@kanzo-tech/auth 0.30.2 → 0.31.1

package/dist/server.js

@@ -1,248 +1,286 @@
-import { buildEndSessionUrl as R, randomPKCECodeVerifier as C, randomState as U, randomNonce as D, calculatePKCECodeChallenge as L, buildAuthorizationUrl as j, refreshTokenGrant as M, authorizationCodeGrant as P } from "openid-client";
-import { jwtVerify as F } from "jose";
-import { claims as G } from "./claims.js";
-import { sealedCookie as N } from "./cookie-session.js";
-import { cookieValue as we } from "./cookie-session.js";
-import { DEADLINE as H } from "./deadline.js";
-import { issuer as K } from "./issuer.js";
-import { rewriteOrigin as Te } from "./issuer.js";
-import { keyedSingleFlight as V } from "./single-flight.js";
-import { statelessStore as W } from "./store.js";
-import { ticketStore as ye } from "./store.js";
-import { AuthError as m } from "./types.js";
-const Z = "openid profile email organization:*", $ = 480 * 60, J = 600, X = /^[A-Za-z0-9_-]{16,128}$/, B = "http://schemas.openid.net/event/backchannel-logout", Y = 60;
-function f(o, a, s) {
-  throw new m(o, a, {}, s === void 0 ? void 0 : { cause: s });
+import { buildEndSessionUrl as G, randomPKCECodeVerifier as M, randomState as P, randomNonce as K, calculatePKCECodeChallenge as W, buildAuthorizationUrl as F, refreshTokenGrant as H, genericGrantRequest as Z, authorizationCodeGrant as V } from "openid-client";
+import { jwtVerify as J } from "jose";
+import { claims as X } from "./claims.js";
+import { sealedCookie as O } from "./cookie-session.js";
+import { cookieValue as be } from "./cookie-session.js";
+import { DEADLINE as Y } from "./deadline.js";
+import { DEFAULT_RENEW_WITHIN as q } from "./renew-within.js";
+import { issuer as B } from "./issuer.js";
+import { rewriteOrigin as Ie } from "./issuer.js";
+import { keyedSingleFlight as R } from "./single-flight.js";
+import { statelessStore as Q } from "./store.js";
+import { ticketStore as Oe } from "./store.js";
+import { AuthError as p } from "./types.js";
+const ee = "openid profile email organization:*", te = 480 * 60, ne = 600, oe = /^[A-Za-z0-9_-]{16,128}$/, se = "http://schemas.openid.net/event/backchannel-logout", ie = "urn:ietf:params:oauth:grant-type:token-exchange", z = "urn:ietf:params:oauth:token-type:access_token", ae = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,254}$/;
+function f(i, c, a) {
+  throw new p(i, c, {}, a === void 0 ? void 0 : { cause: a });
 }
-function _(o) {
-  if (typeof o != "object" || o === null || !("code" in o)) return;
-  const a = o.code;
-  return typeof a == "string" ? a : void 0;
+function v(i) {
+  if (typeof i != "object" || i === null || !("code" in i)) return;
+  const c = i.code;
+  return typeof c == "string" ? c : void 0;
 }
-function O(o) {
-  const a = _(o);
-  if (a === "OAUTH_JWT_CLAIM_COMPARISON_FAILED") {
-    let s = o;
-    for (let u = 0; u < 4 && typeof s == "object" && s !== null; u++) {
-      if (s.claim === "nonce") return !0;
-      s = s.cause;
+function S(i) {
+  const c = v(i);
+  if (c === "OAUTH_JWT_CLAIM_COMPARISON_FAILED") {
+    let a = i;
+    for (let u = 0; u < 4 && typeof a == "object" && a !== null; u++) {
+      if (a.claim === "nonce") return !0;
+      a = a.cause;
     }
     return !1;
   }
-  return a === "OAUTH_INVALID_RESPONSE" && o instanceof Error && o.cause instanceof Error && o.cause.message.includes('"nonce"');
+  return c === "OAUTH_INVALID_RESPONSE" && i instanceof Error && i.cause instanceof Error && i.cause.message.includes('"nonce"');
 }
-function Q(o) {
-  return _(o) === "OAUTH_KEY_SELECTION_FAILED";
+function re(i) {
+  return v(i) === "OAUTH_KEY_SELECTION_FAILED";
 }
-function x(o) {
-  const a = _(o);
-  if (a === "OAUTH_TIMEOUT" || a === "ERR_JWKS_TIMEOUT") return "idp/silent";
-  if (a === "OAUTH_RESPONSE_IS_NOT_CONFORM" || a === "ERR_JWKS_INVALID" || a === "ERR_JOSE_GENERIC" || o instanceof TypeError && a === void 0) return "idp/unreachable";
+function C(i) {
+  const c = v(i);
+  if (c === "OAUTH_TIMEOUT" || c === "ERR_JWKS_TIMEOUT") return "idp/silent";
+  if (c === "OAUTH_RESPONSE_IS_NOT_CONFORM" || c === "ERR_JWKS_INVALID" || c === "ERR_JOSE_GENERIC" || i instanceof TypeError && c === void 0) return "idp/unreachable";
 }
-function q(o) {
-  return typeof o == "object" && o !== null && o.error === "invalid_grant";
+function ce(i) {
+  return typeof i == "object" && i !== null && i.error === "invalid_grant";
 }
-function ee(o, a) {
-  return [...(o ?? Z).split(/\s+/).filter((u) => u !== "" && u !== "organization" && !u.startsWith("organization:")), `organization:${a ?? "*"}`].join(" ");
+function de(i, c) {
+  return [...(i ?? ee).split(/\s+/).filter((u) => u !== "" && u !== "organization" && !u.startsWith("organization:")), `organization:${c ?? "*"}`].join(" ");
 }
-const te = /^(\*|[A-Za-z0-9](?:[A-Za-z0-9._-]{0,62}[A-Za-z0-9])?)$/, ne = V();
-function oe(o) {
-  const a = (s) => async (...u) => {
+const D = /^(\*|[A-Za-z0-9](?:[A-Za-z0-9._-]{0,62}[A-Za-z0-9])?)$/, le = R();
+function fe(i) {
+  const c = (a) => async (...u) => {
     try {
-      return await s(...u);
+      return await a(...u);
     } catch (h) {
-      if (h instanceof m && h.code === "session/irrevocable") throw h;
+      if (h instanceof p && h.code === "session/irrevocable") throw h;
       return f("session/unavailable", "the session store did not answer", h);
     }
   };
   return {
-    put: a((s) => o.put(s)),
-    update: a((s, u) => o.update(s, u)),
-    get: a((s) => o.get(s)),
-    drop: a((s) => o.drop(s)),
-    dropAll: a((s) => o.dropAll(s))
+    put: c((a) => i.put(a)),
+    update: c((a, u) => i.update(a, u)),
+    get: c((a) => i.get(a)),
+    drop: c((a) => i.drop(a)),
+    dropAll: c((a) => i.dropAll(a))
   };
 }
-function he(o) {
-  const a = K(o), s = oe(o.store ?? W()), u = H, h = (t, e, n) => {
-    const i = x(t) ?? e;
-    return new m(i, n, i === "idp/silent" ? { after: u } : {}, { cause: t });
-  }, T = async () => {
+function _e(i) {
+  const c = B(i), a = fe(i.store ?? Q()), u = Y, h = (t, n, e) => {
+    const s = C(t) ?? n;
+    return new p(s, e, s === "idp/silent" ? { after: u } : {}, { cause: t });
+  }, m = async () => {
     try {
-      return await a.configuration();
+      return await c.configuration();
     } catch (t) {
       throw h(t, "idp/unreachable", "the IdP's discovery document could not be read");
     }
-  }, w = N({
+  }, g = O({
     name: "kanzo-session",
-    secret: o.secret,
-    maxAge: o.maxAge ?? $
-  }), E = (t) => N({ name: `kanzo-auth.${t}`, secret: o.secret, maxAge: J }), g = async (t) => {
-    const e = await w.read(t);
-    return e === null ? null : { ticket: e.ticket, record: await s.get(e.ticket) };
-  }, p = async (t, e = "session/absent") => (t !== void 0 && await s.drop(t), { ended: !0, code: e, cookies: t === void 0 ? [] : [w.clear()] }), b = (t, e) => {
-    const n = t.claims(), i = n === void 0 ? e == null ? void 0 : e.session : G(n, o);
-    i === void 0 && f("token/exchange-failed", "the token response carried no ID token, so it names nobody");
-    const r = t.expiresIn(), c = r === void 0 ? void 0 : Date.now() + r * 1e3, l = typeof (n == null ? void 0 : n.sid) == "string" ? n.sid : e == null ? void 0 : e.sid;
+    secret: i.secret,
+    maxAge: i.maxAge ?? te
+  }), b = (t) => O({ name: `kanzo-auth.${t}`, secret: i.secret, maxAge: ne }), A = async (t) => {
+    const n = await g.read(t);
+    return n === null ? null : { ticket: n.ticket, record: await a.get(n.ticket) };
+  }, T = async (t, n = "session/absent") => (t !== void 0 && await a.drop(t), { ended: !0, code: n, cookies: t === void 0 ? [] : [g.clear()] }), x = (t, n) => {
+    const e = t.claims(), s = e === void 0 ? n == null ? void 0 : n.session : X(e, i);
+    s === void 0 && f("token/exchange-failed", "the token response carried no ID token, so it names nobody");
+    const o = t.expiresIn(), r = o === void 0 ? void 0 : Date.now() + o * 1e3, d = typeof (e == null ? void 0 : e.sid) == "string" ? e.sid : n == null ? void 0 : n.sid;
     return {
-      session: { ...i, expiresAt: c ?? i.expiresAt },
-      sid: l,
+      session: { ...s, expiresAt: r ?? s.expiresAt },
+      sid: d,
       accessToken: t.access_token,
-      accessTokenExpiresAt: c,
+      accessTokenExpiresAt: r,
       // RFC 10017 requires rotation, so the newly issued token is the only one still valid. An
       // authorization server that did not rotate returns none, and the one we hold stays good.
-      refreshToken: t.refresh_token ?? (e == null ? void 0 : e.refreshToken),
-      idToken: t.id_token ?? (e == null ? void 0 : e.idToken)
+      refreshToken: t.refresh_token ?? (n == null ? void 0 : n.refreshToken),
+      idToken: t.id_token ?? (n == null ? void 0 : n.idToken)
     };
-  }, I = (t, e) => ne(t, async () => {
-    const n = e.refreshToken;
-    if (n === void 0) return p(t);
-    let i;
+  }, I = (t, n) => le(t, async () => {
+    const e = n.refreshToken;
+    if (e === void 0) return T(t);
+    let s;
     try {
-      i = await M(await T(), n);
-    } catch (l) {
-      if (l instanceof m) throw l;
-      if (x(l) !== void 0 || !q(l))
-        throw h(l, "token/exchange-failed", "the token endpoint did not renew the session");
-      const d = await s.get(t);
-      return (d == null ? void 0 : d.refreshToken) !== void 0 && d.refreshToken !== n ? { record: d, renewed: { ended: !1, session: d.session, cookies: [] } } : p(t, "token/refused");
+      s = await H(await m(), e);
+    } catch (d) {
+      if (d instanceof p) throw d;
+      if (C(d) !== void 0 || !ce(d))
+        throw h(d, "token/exchange-failed", "the token endpoint did not renew the session");
+      const l = await a.get(t);
+      return (l == null ? void 0 : l.refreshToken) !== void 0 && l.refreshToken !== e ? { record: l, renewed: { ended: !1, session: l.session, cookies: [] } } : T(t, "token/refused");
     }
-    const r = b(i, e), c = await s.update(t, r);
-    return c === null ? p(t) : {
-      record: r,
+    const o = x(s, n), r = await a.update(t, o);
+    return r === null ? T(t) : {
+      record: o,
       renewed: {
         ended: !1,
-        session: r.session,
-        cookies: c === t ? [] : [await w.seal({ ticket: c })]
+        session: o.session,
+        cookies: r === t ? [] : [await g.seal({ ticket: r })]
       }
     };
-  }), S = (t) => t instanceof m ? t : h(t, "token/refused", "the logout token did not verify");
+  }), N = async (t, n) => {
+    const e = await A(t);
+    if ((e == null ? void 0 : e.record) == null) return T(e == null ? void 0 : e.ticket);
+    const { ticket: s, record: o } = e, r = o.accessTokenExpiresAt !== void 0 && o.accessTokenExpiresAt - Date.now() <= n;
+    if (o.accessToken !== void 0 && !r)
+      return { ended: !1, accessToken: o.accessToken, session: o.session, cookies: [] };
+    const d = await I(s, o);
+    return "ended" in d ? d : (d.record.accessToken === void 0 && f("token/exchange-failed", "the token response carried no access token"), { ...d.renewed, accessToken: d.record.accessToken });
+  }, _ = /* @__PURE__ */ new Map(), U = R(), L = async (t, n, e) => {
+    const s = e === void 0 ? void 0 : `organization:${e}`;
+    let o;
+    try {
+      o = await Z(await m(), ie, {
+        subject_token: t,
+        subject_token_type: z,
+        requested_token_type: z,
+        scope: s === void 0 ? n : `${n} ${s}`
+      });
+    } catch (k) {
+      throw k instanceof p ? k : h(k, "token/exchange-failed", `the session's token was not exchanged for \`${n}\``);
+    }
+    s !== void 0 && o.scope !== void 0 && !o.scope.split(" ").includes(s) && f("organization/denied", `the realm did not grant \`${s}\`: the person is not a member`);
+    const r = o.expiresIn(), d = {
+      accessToken: o.access_token,
+      expiresAt: r === void 0 ? void 0 : Date.now() + r * 1e3
+    }, l = Date.now();
+    for (const [k, y] of _)
+      y.expiresAt !== void 0 && y.expiresAt <= l && _.delete(k);
+    return _.set([t, n, e ?? ""].join(" "), d), d;
+  }, j = (t) => t instanceof p ? t : h(t, "token/refused", "the logout token did not verify");
   return {
     async begin(t) {
-      const e = await T(), n = C(), i = U(), r = D();
-      t.organization !== void 0 && !te.test(t.organization) && f(
+      const n = await m(), e = M(), s = P(), o = K();
+      t.organization !== void 0 && !D.test(t.organization) && f(
         "organization/invalid",
         `\`${t.organization}\` is not an organization alias, and a scope is a space-delimited list: see ORGANIZATION`
       );
-      const c = {
+      const r = {
         redirect_uri: t.redirectUri,
-        scope: ee(o.scope, t.organization),
-        code_challenge: await L(n),
+        scope: de(i.scope, t.organization),
+        code_challenge: await W(e),
         code_challenge_method: "S256",
-        state: i,
-        nonce: r
+        state: s,
+        nonce: o
       };
       return {
-        url: j(e, c).href,
+        url: F(n, r).href,
         cookies: [
-          await E(i).seal({ state: i, nonce: r, verifier: n, returnTo: t.returnTo ?? "/" })
+          await b(s).seal({ state: s, nonce: o, verifier: e, returnTo: t.returnTo ?? "/" })
         ]
       };
     },
     async complete(t) {
-      const e = new URL(t.url), n = e.searchParams.get("state");
-      (n === null || !X.test(n)) && f("callback/state-mismatch", "the callback carries no `state` this client could have sent");
-      const i = E(n), r = await i.read(t.cookie);
-      (r === null || r.state !== n) && f(
+      const n = new URL(t.url), e = n.searchParams.get("state");
+      (e === null || !oe.test(e)) && f("callback/state-mismatch", "the callback carries no `state` this client could have sent");
+      const s = b(e), o = await s.read(t.cookie);
+      (o === null || o.state !== e) && f(
         "callback/state-mismatch",
         "the callback's `state` names no transaction this browser started"
       );
-      const c = {
-        pkceCodeVerifier: r.verifier,
-        expectedState: r.state,
-        expectedNonce: r.nonce
-      }, l = new URL(t.redirectUri);
-      l.search = e.search;
-      const d = (k) => P(k, l, c);
-      let y;
+      const r = {
+        pkceCodeVerifier: o.verifier,
+        expectedState: o.state,
+        expectedNonce: o.nonce
+      }, d = new URL(t.redirectUri);
+      d.search = n.search;
+      const l = (w) => V(w, d, r);
+      let k;
       try {
-        y = await d(await T());
-      } catch (k) {
-        if (k instanceof m) throw k;
-        if (O(k) && f(
+        k = await l(await m());
+      } catch (w) {
+        if (w instanceof p) throw w;
+        if (S(w) && f(
           "callback/nonce-mismatch",
           "the ID token's `nonce` is not the one this transaction sent",
-          k
-        ), !Q(k))
-          throw h(k, "token/exchange-failed", "the authorization code could not be exchanged");
+          w
+        ), !re(w))
+          throw h(w, "token/exchange-failed", "the authorization code could not be exchanged");
         try {
-          y = await d(await a.rediscover());
-        } catch (A) {
-          throw O(A) && f(
+          k = await l(await c.rediscover());
+        } catch (E) {
+          throw S(E) && f(
             "callback/nonce-mismatch",
             "the ID token's `nonce` is not the one this transaction sent",
-            A
+            E
           ), h(
-            A,
+            E,
             "token/exchange-failed",
             "the ID token did not verify, and did not verify against freshly discovered keys either"
           );
         }
       }
-      const v = b(y, null), z = await s.put(v);
+      const y = x(k, null), $ = await a.put(y);
       return {
-        session: v.session,
-        cookies: [await w.seal({ ticket: z }), i.clear()],
-        returnTo: r.returnTo
+        session: y.session,
+        cookies: [await g.seal({ ticket: $ }), s.clear()],
+        returnTo: o.returnTo
       };
     },
     async read(t) {
-      var e, n;
-      return ((n = (e = await g(t)) == null ? void 0 : e.record) == null ? void 0 : n.session) ?? null;
+      var n, e;
+      return ((e = (n = await A(t)) == null ? void 0 : n.record) == null ? void 0 : e.session) ?? null;
     },
-    async token(t, e = {}) {
-      const n = await g(t);
-      if ((n == null ? void 0 : n.record) == null) return p(n == null ? void 0 : n.ticket);
-      const { ticket: i, record: r } = n, c = (e.renewWithin ?? Y) * 1e3, l = r.accessTokenExpiresAt !== void 0 && r.accessTokenExpiresAt - Date.now() <= c;
-      if (r.accessToken !== void 0 && !l)
-        return { ended: !1, accessToken: r.accessToken, session: r.session, cookies: [] };
-      const d = await I(i, r);
-      return "ended" in d ? d : (d.record.accessToken === void 0 && f("token/exchange-failed", "the token response carried no access token"), { ...d.renewed, accessToken: d.record.accessToken });
+    async token(t, n) {
+      const { audience: e, organization: s } = n;
+      if (!ae.test(e))
+        throw new Error(`\`${e}\` is not a client id, and a scope is a space-delimited list`);
+      s !== void 0 && (s === "*" || !D.test(s)) && f(
+        "organization/invalid",
+        `\`${s}\` is not one organization alias, and a token is for one organization`
+      );
+      const o = (n.renewWithin ?? q) * 1e3, r = await N(t, o);
+      if (r.ended) return r;
+      const d = [r.accessToken, e, s ?? ""].join(" "), l = _.get(d), k = l !== void 0 && (l.expiresAt === void 0 || l.expiresAt - Date.now() > o) ? l : await U(d, () => L(r.accessToken, e, s));
+      return { ended: !1, session: r.session, cookies: r.cookies, accessToken: k.accessToken };
     },
-    async refresh(t) {
-      const e = await g(t);
-      if ((e == null ? void 0 : e.record) == null) return p(e == null ? void 0 : e.ticket);
-      const n = await I(e.ticket, e.record);
-      return "ended" in n ? n : n.renewed;
+    async refresh(t, n = {}) {
+      if (n.renewWithin !== void 0) {
+        const o = await N(t, n.renewWithin * 1e3);
+        return o.ended ? o : { ended: !1, session: o.session, cookies: o.cookies };
+      }
+      const e = await A(t);
+      if ((e == null ? void 0 : e.record) == null) return T(e == null ? void 0 : e.ticket);
+      const s = await I(e.ticket, e.record);
+      return "ended" in s ? s : s.renewed;
     },
-    async end(t, e = {}) {
-      var c;
-      const n = await g(t);
-      n !== null && await s.drop(n.ticket);
-      const i = {}, r = e.returnTo ?? o.postLogoutRedirectUri;
-      return r !== void 0 && (i.post_logout_redirect_uri = r), ((c = n == null ? void 0 : n.record) == null ? void 0 : c.idToken) !== void 0 && (i.id_token_hint = n.record.idToken), {
-        url: R(await T(), i).href,
-        cookies: [w.clear()]
+    async end(t, n = {}) {
+      var r;
+      const e = await A(t);
+      e !== null && await a.drop(e.ticket);
+      const s = {}, o = n.returnTo ?? i.postLogoutRedirectUri;
+      return o !== void 0 && (s.post_logout_redirect_uri = o), ((r = e == null ? void 0 : e.record) == null ? void 0 : r.idToken) !== void 0 && (s.id_token_hint = e.record.idToken), {
+        url: G(await m(), s).href,
+        cookies: [g.clear()]
       };
     },
     async logout(t) {
-      let e;
+      let n;
       try {
-        ({ payload: e } = await F(t, await a.keys(), {
-          issuer: o.issuer,
-          audience: o.clientId,
+        ({ payload: n } = await J(t, await c.keys(), {
+          issuer: i.issuer,
+          audience: i.clientId,
           requiredClaims: ["iat"]
         }));
-      } catch (l) {
-        throw S(l);
+      } catch (d) {
+        throw j(d);
       }
-      const n = e.events, i = typeof n == "object" && n !== null ? n[B] : void 0;
-      (typeof i != "object" || i === null) && f("token/refused", "the logout token does not carry the back-channel logout event"), "nonce" in e && f("token/refused", "a logout token must not carry a `nonce`");
-      const r = typeof e.sub == "string" ? e.sub : void 0, c = typeof e.sid == "string" ? e.sid : void 0;
-      r === void 0 && f(
+      const e = n.events, s = typeof e == "object" && e !== null ? e[se] : void 0;
+      (typeof s != "object" || s === null) && f("token/refused", "the logout token does not carry the back-channel logout event"), "nonce" in n && f("token/refused", "a logout token must not carry a `nonce`");
+      const o = typeof n.sub == "string" ? n.sub : void 0, r = typeof n.sid == "string" ? n.sid : void 0;
+      o === void 0 && f(
         "token/refused",
-        c === void 0 ? "the logout token names neither a subject nor a session" : "the logout token names a session but no subject, and sessions are found by subject"
-      ), await s.dropAll({ sub: r, sid: c });
+        r === void 0 ? "the logout token names neither a subject nor a session" : "the logout token names a session but no subject, and sessions are found by subject"
+      ), await a.dropAll({ sub: o, sid: r });
     }
   };
 }
 export {
-  we as cookieValue,
-  K as issuer,
-  he as relyingParty,
-  Te as rewriteOrigin,
-  N as sealedCookie,
-  W as statelessStore,
-  ye as ticketStore
+  be as cookieValue,
+  B as issuer,
+  _e as relyingParty,
+  Ie as rewriteOrigin,
+  O as sealedCookie,
+  Q as statelessStore,
+  Oe as ticketStore
 };
 //# sourceMappingURL=server.js.map