@lastshotlabs/bunshot 0.0.27 → 0.1.0

package/dist/packages/bunshot-auth/src/plugin.js

@@ -0,0 +1,277 @@
+import { COOKIE_TOKEN, getContextOrNull, setStandaloneTrustProxy, timingSafeEqual, validatePluginConfig, } from '../../bunshot-core/src/index.js';
+import { bootstrapAuth } from './bootstrap';
+import { createMemoryCacheAdapter } from './lib/cache';
+import { templates } from './lib/emailTemplates';
+import { isProd } from './lib/env';
+import { buildFingerprint } from './lib/fingerprint';
+import { validateJwtSecrets, verifyToken } from './lib/jwt';
+import { createBearerAuth } from './middleware/bearerAuth';
+import { csrfProtection } from './middleware/csrf';
+import { createIdentifyMiddleware } from './middleware/identify';
+import { requireMfaSetup } from './middleware/requireMfaSetup';
+import { requireRole } from './middleware/requireRole';
+import { userAuth } from './middleware/userAuth';
+import { AUTH_RUNTIME_KEY } from './runtime';
+import { authPluginConfigSchema } from './types/config';
+export function createAuthPlugin(rawConfig) {
+    const config = validatePluginConfig('bunshot-auth', rawConfig, authPluginConfigSchema);
+    // Lifecycle handoff: setupMiddleware resolves this promise once bootstrap
+    // completes. Later phases await it — type-safe, no mutable variable.
+    // rejectBootstrap is called when setupMiddleware throws so teardown() can
+    // detect failure and return early rather than deadlocking on bootstrapReady.
+    // The .catch(() => {}) suppresses the unhandled-rejection warning in cases
+    // where setupMiddleware throws before teardown() attaches its own catch.
+    let resolveBootstrap;
+    let rejectBootstrap;
+    const bootstrapReady = new Promise((resolve, reject) => {
+        resolveBootstrap = resolve;
+        rejectBootstrap = reject;
+    });
+    bootstrapReady.catch(() => { });
+    return {
+        name: 'bunshot-auth',
+        async setupMiddleware(app, frameworkConfig, bus) {
+            try {
+                const fwConfig = frameworkConfig;
+                const registrar = fwConfig?.registrar;
+                if (!fwConfig) {
+                    const standaloneTrustProxy = config.security?.trustProxy ?? false;
+                    app.use('*', async (c, next) => {
+                        setStandaloneTrustProxy(c.req.raw, standaloneTrustProxy);
+                        await next();
+                    });
+                }
+                const resolved = fwConfig?.resolvedStores;
+                const redis = fwConfig?.redis;
+                const mongo = fwConfig?.mongo;
+                const result = await bootstrapAuth(config, bus, resolved, {
+                    signing: fwConfig?.signing ?? config.security?.signing ?? null,
+                    dataEncryptionKeys: fwConfig?.dataEncryptionKeys ?? [],
+                    getRedis: redis ? () => redis : undefined,
+                    getMongoAuth: mongo ? () => mongo.auth : undefined,
+                    getMongoApp: mongo ? () => mongo.app : undefined,
+                });
+                resolveBootstrap(result);
+                const ctx = getContextOrNull(app);
+                if (ctx) {
+                    ctx.pluginState.set(AUTH_RUNTIME_KEY, result.runtime);
+                }
+                // Validate JWT secrets — auth owns its own startup validation
+                validateJwtSecrets(result.runtime.config, result.runtime.signing);
+                // Warn when session fingerprint binding is unconfigured in production.
+                // Without it a stolen JWT+session pair works from any IP or browser.
+                // Set signing.sessionBinding (or security.signing.sessionBinding) to suppress.
+                // Use `true` for IP+UA binding, or `{ fields: ['ua'], onMismatch: 'log-only' }`
+                // for a low-false-positive start on mobile/CDN-heavy deployments.
+                if (isProd() && result.runtime.signing?.sessionBinding === undefined) {
+                    console.warn('[bunshot-auth] Session fingerprint binding is disabled. ' +
+                        'A stolen JWT+session token is usable from any IP or browser. ' +
+                        'Enable via signing.sessionBinding (e.g. `true` for IP+UA, ' +
+                        '`{ fields: ["ua"], onMismatch: "log-only" }` for CDN/mobile deployments).');
+                }
+                // Register auth boundary contracts with core
+                // RouteAuthRegistry — provides userAuth and requireRole to framework routes
+                registrar?.setRouteAuth({
+                    userAuth,
+                    requireRole(...roles) {
+                        return requireRole(...roles);
+                    },
+                });
+                // RateLimitAdapter — wraps auth's rate limit service
+                const rlService = result.runtime.rateLimit;
+                registrar?.setRateLimitAdapter({
+                    async trackAttempt(key, opts) {
+                        return rlService.trackAttempt(key, opts);
+                    },
+                });
+                // FingerprintBuilder — wraps auth's buildFingerprint
+                registrar?.setFingerprintBuilder({
+                    async buildFingerprint(req) {
+                        return buildFingerprint(req);
+                    },
+                });
+                // CacheAdapters — register factory-created memory cache adapter
+                registrar?.addCacheAdapter('memory', createMemoryCacheAdapter());
+                // Resolve bearer tokens: explicit config only — no process.env fallback.
+                // Bearer tokens should be provided via config or resolved by ISecretRepository at the app level.
+                const bearerTokens = config.security?.bearerTokens ?? undefined;
+                const enableBearerAuth = config.security?.bearerAuth !== false && bearerTokens;
+                if (enableBearerAuth) {
+                    const bearerAuthMiddleware = createBearerAuth(bearerTokens);
+                    const bypass = result.bearerAuthBypassPaths;
+                    app.use('*', async (c, next) => {
+                        const path = c.req.path;
+                        const bypassed = bypass.some((entry) => entry.endsWith('*') ? path.startsWith(entry.slice(0, -1)) : path === entry);
+                        if (bypassed)
+                            return next();
+                        return bearerAuthMiddleware(c, next);
+                    });
+                }
+                app.use('*', createIdentifyMiddleware(result.runtime));
+                if (config.security?.csrf?.enabled) {
+                    const corsOrigins = fwConfig?.security?.cors ?? config.security?.cors ?? '*';
+                    const csrfExemptPaths = [
+                        ...result.oauthCallbackPaths,
+                        ...(config.security.csrf.exemptPaths ?? []),
+                    ];
+                    app.use('*', csrfProtection({
+                        exemptPaths: csrfExemptPaths,
+                        checkOrigin: config.security.csrf.checkOrigin ?? true,
+                        allowedOrigins: corsOrigins,
+                        signing: result.runtime.signing,
+                    }));
+                }
+                if (config.auth?.mfa?.required) {
+                    app.use('*', requireMfaSetup);
+                }
+                // Config is already deep-frozen by buildAuthResolvedConfig in bootstrap
+            }
+            catch (err) {
+                rejectBootstrap(err);
+                throw err;
+            }
+        },
+        async setupRoutes(app) {
+            const result = await bootstrapReady;
+            const enableAuthRoutes = config.auth?.enabled !== false;
+            const authConfig = config.auth ?? {};
+            const primaryField = authConfig.primaryField ?? 'email';
+            if (enableAuthRoutes) {
+                const { createAuthRouter } = await import('./routes/auth');
+                app.route('/', createAuthRouter({
+                    primaryField,
+                    emailVerification: authConfig.emailVerification,
+                    passwordReset: authConfig.passwordReset,
+                    rateLimit: authConfig.rateLimit,
+                    accountDeletion: authConfig.accountDeletion,
+                    refreshTokens: authConfig.refreshTokens,
+                    stepUp: authConfig.stepUp,
+                    sessionPolicy: authConfig.sessionPolicy ?? {},
+                    concealRegistration: authConfig.concealRegistration,
+                    magicLink: authConfig.magicLink,
+                }, result.runtime));
+            }
+            if (result.configuredOAuthProviders.length > 0) {
+                const { createOAuthRouter } = await import('./routes/oauth');
+                const postRedirect = authConfig.oauth?.postRedirect ?? '/';
+                app.route('/', createOAuthRouter(result.configuredOAuthProviders, postRedirect, result.runtime, authConfig.rateLimit));
+            }
+            if (authConfig.mfa && enableAuthRoutes) {
+                const { createMfaRouter } = await import('./routes/mfa');
+                app.route('/', createMfaRouter({ rateLimit: authConfig.rateLimit }, result.runtime));
+            }
+            if (authConfig.mfa?.webauthn?.allowPasswordlessLogin && enableAuthRoutes) {
+                const { assertWebAuthnDependency } = await import('./services/mfa');
+                await assertWebAuthnDependency();
+                const { createPasskeyRouter } = await import('./routes/passkey');
+                app.route('/', createPasskeyRouter(result.runtime));
+            }
+            if (authConfig.m2m?.enabled !== false && authConfig.m2m) {
+                const { createM2MRouter } = await import('./routes/m2m');
+                app.route('/', createM2MRouter(result.runtime));
+            }
+            if (config.groups?.managementRoutes) {
+                const { createGroupsRouter } = await import('./routes/groups');
+                app.route('/', createGroupsRouter(config.groups));
+            }
+            if (config.organizations?.enabled) {
+                const { createOrgRouter } = await import('./routes/organizations');
+                app.route('/', createOrgRouter(config.organizations, result.runtime));
+            }
+            if (authConfig.oidc) {
+                const { createOidcRouter } = await import('./routes/oidc');
+                app.route('/', createOidcRouter(result.runtime.config));
+            }
+            if (authConfig.saml) {
+                const { createSamlRouter } = await import('./routes/saml');
+                app.route('/', createSamlRouter(result.runtime));
+            }
+            if (authConfig.scim) {
+                const { createScimRouter } = await import('./routes/scim');
+                app.route('/', createScimRouter(result.runtime));
+            }
+        },
+        async setupPost(app, frameworkConfig) {
+            const result = await bootstrapReady;
+            const fwConfig = frameworkConfig;
+            const registrar = fwConfig?.registrar;
+            // Register resolved auth config on BunshotContext (when available)
+            const ctx = getContextOrNull(app);
+            if (ctx) {
+                ctx.pluginState.set(AUTH_RUNTIME_KEY, result.runtime);
+            }
+            // UserResolver — provides resolveUserId to framework WS/SSE upgrade
+            const runtime = result.runtime;
+            registrar?.setUserResolver({
+                async resolveUserId(req) {
+                    try {
+                        const url = new URL(req.url);
+                        const token = req.headers
+                            .get('cookie')
+                            ?.match(new RegExp(`(?:^|;\\s*)${COOKIE_TOKEN}=([^;]+)`))?.[1] ??
+                            url.searchParams.get('token') ??
+                            null;
+                        if (!token)
+                            return null;
+                        const payload = await verifyToken(token, runtime.config, runtime.signing);
+                        const sessionId = payload.sid;
+                        if (!sessionId)
+                            return null;
+                        const stored = await runtime.repos.session.getSession(sessionId, runtime.config);
+                        if (!timingSafeEqual(stored ?? '', token))
+                            return null;
+                        return payload.sub;
+                    }
+                    catch {
+                        return null;
+                    }
+                },
+            });
+            // EmailTemplates — register auth's built-in templates for mail plugin
+            const templateMap = {};
+            for (const [key, tpl] of Object.entries(templates)) {
+                templateMap[key] = { subject: tpl.subject, html: tpl.html, text: tpl.text };
+            }
+            const DELIVERY_MAP = {
+                email_verification: 'emailVerification',
+                password_reset: 'passwordReset',
+                magic_link: 'magicLink',
+                email_otp: 'emailOtp',
+                welcome: 'welcomeEmail',
+                account_deletion: 'accountDeletion',
+                org_invitation: 'orgInvitation',
+            };
+            for (const [deliveryKey, authKey] of Object.entries(DELIVERY_MAP)) {
+                if (templates[authKey]) {
+                    templateMap[deliveryKey] = {
+                        subject: templates[authKey].subject,
+                        html: templates[authKey].html,
+                        text: templates[authKey].text,
+                    };
+                }
+            }
+            registrar?.addEmailTemplates(templateMap);
+        },
+        /**
+         * Standalone convenience — the framework NEVER calls this.
+         * Plain Hono apps call setup() directly since there is no framework to orchestrate phases.
+         * Calls setupMiddleware then setupRoutes in sequence.
+         */
+        async setup(app, frameworkConfig, bus) {
+            await this.setupMiddleware(app, frameworkConfig, bus);
+            await this.setupRoutes(app, frameworkConfig, bus);
+        },
+        async teardown() {
+            let result;
+            try {
+                result = await bootstrapReady;
+            }
+            catch {
+                return; // bootstrap never completed — nothing to tear down
+            }
+            for (const fn of result.teardownFns) {
+                await fn();
+            }
+        },
+    };
+}

package/dist/packages/bunshot-auth/src/routes/auth.d.ts

@@ -0,0 +1,15 @@
+import type { AccountDeletionConfig, AuthRateLimitConfig, AuthSessionPolicyConfig, ConcealRegistrationConfig, EmailVerificationConfig, MagicLinkConfig, PasswordResetConfig, PrimaryField, RefreshTokenConfig, StepUpConfig } from '../config/authConfig';
+import type { AuthRuntimeContext } from '../runtime';
+export interface AuthRouterOptions {
+    primaryField: PrimaryField;
+    emailVerification?: EmailVerificationConfig;
+    passwordReset?: PasswordResetConfig;
+    rateLimit?: AuthRateLimitConfig;
+    accountDeletion?: AccountDeletionConfig;
+    refreshTokens?: RefreshTokenConfig;
+    stepUp?: StepUpConfig;
+    sessionPolicy?: AuthSessionPolicyConfig;
+    concealRegistration?: ConcealRegistrationConfig;
+    magicLink?: MagicLinkConfig;
+}
+export declare const createAuthRouter: ({ primaryField, emailVerification, passwordReset, rateLimit, accountDeletion, refreshTokens, stepUp, sessionPolicy, concealRegistration, magicLink, }: AuthRouterOptions, runtime: AuthRuntimeContext) => import("@hono/zod-openapi").OpenAPIHono<import("../../../bunshot-core/src/index.js").AppEnv, {}, "/">;