@madauth/server 0.1.0

package/dist/chunk-TEMZRMFF.js

@@ -0,0 +1,498 @@
+import {
+  SESSION_COOKIE,
+  SESSION_TYP,
+  randomString,
+  readToken,
+  signSession,
+  signToken,
+  userFromClaims
+} from "./chunk-PRRKLEW7.js";
+import {
+  MAX_PASSWORD_LENGTH,
+  Users,
+  checkPasswordPolicy,
+  deriveCodeKey,
+  hashPassword,
+  isValidEmail,
+  normalizeEmail,
+  verifyAgainstDummy,
+  verifyPassword
+} from "./chunk-V2XKGETK.js";
+import {
+  importSigningKeys
+} from "./chunk-JDQLSL36.js";
+import {
+  createWebhookClient
+} from "./chunk-AVZE6FFR.js";
+
+// src/routes/google.ts
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { base64url } from "jose";
+
+// src/google.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+var googleJwks;
+function googleKeys() {
+  googleJwks ??= createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
+  return googleJwks;
+}
+async function verifyGoogleIdToken(idToken, opts) {
+  let payload;
+  try {
+    ({ payload } = await jwtVerify(idToken, opts.keys ?? googleKeys(), {
+      issuer: GOOGLE_ISSUERS,
+      audience: opts.clientId,
+      algorithms: ["RS256", "ES256"]
+    }));
+  } catch (e) {
+    return { ok: false, error: "verification_failed", reason: e.message };
+  }
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    return { ok: false, error: "verification_failed", reason: "missing sub" };
+  }
+  if (payload.nonce !== opts.nonce) {
+    return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
+  }
+  if (payload.email_verified !== true) {
+    return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
+  }
+  const user = { id: `google:${payload.sub}` };
+  if (typeof payload.email === "string") user.email = payload.email;
+  if (typeof payload.name === "string") user.name = payload.name;
+  if (typeof payload.picture === "string") user.picture = payload.picture;
+  return { ok: true, user };
+}
+
+// src/routes/google.ts
+var NONCE_COOKIE = "madauth_nonce";
+var NONCE_TYP = "madauth-nonce+jwt";
+var NONCE_TTL = 5 * 60;
+var OAUTH_COOKIE = "madauth_oauth";
+var OAUTH_TYP = "madauth-oauth-state+jwt";
+var OAUTH_TTL = 10 * 60;
+var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var REDIRECT_ERROR_PARAM = "madauth_error";
+async function pkceChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url.encode(new Uint8Array(digest));
+}
+function googleRoutes(app, ctx, google) {
+  const { config, keys, secure } = ctx;
+  const { issuer } = config;
+  const callbackUrl = `${issuer}/auth/google/callback`;
+  app.post("/auth/google/nonce", async (c) => {
+    const nonce = randomString();
+    const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
+    setCookie(c, NONCE_COOKIE, token, {
+      path: "/auth/google",
+      httpOnly: true,
+      secure,
+      sameSite: "Strict",
+      maxAge: NONCE_TTL
+    });
+    return c.json({ nonce });
+  });
+  app.post("/auth/google/verify", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    if (typeof body.credential !== "string" || !body.credential) {
+      return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
+    }
+    const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie(c, NONCE_COOKIE));
+    if (!nonceClaims) {
+      return c.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
+    }
+    const result = await verifyGoogleIdToken(body.credential, {
+      clientId: google.clientId,
+      nonce: nonceClaims.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) {
+      return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
+    }
+    deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
+    await ctx.startSession(c, result.user, ["google"]);
+    await ctx.emit("user.signed_in", { user: result.user, method: "google" });
+    return c.json({ user: result.user });
+  });
+  const requireCodeFlow = async (c, next) => {
+    if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
+    await next();
+  };
+  app.get("/auth/google/start", requireCodeFlow, async (c) => {
+    const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
+    if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
+    const oauth = {
+      state: randomString(),
+      nonce: randomString(),
+      verifier: randomString(),
+      returnTo: returnUrl.href
+    };
+    const token = await signToken(await keys, issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
+    setCookie(c, OAUTH_COOKIE, token, {
+      path: "/auth/google",
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: OAUTH_TTL
+    });
+    const url = new URL(GOOGLE_AUTH_ENDPOINT);
+    url.search = new URLSearchParams({
+      client_id: google.clientId,
+      redirect_uri: callbackUrl,
+      response_type: "code",
+      scope: "openid email profile",
+      state: oauth.state,
+      nonce: oauth.nonce,
+      code_challenge: await pkceChallenge(oauth.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return c.redirect(url.href, 302);
+  });
+  app.get("/auth/google/callback", requireCodeFlow, async (c) => {
+    const oauth = await readToken(await keys, issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
+    if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
+    deleteCookie(c, OAUTH_COOKIE, { path: "/auth/google", secure });
+    const back = (error) => {
+      const url = new URL(oauth.returnTo);
+      if (error) url.hash = `${REDIRECT_ERROR_PARAM}=${error}`;
+      return c.redirect(url.href, 302);
+    };
+    if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
+    const code = c.req.query("code");
+    if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
+    let idToken;
+    try {
+      const res = await fetch(GOOGLE_TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: google.clientId,
+          client_secret: google.clientSecret,
+          redirect_uri: callbackUrl,
+          grant_type: "authorization_code",
+          code_verifier: oauth.verifier
+        })
+      });
+      if (!res.ok) return back("verification_failed");
+      ({ id_token: idToken } = await res.json());
+    } catch {
+      return back("verification_failed");
+    }
+    if (typeof idToken !== "string") return back("verification_failed");
+    const result = await verifyGoogleIdToken(idToken, {
+      clientId: google.clientId,
+      nonce: oauth.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) return back(result.error);
+    await ctx.startSession(c, result.user, ["google"]);
+    await ctx.emit("user.signed_in", { user: result.user, method: "google" });
+    return back();
+  });
+}
+
+// src/app.ts
+import { Hono } from "hono";
+import { deleteCookie as deleteCookie2, getCookie as getCookie2, setCookie as setCookie2 } from "hono/cookie";
+import { cors } from "hono/cors";
+
+// src/routes/password.ts
+var FREE_ATTEMPTS = 5;
+var MAX_LOCK_MS = 15 * 60 * 1e3;
+var MAIL_INTERVAL_MS = 60 * 1e3;
+var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
+var RESET_TTL_MS = 30 * 60 * 1e3;
+var WEBHOOK_TIMEOUT_MS = 1e4;
+var VERIFY_LINK_PARAM = "madauth_verify";
+var RESET_LINK_PARAM = "madauth_reset";
+var MAX_NAME_LENGTH = 100;
+var MAX_LOCALE_LENGTH = 35;
+function toMadauthUser(user) {
+  const result = { id: user.id, email: user.email };
+  if (user.name) result.name = user.name;
+  return result;
+}
+function passwordRoutes(app, ctx, password, users, webhook) {
+  const { minLength } = password;
+  const body = async (c) => {
+    const data = await c.req.json().catch(() => null);
+    return data && typeof data === "object" ? data : {};
+  };
+  const error = (c, status, code, message) => c.json({ error: code, message }, status);
+  const unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
+  const accepted = (c) => c.json({}, 202);
+  const redirectTarget = (c, value) => {
+    const url = ctx.allowedUrl(value);
+    return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
+  };
+  const sendEmail = async (user, type, data) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastMailAt: Date.now() });
+    return true;
+  };
+  const sendLinkEmail = async (user, purpose, target, locale) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
+    const { token, code } = await users.issueVerification(user.id, purpose, ttl);
+    const link = new URL(target);
+    link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
+    return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
+      link: link.href,
+      code,
+      expiresAt: Date.now() + ttl,
+      site: target.host,
+      locale
+    });
+  };
+  const localeOf = (data) => typeof data.locale === "string" && data.locale.length <= MAX_LOCALE_LENGTH ? data.locale : void 0;
+  const consume = async (data, purpose) => {
+    if (typeof data.token === "string" && data.token) {
+      return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
+    }
+    if (isValidEmail(data.email) && typeof data.code === "string") {
+      const user = await users.findByEmail(normalizeEmail(data.email));
+      const code = data.code.replace(/\s/g, "");
+      return { userId: user ? await users.consumeCode(user.id, purpose, code) : null, via: "code" };
+    }
+    return { userId: null, via: "code" };
+  };
+  const invalidVerification = (c, via) => via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+  app.post("/auth/password/signin", async (c) => {
+    const data = await body(c);
+    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
+    const pw = typeof data.password === "string" ? data.password : "";
+    if (!isValidEmail(data.email) || !pw || pw.length > MAX_PASSWORD_LENGTH * 4) return wrong();
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account?.secret) {
+      await verifyAgainstDummy(pw);
+      return wrong();
+    }
+    const now = Date.now();
+    if (account.lockedUntil > now) {
+      const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
+      return error(c, 429, "too_many_attempts", `Too many failed attempts. Try again in ${seconds} seconds.`);
+    }
+    const failed = account.failedAttempts + 1;
+    const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
+    if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
+      return error(c, 429, "too_many_attempts", "Too many attempts at once. Please try again.");
+    }
+    const { ok, needsRehash } = await verifyPassword(pw, account.secret);
+    if (!ok) return wrong();
+    await users.updateAccount(account.id, {
+      failedAttempts: 0,
+      lockedUntil: 0,
+      ...needsRehash ? { secret: await hashPassword(pw) } : {}
+    });
+    if (!user.emailVerified) {
+      return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
+    }
+    const result = toMadauthUser(user);
+    await ctx.startSession(c, result, ["pwd"], { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: "password" });
+    return c.json({ user: result });
+  });
+  app.post("/auth/password/signup", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const policy = checkPasswordPolicy(data.password, minLength);
+    if (policy) return error(c, 400, "weak_password", policy);
+    const name = typeof data.name === "string" && data.name.trim() ? data.name.trim().slice(0, MAX_NAME_LENGTH) : null;
+    const email = data.email.trim();
+    const locale = localeOf(data);
+    if (webhook.wants("signup.before")) {
+      const check = await webhook.call("signup.before", { email, name: name ?? void 0, locale }, WEBHOOK_TIMEOUT_MS);
+      if (!check.ok) {
+        console.error(`[madauth] Webhook "signup.before" failed: ${check.reason}`);
+        return unavailable(c);
+      }
+      const answer = check.body;
+      if (answer?.allow === false) {
+        const message = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
+        return error(c, 403, "signup_rejected", message);
+      }
+    }
+    const passwordHash = await hashPassword(data.password);
+    const existing = await users.findByEmail(normalizeEmail(email));
+    if (existing?.emailVerified) {
+      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
+      return sent ? accepted(c) : unavailable(c);
+    }
+    if (existing) {
+      if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+      const account = await users.passwordAccount(existing.id);
+      if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
+      await users.updateUser(existing.id, { name });
+      return await sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
+    }
+    const user = await users.createPasswordUser({
+      email,
+      emailNormalized: normalizeEmail(email),
+      name,
+      passwordHash,
+      emailVerified: false
+    });
+    if (!user) return accepted(c);
+    await ctx.emit("user.created", { user: toMadauthUser(user) });
+    return await sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
+  });
+  app.post("/auth/password/send-verification", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && !user.emailVerified && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "verify", target, localeOf(data))) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  app.post("/auth/password/verify-email", async (c) => {
+    const { userId, via } = await consume(await body(c), "verify");
+    const user = userId ? await users.findById(userId) : null;
+    if (!user) return invalidVerification(c, via);
+    await users.updateUser(user.id, { emailVerified: true });
+    const result = toMadauthUser(user);
+    await ctx.startSession(c, result, ["pwd"], { sv: user.sessionVersion });
+    await ctx.emit("email.verified", { user: result, via });
+    await ctx.emit("user.signed_in", { user: result, method: "password" });
+    return c.json({ user: result });
+  });
+  app.post("/auth/password/send-reset", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "reset", target, localeOf(data))) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  app.post("/auth/password/reset", async (c) => {
+    const data = await body(c);
+    const policy = checkPasswordPolicy(data.password, minLength);
+    if (policy) return error(c, 400, "weak_password", policy);
+    const { userId, via } = await consume(data, "reset");
+    const user = userId ? await users.findById(userId) : null;
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return invalidVerification(c, via);
+    await users.updateAccount(account.id, { secret: await hashPassword(data.password), failedAttempts: 0, lockedUntil: 0 });
+    const sessionVersion = user.sessionVersion + 1;
+    await users.updateUser(user.id, { emailVerified: true, sessionVersion });
+    await users.clearVerifications(user.id);
+    const result = toMadauthUser(user);
+    await ctx.startSession(c, result, ["pwd"], { sv: sessionVersion });
+    await ctx.emit("password.reset", { user: result });
+    await ctx.emit("user.signed_in", { user: result, method: "password" });
+    return c.json({ user: result });
+  });
+}
+
+// src/app.ts
+var EVENT_TIMEOUT_MS = 5e3;
+function createApp(config) {
+  const { issuer, allowedOrigins, sessionTtlSeconds, cookieDomain } = config;
+  const keys = importSigningKeys(config.signingKey);
+  const secure = issuer.startsWith("https:");
+  const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
+  const ctx = {
+    config,
+    keys,
+    secure,
+    isAllowedOrigin,
+    allowedUrl(value) {
+      let url;
+      try {
+        url = new URL(typeof value === "string" ? value : "");
+      } catch {
+        return null;
+      }
+      if (!isAllowedOrigin(url.origin)) return null;
+      url.hash = "";
+      return url;
+    },
+    async startSession(c, user, amr, extra) {
+      const token = await signSession(await keys, issuer, sessionTtlSeconds, user, amr, extra);
+      setCookie2(c, SESSION_COOKIE, token, {
+        path: "/",
+        domain: cookieDomain,
+        httpOnly: true,
+        secure,
+        sameSite: "Lax",
+        maxAge: sessionTtlSeconds
+      });
+    },
+    users: config.password ? new Users(config.password.store, deriveCodeKey(config.signingKey.d)) : void 0,
+    webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
+    async emit(type, data) {
+      if (!this.webhook?.wants(type)) return;
+      const result = await this.webhook.call(type, data, EVENT_TIMEOUT_MS);
+      if (!result.ok) console.error(`[madauth] Webhook "${type}" failed: ${result.reason}`);
+    }
+  };
+  const app = new Hono();
+  app.use(
+    "/auth/*",
+    cors({
+      origin: (origin) => isAllowedOrigin(origin) ? origin : null,
+      credentials: true,
+      allowMethods: ["GET", "POST"],
+      allowHeaders: ["Content-Type"],
+      maxAge: 600
+    })
+  );
+  app.use("/auth/*", async (c, next) => {
+    if (c.req.method === "POST" && !isAllowedOrigin(c.req.header("origin"))) {
+      return c.json({ error: "forbidden_origin" }, 403);
+    }
+    await next();
+  });
+  app.get("/health", (c) => c.text("ok"));
+  app.get("/.well-known/jwks.json", async (c) => {
+    const { publicJwk } = await keys;
+    c.header("Cache-Control", "public, max-age=3600");
+    return c.json({ keys: [publicJwk] });
+  });
+  app.get(
+    "/auth/config",
+    (c) => c.json({
+      google: config.google ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
+      password: config.password ? { minLength: config.password.minLength } : null
+    })
+  );
+  if (config.google) googleRoutes(app, ctx, config.google);
+  if (config.password && ctx.users && ctx.webhook) passwordRoutes(app, ctx, config.password, ctx.users, ctx.webhook);
+  app.get("/auth/session", async (c) => {
+    const claims = await readToken(await keys, issuer, SESSION_TYP, getCookie2(c, SESSION_COOKIE));
+    if (!claims) return c.json({ error: "no_session" }, 401);
+    if (claims.sub.startsWith("usr_")) {
+      const stored = await ctx.users?.findById(claims.sub);
+      if (!stored || stored.sessionVersion !== claims.sv) return c.json({ error: "no_session" }, 401);
+    }
+    const user = userFromClaims(claims);
+    if (Date.now() / 1e3 - claims.iat > sessionTtlSeconds / 2) await ctx.startSession(c, user, claims.amr, { sv: claims.sv });
+    return c.json({ user });
+  });
+  app.post("/auth/logout", (c) => {
+    deleteCookie2(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
+    return c.body(null, 204);
+  });
+  return app;
+}
+
+export {
+  REDIRECT_ERROR_PARAM,
+  createApp
+};