@incorta/auth 1.6.0 → 1.7.1

package/dist/index.cjs

@@ -20,7 +20,12 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  AppAccessTokenRejectedError: () => AppAccessTokenRejectedError,
+  AppAccessUnavailableError: () => AppAccessUnavailableError,
+  EDIT_BIT: () => EDIT_BIT,
   IncortaAuthError: () => IncortaAuthError,
+  SHARE_BIT: () => SHARE_BIT,
+  VIEW_BIT: () => VIEW_BIT,
   createIncortaAuth: () => createIncortaAuth,
   deleteClient: () => deleteClient,
   getClient: () => getClient,
@@ -30,6 +35,16 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/core/config.ts
+function resolveAppAccess(input, envValue) {
+  if (input) return input;
+  const raw = envValue?.trim().toLowerCase();
+  if (!raw) return "authenticated";
+  if (raw === "public" || raw === "authenticated" || raw === "catalog") return raw;
+  console.warn(
+    `[incorta-auth] Unrecognized INCORTA_APP_ACCESS value "${envValue}" \u2014 using "authenticated".`
+  );
+  return "authenticated";
+}
 function required(value, name, envVar) {
   if (!value) {
     throw new Error(
@@ -103,6 +118,7 @@ function resolveConfig(input = {}) {
     cookieSameSite,
     cookiePartitioned,
     exposeAccessToken: input.exposeAccessToken ?? false,
+    appAccess: resolveAppAccess(input.appAccess, env.INCORTA_APP_ACCESS),
     embeddedSignIn: input.embeddedSignIn ?? (env.INCORTA_EMBEDDED_SIGN_IN?.toLowerCase() === "new-tab" ? "new-tab" : "redirect"),
     issuer,
     discoveryUrl: input.advanced?.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`,
@@ -114,6 +130,99 @@ function resolveConfig(input = {}) {
 // src/core/handler.ts
 var import_node_crypto2 = require("crypto");
 
+// src/core/app-access.ts
+var VIEW_BIT = 1;
+var SHARE_BIT = 2;
+var EDIT_BIT = 4;
+var AppAccessUnavailableError = class extends Error {
+  constructor(cause) {
+    super(`[incorta-auth] App access check unavailable: ${cause}`);
+    this.name = "AppAccessUnavailableError";
+  }
+};
+var AppAccessTokenRejectedError = class extends Error {
+  constructor() {
+    super("[incorta-auth] Incorta rejected the session token during the app access check");
+    this.name = "AppAccessTokenRejectedError";
+  }
+};
+var APP_ACCESS_CACHE_TTL_MS = 3e4;
+var CHECK_TIMEOUT_MS = 5e3;
+var CACHE_MAX_ENTRIES = 5e3;
+function toVerdict(registered, access) {
+  const canView = (access & VIEW_BIT) === VIEW_BIT;
+  return {
+    registered,
+    access,
+    canView,
+    canEdit: (access & EDIT_BIT) === EDIT_BIT,
+    allowed: !registered || canView
+  };
+}
+function createAppAccessChecker(config) {
+  const base = config.internalIncortaUrl ?? config.incortaUrl;
+  const checkUrl = `${base}/apps-catalog/check`;
+  const cache = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
+  function prune(now) {
+    if (cache.size < CACHE_MAX_ENTRIES) return;
+    for (const [key, entry] of cache) {
+      if (entry.expiresAt <= now) cache.delete(key);
+    }
+  }
+  async function fetchVerdict(accessToken) {
+    let response;
+    try {
+      response = await config.fetch(checkUrl, {
+        headers: {
+          accept: "application/json",
+          authorization: `Bearer ${accessToken}`
+        },
+        signal: AbortSignal.timeout(CHECK_TIMEOUT_MS)
+      });
+    } catch (error) {
+      throw new AppAccessUnavailableError(error.message);
+    }
+    if (response.status === 401) throw new AppAccessTokenRejectedError();
+    if (!response.ok) {
+      throw new AppAccessUnavailableError(`HTTP ${response.status}`);
+    }
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new AppAccessUnavailableError("invalid JSON response");
+    }
+    if (typeof body.registered !== "boolean" || typeof body.access !== "number") {
+      throw new AppAccessUnavailableError("malformed check response");
+    }
+    return toVerdict(body.registered, body.access);
+  }
+  async function check(accessToken, userKey) {
+    const now = Date.now();
+    const cached = cache.get(userKey);
+    if (cached && cached.expiresAt > now) return cached.verdict;
+    const pending = inFlight.get(userKey);
+    if (pending) return pending;
+    const promise = fetchVerdict(accessToken).then((verdict) => {
+      prune(now);
+      cache.set(userKey, { verdict, expiresAt: Date.now() + APP_ACCESS_CACHE_TTL_MS });
+      return verdict;
+    }).finally(() => {
+      inFlight.delete(userKey);
+    });
+    inFlight.set(userKey, promise);
+    return promise;
+  }
+  return {
+    check,
+    clearCache() {
+      cache.clear();
+      inFlight.clear();
+    }
+  };
+}
+
 // src/core/cookies.ts
 function parseCookies(header) {
   const out = {};
@@ -412,7 +521,17 @@ function withErrorParam(target, code) {
 function randomToken() {
   return (0, import_node_crypto2.randomBytes)(16).toString("base64url");
 }
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function wantsHtml(request) {
+  return request.method.toUpperCase() === "GET" && (request.headers.get("accept") ?? "").includes("text/html");
+}
+function requestPath(url) {
+  return `${url.pathname}${url.search}`;
+}
 function createHandler(config) {
+  const appAccessChecker = createAppAccessChecker(config);
   const sessionCookieOptions = (secure) => ({
     httpOnly: true,
     // SameSite=None requires Secure — force the pair even on plain http
@@ -562,6 +681,18 @@ function createHandler(config) {
       setCookies
     );
   }
+  async function refreshRoute(request, url) {
+    const origin = requestOrigin(config, request);
+    const returnTo = validateReturnTo(url.searchParams.get("redirect_to"), origin);
+    const { session, setCookies } = await loadSession(request);
+    if (!session) {
+      return redirect(
+        `${config.basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`,
+        setCookies
+      );
+    }
+    return redirect(returnTo, setCookies);
+  }
   async function logout(request, url) {
     const secure = isSecureRequest(config, request);
     const clearSession = deleteCookie(config.cookieName, sessionCookieOptions(secure));
@@ -662,6 +793,95 @@ function createHandler(config) {
     for (const cookie of cookies) headers.append("set-cookie", cookie);
     return new Response(body, { status: 200, headers });
   }
+  function accessDeniedResponse(request, session) {
+    if (!wantsHtml(request)) {
+      return json(403, { error: "app_access_denied" });
+    }
+    const identity = escapeHtml(session.user.name?.trim() || session.user.sub);
+    const detail = session.user.name?.trim() && session.user.name.trim() !== session.user.sub ? `${identity} (${escapeHtml(session.user.sub)})` : identity;
+    const switchHref = `${config.basePath}/logout`;
+    return new Response(
+      `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>No access</title>
+    <style>
+      body { margin: 0; display: grid; place-items: center; min-height: 100vh;
+             background: #fafafa; color: #18181b;
+             font-family: ui-sans-serif, system-ui, sans-serif; }
+      main { max-width: 26rem; padding: 2rem; text-align: center; }
+      h1 { font-size: 1.25rem; margin: 0 0 .5rem; }
+      p { color: #52525b; font-size: .9rem; line-height: 1.5; margin: 0 0 1.25rem; }
+      strong { color: #18181b; font-weight: 600; }
+      a { display: inline-block; padding: .55rem 1.1rem; border-radius: .5rem;
+          background: #18181b; color: #fafafa; font-size: .9rem;
+          text-decoration: none; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>You don&rsquo;t have access to this application</h1>
+      <p>
+        Ask the app&rsquo;s owner to share it with you in Incorta.
+        You are signed in as <strong>${detail}</strong>.
+      </p>
+      <a href="${switchHref}">Sign in with a different account</a>
+    </main>
+  </body>
+</html>`,
+      {
+        status: 403,
+        headers: {
+          "content-type": "text/html; charset=utf-8",
+          "cache-control": "no-store"
+        }
+      }
+    );
+  }
+  function accessUnavailableResponse(request) {
+    if (!wantsHtml(request)) {
+      return json(503, { error: "app_access_unavailable" });
+    }
+    return new Response(
+      `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta http-equiv="refresh" content="15" />
+    <title>Temporarily unavailable</title>
+    <style>
+      body { margin: 0; display: grid; place-items: center; min-height: 100vh;
+             background: #fafafa; color: #18181b;
+             font-family: ui-sans-serif, system-ui, sans-serif; }
+      main { max-width: 26rem; padding: 2rem; text-align: center; }
+      h1 { font-size: 1.25rem; margin: 0 0 .5rem; }
+      p { color: #52525b; font-size: .9rem; line-height: 1.5; margin: 0; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>This app is temporarily unavailable</h1>
+      <p>
+        Your access could not be verified because Incorta did not respond.
+        This page retries automatically &mdash; you can also refresh in a
+        moment.
+      </p>
+    </main>
+  </body>
+</html>`,
+      {
+        status: 503,
+        headers: {
+          "content-type": "text/html; charset=utf-8",
+          "cache-control": "no-store",
+          "retry-after": "30"
+        }
+      }
+    );
+  }
   async function handler(request) {
     const url = new URL(request.url);
     if (url.pathname !== config.basePath && !url.pathname.startsWith(`${config.basePath}/`)) {
@@ -674,6 +894,7 @@ function createHandler(config) {
       if (route === "/callback" && method === "GET") return await callback(request, url);
       if (route === "/session" && method === "GET") return await sessionRoute(request);
       if (route === "/token" && method === "GET") return await tokenRoute(request);
+      if (route === "/refresh" && method === "GET") return await refreshRoute(request, url);
       if (route === "/logout" && (method === "POST" || method === "GET")) {
         return await logout(request, url);
       }
@@ -699,7 +920,57 @@ function createHandler(config) {
       expiresAt
     };
   }
-  return { handler, getSession };
+  function getAppAccess(session) {
+    return appAccessChecker.check(session.accessToken, session.user.sub);
+  }
+  async function gate(request) {
+    const url = new URL(request.url);
+    if (url.pathname === config.basePath || url.pathname.startsWith(`${config.basePath}/`)) {
+      return handler(request);
+    }
+    if (config.appAccess === "public") return null;
+    const session = await getSession(request);
+    if (!session) {
+      if (wantsHtml(request)) {
+        return redirect(
+          `${config.basePath}/login?redirect_to=${encodeURIComponent(requestPath(url))}`
+        );
+      }
+      return json(401, { error: "unauthenticated" });
+    }
+    if (config.appAccess !== "catalog") return null;
+    if (session.accessTokenExpiresAt <= Date.now()) {
+      if (wantsHtml(request)) {
+        return redirect(
+          `${config.basePath}/refresh?redirect_to=${encodeURIComponent(requestPath(url))}`
+        );
+      }
+      return json(401, { error: "token_expired" });
+    }
+    try {
+      const verdict = await getAppAccess(session);
+      if (verdict.allowed) return null;
+      return accessDeniedResponse(request, session);
+    } catch (error) {
+      if (error instanceof AppAccessTokenRejectedError) {
+        const secure = isSecureRequest(config, request);
+        const clearSession = deleteCookie(config.cookieName, sessionCookieOptions(secure));
+        if (wantsHtml(request)) {
+          return redirect(
+            `${config.basePath}/login?redirect_to=${encodeURIComponent(requestPath(url))}`,
+            [clearSession]
+          );
+        }
+        return json(401, { error: "unauthenticated" }, [clearSession]);
+      }
+      if (!(error instanceof AppAccessUnavailableError)) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error("[incorta-auth] app access check failed unexpectedly:", message);
+      }
+      return accessUnavailableResponse(request);
+    }
+  }
+  return { handler, getSession, gate, getAppAccess };
 }
 
 // src/core/register.ts
@@ -834,12 +1105,17 @@ async function deleteClient(options) {
 // src/index.ts
 function createIncortaAuth(config = {}) {
   const resolved = resolveConfig(config);
-  const { handler, getSession } = createHandler(resolved);
-  return { handler, getSession, config: resolved };
+  const { handler, getSession, gate, getAppAccess } = createHandler(resolved);
+  return { handler, getSession, gate, getAppAccess, config: resolved };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AppAccessTokenRejectedError,
+  AppAccessUnavailableError,
+  EDIT_BIT,
   IncortaAuthError,
+  SHARE_BIT,
+  VIEW_BIT,
   createIncortaAuth,
   deleteClient,
   getClient,