@indecisivedev/openplan 0.2.0-alpha.2

package/dist/web-auth.js

@@ -0,0 +1,122 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { config } from "./config.js";
+export const SESSION_COOKIE = "openplan_session";
+export const AUTH_STATE_COOKIE = "openplan_auth_state";
+const SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
+const AUTH_STATE_TTL_SECONDS = 10 * 60;
+export function signToken(payload, secret, ttlSeconds) {
+    const body = Buffer.from(JSON.stringify({ ...payload, exp: nowSeconds() + ttlSeconds })).toString("base64url");
+    return `${body}.${hmac(body, secret)}`;
+}
+export function verifyToken(token, secret) {
+    if (typeof token !== "string" || !token.includes("."))
+        return null;
+    const separator = token.indexOf(".");
+    const body = token.slice(0, separator);
+    const signature = token.slice(separator + 1);
+    const expected = hmac(body, secret);
+    const a = Buffer.from(signature || "");
+    const b = Buffer.from(expected);
+    if (a.length !== b.length || !timingSafeEqual(a, b))
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+        if (!payload || typeof payload !== "object")
+            return null;
+        const candidate = payload;
+        if (typeof candidate.exp !== "number" || !Number.isFinite(candidate.exp) || candidate.exp < nowSeconds())
+            return null;
+        return candidate;
+    }
+    catch {
+        return null;
+    }
+}
+export function createSessionCookie({ accountId, accountName, email, pictureUrl, authProvider, oidcBinding, sessionVersion }) {
+    const token = signToken({
+        accountId,
+        accountName,
+        email: email ?? null,
+        pictureUrl: pictureUrl ?? null,
+        authProvider: authProvider || "shoo",
+        ...(oidcBinding === undefined ? {} : { oidcBinding }),
+        ...(sessionVersion === undefined ? {} : { sessionVersion })
+    }, requireSecret(), SESSION_TTL_SECONDS);
+    return serializeCookie(SESSION_COOKIE, token, { maxAge: SESSION_TTL_SECONDS });
+}
+export function clearSessionCookie() {
+    return serializeCookie(SESSION_COOKIE, "", { maxAge: 0 });
+}
+export function createAuthStateCookie(payload) {
+    const token = signToken(payload, requireSecret(), AUTH_STATE_TTL_SECONDS);
+    return serializeCookie(AUTH_STATE_COOKIE, token, { maxAge: AUTH_STATE_TTL_SECONDS });
+}
+export function clearAuthStateCookie() {
+    return serializeCookie(AUTH_STATE_COOKIE, "", { maxAge: 0 });
+}
+export function readSession(req) {
+    if (!config.sessionSecret)
+        return null;
+    const token = readCookie(req, SESSION_COOKIE);
+    if (!token)
+        return null;
+    const payload = verifyToken(token, config.sessionSecret);
+    return typeof payload?.accountId === "string" ? payload : null;
+}
+export function readAuthState(req) {
+    if (!config.sessionSecret)
+        return null;
+    const token = readCookie(req, AUTH_STATE_COOKIE);
+    const payload = token ? verifyToken(token, config.sessionSecret) : null;
+    if (!payload ||
+        typeof payload.state !== "string" ||
+        typeof payload.verifier !== "string" ||
+        typeof payload.next !== "string") {
+        return null;
+    }
+    return payload;
+}
+export function readCookie(req, name) {
+    const header = req.get("cookie") || "";
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq === -1)
+            continue;
+        if (part.slice(0, eq).trim() === name) {
+            // A malformed value (bad percent-escape) must read as "no cookie", not
+            // throw — otherwise one bad cookie 500s every web page until cleared.
+            try {
+                return decodeURIComponent(part.slice(eq + 1).trim());
+            }
+            catch {
+                return null;
+            }
+        }
+    }
+    return null;
+}
+function serializeCookie(name, value, { maxAge }) {
+    const attributes = [
+        `${name}=${encodeURIComponent(value)}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${maxAge}`
+    ];
+    if (process.env.NODE_ENV !== "development")
+        attributes.push("Secure");
+    return attributes.join("; ");
+}
+function hmac(value, secret) {
+    return createHmac("sha256", secret).update(value).digest("base64url");
+}
+function requireSecret() {
+    if (!config.sessionSecret) {
+        throw new Error("OPENPLAN_SESSION_SECRET is not configured.");
+    }
+    return config.sessionSecret;
+}
+function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+//# sourceMappingURL=web-auth.js.map

package/dist/web-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-auth.js","sourceRoot":"","sources":["../src/web-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AACjD,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AACvD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9C,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,CAAC;AAevC,MAAM,UAAU,SAAS,CACvB,OAAgC,EAChC,MAAc,EACd,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CACtB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,CAC/D,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,MAAc;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,SAAS,GAAG,OAAkC,CAAC;QACrD,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE;YAAE,OAAO,IAAI,CAAC;QACtH,OAAO,SAA0B,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,SAAS,EACT,WAAW,EACX,KAAK,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,cAAc,EASf;IACC,MAAM,KAAK,GAAG,SAAS,CACrB;QACE,SAAS;QACT,WAAW;QACX,KAAK,EAAE,KAAK,IAAI,IAAI;QACpB,UAAU,EAAE,UAAU,IAAI,IAAI;QAC9B,YAAY,EAAE,YAAY,IAAI,MAAM;QACpC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;KAC5D,EACD,aAAa,EAAE,EACf,mBAAmB,CACpB,CAAC;IACF,OAAO,eAAe,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAsC;IAC1E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAC1E,OAAO,eAAe,CAAC,iBAAiB,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,eAAe,CAAC,iBAAiB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACzD,OAAO,OAAO,OAAO,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAE,OAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,IACE,CAAC,OAAO;QACR,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAA2B,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,IAAY;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACtC,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,MAAM,EAAsB;IAClF,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ;QACR,UAAU;QACV,cAAc;QACd,WAAW,MAAM,EAAE;KACpB,CAAC;IACF,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC,aAAa,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/web.d.ts

@@ -0,0 +1,2 @@
+import type { Application } from "express";
+export declare function registerWebRoutes(app: Application): void;