@konneal/engine 0.2.22 → 0.2.24

package/workers/worker_public/src/livedata.ts

@@ -65,6 +65,41 @@ const EXCHANGED_KEY = (sessionHash: string) => `ossx:${sessionHash}`;
  *  window (the OP token's own TTL, minus a small margin). Called ONCE
  *  per sign-in from the auth callback; the token never persists past
  *  the window. */
+// The session's refresh-token store (oidc-refresh.ts): the OP's refresh
+// grant is what makes session renewal a RE-JUDGMENT of live standing
+// instead of a re-stamp of frozen claims. Same KV discipline as the
+// access token: keyed by the session token's hash, TTL = the grant's
+// own life, never D1.
+const REFRESH_KEY = (sessionHash: string) => `ort:${sessionHash}`;
+const REFRESH_TTL_SEC = 30 * 24 * 60 * 60; // the OP's grant TTL default
+
+export async function retainRefreshToken(env: any, sessionRaw: string, refreshToken: string): Promise<void> {
+  try {
+    await env.CACHE.put(REFRESH_KEY(await sha256Hex(sessionRaw)), JSON.stringify({ token: refreshToken }), {
+      expirationTtl: REFRESH_TTL_SEC,
+    });
+  } catch {
+    // a KV hiccup degrades to the legacy staleness, never blocks sign-in
+  }
+}
+
+export async function readRefreshToken(env: any, sessionRaw: string): Promise<string | null> {
+  try {
+    const hit = await env.CACHE.get(REFRESH_KEY(await sha256Hex(sessionRaw)), "json");
+    return typeof hit?.token === "string" ? hit.token : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function dropRefreshToken(env: any, sessionRaw: string): Promise<void> {
+  try {
+    await env.CACHE.delete(REFRESH_KEY(await sha256Hex(sessionRaw)));
+  } catch {
+    // best effort
+  }
+}
+
 export async function retainOpAccessToken(
   env: any,
   sessionRaw: string,

package/workers/worker_public/src/oidc-refresh.ts

@@ -0,0 +1,76 @@
+// The session's lifeline (TODO.identity-rp/01): a session's claims are
+// frozen at mint — a deactivated account, a revoked role, a new avatar
+// would all surface weeks late. So renewal is not a re-stamp of the old
+// claims: when a session ages past the threshold, the RP presents the
+// OP's refresh token, and the OP's refresh grant re-judges the LIVE
+// standing (deactivation kills the grant family → the next renewal ends
+// the session, and the response carries today's name/picture/roles).
+// The rotated refresh token must be stored after every use — the OP's
+// rotation is one-time, and a reuse verdict revokes the whole family.
+
+import { discoverIssuer, validateIdToken, type OidcIdTokenClaims } from "./oidc.ts";
+import { renewedSessionClaims, refreshGrant, type OidcMetadata } from "./refresh-core.ts";
+import type { SessionClaims } from "./session";
+import { readRefreshToken, dropRefreshToken, retainRefreshToken } from "./livedata";
+
+
+
+export interface RenewedSession {
+  claims: Omit<SessionClaims, "iat" | "exp">;
+  refreshToken: string;
+}
+
+export type RenewOutcome =
+  | { kind: "ok"; renewed: RenewedSession }
+  | { kind: "revoked" }
+  | { kind: "unavailable" };
+
+export async function renewSessionClaims(
+  env: any,
+  cfg: { issuer: string; clientId: string; clientSecret?: string; sessionSecret: string },
+  session: SessionClaims,
+  sessionRaw: string,
+): Promise<RenewOutcome> {
+  const stored = await readRefreshToken(env, sessionRaw);
+  if (!stored) return { kind: "unavailable" };
+  let meta;
+  try {
+    meta = (await discoverIssuer(cfg.issuer)) as unknown as OidcMetadata;
+  } catch {
+    return { kind: "unavailable" };
+  }
+  const granted = await refreshGrant(meta, cfg, stored);
+  // the OP's refusal IS the revocation signal (deactivated, signed out
+  // everywhere, expired) — the renewal ends; unavailability keeps the
+  // session for the next load
+  if (granted.kind === "refused") {
+    await dropRefreshToken(env, sessionRaw);
+    return { kind: "revoked" };
+  }
+  if (granted.kind === "unavailable") return granted;
+  const token = granted.token;
+  if (typeof token.refresh_token !== "string" || !token.refresh_token) {
+    // a rotation without a successor: the OP is telling us the grant is
+    // finished (narrowed away) — treat as revoked
+    await dropRefreshToken(env, sessionRaw);
+    return { kind: "revoked" };
+  }
+  let claims: OidcIdTokenClaims;
+  try {
+    claims = await validateIdToken(token.id_token, {
+      issuer: cfg.issuer,
+      clientId: cfg.clientId,
+      nonce: undefined as unknown as string,
+      jwksUri: meta.jwks_uri,
+    });
+  } catch {
+    return { kind: "unavailable" };
+  }
+  const fresh = renewedSessionClaims(session, claims);
+  if (!fresh) {
+    await dropRefreshToken(env, sessionRaw);
+    return { kind: "revoked" };
+  }
+  await retainRefreshToken(env, sessionRaw, token.refresh_token);
+  return { kind: "ok", renewed: { claims: fresh, refreshToken: token.refresh_token } };
+}

package/workers/worker_public/src/oidc.ts

@@ -152,6 +152,7 @@ export function buildAuthorizationUrl(
 export interface OidcTokenResponse {
   id_token: string;
   access_token?: string;
+  refresh_token?: string;
   token_type?: string;
   expires_in?: number;
 }

package/workers/worker_public/src/refresh-core.ts

@@ -0,0 +1,67 @@
+// The dependency-free core of the session renewal (node-loadable for
+// unit tests — the law that produced verdict-parse.ts): the refresh
+// grant's backchannel classification and the claims merge with its
+// sub guard. The stateful orchestration lives in oidc-refresh.ts.
+import type { OidcIdTokenClaims, OidcTokenResponse } from "./oidc.ts";
+import type { SessionClaims } from "./session";
+
+export interface OidcMetadata {
+  token_endpoint: string;
+  jwks_uri: string;
+}
+
+export type RefreshResult =
+  | { kind: "ok"; token: OidcTokenResponse }
+  | { kind: "refused" }
+  | { kind: "unavailable" };
+
+/** The refresh grant's backchannel: the same shape as the code
+ *  exchange's POST (the OP's WAF wants the issuer's own origin), with
+ *  the three outcomes the renewal policy needs — a 400 is the OP
+ *  REFUSING (revocation, expiry: dead), a network throw is
+ *  unavailability (keep the session, retry next load). */
+export async function refreshGrant(
+  meta: OidcMetadata,
+  cfg: { clientId: string; clientSecret?: string },
+  refreshToken: string,
+): Promise<RefreshResult> {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: cfg.clientId,
+  });
+  const headers: Record<string, string> = { "content-type": "application/x-www-form-urlencoded" };
+  headers.origin = new URL(meta.token_endpoint).origin;
+  if (cfg.clientSecret) {
+    headers.authorization = `Basic ${btoa(`${encodeURIComponent(cfg.clientId)}:${encodeURIComponent(cfg.clientSecret)}`)}`;
+  }
+  let json: unknown;
+  try {
+    const res = await fetch(meta.token_endpoint, { method: "POST", headers, body });
+    json = await res.json().catch(() => ({}));
+    if (!res.ok) return { kind: "refused" };
+  } catch {
+    return { kind: "unavailable" };
+  }
+  const token = json as Partial<OidcTokenResponse>;
+  if (typeof token?.id_token !== "string") return { kind: "unavailable" };
+  return { kind: "ok", token: token as OidcTokenResponse };
+}
+
+/** The fresh session claims from the refresh grant's ID token. The sub
+ *  MUST match (a different account is a provisioning error, never an
+ *  update); every profile field falls back to the standing session's so
+ *  a claim the OP omits never erases what the user already had. */
+export function renewedSessionClaims(
+  session: SessionClaims,
+  claims: OidcIdTokenClaims,
+): Omit<SessionClaims, "iat" | "exp"> | null {
+  if (claims.sub !== session.sub) return null;
+  return {
+    sub: session.sub,
+    name: typeof claims.name === "string" && claims.name ? claims.name : session.name,
+    email: typeof claims.email === "string" && claims.email ? claims.email : session.email,
+    picture: typeof claims.picture === "string" && claims.picture ? claims.picture : session.picture,
+    roles: Array.isArray(claims.roles) ? claims.roles.map(String) : session.roles,
+  };
+}

package/dist/ask-HLELROYT.js

@@ -1,12 +0,0 @@
-import {
-  handleAsk
-} from "./chunk-M24JWPVN.js";
-import "./chunk-4XBU4J6B.js";
-import "./chunk-BV7IKH3N.js";
-import "./chunk-FNJ457SE.js";
-import "./chunk-COKARI7O.js";
-import "./chunk-RESCBSX6.js";
-import "./chunk-YTWPZE5O.js";
-export {
-  handleAsk
-};