@owlmeans/server-auth 0.1.18-rc.51 → 0.1.18-rc.53

package/src/manager/rely.ts

@@ -1,18 +1,15 @@
 import { assertContext, createService } from '@owlmeans/context'
 import { DEFAULT_RELY } from './consts.js'
 import type { AppContext, RelyService } from './types.js'
-import { AUTH_QUERY, AuthenFailed, AuthenticationType } from '@owlmeans/auth'
-import type { Auth, AuthCredentials, AuthToken } from '@owlmeans/auth'
+import { AUTH_QUERY, AuthenFailed, AuthenticationType, type Auth, type AuthCredentials, type AuthToken } from '@owlmeans/auth'
 import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
-import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js'
 import type { AuthSpent } from '../types.js'
 import type { Resource } from '@owlmeans/resource'
 import { trusted } from './utils/trusted.js'
+import type { Config, Context } from './types.local.js'
 
-type Config = ServerConfig
-type Context = ServerContext<Config>
 
 export const createRelyService = (alias: string = DEFAULT_RELY): RelyService => {
   const _keyPair = async (context: Context) => {

package/src/manager/supervisor.ts

@@ -1,56 +1,9 @@
 import { AuthenticationType } from '@owlmeans/auth'
-import type { AuthPayload } from '@owlmeans/auth'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
-import type { AppConfig, AppContext } from './types.js'
+import type { AppConfig, AppContext, SupervisorAuthOptions, SupervisorPluginOptions } from './types.js'
 import { registerPlugin } from './plugins/index.js'
 import { makeSupervisorPlugin } from './plugins/supervisor.js'
-
-/**
- * What a `SupervisorUserResolver` returns: the identity the supervisor-minted
- * token will represent. Only `userId` is required - the rest default sensibly.
- */
-export interface SupervisorUserResolution extends Partial<Pick<AuthPayload,
-  'profileId' | 'entitySlug' | 'role' | 'scopes'>> {
-  userId: string
-}
-
-/**
- * Find-or-create the target identity for a supervisor login. `register` reflects
- * `allowRegistration`; when false the resolver should only look existing users up.
- * Wire this to the project's identity store (e.g. `@owlmeans/server-auth-identity`).
- */
-export interface SupervisorUserResolver {
-  <C extends AppConfig, T extends AppContext<C>>(
-    userId: string, context: T, opts: { register: boolean }
-  ): Promise<SupervisorUserResolution>
-}
-
-/** Resolved options handed to the plugin factory. */
-export interface SupervisorPluginOptions {
-  supervisors: string[]
-  allowRegistration: boolean
-  resolveUser?: SupervisorUserResolver
-}
-
-export interface SupervisorAuthOptions {
-  /** Trusted-record aliases authorized to act as supervisor. Default: master + superuser. */
-  supervisors?: string[]
-  /** Find-or-create the target user by id/email. Default: trust the id as-is. */
-  resolveUser?: SupervisorUserResolver
-  /** Allow minting a token for an unknown user (registration). Default: true. */
-  allowRegistration?: boolean
-  /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
-  enabled?: boolean
-  /**
-   * Also accept internal owlmeans `Ed25519BasicToken`s even when another guard
-   * (e.g. OIDC) is the primary guard on protected entrypoints. Default: true.
-   */
-  acceptInternalTokens?: boolean
-  /** The internal-token guard to add as a coguard. Default: DEFAULT_GUARD ('auth'). */
-  guard?: string
-}
-
-const DEFAULT_SUPERVISORS = ['master', 'superuser']
+import { DEFAULT_SUPERVISORS } from './consts.local.js'
 
 const isDevelopment = (context: { cfg: { debug?: { all?: boolean, supervisor?: boolean } } }): boolean =>
   context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true

package/src/manager/types.local.ts

@@ -0,0 +1,5 @@
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+
+export type Config = ServerConfig
+
+export type Context = ServerContext<Config>

package/src/manager/types.ts

@@ -1,4 +1,4 @@
-import type { AllowanceRequest, AllowanceResponse, Auth, AuthCredentials, AuthToken, RelyToken } from '@owlmeans/auth'
+import type { AllowanceRequest, AllowanceResponse, Auth, AuthCredentials, AuthToken, RelyToken, AuthPayload } from '@owlmeans/auth'
 import type { KlusterConfig } from '@owlmeans/kluster'
 import type { GuardService } from '@owlmeans/entrypoint'
 import type { ApiServerAppend } from '@owlmeans/server-api'
@@ -40,3 +40,48 @@ export interface RelyCarrier {
   source: RelyToken,
   rely: RelyToken
 }
+
+/**
+ * What a `SupervisorUserResolver` returns: the identity the supervisor-minted
+ * token will represent. Only `userId` is required - the rest default sensibly.
+ */
+export interface SupervisorUserResolution extends Partial<Pick<AuthPayload,
+  'profileId' | 'entitySlug' | 'role' | 'scopes'>> {
+  userId: string
+}
+
+/**
+ * Find-or-create the target identity for a supervisor login. `register` reflects
+ * `allowRegistration`; when false the resolver should only look existing users up.
+ * Wire this to the project's identity store (e.g. `@owlmeans/server-auth-identity`).
+ */
+export interface SupervisorUserResolver {
+  <C extends AppConfig, T extends AppContext<C>>(
+    userId: string, context: T, opts: { register: boolean }
+  ): Promise<SupervisorUserResolution>
+}
+
+/** Resolved options handed to the plugin factory. */
+export interface SupervisorPluginOptions {
+  supervisors: string[]
+  allowRegistration: boolean
+  resolveUser?: SupervisorUserResolver
+}
+
+export interface SupervisorAuthOptions {
+  /** Trusted-record aliases authorized to act as supervisor. Default: master + superuser. */
+  supervisors?: string[]
+  /** Find-or-create the target user by id/email. Default: trust the id as-is. */
+  resolveUser?: SupervisorUserResolver
+  /** Allow minting a token for an unknown user (registration). Default: true. */
+  allowRegistration?: boolean
+  /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
+  enabled?: boolean
+  /**
+   * Also accept internal owlmeans `Ed25519BasicToken`s even when another guard
+   * (e.g. OIDC) is the primary guard on protected entrypoints. Default: true.
+   */
+  acceptInternalTokens?: boolean
+  /** The internal-token guard to add as a coguard. Default: DEFAULT_GUARD ('auth'). */
+  guard?: string
+}

package/src/service.ts

@@ -1,28 +1,34 @@
-import type { ServerContext, ServerConfig } from '@owlmeans/server-context'
+import type { ServerContext } from '@owlmeans/server-context'
 import { TRUSTED } from '@owlmeans/config'
 import { AUTH_CACHE, AUTH_SRV_KEY, AUTHEN_TIMEFRAME, DEFAULT_ALIAS } from './consts.js'
 import type { AuthServiceAppend, AuthService, AuthSpent } from './types.js'
 import { assertContext, createService } from '@owlmeans/context'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
-import type { Auth, AuthCredentials } from '@owlmeans/auth'
-import { AuthenFailed, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth'
+import { type Auth, type AuthCredentials, AuthenFailed, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth'
 import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'
 import type { Resource } from '@owlmeans/resource'
 import { createStaticResource } from '@owlmeans/static-resource'
 import { trust, extractAuthToken } from '@owlmeans/auth-common/utils'
-import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
-import type { EntityResolverService } from '@owlmeans/auth-common'
-import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
-import type { IdentityProfile, IdentityProfileResource } from '@owlmeans/server-auth-identity'
-import {
-  appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL
-} from '@owlmeans/server-auth-session'
-import type { AuthSessionManager } from '@owlmeans/server-auth-session'
+import { ENTITY_RESOLVER, type EntityResolverService, TOKEN_UPDATE } from '@owlmeans/auth-common'
+import { AUTH_IDENTITY_PROFILE, type IdentityProfile, type IdentityProfileResource } from '@owlmeans/server-auth-identity'
+import { appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL, type AuthSessionManager } from '@owlmeans/server-auth-session'
 import { uuid } from '@owlmeans/basic-ids'
-import { TOKEN_UPDATE } from '@owlmeans/auth-common'
+import { logger } from '@owlmeans/log'
+import type { Config, Context } from './types.local.js'
 
-type Config = ServerConfig
-type Context = ServerContext<Config>
+
+const log = logger('server-auth')
+
+/**
+ * A refused token exchange — the manager's token presented to open a session. Logged with the
+ * reason and the account id only; returns the error for the caller to throw.
+ */
+const refuse = (reason: string, error: AuthenFailed, userId?: string): AuthenFailed => {
+  const accountId = userId == null ? undefined
+    : userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId
+  log.warn('Session exchange refused', { reason, ...(accountId != null ? { accountId } : {}) }, { event: 'auth.refused' })
+  return error
+}
 
 export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
   const location = `server-auth:${alias}`
@@ -152,7 +158,7 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
 
       const authService = await trust<Config, Context>(context, TRUSTED, AUTH_SRV_KEY)
       if (!await envelope.verify(authService.key)) {
-        throw new AuthenFailed()
+        throw refuse('signature', new AuthenFailed())
       }
 
       const credentials = envelope.message()
@@ -163,11 +169,11 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
       try {
         await cache(context).create({ id: msg }, { ttl: AUTHEN_TIMEFRAME / 1000 })
       } catch {
-        throw new AuthenFailed()
+        throw refuse('replay', new AuthenFailed(), credentials.userId)
       }
 
       if (credentials.credential !== authService.user.id) {
-        throw new AuthenFailed()
+        throw refuse('issuer', new AuthenFailed(), credentials.userId)
       }
 
       // @TODO Move to a plugin
@@ -191,12 +197,12 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
       const manager = sessions(context)
       if (manager != null) {
         const entityId = await entityIdFor(context, auth.entitySlug)
-        if (entityId == null || auth.profileId == null) throw new AuthenFailed('session')
+        if (entityId == null || auth.profileId == null) throw refuse('session', new AuthenFailed('session'), auth.userId)
         const decision = await manager.register({
           id: auth.sessionId!, kind: 'bearer', entityId, profileId: auth.profileId,
           issuedAt, expiresAt: expiresAt.getTime()
         })
-        if (decision.state !== 'active') throw new AuthenFailed('session')
+        if (decision.state !== 'active') throw refuse('session', new AuthenFailed('session'), auth.userId)
         auth.authorizationVersion = decision.version
       }
 

package/src/types.local.ts

@@ -0,0 +1,5 @@
+import type { ServerContext, ServerConfig } from '@owlmeans/server-context'
+
+export type Config = ServerConfig
+
+export type Context = ServerContext<Config>