@holo-js/auth-workos 0.1.5 → 0.1.6

package/dist/index.mjs

@@ -235,9 +235,23 @@ async function verifyWorkosSessionToken(token, config) {
     throw new Error("[@holo-js/auth-workos] WorkOS token signature verification failed.");
   }
   const exp = typeof parsed.payload.exp === "number" ? parsed.payload.exp : void 0;
-  if (typeof exp === "number" && exp * 1e3 <= Date.now()) {
+  if (typeof exp !== "number") {
+    throw new Error("[@holo-js/auth-workos] WorkOS token did not include an expiration.");
+  }
+  if (exp * 1e3 <= Date.now()) {
     throw new Error("[@holo-js/auth-workos] WorkOS token has expired.");
   }
+  if (typeof parsed.payload.sub !== "string" || !parsed.payload.sub.trim()) {
+    throw new Error("[@holo-js/auth-workos] WorkOS token did not include a subject.");
+  }
+  if ((typeof parsed.payload.sid !== "string" || !parsed.payload.sid.trim()) && (typeof parsed.payload.session_id !== "string" || !parsed.payload.session_id.trim())) {
+    throw new Error("[@holo-js/auth-workos] WorkOS token did not include a session id.");
+  }
+  const audience = parsed.payload.aud;
+  const audiences = Array.isArray(audience) ? audience.filter((value) => typeof value === "string") : typeof audience === "string" ? [audience] : [];
+  if (!audiences.includes(clientId)) {
+    throw new Error(`[@holo-js/auth-workos] WorkOS token audience is not valid for client "${clientId}".`);
+  }
   const nbf = typeof parsed.payload.nbf === "number" ? parsed.payload.nbf : void 0;
   if (typeof nbf === "number" && nbf * 1e3 > Date.now()) {
     throw new Error("[@holo-js/auth-workos] WorkOS token is not valid yet.");
@@ -444,10 +458,23 @@ function createLogoutUrl(sessionId, request, returnTo) {
   const url = new URL(WORKOS_LOGOUT_URL);
   url.searchParams.set("session_id", sessionId);
   if (returnTo?.trim()) {
-    url.searchParams.set("return_to", new URL(returnTo, request.url).toString());
+    url.searchParams.set("return_to", createWorkosReturnUrl(returnTo, request));
   }
   return url.toString();
 }
+function createWorkosReturnUrl(returnTo, request) {
+  const requestUrl = new URL(request.url);
+  let target;
+  try {
+    target = new URL(returnTo, requestUrl.origin);
+  } catch {
+    return requestUrl.origin;
+  }
+  if (target.origin !== requestUrl.origin) {
+    return requestUrl.origin;
+  }
+  return target.toString();
+}
 function createWorkosErrorResponse(error, code) {
   return Response.json({
     ok: false,
@@ -670,21 +697,6 @@ async function ensureNoUnexpectedEmailCollision(adapter, providerName, profile,
     });
   }
 }
-async function assertUserLinkAvailable(providerName, authProvider, adapter, user, workosUserId) {
-  const existing = await getBindings().identityStore.findByUserId(
-    providerName,
-    authProvider,
-    requireUserId(adapter, user, "[@holo-js/auth-workos] Linked users must expose a serializable id.")
-  );
-  if (existing && existing.providerUserId !== workosUserId) {
-    throw new WorkosAuthConflictError({
-      provider: providerName,
-      workosUserId,
-      email: existing.email,
-      message: `[@holo-js/auth-workos] Local user is already linked to WorkOS identity "${existing.providerUserId}".`
-    });
-  }
-}
 function isEmailVerificationRequired() {
   return authRuntimeInternals.getRuntimeBindings().config.emailVerification.required === true;
 }
@@ -855,16 +867,19 @@ async function syncIdentity(session, provider, options = {}) {
     const existingLinkedUser = await adapter.findById(existingIdentity.userId);
     let linkedUser = existingLinkedUser ? requireUserRecord(existingLinkedUser, "[@holo-js/auth-workos] Auth provider lookups must return object users.") : null;
     if (!linkedUser) {
-      linkedUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
-      if (linkedUser) {
-        await assertUserLinkAvailable(providerName, authProvider, adapter, linkedUser, profile.id);
-      }
-      if (!linkedUser) {
-        linkedUser = requireUserRecord(
-          await adapter.create(resolveCreateUserInput(profile, options.user)),
-          "[@holo-js/auth-workos] Auth provider create() must return an object user."
-        );
+      const emailMatchedUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
+      if (emailMatchedUser) {
+        throw new WorkosAuthConflictError({
+          provider: providerName,
+          workosUserId: profile.id,
+          email: verifiedEmail,
+          message: `[@holo-js/auth-workos] WorkOS email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
+        });
       }
+      linkedUser = requireUserRecord(
+        await adapter.create(resolveCreateUserInput(profile, options.user)),
+        "[@holo-js/auth-workos] Auth provider create() must return an object user."
+      );
       const relinked = await updateLocalUser(adapter, linkedUser, resolveUpdateUserInput(profile, options.user));
       const relinkedUser = relinked.user;
       const identity3 = createIdentityRecord({
@@ -926,28 +941,11 @@ async function syncIdentity(session, provider, options = {}) {
   }
   let localUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
   if (localUser) {
-    await assertUserLinkAvailable(providerName, authProvider, adapter, localUser, profile.id);
-    const linked = await updateLocalUser(adapter, localUser, resolveUpdateUserInput(profile, options.user));
-    const identity2 = createIdentityRecord({
-      provider: providerName,
-      guard,
-      authProvider,
-      userId: requireUserId(
-        adapter,
-        linked.user,
-        "[@holo-js/auth-workos] Linked local users must expose a serializable id."
-      ),
-      profile
-    });
-    await identityStore.save(identity2);
-    return Object.freeze({
+    throw new WorkosAuthConflictError({
       provider: providerName,
-      guard,
-      authProvider,
-      status: "linked",
-      user: serializeLocalUser(adapter, linked.user, authProvider),
-      identity: identity2,
-      session
+      workosUserId: profile.id,
+      email: verifiedEmail,
+      message: `[@holo-js/auth-workos] WorkOS email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
     });
   }
   localUser = requireUserRecord(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/auth-workos",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Holo-JS Framework - WorkOS auth integration contracts",
   "type": "module",
   "license": "MIT",
@@ -23,9 +23,9 @@
     "test": "vitest --run"
   },
   "dependencies": {
-    "@holo-js/auth": "^0.1.5",
-    "@holo-js/config": "^0.1.5",
-    "@holo-js/session": "^0.1.5"
+    "@holo-js/auth": "^0.1.6",
+    "@holo-js/config": "^0.1.6",
+    "@holo-js/session": "^0.1.6"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",