@nerdsystem/sdk 0.0.5 → 0.0.7

package/dist/app.d.ts

@@ -7,6 +7,8 @@ export interface CreateNerdAppOptions {
     authPath?: string;
     /** Security headers on every response. Pass false to disable, or options to tune the CSP. */
     securityHeaders?: SecurityHeadersOptions | false;
+    /** Reject cookie-authenticated writes that a browser sent from another site. Pass false only if you handle CSRF yourself. */
+    crossSiteGuard?: false;
 }
 /**
  * A Hono app with nerdsystem auth wired in: session routes at /api/auth and `c.var.user`

package/dist/app.js

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import { attachUser } from "./auth/middleware";
+import { crossSiteGuard } from "./auth/csrf";
 import { authRoutes } from "./auth/routes";
 import { securityHeaders } from "./security";
 /**
@@ -10,6 +11,8 @@ export function createNerdApp(options = {}) {
     const app = new Hono();
     if (options.securityHeaders !== false)
         app.use("*", securityHeaders(options.securityHeaders ?? {}));
+    if (options.crossSiteGuard !== false)
+        app.use("*", crossSiteGuard());
     app.use("*", attachUser());
     app.route(options.authPath ?? "/api/auth", authRoutes());
     app.notFound((c) => c.json({ error: { code: "not_found", message: `No route for ${c.req.method} ${c.req.path}` } }, 404));

package/dist/auth/client.d.ts

@@ -21,8 +21,12 @@ export declare class AuthServiceError extends Error {
 export declare class AuthServiceClient {
     private readonly env;
     private readonly fetchImpl;
+    /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
+    private readonly clientIp?;
     private readonly base;
-    constructor(env: Pick<NerdEnv, "NERD_AUTH_URL" | "NERD_PROJECT_ID" | "NERD_AUTH_SECRET">, fetchImpl?: typeof fetch);
+    constructor(env: Pick<NerdEnv, "NERD_AUTH_URL" | "NERD_PROJECT_ID" | "NERD_AUTH_SECRET">, fetchImpl?: typeof fetch, 
+    /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
+    clientIp?: string | undefined);
     get jwksUrl(): string;
     private call;
     signup(input: {
@@ -41,6 +45,7 @@ export declare class AuthServiceClient {
     me(accessToken: string): Promise<{
         user: EndUser;
     }>;
+    /** Server-side only: the platform requires the tenant secret so nobody can turn the reset email into a phishing relay. */
     forgotPassword(input: {
         email: string;
         resetUrl: string;

package/dist/auth/client.js

@@ -13,12 +13,16 @@ export class AuthServiceError extends Error {
 export class AuthServiceClient {
     env;
     fetchImpl;
+    clientIp;
     base;
     constructor(env, 
     // Wrapped, not bare: calling a stored `fetch` as a method breaks in workerd (illegal invocation).
-    fetchImpl = (input, init) => fetch(input, init)) {
+    fetchImpl = (input, init) => fetch(input, init), 
+    /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
+    clientIp) {
         this.env = env;
         this.fetchImpl = fetchImpl;
+        this.clientIp = clientIp;
         this.base = `${env.NERD_AUTH_URL.replace(/\/$/, "")}/t/${env.NERD_PROJECT_ID}`;
     }
     get jwksUrl() {
@@ -30,6 +34,7 @@ export class AuthServiceClient {
             headers: {
                 ...(body !== undefined ? { "content-type": "application/json" } : {}),
                 ...(auth ? { authorization: `Bearer ${auth}` } : {}),
+                ...(this.clientIp ? { "x-nerd-client-ip": this.clientIp } : {}),
             },
             body: body !== undefined ? JSON.stringify(body) : null,
         });
@@ -56,8 +61,9 @@ export class AuthServiceClient {
     me(accessToken) {
         return this.call("GET", "/me", undefined, accessToken);
     }
+    /** Server-side only: the platform requires the tenant secret so nobody can turn the reset email into a phishing relay. */
     forgotPassword(input) {
-        return this.call("POST", "/password/forgot", input);
+        return this.call("POST", "/password/forgot", input, this.env.NERD_AUTH_SECRET);
     }
     resetPassword(input) {
         return this.call("POST", "/password/reset", input);

package/dist/auth/csrf.d.ts

@@ -0,0 +1,9 @@
+import type { MiddlewareHandler } from "hono";
+/**
+ * Rejects state-changing requests that a browser sent from another site. Every app on the shared
+ * app domain is "same-site" with every other until the domain is on the Public Suffix List, and
+ * the auth cookies are SameSite=Lax, so without this a page on one app could POST to another with
+ * the visitor's cookies attached. Requests with a bearer token (mobile and server clients) and
+ * requests without browser fetch metadata are allowed through.
+ */
+export declare function crossSiteGuard(): MiddlewareHandler;

package/dist/auth/csrf.js

@@ -0,0 +1,26 @@
+/**
+ * Rejects state-changing requests that a browser sent from another site. Every app on the shared
+ * app domain is "same-site" with every other until the domain is on the Public Suffix List, and
+ * the auth cookies are SameSite=Lax, so without this a page on one app could POST to another with
+ * the visitor's cookies attached. Requests with a bearer token (mobile and server clients) and
+ * requests without browser fetch metadata are allowed through.
+ */
+export function crossSiteGuard() {
+    return async (c, next) => {
+        const method = c.req.method;
+        if (method === "GET" || method === "HEAD" || method === "OPTIONS")
+            return next();
+        if (c.req.header("authorization")?.toLowerCase().startsWith("bearer "))
+            return next();
+        const site = c.req.header("sec-fetch-site");
+        if (site && site !== "same-origin" && site !== "none")
+            return reject(c);
+        const origin = c.req.header("origin");
+        if (origin && origin !== new URL(c.req.url).origin)
+            return reject(c);
+        return next();
+    };
+}
+function reject(c) {
+    return c.json({ error: { code: "forbidden", message: "Cross-site request rejected. Call this API from the app's own pages, or send a bearer token." } }, 403);
+}

package/dist/auth/middleware.js

@@ -16,7 +16,7 @@ export async function resolveUser(c) {
     const token = bearer?.toLowerCase().startsWith("bearer ") ? bearer.slice(7) : readAccessCookie(c);
     if (!token)
         return null;
-    const client = new AuthServiceClient(c.env);
+    const client = new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip"));
     const verified = await verifyAccessToken(token, { jwksUrl: client.jwksUrl, projectId: c.env.NERD_PROJECT_ID });
     if (!verified)
         return null;

package/dist/auth/routes.js

@@ -39,7 +39,7 @@ export function authRoutes() {
         if (c.env.NERD_TURNSTILE_SECRET && !(await verifyTurnstile(c.env.NERD_TURNSTILE_SECRET, str(body.turnstileToken), c.req.header("cf-connecting-ip")))) {
             return c.json({ error: { code: "bad_request", message: "Please complete the verification challenge" } }, 400);
         }
-        const session = await new AuthServiceClient(c.env).signup({ email, password, name });
+        const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).signup({ email, password, name });
         setSessionCookies(c, session);
         return c.json({ user: session.user }, 201);
     });
@@ -49,7 +49,7 @@ export function authRoutes() {
         const password = str(body.password);
         if (!email || !password)
             return c.json({ error: { code: "bad_request", message: "email and password are required" } }, 400);
-        const session = await new AuthServiceClient(c.env).login({ email, password });
+        const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).login({ email, password });
         setSessionCookies(c, session);
         return c.json({ user: session.user }, 200);
     });
@@ -58,7 +58,7 @@ export function authRoutes() {
         if (!refreshToken)
             return c.json({ error: { code: "unauthorized", message: "No session" } }, 401);
         try {
-            const session = await new AuthServiceClient(c.env).refresh(refreshToken);
+            const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).refresh(refreshToken);
             setSessionCookies(c, session);
             return c.json({ user: session.user }, 200);
         }
@@ -73,7 +73,7 @@ export function authRoutes() {
     r.post("/logout", async (c) => {
         const refreshToken = readRefreshCookie(c);
         if (refreshToken)
-            await new AuthServiceClient(c.env).logout(refreshToken).catch(() => { });
+            await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).logout(refreshToken).catch(() => { });
         clearSessionCookies(c);
         return c.json({ ok: true }, 200);
     });
@@ -84,7 +84,7 @@ export function authRoutes() {
         if (!email)
             return c.json({ error: { code: "bad_request", message: "email is required" } }, 400);
         const origin = new URL(c.req.url).origin;
-        await new AuthServiceClient(c.env).forgotPassword({ email, resetUrl: `${origin}/reset-password`, ...(c.env.NERD_APP_NAME ? { appName: c.env.NERD_APP_NAME } : {}) });
+        await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).forgotPassword({ email, resetUrl: `${origin}/reset-password`, ...(c.env.NERD_APP_NAME ? { appName: c.env.NERD_APP_NAME } : {}) });
         return c.json({ ok: true }, 200);
     });
     r.post("/reset", async (c) => {
@@ -93,7 +93,7 @@ export function authRoutes() {
         const password = str(body.password);
         if (!token || !password)
             return c.json({ error: { code: "bad_request", message: "token and password are required" } }, 400);
-        const session = await new AuthServiceClient(c.env).resetPassword({ token, password });
+        const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).resetPassword({ token, password });
         setSessionCookies(c, session);
         return c.json({ user: session.user }, 200);
     });
@@ -106,7 +106,7 @@ export function authRoutes() {
         if (!refreshToken || readAccessCookie(c))
             return c.json({ user: null }, 200);
         try {
-            const session = await new AuthServiceClient(c.env).refresh(refreshToken);
+            const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).refresh(refreshToken);
             setSessionCookies(c, session);
             return c.json({ user: { id: session.user.id, email: session.user.email, name: session.user.name, roles: session.user.roles } }, 200);
         }

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { createNerdApp, type CreateNerdAppOptions } from "./app";
 export type { NerdEnv, NerdUser, NerdVariables } from "./env";
 export { attachUser, requireAuth, requireRole, resolveUser, type NerdHonoEnv } from "./auth/middleware";
+export { crossSiteGuard } from "./auth/csrf";
 export { AuthServiceClient, AuthServiceError, type EndUser, type Session } from "./auth/client";
 export { verifyAccessToken, type VerifiedToken } from "./auth/jwks";
 export { authRoutes } from "./auth/routes";

package/dist/index.js

@@ -1,5 +1,6 @@
 export { createNerdApp } from "./app";
 export { attachUser, requireAuth, requireRole, resolveUser } from "./auth/middleware";
+export { crossSiteGuard } from "./auth/csrf";
 export { AuthServiceClient, AuthServiceError } from "./auth/client";
 export { verifyAccessToken } from "./auth/jwks";
 export { authRoutes } from "./auth/routes";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nerdsystem/sdk",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "Runtime for apps deployed on nerdsystem: auth, authorization, and platform bindings.",
   "type": "module",
   "main": "./dist/index.js",