@micacms/auth-oidc 0.2.0

package/dist/index.js

@@ -0,0 +1,49 @@
+/**
+ * @micacms/auth-oidc — the server-only OIDC gate around @micacms/runtime.
+ *
+ * One factory: hand it the finished configuration, an open database and a
+ * logger, and it returns the `AuthSurface` the runtime mounts — sign-in
+ * routes at `/api/auth`, and the session-plus-CSRF gate in front of the admin
+ * API — together with the services the composing app reports on.
+ *
+ * This package is a dependency of `@micacms/self-hosted` and of nothing else.
+ * The local editor must never gain a path to it: that absence is the product
+ * boundary that keeps `npx @micacms/editor` free of authentication code.
+ */
+import { createRateLimiter } from "@micacms/runtime";
+import { createAdmissionPolicy } from "./admission.js";
+import { csrfProtection, requireAccess } from "./gate.js";
+import { createOidcService } from "./oidc.js";
+import { authRoutes } from "./routes.js";
+import { createSessionService } from "./session.js";
+import { createSessionRepository } from "./sessions-repository.js";
+export function createOidcAuth(deps) {
+    const { config, logger } = deps;
+    const sessionsRepo = createSessionRepository(deps.db);
+    const sessions = createSessionService(sessionsRepo, config);
+    const admission = createAdmissionPolicy(config);
+    const oidc = createOidcService({ config, logger });
+    const loginLimiter = createRateLimiter({
+        limit: config.LOGIN_MAX_ATTEMPTS,
+        windowMs: config.LOGIN_WINDOW_MS,
+    });
+    const gate = { sessions, sessionsRepo, admission };
+    return {
+        surface: {
+            routes: authRoutes({ config, sessions, sessionsRepo, oidc, admission, loginLimiter }),
+            gate: [requireAccess(gate), csrfProtection()],
+        },
+        sessions,
+        sessionsRepo,
+        admission,
+        oidc,
+        loginLimiter,
+    };
+}
+export { createAdmissionPolicy } from "./admission.js";
+export { authEnv, deriveAuth, requireAuthConfig, } from "./config.js";
+export { csrfProtection, requireAccess, sessionOf } from "./gate.js";
+export { createOidcService } from "./oidc.js";
+export { createSessionService, CSRF_COOKIE, CSRF_HEADER, SESSION_COOKIE, } from "./session.js";
+export { createSessionRepository, } from "./sessions-repository.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,iBAAiB,EAAoB,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAwB,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAoB,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAuB,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAA0B,MAAM,0BAA0B,CAAC;AAmB3F,MAAM,UAAU,cAAc,CAAC,IAAkB;IAC/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEhC,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,iBAAiB,CAAC;QACrC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,QAAQ,EAAE,MAAM,CAAC,eAAe;KACjC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAEnD,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;YACrF,IAAI,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC;SAC9C;QACD,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,IAAI;QACJ,YAAY;KACb,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,qBAAqB,EAA8C,MAAM,gBAAgB,CAAC;AACnG,OAAO,EACL,OAAO,EACP,UAAU,EACV,iBAAiB,GAGlB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAoB,MAAM,WAAW,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,cAAc,GAEf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,GAIxB,MAAM,0BAA0B,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,83 @@
+/**
+ * OpenID Connect.
+ *
+ * Mica does not authenticate anybody. It asks a provider who you are, and
+ * records the answer. Hashing, reset flows, MFA, passkeys and breach response
+ * all belong to the identity provider, and none of them are Mica's to get
+ * wrong.
+ *
+ * What is Mica's is the small part here: run the authorization code flow
+ * correctly and report what the provider said. Whether that person may edit
+ * this site is `services/admission.ts`, and deliberately not a table.
+ *
+ * Three checks carry the security of the flow, and all three are enforced
+ * rather than assumed:
+ *
+ *   - **PKCE** binds the authorization code to this browser, so a code
+ *     intercepted in a redirect is useless to anyone else.
+ *   - **state** binds the callback to a request Mica actually started, which
+ *     is what stops an attacker feeding a victim their own login.
+ *   - **nonce** binds the ID token to that same request, so a token replayed
+ *     from elsewhere does not validate.
+ *
+ * They are carried in a short-lived signed cookie rather than in the database:
+ * the transaction lasts one redirect, and a table of them would be a table of
+ * garbage to collect.
+ */
+import { type Logger } from "@micacms/runtime";
+import type { AuthConfig } from "./config.js";
+/** Carries state, PKCE verifier and nonce across the redirect to the provider. */
+export declare const TRANSACTION_COOKIE = "mica_oidc";
+export interface OidcTransaction {
+    state: string;
+    nonce: string;
+    verifier: string;
+    /** Where to send the browser once the session exists. */
+    returnTo: string;
+    expiresAt: number;
+}
+/** What the provider told us about the person signing in. */
+export interface OidcClaims {
+    issuer: string;
+    subject: string;
+    email: string;
+    /** The provider's `email_verified`. Absent counts as false, never as true. */
+    emailVerified: boolean;
+    name: string;
+    /** The configured groups claim, or empty when the provider sends none. */
+    groups: string[];
+}
+export declare function sealTransaction(transaction: OidcTransaction, secret: string): string;
+export declare function openTransaction(cookie: string, secret: string): OidcTransaction | null;
+export interface OidcServiceDeps {
+    config: AuthConfig;
+    logger: Logger;
+}
+export declare function createOidcService(deps: OidcServiceDeps): {
+    /** Where to send a browser to sign in, plus the transaction to remember. */
+    begin(returnTo: string): Promise<{
+        url: string;
+        transaction: OidcTransaction;
+    }>;
+    /**
+     * Completes the flow and returns who signed in.
+     *
+     * `authorizationCodeGrant` verifies the ID token signature, the issuer, the
+     * audience, the expiry, the nonce and the PKCE verifier. Doing any of that
+     * by hand here would be reimplementing the part of this that is genuinely
+     * hard to get right.
+     */
+    complete(currentUrl: URL, transaction: OidcTransaction): Promise<OidcClaims>;
+    /**
+     * Where to send the browser to end the provider's session too.
+     *
+     * Null when the provider does not advertise the endpoint: signing out of
+     * Mica always works, and signing out of the IdP is a bonus that not every
+     * deployment can offer.
+     */
+    endSessionUrl(): Promise<string | null>;
+};
+export type OidcService = ReturnType<typeof createOidcService>;
+/** A random return path token, for the local mode that has no provider. */
+export declare const randomToken: () => string;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,OAAO,EAAY,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAU9C,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAgBD,wBAAgB,eAAe,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAkBtF;AAMD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe;IA2CnD,4EAA4E;oBACtD,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,eAAe,CAAA;KAAE,CAAC;IAwBrF;;;;;;;OAOG;yBACwB,GAAG,eAAe,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IA+DlF;;;;;;OAMG;qBACoB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;EAahD;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAiB/D,2EAA2E;AAC3E,eAAO,MAAM,WAAW,QAAO,MAA+C,CAAC"}

package/dist/oidc.js

@@ -0,0 +1,224 @@
+/**
+ * OpenID Connect.
+ *
+ * Mica does not authenticate anybody. It asks a provider who you are, and
+ * records the answer. Hashing, reset flows, MFA, passkeys and breach response
+ * all belong to the identity provider, and none of them are Mica's to get
+ * wrong.
+ *
+ * What is Mica's is the small part here: run the authorization code flow
+ * correctly and report what the provider said. Whether that person may edit
+ * this site is `services/admission.ts`, and deliberately not a table.
+ *
+ * Three checks carry the security of the flow, and all three are enforced
+ * rather than assumed:
+ *
+ *   - **PKCE** binds the authorization code to this browser, so a code
+ *     intercepted in a redirect is useless to anyone else.
+ *   - **state** binds the callback to a request Mica actually started, which
+ *     is what stops an attacker feeding a victim their own login.
+ *   - **nonce** binds the ID token to that same request, so a token replayed
+ *     from elsewhere does not validate.
+ *
+ * They are carried in a short-lived signed cookie rather than in the database:
+ * the transaction lasts one redirect, and a table of them would be a table of
+ * garbage to collect.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import * as client from "openid-client";
+import { ApiError } from "@micacms/runtime";
+/** Carries state, PKCE verifier and nonce across the redirect to the provider. */
+export const TRANSACTION_COOKIE = "mica_oidc";
+/**
+ * How long a sign-in may take.
+ *
+ * Long enough to enter a second factor and read an email; short enough that an
+ * abandoned transaction cookie is not a lasting liability.
+ */
+const TRANSACTION_TTL_MS = 15 * 60 * 1000;
+/* ------------------------------------------------------------------ *
+ * The transaction cookie
+ * ------------------------------------------------------------------ */
+function sign(value, secret) {
+    return createHmac("sha256", secret).update(value).digest("base64url");
+}
+function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+export function sealTransaction(transaction, secret) {
+    const payload = Buffer.from(JSON.stringify(transaction)).toString("base64url");
+    return `${payload}.${sign(payload, secret)}`;
+}
+export function openTransaction(cookie, secret) {
+    const separator = cookie.lastIndexOf(".");
+    if (separator < 1)
+        return null;
+    const payload = cookie.slice(0, separator);
+    const signature = cookie.slice(separator + 1);
+    if (!safeEqual(signature, sign(payload, secret)))
+        return null;
+    try {
+        const transaction = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return transaction.expiresAt > Date.now() ? transaction : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function createOidcService(deps) {
+    const { config, logger } = deps;
+    const redirectUri = new URL("/api/auth/callback", config.MICA_PUBLIC_URL).toString();
+    /**
+     * Discovery, done once and remembered.
+     *
+     * Lazy rather than at startup: an identity provider that is briefly
+     * unreachable should delay the first sign-in, not stop Mica from booting and
+     * taking its health check down with it.
+     */
+    let discovered = null;
+    function configuration() {
+        discovered ??= client
+            .discovery(new URL(config.MICA_OIDC_ISSUER), config.MICA_OIDC_CLIENT_ID, config.MICA_OIDC_CLIENT_SECRET, undefined, 
+        // Only ever for a provider on localhost, and only outside production —
+        // the config layer refuses the combination anywhere else.
+        config.oidcAllowInsecure ? { execute: [client.allowInsecureRequests] } : undefined)
+            .catch((error) => {
+            // Forget the failure so the next attempt retries rather than caching a
+            // rejected promise for the life of the process.
+            discovered = null;
+            logger.error("OIDC discovery failed", {
+                issuer: config.MICA_OIDC_ISSUER,
+                error: String(error),
+            });
+            throw new ApiError("service_unavailable", "The identity provider could not be reached. Try again shortly.");
+        });
+        return discovered;
+    }
+    return {
+        /** Where to send a browser to sign in, plus the transaction to remember. */
+        async begin(returnTo) {
+            const as = await configuration();
+            const verifier = client.randomPKCECodeVerifier();
+            const transaction = {
+                state: client.randomState(),
+                nonce: client.randomNonce(),
+                verifier,
+                returnTo,
+                expiresAt: Date.now() + TRANSACTION_TTL_MS,
+            };
+            const url = client.buildAuthorizationUrl(as, {
+                redirect_uri: redirectUri,
+                scope: config.MICA_OIDC_SCOPE,
+                state: transaction.state,
+                nonce: transaction.nonce,
+                code_challenge: await client.calculatePKCECodeChallenge(verifier),
+                code_challenge_method: "S256",
+            });
+            return { url: url.toString(), transaction };
+        },
+        /**
+         * Completes the flow and returns who signed in.
+         *
+         * `authorizationCodeGrant` verifies the ID token signature, the issuer, the
+         * audience, the expiry, the nonce and the PKCE verifier. Doing any of that
+         * by hand here would be reimplementing the part of this that is genuinely
+         * hard to get right.
+         */
+        async complete(currentUrl, transaction) {
+            const as = await configuration();
+            let tokens;
+            try {
+                tokens = await client.authorizationCodeGrant(as, currentUrl, {
+                    pkceCodeVerifier: transaction.verifier,
+                    expectedState: transaction.state,
+                    expectedNonce: transaction.nonce,
+                });
+            }
+            catch (error) {
+                logger.warn("OIDC callback rejected", { error: String(error) });
+                throw new ApiError("unauthenticated", "Sign-in could not be completed. Please try again.");
+            }
+            const claims = tokens.claims();
+            if (!claims?.sub) {
+                throw new ApiError("unauthenticated", "The identity provider returned no subject.");
+            }
+            // Not every provider puts email, name and groups in the ID token; some
+            // keep them at the userinfo endpoint, and some only release groups
+            // there. Ask only when something is missing.
+            const groupsClaim = config.MICA_OIDC_GROUPS_CLAIM;
+            let email = typeof claims["email"] === "string" ? claims["email"] : "";
+            let name = typeof claims["name"] === "string" ? claims["name"] : "";
+            let emailVerified = claims["email_verified"] === true;
+            let groups = readGroups(claims[groupsClaim]);
+            if (!email || !name || groups.length === 0) {
+                try {
+                    const info = await client.fetchUserInfo(as, tokens.access_token, claims.sub);
+                    email ||= typeof info.email === "string" ? info.email : "";
+                    name ||= typeof info.name === "string" ? info.name : "";
+                    emailVerified ||= info["email_verified"] === true;
+                    if (groups.length === 0)
+                        groups = readGroups(info[groupsClaim]);
+                }
+                catch (error) {
+                    logger.debug("OIDC userinfo unavailable", { error: String(error) });
+                }
+            }
+            if (!email) {
+                // Mica names people by email — it is who the commits are from. An
+                // identity without one cannot be shown to anybody, so it is refused
+                // rather than displayed as blank.
+                throw new ApiError("unauthenticated", "The identity provider did not release an email address. " +
+                    "Grant Mica the `email` scope.");
+            }
+            return {
+                issuer: String(claims.iss),
+                subject: String(claims.sub),
+                email,
+                emailVerified,
+                name: name || email,
+                groups,
+            };
+        },
+        /**
+         * Where to send the browser to end the provider's session too.
+         *
+         * Null when the provider does not advertise the endpoint: signing out of
+         * Mica always works, and signing out of the IdP is a bonus that not every
+         * deployment can offer.
+         */
+        async endSessionUrl() {
+            try {
+                const as = await configuration();
+                return client
+                    .buildEndSessionUrl(as, {
+                    post_logout_redirect_uri: new URL("/admin/", config.MICA_PUBLIC_URL).toString(),
+                })
+                    .toString();
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+/**
+ * A groups claim, from a provider that may not send one and is under no
+ * obligation to send it as an array.
+ *
+ * Keycloak sends a list of paths, Entra a list of ids, some deployments a
+ * single string, and a misconfigured mapper sends an object. Everything that
+ * is not a string in a list is dropped rather than coerced, because a group
+ * name Mica invented would be a group name that could match a rule.
+ */
+function readGroups(value) {
+    if (typeof value === "string")
+        return value.split(/[,\s]+/).filter(Boolean);
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((entry) => typeof entry === "string");
+}
+/** A random return path token, for the local mode that has no provider. */
+export const randomToken = () => randomBytes(32).toString("base64url");
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAe,MAAM,kBAAkB,CAAC;AAIzD,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAuB1C;;wEAEwE;AAExE,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAA4B,EAAE,MAAc;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/E,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,MAAc;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAE9C,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAChC,CAAC;QAErB,OAAO,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEhC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC;IAErF;;;;;;OAMG;IACH,IAAI,UAAU,GAAyC,IAAI,CAAC;IAE5D,SAAS,aAAa;QACpB,UAAU,KAAK,MAAM;aAClB,SAAS,CACR,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAiB,CAAC,EACjC,MAAM,CAAC,mBAAoB,EAC3B,MAAM,CAAC,uBAAuB,EAC9B,SAAS;QACT,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CACnF;aACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,uEAAuE;YACvE,gDAAgD;YAChD,UAAU,GAAG,IAAI,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBACpC,MAAM,EAAE,MAAM,CAAC,gBAAgB;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;aACrB,CAAC,CAAC;YACH,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,gEAAgE,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,4EAA4E;QAC5E,KAAK,CAAC,KAAK,CAAC,QAAgB;YAC1B,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;YAEjC,MAAM,QAAQ,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACjD,MAAM,WAAW,GAAoB;gBACnC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC3B,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC3B,QAAQ;gBACR,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;aAC3C,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE;gBAC3C,YAAY,EAAE,WAAW;gBACzB,KAAK,EAAE,MAAM,CAAC,eAAe;gBAC7B,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,cAAc,EAAE,MAAM,MAAM,CAAC,0BAA0B,CAAC,QAAQ,CAAC;gBACjE,qBAAqB,EAAE,MAAM;aAC9B,CAAC,CAAC;YAEH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC;QAC9C,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,QAAQ,CAAC,UAAe,EAAE,WAA4B;YAC1D,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;YAEjC,IAAI,MAA0E,CAAC;YAC/E,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE;oBAC3D,gBAAgB,EAAE,WAAW,CAAC,QAAQ;oBACtC,aAAa,EAAE,WAAW,CAAC,KAAK;oBAChC,aAAa,EAAE,WAAW,CAAC,KAAK;iBACjC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAChE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;YAC7F,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;YACtF,CAAC;YAED,uEAAuE;YACvE,mEAAmE;YACnE,6CAA6C;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,sBAAsB,CAAC;YAElD,IAAI,KAAK,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,IAAI,IAAI,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,IAAI,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;YACtD,IAAI,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAE7C,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7E,KAAK,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,aAAa,KAAK,IAAI,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;oBAClD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,kEAAkE;gBAClE,oEAAoE;gBACpE,kCAAkC;gBAClC,MAAM,IAAI,QAAQ,CAChB,iBAAiB,EACjB,0DAA0D;oBACxD,+BAA+B,CAClC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC3B,KAAK;gBACL,aAAa;gBACb,IAAI,EAAE,IAAI,IAAI,KAAK;gBACnB,MAAM;aACP,CAAC;QACJ,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,aAAa;YACjB,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;gBACjC,OAAO,MAAM;qBACV,kBAAkB,CAAC,EAAE,EAAE;oBACtB,wBAAwB,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;iBAChF,CAAC;qBACD,QAAQ,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAID;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC"}

package/dist/routes.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Authentication routes.
+ *
+ * The authorization code flow, and nothing else. There is no login form here,
+ * no password check and no reset: the browser is sent to an identity provider,
+ * comes back with a code, and Mica exchanges it for a statement about who the
+ * person is.
+ *
+ * What Mica still decides is whether that person may edit *this site*. A valid
+ * token from a correctly configured provider proves an identity and nothing
+ * more; `admission.ts` is the gate, and an unknown person hits it.
+ */
+import { Hono } from "hono";
+import { type Env, type RateLimiter } from "@micacms/runtime";
+import type { AdmissionPolicy } from "./admission.js";
+import type { AuthConfig } from "./config.js";
+import { type SessionService } from "./session.js";
+import type { SessionRepository } from "./sessions-repository.js";
+import { type OidcService } from "./oidc.js";
+export interface AuthRoutesDeps {
+    config: AuthConfig;
+    sessions: SessionService;
+    sessionsRepo: SessionRepository;
+    oidc: OidcService;
+    admission: AdmissionPolicy;
+    loginLimiter: RateLimiter;
+}
+export declare function authRoutes(deps: AuthRoutesDeps): Hono<Env>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAsB,KAAK,GAAG,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAElF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAmB,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAiBnB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC;IACzB,YAAY,EAAE,iBAAiB,CAAC;IAChC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;IAC3B,YAAY,EAAE,WAAW,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAkI1D"}

package/dist/routes.js

@@ -0,0 +1,135 @@
+/**
+ * Authentication routes.
+ *
+ * The authorization code flow, and nothing else. There is no login form here,
+ * no password check and no reset: the browser is sent to an identity provider,
+ * comes back with a code, and Mica exchanges it for a statement about who the
+ * person is.
+ *
+ * What Mica still decides is whether that person may edit *this site*. A valid
+ * token from a correctly configured provider proves an identity and nothing
+ * more; `admission.ts` is the gate, and an unknown person hits it.
+ */
+import { Hono } from "hono";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { ApiError, clientIp } from "@micacms/runtime";
+import { requireAccess, sessionOf } from "./gate.js";
+import { CSRF_COOKIE, establishSession, SESSION_COOKIE, } from "./session.js";
+import { openTransaction, sealTransaction, TRANSACTION_COOKIE, } from "./oidc.js";
+/** Only ever a path on this server, so the callback cannot be an open redirect. */
+function safeReturnTo(raw) {
+    if (!raw || !raw.startsWith("/") || raw.startsWith("//"))
+        return "/admin/";
+    return raw;
+}
+const identityOf = (claims) => ({
+    issuer: claims.issuer,
+    subject: claims.subject,
+    email: claims.email,
+    emailVerified: claims.emailVerified,
+    name: claims.name,
+    groups: claims.groups,
+});
+export function authRoutes(deps) {
+    const app = new Hono();
+    const { config, sessions, oidc, admission } = deps;
+    const gate = deps;
+    /**
+     * What the sign-in screen needs to know before it draws anything.
+     *
+     * Public: it reveals only that this deployment authenticates and which
+     * provider it uses, which the redirect would reveal a moment later anyway.
+     */
+    app.get("/config", (c) => c.json({
+        authRequired: true,
+        provider: config.MICA_OIDC_ISSUER ? new URL(config.MICA_OIDC_ISSUER).hostname : null,
+    }));
+    /** Starts the flow. A redirect, not a form post. */
+    app.get("/login", async (c) => {
+        const returnTo = safeReturnTo(c.req.query("returnTo"));
+        // Rate limited on the way out as well as the way back: starting a flow is
+        // cheap for a client and costs Mica a discovery request.
+        const limit = deps.loginLimiter.check(`oidc:${clientIp(c)}`);
+        if (!limit.allowed) {
+            throw new ApiError("rate_limited", `Too many sign-in attempts. Try again in ${Math.ceil(limit.retryAfter / 60)} minutes.`, { headers: { "retry-after": String(limit.retryAfter) } });
+        }
+        const { url, transaction } = await oidc.begin(returnTo);
+        setCookie(c, TRANSACTION_COOKIE, sealTransaction(transaction, config.sessionSecret), {
+            path: "/api/auth",
+            httpOnly: true,
+            secure: config.cookieSecure,
+            // Lax, not Strict: the provider redirects the browser back here from
+            // another origin, and Strict would withhold the cookie exactly then.
+            sameSite: "Lax",
+            maxAge: 15 * 60,
+        });
+        return c.redirect(url);
+    });
+    /**
+     * Where the provider sends the browser back.
+     *
+     * A browser is following a redirect here, not making an XHR, so a failure
+     * must not be a JSON error envelope — that would put a wall of braces on the
+     * screen. Everything that can go wrong goes back to the sign-in page with a
+     * message the person can act on.
+     */
+    app.get("/callback", async (c) => {
+        const logger = c.get("logger");
+        const refuse = (message) => c.redirect(`/admin/login?error=${encodeURIComponent(message)}`);
+        const sealed = getCookie(c, TRANSACTION_COOKIE);
+        deleteCookie(c, TRANSACTION_COOKIE, { path: "/api/auth" });
+        const transaction = sealed ? openTransaction(sealed, config.sessionSecret) : null;
+        if (!transaction) {
+            // Expired, tampered with, or a callback nobody asked for.
+            return refuse("That sign-in attempt expired or was not started here. Please try again.");
+        }
+        let claims;
+        try {
+            claims = await oidc.complete(new URL(c.req.url), transaction);
+        }
+        catch (error) {
+            return refuse(error instanceof ApiError ? error.message : "Sign-in could not be completed.");
+        }
+        const identity = identityOf(claims);
+        /**
+         * Authentication succeeded; admission is a separate question.
+         *
+         * A provider may vouch for an entire company. The admission rules are what
+         * say this particular person may edit this particular site, and their
+         * refusal is the expected answer for everybody who was not meant to be
+         * here — so it is a plain message, not an error.
+         */
+        const verdict = admission.admits(identity);
+        if (!verdict.admitted) {
+            logger.warn("Authenticated but not admitted", {
+                subject: identity.subject,
+                reason: verdict.reason,
+            });
+            return refuse(`You are signed in as ${claims.email}, but that account has no access to ` +
+                "this site. Ask whoever runs it to add you.");
+        }
+        establishSession(c, sessions, identity);
+        logger.info("Signed in", { subject: identity.subject, issuer: identity.issuer });
+        return c.redirect(transaction.returnTo);
+    });
+    app.post("/logout", async (c) => {
+        sessions.destroy(getCookie(c, SESSION_COOKIE));
+        deleteCookie(c, SESSION_COOKIE, sessions.clearedCookieOptions());
+        deleteCookie(c, CSRF_COOKIE, sessions.clearedCookieOptions());
+        // Offered, not followed: ending the provider's session is the provider's
+        // decision to make, and the SPA sends the browser there if it is there.
+        return c.json({ ok: true, endSession: await oidc.endSessionUrl() });
+    });
+    /** The session this request is in, and who it belongs to. */
+    app.get("/me", requireAccess(gate), (c) => {
+        const session = sessionOf(c);
+        const { identity } = c.get("access");
+        return c.json({
+            identity,
+            csrfToken: session.csrfToken,
+            expiresAt: session.expiresAt,
+        });
+    });
+    return app;
+}
+//# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAA8B,MAAM,kBAAkB,CAAC;AAIlF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAiB,MAAM,WAAW,CAAC;AACpE,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,cAAc,GAEf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,eAAe,EACf,kBAAkB,GAGnB,MAAM,WAAW,CAAC;AAEnB,mFAAmF;AACnF,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAkB,EAAmB,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,KAAK,EAAE,MAAM,CAAC,KAAK;IACnB,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC,CAAC;AAWH,MAAM,UAAU,UAAU,CAAC,IAAoB;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACnD,MAAM,IAAI,GAAa,IAAI,CAAC;IAE5B;;;;;OAKG;IACH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CACvB,CAAC,CAAC,IAAI,CAAC;QACL,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;KACrF,CAAC,CACH,CAAC;IAEF,oDAAoD;IACpD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAEvD,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,2CAA2C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,WAAW,EACtF,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,SAAS,CAAC,CAAC,EAAE,kBAAkB,EAAE,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE;YACnF,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,YAAY;YAC3B,qEAAqE;YACrE,qEAAqE;YACrE,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,EAAE,GAAG,EAAE;SAChB,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE/B,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CACjC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAChD,YAAY,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE3D,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,0DAA0D;YAC1D,OAAO,MAAM,CAAC,yEAAyE,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEpC;;;;;;;WAOG;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBAC5C,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,OAAO,MAAM,CACX,wBAAwB,MAAM,CAAC,KAAK,sCAAsC;gBACxE,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAEjF,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;QAE/C,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACjE,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAE9D,yEAAyE;QACzE,wEAAwE;QACxE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAErC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,QAAQ;YACR,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Session management.
+ *
+ * Server-side sessions in SQLite, addressed by an opaque random token held in a
+ * Secure/HttpOnly/SameSite cookie. No JWTs: revocation has to be immediate, and
+ * a row delete is the simplest way to get it.
+ *
+ * Three layers of defence on the cookie value:
+ *   1. the token is 256 bits from `crypto.randomBytes`;
+ *   2. it is HMAC-signed with SESSION_SECRET, so forged or truncated cookies
+ *      are rejected without touching the database;
+ *   3. only its SHA-256 is stored, so a database dump yields no usable session.
+ *
+ * Session fixation is handled by never adopting a client-supplied identifier —
+ * a token is minted at login and the previous one deleted.
+ */
+import type { Context } from "hono";
+import { type Env } from "@micacms/runtime";
+import type { AuthConfig } from "./config.js";
+import type { SessionIdentity, SessionRecord, SessionRepository } from "./sessions-repository.js";
+export declare const SESSION_COOKIE = "mica_session";
+export declare const CSRF_COOKIE = "mica_csrf";
+export declare const CSRF_HEADER = "x-csrf-token";
+export interface SessionService {
+    /**
+     * `identity` is null in local mode, where there is no provider and no user:
+     * the row exists to carry a CSRF token and an expiry, and nothing else.
+     */
+    create(input: {
+        identity: SessionIdentity | null;
+        ip?: string | null;
+        userAgent?: string | null;
+    }): {
+        record: SessionRecord;
+        cookie: string;
+        csrfToken: string;
+    };
+    resolve(cookieValue: string | undefined): SessionRecord | null;
+    destroy(cookieValue: string | undefined): void;
+    /** Signs one person out on every device. */
+    destroyAllForIdentity(issuer: string, subject: string): void;
+    sessionCookieOptions(): CookieOptions;
+    csrfCookieOptions(): CookieOptions;
+    clearedCookieOptions(): CookieOptions;
+    purgeExpired(): number;
+}
+export interface CookieOptions {
+    path: string;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: "Lax" | "Strict" | "None";
+    maxAge: number;
+}
+/** Constant-time string comparison that tolerates differing lengths. */
+export declare function safeEqual(a: string, b: string): boolean;
+export declare function createSessionService(sessions: SessionRepository, config: AuthConfig): SessionService;
+/** Issues the session cookies for a browser that has just been identified. */
+export declare function establishSession(c: Context<Env>, sessions: SessionService, identity: SessionIdentity): void;
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,EAAyB,KAAK,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EACV,eAAe,EACf,aAAa,EACb,iBAAiB,EAClB,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAC7C,eAAO,MAAM,WAAW,cAAc,CAAC;AACvC,eAAO,MAAM,WAAW,iBAAiB,CAAC;AAK1C,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;QACjC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,GAAG;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,IAAI,CAAC;IAC/D,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC/C,4CAA4C;IAC5C,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7D,oBAAoB,IAAI,aAAa,CAAC;IACtC,iBAAiB,IAAI,aAAa,CAAC;IACnC,oBAAoB,IAAI,aAAa,CAAC;IACtC,YAAY,IAAI,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CAChB;AAQD,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CASvD;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,UAAU,GACjB,cAAc,CA2GhB;AAMD,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EACf,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,eAAe,GACxB,IAAI,CAYN"}