@jskit-ai/auth-core 0.1.242 → 0.1.243

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-core",
-  "version": "0.1.242",
+  "version": "0.1.243",
   "type": "module",
   "scripts": {
     "test": "node --test --test-concurrency=1"
@@ -135,6 +135,6 @@
     }
   },
   "peerDependencies": {
-    "@jskit-ai/kernel": "0.1.244"
+    "@jskit-ai/kernel": "0.1.245"
   }
 }

package/src/server/actions/auth.contributor.js

@@ -138,8 +138,8 @@ const authActionSpecifications = Object.freeze([
       actionName: "auth.login.oauth.start"
     },
     observability: {},
-    async run(authService, input) {
-      return authService.oauthStart(input);
+    async run(authService, input, context) {
+      return authService.oauthStart(input, context?.requestMeta?.request || null);
     }
   },
   {
@@ -154,8 +154,8 @@ const authActionSpecifications = Object.freeze([
       actionName: "auth.login.oauth.complete"
     },
     observability: {},
-    async run(authService, input) {
-      return authService.oauthComplete(input);
+    async run(authService, input, context) {
+      return authService.oauthComplete(input, context?.requestMeta?.request || null);
     }
   },
   {

package/src/server/lib/plugin.js

@@ -2,6 +2,7 @@ import fastifyCookie from "@fastify/cookie";
 import fastifyCsrfProtection from "@fastify/csrf-protection";
 import fastifyRateLimit from "@fastify/rate-limit";
 import { safeRequestUrl } from "@jskit-ai/kernel/server/runtime/requestUrl";
+import { hostOnlyCookieName } from "../utils.js";
 
 import { assertAuthPolicyDeps, normalizeActorResolution } from "./authPolicySupport.js";
 import { AUTH_POLICY_DENY_REASONS, createAuthPolicyError } from "./errors.js";
@@ -101,18 +102,26 @@ function authPolicyPlugin(deps = {}, options = {}) {
       ? options.createError
       : (status, message) => createAuthPolicyError(status, message);
 
+  // CSRF uses tokens checked against a secret cookie, never SameSite alone. In
+  // production that cookie is host-only (__Host-), so a sibling host cannot plant
+  // a secret it knows and forge tokens.
+  const csrfCookieSecure = typeof csrfCookieOpts.secure === "boolean" ? csrfCookieOpts.secure : nodeEnv === "production";
+  const csrfCookieOptions = {
+    path: "/",
+    sameSite: "lax",
+    httpOnly: true,
+    ...csrfCookieOpts,
+    secure: csrfCookieSecure
+  };
+  const csrfCookieHostOnly = csrfCookieSecure && csrfCookieOptions.path === "/" && !csrfCookieOptions.domain;
+
   return async function registerAuthPolicyPlugin(fastify) {
     await fastify.register(fastifyCookie);
     await fastify.register(fastifyRateLimit, rateLimitPluginOptions);
     await fastify.register(fastifyCsrfProtection, {
       getToken: resolveCsrfTokenFn,
-      cookieOpts: {
-        path: "/",
-        sameSite: "lax",
-        secure: nodeEnv === "production",
-        httpOnly: true,
-        ...csrfCookieOpts
-      }
+      cookieKey: hostOnlyCookieName("_csrf", csrfCookieHostOnly),
+      cookieOpts: csrfCookieOptions
     });
 
     fastify.decorateRequest("user", null);

package/src/server/providers/AuthPolicyProvider.js

@@ -28,9 +28,12 @@ function createPolicy({ authService, extensions, env }) {
       nodeEnv: String(env.NODE_ENV || "development").trim() || "development",
       apiPrefix: String(env.AUTH_API_PREFIX || "/api/").trim() || "/api/",
       unsafeMethods: Object.freeze(parseList(env.AUTH_CSRF_UNSAFE_METHODS)),
-      csrfCookieOpts: Object.freeze({
-        secure: parseBooleanFlag(env.AUTH_CSRF_COOKIE_SECURE, false)
-      })
+      // Unset AUTH_CSRF_COOKIE_SECURE follows NODE_ENV (Secure in production).
+      csrfCookieOpts: Object.freeze(
+        String(env.AUTH_CSRF_COOKIE_SECURE ?? "").trim()
+          ? { secure: parseBooleanFlag(env.AUTH_CSRF_COOKIE_SECURE, false) }
+          : {}
+      )
     })
   });
 }

package/src/server/utils.js

@@ -1,5 +1,15 @@
 import { normalizeReturnToPath as normalizeSharedReturnToPath } from "@jskit-ai/kernel/shared/support";
 
+const HOST_ONLY_COOKIE_PREFIX = "__Host-";
+
+// Secure (HTTPS) cookies carry the __Host- prefix: the browser then requires
+// Secure, Path=/ and no Domain, so a sibling host under the same parent domain
+// can neither set nor overwrite them (no cookie tossing or session fixation).
+export function hostOnlyCookieName(name, secure) {
+  const cookieName = String(name || "").trim();
+  return secure && !cookieName.startsWith(HOST_ONLY_COOKIE_PREFIX) ? `${HOST_ONLY_COOKIE_PREFIX}${cookieName}` : cookieName;
+}
+
 export function normalizeEmail(value) {
   return String(value || "")
     .trim()

package/src/shared/commands/authCommandValidators.js

@@ -183,7 +183,8 @@ const oauthCompleteOutputValidator = deepFreeze({
     ok: { type: "boolean", required: true },
     provider: { ...oauthProviderFieldDefinition, required: false },
     username: { type: "string", required: true, minLength: 1, maxLength: 120 },
-    email: { ...authEmailFieldDefinition, required: true }
+    email: { ...authEmailFieldDefinition, required: true },
+    returnTo: { ...oauthReturnToFieldDefinition, required: false }
   }),
   mode: "replace"
 });

package/src/shared/commands/authLoginOAuthCompleteCommand.js

@@ -23,6 +23,12 @@ const AUTH_LOGIN_OAUTH_COMPLETE_MESSAGES = createCommandMessages({
     },
     refreshToken: {
       default: "Refresh token is invalid."
+    },
+    state: {
+      default: "OAuth state is invalid."
+    },
+    iss: {
+      default: "OAuth issuer is invalid."
     }
   }
 });
@@ -33,6 +39,8 @@ const authLoginOAuthCompleteBodyValidator = deepFreeze({
     code: { ...authRecoveryTokenFieldDefinition, required: false },
     accessToken: { ...authAccessTokenFieldDefinition, required: false },
     refreshToken: { ...authRefreshTokenFieldDefinition, required: false },
+    state: { type: "string", required: false, minLength: 1, maxLength: 512 },
+    iss: { type: "string", required: false, minLength: 1, maxLength: 2048 },
     error: { type: "string", required: false, minLength: 1, maxLength: 128 },
     errorDescription: { type: "string", required: false, minLength: 1, maxLength: 1024 },
     error_code: { type: "string", required: false, minLength: 1, maxLength: 128 },

package/test/plugin.test.js

@@ -48,6 +48,38 @@ test("auth policy protects real Fastify requests with CSRF and route rate limits
   assert.equal((await app.inject({ method: "GET", url: "/api/limited" })).statusCode, 429);
 });
 
+test("production CSRF secrets live in a host-only __Host- cookie a sibling host cannot plant", async (t) => {
+  const app = Fastify();
+  t.after(() => app.close());
+  await authPolicyPlugin({
+    async resolveActor() {
+      return { authenticated: false, actor: null, transientFailure: false };
+    },
+    hasPermission() {
+      return false;
+    }
+  }, { nodeEnv: "production" })(app);
+  app.get("/api/csrf", { config: { authPolicy: "public" } }, (_request, reply) => ({ token: reply.generateCsrf() }));
+  app.post("/api/write", { config: { authPolicy: "public" } }, () => ({ accepted: true }));
+
+  const csrf = await app.inject({ method: "GET", url: "/api/csrf" });
+  const [secretCookie] = csrf.cookies;
+  assert.equal(secretCookie.name, "__Host-_csrf");
+  assert.equal(secretCookie.path, "/");
+  assert.equal(secretCookie.secure, true);
+  assert.equal(secretCookie.domain, undefined);
+  const token = csrf.json().token;
+  const accepted = await app.inject({
+    method: "POST", url: "/api/write", cookies: { "__Host-_csrf": secretCookie.value }, headers: { "x-csrf-token": token }
+  });
+  assert.equal(accepted.statusCode, 200);
+  // A secret tossed under the old, unprefixed name is never read.
+  const tossed = await app.inject({
+    method: "POST", url: "/api/write", cookies: { _csrf: secretCookie.value }, headers: { "x-csrf-token": token }
+  });
+  assert.equal(tossed.statusCode, 403);
+});
+
 test("requires resolveActor and hasPermission dependencies", () => {
   assert.throws(() => authPolicyPlugin(), /resolveActor is required/);
   assert.throws(() => authPolicyPlugin({ resolveActor() {} }), /hasPermission is required/);