@jskit-ai/auth-core 0.1.243 → 0.1.245

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-core",
-  "version": "0.1.243",
+  "version": "0.1.245",
   "type": "module",
   "scripts": {
     "test": "node --test --test-concurrency=1"
@@ -135,6 +135,6 @@
     }
   },
   "peerDependencies": {
-    "@jskit-ai/kernel": "0.1.245"
+    "@jskit-ai/kernel": "0.1.247"
   }
 }

package/src/server/actions/auth.contributor.js

@@ -1,7 +1,7 @@
 import { createSchema } from "json-rest-schema";
 import {
   emptyInputValidator
-} from "@jskit-ai/kernel/shared/actions/actionContributorHelpers";
+} from "@jskit-ai/kernel/server/actions/actionContributorHelpers";
 import {
   composeSchemaDefinitions
 } from "@jskit-ai/kernel/shared/validators";
@@ -54,10 +54,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authRegisterCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.register"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.register(input);
     }
@@ -70,10 +66,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authRegisterConfirmationResendCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.register.confirmation.resend"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.resendRegisterConfirmation(input);
     }
@@ -86,10 +78,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginPasswordCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.password"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.login(input);
     }
@@ -102,10 +90,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginOtpRequestCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.otp.request"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.requestOtpLogin(input);
     }
@@ -118,10 +102,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginOtpVerifyCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.otp.verify"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.verifyOtpLogin(input);
     }
@@ -134,10 +114,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginOAuthStartInput,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.oauth.start"
-    },
-    observability: {},
     async run(authService, input, context) {
       return authService.oauthStart(input, context?.requestMeta?.request || null);
     }
@@ -150,10 +126,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authLoginOAuthCompleteCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.login.oauth.complete"
-    },
-    observability: {},
     async run(authService, input, context) {
       return authService.oauthComplete(input, context?.requestMeta?.request || null);
     }
@@ -166,10 +138,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authDevLoginAsCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.dev.loginAs"
-    },
-    observability: {},
     async run(authService, input, context) {
       return authService.devLoginAs(
         requireRequestContext(context, "auth.dev.loginAs"),
@@ -185,10 +153,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authPasswordResetRequestCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.password.reset.request"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.requestPasswordReset(input);
     }
@@ -201,10 +165,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authPasswordRecoveryCompleteCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.password.recovery.complete"
-    },
-    observability: {},
     async run(authService, input) {
       return authService.completePasswordRecovery(input);
     }
@@ -217,10 +177,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: authPasswordResetCommand.operation.body,
     idempotency: "none",
-    audit: {
-      actionName: "auth.password.reset"
-    },
-    observability: {},
     async run(authService, input, context) {
       return authService.resetPassword(requireRequestContext(context, "auth.password.reset"), input);
     }
@@ -234,10 +190,6 @@ const authActionSpecifications = Object.freeze([
     input: emptyInputValidator,
     output: authLogoutOutput,
     idempotency: "none",
-    audit: {
-      actionName: "auth.logout"
-    },
-    observability: {},
     async run(authService, _input, context) {
       let logoutResult = {
         ok: true,
@@ -260,10 +212,6 @@ const authActionSpecifications = Object.freeze([
     surfacesFrom: "enabled",
     input: emptyInputValidator,
     idempotency: "none",
-    audit: {
-      actionName: "auth.session.read"
-    },
-    observability: {},
     async run(authService, _input, context) {
       return authService.authenticateRequest(requireRequestContext(context, "auth.session.read"));
     }

package/src/server/providers/AuthPolicyProvider.js

@@ -13,6 +13,7 @@ function defaultHasPermission({ permission, permissions = [] } = {}) {
 }
 
 function createPolicy({ authService, extensions, env }) {
+  const unsafeMethods = parseList(env.AUTH_CSRF_UNSAFE_METHODS);
   return Object.freeze({
     async resolveActor(request) {
       if (authService && typeof authService.authenticateRequest === "function") {
@@ -27,7 +28,8 @@ function createPolicy({ authService, extensions, env }) {
     options: Object.freeze({
       nodeEnv: String(env.NODE_ENV || "development").trim() || "development",
       apiPrefix: String(env.AUTH_API_PREFIX || "/api/").trim() || "/api/",
-      unsafeMethods: Object.freeze(parseList(env.AUTH_CSRF_UNSAFE_METHODS)),
+      // Unset AUTH_CSRF_UNSAFE_METHODS keeps the plugin default (POST, PUT, PATCH, DELETE).
+      unsafeMethods: unsafeMethods.length > 0 ? Object.freeze(unsafeMethods) : undefined,
       // Unset AUTH_CSRF_COOKIE_SECURE follows NODE_ENV (Secure in production).
       csrfCookieOpts: Object.freeze(
         String(env.AUTH_CSRF_COOKIE_SECURE ?? "").trim()

package/src/shared/commands/authDevLoginAsCommand.js

@@ -1,5 +1,5 @@
 import { createSchema } from "json-rest-schema";
-import { recordIdInputSchema } from "@jskit-ai/kernel/shared/validators";
+import { recordIdSchema } from "@jskit-ai/kernel/shared/validators";
 import { deepFreeze } from "@jskit-ai/kernel/shared/support/deepFreeze";
 import {
   authEmailValidator,
@@ -24,7 +24,7 @@ const AUTH_DEV_LOGIN_AS_MESSAGES = createCommandMessages({
 const authDevLoginAsBodyValidator = deepFreeze({
   schema: createSchema({
     userId: {
-      ...recordIdInputSchema,
+      ...recordIdSchema,
       required: false
     },
     email: {

package/test/commandValidators.test.js

@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { resolveStructuredSchemaTransportSchema } from "@jskit-ai/kernel/shared/validators";
+import { resolveSchemaTransportSchemaDefinition } from "@jskit-ai/kernel/shared/validators";
 import { authRegisterCommand } from "../src/shared/commands/authRegisterCommand.js";
 import { authRegisterConfirmationResendCommand } from "../src/shared/commands/authRegisterConfirmationResendCommand.js";
 import { authLoginPasswordCommand } from "../src/shared/commands/authLoginPasswordCommand.js";
@@ -36,7 +36,7 @@ test("auth commands expose canonical operation validator messages", () => {
 });
 
 test("oauth complete command allows provider-less session-pair callbacks", () => {
-  const bodySchema = resolveStructuredSchemaTransportSchema(
+  const bodySchema = resolveSchemaTransportSchemaDefinition(
     authLoginOAuthCompleteCommand.operation.body,
     {
       context: "auth login oauth complete body",
@@ -46,7 +46,7 @@ test("oauth complete command allows provider-less session-pair callbacks", () =>
   const bodyRequired = Array.isArray(bodySchema?.required) ? bodySchema.required : [];
   assert.equal(bodyRequired.includes("provider"), false);
 
-  const responseSchema = resolveStructuredSchemaTransportSchema(
+  const responseSchema = resolveSchemaTransportSchemaDefinition(
     authLoginOAuthCompleteCommand.operation.response,
     {
       context: "auth login oauth complete response",
@@ -78,21 +78,21 @@ test("auth command body validators lowercase email inputs", () => {
 });
 
 test("auth session and oauth start commands expose explicit nested response schemas", () => {
-  const sessionResponseSchema = resolveStructuredSchemaTransportSchema(
+  const sessionResponseSchema = resolveSchemaTransportSchemaDefinition(
     authSessionReadCommand.operation.response,
     {
       context: "auth session read response",
       defaultMode: "replace"
     }
   );
-  const sessionUnavailableSchema = resolveStructuredSchemaTransportSchema(
+  const sessionUnavailableSchema = resolveSchemaTransportSchemaDefinition(
     authSessionReadCommand.operation.unavailableResponse,
     {
       context: "auth session read unavailable response",
       defaultMode: "replace"
     }
   );
-  const oauthStartResponseSchema = resolveStructuredSchemaTransportSchema(
+  const oauthStartResponseSchema = resolveSchemaTransportSchemaDefinition(
     authLoginOAuthStartCommand.operation.response,
     {
       context: "auth login oauth start response",

package/test/providerRuntime.test.js

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import Fastify from "fastify";
 import { createActionProvider } from "@jskit-ai/kernel/server/actions";
 import { createCapabilityRuntime, defineProvider } from "@jskit-ai/kernel/shared/capabilities";
 import { HttpProvider } from "@jskit-ai/kernel/server/http";
@@ -126,3 +127,23 @@ test("auth policy denies protected routes when no auth service is installed", as
     routeOptions: { config: { authPolicy: "required" } }
   }, {}), /Authentication required/);
 });
+
+test("AuthPolicyProvider checks CSRF on unsafe methods when AUTH_CSRF_UNSAFE_METHODS is unset", async (t) => {
+  const app = Fastify();
+  t.after(() => app.close());
+  const runtime = createCapabilityRuntime({
+    inputs: runtimeInputs(app),
+    providers: [
+      createActionProvider(),
+      HttpProvider,
+      AuthExtensionsProvider,
+      AuthFeature,
+      AuthPolicyProvider
+    ]
+  });
+  await runtime.start();
+  app.post("/api/write", { config: { authPolicy: "public" } }, () => ({ accepted: true }));
+
+  const missingToken = await app.inject({ method: "POST", url: "/api/write" });
+  assert.equal(missingToken.statusCode, 403);
+});