@jeffusion/bungee-core 6.0.3 → 6.1.0

package/dist/plugins/user-auth/control.js

@@ -2607,6 +2607,14 @@ function validateFailure(value) {
     fail("corrupt_state", 503);
   return f;
 }
+function validateFlow(v) {
+  if (v === null)
+    return null;
+  const f = v;
+  if (!f || Object.keys(f).some((k) => !["id", "state", "nonce", "verifierRef", "connectionId", "generation", "created", "expiresAt", "epoch", "returnTo", "status", "initiator", "subject", "issuer", "protocol"].includes(k)) || typeof f.id !== "string" || typeof f.state !== "string" || typeof f.nonce !== "string" || typeof f.verifierRef !== "string" || typeof f.connectionId !== "string" || !Number.isSafeInteger(f.generation) || !Number.isSafeInteger(f.created) || !Number.isSafeInteger(f.expiresAt) || !Number.isSafeInteger(f.epoch) || !["pending", "exchanging", "verified", "consumed"].includes(f.status) || typeof f.returnTo !== "string" || f.subject !== undefined && typeof f.subject !== "string" || f.issuer !== undefined && typeof f.issuer !== "string" || f.protocol !== undefined && !["oidc", "oauth2"].includes(f.protocol) || f.status === "verified" && (!f.subject || !f.issuer || !f.protocol) || f.initiator !== undefined && (!f.initiator || typeof f.initiator.userId !== "string" || typeof f.initiator.sessionDigest !== "string" || !Number.isSafeInteger(f.initiator.generation)))
+    fail("corrupt_state", 503);
+  return f;
+}
 function slots(records, kind, limit, validate) {
   const result = Array.from({ length: limit }, (_, i) => ({ key: `${kind}:${i}`, version: 0, value: null }));
   const seen = new Set;
@@ -2681,11 +2689,7 @@ function setupRecord(records) {
   if (!record)
     fail("corrupt_state", 503);
   const value = envelope(record.value, "setup");
-  if (!value || !["uninitialized", "ready"].includes(value.phase) || Object.keys(value).some((k) => !["phase", "code"].includes(k)))
-    fail("corrupt_state", 503);
-  if (value.code !== undefined && (!value.code || !/^[a-f0-9]{64}$/.test(value.code.digest) || !Number.isSafeInteger(value.code.expiresAt) || value.code.expiresAt < 0 || Object.keys(value.code).some((k) => !["digest", "expiresAt"].includes(k))))
-    fail("corrupt_state", 503);
-  if (value.phase === "ready" && value.code !== undefined)
+  if (!value || !["uninitialized", "ready"].includes(value.phase) || Object.keys(value).some((k) => k !== "phase"))
     fail("corrupt_state", 503);
   const all = users(records), anchor = records.find((r) => r.key === "recovery-anchor");
   if (value.phase === "ready" !== !!all.length || value.phase === "ready" && (!anchor || typeof envelope(anchor.value, "userId") !== "string"))
@@ -2905,6 +2909,8 @@ class UserAuthControl {
     return { version: record?.version ?? 0, policy: record ? validateSessionPolicy(envelope(record.value, "policy"), "corrupt_state", 503) : { ...DEFAULT_SESSION_POLICY } };
   }
   async start() {
+    await clearSetupCode(this.state);
+    await ensureSetup(this.state, this.now);
     await readManagementSetup(this.state);
     await observeClock(this.state, this.now);
     await this.readSessionPolicy();
@@ -2939,19 +2945,43 @@ class UserAuthControl {
     });
   }
   async bootstrap(input) {
-    const b = object(input);
-    exact(b, ["username", "password"]);
-    const name = username(b.username), p = password(b.password);
-    if (await this.setupStatus() !== "ready")
-      fail("initialization_required", 409);
-    const prior = users(await this.records()).find((u) => u.username === name);
-    if (!prior?.passwordHash)
-      fail("invalid_credentials", 401);
-    if (prior.username !== name || prior.disabled || !await Bun.password.verify(p, prior.passwordHash))
-      fail("invalid_credentials", 401);
-    const latest = (await this.readAdministrator(prior.id)).value;
-    if (!latest || latest.id !== prior.id || latest.generation !== prior.generation || latest.username !== prior.username || latest.disabled)
-      fail("invalid_credentials", 401);
+    try {
+      const b = object(input);
+      if (b.operation === "initialize") {
+        exact(b, ["operation", "username", "password", "passwordConfirmation"]);
+        await this.createInitialUser(b);
+        return;
+      }
+      if (b.operation !== "verify")
+        fail("invalid_input");
+      exact(b, ["operation", "username", "password"]);
+      const name = username(b.username), p = password(b.password);
+      if (await this.setupStatus() !== "ready")
+        fail("initialization_required", 409);
+      const prior = users(await this.records()).find((u) => u.username === name);
+      if (!prior?.passwordHash || prior.disabled || !await Bun.password.verify(p, prior.passwordHash))
+        fail("invalid_credentials", 401);
+      const latest = (await this.readAdministrator(prior.id)).value;
+      if (!latest || latest.generation !== prior.generation || latest.username !== prior.username || latest.disabled)
+        fail("invalid_credentials", 401);
+    } catch (error) {
+      if (error instanceof AccountError && ["invalid_password", "password_confirmation"].includes(error.code))
+        fail("invalid_input");
+      throw error;
+    }
+  }
+  async createInitialUser(b) {
+    const name = username(b.username), p = this.confirmPassword(b);
+    if (validateState(await this.records()).value.phase !== "uninitialized")
+      fail("already_initialized", 409);
+    const passwordHash = await this.hash(p);
+    await this.retry(async () => {
+      const records = await this.records();
+      if (validateState(records).value.phase !== "uninitialized")
+        fail("already_initialized", 409);
+      const account = { id: randomUUID(), username: name, displayName: name, disabled: false, generation: 1 };
+      return { mutations: initialUserMutations(records, account, passwordHash), result: undefined };
+    });
   }
   source(request) {
     return (this.dependencies.trustedSource ?? this.host.trustedSource)?.(request) ?? "unknown";
@@ -2983,28 +3013,8 @@ class UserAuthControl {
         fail("method_not_allowed", 405);
       origin(request, this.host.managementOrigin);
       const b = await body(request);
-      exact(b, ["setupCode", "username", "password", "passwordConfirmation"]);
-      await this.reserve(["source:" + digest(this.source(request))]);
-      const check = async (time) => {
-        const records = await this.records(), setup = setupRecord(records), now = await time();
-        if (setup.value.phase !== "uninitialized")
-          fail("already_initialized", 409);
-        if (!setup.value.code || now >= setup.value.code.expiresAt || typeof b.setupCode !== "string" || !constant(digest(b.setupCode), setup.value.code.digest))
-          fail("invalid_setup_code", 401);
-        return { setup, records };
-      };
-      const initial = await this.retry(async (time) => ({ mutations: [], result: await check(time) }));
-      const name = username(b.username), p = password(b.password);
-      if (b.passwordConfirmation !== p)
-        fail("password_confirmation");
-      const passwordHash = await this.hash(p);
-      await this.retry(async (time) => {
-        const { setup, records } = await check(time);
-        if (setup.version !== initial.setup.version)
-          fail("invalid_setup_code", 401);
-        const account = { id: randomUUID(), username: name, displayName: name, disabled: false, generation: 1 };
-        return { mutations: [mutation(setup, "setup", { phase: "ready" }), mutation(settings(records), "settings", EMPTY_SETTINGS), mutation(turnstile(records), "turnstile", EMPTY_TURNSTILE), { key: "user:" + account.id, expectedVersion: 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, user: account }) }, this.credentialMutation(records, account.id, passwordHash), { key: "recovery-anchor", expectedVersion: 0, value: { schema: ACCOUNT_RECORD_SCHEMA, userId: account.id } }], result: undefined };
-      });
+      exact(b, ["username", "password", "passwordConfirmation"]);
+      await this.createInitialUser(b);
       return json({ initialized: true });
     } catch (e) {
       return safe(e);
@@ -3609,14 +3619,7 @@ class UserAuthControl {
     return `${FLOW_COOKIE}=${token}; Path=/api/auth/login/callback/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${this.publicOrigin().startsWith("https:") ? "; Secure" : ""}`;
   }
   flows(records) {
-    return slots(records, "flow", MAX_FLOWS, (v) => {
-      if (v === null)
-        return null;
-      const f = v;
-      if (!f || Object.keys(f).some((k) => !["id", "state", "nonce", "verifierRef", "connectionId", "generation", "created", "expiresAt", "epoch", "returnTo", "status", "initiator", "subject", "issuer", "protocol"].includes(k)) || typeof f.id !== "string" || typeof f.state !== "string" || typeof f.nonce !== "string" || typeof f.verifierRef !== "string" || typeof f.connectionId !== "string" || !Number.isSafeInteger(f.generation) || !Number.isSafeInteger(f.created) || !Number.isSafeInteger(f.expiresAt) || !Number.isSafeInteger(f.epoch) || !["pending", "exchanging", "verified", "consumed"].includes(f.status) || typeof f.returnTo !== "string" || f.subject !== undefined && typeof f.subject !== "string" || f.issuer !== undefined && typeof f.issuer !== "string" || f.protocol !== undefined && !["oidc", "oauth2"].includes(f.protocol) || f.status === "verified" && (!f.subject || !f.issuer || !f.protocol) || f.initiator !== undefined && (!f.initiator || typeof f.initiator.userId !== "string" || typeof f.initiator.sessionDigest !== "string" || !Number.isSafeInteger(f.initiator.generation)))
-        fail("corrupt_state", 503);
-      return f;
-    });
+    return slots(records, "flow", MAX_FLOWS, validateFlow);
   }
   loginProviders() {
     return new LoginProviders(this.dependencies.fetch ?? fetch, this.host.signal);
@@ -3784,30 +3787,153 @@ var rpc = [];
 var controlApi = api;
 var controlRpc = rpc;
 async function readManagementSetup(state) {
-  const records = await state.list(), setup = setupRecord(records);
+  const records = withoutSetupCode(await state.list());
+  if (!records.length)
+    return { initialized: false };
+  const setup = validateState(records);
+  return { initialized: setup.value.phase === "ready" };
+}
+function validateState(records) {
+  const setup = setupRecord(records);
   slots(records, "session", MAX_SESSIONS, validateSession);
   slots(records, "failure", MAX_FAILURES, validateFailure);
+  slots(records, "flow", MAX_FLOWS, validateFlow);
   const policy = records.find((r) => r.key === "session-policy");
   if (policy)
     validateSessionPolicy(envelope(policy.value, "policy"), "corrupt_state", 503);
-  return { initialized: setup.value.phase === "ready" };
+  const all = users(records);
+  for (const record of records.filter((r) => r.key.startsWith("credential:"))) {
+    localValue(record);
+    if (!all.some((u) => record.key === "credential:" + u.id))
+      fail("corrupt_state", 503);
+  }
+  return setup;
 }
-async function prepareInitialization(context) {
+function withoutSetupCode(records) {
+  const record = records.find((r) => r.key === "setup");
+  if (!record)
+    return records;
+  const value = envelope(record.value, "setup");
+  if (!value || !Object.hasOwn(value, "code"))
+    return records;
+  const code = value.code;
+  if (value.phase !== "uninitialized" || Object.keys(value).some((k) => !["phase", "code"].includes(k)) || !code || typeof code.digest !== "string" || !/^[a-f0-9]{64}$/.test(code.digest) || !Number.isSafeInteger(code.expiresAt) || code.expiresAt < 0 || Object.keys(code).some((k) => !["digest", "expiresAt"].includes(k)))
+    fail("corrupt_state", 503);
+  return records.map((r) => r === record ? { ...r, value: { schema: ACCOUNT_RECORD_SCHEMA, setup: { phase: "uninitialized" } } } : r);
+}
+async function clearSetupCode(state) {
+  for (let i = 0;i < 64; i++) {
+    const records = await state.list(), normalized = withoutSetupCode(records);
+    if (normalized === records)
+      return;
+    const before = records.find((r) => r.key === "setup"), after = normalized.find((r) => r.key === "setup");
+    const clock = records.find((r) => r.key === "clock");
+    try {
+      await state.transact([{ key: "setup", expectedVersion: before.version, value: after.value }, clockMutation({ version: clock?.version ?? 0, value: clockValue(clock) })]);
+      return;
+    } catch (error) {
+      if (!isDurableStateConflictError(error))
+        throw error;
+    }
+  }
+  fail("version_conflict", 409);
+}
+async function ensureSetup(state, now) {
+  for (let i = 0;i < 64; i++) {
+    if ((await state.list()).length)
+      return;
+    try {
+      await state.transact([{ key: "setup", expectedVersion: 0, value: { schema: ACCOUNT_RECORD_SCHEMA, setup: { phase: "uninitialized" } } }, clockMutation({ version: 0, value: wallTime(now) })]);
+      return;
+    } catch (error) {
+      if (!isDurableStateConflictError(error))
+        throw error;
+    }
+  }
+  fail("version_conflict", 409);
+}
+function initialUserMutations(records, user, hash) {
+  return [
+    { key: "setup", expectedVersion: records.find((r) => r.key === "setup")?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, setup: { phase: "ready" } } },
+    mutation(settings(records), "settings", EMPTY_SETTINGS),
+    mutation(turnstile(records), "turnstile", EMPTY_TURNSTILE),
+    { key: "user:" + user.id, expectedVersion: 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, user }) },
+    { key: "credential:" + user.id, expectedVersion: 0, value: { schema: ACCOUNT_RECORD_SCHEMA, credential: { passwordHash: hash, temporary: false } } },
+    { key: "recovery-anchor", expectedVersion: 0, value: { schema: ACCOUNT_RECORD_SCHEMA, userId: user.id } }
+  ];
+}
+function offlinePasswordInput(input, operation) {
+  const b = object(input);
+  exact(b, ["operation", "username", "password", "passwordConfirmation"]);
+  if (b.operation !== operation)
+    fail("invalid_input");
+  const name = username(b.username), p = password(b.password);
+  if (b.passwordConfirmation !== p)
+    fail("password_confirmation");
+  return { name, p };
+}
+async function addUserOffline(input, context) {
+  const { name, p } = offlinePasswordInput(input, "add-user");
   const state = context.durableState, now = context.now ?? Date.now;
+  await clearSetupCode(state);
+  const hash = await Bun.password.hash(p, { algorithm: "argon2id", memoryCost: 65536, timeCost: 3 });
   for (let i = 0;i < 64; i++) {
-    const records = await state.list(), fresh = !records.length;
-    if (!fresh)
-      await readManagementSetup(state);
-    const setup = fresh ? undefined : setupRecord(records);
-    if (setup?.value.phase === "ready")
-      fail("already_initialized", 409);
-    const clock = fresh ? { version: 0, value: wallTime(now) } : await observeClock(state, now), code = randomBytes2(32).toString("base64url"), expiresAt = clock.value + 30 * 60000;
+    const records = await state.list();
+    if (records.length)
+      validateState(records);
+    const all = users(records);
+    if (all.some((u) => u.username === name))
+      fail("username_exists", 409);
+    if (all.length >= MAX_USERS)
+      fail("user_limit", 409);
+    const user = { id: randomUUID(), username: name, displayName: name, disabled: false, generation: 1 };
+    const pending = !records.length || setupRecord(records).value.phase === "uninitialized";
+    const changes = pending ? initialUserMutations(records, user, hash) : [
+      { key: "user:" + user.id, expectedVersion: 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, user }) },
+      { key: "credential:" + user.id, expectedVersion: 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, credential: { passwordHash: hash, temporary: false } }) }
+    ];
+    const clock = records.find((r) => r.key === "clock");
+    changes.push(clockMutation({ version: clock?.version ?? 0, value: Math.max(clock ? clockValue(clock) : 0, wallTime(now)) }));
     try {
-      await state.transact([{ key: "setup", expectedVersion: setup?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, setup: { phase: "uninitialized", code: { digest: digest(code), expiresAt } } }) }, clockMutation(clock)]);
-      return { code, expiresAt };
-    } catch (e) {
-      if (!isDurableStateConflictError(e))
-        throw e;
+      await state.transact(changes);
+      return dto({ ...user, passwordHash: hash, temporary: false });
+    } catch (error) {
+      if (!isDurableStateConflictError(error))
+        throw error;
+    }
+  }
+  return fail("version_conflict", 409);
+}
+async function resetUserPasswordOffline(input, context) {
+  const { name, p } = offlinePasswordInput(input, "reset-password");
+  const state = context.durableState, now = context.now ?? Date.now;
+  await clearSetupCode(state);
+  const initial = await state.list();
+  if (initial.length)
+    validateState(initial);
+  if (!users(initial).some((u) => u.username === name))
+    fail("not_found", 404);
+  const hash = await Bun.password.hash(p, { algorithm: "argon2id", memoryCost: 65536, timeCost: 3 });
+  for (let i = 0;i < 64; i++) {
+    const records = await state.list();
+    validateState(records);
+    const target = users(records).find((u) => u.username === name);
+    if (!target)
+      fail("not_found", 404);
+    const record = records.find((r) => r.key === "user:" + target.id), credential = records.find((r) => r.key === "credential:" + target.id);
+    const { passwordHash: _, temporary: __, ...prior } = target, user = { ...prior, generation: next(prior.generation) };
+    const s = settings(records), failures = slots(records, "failure", MAX_FAILURES, validateFailure), clock = records.find((r) => r.key === "clock");
+    try {
+      await state.transact([
+        { key: record.key, expectedVersion: record.version, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, user }) },
+        { key: "credential:" + user.id, expectedVersion: credential?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, credential: { passwordHash: hash, temporary: false } } },
+        mutation(s, "settings", { ...s.value, failureEpoch: next(Math.max(s.value.failureEpoch, ...failures.map((f) => f.value?.epoch ?? 0))) }),
+        clockMutation({ version: clock.version, value: Math.max(clockValue(clock), wallTime(now)) })
+      ]);
+      return dto({ ...user, passwordHash: hash, temporary: false });
+    } catch (error) {
+      if (!isDurableStateConflictError(error))
+        throw error;
     }
   }
   return fail("version_conflict", 409);
@@ -3822,7 +3948,9 @@ async function recoverIdentity(input, context) {
     fail("password_confirmation");
   if (typeof b.reason !== "string" || !b.reason.trim() || b.reason.length > 512)
     fail("invalid_reason");
-  const state = context.durableState, now = context.now ?? Date.now, hash = await Bun.password.hash(p, { algorithm: "argon2id", memoryCost: 65536, timeCost: 3 });
+  const state = context.durableState, now = context.now ?? Date.now;
+  await clearSetupCode(state);
+  const hash = await Bun.password.hash(p, { algorithm: "argon2id", memoryCost: 65536, timeCost: 3 });
   for (let i = 0;i < 64; i++) {
     const records = await state.list();
     validateKeys(records);
@@ -3834,9 +3962,11 @@ async function recoverIdentity(input, context) {
         fail("corrupt_state", 503);
       anchorId = id;
     }
-    for (const r of records)
-      if (r.value?.schema !== ACCOUNT_RECORD_SCHEMA)
+    for (const r of records) {
+      const anchorTombstone = anchorId && ["user:" + anchorId, "credential:" + anchorId].includes(r.key) && r.value === null;
+      if (!anchorTombstone && r.value?.schema !== ACCOUNT_RECORD_SCHEMA)
         fail("corrupt_state", 503);
+    }
     const id = anchorId ?? randomUUID(), record = records.find((r) => r.key === "user:" + id);
     let prior;
     if (record) {
@@ -3850,15 +3980,27 @@ async function recoverIdentity(input, context) {
     const other = records.filter((r) => r.key.startsWith("user:") && r.key !== "user:" + id).map((r) => validateUser(envelope(r.value, "user")));
     if (other.some((u) => u.username === name))
       fail("username_exists", 409);
-    const s = settings(records), turn = turnstile(records), clockRecord = records.find((r) => r.key === "clock");
-    let observed = 0;
-    try {
-      observed = clockValue(clockRecord);
-    } catch (error) {
-      if (!(error instanceof AccountError))
-        throw error;
+    const user = { id, username: name, displayName: prior?.displayName ?? name, disabled: false, generation: next(prior?.generation ?? 0) };
+    const credential = records.find((r) => r.key === "credential:" + id);
+    if (records.length) {
+      if (!anchorId && setupRecord(records).value.phase === "ready")
+        fail("corrupt_state", 503);
+      const repaired = records.filter((r) => !["user:" + id, "credential:" + id].includes(r.key));
+      const setup = records.find((r) => r.key === "setup");
+      if (!setup)
+        fail("corrupt_state", 503);
+      const phase = envelope(setup.value, "setup").phase;
+      if (phase === "ready") {
+        validateState([
+          ...repaired,
+          { key: "user:" + id, version: record?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, user }) },
+          { key: "credential:" + id, version: credential?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, credential: { passwordHash: hash, temporary: false } } }
+        ]);
+      } else
+        validateState(records);
     }
-    const at = Math.max(observed, wallTime(now)), user = { id, username: name, displayName: prior?.displayName ?? name, disabled: false, generation: next(prior?.generation ?? 0) }, credential = records.find((r) => r.key === "credential:" + id);
+    const s = settings(records), turn = turnstile(records), clockRecord = records.find((r) => r.key === "clock");
+    const at = Math.max(clockRecord ? clockValue(clockRecord) : 0, wallTime(now));
     const failures = slots(records, "failure", MAX_FAILURES, validateFailure);
     slots(records, "session", MAX_SESSIONS, validateSession);
     connections(records);
@@ -3883,29 +4025,34 @@ async function recoverIdentity(input, context) {
   }
   return fail("version_conflict", 409);
 }
-var control_default = { createControl, readManagementSetup, offlineRecovery: {
-  kind: "identity",
-  prepareInitialization,
-  prompts: [{ name: "username", label: "Recovery username", secret: false }, { name: "password", label: "New password", secret: true }, { name: "passwordConfirmation", label: "Confirm password", secret: true }, { name: "reason", label: "Recovery reason", secret: false }, { name: "disableTurnstile", label: "Disable Turnstile? Type yes to disable; default no", secret: false }],
-  recover: recoverIdentity
-} };
+var passwordPrompts = [
+  { name: "username", label: "Username", secret: false },
+  { name: "password", label: "New password", secret: true },
+  { name: "passwordConfirmation", label: "Confirm password", secret: true }
+];
+var control_default = { createControl, readManagementSetup, offlineRecovery: { kind: "identity", actions: {
+  "add-user": { prompts: passwordPrompts, run: (input, context) => addUserOffline({ ...input, operation: "add-user" }, context) },
+  "reset-password": { prompts: passwordPrompts, run: (input, context) => resetUserPasswordOffline({ ...input, operation: "reset-password" }, context) },
+  reset: { prompts: [{ name: "username", label: "Recovery username", secret: false }, ...passwordPrompts.slice(1), { name: "reason", label: "Recovery reason", secret: false }, { name: "disableTurnstile", label: "Disable Turnstile? Type yes to disable; default no", secret: false }], run: (input, context) => recoverIdentity({ ...input, operation: "reset" }, context) }
+} } };
 export {
   ACCOUNT_RECORD_SCHEMA,
   LoginProviders,
   MAX_FAILURES,
   MAX_SESSIONS,
   UserAuthControl,
+  addUserOffline,
   api,
   controlApi,
   controlRpc,
   createControl,
   control_default as default,
   parseProvider,
-  prepareInitialization,
   providerUrl,
   readManagementSetup,
   recoverIdentity,
+  resetUserPasswordOffline,
   rpc
 };
 
-//# debugId=5FEFB6DCD014AEAE64756E2164756E21
+//# debugId=2F381703039117D664756E2164756E21