@o3co/create-auth-provider 0.9.0 → 0.10.0

package/templates/standalone/tests/index.test.js

@@ -29,6 +29,23 @@ const client = axios.create({
 
 const _extractCookies = (res) => (res.headers["set-cookie"] ?? []).join("; ");
 
+/**
+ * The server's own origin, as a browser would report it.
+ *
+ * Since #272 `POST /session/login` and `POST /session/logout` reject a request
+ * that carries neither a same-origin `Origin`/`Referer` nor a valid
+ * double-submit CSRF token. A browser sets `Origin` on its own; a scripted
+ * client like this one has to say it.
+ */
+const SERVER_ORIGIN = new URL(BASE_URL).origin;
+
+/** POST to a state-changing session route the way a same-origin browser would. */
+const sessionPost = (path, data, config = {}) =>
+	client.post(path, data, {
+		...config,
+		headers: { Origin: SERVER_ORIGIN, ...(config.headers ?? {}) },
+	});
+
 describe("POST /oauth/introspect", () => {
 	// Helper: self-introspect sends the token as both Bearer credential and body parameter
 	const selfIntrospect = (token, contentType = "application/json") => {
@@ -109,12 +126,12 @@ describe("POST /oauth/introspect", () => {
 
 describe("POST /session/login", () => {
 	it("returns 400 when no credentials are provided", async () => {
-		const res = await client.post("/session/login", {});
+		const res = await sessionPost("/session/login", {});
 		expect(res.status).toBe(400);
 	});
 
 	it("returns 400 when redirect_to has an invalid scheme", async () => {
-		const res = await client.post("/session/login", {
+		const res = await sessionPost("/session/login", {
 			username: "testuser",
 			password: "testpass",
 			redirect_to: "javascript:alert(1)",
@@ -124,7 +141,7 @@ describe("POST /session/login", () => {
 	});
 
 	it("returns 400 when redirect_to is not a valid URL", async () => {
-		const res = await client.post("/session/login", {
+		const res = await sessionPost("/session/login", {
 			username: "testuser",
 			password: "testpass",
 			redirect_to: "not-a-url",
@@ -134,7 +151,7 @@ describe("POST /session/login", () => {
 	});
 
 	it("returns 400 when redirect_to exceeds 2048 characters", async () => {
-		const res = await client.post("/session/login", {
+		const res = await sessionPost("/session/login", {
 			username: "testuser",
 			password: "testpass",
 			redirect_to: `https://example.com/${"a".repeat(2048)}`,
@@ -147,7 +164,7 @@ describe("POST /session/login", () => {
 		// redirect_to validation runs before authentication, so even with
 		// invalid credentials, a valid redirect_to should not cause a 400
 		// with error: "invalid_redirect". It should fail with 401 (auth failure).
-		const res = await client.post("/session/login", {
+		const res = await sessionPost("/session/login", {
 			username: "testuser",
 			password: "testpass",
 			redirect_to: "http://localhost:3000/oauth/authorize",
@@ -157,6 +174,53 @@ describe("POST /session/login", () => {
 	});
 });
 
+describe("CSRF on the state-changing session routes (#272)", () => {
+	it("rejects a login carrying neither an origin signal nor a token", async () => {
+		// The bypass this replaced: omitting `Origin` skipped the check entirely.
+		const res = await client.post("/session/login", {
+			username: "testuser",
+			password: "testpass",
+		});
+		expect(res.status).toBe(403);
+		expect(res.data.error).toBe("access_denied");
+	});
+
+	it("rejects a logout carrying neither an origin signal nor a token", async () => {
+		const res = await client.post("/session/logout", {});
+		expect(res.status).toBe(403);
+		expect(res.data.error).toBe("access_denied");
+	});
+
+	it("rejects a login from a foreign origin", async () => {
+		const res = await client.post(
+			"/session/login",
+			{ username: "testuser", password: "testpass" },
+			{ headers: { Origin: "https://evil.example.com" } },
+		);
+		expect(res.status).toBe(403);
+	});
+
+	it("accepts a header-less client that presents a token from GET /session/csrf", async () => {
+		const issued = await client.get("/session/csrf");
+		expect(issued.status).toBe(200);
+		expect(typeof issued.data.csrf_token).toBe("string");
+
+		const res = await client.post(
+			"/session/login",
+			{ username: "testuser", password: "testpass" },
+			{
+				headers: {
+					Cookie: _extractCookies(issued).split(";")[0],
+					[issued.data.header_name]: issued.data.csrf_token,
+				},
+			},
+		);
+		// Credentials are still wrong in this environment — the point is that the
+		// request got past the CSRF guard rather than stopping at 403.
+		expect(res.status).not.toBe(403);
+	});
+});
+
 describe("POST /oauth/token", () => {
 	it("returns 401 for grant_type=session without an authenticated session", async () => {
 		const res = await client.post("/oauth/token", "grant_type=session", {

package/templates/standalone/tsconfig.json

@@ -1,6 +1,14 @@
 {
 	"compilerOptions": {
-		"target": "esnext",
+		// `es2023` target (NOT esnext) with `lib: esnext` — mirrors the monorepo's
+		// tsconfig.base.json. This template is copied verbatim into scaffolded
+		// consumer projects (so it must stay self-contained and cannot `extends`
+		// ../../tsconfig.base.json). Capping the emit target at ES2023 — the newest
+		// edition Node 22 (this template's engine floor) parses natively — makes tsc
+		// downlevel any newer syntax (e.g. `await using`) into helpers, so the built
+		// server actually runs on the Node it advertises. Do NOT raise to `esnext`
+		// without also raising the engine floor.
+		"target": "es2023",
 		"lib": ["esnext"],
 		"module": "nodenext",
 		"moduleResolution": "nodenext",

package/templates/standalone/vitest.config.mts

@@ -3,5 +3,13 @@ import { defineConfig } from "vitest/config";
 export default defineConfig({
 	test: {
 		include: ["src/**/__tests__/**/*.test.mts"],
+		// #357: the workspace-wide deadline floor, repeated as literals rather
+		// than imported from vitest.shared.mts — this template is copied
+		// verbatim into scaffolded projects, where that file does not exist.
+		// Rationale lives there: under a loaded parallel run, transform+import
+		// alone can exceed vitest's 5s default, and a real hang still fails at
+		// 20s.
+		testTimeout: 20_000,
+		hookTimeout: 20_000,
 	},
 });

package/templates/versions.json

@@ -1,13 +1,13 @@
 {
-	"@o3co/auth-provider-core": "0.9.0",
-	"@o3co/auth-provider-dpop": "0.9.0",
-	"@o3co/auth-provider-mtls": "0.9.0",
-	"@o3co/auth-provider-federation-google": "0.9.0",
-	"@o3co/auth-provider-federation-github": "0.9.0",
-	"@o3co/auth-provider-oauth": "0.9.0",
-	"@o3co/auth-provider-oauth-token-exchange": "0.9.0",
-	"@o3co/auth-provider-session": "0.9.0",
-	"@o3co/auth-provider-foundation": "0.9.0",
-	"@o3co/auth-provider-redis": "0.9.0",
-	"@o3co/auth-provider-webauthn": "0.9.0"
+	"@o3co/auth-provider-core": "0.10.0",
+	"@o3co/auth-provider-dpop": "0.10.0",
+	"@o3co/auth-provider-mtls": "0.10.0",
+	"@o3co/auth-provider-federation-google": "0.10.0",
+	"@o3co/auth-provider-federation-github": "0.10.0",
+	"@o3co/auth-provider-oauth": "0.10.0",
+	"@o3co/auth-provider-oauth-token-exchange": "0.10.0",
+	"@o3co/auth-provider-session": "0.10.0",
+	"@o3co/auth-provider-foundation": "0.10.0",
+	"@o3co/auth-provider-redis": "0.10.0",
+	"@o3co/auth-provider-webauthn": "0.10.0"
 }