@incorta/auth 1.5.0 → 1.7.0

package/dist/index.js

@@ -1,4 +1,23 @@
+import {
+  AppAccessTokenRejectedError,
+  AppAccessUnavailableError,
+  EDIT_BIT,
+  SHARE_BIT,
+  VIEW_BIT,
+  createAppAccessChecker
+} from "./chunk-TMXOEIA2.js";
+
 // src/core/config.ts
+function resolveAppAccess(input, envValue) {
+  if (input) return input;
+  const raw = envValue?.trim().toLowerCase();
+  if (!raw) return "authenticated";
+  if (raw === "public" || raw === "authenticated" || raw === "catalog") return raw;
+  console.warn(
+    `[incorta-auth] Unrecognized INCORTA_APP_ACCESS value "${envValue}" \u2014 using "authenticated".`
+  );
+  return "authenticated";
+}
 function required(value, name, envVar) {
   if (!value) {
     throw new Error(
@@ -72,6 +91,8 @@ function resolveConfig(input = {}) {
     cookieSameSite,
     cookiePartitioned,
     exposeAccessToken: input.exposeAccessToken ?? false,
+    appAccess: resolveAppAccess(input.appAccess, env.INCORTA_APP_ACCESS),
+    embeddedSignIn: input.embeddedSignIn ?? (env.INCORTA_EMBEDDED_SIGN_IN?.toLowerCase() === "new-tab" ? "new-tab" : "redirect"),
     issuer,
     discoveryUrl: input.advanced?.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`,
     jwksOverride: input.advanced?.jwks,
@@ -380,7 +401,17 @@ function withErrorParam(target, code) {
 function randomToken() {
   return randomBytes(16).toString("base64url");
 }
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function wantsHtml(request) {
+  return request.method.toUpperCase() === "GET" && (request.headers.get("accept") ?? "").includes("text/html");
+}
+function requestPath(url) {
+  return `${url.pathname}${url.search}`;
+}
 function createHandler(config) {
+  const appAccessChecker = createAppAccessChecker(config);
   const sessionCookieOptions = (secure) => ({
     httpOnly: true,
     // SameSite=None requires Secure — force the pair even on plain http
@@ -413,6 +444,9 @@ function createHandler(config) {
     authorizeUrl.searchParams.set("scope", config.scope);
     authorizeUrl.searchParams.set("state", state);
     authorizeUrl.searchParams.set("nonce", nonce);
+    if (config.embeddedSignIn === "new-tab") {
+      return newTabSignInPage(authorizeUrl.toString(), `${origin}/`, [stateCookie]);
+    }
     return redirect(authorizeUrl.toString(), [stateCookie]);
   }
   async function callback(request, url) {
@@ -527,6 +561,18 @@ function createHandler(config) {
       setCookies
     );
   }
+  async function refreshRoute(request, url) {
+    const origin = requestOrigin(config, request);
+    const returnTo = validateReturnTo(url.searchParams.get("redirect_to"), origin);
+    const { session, setCookies } = await loadSession(request);
+    if (!session) {
+      return redirect(
+        `${config.basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`,
+        setCookies
+      );
+    }
+    return redirect(returnTo, setCookies);
+  }
   async function logout(request, url) {
     const secure = isSecureRequest(config, request);
     const clearSession = deleteCookie(config.cookieName, sessionCookieOptions(secure));
@@ -579,6 +625,143 @@ function createHandler(config) {
       }
     );
   }
+  function newTabSignInPage(authorizeUrl, appRoot, cookies) {
+    const body = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Sign in with Incorta</title>
+    <style>
+      body { margin: 0; display: grid; place-items: center; min-height: 100vh;
+             background: #fafafa; color: #18181b;
+             font-family: ui-sans-serif, system-ui, sans-serif; }
+      main { max-width: 26rem; padding: 2rem; text-align: center; }
+      h1 { font-size: 1.2rem; margin: 0 0 .5rem; }
+      p { color: #52525b; font-size: .9rem; line-height: 1.5; margin: 0 0 1.25rem; }
+      a.btn { display: inline-block; padding: .55rem 1.1rem; border-radius: .5rem;
+              background: #18181b; color: #fafafa; text-decoration: none;
+              font-weight: 600; }
+    </style>
+  </head>
+  <body>
+    <main id="frame" hidden>
+      <h1>Sign in with Incorta</h1>
+      <p>
+        This app signs you in with your Incorta account. The embedded preview
+        can&rsquo;t complete sign-in here &mdash; continue in a new tab.
+      </p>
+      <a class="btn" href="${appRoot}" target="_blank" rel="noopener noreferrer">Sign in with Incorta &#8599;</a>
+    </main>
+    <script>
+      (function () {
+        var authorize = ${JSON.stringify(authorizeUrl)};
+        if (window.top === window.self) {
+          window.location.replace(authorize);
+        } else {
+          document.getElementById("frame").hidden = false;
+        }
+      })();
+    </script>
+    <noscript><a href="${appRoot}">Continue to sign in</a></noscript>
+  </body>
+</html>`;
+    const headers = new Headers({
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
+    });
+    for (const cookie of cookies) headers.append("set-cookie", cookie);
+    return new Response(body, { status: 200, headers });
+  }
+  function accessDeniedResponse(request, session) {
+    if (!wantsHtml(request)) {
+      return json(403, { error: "app_access_denied" });
+    }
+    const identity = escapeHtml(session.user.name?.trim() || session.user.sub);
+    const detail = session.user.name?.trim() && session.user.name.trim() !== session.user.sub ? `${identity} (${escapeHtml(session.user.sub)})` : identity;
+    const switchHref = `${config.basePath}/logout`;
+    return new Response(
+      `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>No access</title>
+    <style>
+      body { margin: 0; display: grid; place-items: center; min-height: 100vh;
+             background: #fafafa; color: #18181b;
+             font-family: ui-sans-serif, system-ui, sans-serif; }
+      main { max-width: 26rem; padding: 2rem; text-align: center; }
+      h1 { font-size: 1.25rem; margin: 0 0 .5rem; }
+      p { color: #52525b; font-size: .9rem; line-height: 1.5; margin: 0 0 1.25rem; }
+      strong { color: #18181b; font-weight: 600; }
+      a { display: inline-block; padding: .55rem 1.1rem; border-radius: .5rem;
+          background: #18181b; color: #fafafa; font-size: .9rem;
+          text-decoration: none; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>You don&rsquo;t have access to this application</h1>
+      <p>
+        Ask the app&rsquo;s owner to share it with you in Incorta.
+        You are signed in as <strong>${detail}</strong>.
+      </p>
+      <a href="${switchHref}">Sign in with a different account</a>
+    </main>
+  </body>
+</html>`,
+      {
+        status: 403,
+        headers: {
+          "content-type": "text/html; charset=utf-8",
+          "cache-control": "no-store"
+        }
+      }
+    );
+  }
+  function accessUnavailableResponse(request) {
+    if (!wantsHtml(request)) {
+      return json(503, { error: "app_access_unavailable" });
+    }
+    return new Response(
+      `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta http-equiv="refresh" content="15" />
+    <title>Temporarily unavailable</title>
+    <style>
+      body { margin: 0; display: grid; place-items: center; min-height: 100vh;
+             background: #fafafa; color: #18181b;
+             font-family: ui-sans-serif, system-ui, sans-serif; }
+      main { max-width: 26rem; padding: 2rem; text-align: center; }
+      h1 { font-size: 1.25rem; margin: 0 0 .5rem; }
+      p { color: #52525b; font-size: .9rem; line-height: 1.5; margin: 0; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>This app is temporarily unavailable</h1>
+      <p>
+        Your access could not be verified because Incorta did not respond.
+        This page retries automatically &mdash; you can also refresh in a
+        moment.
+      </p>
+    </main>
+  </body>
+</html>`,
+      {
+        status: 503,
+        headers: {
+          "content-type": "text/html; charset=utf-8",
+          "cache-control": "no-store",
+          "retry-after": "30"
+        }
+      }
+    );
+  }
   async function handler(request) {
     const url = new URL(request.url);
     if (url.pathname !== config.basePath && !url.pathname.startsWith(`${config.basePath}/`)) {
@@ -591,6 +774,7 @@ function createHandler(config) {
       if (route === "/callback" && method === "GET") return await callback(request, url);
       if (route === "/session" && method === "GET") return await sessionRoute(request);
       if (route === "/token" && method === "GET") return await tokenRoute(request);
+      if (route === "/refresh" && method === "GET") return await refreshRoute(request, url);
       if (route === "/logout" && (method === "POST" || method === "GET")) {
         return await logout(request, url);
       }
@@ -616,7 +800,57 @@ function createHandler(config) {
       expiresAt
     };
   }
-  return { handler, getSession };
+  function getAppAccess(session) {
+    return appAccessChecker.check(session.accessToken, session.user.sub);
+  }
+  async function gate(request) {
+    const url = new URL(request.url);
+    if (url.pathname === config.basePath || url.pathname.startsWith(`${config.basePath}/`)) {
+      return handler(request);
+    }
+    if (config.appAccess === "public") return null;
+    const session = await getSession(request);
+    if (!session) {
+      if (wantsHtml(request)) {
+        return redirect(
+          `${config.basePath}/login?redirect_to=${encodeURIComponent(requestPath(url))}`
+        );
+      }
+      return json(401, { error: "unauthenticated" });
+    }
+    if (config.appAccess !== "catalog") return null;
+    if (session.accessTokenExpiresAt <= Date.now()) {
+      if (wantsHtml(request)) {
+        return redirect(
+          `${config.basePath}/refresh?redirect_to=${encodeURIComponent(requestPath(url))}`
+        );
+      }
+      return json(401, { error: "token_expired" });
+    }
+    try {
+      const verdict = await getAppAccess(session);
+      if (verdict.allowed) return null;
+      return accessDeniedResponse(request, session);
+    } catch (error) {
+      if (error instanceof AppAccessTokenRejectedError) {
+        const secure = isSecureRequest(config, request);
+        const clearSession = deleteCookie(config.cookieName, sessionCookieOptions(secure));
+        if (wantsHtml(request)) {
+          return redirect(
+            `${config.basePath}/login?redirect_to=${encodeURIComponent(requestPath(url))}`,
+            [clearSession]
+          );
+        }
+        return json(401, { error: "unauthenticated" }, [clearSession]);
+      }
+      if (!(error instanceof AppAccessUnavailableError)) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error("[incorta-auth] app access check failed unexpectedly:", message);
+      }
+      return accessUnavailableResponse(request);
+    }
+  }
+  return { handler, getSession, gate, getAppAccess };
 }
 
 // src/core/register.ts
@@ -751,11 +985,16 @@ async function deleteClient(options) {
 // src/index.ts
 function createIncortaAuth(config = {}) {
   const resolved = resolveConfig(config);
-  const { handler, getSession } = createHandler(resolved);
-  return { handler, getSession, config: resolved };
+  const { handler, getSession, gate, getAppAccess } = createHandler(resolved);
+  return { handler, getSession, gate, getAppAccess, config: resolved };
 }
 export {
+  AppAccessTokenRejectedError,
+  AppAccessUnavailableError,
+  EDIT_BIT,
   IncortaAuthError,
+  SHARE_BIT,
+  VIEW_BIT,
   createIncortaAuth,
   deleteClient,
   getClient,