@o3co/create-auth-provider 0.9.0 → 0.11.0

package/templates/standalone/src/terminalError.mts

@@ -0,0 +1,60 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { errorEnvelope, type Logger } from "@o3co/auth-provider-core";
+import type { ErrorRequestHandler } from "express";
+
+/**
+ * Terminal Express error handler (#293 item 8).
+ *
+ * Anything a route threw past its own try/catch — and every body-parser
+ * rejection, which fires before any route runs — used to fall through to
+ * Express's default handler: an HTML 500 outside the structured-log pipeline,
+ * carrying a stack trace outside production. A client that parses only the
+ * RFC 6749 §5.2 JSON envelope this surface answers with everywhere else has
+ * no way to read that page.
+ *
+ * Body-parser failures (malformed JSON/form, over-limit, bad charset) carry
+ * their own 4xx `status` and are the client's fault: keep the status, wrap it
+ * in the shared envelope, and do not log them as server errors. Everything
+ * else is logged with the request path and answered `500 server_error`.
+ *
+ * Mount it AFTER every route (`app.use(handle.router)` included) — Express
+ * routes errors only to handlers registered later.
+ */
+export const createTerminalErrorHandler = (logger: Logger): ErrorRequestHandler => {
+	return (err, req, res, next) => {
+		// A failure after the response started is not ours to rewrite; handing
+		// it back lets Express close the connection.
+		if (res.headersSent) {
+			next(err);
+			return;
+		}
+		const status = (err as { status?: unknown; statusCode?: unknown } | null) ?? {};
+		const httpStatus =
+			typeof status.status === "number"
+				? status.status
+				: typeof status.statusCode === "number"
+					? status.statusCode
+					: undefined;
+		if (httpStatus !== undefined && httpStatus >= 400 && httpStatus < 500) {
+			const description = httpStatus === 413 ? "request body too large" : "malformed request body";
+			res.status(httpStatus).json(errorEnvelope("invalid_request", description));
+			return;
+		}
+		logger.error({ err, endpoint: req.path }, "unhandled_request_error");
+		res.status(500).json(errorEnvelope("server_error", "Internal server error"));
+	};
+};

package/templates/standalone/tests/index.test.js

@@ -29,6 +29,23 @@ const client = axios.create({
 
 const _extractCookies = (res) => (res.headers["set-cookie"] ?? []).join("; ");
 
+/**
+ * The server's own origin, as a browser would report it.
+ *
+ * Since #272 `POST /session/login` and `POST /session/logout` reject a request
+ * that carries neither a same-origin `Origin`/`Referer` nor a valid
+ * double-submit CSRF token. A browser sets `Origin` on its own; a scripted
+ * client like this one has to say it.
+ */
+const SERVER_ORIGIN = new URL(BASE_URL).origin;
+
+/** POST to a state-changing session route the way a same-origin browser would. */
+const sessionPost = (path, data, config = {}) =>
+	client.post(path, data, {
+		...config,
+		headers: { Origin: SERVER_ORIGIN, ...(config.headers ?? {}) },
+	});
+
 describe("POST /oauth/introspect", () => {
 	// Helper: self-introspect sends the token as both Bearer credential and body parameter
 	const selfIntrospect = (token, contentType = "application/json") => {
@@ -109,12 +126,12 @@ describe("POST /oauth/introspect", () => {
 
 describe("POST /session/login", () => {
 	it("returns 400 when no credentials are provided", async () => {
-		const res = await client.post("/session/login", {});
+		const res = await sessionPost("/session/login", {});
 		expect(res.status).toBe(400);
 	});
 
 	it("returns 400 when redirect_to has an invalid scheme", async () => {
-		const res = await client.post("/session/login", {
+		const res = await sessionPost("/session/login", {
 			username: "testuser",
 			password: "testpass",
 			redirect_to: "javascript:alert(1)",
@@ -124,7 +141,7 @@ describe("POST /session/login", () => {
 	});
 
 	it("returns 400 when redirect_to is not a valid URL", async () => {
-		const res = await client.post("/session/login", {
+		const res = await sessionPost("/session/login", {
 			username: "testuser",
 			password: "testpass",
 			redirect_to: "not-a-url",
@@ -134,7 +151,7 @@ describe("POST /session/login", () => {
 	});
 
 	it("returns 400 when redirect_to exceeds 2048 characters", async () => {
-		const res = await client.post("/session/login", {
+		const res = await sessionPost("/session/login", {
 			username: "testuser",
 			password: "testpass",
 			redirect_to: `https://example.com/${"a".repeat(2048)}`,
@@ -147,7 +164,7 @@ describe("POST /session/login", () => {
 		// redirect_to validation runs before authentication, so even with
 		// invalid credentials, a valid redirect_to should not cause a 400
 		// with error: "invalid_redirect". It should fail with 401 (auth failure).
-		const res = await client.post("/session/login", {
+		const res = await sessionPost("/session/login", {
 			username: "testuser",
 			password: "testpass",
 			redirect_to: "http://localhost:3000/oauth/authorize",
@@ -157,6 +174,53 @@ describe("POST /session/login", () => {
 	});
 });
 
+describe("CSRF on the state-changing session routes (#272)", () => {
+	it("rejects a login carrying neither an origin signal nor a token", async () => {
+		// The bypass this replaced: omitting `Origin` skipped the check entirely.
+		const res = await client.post("/session/login", {
+			username: "testuser",
+			password: "testpass",
+		});
+		expect(res.status).toBe(403);
+		expect(res.data.error).toBe("access_denied");
+	});
+
+	it("rejects a logout carrying neither an origin signal nor a token", async () => {
+		const res = await client.post("/session/logout", {});
+		expect(res.status).toBe(403);
+		expect(res.data.error).toBe("access_denied");
+	});
+
+	it("rejects a login from a foreign origin", async () => {
+		const res = await client.post(
+			"/session/login",
+			{ username: "testuser", password: "testpass" },
+			{ headers: { Origin: "https://evil.example.com" } },
+		);
+		expect(res.status).toBe(403);
+	});
+
+	it("accepts a header-less client that presents a token from GET /session/csrf", async () => {
+		const issued = await client.get("/session/csrf");
+		expect(issued.status).toBe(200);
+		expect(typeof issued.data.csrf_token).toBe("string");
+
+		const res = await client.post(
+			"/session/login",
+			{ username: "testuser", password: "testpass" },
+			{
+				headers: {
+					Cookie: _extractCookies(issued).split(";")[0],
+					[issued.data.header_name]: issued.data.csrf_token,
+				},
+			},
+		);
+		// Credentials are still wrong in this environment — the point is that the
+		// request got past the CSRF guard rather than stopping at 403.
+		expect(res.status).not.toBe(403);
+	});
+});
+
 describe("POST /oauth/token", () => {
 	it("returns 401 for grant_type=session without an authenticated session", async () => {
 		const res = await client.post("/oauth/token", "grant_type=session", {

package/templates/standalone/tsconfig.json

@@ -1,6 +1,14 @@
 {
 	"compilerOptions": {
-		"target": "esnext",
+		// `es2023` target (NOT esnext) with `lib: esnext` — mirrors the monorepo's
+		// tsconfig.base.json. This template is copied verbatim into scaffolded
+		// consumer projects (so it must stay self-contained and cannot `extends`
+		// ../../tsconfig.base.json). Capping the emit target at ES2023 — the newest
+		// edition Node 22 (this template's engine floor) parses natively — makes tsc
+		// downlevel any newer syntax (e.g. `await using`) into helpers, so the built
+		// server actually runs on the Node it advertises. Do NOT raise to `esnext`
+		// without also raising the engine floor.
+		"target": "es2023",
 		"lib": ["esnext"],
 		"module": "nodenext",
 		"moduleResolution": "nodenext",

package/templates/standalone/vitest.config.mts

@@ -3,5 +3,13 @@ import { defineConfig } from "vitest/config";
 export default defineConfig({
 	test: {
 		include: ["src/**/__tests__/**/*.test.mts"],
+		// #357: the workspace-wide deadline floor, repeated as literals rather
+		// than imported from vitest.shared.mts — this template is copied
+		// verbatim into scaffolded projects, where that file does not exist.
+		// Rationale lives there: under a loaded parallel run, transform+import
+		// alone can exceed vitest's 5s default, and a real hang still fails at
+		// 20s.
+		testTimeout: 20_000,
+		hookTimeout: 20_000,
 	},
 });

package/templates/versions.json

@@ -1,13 +1,14 @@
 {
-	"@o3co/auth-provider-core": "0.9.0",
-	"@o3co/auth-provider-dpop": "0.9.0",
-	"@o3co/auth-provider-mtls": "0.9.0",
-	"@o3co/auth-provider-federation-google": "0.9.0",
-	"@o3co/auth-provider-federation-github": "0.9.0",
-	"@o3co/auth-provider-oauth": "0.9.0",
-	"@o3co/auth-provider-oauth-token-exchange": "0.9.0",
-	"@o3co/auth-provider-session": "0.9.0",
-	"@o3co/auth-provider-foundation": "0.9.0",
-	"@o3co/auth-provider-redis": "0.9.0",
-	"@o3co/auth-provider-webauthn": "0.9.0"
+	"@o3co/auth-provider-core": "0.11.0",
+	"@o3co/auth-provider-device-grant": "0.11.0",
+	"@o3co/auth-provider-dpop": "0.11.0",
+	"@o3co/auth-provider-mtls": "0.11.0",
+	"@o3co/auth-provider-federation-google": "0.11.0",
+	"@o3co/auth-provider-federation-github": "0.11.0",
+	"@o3co/auth-provider-oauth": "0.11.0",
+	"@o3co/auth-provider-oauth-token-exchange": "0.11.0",
+	"@o3co/auth-provider-session": "0.11.0",
+	"@o3co/auth-provider-foundation": "0.11.0",
+	"@o3co/auth-provider-redis": "0.11.0",
+	"@o3co/auth-provider-webauthn": "0.11.0"
 }