@incorta/auth 1.7.2 → 1.9.0

package/README.md

@@ -4,6 +4,11 @@ Authenticate Incorta users in any Node.js app via Incorta's built-in OAuth
 2.0/OIDC authorization server. See the repository root README for the full
 guide; this is the API surface.
 
+To *read* Incorta with the session this package holds — schemas, tables,
+columns, rows, all filtered to the signed-in user — add
+[`@incorta/sdk`](../sdk/README.md), released from this repository at the same
+version.
+
 ## Entry points
 
 | Import                  | What's in it                                                        |
@@ -20,9 +25,12 @@ Returns `{ handler, getSession, config }`:
 - `handler(request: Request): Promise<Response>` — serves, under
   `config.basePath` (default `/auth`):
   - `GET /login?redirect_to=` — 302 into the Incorta authorize flow (or straight
-    back when already signed in). Sets a sealed state+nonce cookie (10 min).
-  - `GET /callback` — validates state, exchanges the code
-    (`client_secret_basic`), verifies the ID token against the tenant JWKS
+    back when already signed in), with a PKCE S256 challenge. Sets a sealed
+    state+nonce+verifier cookie (10 min).
+  - `GET /callback` — validates state, exchanges the code with the PKCE
+    verifier (as a public client — `client_id` in the body — or with
+    `client_secret_basic` when a secret is configured), verifies the ID token
+    against the tenant JWKS
     (issuer, audience, nonce), seals the session cookie, 302 to the original page.
     Failures 302 to `{redirect_to}?incorta_auth_error={code}`.
   - `GET /session` — `{ user, session }` or `{ user: null }`. Refreshes the
@@ -39,7 +47,9 @@ Returns `{ handler, getSession, config }`:
   for server code (`user`, `accessToken`, `accessTokenExpiresAt`, `expiresAt`).
 
 Config falls back to `INCORTA_URL`, `INCORTA_TENANT`, `INCORTA_CLIENT_ID`,
-`INCORTA_CLIENT_SECRET`, `INCORTA_AUTH_SECRET`, `INCORTA_APP_URL`, and
+`INCORTA_AUTH_SECRET`, `INCORTA_APP_URL`, `INCORTA_CLIENT_SECRET` (optional —
+only a confidential client has one; Incorta registers apps as public
+clients), and
 `INCORTA_INTERNAL_URL` (split horizon: server-side discovery/token/JWKS calls
 use it when the public `incortaUrl` is not routable from the app — e.g.
 `http://host.docker.internal:8080/incorta` from a local container; the

package/dist/{app-access-BSsKtvbi.d.cts → app-access-B5lrn34s.d.cts}

@@ -50,7 +50,13 @@ interface IncortaAuthConfig {
     tenant?: string;
     /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */
     clientId?: string;
-    /** OAuth client secret. Defaults to `INCORTA_CLIENT_SECRET`. */
+    /**
+     * OAuth client secret — only for a CONFIDENTIAL client. Incorta's dynamic
+     * registration issues app clients as PUBLIC clients (no secret; see
+     * `registerClient`), and the SDK then authenticates token requests with
+     * `client_id` alone and relies on PKCE. Defaults to `INCORTA_CLIENT_SECRET`;
+     * unset or empty means public.
+     */
     clientSecret?: string;
     /**
      * Secret used to encrypt the session cookie (any long random string, >= 32 chars).
@@ -157,7 +163,8 @@ interface ResolvedConfig {
     internalIncortaUrl?: string;
     tenant: string;
     clientId: string;
-    clientSecret: string;
+    /** Absent for a public client: token requests then carry `client_id` instead of Basic auth. */
+    clientSecret?: string;
     secret: string;
     basePath: string;
     appUrl?: string;

package/dist/{app-access-BSsKtvbi.d.ts → app-access-B5lrn34s.d.ts}

@@ -50,7 +50,13 @@ interface IncortaAuthConfig {
     tenant?: string;
     /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */
     clientId?: string;
-    /** OAuth client secret. Defaults to `INCORTA_CLIENT_SECRET`. */
+    /**
+     * OAuth client secret — only for a CONFIDENTIAL client. Incorta's dynamic
+     * registration issues app clients as PUBLIC clients (no secret; see
+     * `registerClient`), and the SDK then authenticates token requests with
+     * `client_id` alone and relies on PKCE. Defaults to `INCORTA_CLIENT_SECRET`;
+     * unset or empty means public.
+     */
     clientSecret?: string;
     /**
      * Secret used to encrypt the session cookie (any long random string, >= 32 chars).
@@ -157,7 +163,8 @@ interface ResolvedConfig {
     internalIncortaUrl?: string;
     tenant: string;
     clientId: string;
-    clientSecret: string;
+    /** Absent for a public client: token requests then carry `client_id` instead of Basic auth. */
+    clientSecret?: string;
     secret: string;
     basePath: string;
     appUrl?: string;

package/dist/cli.js

@@ -49,14 +49,13 @@ async function registerClient(options) {
     })
   });
   const body = await readJson(response, "Client registration");
-  if (!body.client_id || !body.client_secret) {
-    throw new Error(
-      `[incorta-auth] Client registration failed: response is missing client_id/client_secret.`
-    );
+  if (!body.client_id) {
+    throw new Error(`[incorta-auth] Client registration failed: response is missing client_id.`);
   }
   return {
     clientId: body.client_id,
-    clientSecret: body.client_secret,
+    clientSecret: body.client_secret || void 0,
+    tokenEndpointAuthMethod: body.token_endpoint_auth_method,
     registrationAccessToken: body.registration_access_token,
     registrationClientUri: body.registration_client_uri
   };
@@ -237,7 +236,13 @@ async function runRegister(args) {
   console.log(`INCORTA_URL=${args.url}`);
   console.log(`INCORTA_TENANT=${args.tenant}`);
   console.log(`INCORTA_CLIENT_ID=${client.clientId}`);
-  console.log(`INCORTA_CLIENT_SECRET=${client.clientSecret}`);
+  if (client.clientSecret) {
+    console.log(`INCORTA_CLIENT_SECRET=${client.clientSecret}`);
+  } else {
+    console.log(
+      `# Public client (${client.tokenEndpointAuthMethod ?? "none"}): Incorta issued no client secret; PKCE protects the code flow.`
+    );
+  }
   console.log(`INCORTA_AUTH_SECRET=${authSecret}`);
   if (client.registrationAccessToken) {
     console.log(

package/dist/express.d.cts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { AuthSession, IncortaAuth } from './index.cjs';
-export { A as AppAccess, a as AppAccessPolicy } from './app-access-BSsKtvbi.cjs';
+export { A as AppAccess, a as AppAccessPolicy } from './app-access-B5lrn34s.cjs';
 import 'jose';
 
 /**

package/dist/express.d.ts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { AuthSession, IncortaAuth } from './index.js';
-export { A as AppAccess, a as AppAccessPolicy } from './app-access-BSsKtvbi.js';
+export { A as AppAccess, a as AppAccessPolicy } from './app-access-B5lrn34s.js';
 import 'jose';
 
 /**

package/dist/index.cjs

@@ -68,11 +68,7 @@ function resolveConfig(input = {}) {
     "clientId",
     "INCORTA_CLIENT_ID"
   );
-  const clientSecret = required(
-    input.clientSecret ?? env.INCORTA_CLIENT_SECRET,
-    "clientSecret",
-    "INCORTA_CLIENT_SECRET"
-  );
+  const clientSecret = (input.clientSecret ?? env.INCORTA_CLIENT_SECRET)?.trim() || void 0;
   const secret = required(
     input.secret ?? env.INCORTA_AUTH_SECRET,
     "secret",
@@ -128,7 +124,7 @@ function resolveConfig(input = {}) {
 }
 
 // src/core/handler.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 
 // src/core/app-access.ts
 var VIEW_BIT = 1;
@@ -314,12 +310,22 @@ async function resolve(config) {
   };
 }
 
-// src/core/session.ts
+// src/core/pkce.ts
 var import_node_crypto = require("crypto");
+function generateCodeVerifier() {
+  return (0, import_node_crypto.randomBytes)(32).toString("base64url");
+}
+function codeChallengeFor(codeVerifier) {
+  return (0, import_node_crypto.createHash)("sha256").update(codeVerifier, "ascii").digest("base64url");
+}
+var CODE_CHALLENGE_METHOD = "S256";
+
+// src/core/session.ts
+var import_node_crypto2 = require("crypto");
 var import_jose2 = require("jose");
 function sealKey(config) {
   return new Uint8Array(
-    (0, import_node_crypto.createHash)("sha256").update(`incorta-auth:${config.secret}`).digest()
+    (0, import_node_crypto2.createHash)("sha256").update(`incorta-auth:${config.secret}`).digest()
   );
 }
 async function seal(config, purpose, data, maxAgeSeconds) {
@@ -358,6 +364,7 @@ async function unsealLoginState(config, cookieValue) {
   if (!result) return null;
   const { data } = result;
   if (!data || typeof data.state !== "string" || typeof data.nonce !== "string") return null;
+  if (data.codeVerifier !== void 0 && typeof data.codeVerifier !== "string") return null;
   return data;
 }
 
@@ -371,12 +378,19 @@ var IncortaAuthError = class extends Error {
   }
   code;
 };
-function basicAuth(config) {
-  const raw = `${config.clientId}:${config.clientSecret}`;
+function basicAuth(clientId, clientSecret) {
+  const raw = `${clientId}:${clientSecret}`;
   return `Basic ${Buffer.from(raw, "utf8").toString("base64")}`;
 }
+function clientAuthentication(config, params) {
+  if (config.clientSecret) {
+    return { headers: { authorization: basicAuth(config.clientId, config.clientSecret) }, params };
+  }
+  return { headers: {}, params: { client_id: config.clientId, ...params } };
+}
 async function callTokenEndpoint(config, params) {
   const { tokenEndpoint } = await getEndpoints(config);
+  const auth = clientAuthentication(config, params);
   let response;
   try {
     response = await config.fetch(tokenEndpoint, {
@@ -384,9 +398,9 @@ async function callTokenEndpoint(config, params) {
       headers: {
         "content-type": "application/x-www-form-urlencoded",
         accept: "application/json",
-        authorization: basicAuth(config)
+        ...auth.headers
       },
-      body: new URLSearchParams(params).toString()
+      body: new URLSearchParams(auth.params).toString()
     });
   } catch (error) {
     throw new IncortaAuthError(
@@ -417,11 +431,12 @@ async function callTokenEndpoint(config, params) {
     refreshToken: body.refresh_token
   };
 }
-function exchangeCode(config, code, redirectUri) {
+function exchangeCode(config, code, redirectUri, codeVerifier) {
   return callTokenEndpoint(config, {
     grant_type: "authorization_code",
     code,
-    redirect_uri: redirectUri
+    redirect_uri: redirectUri,
+    ...codeVerifier ? { code_verifier: codeVerifier } : {}
   });
 }
 function refreshTokens(config, refreshToken) {
@@ -519,7 +534,7 @@ function withErrorParam(target, code) {
   return `${target}${separator}incorta_auth_error=${encodeURIComponent(code)}`;
 }
 function randomToken() {
-  return (0, import_node_crypto2.randomBytes)(16).toString("base64url");
+  return (0, import_node_crypto3.randomBytes)(16).toString("base64url");
 }
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
@@ -551,9 +566,10 @@ function createHandler(config) {
     if (existing) return redirect(returnTo);
     const state = randomToken();
     const nonce = randomToken();
+    const codeVerifier = generateCodeVerifier();
     const stateCookie = serializeCookie(
       config.stateCookieName,
-      await sealLoginState(config, { state, nonce, returnTo }),
+      await sealLoginState(config, { state, nonce, returnTo, codeVerifier }),
       { ...sessionCookieOptions(secure), maxAge: 600 }
     );
     const { authorizationEndpoint } = await getEndpoints(config);
@@ -564,6 +580,8 @@ function createHandler(config) {
     authorizeUrl.searchParams.set("scope", config.scope);
     authorizeUrl.searchParams.set("state", state);
     authorizeUrl.searchParams.set("nonce", nonce);
+    authorizeUrl.searchParams.set("code_challenge", codeChallengeFor(codeVerifier));
+    authorizeUrl.searchParams.set("code_challenge_method", CODE_CHALLENGE_METHOD);
     if (config.embeddedSignIn === "new-tab") {
       return newTabSignInPage(authorizeUrl.toString(), `${origin}/`, [stateCookie]);
     }
@@ -585,7 +603,12 @@ function createHandler(config) {
     if (!loginState) return fail("state_missing");
     if (state !== loginState.state) return fail("state_mismatch");
     try {
-      const tokens = await exchangeCode(config, code, `${origin}${config.basePath}/callback`);
+      const tokens = await exchangeCode(
+        config,
+        code,
+        `${origin}${config.basePath}/callback`,
+        loginState.codeVerifier
+      );
       const user = tokens.idToken ? await verifyIdToken(config, tokens.idToken, loginState.nonce) : await userFromAccessToken(config, tokens.accessToken);
       const session = {
         user,
@@ -1019,14 +1042,13 @@ async function registerClient(options) {
     })
   });
   const body = await readJson(response, "Client registration");
-  if (!body.client_id || !body.client_secret) {
-    throw new Error(
-      `[incorta-auth] Client registration failed: response is missing client_id/client_secret.`
-    );
+  if (!body.client_id) {
+    throw new Error(`[incorta-auth] Client registration failed: response is missing client_id.`);
   }
   return {
     clientId: body.client_id,
-    clientSecret: body.client_secret,
+    clientSecret: body.client_secret || void 0,
+    tokenEndpointAuthMethod: body.token_endpoint_auth_method,
     registrationAccessToken: body.registration_access_token,
     registrationClientUri: body.registration_client_uri
   };