@jskit-ai/auth-core 0.1.242 → 0.1.244

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-core",
-  "version": "0.1.242",
+  "version": "0.1.244",
   "type": "module",
   "scripts": {
     "test": "node --test --test-concurrency=1"
@@ -135,6 +135,6 @@
     }
   },
   "peerDependencies": {
-    "@jskit-ai/kernel": "0.1.244"
+    "@jskit-ai/kernel": "0.1.246"
   }
 }

package/src/server/actions/auth.contributor.js

@@ -1,7 +1,7 @@
 import { createSchema } from "json-rest-schema";
 import {
   emptyInputValidator
-} from "@jskit-ai/kernel/shared/actions/actionContributorHelpers";
+} from "@jskit-ai/kernel/server/actions/actionContributorHelpers";
 import {
   composeSchemaDefinitions
 } from "@jskit-ai/kernel/shared/validators";
@@ -54,10 +54,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authRegisterCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.register"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.register(input);
     }
@@ -70,10 +66,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authRegisterConfirmationResendCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.register.confirmation.resend"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.resendRegisterConfirmation(input);
     }
@@ -86,10 +78,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginPasswordCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.password"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.login(input);
     }
@@ -102,10 +90,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginOtpRequestCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.otp.request"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.requestOtpLogin(input);
     }
@@ -118,10 +102,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginOtpVerifyCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.otp.verify"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.verifyOtpLogin(input);
     }
@@ -134,12 +114,8 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginOAuthStartInput,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.oauth.start"
-    },
-    observability: {},
-    async run(authService, input) {
-      return authService.oauthStart(input);
+    async run(authService, input, context) {
+      return authService.oauthStart(input, context?.requestMeta?.request || null);
     }
   },
   {
@@ -150,12 +126,8 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginOAuthCompleteCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.oauth.complete"
-    },
-    observability: {},
-    async run(authService, input) {
-      return authService.oauthComplete(input);
+    async run(authService, input, context) {
+      return authService.oauthComplete(input, context?.requestMeta?.request || null);
     }
   },
   {
@@ -166,10 +138,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authDevLoginAsCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.dev.loginAs"
-    },
-    observability: {},
     async run(authService, input, context) {
       return authService.devLoginAs(
         requireRequestContext(context, "auth.dev.loginAs"),
@@ -185,10 +153,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authPasswordResetRequestCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.password.reset.request"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.requestPasswordReset(input);
     }
@@ -201,10 +165,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authPasswordRecoveryCompleteCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.password.recovery.complete"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.completePasswordRecovery(input);
     }
@@ -217,10 +177,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authPasswordResetCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.password.reset"
-    },
-    observability: {},
     async run(authService, input, context) {
       return authService.resetPassword(requireRequestContext(context, "auth.password.reset"), input);
     }
@@ -234,10 +190,6 @@ const authActionSpecifications = Object.freeze([
     input: emptyInputValidator,
     output: authLogoutOutput,
     idempotency: "none",
-    audit: {
-      actionName: "auth.logout"
-    },
-    observability: {},
     async run(authService, _input, context) {
       let logoutResult = {
         ok: true,
@@ -260,10 +212,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: emptyInputValidator,
     idempotency: "none",
-    audit: {
-      actionName: "auth.session.read"
-    },
-    observability: {},
     async run(authService, _input, context) {
       return authService.authenticateRequest(requireRequestContext(context, "auth.session.read"));
     }

package/src/server/lib/plugin.js

@@ -2,6 +2,7 @@ import fastifyCookie from "@fastify/cookie";
 import fastifyCsrfProtection from "@fastify/csrf-protection";
 import fastifyRateLimit from "@fastify/rate-limit";
 import { safeRequestUrl } from "@jskit-ai/kernel/server/runtime/requestUrl";
+import { hostOnlyCookieName } from "../utils.js";
 
 import { assertAuthPolicyDeps, normalizeActorResolution } from "./authPolicySupport.js";
 import { AUTH_POLICY_DENY_REASONS, createAuthPolicyError } from "./errors.js";
@@ -101,18 +102,26 @@ function authPolicyPlugin(deps = {}, options = {}) {
       ? options.createError
       : (status, message) => createAuthPolicyError(status, message);
 
+  // CSRF uses tokens checked against a secret cookie, never SameSite alone. In
+  // production that cookie is host-only (__Host-), so a sibling host cannot plant
+  // a secret it knows and forge tokens.
+  const csrfCookieSecure = typeof csrfCookieOpts.secure === "boolean" ? csrfCookieOpts.secure : nodeEnv === "production";
+  const csrfCookieOptions = {
+    path: "/",
+    sameSite: "lax",
+    httpOnly: true,
+    ...csrfCookieOpts,
+    secure: csrfCookieSecure
+  };
+  const csrfCookieHostOnly = csrfCookieSecure && csrfCookieOptions.path === "/" && !csrfCookieOptions.domain;
+
   return async function registerAuthPolicyPlugin(fastify) {
     await fastify.register(fastifyCookie);
     await fastify.register(fastifyRateLimit, rateLimitPluginOptions);
     await fastify.register(fastifyCsrfProtection, {
       getToken: resolveCsrfTokenFn,
-      cookieOpts: {
-        path: "/",
-        sameSite: "lax",
-        secure: nodeEnv === "production",
-        httpOnly: true,
-        ...csrfCookieOpts
-      }
+      cookieKey: hostOnlyCookieName("_csrf", csrfCookieHostOnly),
+      cookieOpts: csrfCookieOptions
     });
 
     fastify.decorateRequest("user", null);

package/src/server/providers/AuthPolicyProvider.js

@@ -28,9 +28,12 @@ function createPolicy({ authService, extensions, env }) {
       nodeEnv: String(env.NODE_ENV || "development").trim() || "development",
       apiPrefix: String(env.AUTH_API_PREFIX || "/api/").trim() || "/api/",
       unsafeMethods: Object.freeze(parseList(env.AUTH_CSRF_UNSAFE_METHODS)),
-      csrfCookieOpts: Object.freeze({
-        secure: parseBooleanFlag(env.AUTH_CSRF_COOKIE_SECURE, false)
-      })
+      // Unset AUTH_CSRF_COOKIE_SECURE follows NODE_ENV (Secure in production).
+      csrfCookieOpts: Object.freeze(
+        String(env.AUTH_CSRF_COOKIE_SECURE ?? "").trim()
+          ? { secure: parseBooleanFlag(env.AUTH_CSRF_COOKIE_SECURE, false) }
+          : {}
+      )
     })
   });
 }

package/src/server/utils.js

@@ -1,5 +1,15 @@
 import { normalizeReturnToPath as normalizeSharedReturnToPath } from "@jskit-ai/kernel/shared/support";
 
+const HOST_ONLY_COOKIE_PREFIX = "__Host-";
+
+// Secure (HTTPS) cookies carry the __Host- prefix: the browser then requires
+// Secure, Path=/ and no Domain, so a sibling host under the same parent domain
+// can neither set nor overwrite them (no cookie tossing or session fixation).
+export function hostOnlyCookieName(name, secure) {
+  const cookieName = String(name || "").trim();
+  return secure && !cookieName.startsWith(HOST_ONLY_COOKIE_PREFIX) ? `${HOST_ONLY_COOKIE_PREFIX}${cookieName}` : cookieName;
+}
+
 export function normalizeEmail(value) {
   return String(value || "")
     .trim()

package/src/shared/commands/authCommandValidators.js

@@ -183,7 +183,8 @@ const oauthCompleteOutputValidator = deepFreeze({
     ok: { type: "boolean", required: true },
     provider: { ...oauthProviderFieldDefinition, required: false },
     username: { type: "string", required: true, minLength: 1, maxLength: 120 },
-    email: { ...authEmailFieldDefinition, required: true }
+    email: { ...authEmailFieldDefinition, required: true },
+    returnTo: { ...oauthReturnToFieldDefinition, required: false }
   }),
   mode: "replace"
 });

package/src/shared/commands/authDevLoginAsCommand.js

@@ -1,5 +1,5 @@
 import { createSchema } from "json-rest-schema";
-import { recordIdInputSchema } from "@jskit-ai/kernel/shared/validators";
+import { recordIdSchema } from "@jskit-ai/kernel/shared/validators";
 import { deepFreeze } from "@jskit-ai/kernel/shared/support/deepFreeze";
 import {
   authEmailValidator,
@@ -24,7 +24,7 @@ const AUTH_DEV_LOGIN_AS_MESSAGES = createCommandMessages({
 const authDevLoginAsBodyValidator = deepFreeze({
   schema: createSchema({
     userId: {
-      ...recordIdInputSchema,
+      ...recordIdSchema,
       required: false
     },
     email: {

package/src/shared/commands/authLoginOAuthCompleteCommand.js

@@ -23,6 +23,12 @@ const AUTH_LOGIN_OAUTH_COMPLETE_MESSAGES = createCommandMessages({
     },
     refreshToken: {
       default: "Refresh token is invalid."
+    },
+    state: {
+      default: "OAuth state is invalid."
+    },
+    iss: {
+      default: "OAuth issuer is invalid."
     }
   }
 });
@@ -33,6 +39,8 @@ const authLoginOAuthCompleteBodyValidator = deepFreeze({
     code: { ...authRecoveryTokenFieldDefinition, required: false },
     accessToken: { ...authAccessTokenFieldDefinition, required: false },
     refreshToken: { ...authRefreshTokenFieldDefinition, required: false },
+    state: { type: "string", required: false, minLength: 1, maxLength: 512 },
+    iss: { type: "string", required: false, minLength: 1, maxLength: 2048 },
     error: { type: "string", required: false, minLength: 1, maxLength: 128 },
     errorDescription: { type: "string", required: false, minLength: 1, maxLength: 1024 },
     error_code: { type: "string", required: false, minLength: 1, maxLength: 128 },

package/test/commandValidators.test.js

@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { resolveStructuredSchemaTransportSchema } from "@jskit-ai/kernel/shared/validators";
+import { resolveSchemaTransportSchemaDefinition } from "@jskit-ai/kernel/shared/validators";
 import { authRegisterCommand } from "../src/shared/commands/authRegisterCommand.js";
 import { authRegisterConfirmationResendCommand } from "../src/shared/commands/authRegisterConfirmationResendCommand.js";
 import { authLoginPasswordCommand } from "../src/shared/commands/authLoginPasswordCommand.js";
@@ -36,7 +36,7 @@ test("auth commands expose canonical operation validator messages", () => {
 });
 
 test("oauth complete command allows provider-less session-pair callbacks", () => {
-  const bodySchema = resolveStructuredSchemaTransportSchema(
+  const bodySchema = resolveSchemaTransportSchemaDefinition(
     authLoginOAuthCompleteCommand.operation.body,
     {
       context: "auth login oauth complete body",
@@ -46,7 +46,7 @@ test("oauth complete command allows provider-less session-pair callbacks", () =>
   const bodyRequired = Array.isArray(bodySchema?.required) ? bodySchema.required : [];
   assert.equal(bodyRequired.includes("provider"), false);
 
-  const responseSchema = resolveStructuredSchemaTransportSchema(
+  const responseSchema = resolveSchemaTransportSchemaDefinition(
     authLoginOAuthCompleteCommand.operation.response,
     {
       context: "auth login oauth complete response",
@@ -78,21 +78,21 @@ test("auth command body validators lowercase email inputs", () => {
 });
 
 test("auth session and oauth start commands expose explicit nested response schemas", () => {
-  const sessionResponseSchema = resolveStructuredSchemaTransportSchema(
+  const sessionResponseSchema = resolveSchemaTransportSchemaDefinition(
     authSessionReadCommand.operation.response,
     {
       context: "auth session read response",
       defaultMode: "replace"
     }
   );
-  const sessionUnavailableSchema = resolveStructuredSchemaTransportSchema(
+  const sessionUnavailableSchema = resolveSchemaTransportSchemaDefinition(
     authSessionReadCommand.operation.unavailableResponse,
     {
       context: "auth session read unavailable response",
       defaultMode: "replace"
     }
   );
-  const oauthStartResponseSchema = resolveStructuredSchemaTransportSchema(
+  const oauthStartResponseSchema = resolveSchemaTransportSchemaDefinition(
     authLoginOAuthStartCommand.operation.response,
     {
       context: "auth login oauth start response",

package/test/plugin.test.js

@@ -48,6 +48,38 @@ test("auth policy protects real Fastify requests with CSRF and route rate limits
   assert.equal((await app.inject({ method: "GET", url: "/api/limited" })).statusCode, 429);
 });
 
+test("production CSRF secrets live in a host-only __Host- cookie a sibling host cannot plant", async (t) => {
+  const app = Fastify();
+  t.after(() => app.close());
+  await authPolicyPlugin({
+    async resolveActor() {
+      return { authenticated: false, actor: null, transientFailure: false };
+    },
+    hasPermission() {
+      return false;
+    }
+  }, { nodeEnv: "production" })(app);
+  app.get("/api/csrf", { config: { authPolicy: "public" } }, (_request, reply) => ({ token: reply.generateCsrf() }));
+  app.post("/api/write", { config: { authPolicy: "public" } }, () => ({ accepted: true }));
+
+  const csrf = await app.inject({ method: "GET", url: "/api/csrf" });
+  const [secretCookie] = csrf.cookies;
+  assert.equal(secretCookie.name, "__Host-_csrf");
+  assert.equal(secretCookie.path, "/");
+  assert.equal(secretCookie.secure, true);
+  assert.equal(secretCookie.domain, undefined);
+  const token = csrf.json().token;
+  const accepted = await app.inject({
+    method: "POST", url: "/api/write", cookies: { "__Host-_csrf": secretCookie.value }, headers: { "x-csrf-token": token }
+  });
+  assert.equal(accepted.statusCode, 200);
+  // A secret tossed under the old, unprefixed name is never read.
+  const tossed = await app.inject({
+    method: "POST", url: "/api/write", cookies: { _csrf: secretCookie.value }, headers: { "x-csrf-token": token }
+  });
+  assert.equal(tossed.statusCode, 403);
+});
+
 test("requires resolveActor and hasPermission dependencies", () => {
   assert.throws(() => authPolicyPlugin(), /resolveActor is required/);
   assert.throws(() => authPolicyPlugin({ resolveActor() {} }), /hasPermission is required/);