@meith/accounts 0.16.0

package/src/federation/service.ts

@@ -0,0 +1,198 @@
+import { ConflictError, ForbiddenError, ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import { foldIdentifier } from '../case-fold'
+import type {
+  AccountRecord,
+  AccountRepository,
+  Clock,
+  UserIdentityRecord,
+  UserIdentityRepository,
+} from '../ports'
+import type { IdentityService, LoginResult, RequestContext } from '../service'
+import type { IdentityProvider, ProviderProfile } from './types'
+
+export interface FederationDeps {
+  readonly identity: IdentityService
+  readonly accounts: AccountRepository
+  readonly identities: UserIdentityRepository
+  readonly clock?: Clock
+}
+
+export interface CompleteSignInInput {
+  readonly provider: IdentityProvider
+  readonly profile: ProviderProfile
+  readonly context?: RequestContext
+  readonly beforeProvision?: () => Promise<void>
+}
+
+export type FederationOutcome =
+  | {
+      readonly status: 'signed-in'
+      readonly account: AccountRecord
+      readonly login: LoginResult
+      readonly created: boolean
+    }
+  | {
+      readonly status: 'pending'
+      readonly account: AccountRecord
+      readonly verificationToken: string | null
+    }
+
+export const UNLINK_LAST_CREDENTIAL =
+  'That is the only way you have left to sign in. Set a password first, then unlink it.'
+
+export class FederationService {
+  private readonly identity: IdentityService
+  private readonly accounts: AccountRepository
+  private readonly identities: UserIdentityRepository
+  private readonly now: Clock
+
+  constructor(deps: FederationDeps) {
+    this.identity = deps.identity
+    this.accounts = deps.accounts
+    this.identities = deps.identities
+    this.now = deps.clock ?? (() => new Date())
+  }
+
+  async completeSignIn(input: CompleteSignInInput): Promise<FederationOutcome> {
+    const context = input.context ?? {}
+    const linked = await this.identities.findBySubject(input.provider.id, input.profile.subject)
+
+    if (linked !== null) {
+      const account = await this.accounts.findById(linked.userId)
+      if (account === null) {
+        throw new ForbiddenError(
+          `The account behind that ${input.provider.label} sign-in no longer exists.`,
+        )
+      }
+
+      const login = await this.identity.startSessionFor(account, context)
+      await this.identities.markUsed(linked.id, this.now())
+      return { status: 'signed-in', account, login, created: false }
+    }
+
+    const email = normalisedEmail(input.profile)
+    const existing =
+      email === null ? null : await this.accounts.findByEmailLower(foldIdentifier(email))
+
+    if (existing !== null) {
+      if (!input.profile.emailVerified) {
+        throw new ForbiddenError(
+          `An account here already uses that address, and ${input.provider.label} has not ` +
+            'confirmed it belongs to you. Sign in with your password and link the two from ' +
+            'your account security page.',
+        )
+      }
+
+      const login = await this.identity.startSessionFor(existing, context)
+      await this.link({
+        userId: existing.id,
+        provider: input.provider,
+        profile: input.profile,
+      })
+      return { status: 'signed-in', account: existing, login, created: false }
+    }
+
+    if (email === null) {
+      throw new ValidationError(
+        `${input.provider.label} did not share a confirmed e-mail address, so there is ` +
+          'nothing to register an account against. Register with a password instead.',
+      )
+    }
+
+    await input.beforeProvision?.()
+
+    const provisioned = await this.identity.provisionFederated(
+      {
+        username: suggestedUsername(input.profile, email),
+        email,
+        emailVerified: input.profile.emailVerified,
+      },
+      context,
+    )
+
+    await this.link({
+      userId: provisioned.account.id,
+      provider: input.provider,
+      profile: input.profile,
+    })
+
+    if (provisioned.account.state !== 'active') {
+      return {
+        status: 'pending',
+        account: provisioned.account,
+        verificationToken: provisioned.verificationToken ?? null,
+      }
+    }
+
+    return {
+      status: 'signed-in',
+      account: provisioned.account,
+      login: await this.identity.startSessionFor(provisioned.account, context),
+      created: true,
+    }
+  }
+
+  async linkToViewer(input: {
+    readonly userId: number
+    readonly provider: IdentityProvider
+    readonly profile: ProviderProfile
+  }): Promise<UserIdentityRecord> {
+    const linked = await this.identities.findBySubject(input.provider.id, input.profile.subject)
+
+    if (linked !== null && linked.userId !== input.userId) {
+      throw new ConflictError(
+        `That ${input.provider.label} account is already linked to another member here.`,
+      )
+    }
+
+    return linked ?? this.link(input)
+  }
+
+  async unlink(input: {
+    readonly userId: number
+    readonly identityId: number
+    readonly hasPassword: boolean
+    readonly usablePasskeys: number
+    readonly usableProviders: readonly string[]
+  }): Promise<void> {
+    const remaining = (await this.identities.listForUser(input.userId)).filter(
+      (identity) =>
+        identity.id !== input.identityId && input.usableProviders.includes(identity.provider),
+    )
+
+    if (!input.hasPassword && input.usablePasskeys === 0 && remaining.length === 0) {
+      throw new ForbiddenError(UNLINK_LAST_CREDENTIAL)
+    }
+
+    const removed = await this.identities.unlink(input.userId, input.identityId)
+    if (!removed) {
+      throw new ConflictError(msg('error.accounts.sign-in-already-unlinked'))
+    }
+  }
+
+  private async link(input: {
+    readonly userId: number
+    readonly provider: IdentityProvider
+    readonly profile: ProviderProfile
+  }): Promise<UserIdentityRecord> {
+    return this.identities.link({
+      userId: input.userId,
+      provider: input.provider.id,
+      subject: input.profile.subject,
+      label: input.profile.username ?? input.profile.email ?? input.profile.displayName,
+      now: this.now(),
+    })
+  }
+}
+
+function normalisedEmail(profile: ProviderProfile): string | null {
+  const email = profile.email?.trim() ?? ''
+  return email === '' ? null : email
+}
+
+function suggestedUsername(profile: ProviderProfile, email: string): string {
+  const local = email.split('@')[0] ?? ''
+  return profile.username ?? profile.displayName ?? local
+}

package/src/federation/types.ts

@@ -0,0 +1,50 @@
+export type ProviderKind = 'github' | 'google' | 'oidc'
+
+export interface ProviderProfile {
+  readonly subject: string
+  readonly email: string | null
+  readonly emailVerified: boolean
+  readonly username: string | null
+  readonly displayName: string | null
+}
+
+export interface AuthorizeInput {
+  readonly redirectUri: string
+  readonly state: string
+  readonly nonce: string
+  readonly codeVerifier: string
+}
+
+export interface ExchangeInput {
+  readonly code: string
+  readonly redirectUri: string
+  readonly nonce: string
+  readonly codeVerifier: string
+}
+
+export interface IdentityProvider {
+  readonly id: ProviderKind
+  readonly label: string
+  authorizationUrl(input: AuthorizeInput): Promise<string>
+  exchange(input: ExchangeInput): Promise<ProviderProfile>
+}
+
+export type Fetcher = typeof fetch
+
+export interface ProviderCredentials {
+  readonly enabled: boolean
+  readonly clientId: string
+  readonly clientSecret: string
+}
+
+export interface OidcCredentials extends ProviderCredentials {
+  readonly issuer: string
+  readonly label: string
+  readonly scopes: string
+}
+
+export interface FederationOptions {
+  readonly github: ProviderCredentials
+  readonly google: ProviderCredentials
+  readonly oidc: OidcCredentials
+}

package/src/index.ts

@@ -0,0 +1,223 @@
+export {
+  assertUsableFilter,
+  BAN_FILTER_PATTERN_MAX,
+  BAN_FILTER_TYPES,
+  BAN_FILTER_WILDCARD_MAX,
+  type BanFilter,
+  type BanFilterSubject,
+  type BanFilterType,
+  matchBanFilter,
+} from './ban-filter'
+export { type BanInput, BanService, type BanServiceDeps } from './ban-service'
+export { foldIdentifier } from './case-fold'
+export {
+  CREDENTIAL_PROOF_TTL_MS,
+  hasFreshCredentialProof,
+} from './credential-proof'
+export {
+  decodeBase64Url,
+  decodeBase64UrlText,
+  encodeBase64Url,
+  randomBase64Url,
+} from './crypto/base64url'
+export {
+  isLegacyHash,
+  type LegacyMybbHash,
+  MYBB_PREFIX,
+  PHPBB_PREFIX,
+  parseMybbHash,
+  verifyLegacyPassword,
+  verifyMybbPassword,
+  verifyPhpbbPassword,
+} from './crypto/legacy'
+export {
+  type Argon2Params,
+  CURRENT_PASSWORD_POLICY,
+  hashPassword,
+  needsRehash,
+  type PasswordPolicy,
+  parseArgon2Params,
+  verifyPassword,
+} from './crypto/password'
+export {
+  generateToken,
+  hashToken,
+  timingSafeEqual,
+} from './crypto/tokens'
+export {
+  configuredProviders,
+  isProviderKind,
+  PROVIDER_KINDS,
+  type ProviderBuildDeps,
+  parseScopes,
+  providerFor,
+  providerLabel,
+} from './federation/catalog'
+export { type GithubProviderConfig, githubProvider } from './federation/github'
+export {
+  DEFAULT_OIDC_SCOPES,
+  type OidcProviderConfig,
+  oidcProvider,
+} from './federation/oidc'
+export { codeChallenge, type HandshakeSecrets, newHandshake } from './federation/pkce'
+export {
+  type CompleteSignInInput,
+  type FederationDeps,
+  type FederationOutcome,
+  FederationService,
+  UNLINK_LAST_CREDENTIAL,
+} from './federation/service'
+export type {
+  AuthorizeInput,
+  ExchangeInput,
+  FederationOptions,
+  IdentityProvider,
+  OidcCredentials,
+  ProviderCredentials,
+  ProviderKind,
+  ProviderProfile,
+} from './federation/types'
+export {
+  AUTOMATIC_LOCALE,
+  AUTOMATIC_TIMEZONE,
+  BIO_MAX,
+  EMAIL_CHANGE_TTL_MINUTES,
+  isKnownTimezone,
+  isLocalePreference,
+  isTimezonePreference,
+  LOCATION_MAX,
+  type MemberGroupChoice,
+  type MemberSettings,
+  type MemberSettingsRepository,
+  MemberSettingsService,
+  PAGE_SIZE_MAX,
+  PAGE_SIZE_MIN,
+  WEBSITE_MAX,
+} from './member-settings'
+export { MemoryBanFilters, MemoryBans } from './memory-bans'
+export { createMemoryStore } from './memory-repos'
+export {
+  AUTH_SETTING_KEYS,
+  type AuthPolicy,
+  DEFAULT_AUTH_POLICY,
+  type ResolvedAuthSettings,
+  resolveAuthPolicy,
+  type SettingReader,
+} from './policy'
+export type {
+  AccountRecord,
+  AccountRepository,
+  AccountState,
+  AccountStore,
+  ActiveSessionRecord,
+  AuthConfig,
+  AuthEventKind,
+  AuthEventRecord,
+  AuthEventRepository,
+  BanFilterRepository,
+  BanRecord,
+  BanRepository,
+  Clock,
+  CreateBanInput,
+  CredentialPurpose,
+  CredentialTokenRepository,
+  LinkIdentityInput,
+  LoginAttemptRepository,
+  LoginBucket,
+  MemberProfileRecord,
+  MemberProfileRepository,
+  MemberSuggestion,
+  NewAccount,
+  NewAuthEvent,
+  NewPasskey,
+  PasskeyRecord,
+  PasskeyRepository,
+  RecoveryCodeRepository,
+  RememberRotation,
+  RememberTokenRepository,
+  SessionLocation,
+  SessionRecord,
+  SessionRepository,
+  TwoFactorRecord,
+  TwoFactorRepository,
+  UserIdentityRecord,
+  UserIdentityRepository,
+} from './ports'
+export { AUTH_EVENT_KINDS, REMEMBER_ROTATION_GRACE_SECONDS, withinRotationGrace } from './ports'
+export {
+  REGISTER_FIELD,
+  type RegisterField,
+  rejectedField,
+} from './register-fields'
+export {
+  type ActivationOutcome,
+  type ActivationResult,
+  type BanLookup,
+  type FederatedProvision,
+  type IdentityDeps,
+  IdentityService,
+  type LoginOutcome,
+  type LoginResult,
+  type PendingSecondFactor,
+  REGISTRATION_CLOSED,
+  type RegisterInput,
+  type RegisterResult,
+  type RequestContext,
+  type ResendVerification,
+  type ResetRequest,
+  SECOND_FACTOR_TTL_MINUTES,
+  type SecondFactorLookup,
+  VERIFICATION_TTL_HOURS,
+} from './service'
+export {
+  type RememberedLogin,
+  type ResumeOutcome,
+  SessionService,
+  type SessionServiceDeps,
+} from './session-service'
+export { decodeBase32, encodeBase32, isBase32 } from './totp/base32'
+export { assertSealingKey, openSecret, sealSecret } from './totp/secret-box'
+export {
+  clearSecondFactor,
+  type Enrolment,
+  enrolmentLookup,
+  holdsSecondFactor,
+  newRecoveryCode,
+  normaliseRecoveryCode,
+  RECOVERY_CODE_COUNT,
+  REPLAYED_CODE,
+  type SecondFactorOutcome,
+  type TwoFactorDeps,
+  TwoFactorService,
+  type TwoFactorState,
+  WRONG_CODE,
+} from './totp/service'
+export {
+  generateTotpSecret,
+  matchTotp,
+  otpauthUri,
+  stepAt,
+  TOTP_DIGITS,
+  TOTP_PERIOD_SECONDS,
+  totpCode,
+} from './totp/totp'
+export {
+  CHALLENGE_BYTES,
+  newChallenge,
+  PASSKEY_LABEL_MAX,
+  PASSKEY_LIMIT,
+  type PasskeyAssertionOptions,
+  type PasskeyDeps,
+  type PasskeyRegistrationOptions,
+  PasskeyService,
+  passkeyLabel,
+  REMOVE_LAST_CREDENTIAL,
+} from './webauthn/service'
+export {
+  type AssertionResponse,
+  type RegisteredCredential,
+  type RegistrationResponse,
+  type RelyingParty,
+  verifyAssertion,
+  verifyRegistration,
+} from './webauthn/verify'