@incorta/auth 1.0.0

package/dist/index.js

@@ -0,0 +1,613 @@
+// src/core/config.ts
+function required(value, name, envVar) {
+  if (!value) {
+    throw new Error(
+      `[incorta-auth] Missing required config "${name}" (or env var ${envVar}).`
+    );
+  }
+  return value;
+}
+function stripTrailingSlash(url) {
+  return url.replace(/\/+$/, "");
+}
+function resolveConfig(input = {}) {
+  const env = globalThis.process?.env ?? {};
+  const incortaUrl = stripTrailingSlash(
+    required(input.incortaUrl ?? env.INCORTA_URL, "incortaUrl", "INCORTA_URL")
+  );
+  const tenant = required(input.tenant ?? env.INCORTA_TENANT, "tenant", "INCORTA_TENANT");
+  const clientId = required(
+    input.clientId ?? env.INCORTA_CLIENT_ID,
+    "clientId",
+    "INCORTA_CLIENT_ID"
+  );
+  const clientSecret = required(
+    input.clientSecret ?? env.INCORTA_CLIENT_SECRET,
+    "clientSecret",
+    "INCORTA_CLIENT_SECRET"
+  );
+  const secret = required(
+    input.secret ?? env.INCORTA_AUTH_SECRET,
+    "secret",
+    "INCORTA_AUTH_SECRET"
+  );
+  if (secret.length < 32) {
+    throw new Error(
+      "[incorta-auth] `secret` must be at least 32 characters. Generate one with: openssl rand -base64 32"
+    );
+  }
+  const basePath = input.basePath ?? "/auth";
+  if (!basePath.startsWith("/") || basePath.endsWith("/")) {
+    throw new Error(
+      `[incorta-auth] basePath must start with "/" and not end with "/" (got "${basePath}").`
+    );
+  }
+  const appUrl = input.appUrl ?? env.INCORTA_APP_URL;
+  const cookieName = input.session?.cookieName ?? "incorta_auth_session";
+  const issuer = `${incortaUrl}/oauth/${tenant}`;
+  return {
+    incortaUrl,
+    tenant,
+    clientId,
+    clientSecret,
+    secret,
+    basePath,
+    appUrl: appUrl ? stripTrailingSlash(appUrl) : void 0,
+    scope: input.scope ?? "openid profile email",
+    cookieName,
+    stateCookieName: `${cookieName}_state`,
+    sessionMaxAge: input.session?.maxAge ?? 12 * 60 * 60,
+    secureCookies: input.cookies?.secure ?? "auto",
+    exposeAccessToken: input.exposeAccessToken ?? false,
+    issuer,
+    discoveryUrl: input.advanced?.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`,
+    jwksOverride: input.advanced?.jwks,
+    fetch: input.advanced?.fetch ?? fetch
+  };
+}
+
+// src/core/handler.ts
+import { randomBytes } from "crypto";
+
+// src/core/cookies.ts
+function parseCookies(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    const name = part.slice(0, eq).trim();
+    if (!name) continue;
+    let value = part.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"')) value = value.slice(1, -1);
+    try {
+      out[name] = decodeURIComponent(value);
+    } catch {
+      out[name] = value;
+    }
+  }
+  return out;
+}
+function serializeCookie(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  parts.push(`Path=${options.path ?? "/"}`);
+  if (options.maxAge !== void 0) {
+    parts.push(`Max-Age=${Math.floor(options.maxAge)}`);
+    parts.push(`Expires=${new Date(Date.now() + options.maxAge * 1e3).toUTCString()}`);
+  }
+  if (options.httpOnly ?? true) parts.push("HttpOnly");
+  if (options.secure) parts.push("Secure");
+  const sameSite = options.sameSite ?? "lax";
+  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+  return parts.join("; ");
+}
+function deleteCookie(name, options = {}) {
+  return serializeCookie(name, "", { ...options, maxAge: 0 });
+}
+
+// src/core/discovery.ts
+import { createRemoteJWKSet } from "jose";
+var endpointsCache = /* @__PURE__ */ new Map();
+function getEndpoints(config) {
+  const cached = endpointsCache.get(config.issuer);
+  if (cached) return cached;
+  const promise = resolve(config).catch((error) => {
+    endpointsCache.delete(config.issuer);
+    throw error;
+  });
+  endpointsCache.set(config.issuer, promise);
+  return promise;
+}
+async function resolve(config) {
+  const fallback = {
+    issuer: config.issuer,
+    authorization_endpoint: `${config.issuer}/authorize`,
+    token_endpoint: `${config.issuer}/token`,
+    jwks_uri: `${config.issuer}/.well-known/jwks.json`
+  };
+  let doc = fallback;
+  try {
+    const response = await config.fetch(config.discoveryUrl, {
+      headers: { accept: "application/json" }
+    });
+    if (response.ok) {
+      const body = await response.json();
+      doc = {
+        issuer: body.issuer ?? fallback.issuer,
+        authorization_endpoint: body.authorization_endpoint ?? fallback.authorization_endpoint,
+        token_endpoint: body.token_endpoint ?? fallback.token_endpoint,
+        jwks_uri: body.jwks_uri ?? fallback.jwks_uri
+      };
+    }
+  } catch {
+  }
+  const jwks = config.jwksOverride ?? createRemoteJWKSet(new URL(doc.jwks_uri), {
+    cacheMaxAge: 10 * 60 * 1e3,
+    cooldownDuration: 30 * 1e3
+  });
+  return {
+    issuer: doc.issuer,
+    authorizationEndpoint: doc.authorization_endpoint,
+    tokenEndpoint: doc.token_endpoint,
+    jwks
+  };
+}
+
+// src/core/session.ts
+import { createHash } from "crypto";
+import { EncryptJWT, jwtDecrypt } from "jose";
+function sealKey(config) {
+  return new Uint8Array(
+    createHash("sha256").update(`incorta-auth:${config.secret}`).digest()
+  );
+}
+async function seal(config, purpose, data, maxAgeSeconds) {
+  return new EncryptJWT({ purpose, data }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${maxAgeSeconds}s`).encrypt(sealKey(config));
+}
+async function unseal(config, purpose, cookieValue) {
+  if (!cookieValue) return null;
+  try {
+    const { payload } = await jwtDecrypt(cookieValue, sealKey(config));
+    if (payload.purpose !== purpose) return null;
+    return {
+      data: payload.data,
+      issuedAt: (payload.iat ?? 0) * 1e3,
+      expiresAt: (payload.exp ?? 0) * 1e3
+    };
+  } catch {
+    return null;
+  }
+}
+function sealSession(config, session) {
+  return seal(config, "session", session, config.sessionMaxAge);
+}
+async function unsealSession(config, cookieValue) {
+  const result = await unseal(config, "session", cookieValue);
+  if (!result) return null;
+  const { data, issuedAt, expiresAt } = result;
+  if (!data || typeof data !== "object" || !data.user || !data.accessToken) return null;
+  return { session: data, issuedAt, expiresAt };
+}
+var STATE_MAX_AGE_SECONDS = 10 * 60;
+function sealLoginState(config, state) {
+  return seal(config, "state", state, STATE_MAX_AGE_SECONDS);
+}
+async function unsealLoginState(config, cookieValue) {
+  const result = await unseal(config, "state", cookieValue);
+  if (!result) return null;
+  const { data } = result;
+  if (!data || typeof data.state !== "string" || typeof data.nonce !== "string") return null;
+  return data;
+}
+
+// src/core/tokens.ts
+import { decodeJwt, jwtVerify } from "jose";
+var IncortaAuthError = class extends Error {
+  constructor(code, message) {
+    super(`[incorta-auth] ${message}`);
+    this.code = code;
+    this.name = "IncortaAuthError";
+  }
+  code;
+};
+function basicAuth(config) {
+  const raw = `${config.clientId}:${config.clientSecret}`;
+  return `Basic ${Buffer.from(raw, "utf8").toString("base64")}`;
+}
+async function callTokenEndpoint(config, params) {
+  const { tokenEndpoint } = await getEndpoints(config);
+  let response;
+  try {
+    response = await config.fetch(tokenEndpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json",
+        authorization: basicAuth(config)
+      },
+      body: new URLSearchParams(params).toString()
+    });
+  } catch (error) {
+    throw new IncortaAuthError(
+      "incorta_unreachable",
+      `Could not reach the Incorta token endpoint (${tokenEndpoint}): ${error.message}`
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new IncortaAuthError(
+      "invalid_token_response",
+      `Token endpoint returned a non-JSON response (HTTP ${response.status}).`
+    );
+  }
+  if (!response.ok || !body.access_token) {
+    throw new IncortaAuthError(
+      body.error ?? "token_exchange_failed",
+      body.error_description ?? `Token exchange failed (HTTP ${response.status}).`
+    );
+  }
+  const { exp } = decodeJwt(body.access_token);
+  return {
+    accessToken: body.access_token,
+    accessTokenExpiresAt: exp ? exp * 1e3 : Date.now() + 60 * 60 * 1e3,
+    idToken: body.id_token,
+    refreshToken: body.refresh_token
+  };
+}
+function exchangeCode(config, code, redirectUri) {
+  return callTokenEndpoint(config, {
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri
+  });
+}
+function refreshTokens(config, refreshToken) {
+  return callTokenEndpoint(config, {
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+}
+async function verifyJwt(config, token) {
+  const { jwks, issuer } = await getEndpoints(config);
+  try {
+    const { payload } = await jwtVerify(token, jwks, {
+      issuer,
+      audience: config.clientId,
+      algorithms: ["RS256"]
+    });
+    return payload;
+  } catch (error) {
+    throw new IncortaAuthError(
+      "invalid_token",
+      `Token verification failed: ${error.message}`
+    );
+  }
+}
+async function verifyAccessToken(config, accessToken) {
+  return verifyJwt(config, accessToken);
+}
+async function verifyIdToken(config, idToken, expectedNonce) {
+  const payload = await verifyJwt(config, idToken);
+  if (payload.nonce !== expectedNonce) {
+    throw new IncortaAuthError("nonce_mismatch", "ID token nonce does not match the login request.");
+  }
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    throw new IncortaAuthError("invalid_token", "ID token is missing the sub claim.");
+  }
+  const roles = Array.isArray(payload.roles) ? payload.roles.filter((role) => typeof role === "string") : [];
+  return {
+    sub: payload.sub,
+    name: typeof payload.name === "string" ? payload.name : void 0,
+    email: typeof payload.email === "string" ? payload.email : void 0,
+    roles,
+    tenant: typeof payload.tenant === "string" ? payload.tenant : config.tenant
+  };
+}
+async function userFromAccessToken(config, accessToken) {
+  const payload = await verifyAccessToken(config, accessToken);
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    throw new IncortaAuthError("invalid_token", "Access token is missing the sub claim.");
+  }
+  return {
+    sub: payload.sub,
+    roles: [],
+    tenant: typeof payload.tenant === "string" ? payload.tenant : config.tenant
+  };
+}
+
+// src/core/handler.ts
+var ACCESS_TOKEN_REFRESH_LEEWAY_MS = 60 * 1e3;
+function requestOrigin(config, request) {
+  if (config.appUrl) return config.appUrl;
+  const url = new URL(request.url);
+  const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim() ?? url.protocol.replace(":", "");
+  const host = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim() ?? request.headers.get("host") ?? url.host;
+  return `${proto}://${host}`;
+}
+function isSecureRequest(config, request) {
+  if (config.secureCookies !== "auto") return config.secureCookies;
+  return requestOrigin(config, request).startsWith("https://");
+}
+function validateReturnTo(raw, origin) {
+  if (!raw) return "/";
+  if (raw.startsWith("/") && !raw.startsWith("//")) return raw;
+  try {
+    const url = new URL(raw);
+    if (url.origin === origin) return `${url.pathname}${url.search}${url.hash}` || "/";
+  } catch {
+  }
+  return "/";
+}
+function json(status, body, cookies = []) {
+  const headers = new Headers({
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  for (const cookie of cookies) headers.append("set-cookie", cookie);
+  return new Response(JSON.stringify(body), { status, headers });
+}
+function redirect(location, cookies = []) {
+  const headers = new Headers({ location, "cache-control": "no-store" });
+  for (const cookie of cookies) headers.append("set-cookie", cookie);
+  return new Response(null, { status: 302, headers });
+}
+function withErrorParam(target, code) {
+  const separator = target.includes("?") ? "&" : "?";
+  return `${target}${separator}incorta_auth_error=${encodeURIComponent(code)}`;
+}
+function randomToken() {
+  return randomBytes(16).toString("base64url");
+}
+function createHandler(config) {
+  const sessionCookieOptions = (secure) => ({
+    httpOnly: true,
+    secure,
+    sameSite: "lax",
+    path: "/"
+  });
+  async function login(request, url) {
+    const origin = requestOrigin(config, request);
+    const secure = isSecureRequest(config, request);
+    const returnTo = validateReturnTo(url.searchParams.get("redirect_to"), origin);
+    const cookies = parseCookies(request.headers.get("cookie"));
+    const existing = await unsealSession(config, cookies[config.cookieName]);
+    if (existing) return redirect(returnTo);
+    const state = randomToken();
+    const nonce = randomToken();
+    const stateCookie = serializeCookie(
+      config.stateCookieName,
+      await sealLoginState(config, { state, nonce, returnTo }),
+      { ...sessionCookieOptions(secure), maxAge: 600 }
+    );
+    const { authorizationEndpoint } = await getEndpoints(config);
+    const authorizeUrl = new URL(authorizationEndpoint);
+    authorizeUrl.searchParams.set("response_type", "code");
+    authorizeUrl.searchParams.set("client_id", config.clientId);
+    authorizeUrl.searchParams.set("redirect_uri", `${origin}${config.basePath}/callback`);
+    authorizeUrl.searchParams.set("scope", config.scope);
+    authorizeUrl.searchParams.set("state", state);
+    authorizeUrl.searchParams.set("nonce", nonce);
+    return redirect(authorizeUrl.toString(), [stateCookie]);
+  }
+  async function callback(request, url) {
+    const origin = requestOrigin(config, request);
+    const secure = isSecureRequest(config, request);
+    const cookies = parseCookies(request.headers.get("cookie"));
+    const clearState = deleteCookie(config.stateCookieName, sessionCookieOptions(secure));
+    const loginState = await unsealLoginState(config, cookies[config.stateCookieName]);
+    const returnTo = validateReturnTo(loginState?.returnTo ?? null, origin);
+    const fail = (code2) => redirect(withErrorParam(returnTo, code2), [clearState]);
+    const oauthError = url.searchParams.get("error");
+    if (oauthError) return fail(oauthError);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (!code || !state) return fail("missing_code");
+    if (!loginState) return fail("state_missing");
+    if (state !== loginState.state) return fail("state_mismatch");
+    try {
+      const tokens = await exchangeCode(config, code, `${origin}${config.basePath}/callback`);
+      const user = tokens.idToken ? await verifyIdToken(config, tokens.idToken, loginState.nonce) : await userFromAccessToken(config, tokens.accessToken);
+      const session = {
+        user,
+        accessToken: tokens.accessToken,
+        accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+        refreshToken: tokens.refreshToken,
+        createdAt: Date.now()
+      };
+      const sessionCookie = serializeCookie(
+        config.cookieName,
+        await sealSession(config, session),
+        { ...sessionCookieOptions(secure), maxAge: config.sessionMaxAge }
+      );
+      return redirect(returnTo, [sessionCookie, clearState]);
+    } catch (error) {
+      const code2 = error instanceof IncortaAuthError ? error.code : "callback_failed";
+      return fail(code2);
+    }
+  }
+  async function loadSession(request) {
+    const secure = isSecureRequest(config, request);
+    const cookies = parseCookies(request.headers.get("cookie"));
+    const unsealed = await unsealSession(config, cookies[config.cookieName]);
+    if (!unsealed) return { session: null, sessionExpiresAt: 0, setCookies: [] };
+    let { session } = unsealed;
+    let mustReseal = false;
+    const now = Date.now();
+    if (session.accessTokenExpiresAt - now < ACCESS_TOKEN_REFRESH_LEEWAY_MS) {
+      if (session.refreshToken) {
+        try {
+          const tokens = await refreshTokens(config, session.refreshToken);
+          session = {
+            ...session,
+            accessToken: tokens.accessToken,
+            accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+            refreshToken: tokens.refreshToken ?? session.refreshToken
+          };
+          mustReseal = true;
+        } catch {
+          if (session.accessTokenExpiresAt <= now) {
+            return {
+              session: null,
+              sessionExpiresAt: 0,
+              setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))]
+            };
+          }
+        }
+      } else if (session.accessTokenExpiresAt <= now) {
+        return {
+          session: null,
+          sessionExpiresAt: 0,
+          setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))]
+        };
+      }
+    }
+    const halfLifeMs = config.sessionMaxAge * 1e3 / 2;
+    if (now - unsealed.issuedAt > halfLifeMs) mustReseal = true;
+    if (!mustReseal) {
+      return { session, sessionExpiresAt: unsealed.expiresAt, setCookies: [] };
+    }
+    const resealed = serializeCookie(config.cookieName, await sealSession(config, session), {
+      ...sessionCookieOptions(secure),
+      maxAge: config.sessionMaxAge
+    });
+    return {
+      session,
+      sessionExpiresAt: now + config.sessionMaxAge * 1e3,
+      setCookies: [resealed]
+    };
+  }
+  async function sessionRoute(request) {
+    const { session, sessionExpiresAt, setCookies } = await loadSession(request);
+    if (!session) return json(200, { user: null }, setCookies);
+    return json(
+      200,
+      {
+        user: session.user,
+        session: {
+          expiresAt: sessionExpiresAt,
+          accessTokenExpiresAt: session.accessTokenExpiresAt
+        }
+      },
+      setCookies
+    );
+  }
+  async function tokenRoute(request) {
+    if (!config.exposeAccessToken) return json(404, { error: "not_found" });
+    const { session, setCookies } = await loadSession(request);
+    if (!session) return json(401, { error: "unauthenticated" }, setCookies);
+    return json(
+      200,
+      { accessToken: session.accessToken, expiresAt: session.accessTokenExpiresAt },
+      setCookies
+    );
+  }
+  async function logout(request, url) {
+    const secure = isSecureRequest(config, request);
+    const clearSession = deleteCookie(config.cookieName, sessionCookieOptions(secure));
+    if (request.method === "GET") {
+      const origin = requestOrigin(config, request);
+      const returnTo = validateReturnTo(url.searchParams.get("redirect_to"), origin);
+      return redirect(returnTo, [clearSession]);
+    }
+    return json(200, { ok: true }, [clearSession]);
+  }
+  async function handler(request) {
+    const url = new URL(request.url);
+    if (url.pathname !== config.basePath && !url.pathname.startsWith(`${config.basePath}/`)) {
+      return json(404, { error: "not_found" });
+    }
+    const route = url.pathname.slice(config.basePath.length) || "/";
+    const method = request.method.toUpperCase();
+    try {
+      if (route === "/login" && method === "GET") return await login(request, url);
+      if (route === "/callback" && method === "GET") return await callback(request, url);
+      if (route === "/session" && method === "GET") return await sessionRoute(request);
+      if (route === "/token" && method === "GET") return await tokenRoute(request);
+      if (route === "/logout" && (method === "POST" || method === "GET")) {
+        return await logout(request, url);
+      }
+      return json(404, { error: "not_found" });
+    } catch (error) {
+      const code = error instanceof IncortaAuthError ? error.code : "internal_error";
+      const message = error instanceof Error ? error.message : "Unexpected incorta-auth handler error";
+      console.error(`[incorta-auth] ${route} failed:`, message);
+      return json(500, { error: code });
+    }
+  }
+  async function getSession(request) {
+    const cookies = parseCookies(request.headers.get("cookie"));
+    const unsealed = await unsealSession(config, cookies[config.cookieName]);
+    if (!unsealed) return null;
+    const { session, expiresAt } = unsealed;
+    if (session.accessTokenExpiresAt <= Date.now() && !session.refreshToken) return null;
+    return {
+      user: session.user,
+      accessToken: session.accessToken,
+      accessTokenExpiresAt: session.accessTokenExpiresAt,
+      expiresAt
+    };
+  }
+  return { handler, getSession };
+}
+
+// src/core/register.ts
+async function registerClient(options) {
+  const {
+    incortaUrl,
+    tenant,
+    name,
+    redirectUris,
+    scope = "openid profile email",
+    grantTypes = ["authorization_code", "refresh_token"],
+    fetchImpl = fetch
+  } = options;
+  if (!redirectUris.length) {
+    throw new Error("[incorta-auth] registerClient requires at least one redirect URI.");
+  }
+  const endpoint = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({
+      client_name: name,
+      redirect_uris: redirectUris,
+      grant_types: grantTypes,
+      scope,
+      token_endpoint_auth_method: "client_secret_basic"
+    })
+  });
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new Error(
+      `[incorta-auth] Client registration returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
+    );
+  }
+  if (!response.ok || !body.client_id || !body.client_secret) {
+    throw new Error(
+      `[incorta-auth] Client registration failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+    );
+  }
+  return {
+    clientId: body.client_id,
+    clientSecret: body.client_secret,
+    registrationAccessToken: body.registration_access_token,
+    registrationClientUri: body.registration_client_uri
+  };
+}
+
+// src/index.ts
+function createIncortaAuth(config = {}) {
+  const resolved = resolveConfig(config);
+  const { handler, getSession } = createHandler(resolved);
+  return { handler, getSession, config: resolved };
+}
+export {
+  IncortaAuthError,
+  createIncortaAuth,
+  registerClient
+};
+//# sourceMappingURL=index.js.map