@meith/accounts 0.34.0 → 0.35.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/accounts",
-  "version": "0.34.0",
+  "version": "0.35.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "hash-wasm": "^4.12.0",
-    "@meith/i18n": "0.34.0",
-    "@meith/subscriptions": "0.34.0"
+    "@meith/i18n": "0.35.1",
+    "@meith/subscriptions": "0.35.1"
   }
 }

package/src/federation/catalog.ts

@@ -25,6 +25,7 @@ const GOOGLE_ISSUER = 'https://accounts.google.com'
 
 export interface ProviderBuildDeps {
   readonly fetcher?: Fetcher
+  readonly allowPrivateHosts?: boolean
   readonly clock?: () => Date
 }
 
@@ -65,6 +66,9 @@ export function providerFor(
       clientSecret: options.google.clientSecret,
       scopes: DEFAULT_OIDC_SCOPES,
       ...(deps.fetcher === undefined ? {} : { fetcher: deps.fetcher }),
+      ...(deps.allowPrivateHosts === undefined
+        ? {}
+        : { allowPrivateHosts: deps.allowPrivateHosts }),
       ...(deps.clock === undefined ? {} : { clock: deps.clock }),
     })
   }
@@ -79,6 +83,7 @@ export function providerFor(
     clientSecret: options.oidc.clientSecret,
     scopes: parseScopes(options.oidc.scopes),
     ...(deps.fetcher === undefined ? {} : { fetcher: deps.fetcher }),
+    ...(deps.allowPrivateHosts === undefined ? {} : { allowPrivateHosts: deps.allowPrivateHosts }),
     ...(deps.clock === undefined ? {} : { clock: deps.clock }),
   })
 }

package/src/federation/oidc.ts

@@ -1,4 +1,5 @@
 import { ConfigurationError, ValidationError } from '@meith/core'
+import { assertAllowedUrl } from '@meith/core/outbound'
 import { msg } from '@meith/i18n'
 
 import { fetchJson, readBoolean, readString } from './http'
@@ -21,9 +22,18 @@ export interface OidcProviderConfig {
   readonly clientSecret: string
   readonly scopes: readonly string[]
   readonly fetcher?: Fetcher
+  readonly allowPrivateHosts?: boolean
   readonly clock?: () => Date
 }
 
+function guardedFetcher(allowPrivateHosts: boolean): Fetcher {
+  return async (input, init) => {
+    const target = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
+    assertAllowedUrl(target, { allowPrivateHosts })
+    return fetch(input, { ...init, redirect: 'error' })
+  }
+}
+
 interface Discovery {
   readonly issuer: string
   readonly authorizationEndpoint: string
@@ -35,7 +45,7 @@ interface Discovery {
 export const DEFAULT_OIDC_SCOPES = ['openid', 'email', 'profile'] as const
 
 export function oidcProvider(config: OidcProviderConfig): IdentityProvider {
-  const fetcher = config.fetcher ?? fetch
+  const fetcher = config.fetcher ?? guardedFetcher(config.allowPrivateHosts ?? false)
   const clock = config.clock ?? (() => new Date())
   const issuer = config.issuer.replace(/\/$/, '')
 
@@ -135,10 +145,14 @@ function profileFrom(claims: IdTokenClaims, userinfo: IdTokenClaims): ProviderPr
     throw new ValidationError(msg('error.accounts.identity-provider-sent-account-with'))
   }
 
+  const emailFromToken = stringClaim(claims, 'email')
+  const emailSource = emailFromToken !== null ? claims : userinfo
+  const email = emailFromToken ?? stringClaim(userinfo, 'email')
+
   return {
     subject,
-    email: stringClaim(merged, 'email') ?? stringClaim(userinfo, 'email'),
-    emailVerified: readBoolean(merged, 'email_verified') || readBoolean(userinfo, 'email_verified'),
+    email,
+    emailVerified: email !== null && readBoolean(emailSource, 'email_verified'),
     username:
       stringClaim(merged, 'preferred_username') ??
       stringClaim(merged, 'nickname') ??

package/src/memory-repos.ts

@@ -414,19 +414,44 @@ class MemoryCredentialTokens implements CredentialTokenRepository {
 }
 
 interface Attempt {
+  id: number
   succeeded: boolean
   at: Date
 }
 
 class MemoryLoginAttempts implements LoginAttemptRepository {
   private readonly buckets = new Map<string, Attempt[]>()
+  private nextId = 1
 
   async record(bucket: string, succeeded: boolean, at: Date): Promise<void> {
     const list = this.buckets.get(bucket) ?? []
-    list.push({ succeeded, at })
+    list.push({ id: this.nextId++, succeeded, at })
     this.buckets.set(bucket, list)
   }
 
+  async recordFailureAndCount(
+    bucket: string,
+    since: Date,
+    at: Date,
+  ): Promise<{ readonly id: number; readonly count: number }> {
+    const list = this.buckets.get(bucket) ?? []
+    const id = this.nextId++
+    list.push({ id, succeeded: false, at })
+    this.buckets.set(bucket, list)
+    const count = list.filter((a) => !a.succeeded && a.at.getTime() > since.getTime()).length
+    return { id, count }
+  }
+
+  async removeAttempt(id: number): Promise<void> {
+    for (const list of this.buckets.values()) {
+      const index = list.findIndex((a) => a.id === id)
+      if (index !== -1) {
+        list.splice(index, 1)
+        return
+      }
+    }
+  }
+
   async countFailuresSince(bucket: string, since: Date): Promise<number> {
     const list = this.buckets.get(bucket) ?? []
     return list.filter((a) => !a.succeeded && a.at.getTime() >= since.getTime()).length
@@ -524,11 +549,12 @@ class MemoryPasskeys implements PasskeyRepository {
     return true
   }
 
-  async markUsed(passkeyId: number, signCount: number, now: Date): Promise<void> {
+  async markUsed(passkeyId: number, signCount: number, now: Date): Promise<boolean> {
     const record = this.byId.get(passkeyId)
-    if (record !== undefined) {
-      this.byId.set(passkeyId, { ...record, signCount, lastUsedAt: now })
-    }
+    if (record === undefined) return false
+    if (signCount !== 0 && signCount <= record.signCount) return false
+    this.byId.set(passkeyId, { ...record, signCount, lastUsedAt: now })
+    return true
   }
 }
 

package/src/ports.ts

@@ -230,7 +230,7 @@ export interface PasskeyRepository {
   listForUser(userId: number): Promise<readonly PasskeyRecord[]>
   create(input: NewPasskey): Promise<PasskeyRecord>
   remove(userId: number, passkeyId: number): Promise<boolean>
-  markUsed(passkeyId: number, signCount: number, now: Date): Promise<void>
+  markUsed(passkeyId: number, signCount: number, now: Date): Promise<boolean>
 }
 
 export interface TwoFactorRecord {
@@ -316,6 +316,12 @@ export interface AuthEventRepository {
 
 export interface LoginAttemptRepository {
   record(bucket: string, succeeded: boolean, at: Date): Promise<void>
+  recordFailureAndCount(
+    bucket: string,
+    since: Date,
+    at: Date,
+  ): Promise<{ readonly id: number; readonly count: number }>
+  removeAttempt(id: number): Promise<void>
   countFailuresSince(bucket: string, since: Date): Promise<number>
   clear(bucket: string): Promise<void>
 }

package/src/service.ts

@@ -338,11 +338,18 @@ export class IdentityService {
     await this.assertNotFiltered({ ip: context.ip })
 
     const since = new Date(at.getTime() - this.config.lockoutMinutes * 60_000)
+    const spent: { readonly key: string; readonly id: number; readonly clearOnSuccess: boolean }[] =
+      []
     for (const counter of counters) {
       const max = counter.max ?? this.config.maxLoginAttempts
       if (max <= 0) continue
-      const failures = await this.store.loginAttempts.countFailuresSince(counter.key, since)
-      if (failures >= max) {
+      const { id, count } = await this.store.loginAttempts.recordFailureAndCount(
+        counter.key,
+        since,
+        at,
+      )
+      spent.push({ key: counter.key, id, clearOnSuccess: counter.clearOnSuccess !== false })
+      if (count > max) {
         throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
       }
     }
@@ -355,29 +362,20 @@ export class IdentityService {
     const encoded = account?.passwordHash ?? (await dummyHash())
     const ok = await verifyPassword(password, encoded)
 
-    const recordFailure = async (): Promise<void> => {
-      for (const counter of counters) {
-        await this.store.loginAttempts.record(counter.key, false, at)
-      }
-    }
-
     if (!account || !ok || account.passwordHash === null) {
-      await recordFailure()
       throw new ValidationError(msg('error.accounts.incorrect-username-password'))
     }
 
     const refusal = await this.signInRefusal(account)
     if (refusal !== null) {
-      await recordFailure()
       throw new ForbiddenError(refusal)
     }
 
     await this.assertNotFiltered({ username: account.username, email: account.email })
 
-    for (const counter of counters) {
-      if (counter.clearOnSuccess === false) continue
-      await this.store.loginAttempts.record(counter.key, true, at)
-      await this.store.loginAttempts.clear(counter.key)
+    for (const entry of spent) {
+      if (entry.clearOnSuccess) await this.store.loginAttempts.clear(entry.key)
+      else await this.store.loginAttempts.removeAttempt(entry.id)
     }
 
     if (needsRehash(encoded)) {
@@ -448,25 +446,22 @@ export class IdentityService {
     await this.store.tokens.revokeAllForUser(userId, 'second_factor')
   }
 
-  async assertSecondFactorAttemptsLeft(userId: number): Promise<void> {
+  async spendSecondFactorAttempt(userId: number): Promise<void> {
     const max = this.config.maxLoginAttempts
     if (max <= 0) return
 
     const since = new Date(this.now().getTime() - this.config.lockoutMinutes * 60_000)
-    const failures = await this.store.loginAttempts.countFailuresSince(
+    const { count } = await this.store.loginAttempts.recordFailureAndCount(
       secondFactorBucket(userId),
       since,
+      this.now(),
     )
 
-    if (failures >= max) {
+    if (count > max) {
       throw new ForbiddenError(msg('error.accounts.too-many-wrong-codes-please'))
     }
   }
 
-  async recordSecondFactorFailure(userId: number): Promise<void> {
-    await this.store.loginAttempts.record(secondFactorBucket(userId), false, this.now())
-  }
-
   async clearSecondFactorFailures(userId: number): Promise<void> {
     await this.store.loginAttempts.clear(secondFactorBucket(userId))
   }

package/src/session-service.ts

@@ -49,25 +49,19 @@ export class SessionService {
     return this.mintSession(userId, this.now(), context)
   }
 
-  async startRemembered(userId: number, context: RequestContext = {}): Promise<RememberedLogin> {
+  async issueRemember(
+    userId: number,
+  ): Promise<{ readonly rememberToken: string; readonly rememberExpiresAt: Date }> {
     const at = this.now()
-    const familyId = generateToken()
     const rememberToken = generateToken()
     const rememberExpiresAt = new Date(at.getTime() + this.rememberDays * DAY_MS)
     await this.store.remember.issue({
       tokenHash: await hashToken(rememberToken),
-      familyId,
+      familyId: generateToken(),
       userId,
       expiresAt: rememberExpiresAt,
     })
-    const session = await this.mintSession(userId, at, context)
-    return {
-      userId,
-      sessionToken: session.token,
-      sessionExpiresAt: session.expiresAt,
-      rememberToken,
-      rememberExpiresAt,
-    }
+    return { rememberToken, rememberExpiresAt }
   }
 
   async resume(rememberToken: string, context: RequestContext = {}): Promise<ResumeOutcome> {

package/src/webauthn/service.ts

@@ -194,8 +194,11 @@ export class PasskeyService {
       throw new ForbiddenError(msg('error.accounts.account-behind-passkey-longer-exists'))
     }
 
+    if (!(await this.passkeys.markUsed(passkey.id, verified.signCount, this.now()))) {
+      throw new ForbiddenError(msg('error.accounts.passkey-replayed-counter-board-already'))
+    }
+
     const login = await this.identity.startSessionFor(account, input.context ?? {})
-    await this.passkeys.markUsed(passkey.id, verified.signCount, this.now())
 
     return { account, login }
   }
@@ -218,8 +221,7 @@ export class PasskeyService {
       storedSignCount: passkey.signCount,
     })
 
-    await this.passkeys.markUsed(passkey.id, verified.signCount, this.now())
-    return true
+    return this.passkeys.markUsed(passkey.id, verified.signCount, this.now())
   }
 
   async remove(input: {