@lupinum/better-convex-nuxt 0.8.0-beta.40

package/dist/runtime/convex-auth/oauth-security.js

@@ -0,0 +1,454 @@
+import { readStreamWithByteLimit } from "../shared/bounded-stream.js";
+const OAUTH_CONFIG_ERROR = "AUTH_OAUTH_CONFIG_INVALID";
+const OAUTH_REQUEST_ERROR = "AUTH_OAUTH_REQUEST_INVALID";
+const OAUTH_TOKEN_ERROR = "AUTH_OAUTH_TOKEN_INVALID";
+const FORBIDDEN_SCOPES = /* @__PURE__ */ new Set(["email", "offline_access", "openid", "profile"]);
+const SCOPE_PATTERN = /^[\w:./-]+$/;
+const TOKEN_CLAIMS = /* @__PURE__ */ new Set([
+  "aud",
+  "azp",
+  "client_id",
+  "exp",
+  "iat",
+  "iss",
+  "jti",
+  "scope",
+  "sid",
+  "sub",
+  "token_use"
+]);
+const PINNED_OAUTH_PROVIDER_KEYS = [
+  "accessTokenExpiresIn",
+  "allowDynamicClientRegistration",
+  "allowPublicClientPrelogin",
+  "allowUnauthenticatedClientRegistration",
+  "advertisedMetadata",
+  "clientCredentialGrantDefaultScopes",
+  "clientPrivileges",
+  "clientRegistrationRequirePKCE",
+  "codeExpiresIn",
+  "consentPage",
+  "customAccessTokenClaims",
+  "customIdTokenClaims",
+  "customTokenResponseFields",
+  "customUserInfoClaims",
+  "disableJwtPlugin",
+  "dpop",
+  "enforcePerClientResources",
+  "extensions",
+  "grantTypes",
+  "loginPage",
+  "m2mAccessTokenExpiresIn",
+  "pairwiseSecret",
+  "rateLimit",
+  "requestUriResolver",
+  "resourcePrivileges",
+  "resources",
+  "scopes",
+  "storeClientSecret",
+  "storeTokens",
+  "validateInitialAccessToken"
+];
+const PINNED_OAUTH_PROVIDER_KEY_SET = new Set(PINNED_OAUTH_PROVIDER_KEYS);
+const hardenedProfiles = /* @__PURE__ */ new WeakMap();
+export class OAuthSecurityError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.name = "OAuthSecurityError";
+    this.code = code;
+  }
+}
+export function installUrlCanParseCompatibility(target = URL) {
+  if (typeof target.canParse === "function") return;
+  Object.defineProperty(target, "canParse", {
+    configurable: true,
+    value: (input, base) => {
+      try {
+        new URL(input, base);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    writable: true
+  });
+}
+function invalidConfig() {
+  throw new OAuthSecurityError(OAUTH_CONFIG_ERROR);
+}
+function invalidRequest() {
+  throw new OAuthSecurityError(OAUTH_REQUEST_ERROR);
+}
+function invalidToken() {
+  throw new OAuthSecurityError(OAUTH_TOKEN_ERROR);
+}
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function exactArray(value, expected) {
+  return Array.isArray(value) && value.length === expected.length && value.every((item, index) => item === expected[index]);
+}
+function emptyValue(value) {
+  if (value === void 0 || value === null || value === false) return true;
+  if (Array.isArray(value)) return value.length === 0;
+  if (isRecord(value)) return Object.keys(value).length === 0;
+  return false;
+}
+function validatePagePath(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.includes("?") || value.includes("#")) {
+    invalidConfig();
+  }
+}
+export function validateOAuthScopes(scopes) {
+  if (!Array.isArray(scopes) || scopes.length === 0 || scopes.length > 64) invalidConfig();
+  const seen = /* @__PURE__ */ new Set();
+  for (const scope of scopes) {
+    if (typeof scope !== "string" || !SCOPE_PATTERN.test(scope) || FORBIDDEN_SCOPES.has(scope) || seen.has(scope)) {
+      invalidConfig();
+    }
+    seen.add(scope);
+  }
+}
+function validateRateLimit(value, expected) {
+  if (!isRecord(value) || value.max !== expected.max || value.window !== expected.window) {
+    invalidConfig();
+  }
+}
+function validateConfiguredResource(value, allowedScopes) {
+  if (typeof value === "string") {
+    validateResourceIdentifier(value);
+    return;
+  }
+  if (!isRecord(value)) invalidConfig();
+  assertSafeStoredOAuthResource(
+    {
+      accessTokenTtl: value.accessTokenTtl,
+      allowedScopes: value.allowedScopes,
+      customClaims: value.customClaims,
+      disabled: value.disabled,
+      dpopBoundAccessTokensRequired: value.dpopBoundAccessTokensRequired,
+      identifier: value.identifier,
+      name: typeof value.name === "string" ? value.name : "Configured resource",
+      refreshTokenTtl: value.refreshTokenTtl,
+      signingAlgorithm: value.signingAlgorithm,
+      signingKeyId: value.signingKeyId
+    },
+    allowedScopes
+  );
+}
+export function validateOAuthProviderProfile(options) {
+  if (!isRecord(options)) invalidConfig();
+  for (const key of Reflect.ownKeys(options)) {
+    if (typeof key !== "string" || !PINNED_OAUTH_PROVIDER_KEY_SET.has(key)) invalidConfig();
+  }
+  if (options.accessTokenExpiresIn !== 600 || options.codeExpiresIn !== 120 || options.allowDynamicClientRegistration !== false || options.allowPublicClientPrelogin !== true || options.allowUnauthenticatedClientRegistration !== false || options.enforcePerClientResources !== true || options.storeClientSecret !== "hashed" || options.storeTokens !== "hashed" || options.disableJwtPlugin === true || options.clientRegistrationRequirePKCE === false || !exactArray(options.grantTypes, ["authorization_code"]) || typeof options.clientPrivileges !== "function" || typeof options.resourcePrivileges !== "function" || typeof options.customAccessTokenClaims !== "function") {
+    invalidConfig();
+  }
+  validatePagePath(options.loginPage);
+  validatePagePath(options.consentPage);
+  validateOAuthScopes(options.scopes);
+  if (!isRecord(options.dpop) || !Array.isArray(options.dpop.signingAlgorithms) || options.dpop.signingAlgorithms.length !== 0) {
+    invalidConfig();
+  }
+  if (!isRecord(options.rateLimit)) invalidConfig();
+  validateRateLimit(options.rateLimit.token, { max: 20, window: 60 });
+  validateRateLimit(options.rateLimit.authorize, { max: 30, window: 60 });
+  validateRateLimit(options.rateLimit.revoke, { max: 30, window: 60 });
+  if (!emptyValue(options.extensions) || !emptyValue(options.validateInitialAccessToken) || !emptyValue(options.requestUriResolver) || !emptyValue(options.customIdTokenClaims) || !emptyValue(options.customUserInfoClaims) || !emptyValue(options.customTokenResponseFields) || !emptyValue(options.clientCredentialGrantDefaultScopes) || !emptyValue(options.pairwiseSecret) || options.m2mAccessTokenExpiresIn !== void 0) {
+    invalidConfig();
+  }
+  if (options.advertisedMetadata !== void 0) {
+    if (!isRecord(options.advertisedMetadata) || !emptyValue(options.advertisedMetadata.claims_supported) || options.advertisedMetadata.scopes_supported !== void 0 && !exactArray(options.advertisedMetadata.scopes_supported, options.scopes)) {
+      invalidConfig();
+    }
+  }
+  if (options.resources !== void 0 && !Array.isArray(options.resources)) invalidConfig();
+  for (const resource of options.resources ?? []) {
+    if (typeof resource !== "string" && !isRecord(resource)) invalidConfig();
+    validateConfiguredResource(resource, options.scopes);
+  }
+}
+async function runPrivilegeCallback(callback, context) {
+  if (!context || typeof context !== "object" || !context.user || !context.session) return false;
+  let timer;
+  try {
+    const result = await Promise.race([
+      Promise.resolve().then(() => callback(context)).catch(() => false),
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(false), 500);
+      })
+    ]);
+    return result === true;
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+export function hardenOAuthProviderCallbacks(options) {
+  validateOAuthProviderProfile(options);
+  const existing = hardenedProfiles.get(options);
+  if (existing) return existing;
+  const clientPrivileges = options.clientPrivileges;
+  const resourcePrivileges = options.resourcePrivileges;
+  const accessTokenClaims = options.customAccessTokenClaims;
+  const hardened = {
+    clientPrivileges: (context) => runPrivilegeCallback(clientPrivileges, context),
+    resourcePrivileges: (context) => runPrivilegeCallback(resourcePrivileges, context),
+    customAccessTokenClaims: async (info) => {
+      let claims;
+      try {
+        claims = await accessTokenClaims(info);
+      } catch {
+        invalidConfig();
+      }
+      if (!isRecord(claims) || Object.keys(claims).length !== 1 || claims.token_use !== "oauth-access") {
+        invalidConfig();
+      }
+      return { token_use: "oauth-access" };
+    }
+  };
+  try {
+    Object.assign(options, hardened);
+  } catch {
+    invalidConfig();
+  }
+  if (options.clientPrivileges !== hardened.clientPrivileges || options.resourcePrivileges !== hardened.resourcePrivileges || options.customAccessTokenClaims !== hardened.customAccessTokenClaims) {
+    invalidConfig();
+  }
+  hardenedProfiles.set(options, hardened);
+  return hardened;
+}
+export function validateResourceIdentifier(identifier) {
+  let url;
+  try {
+    url = new URL(identifier);
+  } catch {
+    invalidConfig();
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.hash || url.username || url.password || url.href !== identifier) {
+    invalidConfig();
+  }
+}
+function isLoopbackRedirectHost(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+export function validateOAuthRedirectUris(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > 32) invalidConfig();
+  const seen = /* @__PURE__ */ new Set();
+  for (const redirectUri of value) {
+    if (typeof redirectUri !== "string" || seen.has(redirectUri) || redirectUri.includes("*") || redirectUri.includes("#")) {
+      invalidConfig();
+    }
+    let url;
+    try {
+      url = new URL(redirectUri);
+    } catch {
+      invalidConfig();
+    }
+    const loopbackHost = isLoopbackRedirectHost(url.hostname);
+    const fixedLoopback = url.protocol === "http:" && loopbackHost && url.port !== "" && Number.isSafeInteger(Number(url.port)) && Number(url.port) > 0 && Number(url.port) <= 65535;
+    if ((url.protocol === "https:" ? loopbackHost : !fixedLoopback) || url.hash || url.username || url.password || url.href !== redirectUri) {
+      invalidConfig();
+    }
+    seen.add(redirectUri);
+  }
+}
+function validateScopeSubset(value, allowedScopes, requireValue) {
+  if (!Array.isArray(value)) {
+    if (!requireValue && value === void 0) return;
+    invalidConfig();
+  }
+  if (requireValue && value.length === 0) invalidConfig();
+  const allowed = new Set(allowedScopes);
+  const seen = /* @__PURE__ */ new Set();
+  for (const scope of value) {
+    if (typeof scope !== "string" || !allowed.has(scope) || seen.has(scope)) invalidConfig();
+    seen.add(scope);
+  }
+}
+function assertNoHiddenClientMetadata(client) {
+  for (const field of [
+    "backchannelLogoutUri",
+    "backchannelLogoutSessionRequired",
+    "jwks",
+    "jwksUri",
+    "metadata",
+    "postLogoutRedirectUris",
+    "softwareStatement"
+  ]) {
+    if (!emptyValue(client[field])) invalidConfig();
+  }
+}
+export function assertSafeStoredOAuthClient(client, allowedScopes) {
+  if (client.expiresAt !== void 0 && client.expiresAt !== null) {
+    const expiresAt = client.expiresAt instanceof Date ? client.expiresAt.getTime() : typeof client.expiresAt === "number" ? client.expiresAt : Number.NaN;
+    if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) invalidConfig();
+  }
+  const confidentialBasic = client.public === false && client.tokenEndpointAuthMethod === "client_secret_basic" && typeof client.clientSecret === "string" && client.clientSecret.length > 0 && (client.type === void 0 || client.type === "web");
+  const publicNone = client.public === true && client.tokenEndpointAuthMethod === "none" && (client.clientSecret === void 0 || client.clientSecret === null) && (client.type === void 0 || client.type === "native" || client.type === "user-agent-based");
+  if (typeof client.clientId !== "string" || client.clientId.length === 0 || client.disabled === true || !confidentialBasic && !publicNone || client.requirePKCE !== true || client.skipConsent !== false || client.enableEndSession !== false || client.dpopBoundAccessTokens !== false || client.subjectType !== void 0 && client.subjectType !== "public" || !exactArray(client.grantTypes, ["authorization_code"]) || !exactArray(client.responseTypes, ["code"])) {
+    invalidConfig();
+  }
+  validateScopeSubset(client.scopes, allowedScopes, true);
+  validateOAuthRedirectUris(client.redirectUris);
+  assertNoHiddenClientMetadata(client);
+}
+export function assertSafeStoredOAuthResource(resource, allowedScopes) {
+  if (typeof resource.identifier !== "string" || typeof resource.name !== "string" || resource.name.length === 0 || resource.disabled === true || resource.dpopBoundAccessTokensRequired === true || !emptyValue(resource.refreshTokenTtl) || !emptyValue(resource.signingKeyId) || !emptyValue(resource.customClaims) || resource.signingAlgorithm !== void 0 && resource.signingAlgorithm !== "RS256") {
+    invalidConfig();
+  }
+  validateResourceIdentifier(resource.identifier);
+  if (resource.accessTokenTtl !== void 0) {
+    if (!Number.isSafeInteger(resource.accessTokenTtl) || resource.accessTokenTtl <= 0 || resource.accessTokenTtl > 600) {
+      invalidConfig();
+    }
+  }
+  validateScopeSubset(resource.allowedScopes, allowedScopes, false);
+}
+export function assertSafeStoredOAuthClientResource(link, clientId, resourceId) {
+  if (link.id !== `${clientId}::${resourceId}` || link.clientId !== clientId || link.resourceId !== resourceId || !emptyValue(link.metadata)) {
+    invalidConfig();
+  }
+}
+export function assertSingleParameters(parameters, singletonFields) {
+  for (const field of singletonFields) {
+    if (parameters.getAll(field).length > 1) invalidRequest();
+  }
+}
+export function requireSingleParameter(parameters, field) {
+  const values = parameters.getAll(field);
+  if (values.length !== 1 || values[0] === "") invalidRequest();
+  return values[0];
+}
+export async function parseBoundedFormRequest(request, allowedFields, maxBytes = 16 * 1024) {
+  const parameters = await parseBoundedFormBody(request, maxBytes);
+  const allowed = new Set(allowedFields);
+  for (const field of parameters.keys()) {
+    if (!allowed.has(field)) invalidRequest();
+  }
+  assertSingleParameters(parameters, allowedFields);
+  return parameters;
+}
+export async function parseBoundedFormBody(request, maxBytes) {
+  const contentType = request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/x-www-form-urlencoded") invalidRequest();
+  const contentLength = request.headers.get("content-length");
+  if (contentLength !== null) {
+    const bytes = Number(contentLength);
+    if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > maxBytes) invalidRequest();
+  }
+  const body = await readStreamWithByteLimit(
+    request.clone().body,
+    maxBytes,
+    () => new OAuthSecurityError(OAUTH_REQUEST_ERROR),
+    request.signal
+  );
+  return new URLSearchParams(new TextDecoder().decode(body ?? new Uint8Array()));
+}
+function metadataUrl(value, expected) {
+  if (value !== expected) invalidConfig();
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    invalidConfig();
+  }
+  if (url.href !== expected) invalidConfig();
+}
+export function projectOAuthAuthorizationServerMetadata(officialMetadata, issuer, scopes) {
+  if (!isRecord(officialMetadata)) invalidConfig();
+  const expected = {
+    authorization_endpoint: `${issuer}/oauth2/authorize`,
+    issuer,
+    jwks_uri: `${issuer}/jwks`,
+    revocation_endpoint: `${issuer}/oauth2/revoke`,
+    token_endpoint: `${issuer}/oauth2/token`
+  };
+  for (const [field, value] of Object.entries(expected)) metadataUrl(officialMetadata[field], value);
+  const expectedOrigin = new URL(issuer).origin;
+  for (const [field, value] of Object.entries(officialMetadata)) {
+    if ((field.endsWith("_endpoint") || field.endsWith("_uri")) && typeof value === "string") {
+      let url;
+      try {
+        url = new URL(value);
+      } catch {
+        invalidConfig();
+      }
+      if (url.origin !== expectedOrigin) invalidConfig();
+    }
+  }
+  if (!exactArray(officialMetadata.scopes_supported, scopes) || !Array.isArray(officialMetadata.response_types_supported) || !officialMetadata.response_types_supported.includes("code") || !Array.isArray(officialMetadata.grant_types_supported) || !officialMetadata.grant_types_supported.includes("authorization_code") || !Array.isArray(officialMetadata.token_endpoint_auth_methods_supported) || !officialMetadata.token_endpoint_auth_methods_supported.includes("client_secret_basic") || !Array.isArray(officialMetadata.code_challenge_methods_supported) || !officialMetadata.code_challenge_methods_supported.includes("S256") || officialMetadata.authorization_response_iss_parameter_supported !== true) {
+    invalidConfig();
+  }
+  return Object.freeze({
+    issuer: expected.issuer,
+    authorization_endpoint: expected.authorization_endpoint,
+    token_endpoint: expected.token_endpoint,
+    jwks_uri: expected.jwks_uri,
+    revocation_endpoint: expected.revocation_endpoint,
+    scopes_supported: [...scopes],
+    response_types_supported: ["code"],
+    grant_types_supported: ["authorization_code"],
+    token_endpoint_auth_methods_supported: ["none", "client_secret_basic"],
+    code_challenge_methods_supported: ["S256"],
+    authorization_response_iss_parameter_supported: true
+  });
+}
+function requiredString(payload, field) {
+  const value = payload[field];
+  if (typeof value !== "string" || value.length === 0) invalidToken();
+  return value;
+}
+function requiredNumericDate(payload, field) {
+  const value = payload[field];
+  if (!Number.isSafeInteger(value) || value <= 0) invalidToken();
+  return value;
+}
+export function assertOAuthAccessTokenClaims(payload, expectations) {
+  return assertOAuthAccessTokenClaimsAt(
+    payload,
+    expectations,
+    Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3)
+  );
+}
+function assertOAuthAccessTokenClaimsAt(payload, expectations, now) {
+  if (!isRecord(payload)) invalidToken();
+  for (const claim of Object.keys(payload)) {
+    if (!TOKEN_CLAIMS.has(claim)) invalidToken();
+  }
+  const maxLifetime = expectations.maxLifetimeSeconds ?? 600;
+  if (!Number.isSafeInteger(maxLifetime) || maxLifetime <= 0 || maxLifetime > 600) invalidToken();
+  const issuer = requiredString(payload, "iss");
+  const subject = requiredString(payload, "sub");
+  const audience = requiredString(payload, "aud");
+  const clientId = requiredString(payload, "client_id");
+  const authorizedParty = requiredString(payload, "azp");
+  const sessionId = requiredString(payload, "sid");
+  requiredString(payload, "jti");
+  const issuedAt = requiredNumericDate(payload, "iat");
+  const expiresAt = requiredNumericDate(payload, "exp");
+  if (issuer !== expectations.issuer || audience !== expectations.audience || clientId !== authorizedParty || payload.token_use !== "oauth-access" || issuedAt > now || expiresAt <= now || expiresAt <= issuedAt || expiresAt - issuedAt > maxLifetime || expectations.clientId !== void 0 && clientId !== expectations.clientId || expectations.subject !== void 0 && subject !== expectations.subject) {
+    invalidToken();
+  }
+  const rawScope = requiredString(payload, "scope");
+  const scopes = rawScope.split(" ");
+  if (scopes.some((scope) => scope.length === 0) || new Set(scopes).size !== scopes.length) {
+    invalidToken();
+  }
+  const allowed = new Set(expectations.allowedScopes);
+  if (scopes.some((scope) => !allowed.has(scope))) invalidToken();
+  for (const required of expectations.requiredScopes ?? []) {
+    if (!allowed.has(required) || !scopes.includes(required)) invalidToken();
+  }
+  return Object.freeze({ clientId, expiresAt, scopes, sessionId, subject });
+}
+export function prepareOAuthAccessTokenVerification(expectations) {
+  const currentDate = /* @__PURE__ */ new Date();
+  const now = Math.floor(currentDate.getTime() / 1e3);
+  return Object.freeze({
+    currentDate,
+    assert(payload) {
+      return assertOAuthAccessTokenClaimsAt(payload, expectations, now);
+    }
+  });
+}

package/dist/runtime/convex-auth/origin.d.ts

@@ -0,0 +1,4 @@
+import { isExactLoopbackHost, normalizeAuthOrigin } from '../shared/auth-origin.js';
+type AuthOriginName = 'CONVEX_SITE_URL' | 'SITE_URL';
+export { isExactLoopbackHost, normalizeAuthOrigin };
+export declare function requireAuthOrigin(name: AuthOriginName, env?: Readonly<Record<string, string | undefined>>): string;

package/dist/runtime/convex-auth/origin.js

@@ -0,0 +1,9 @@
+import {
+  isExactLoopbackHost,
+  normalizeAuthOrigin,
+  requireAuthOrigin as requireSharedAuthOrigin
+} from "../shared/auth-origin.js";
+export { isExactLoopbackHost, normalizeAuthOrigin };
+export function requireAuthOrigin(name, env = process.env) {
+  return requireSharedAuthOrigin(name, env);
+}

package/dist/runtime/convex-auth/plugin.d.ts

@@ -0,0 +1,18 @@
+import type { BetterAuthPlugin, Session, User } from 'better-auth';
+import type { JwtOptions } from 'better-auth/plugins/jwt';
+import { type PinnedOAuthProviderProfile } from './oauth-security.js';
+type SessionJwtOptions = Pick<NonNullable<JwtOptions['jwt']>, 'audience' | 'expirationTime' | 'issuer'> & {
+    definePayload?: (value: {
+        session: Session & Record<string, unknown>;
+        user: User & Record<string, unknown>;
+    }) => Promise<Record<string, unknown>> | Record<string, unknown> | undefined;
+};
+export interface ConvexAuthOptions {
+    authConfig: {
+        providers: readonly unknown[];
+    };
+    oauthProvider?: PinnedOAuthProviderProfile;
+    sessionJwt: SessionJwtOptions;
+}
+export declare function convexAuth(options: ConvexAuthOptions): BetterAuthPlugin;
+export {};