@lastshotlabs/bunshot 0.0.27 → 0.0.28

package/dist/packages/bunshot-auth/src/routes/passkey.d.ts

@@ -0,0 +1,2 @@
+import type { AuthRuntimeContext } from '../runtime';
+export declare const createPasskeyRouter: (runtime: AuthRuntimeContext) => import("@hono/zod-openapi").OpenAPIHono<import("../../../bunshot-core/src/index.js").AppEnv, {}, "/">;

package/dist/packages/bunshot-auth/src/routes/passkey.js

@@ -0,0 +1,199 @@
+import { getAuthCookieOptions } from '../lib/cookieOptions';
+import { isProd } from '../lib/env';
+import { createPasskeyLoginChallenge } from '../lib/mfaChallenge';
+import { refreshCsrfToken } from '../middleware/csrf';
+import { ErrorResponse } from '../schemas/error';
+import * as AuthService from '../services/auth';
+import { setCookie } from 'hono/cookie';
+import { z } from 'zod';
+import { createRoute } from '../../../bunshot-core/src/index.js';
+import { createRouter } from '../../../bunshot-core/src/index.js';
+import { getClientIp } from '../../../bunshot-core/src/index.js';
+import { COOKIE_REFRESH_TOKEN, COOKIE_TOKEN } from '../../../bunshot-core/src/index.js';
+const tags = ['Passkey'];
+const hookCtx = (c) => ({
+    ip: getClientIp(c) !== 'unknown' ? getClientIp(c) : undefined,
+    userAgent: c.req.header('user-agent') ?? undefined,
+    requestId: c.get('requestId'),
+});
+export const createPasskeyRouter = (runtime) => {
+    const { adapter } = runtime;
+    const getConfig = () => runtime.config;
+    const cookieOptions = (maxAge) => getAuthCookieOptions(isProd(), runtime.config, maxAge);
+    const router = createRouter();
+    // ─── POST /auth/passkey/login-options ──────────────────────────────────────
+    router.openapi(createRoute({
+        method: 'post',
+        path: '/auth/passkey/login-options',
+        summary: 'Get passkey login options',
+        description: 'Returns WebAuthn authentication options for passwordless login. Always returns valid-looking options regardless of whether the email exists (enumeration prevention).',
+        tags,
+        request: {
+            body: {
+                content: {
+                    'application/json': {
+                        schema: z.object({
+                            identifier: z
+                                .string()
+                                .optional()
+                                .describe('Optional primary identifier hint (email, username, or phone). When provided and found, restricts the credential list for a faster prompt. Never reveals whether the account exists.'),
+                        }),
+                    },
+                },
+                required: false,
+            },
+        },
+        responses: {
+            200: {
+                content: {
+                    'application/json': {
+                        schema: z.object({
+                            options: z
+                                .unknown()
+                                .describe('PublicKeyCredentialRequestOptionsJSON — pass to @simplewebauthn/browser startAuthentication().'),
+                            passkeyToken: z
+                                .string()
+                                .describe('Short-lived single-use challenge token (120s). Pass to POST /auth/passkey/login.'),
+                        }),
+                    },
+                },
+                description: 'WebAuthn authentication options.',
+            },
+            429: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Rate limit exceeded.',
+            },
+        },
+    }), async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`passkey-login-options:${ip}`, {
+            windowMs: 60 * 1000,
+            max: 5,
+        })) {
+            return c.json({ error: 'Too many requests. Try again later.' }, 429);
+        }
+        const webauthnConfig = getConfig().mfa.webauthn;
+        // Resolve credential hints for the email (enumeration-safe: ignore all errors/misses)
+        let allowCredentials = [];
+        try {
+            let body = {};
+            try {
+                body = c.req.valid('json');
+            }
+            catch {
+                /* body is optional */
+            }
+            const email = body?.identifier;
+            if (email && adapter.getWebAuthnCredentials) {
+                const findFn = adapter.findByIdentifier ?? adapter.findByEmail.bind(adapter);
+                const user = await findFn(email);
+                if (user) {
+                    const creds = await adapter.getWebAuthnCredentials(user.id);
+                    allowCredentials = creds.map(cr => ({
+                        id: cr.credentialId,
+                        transports: cr.transports,
+                    }));
+                }
+            }
+        }
+        catch {
+            // Enumeration protection: swallow all errors, proceed with empty credential list
+        }
+        const { generateAuthenticationOptions } = await import('@simplewebauthn/server');
+        const options = await generateAuthenticationOptions({
+            rpID: webauthnConfig.rpId,
+            allowCredentials: allowCredentials.length > 0
+                ? allowCredentials.map(ac => ({
+                    id: ac.id,
+                    transports: ac.transports,
+                }))
+                : undefined,
+            userVerification: webauthnConfig.userVerification ?? 'required',
+            timeout: webauthnConfig.timeout ?? 60000,
+        });
+        const passkeyToken = await createPasskeyLoginChallenge(runtime.repos.mfaChallenge, options.challenge);
+        return c.json({ options: options, passkeyToken }, 200);
+    });
+    // ─── POST /auth/passkey/login ──────────────────────────────────────────────
+    router.openapi(createRoute({
+        method: 'post',
+        path: '/auth/passkey/login',
+        summary: 'Complete passkey login',
+        description: 'Verifies the WebAuthn assertion and returns a session token. Satisfies both factors by default — no MFA prompt unless passkeyMfaBypass is disabled.',
+        tags,
+        request: {
+            body: {
+                content: {
+                    'application/json': {
+                        schema: z.object({
+                            passkeyToken: z.string().describe('Token from POST /auth/passkey/login-options.'),
+                            assertionResponse: z
+                                .record(z.string(), z.unknown())
+                                .describe('AuthenticationResponseJSON from @simplewebauthn/browser startAuthentication().'),
+                        }),
+                    },
+                },
+                required: true,
+            },
+        },
+        responses: {
+            200: {
+                content: {
+                    'application/json': {
+                        schema: z.object({
+                            token: z.string(),
+                            userId: z.string(),
+                            email: z.string().optional(),
+                            refreshToken: z.string().optional(),
+                            mfaRequired: z.boolean().optional(),
+                            mfaToken: z.string().optional(),
+                            mfaMethods: z.array(z.string()).optional(),
+                        }),
+                    },
+                },
+                description: 'Session token returned. Also set as HttpOnly cookie.',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Authentication failed.',
+            },
+            429: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Rate limit exceeded.',
+            },
+        },
+    }), async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`passkey-login:${ip}`, {
+            windowMs: 15 * 60 * 1000,
+            max: 10,
+        })) {
+            return c.json({ error: 'Too many requests. Try again later.' }, 429);
+        }
+        const { passkeyToken, assertionResponse } = c.req.valid('json');
+        const metadata = {
+            ipAddress: ip,
+            userAgent: c.req.header('user-agent') ?? undefined,
+        };
+        const result = await AuthService.passkeyLogin(passkeyToken, assertionResponse, runtime, metadata, hookCtx(c));
+        if (!result.mfaRequired) {
+            const rtConfig = getConfig().refreshToken;
+            setCookie(c, COOKIE_TOKEN, result.token, cookieOptions(rtConfig ? (rtConfig.accessTokenExpiry ?? 900) : undefined));
+            if (result.refreshToken) {
+                setCookie(c, COOKIE_REFRESH_TOKEN, result.refreshToken, cookieOptions(rtConfig?.refreshTokenExpiry ?? 2_592_000));
+            }
+            if (getConfig().csrfEnabled)
+                refreshCsrfToken(c);
+        }
+        return c.json({
+            token: result.token,
+            userId: result.userId,
+            email: result.email,
+            refreshToken: result.refreshToken,
+            mfaRequired: result.mfaRequired,
+            mfaToken: result.mfaToken,
+            mfaMethods: result.mfaMethods,
+        }, 200);
+    });
+    return router;
+};

package/dist/packages/bunshot-auth/src/routes/saml.d.ts

@@ -0,0 +1,2 @@
+import type { AuthRuntimeContext } from '../runtime';
+export declare function createSamlRouter(runtime: AuthRuntimeContext): import("@hono/zod-openapi").OpenAPIHono<import("../../../bunshot-core/src/index.js").AppEnv, {}, "/">;

package/dist/packages/bunshot-auth/src/routes/saml.js

@@ -0,0 +1,226 @@
+import { getAuthCookieOptions } from '../lib/cookieOptions';
+import { isProd } from '../lib/env';
+import { consumeSamlRequestId, storeSamlRequestId } from '../lib/samlRequestId';
+import { ErrorResponse } from '../schemas/error';
+import { createSessionForUser, emitLoginSuccess, runPreLoginHook } from '../services/auth';
+import { setCookie } from 'hono/cookie';
+import { z } from 'zod';
+import { createRoute } from '../../../bunshot-core/src/index.js';
+import { HttpError, createRouter } from '../../../bunshot-core/src/index.js';
+import { COOKIE_TOKEN } from '../../../bunshot-core/src/index.js';
+import { getClientIp } from '../../../bunshot-core/src/index.js';
+const tags = ['SAML'];
+const samlLoginOpts = { windowMs: 15 * 60 * 1000, max: 20 }; // 20/15min for login initiation
+const samlAcsOpts = { windowMs: 15 * 60 * 1000, max: 20 }; // 20/15min for ACS
+/** Validate redirect URL is safe (relative path only, no open redirect) */
+function isSafeRedirect(url) {
+    if (!url.startsWith('/'))
+        return false;
+    if (url.startsWith('//'))
+        return false;
+    if (url.includes('://'))
+        return false;
+    return true;
+}
+const hookCtx = (c) => ({
+    ip: getClientIp(c) !== 'unknown' ? getClientIp(c) : undefined,
+    userAgent: c.req.header('user-agent') ?? undefined,
+    requestId: c.get('requestId'),
+});
+const samlLoginRoute = createRoute({
+    method: 'get',
+    path: '/auth/saml/login',
+    summary: 'Initiate SAML SSO login',
+    description: 'Redirects to the SAML Identity Provider for authentication.',
+    tags,
+    request: {
+        query: z.object({
+            redirect: z.string().optional(),
+        }),
+    },
+    responses: {
+        302: { description: 'Redirect to SAML Identity Provider' },
+        404: {
+            content: { 'application/json': { schema: ErrorResponse } },
+            description: 'SAML not configured.',
+        },
+        429: {
+            content: { 'application/json': { schema: ErrorResponse } },
+            description: 'Rate limit exceeded.',
+        },
+    },
+});
+const samlAcsRoute = createRoute({
+    method: 'post',
+    path: '/auth/saml/acs',
+    summary: 'SAML Assertion Consumer Service',
+    description: 'Receives SAML assertion from the IdP, creates a session, and redirects to the app.',
+    tags,
+    request: {
+        body: {
+            content: {
+                'application/x-www-form-urlencoded': {
+                    schema: z.object({
+                        SAMLResponse: z.string(),
+                        RelayState: z.string().optional(),
+                    }),
+                },
+            },
+        },
+    },
+    responses: {
+        302: { description: 'Redirect to app after successful authentication' },
+        400: {
+            content: { 'application/json': { schema: ErrorResponse } },
+            description: 'Invalid SAML response.',
+        },
+        401: {
+            content: { 'application/json': { schema: ErrorResponse } },
+            description: 'SAML assertion validation failed.',
+        },
+        404: {
+            content: { 'application/json': { schema: ErrorResponse } },
+            description: 'SAML not configured.',
+        },
+        429: {
+            content: { 'application/json': { schema: ErrorResponse } },
+            description: 'Rate limit exceeded.',
+        },
+    },
+});
+const samlMetadataRoute = createRoute({
+    method: 'get',
+    path: '/auth/saml/metadata',
+    summary: 'SAML SP metadata',
+    description: 'Returns SAML Service Provider metadata XML for IdP configuration.',
+    tags,
+    responses: {
+        200: {
+            content: { 'application/xml': { schema: z.string() } },
+            description: 'SAML SP metadata XML.',
+        },
+        404: {
+            content: { 'application/json': { schema: ErrorResponse } },
+            description: 'SAML not configured.',
+        },
+    },
+});
+export function createSamlRouter(runtime) {
+    const { adapter } = runtime;
+    const getConfig = () => runtime.config;
+    const storeOAuthState = (state, codeVerifier, linkUserId) => runtime.oauth.stateStore.store(state, codeVerifier, linkUserId);
+    const consumeOAuthState = (state) => runtime.oauth.stateStore.consume(state);
+    const router = createRouter();
+    // GET /auth/saml/login — initiate SAML login, redirect to IdP
+    router.openapi(samlLoginRoute, async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`saml-login:${ip}`, samlLoginOpts)) {
+            throw new HttpError(429, 'Too many SAML login attempts. Try again later.');
+        }
+        const config = getConfig().saml;
+        if (!config)
+            throw new HttpError(404, 'SAML not configured');
+        const { initSaml, createAuthnRequest } = await import('../lib/saml');
+        const { sp, idp } = await initSaml(config);
+        // Store relay state — use codeVerifier slot to carry redirectUrl
+        const relayState = crypto.randomUUID();
+        const rawRedirect = c.req.valid('query').redirect ?? config.postLoginRedirect ?? '/';
+        const redirectAfter = isSafeRedirect(rawRedirect) ? rawRedirect : '/';
+        await storeOAuthState(relayState, redirectAfter);
+        const { redirectUrl, id: requestId } = createAuthnRequest(sp, idp);
+        await storeSamlRequestId(runtime.repos.samlRequestId, requestId);
+        return c.redirect(`${redirectUrl}&RelayState=${encodeURIComponent(relayState)}`);
+    });
+    // POST /auth/saml/acs — handle SAML assertion from IdP
+    // Note: We keep manual formData() parsing here because @hono/zod-openapi's
+    // form-urlencoded validation consumes the body before the handler can access it
+    // reliably with SAML IdP payloads. The route definition documents the schema for OpenAPI.
+    router.openapi(samlAcsRoute, async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`saml-acs:${ip}`, samlAcsOpts)) {
+            throw new HttpError(429, 'Too many SAML assertions. Try again later.');
+        }
+        const config = getConfig().saml;
+        if (!config)
+            throw new HttpError(404, 'SAML not configured');
+        let formData;
+        try {
+            formData = await c.req.formData();
+        }
+        catch {
+            throw new HttpError(400, 'Invalid SAML response');
+        }
+        const samlResponse = formData.get('SAMLResponse');
+        const relayState = formData.get('RelayState');
+        if (!samlResponse)
+            throw new HttpError(400, 'Missing SAMLResponse');
+        const { initSaml, validateSamlResponse, samlProfileToIdentityProfile } = await import('../lib/saml');
+        const { sp, idp } = await initSaml(config);
+        // Extract InResponseTo from the SAML response to validate against stored request ID
+        let inResponseTo;
+        try {
+            const xml = Buffer.from(samlResponse, 'base64').toString('utf-8');
+            const match = xml.match(/InResponseTo="([^"]+)"/);
+            inResponseTo = match?.[1] ?? undefined;
+        }
+        catch {
+            /* non-fatal — validation proceeds without InResponseTo check */
+        }
+        // Validate the stored request ID was actually issued by us (anti-replay)
+        if (inResponseTo) {
+            const valid = await consumeSamlRequestId(runtime.repos.samlRequestId, inResponseTo);
+            if (!valid)
+                throw new HttpError(401, 'Invalid or replayed SAML response');
+        }
+        let samlProfile;
+        try {
+            samlProfile = await validateSamlResponse(sp, idp, samlResponse, config, inResponseTo);
+        }
+        catch (err) {
+            if (err instanceof HttpError)
+                throw err;
+            throw new HttpError(401, 'Invalid SAML assertion');
+        }
+        const loginContext = hookCtx(c);
+        await runPreLoginHook(samlProfile.email ?? samlProfile.nameId, runtime, loginContext);
+        let userId;
+        if (config.onLogin) {
+            const result = await config.onLogin(samlProfile);
+            userId = result.userId;
+        }
+        else {
+            if (!adapter.findOrCreateByProvider)
+                throw new HttpError(500, 'Auth adapter missing findOrCreateByProvider');
+            const profile = samlProfileToIdentityProfile(samlProfile);
+            const result = await adapter.findOrCreateByProvider('saml', samlProfile.nameId, profile);
+            userId = result.id;
+            // Update profile fields from SAML attributes
+            if (adapter.updateProfile && (profile.firstName || profile.lastName || profile.displayName)) {
+                await adapter.updateProfile(userId, profile).catch(() => { });
+            }
+        }
+        const { token, sessionId } = await createSessionForUser(userId, runtime, undefined, loginContext);
+        // SAML IdPs handle their own MFA — mark session as MFA-satisfied so
+        // step-up middleware doesn't re-challenge the user.
+        await runtime.repos.session.setMfaVerifiedAt(sessionId);
+        emitLoginSuccess(userId, sessionId, runtime);
+        // consumeOAuthState returns { codeVerifier?, linkUserId? } — redirectUrl was stored in codeVerifier
+        const rawRedirectUrl = relayState
+            ? ((await consumeOAuthState(relayState))?.codeVerifier ?? config.postLoginRedirect ?? '/')
+            : (config.postLoginRedirect ?? '/');
+        const redirectUrl = isSafeRedirect(rawRedirectUrl) ? rawRedirectUrl : '/';
+        setCookie(c, COOKIE_TOKEN, token, getAuthCookieOptions(isProd(), runtime.config));
+        return c.redirect(redirectUrl);
+    });
+    // GET /auth/saml/metadata — serve SP metadata XML
+    router.openapi(samlMetadataRoute, async (c) => {
+        const config = getConfig().saml;
+        if (!config)
+            throw new HttpError(404, 'SAML not configured');
+        const { initSaml, getSamlSpMetadata } = await import('../lib/saml');
+        const { sp } = await initSaml(config);
+        const metadata = getSamlSpMetadata(sp);
+        return c.body(metadata, 200, { 'Content-Type': 'application/xml' });
+    });
+    return router;
+}

package/dist/packages/bunshot-auth/src/routes/scim.d.ts

@@ -0,0 +1,3 @@
+import type { AppEnv } from '../../../bunshot-core/src/index.js';
+import type { AuthRuntimeContext } from '../runtime';
+export declare function createScimRouter(runtime: AuthRuntimeContext): import("@hono/zod-openapi").OpenAPIHono<AppEnv, {}, "/">;