@ibgib/node-gib 0.0.14 → 0.0.17

package/src/identity/sso/custodian-auth-helpers.respec.mts

@@ -0,0 +1,97 @@
+import {
+    respecfully,
+    iReckon,
+    ifWe
+} from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+
+import {
+    deriveCustodianAuthCode,
+    generateCustodianRequirements,
+    getAuthCustodianIndex,
+    verifyCustodianRequirements
+} from './custodian-auth-helpers.mjs';
+
+const maam = `[${import.meta.url}]`, sir = maam;
+
+await respecfully(sir, 'CustodianAuthHelpers', async () => {
+    const serverSecret = 'test-server-kdf-secret-123456789';
+    const primaryTjpAddr = 'keystone^1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef';
+
+    await ifWe(sir, 'generate custodian requirements cleanly with derived auth code', async () => {
+        const reqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+            ttlMs: 60 * 1000,
+            allowedVerbs: ['sync', 'connect']
+        });
+
+        iReckon(sir, reqs).not.isGonnaBeUndefined();
+        iReckon(sir, reqs.primaryTjpAddr).isGonnaBe(primaryTjpAddr);
+        iReckon(sir, reqs.allowedVerbs).willEqual(['sync', 'connect']);
+        iReckon(sir, reqs.nonce.length > 10).isGonnaBeTrue();
+        iReckon(sir, reqs.authCode.length > 20).isGonnaBeTrue();
+        iReckon(sir, reqs.expiresAt > Date.now()).isGonnaBeTrue();
+    });
+
+    await ifWe(sir, 'verify valid custodian requirements successfully', async () => {
+        const reqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+        });
+
+        const verifyRes = await verifyCustodianRequirements({
+            custodianReqs: reqs,
+            serverSecret
+        });
+
+        iReckon(sir, verifyRes.valid).isGonnaBeTrue();
+        iReckon(sir, verifyRes.error).isGonnaBeUndefined();
+    });
+
+    await ifWe(sir, 'fail verification if payload or authCode is tampered', async () => {
+        const reqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+        });
+
+        // Tamper with allowedVerbs
+        const tamperedReqs = { ...reqs, allowedVerbs: ['sync', 'connect', 'manage'] };
+
+        const verifyRes = await verifyCustodianRequirements({
+            custodianReqs: tamperedReqs,
+            serverSecret
+        });
+
+        iReckon(sir, verifyRes.valid).isGonnaBeFalse();
+        iReckon(sir, verifyRes.error).includes('mismatch');
+    });
+
+    await ifWe(sir, 'fail verification if requirements are expired', async () => {
+        const expiredReqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+            ttlMs: -1000 // expired 1s ago
+        });
+
+        const verifyRes = await verifyCustodianRequirements({
+            custodianReqs: expiredReqs,
+            serverSecret
+        });
+
+        iReckon(sir, verifyRes.valid).isGonnaBeFalse();
+        iReckon(sir, verifyRes.error).includes('expired');
+    });
+
+    await ifWe(sir, 'calculate deterministic authCustodianIndex for atomic file reservation', async () => {
+        const reqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+        });
+
+        const index1 = await getAuthCustodianIndex({ custodianReqs: reqs });
+        const index2 = await getAuthCustodianIndex({ custodianReqs: reqs });
+
+        iReckon(sir, index1).isGonnaBe(index2);
+        iReckon(sir, index1.length).isGonnaBe(64); // SHA-256 hash length
+    });
+});

package/src/identity/sso/sso-config-helper.mts

@@ -0,0 +1,52 @@
+import { SsoServerConfig, SsoProviderServerConfig, SsoProviderId } from './sso-types.mjs';
+
+/**
+ * Loads the SSO configuration from environment variables.
+ * Parses active OAuth2 providers dynamically based on their environment keys.
+ */
+export function loadSsoServerConfig(): SsoServerConfig {
+    const ssoServerKdfSecret = process.env.SSO_SERVER_KDF_SECRET;
+    const sessionSecret = process.env.SESSION_SECRET;
+
+    if (!ssoServerKdfSecret) {
+        throw new Error(
+            `SSO_SERVER_KDF_SECRET is missing from environment. (E: 840899ab4fdfd23e89cfae1889cfae12)`
+        );
+    }
+    if (!sessionSecret) {
+        throw new Error(
+            `SESSION_SECRET is missing from environment. (E: bfa899ab4fdfd23e89cfae23)`
+        );
+    }
+
+    const providers: Partial<Record<SsoProviderId, SsoProviderServerConfig>> = {};
+
+    // Load Google Provider if configured
+    if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
+        providers.google = {
+            providerId: 'google',
+            clientId: process.env.GOOGLE_CLIENT_ID,
+            clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+            tokenUrl: 'https://oauth2.googleapis.com/token',
+            userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+            jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
+        };
+    }
+
+    // Load GitHub Provider if configured
+    if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {
+        providers.github = {
+            providerId: 'github',
+            clientId: process.env.GITHUB_CLIENT_ID,
+            clientSecret: process.env.GITHUB_CLIENT_SECRET,
+            tokenUrl: 'https://github.com/login/oauth/access_token',
+            userInfoUrl: 'https://api.github.com/user'
+        };
+    }
+
+    return {
+        ssoServerKdfSecret,
+        sessionSecret,
+        providers
+    };
+}