@incorta/auth 1.1.1 → 1.3.0

package/README.md

@@ -8,7 +8,7 @@ guide; this is the API surface.
 
 | Import                  | What's in it                                                        |
 | ----------------------- | ------------------------------------------------------------------- |
-| `@incorta/auth`         | `createIncortaAuth`, `registerClient`, `getClient`, `updateClientRedirectUris`, types (`IncortaUser`, `AuthSession`, …) |
+| `@incorta/auth`         | `createIncortaAuth`, `registerClient`, `getClient`, `updateClientRedirectUris`, `deleteClient`, types (`IncortaUser`, `AuthSession`, …) |
 | `@incorta/auth/react`   | `IncortaAuthProvider`, `useAuth`, `useUser`, `SignedIn`, `SignedOut`, `Protect`, `RedirectToLogin` |
 | `@incorta/auth/express` | `incortaAuth(auth)` middleware, `requireAuth(auth, options?)`        |
 | `@incorta/auth/node`    | `toNodeHandler(auth)`, `toWebRequest`, `sendWebResponse`, `getNodeSession` |
@@ -35,7 +35,11 @@ Returns `{ handler, getSession, config }`:
   for server code (`user`, `accessToken`, `accessTokenExpiresAt`, `expiresAt`).
 
 Config falls back to `INCORTA_URL`, `INCORTA_TENANT`, `INCORTA_CLIENT_ID`,
-`INCORTA_CLIENT_SECRET`, `INCORTA_AUTH_SECRET`, `INCORTA_APP_URL`.
+`INCORTA_CLIENT_SECRET`, `INCORTA_AUTH_SECRET`, `INCORTA_APP_URL`, and
+`INCORTA_INTERNAL_URL` (split horizon: server-side discovery/token/JWKS calls
+use it when the public `incortaUrl` is not routable from the app — e.g.
+`http://host.docker.internal:8080/incorta` from a local container; the
+authorize redirect and issuer validation stay on the public URL).
 
 ## Session model
 
@@ -44,6 +48,15 @@ The cookie is an encrypted JWT (JWE `dir`/`A256GCM`, key derived from
 claims (`sub`, `name`, `email`, `roles`, `tenant`) + the Incorta access/refresh
 tokens. Nothing is stored server-side.
 
+**Embedded (cross-site iframe) mode**: when the app runs inside an iframe on a
+DIFFERENT site, `Lax` cookies are never sent — the login flow loops forever.
+Set `cookies: { sameSite: "none", partitioned: true }` (or env
+`INCORTA_COOKIE_SAMESITE=none` + `INCORTA_COOKIE_PARTITIONED=1`): the auth
+cookies become `SameSite=None; Secure; Partitioned` (CHIPS), which modern
+Chrome allows in third-party iframes with a per-embedder cookie jar. `none`
+forces `Secure` (accepted on trustworthy plain-http origins like
+`*.localhost`); top-level usage keeps working with the same setting.
+
 ## CLI
 
 ```bash
@@ -54,12 +67,16 @@ incorta-auth show --url ... --tenant ... --client <id> --rat <token> [--json]
 
 incorta-auth update-redirects --url ... --tenant ... --client <id> --rat <token> \
   --redirect <url> [--redirect ...] [--replace] [--json]
+
+incorta-auth delete --url ... --tenant ... --client <id> --rat <token>
 ```
 
 `register` creates the OAuth client via RFC 7591 dynamic registration and
 prints the `.env` entries (keep the registration access token). `show` and
 `update-redirects` manage the registered client's allowed callback URLs —
-adding by default, replacing the whole set with `--replace`.
+adding by default, replacing the whole set with `--replace`. `delete` removes
+the registration (new logins stop immediately; issued sessions live until
+they expire).
 
 ## Testing
 

package/dist/cli.js

@@ -118,6 +118,19 @@ async function updateClientRedirectUris(options) {
   }
   return getClient(options);
 }
+async function deleteClient(options) {
+  const { incortaUrl, tenant, clientId, registrationAccessToken, fetchImpl = fetch } = options;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    method: "DELETE",
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    }
+  });
+  if (!response.ok) {
+    await readJson(response, "Deleting the client");
+  }
+}
 
 // src/cli.ts
 var HELP = `incorta-auth \u2014 IncortaAuth SDK helper
@@ -135,14 +148,19 @@ Usage:
                                 --redirect <callbackUrl> [--redirect ...] \\
                                 [--replace] [--json]
 
+  incorta-auth delete --url <incortaUrl> --tenant <tenant> \\
+                      --client <clientId> --rat <registrationAccessToken>
+
 register          Registers an OAuth client in Incorta (RFC 7591 dynamic
                   registration) and prints the .env entries your app needs.
                   Keep the printed registration access token \u2014 it is the key
-                  for show/update-redirects later.
+                  for show/update-redirects/delete later.
 show              Prints a registered client's current metadata.
 update-redirects  Adds the given callback URLs to the client's allowed set
                   (or replaces the whole set with --replace, which is also how
                   URLs are removed).
+delete            Deletes the client registration. New logins stop
+                  immediately; sessions already issued live until they expire.
 
 Example:
   incorta-auth register \\
@@ -263,6 +281,15 @@ async function runUpdateRedirects(args) {
   console.log(`Redirect URIs ${args.replace ? "replaced" : "updated"}. Current set:`);
   for (const uri of info.redirectUris) console.log(`  - ${uri}`);
 }
+async function runDelete(args) {
+  await deleteClient({
+    incortaUrl: args.url,
+    tenant: args.tenant,
+    clientId: args.client,
+    registrationAccessToken: args.rat
+  });
+  console.log(`Client ${args.client} deleted.`);
+}
 var COMMANDS = {
   register: { required: ["url", "tenant", "name"], needsRedirect: true, run: runRegister },
   show: { required: ["url", "tenant", "client", "rat"], needsRedirect: false, run: runShow },
@@ -270,7 +297,8 @@ var COMMANDS = {
     required: ["url", "tenant", "client", "rat"],
     needsRedirect: true,
     run: runUpdateRedirects
-  }
+  },
+  delete: { required: ["url", "tenant", "client", "rat"], needsRedirect: false, run: runDelete }
 };
 async function main() {
   const [command, ...rest] = process.argv.slice(2);

package/dist/{config-B-2cbZDV.d.cts → config-CHNLJVau.d.cts}

@@ -36,6 +36,16 @@ interface IncortaAuthConfig {
      * or `http://localhost:8080/incorta`. Defaults to `INCORTA_URL`.
      */
     incortaUrl?: string;
+    /**
+     * Split-horizon override: base URL this SERVER should use to reach Incorta
+     * when the public `incortaUrl` is not routable from where the app runs
+     * (containers, cluster-internal DNS) — e.g.
+     * `http://host.docker.internal:8080/incorta` from a local container. Only
+     * server-to-server calls (discovery, token exchange, JWKS) use it; browser
+     * redirects and token `iss` validation stay on the public `incortaUrl`.
+     * Defaults to `INCORTA_INTERNAL_URL`; unset means no rewrite.
+     */
+    internalIncortaUrl?: string;
     /** Incorta tenant name, e.g. `demo`. Defaults to `INCORTA_TENANT`. */
     tenant?: string;
     /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */
@@ -75,6 +85,25 @@ interface IncortaAuthConfig {
          * @default "auto"
          */
         secure?: boolean | "auto";
+        /**
+         * `SameSite` for the session/state cookies. The `"lax"` default is right
+         * for top-level apps. Set `"none"` when the app runs inside a CROSS-SITE
+         * iframe (e.g. an embedded preview) — Lax cookies are never sent there,
+         * which loops the login flow forever. `"none"` forces the `Secure`
+         * attribute (browsers require the pair; Chrome still accepts it on
+         * trustworthy plain-http origins like `*.localhost`). Defaults to
+         * `INCORTA_COOKIE_SAMESITE`.
+         * @default "lax"
+         */
+        sameSite?: "lax" | "none";
+        /**
+         * CHIPS: adds the `Partitioned` attribute, giving each embedding
+         * top-level site its own cookie jar — what modern Chrome requires for
+         * cookies in third-party iframes. Use together with `sameSite: "none"`.
+         * Defaults to `INCORTA_COOKIE_PARTITIONED` (`1`/`true`).
+         * @default false
+         */
+        partitioned?: boolean;
     };
     /**
      * Expose `GET {basePath}/token` returning the raw Incorta access token to the
@@ -94,6 +123,8 @@ interface IncortaAuthConfig {
 }
 interface ResolvedConfig {
     incortaUrl: string;
+    /** Server-side fetch base when set (split horizon) — see the config doc. */
+    internalIncortaUrl?: string;
     tenant: string;
     clientId: string;
     clientSecret: string;
@@ -105,6 +136,8 @@ interface ResolvedConfig {
     stateCookieName: string;
     sessionMaxAge: number;
     secureCookies: boolean | "auto";
+    cookieSameSite: "lax" | "none";
+    cookiePartitioned: boolean;
     exposeAccessToken: boolean;
     /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */
     issuer: string;

package/dist/{config-B-2cbZDV.d.ts → config-CHNLJVau.d.ts}

@@ -36,6 +36,16 @@ interface IncortaAuthConfig {
      * or `http://localhost:8080/incorta`. Defaults to `INCORTA_URL`.
      */
     incortaUrl?: string;
+    /**
+     * Split-horizon override: base URL this SERVER should use to reach Incorta
+     * when the public `incortaUrl` is not routable from where the app runs
+     * (containers, cluster-internal DNS) — e.g.
+     * `http://host.docker.internal:8080/incorta` from a local container. Only
+     * server-to-server calls (discovery, token exchange, JWKS) use it; browser
+     * redirects and token `iss` validation stay on the public `incortaUrl`.
+     * Defaults to `INCORTA_INTERNAL_URL`; unset means no rewrite.
+     */
+    internalIncortaUrl?: string;
     /** Incorta tenant name, e.g. `demo`. Defaults to `INCORTA_TENANT`. */
     tenant?: string;
     /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */
@@ -75,6 +85,25 @@ interface IncortaAuthConfig {
          * @default "auto"
          */
         secure?: boolean | "auto";
+        /**
+         * `SameSite` for the session/state cookies. The `"lax"` default is right
+         * for top-level apps. Set `"none"` when the app runs inside a CROSS-SITE
+         * iframe (e.g. an embedded preview) — Lax cookies are never sent there,
+         * which loops the login flow forever. `"none"` forces the `Secure`
+         * attribute (browsers require the pair; Chrome still accepts it on
+         * trustworthy plain-http origins like `*.localhost`). Defaults to
+         * `INCORTA_COOKIE_SAMESITE`.
+         * @default "lax"
+         */
+        sameSite?: "lax" | "none";
+        /**
+         * CHIPS: adds the `Partitioned` attribute, giving each embedding
+         * top-level site its own cookie jar — what modern Chrome requires for
+         * cookies in third-party iframes. Use together with `sameSite: "none"`.
+         * Defaults to `INCORTA_COOKIE_PARTITIONED` (`1`/`true`).
+         * @default false
+         */
+        partitioned?: boolean;
     };
     /**
      * Expose `GET {basePath}/token` returning the raw Incorta access token to the
@@ -94,6 +123,8 @@ interface IncortaAuthConfig {
 }
 interface ResolvedConfig {
     incortaUrl: string;
+    /** Server-side fetch base when set (split horizon) — see the config doc. */
+    internalIncortaUrl?: string;
     tenant: string;
     clientId: string;
     clientSecret: string;
@@ -105,6 +136,8 @@ interface ResolvedConfig {
     stateCookieName: string;
     sessionMaxAge: number;
     secureCookies: boolean | "auto";
+    cookieSameSite: "lax" | "none";
+    cookiePartitioned: boolean;
     exposeAccessToken: boolean;
     /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */
     issuer: string;

package/dist/express.d.cts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { AuthSession, IncortaAuth } from './index.cjs';
-import './config-B-2cbZDV.cjs';
+import './config-CHNLJVau.cjs';
 import 'jose';
 
 /**

package/dist/express.d.ts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { AuthSession, IncortaAuth } from './index.js';
-import './config-B-2cbZDV.js';
+import './config-CHNLJVau.js';
 import 'jose';
 
 /**

package/dist/index.cjs

@@ -22,6 +22,7 @@ var src_exports = {};
 __export(src_exports, {
   IncortaAuthError: () => IncortaAuthError,
   createIncortaAuth: () => createIncortaAuth,
+  deleteClient: () => deleteClient,
   getClient: () => getClient,
   registerClient: () => registerClient,
   updateClientRedirectUris: () => updateClientRedirectUris
@@ -45,6 +46,7 @@ function resolveConfig(input = {}) {
   const incortaUrl = stripTrailingSlash(
     required(input.incortaUrl ?? env.INCORTA_URL, "incortaUrl", "INCORTA_URL")
   );
+  const internalIncortaUrl = input.internalIncortaUrl ?? env.INCORTA_INTERNAL_URL;
   const tenant = required(input.tenant ?? env.INCORTA_TENANT, "tenant", "INCORTA_TENANT");
   const clientId = required(
     input.clientId ?? env.INCORTA_CLIENT_ID,
@@ -75,8 +77,18 @@ function resolveConfig(input = {}) {
   const appUrl = input.appUrl ?? env.INCORTA_APP_URL;
   const cookieName = input.session?.cookieName ?? "incorta_auth_session";
   const issuer = `${incortaUrl}/oauth/${tenant}`;
+  const envSameSite = env.INCORTA_COOKIE_SAMESITE?.toLowerCase();
+  const cookieSameSite = input.cookies?.sameSite ?? (envSameSite === "none" || envSameSite === "lax" ? envSameSite : "lax");
+  const envPartitioned = env.INCORTA_COOKIE_PARTITIONED?.toLowerCase();
+  const cookiePartitioned = input.cookies?.partitioned ?? (envPartitioned === "1" || envPartitioned === "true");
+  if (cookiePartitioned && cookieSameSite !== "none") {
+    throw new Error(
+      '[incorta-auth] `cookies.partitioned` requires `cookies.sameSite: "none"` \u2014 browsers only partition cross-site cookies.'
+    );
+  }
   return {
     incortaUrl,
+    internalIncortaUrl: internalIncortaUrl ? stripTrailingSlash(internalIncortaUrl) : void 0,
     tenant,
     clientId,
     clientSecret,
@@ -88,6 +100,8 @@ function resolveConfig(input = {}) {
     stateCookieName: `${cookieName}_state`,
     sessionMaxAge: input.session?.maxAge ?? 12 * 60 * 60,
     secureCookies: input.cookies?.secure ?? "auto",
+    cookieSameSite,
+    cookiePartitioned,
     exposeAccessToken: input.exposeAccessToken ?? false,
     issuer,
     discoveryUrl: input.advanced?.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`,
@@ -129,6 +143,7 @@ function serializeCookie(name, value, options = {}) {
   if (options.secure) parts.push("Secure");
   const sameSite = options.sameSite ?? "lax";
   parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+  if (options.partitioned) parts.push("Partitioned");
   return parts.join("; ");
 }
 function deleteCookie(name, options = {}) {
@@ -138,14 +153,20 @@ function deleteCookie(name, options = {}) {
 // src/core/discovery.ts
 var import_jose = require("jose");
 var endpointsCache = /* @__PURE__ */ new Map();
+function toInternal(config, url) {
+  const internal = config.internalIncortaUrl;
+  if (!internal || !url.startsWith(config.incortaUrl)) return url;
+  return internal + url.slice(config.incortaUrl.length);
+}
 function getEndpoints(config) {
-  const cached = endpointsCache.get(config.issuer);
+  const cacheKey = `${config.issuer}|${config.internalIncortaUrl ?? ""}`;
+  const cached = endpointsCache.get(cacheKey);
   if (cached) return cached;
   const promise = resolve(config).catch((error) => {
-    endpointsCache.delete(config.issuer);
+    endpointsCache.delete(cacheKey);
     throw error;
   });
-  endpointsCache.set(config.issuer, promise);
+  endpointsCache.set(cacheKey, promise);
   return promise;
 }
 async function resolve(config) {
@@ -157,7 +178,7 @@ async function resolve(config) {
   };
   let doc = fallback;
   try {
-    const response = await config.fetch(config.discoveryUrl, {
+    const response = await config.fetch(toInternal(config, config.discoveryUrl), {
       headers: { accept: "application/json" }
     });
     if (response.ok) {
@@ -171,14 +192,14 @@ async function resolve(config) {
     }
   } catch {
   }
-  const jwks = config.jwksOverride ?? (0, import_jose.createRemoteJWKSet)(new URL(doc.jwks_uri), {
+  const jwks = config.jwksOverride ?? (0, import_jose.createRemoteJWKSet)(new URL(toInternal(config, doc.jwks_uri)), {
     cacheMaxAge: 10 * 60 * 1e3,
     cooldownDuration: 30 * 1e3
   });
   return {
     issuer: doc.issuer,
     authorizationEndpoint: doc.authorization_endpoint,
-    tokenEndpoint: doc.token_endpoint,
+    tokenEndpoint: toInternal(config, doc.token_endpoint),
     jwks
   };
 }
@@ -393,8 +414,12 @@ function randomToken() {
 function createHandler(config) {
   const sessionCookieOptions = (secure) => ({
     httpOnly: true,
-    secure,
-    sameSite: "lax",
+    // SameSite=None requires Secure — force the pair even on plain http
+    // (Chrome accepts Secure cookies from trustworthy origins like
+    // `*.localhost`; real cross-site embedding needs https anyway).
+    secure: config.cookieSameSite === "none" ? true : secure,
+    sameSite: config.cookieSameSite,
+    partitioned: config.cookiePartitioned,
     path: "/"
   });
   async function login(request, url) {
@@ -697,6 +722,19 @@ async function updateClientRedirectUris(options) {
   }
   return getClient(options);
 }
+async function deleteClient(options) {
+  const { incortaUrl, tenant, clientId, registrationAccessToken, fetchImpl = fetch } = options;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    method: "DELETE",
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    }
+  });
+  if (!response.ok) {
+    await readJson(response, "Deleting the client");
+  }
+}
 
 // src/index.ts
 function createIncortaAuth(config = {}) {
@@ -708,6 +746,7 @@ function createIncortaAuth(config = {}) {
 0 && (module.exports = {
   IncortaAuthError,
   createIncortaAuth,
+  deleteClient,
   getClient,
   registerClient,
   updateClientRedirectUris