@lalternative/auth 0.19.1 → 1.0.0

package/dist/urbangate.js

@@ -0,0 +1,625 @@
+import {
+  forwardHeaders
+} from "./chunk-MJI5PR73.js";
+
+// src/urbangate/cookies.ts
+function readCookie(headers, name) {
+  const raw = headers.get("cookie") ?? "";
+  for (const part of raw.split(";")) {
+    const [k, ...v] = part.trim().split("=");
+    if (k === name) return decodeURIComponent(v.join("="));
+  }
+  return void 0;
+}
+function serializeCookie(name, value, o) {
+  const attrs = [
+    `${name}=${encodeURIComponent(value)}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${value ? o.maxAge : 0}`
+  ];
+  if (o.secure) attrs.push("Secure");
+  return attrs.join("; ");
+}
+function clearCookie(name, secure) {
+  return serializeCookie(name, "", { maxAge: 0, secure });
+}
+
+// src/urbangate/exchange.ts
+var JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var EXCHANGE_SCOPE = "urbangate:sessions:exchange";
+var REFRESH_MARGIN_MS = 6e4;
+function basic(id, secret) {
+  return "Basic " + btoa(`${id}:${secret}`);
+}
+var Exchange = class {
+  machine = null;
+  config;
+  fetchImpl;
+  constructor(config, fetchImpl = fetch) {
+    this.config = config;
+    this.fetchImpl = fetchImpl;
+  }
+  needsRefresh(token, now = Date.now()) {
+    return !token || token.expiresAt - now < REFRESH_MARGIN_MS;
+  }
+  async exchange(sessionToken) {
+    const machine = await this.machineToken();
+    if (!machine) return { status: "unavailable", reason: "machine_token" };
+    const url = new URL(
+      "/api/machine/sessions/exchange",
+      this.config.issuerUrl
+    );
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${machine}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({ session_token: sessionToken })
+      });
+    } catch {
+      return { status: "unavailable", reason: "exchange" };
+    }
+    if (res.status === 401) {
+      const body = await res.json().catch(() => ({}));
+      if (body.error === "invalid_token") this.machine = null;
+      return body.error === "session" ? { status: "session_gone" } : { status: "unavailable", reason: "exchange_401" };
+    }
+    if (res.status === 403) return { status: "inactive" };
+    if (!res.ok)
+      return { status: "unavailable", reason: `exchange_${res.status}` };
+    const answer = await res.json();
+    return this.hydraToken(answer);
+  }
+  async hydraToken(answer) {
+    const form = new URLSearchParams({
+      grant_type: JWT_BEARER,
+      assertion: answer.assertion,
+      audience: this.config.product
+    });
+    let res;
+    try {
+      res = await this.fetchImpl(
+        new URL("/oauth2/token", this.config.issuerUrl),
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            authorization: basic(
+              this.config.admin.clientId,
+              this.config.admin.clientSecret
+            )
+          },
+          body: form
+        }
+      );
+    } catch {
+      return { status: "unavailable", reason: "hydra" };
+    }
+    if (!res.ok)
+      return { status: "unavailable", reason: `hydra_${res.status}` };
+    const body = await res.json();
+    return {
+      status: "ok",
+      token: {
+        accessToken: body.access_token,
+        expiresAt: Date.now() + body.expires_in * 1e3,
+        identityId: answer.identity_id,
+        roles: answer.roles
+      }
+    };
+  }
+  async machineToken() {
+    if (this.machine && this.machine.expiresAt - Date.now() > REFRESH_MARGIN_MS) {
+      return this.machine.token;
+    }
+    let res;
+    try {
+      res = await this.fetchImpl(
+        new URL("/oauth2/token", this.config.issuerUrl),
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            authorization: basic(
+              this.config.provisioner.clientId,
+              this.config.provisioner.clientSecret
+            )
+          },
+          body: new URLSearchParams({
+            grant_type: "client_credentials",
+            scope: EXCHANGE_SCOPE,
+            audience: "urbangate"
+          })
+        }
+      );
+    } catch {
+      return null;
+    }
+    if (!res.ok) return null;
+    const body = await res.json();
+    this.machine = {
+      token: body.access_token,
+      expiresAt: Date.now() + body.expires_in * 1e3
+    };
+    return this.machine.token;
+  }
+};
+function decodeToken(raw) {
+  const parts = raw.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const payload = JSON.parse(decodeURIComponent(escape(atob(b64))));
+    if (!payload.sub || !payload.exp) return null;
+    return {
+      identityId: payload.sub,
+      roles: Array.isArray(payload.roles) ? payload.roles.filter((r) => typeof r === "string") : [],
+      expiresAt: payload.exp * 1e3
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/urbangate/kratos.ts
+var KratosError = class extends Error {
+  failure;
+  constructor(failure2) {
+    super(failure2.status);
+    this.failure = failure2;
+  }
+};
+var INVALID_CREDENTIALS = 4000006;
+var INVALID_CODE = /* @__PURE__ */ new Set([4010008, 4060006, 4070006]);
+var CODE_SENT = /* @__PURE__ */ new Set([1010014, 1040005, 1060003, 1070003, 1080003]);
+var ALREADY_REGISTERED = 4000007;
+var PASSWORD_POLICY = /* @__PURE__ */ new Set([4000005, 4000031, 4000032, 4000033, 4000034]);
+var FLOW_EXPIRED = /* @__PURE__ */ new Set([4010001, 4040001, 4060005, 4070005]);
+function failureOf(status, body) {
+  const b = body ?? {};
+  if (status === 410 || FLOW_EXPIRED.has(b.error?.code ?? -1)) {
+    return { status: "flow_expired" };
+  }
+  if (b.error?.id === "session_aal2_required") {
+    return { status: "second_factor_required" };
+  }
+  if (b.error?.id === "self_service_flow_expired")
+    return { status: "flow_expired" };
+  if (status >= 500 || status === 0) return { status: "unavailable" };
+  const messages = [
+    ...b.ui?.messages ?? [],
+    ...(b.ui?.nodes ?? []).flatMap((n) => n.messages ?? [])
+  ].filter((m) => m.type === "error");
+  for (const m of messages) {
+    if (m.id === INVALID_CREDENTIALS) return { status: "invalid_credentials" };
+    if (INVALID_CODE.has(m.id ?? -1)) return { status: "invalid_code" };
+    if (m.id === ALREADY_REGISTERED) return { status: "already_registered" };
+    if (PASSWORD_POLICY.has(m.id ?? -1)) {
+      return { status: "password_refused", message: m.text ?? "" };
+    }
+    if (FLOW_EXPIRED.has(m.id ?? -1)) return { status: "flow_expired" };
+  }
+  if (b.error?.id === "account_disabled" || status === 401) {
+    return { status: "account_disabled" };
+  }
+  const first = messages[0]?.text ?? b.error?.message ?? "";
+  return { status: "invalid_input", message: first };
+}
+function codeWasSent(flow) {
+  return (flow.ui?.messages ?? []).some((m) => CODE_SENT.has(m.id ?? -1));
+}
+var KratosFlows = class {
+  baseUrl;
+  fetchImpl;
+  constructor(baseUrl, fetchImpl = fetch) {
+    this.baseUrl = baseUrl;
+    this.fetchImpl = fetchImpl;
+  }
+  async start(kind, sessionToken, params = {}) {
+    const url = new URL(`/self-service/${kind}/api`, this.baseUrl);
+    for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    const res = await this.call(url, { method: "GET" }, sessionToken);
+    return await this.body(res);
+  }
+  async submit(kind, flowId, body, sessionToken) {
+    const url = new URL(`/self-service/${kind}`, this.baseUrl);
+    url.searchParams.set("flow", flowId);
+    const res = await this.call(
+      url,
+      {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+      },
+      sessionToken
+    );
+    return await this.body(res);
+  }
+  async whoami(sessionToken) {
+    const url = new URL("/sessions/whoami", this.baseUrl);
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        headers: { "x-session-token": sessionToken }
+      });
+    } catch {
+      throw new KratosError({ status: "unavailable" });
+    }
+    if (res.status === 401 || res.status === 403) return null;
+    if (!res.ok) throw new KratosError({ status: "unavailable" });
+    return await res.json();
+  }
+  async logout(sessionToken) {
+    const url = new URL("/self-service/logout/api", this.baseUrl);
+    try {
+      await this.fetchImpl(url, {
+        method: "DELETE",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ session_token: sessionToken })
+      });
+    } catch {
+    }
+  }
+  async call(url, init, sessionToken) {
+    const headers = new Headers(init.headers);
+    headers.set("accept", "application/json");
+    if (sessionToken) headers.set("x-session-token", sessionToken);
+    try {
+      return await this.fetchImpl(url, { ...init, headers });
+    } catch {
+      throw new KratosError({ status: "unavailable" });
+    }
+  }
+  async body(res) {
+    const body = await res.json().catch(() => null);
+    if (res.ok || res.status === 422 && body && "continue_with" in body) {
+      return body;
+    }
+    throw new KratosError(failureOf(res.status, body));
+  }
+};
+
+// src/urbangate/server.ts
+var SESSION_MAX_AGE = 30 * 24 * 60 * 60;
+var FLOW_MAX_AGE = 600;
+var TOKEN_MAX_AGE = 15 * 60;
+var FLOW_OF_TYPE = {
+  "email-verification": "verification",
+  "forget-password": "recovery",
+  "sign-in": "login"
+};
+var FAILURE_STATUS = {
+  invalid_credentials: 401,
+  invalid_code: 400,
+  email_not_verified: 403,
+  second_factor_required: 403,
+  account_disabled: 403,
+  already_registered: 409,
+  password_refused: 422,
+  invalid_input: 400,
+  flow_expired: 410,
+  unavailable: 503
+};
+function json(status, body, cookies = []) {
+  const headers = new Headers({ "content-type": "application/json" });
+  for (const c of cookies) headers.append("set-cookie", c);
+  return new Response(JSON.stringify(body), { status, headers });
+}
+function failure(code, status, message) {
+  return json(status, {
+    error: { code, status, ...message ? { message } : {} }
+  });
+}
+function failed(error) {
+  if (error instanceof KratosError) {
+    const f = error.failure;
+    return failure(
+      f.status,
+      FAILURE_STATUS[f.status],
+      "message" in f ? f.message : void 0
+    );
+  }
+  return failure("unavailable", 503);
+}
+function userOf(session, roles, product) {
+  const identity = session.identity;
+  if (!identity) return null;
+  const email = identity.traits?.email ?? "";
+  const address = identity.verifiable_addresses?.find((a) => a.value === email);
+  return {
+    id: identity.id,
+    identityId: identity.id,
+    email,
+    emailVerified: address?.verified ?? false,
+    name: identity.traits?.name ?? "",
+    role: roles.includes(`${product}:admin`) ? "admin" : "user"
+  };
+}
+function continueWith(list, action) {
+  return list?.find(
+    (c) => c.action === action
+  );
+}
+function createUrbangateAuth(config) {
+  const product = config.product;
+  const kratos = new KratosFlows(config.kratosUrl, config.fetch);
+  const exchange = new Exchange({ ...config.urbangate, product }, config.fetch);
+  const names = {
+    session: config.cookie?.name ?? `${product}_session`,
+    token: `${product}_token`,
+    flow: `${product}_flow`
+  };
+  const secure = config.cookie?.secure ?? config.urbangate.issuerUrl.startsWith("https://");
+  const cookie = (name, value, maxAge) => serializeCookie(name, value, { maxAge, secure });
+  const signedIn = (result) => {
+    const token = result.session_token;
+    if (!token) return [];
+    return [
+      cookie(names.session, token, SESSION_MAX_AGE),
+      clearCookie(names.flow, secure)
+    ];
+  };
+  const readToken = (headers) => {
+    const raw = readCookie(headers, names.token);
+    const decoded = raw ? decodeToken(raw) : null;
+    return raw && decoded ? { accessToken: raw, ...decoded } : null;
+  };
+  async function accessToken(headers) {
+    const sessionToken = readCookie(headers, names.session);
+    if (!sessionToken) return null;
+    const held = readToken(headers);
+    if (held && !exchange.needsRefresh(held))
+      return { token: held.accessToken };
+    const outcome = await exchange.exchange(sessionToken);
+    if (outcome.status === "session_gone" || outcome.status === "inactive")
+      return null;
+    if (outcome.status === "unavailable")
+      throw new KratosError({ status: "unavailable" });
+    return {
+      token: outcome.token.accessToken,
+      setCookie: cookie(names.token, outcome.token.accessToken, TOKEN_MAX_AGE)
+    };
+  }
+  async function getSession(headers) {
+    const sessionToken = readCookie(headers, names.session);
+    if (!sessionToken) return null;
+    const session2 = await kratos.whoami(sessionToken);
+    if (!session2?.active) return null;
+    const held = readToken(headers);
+    const user = userOf(session2, held?.roles ?? [], product);
+    if (!user) return null;
+    return { user, session: { expiresAt: session2.expires_at ?? "" } };
+  }
+  async function body(request) {
+    const raw = await request.json().catch(() => null);
+    return raw ?? {};
+  }
+  const str = (b, key) => typeof b[key] === "string" ? b[key].trim() : "";
+  async function signInEmail(request) {
+    const b = await body(request);
+    const email = str(b, "email");
+    const password = typeof b.password === "string" ? b.password : "";
+    if (!email || !password)
+      return failure("invalid_input", 400, "email and password are required");
+    const flow = await kratos.start("login");
+    const result = await kratos.submit("login", flow.id, {
+      method: "password",
+      identifier: email,
+      password
+    });
+    return json(
+      200,
+      { user: result.session ? userOf(result.session, [], product) : null },
+      signedIn(result)
+    );
+  }
+  async function signUpEmail(request) {
+    const b = await body(request);
+    const email = str(b, "email");
+    const password = typeof b.password === "string" ? b.password : "";
+    if (!email || !password)
+      return failure("invalid_input", 400, "email and password are required");
+    const flow = await kratos.start("registration");
+    const result = await kratos.submit(
+      "registration",
+      flow.id,
+      {
+        method: "password",
+        traits: { email, ...str(b, "name") ? { name: str(b, "name") } : {} },
+        password
+      }
+    );
+    const verification = continueWith(
+      result.continue_with,
+      "show_verification_ui"
+    );
+    const cookies = signedIn(result);
+    if (verification)
+      cookies.push(
+        cookie(
+          names.flow,
+          `verification:${verification.flow.id}`,
+          FLOW_MAX_AGE
+        )
+      );
+    return json(
+      200,
+      {
+        user: result.session ? userOf(result.session, [], product) : null,
+        ...verification ? { verification: { flowId: verification.flow.id } } : {}
+      },
+      cookies
+    );
+  }
+  async function sendOtp(request) {
+    const b = await body(request);
+    const email = str(b, "email");
+    const type = str(b, "type");
+    const kind = FLOW_OF_TYPE[type];
+    if (!email || !kind)
+      return failure("invalid_input", 400, "email and type are required");
+    const flow = await kratos.start(kind);
+    const submitted = await kratos.submit(kind, flow.id, {
+      method: "code",
+      ...kind === "login" ? { identifier: email } : { email }
+    });
+    if (!codeWasSent(submitted) && submitted.state !== "sent_email") {
+      return failure("invalid_input", 400, "the code could not be sent");
+    }
+    return json(200, { sent: true }, [
+      cookie(names.flow, `${kind}:${flow.id}`, FLOW_MAX_AGE)
+    ]);
+  }
+  function pendingFlow(headers, kind) {
+    const raw = readCookie(headers, names.flow) ?? "";
+    const [k, id] = raw.split(":");
+    return k === kind && id ? id : null;
+  }
+  async function signInOtp(request) {
+    const b = await body(request);
+    const email = str(b, "email");
+    const code = str(b, "otp");
+    const flowId = pendingFlow(request.headers, "login");
+    if (!flowId) return failure("flow_expired", 410);
+    if (!email || !code)
+      return failure("invalid_input", 400, "email and otp are required");
+    const result = await kratos.submit("login", flowId, {
+      method: "code",
+      identifier: email,
+      code
+    });
+    return json(
+      200,
+      { user: result.session ? userOf(result.session, [], product) : null },
+      signedIn(result)
+    );
+  }
+  async function verifyEmail(request) {
+    const b = await body(request);
+    const code = str(b, "otp");
+    const flowId = pendingFlow(request.headers, "verification");
+    if (!flowId) return failure("flow_expired", 410);
+    if (!code) return failure("invalid_input", 400, "otp is required");
+    const flow = await kratos.submit("verification", flowId, {
+      method: "code",
+      code
+    });
+    if (flow.state !== "passed_challenge") return failure("invalid_code", 400);
+    return json(200, { verified: true }, [clearCookie(names.flow, secure)]);
+  }
+  async function resetPassword(request) {
+    const b = await body(request);
+    const code = str(b, "otp");
+    const password = typeof b.password === "string" ? b.password : "";
+    const flowId = pendingFlow(request.headers, "recovery");
+    if (!flowId) return failure("flow_expired", 410);
+    if (!code || !password)
+      return failure("invalid_input", 400, "otp and password are required");
+    const recovered = await kratos.submit(
+      "recovery",
+      flowId,
+      { method: "code", code }
+    );
+    const token = continueWith(
+      recovered.continue_with,
+      "set_ory_session_token"
+    )?.ory_session_token;
+    const settings = continueWith(recovered.continue_with, "show_settings_ui");
+    if (!token || !settings) return failure("invalid_code", 400);
+    await kratos.submit(
+      "settings",
+      settings.flow.id,
+      { method: "password", password },
+      token
+    );
+    return json(200, { reset: true }, [
+      cookie(names.session, token, SESSION_MAX_AGE),
+      clearCookie(names.flow, secure)
+    ]);
+  }
+  async function signOut(request) {
+    const token = readCookie(request.headers, names.session);
+    if (token) await kratos.logout(token);
+    return json(200, { signedOut: true }, [
+      clearCookie(names.session, secure),
+      clearCookie(names.token, secure),
+      clearCookie(names.flow, secure)
+    ]);
+  }
+  async function session(request) {
+    const s = await getSession(request.headers);
+    return json(200, s);
+  }
+  const routes = {
+    "POST sign-in/email": signInEmail,
+    "POST sign-in/email-otp": signInOtp,
+    "POST sign-up/email": signUpEmail,
+    "POST email-otp/send-verification-otp": sendOtp,
+    "POST email-otp/verify-email": verifyEmail,
+    "POST email-otp/reset-password": resetPassword,
+    "POST sign-out": signOut,
+    "GET get-session": session
+  };
+  async function handler(request) {
+    const path = new URL(request.url).pathname.replace(/\/$/, "");
+    const suffix = path.slice(path.indexOf("/api/auth/") + "/api/auth/".length);
+    if (suffix === "sign-in/social") return failure("not_supported", 501);
+    const route = routes[`${request.method} ${suffix}`];
+    if (!route) return failure("not_found", 404);
+    try {
+      return await route(request);
+    } catch (error) {
+      return failed(error);
+    }
+  }
+  function coreProxy(options) {
+    const coreUrl = options.coreUrl.replace(/\/$/, "");
+    return async (request) => {
+      let s;
+      let token;
+      try {
+        token = await accessToken(request.headers);
+        s = token ? await getSession(
+          new Headers({ ...cookieHeader(request.headers, names, token) })
+        ) : null;
+      } catch {
+        return failure("identity_provider_unavailable", 503);
+      }
+      if (!token || !s) return failure("sign_in_required", 401);
+      if (options.adminOnly && s.user.role !== "admin")
+        return failure("forbidden", 403);
+      const url = new URL(request.url);
+      const headers = forwardHeaders(request.headers);
+      headers.set("authorization", `Bearer ${token.token}`);
+      const upstream = await fetch(`${coreUrl}${url.pathname}${url.search}`, {
+        method: request.method,
+        headers,
+        body: request.method === "GET" || request.method === "HEAD" ? void 0 : request.body,
+        duplex: "half",
+        redirect: "manual"
+      });
+      const out = forwardHeaders(upstream.headers);
+      if (token.setCookie) out.append("set-cookie", token.setCookie);
+      return new Response(upstream.body, {
+        status: upstream.status,
+        headers: out
+      });
+    };
+  }
+  return { handler, getSession, accessToken, coreProxy };
+}
+function cookieHeader(headers, names, token) {
+  const session = readCookie(headers, names.session) ?? "";
+  return {
+    cookie: `${names.session}=${encodeURIComponent(session)}; ${names.token}=${encodeURIComponent(token.token)}`
+  };
+}
+export {
+  createUrbangateAuth
+};
+//# sourceMappingURL=urbangate.js.map