@jimhoyd/urlcode-auth 0.1.0-alpha.1 → 0.1.0-alpha.2

package/dist/manual-recovery.js

@@ -0,0 +1,35 @@
+import { createPresentation } from "./presentation.js";
+import { AuthHttp, AuthHttpError, csrfField, escapeHtml, formField, jsonResponse, readFields, screenResponse, wantsJson } from "./auth-ui.js";
+import { Markup } from '@jimhoyd/urlcode-ui';
+export function validateRecoveryEvidence(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).some(key => !['summary', 'reference'].includes(key)))
+        throw new Error('Invalid recovery evidence');
+    const bounded = (value, max) => typeof value === 'string' && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+    if (!bounded(input.summary, 2000) || input.reference !== undefined && !bounded(input.reference, 256))
+        throw new Error('Invalid recovery evidence');
+    return { summary: input.summary.trim(), ...(input.reference !== undefined ? { reference: input.reference.trim() } : {}) };
+}
+/** Redemption is POST-only and creates an enrollment session, never normal access. */
+export function createManualRecoveryFlows(service, http, mount, ui) {
+    return { async handle(request, presentation = createPresentation().resolve()) {
+            const tr = (key) => presentation.text('manualRecovery.' + key);
+            if (request.path.slice(mount.length) !== '/restore-access')
+                return;
+            if (!service.getManualRecoveryEnabled())
+                throw new AuthHttpError(404, 'Not found');
+            if (!['GET', 'HEAD', 'POST'].includes(request.method))
+                throw new AuthHttpError(405, 'GET, HEAD or POST required');
+            if (request.method !== 'POST') {
+                const tokens = request.query.getAll('token');
+                if (tokens.length !== 1 || !/^[A-Za-z0-9_-]{43}$/.test(tokens[0]))
+                    throw new AuthHttpError(400, 'A single restoration token is required');
+                const prepared = http.prepare(request);
+                return screenResponse(tr('restoreTitle'), { name: 'auth/restore-access', view: { intro: tr('restoreIntro'), form: new Markup(`<form method="post" action="${escapeHtml(mount + '/restore-access?lang=' + encodeURIComponent(presentation.locale))}">${csrfField(prepared.csrf)}<input type="hidden" name="token" value="${escapeHtml(tokens[0])}">${formField('password', tr('newPassword'), 'password', 'new-password')}<button type="submit">${escapeHtml(tr('replace'))}</button></form>`) } }, { status: 200, headers: prepared.headers, presentation, layout: 'compact', ui });
+            }
+            const fields = readFields(request, ['token', 'password']);
+            http.verify(request, fields);
+            const result = await service.redeemRecoveryCase({ token: fields.token || '', password: fields.password || '' });
+            const headers = http.sessionHeaders(result.token);
+            return wantsJson(request) ? jsonResponse(200, { enrollmentRequired: true, user: result.user, csrf: http.token(result.token) }, headers) : jsonResponse(303, { enrollmentRequired: true }, [['location', mount + '/account?lang=' + encodeURIComponent(presentation.locale)], ...headers]);
+        } };
+}

package/dist/oidc.d.ts

@@ -0,0 +1,31 @@
+/** Secrets in this flow stay in encrypted, single-use server storage. */
+export interface OidcFlow {
+    state: string;
+    nonce: string;
+    verifier: string;
+}
+export interface OidcIdentity {
+    issuer: string;
+    subject: string;
+    email?: string;
+    emailVerified: boolean;
+}
+export interface OidcProviderOptions {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    /** Trusted operator transport, useful for offline provider fixtures. */
+    fetch?: typeof globalThis.fetch;
+    scope?: 'openid email' | 'name email';
+    responseMode?: 'query' | 'form_post';
+    appleEmailClaim?: boolean;
+}
+export interface OidcProvider {
+    start(): Promise<{
+        url: string;
+        flow: OidcFlow;
+    }>;
+    complete(callback: URL | Request, flow: OidcFlow): Promise<OidcIdentity>;
+}
+export declare function createOidcProvider(options: OidcProviderOptions): Promise<OidcProvider>;

package/dist/oidc.js

@@ -0,0 +1,54 @@
+import * as oidc from 'openid-client';
+export async function createOidcProvider(options) {
+    const issuer = new URL(options.issuer), redirect = new URL(options.redirectUri);
+    if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.hash || issuer.search)
+        throw new Error('OIDC issuer must be an operator-supplied HTTPS URL');
+    if (redirect.protocol !== 'https:' || redirect.username || redirect.password || redirect.hash || redirect.search)
+        throw new Error('OIDC callback must be a fixed HTTPS URL');
+    if (!options.clientId || !options.clientSecret)
+        throw new Error('OIDC client credentials are required');
+    const transport = async (url, init) => {
+        const endpoint = new URL(String(url));
+        if (endpoint.protocol !== 'https:' || endpoint.username || endpoint.password)
+            throw new Error('OIDC endpoint must use HTTPS');
+        const response = await (options.fetch ?? globalThis.fetch)(url, { ...init, body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body ?? null, redirect: 'error', signal: AbortSignal.any([...(init?.signal ? [init.signal] : []), AbortSignal.timeout(10000)]) });
+        if (response.status >= 300 && response.status < 400)
+            throw new Error('OIDC redirects are not accepted');
+        const reader = response.body?.getReader();
+        const chunks = [];
+        let size = 0;
+        if (reader)
+            try {
+                for (;;) {
+                    const part = await reader.read();
+                    if (part.done)
+                        break;
+                    size += part.value.byteLength;
+                    if (size > 1048576)
+                        throw new Error('OIDC response exceeds limit');
+                    chunks.push(part.value);
+                }
+            }
+            finally {
+                await reader.cancel().catch(() => { });
+                reader.releaseLock();
+            }
+        return new Response(Buffer.concat(chunks), { status: response.status, headers: response.headers });
+    };
+    const config = await oidc.discovery(issuer, options.clientId, options.clientSecret, undefined, { [oidc.customFetch]: transport, timeout: 10, execute: [oidc.enableNonRepudiationChecks] });
+    return {
+        async start() { const flow = { state: oidc.randomState(), nonce: oidc.randomNonce(), verifier: oidc.randomPKCECodeVerifier() }; const url = oidc.buildAuthorizationUrl(config, { redirect_uri: redirect.href, scope: options.scope ?? 'openid email', ...(options.responseMode ? { response_mode: options.responseMode } : {}), response_type: 'code', state: flow.state, nonce: flow.nonce, code_challenge: await oidc.calculatePKCECodeChallenge(flow.verifier), code_challenge_method: 'S256' }); return { url: url.href, flow }; },
+        async complete(callback, flow) {
+            const url = callback instanceof URL ? callback : new URL(callback.url);
+            if (url.origin !== redirect.origin || url.pathname !== redirect.pathname)
+                throw new Error('OIDC callback mismatch');
+            if (!flow || ![flow.state, flow.nonce, flow.verifier].every(value => typeof value === 'string' && value.length >= 32 && value.length <= 256))
+                throw new Error('Invalid OIDC flow');
+            const tokens = await oidc.authorizationCodeGrant(config, callback, { expectedState: flow.state, expectedNonce: flow.nonce, pkceCodeVerifier: flow.verifier, idTokenExpected: true });
+            const claims = tokens.claims();
+            if (!claims || typeof claims.sub !== 'string' || !claims.sub || claims.sub.length > 1024)
+                throw new Error('Invalid OIDC identity');
+            return { issuer: config.serverMetadata().issuer, subject: claims.sub, ...(typeof claims.email === 'string' && claims.email.length <= 320 ? { email: claims.email } : {}), emailVerified: claims.email_verified === true || (options.appleEmailClaim === true && claims.email_verified === 'true') };
+        }
+    };
+}

package/dist/passkeys.d.ts

@@ -0,0 +1,24 @@
+import type { RegistrationResponseJSON, AuthenticationResponseJSON } from '@simplewebauthn/server';
+export interface StoredPasskey {
+    id: string;
+    publicKey: string;
+    counter: number;
+    transports?: string[];
+}
+export interface PasskeyProviderOptions {
+    origin: string;
+    rpId: string;
+    rpName: string;
+}
+export declare function createPasskeyProvider({ origin, rpId, rpName }: PasskeyProviderOptions): {
+    beginRegistration(user: {
+        id: string;
+        email: string;
+    }, exclude?: StoredPasskey[]): Promise<import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON>;
+    verifyRegistration(response: RegistrationResponseJSON, challenge: string): Promise<StoredPasskey>;
+    beginAuthentication(): Promise<import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>;
+    verifyAuthentication(response: AuthenticationResponseJSON, challenge: string, stored: StoredPasskey): Promise<{
+        counter: number;
+    }>;
+};
+export type PasskeyProvider = ReturnType<typeof createPasskeyProvider>;

package/dist/passkeys.js

@@ -0,0 +1,29 @@
+import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from '@simplewebauthn/server';
+export function createPasskeyProvider({ origin, rpId, rpName }) {
+    const url = new URL(origin);
+    // Exact hostname deliberately avoids accidental sibling-site credential sharing.
+    if (url.origin !== origin || url.protocol !== 'https:' || rpId !== url.hostname || !rpName || rpName.length > 128)
+        throw new Error('Passkeys require a canonical HTTPS origin and matching RP hostname');
+    return {
+        beginRegistration(user, exclude = []) {
+            if (!user.id || Buffer.byteLength(user.id) > 64 || exclude.length > 100)
+                throw new Error('Invalid passkey registration');
+            return generateRegistrationOptions({ rpID: rpId, rpName, userID: new TextEncoder().encode(user.id), userName: user.email, attestationType: 'none', authenticatorSelection: { residentKey: 'required', userVerification: 'required' }, excludeCredentials: exclude.map(item => ({ id: item.id, ...(item.transports ? { transports: item.transports } : {}) })) });
+        },
+        async verifyRegistration(response, challenge) {
+            const result = await verifyRegistrationResponse({ response, expectedChallenge: challenge, expectedOrigin: origin, expectedRPID: rpId, requireUserVerification: true });
+            if (!result.verified)
+                throw new Error('Passkey registration refused');
+            const credential = result.registrationInfo.credential;
+            return { id: credential.id, publicKey: Buffer.from(credential.publicKey).toString('base64url'), counter: credential.counter, ...(credential.transports ? { transports: credential.transports } : {}) };
+        },
+        beginAuthentication() { return generateAuthenticationOptions({ rpID: rpId, userVerification: 'required' }); },
+        async verifyAuthentication(response, challenge, stored) {
+            const credential = { id: stored.id, publicKey: new Uint8Array(Buffer.from(stored.publicKey, 'base64url')), counter: stored.counter, ...(stored.transports ? { transports: stored.transports } : {}) };
+            const result = await verifyAuthenticationResponse({ response, expectedChallenge: challenge, expectedOrigin: origin, expectedRPID: rpId, credential, requireUserVerification: true });
+            if (!result.verified || !result.authenticationInfo.userVerified)
+                throw new Error('Passkey authentication refused');
+            return { counter: result.authenticationInfo.newCounter };
+        }
+    };
+}

package/dist/password-policy.d.ts

@@ -0,0 +1,7 @@
+export interface PasswordBreachOptions {
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+/** Opt-in operator transport. SHA-1 is the range lookup protocol, never password storage.
+ * https://haveibeenpwned.com/API/v3#PwnedPasswords */
+export declare function createPasswordBreachChecker(options?: PasswordBreachOptions): (password: string) => Promise<void>;

package/dist/password-policy.js

@@ -0,0 +1,72 @@
+import { createHash } from 'node:crypto';
+import { AuthError } from "./auth-core.js";
+/** Opt-in operator transport. SHA-1 is the range lookup protocol, never password storage.
+ * https://haveibeenpwned.com/API/v3#PwnedPasswords */
+export function createPasswordBreachChecker(options = {}) {
+    const transport = options.fetch ?? fetch, timeout = options.timeoutMs ?? 3000;
+    let active = 0;
+    if (!Number.isSafeInteger(timeout) || timeout < 10 || timeout > 10000)
+        throw new Error('Invalid breach-check deadline');
+    return async (password) => {
+        if (typeof password !== 'string' || !password || Buffer.byteLength(password) > 1024)
+            throw new AuthError(400, 'password_length_invalid');
+        if (active >= 4)
+            throw new AuthError(503, 'password_check_unavailable');
+        const digest = createHash('sha1').update(password, 'utf8').digest('hex').toUpperCase();
+        const controller = new AbortController();
+        let timer;
+        active++;
+        const work = (async () => {
+            const response = await transport('https://api.pwnedpasswords.com/range/' + digest.slice(0, 5), { method: 'GET', redirect: 'error', headers: { 'Add-Padding': 'true', 'User-Agent': 'URLCode-auth', 'Accept': 'text/plain' }, signal: controller.signal });
+            if (response.status !== 200 || !response.body) {
+                await response.body?.cancel();
+                throw new Error('Unavailable');
+            }
+            const reader = response.body.getReader(), chunks = [];
+            let bytes = 0;
+            try {
+                while (true) {
+                    const chunk = await reader.read();
+                    if (chunk.done)
+                        break;
+                    bytes += chunk.value.byteLength;
+                    if (bytes > 1048576)
+                        throw new Error('Oversized response');
+                    chunks.push(chunk.value);
+                }
+            }
+            finally {
+                await reader.cancel().catch(() => { });
+                reader.releaseLock();
+            }
+            const text = new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks));
+            const lines = text.trim().split(/\r?\n/);
+            if (!text.trim() || lines.length > 20000)
+                throw new Error('Invalid response');
+            let breached = false;
+            for (const line of lines) {
+                const entry = /^([A-F0-9]{35}):([0-9]{1,12})$/.exec(line);
+                if (!entry)
+                    throw new Error('Invalid response');
+                if (entry[1] === digest.slice(5) && Number(entry[2]) > 0)
+                    breached = true;
+            }
+            return breached;
+        })().finally(() => { active--; });
+        try {
+            const breached = await Promise.race([work, new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new Error('Timeout')); }, timeout); })]);
+            if (breached)
+                throw new AuthError(400, 'password_compromised');
+        }
+        catch (error) {
+            if (error instanceof AuthError)
+                throw error;
+            throw new AuthError(503, 'password_check_unavailable');
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            controller.abort();
+        }
+    };
+}

package/dist/presentation.d.ts

@@ -0,0 +1,15 @@
+import type { Catalogue, Presentation, PresentationOptions as UiPresentationOptions, ThemeVariables as UiThemeVariables } from '@jimhoyd/urlcode-ui';
+export type { PluralMessage, Catalogue, LocalePreferences, PresentationContext, Presentation } from '@jimhoyd/urlcode-ui';
+export declare const englishCatalogue: Readonly<Catalogue>;
+export interface ThemeVariables extends UiThemeVariables {
+    '--auth-background'?: string;
+    '--auth-foreground'?: string;
+    '--auth-accent'?: string;
+    '--auth-border'?: string;
+    '--auth-radius'?: string;
+}
+export interface PresentationOptions extends Omit<UiPresentationOptions, 'theme' | 'defaults'> {
+    theme?: ThemeVariables;
+}
+/** Legacy auth theme names are adapted here; the shared UI package knows no auth fields. */
+export declare function createPresentation(options?: PresentationOptions): Presentation;