@oxyhq/core 3.10.0 → 3.10.1

package/src/mixins/__tests__/serviceAuth.test.ts

@@ -672,9 +672,9 @@ describe('requireScope() middleware', () => {
     expect(res.headersSent).toBe(false);
   });
 
-  it('allows requests where the delegation grant carries the required scope', () => {
+  it('allows delegated requests only when both app and delegation carry the required scope', () => {
     const req = makeReq();
-    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: [] };
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['user:read'] };
     req.serviceActingAs = { userId: 'u-1', scopes: ['user:read'] };
     const res = makeRes();
     const next = jest.fn();
@@ -684,6 +684,34 @@ describe('requireScope() middleware', () => {
     expect(next).toHaveBeenCalledTimes(1);
   });
 
+  it('rejects delegated requests when only the app carries the required scope', () => {
+    const req = makeReq();
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['files:write'] };
+    req.serviceActingAs = { userId: 'u-1', scopes: ['profile:read'] };
+    const res = makeRes();
+    const next = jest.fn();
+
+    oxy.requireScope('files:write')(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+    expect(res.body).toMatchObject({ code: 'INSUFFICIENT_SCOPE' });
+  });
+
+  it('rejects delegated requests when only the delegation carries the required scope', () => {
+    const req = makeReq();
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['profile:read'] };
+    req.serviceActingAs = { userId: 'u-1', scopes: ['files:write'] };
+    const res = makeRes();
+    const next = jest.fn();
+
+    oxy.requireScope('files:write')(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+    expect(res.body).toMatchObject({ code: 'INSUFFICIENT_SCOPE' });
+  });
+
   it('rejects requests missing the required scope with 403', () => {
     const req = makeReq();
     req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['user:read'] };

package/src/utils/__tests__/fapiAutoDetect.test.ts

@@ -6,8 +6,8 @@
  * one subdomain over.
  *
  * Ported verbatim from packages/auth-sdk/__tests__/utils/fapiAutoDetect.test.ts
- * plus multi-part-TLD bail-out cases that are unique to the core copy's
- * MULTIPART_TLDS guard.
+ * plus Public Suffix List regression cases that are unique to the core
+ * implementation's registrable-apex guard.
  */
 
 import { autoDetectAuthWebUrl, registrableApex } from '../fapiAutoDetect';
@@ -81,13 +81,28 @@ describe('autoDetectAuthWebUrl', () => {
     });
   });
 
-  describe('bails out on multi-part public suffixes (would derive an attacker-registrable apex)', () => {
-    it('does not derive auth.co.uk from a two-label co.uk host', () => {
-      expect(autoDetectAuthWebUrl(loc('foo.co.uk'))).toBeUndefined();
+  describe('uses the Public Suffix List for registrable apex detection', () => {
+    it('derives from the registrable domain under multi-part public suffixes', () => {
+      expect(autoDetectAuthWebUrl(loc('foo.co.uk'))).toBe('https://auth.foo.co.uk');
+      expect(autoDetectAuthWebUrl(loc('shop.com.au'))).toBe('https://auth.shop.com.au');
+      expect(autoDetectAuthWebUrl(loc('shop.victim.com.tr'))).toBe('https://auth.victim.com.tr');
     });
 
-    it('does not derive auth.com.au from a two-label com.au host', () => {
-      expect(autoDetectAuthWebUrl(loc('shop.com.au'))).toBeUndefined();
+    it('derives from the registrable domain under private hosted suffixes', () => {
+      expect(autoDetectAuthWebUrl(loc('honest.github.io'))).toBe('https://auth.honest.github.io');
+      expect(autoDetectAuthWebUrl(loc('app.victim.pages.dev'))).toBe(
+        'https://auth.victim.pages.dev'
+      );
+      expect(autoDetectAuthWebUrl(loc('site.victim.netlify.app'))).toBe(
+        'https://auth.victim.netlify.app'
+      );
+    });
+
+    it('returns undefined for bare public and private suffixes', () => {
+      expect(autoDetectAuthWebUrl(loc('co.uk'))).toBeUndefined();
+      expect(autoDetectAuthWebUrl(loc('github.io'))).toBeUndefined();
+      expect(autoDetectAuthWebUrl(loc('pages.dev'))).toBeUndefined();
+      expect(autoDetectAuthWebUrl(loc('netlify.app'))).toBeUndefined();
     });
   });
 
@@ -105,7 +120,7 @@ describe('autoDetectAuthWebUrl', () => {
       ['[::1]', undefined],
       ['intranet', undefined],
       ['', undefined],
-      ['foo.co.uk', undefined],
+      ['foo.co.uk', 'https://auth.foo.co.uk'],
     ];
     it.each(cases)('autoDetectAuthWebUrl(%s) === %s', (hostname, expected) => {
       const protocol = hostname === 'localhost' || hostname === '[::1]' ? 'http:' : 'https:';
@@ -128,9 +143,23 @@ describe('registrableApex', () => {
     expect(registrableApex('WWW.Mention.EARTH')).toBe('mention.earth');
   });
 
-  it('returns null for a multi-part public suffix (foo.co.uk -> null)', () => {
-    expect(registrableApex('foo.co.uk')).toBeNull();
-    expect(registrableApex('shop.com.au')).toBeNull();
+  it('returns the eTLD+1 for hosts under multi-part public suffixes', () => {
+    expect(registrableApex('foo.co.uk')).toBe('foo.co.uk');
+    expect(registrableApex('www.foo.co.uk')).toBe('foo.co.uk');
+    expect(registrableApex('shop.victim.com.tr')).toBe('victim.com.tr');
+  });
+
+  it('returns the eTLD+1 for hosts under private hosted suffixes', () => {
+    expect(registrableApex('honest.github.io')).toBe('honest.github.io');
+    expect(registrableApex('app.victim.pages.dev')).toBe('victim.pages.dev');
+    expect(registrableApex('site.victim.netlify.app')).toBe('victim.netlify.app');
+  });
+
+  it('returns null for bare public and private suffixes', () => {
+    expect(registrableApex('co.uk')).toBeNull();
+    expect(registrableApex('github.io')).toBeNull();
+    expect(registrableApex('pages.dev')).toBeNull();
+    expect(registrableApex('netlify.app')).toBeNull();
   });
 
   it('returns null for IPv4 literals', () => {

package/src/utils/fapiAutoDetect.ts

@@ -20,10 +20,9 @@
  *   - SSR / non-browser (no `window`).
  *   - `localhost`, `127.0.0.1`, IPv4/IPv6 literals.
  *   - Hostnames with fewer than two labels.
- *   - Hostnames whose trailing two labels form a known multi-part public
- *     suffix (e.g. `co.uk`), where the naive `labels.slice(-2)` apex would be
- *     an attacker-registrable suffix like `auth.co.uk` rather than the real
- *     registrable domain.
+ *   - Hostnames where a registrable domain cannot be determined from the
+ *     Public Suffix List, including private hosted suffixes such as
+ *     `github.io`, `pages.dev`, and `netlify.app`.
  *
  * When the page is already loaded ON the IdP itself (`auth.<anything>`),
  * the helper returns the current origin so the SDK keeps everything
@@ -35,34 +34,11 @@
  * is required for end-to-end FedCM correctness — no per-RP config.
  */
 
-/**
- * Known multi-part public suffixes where the registrable domain is the LAST
- * THREE labels, not two. Deriving an apex from `labels.slice(-2)` against any
- * of these would yield an attacker-registrable suffix (e.g. `auth.co.uk`),
- * so we bail out instead.
- *
- * This is intentionally a small, explicit allow-list rather than the full
- * Public Suffix List — it covers the suffixes the Oxy ecosystem's RPs use.
- * Any multi-part-TLD RP MUST extend this set (or wire in a proper PSL check)
- * before relying on this helper, otherwise auto-detection silently bails to
- * `undefined` and the consumer must pass `authWebUrl` explicitly.
- */
-export const MULTIPART_TLDS: ReadonlySet<string> = new Set([
-  'co.uk',
-  'com.au',
-  'co.jp',
-  'co.nz',
-  'com.br',
-  'co.za',
-  'com.mx',
-  'co.in',
-  'co.kr',
-  'com.sg',
-]);
+import { getDomain } from 'tldts';
 
 /**
- * Compute the bare registrable apex (eTLD+1) of a hostname, guarding against
- * multi-part public suffixes.
+ * Compute the bare registrable apex (eTLD+1) of a hostname using the Public
+ * Suffix List, including private hosted suffixes.
  *
  * This is the pure host-handling kernel shared by {@link autoDetectAuthWebUrl}
  * and the IdP worker — it performs NO protocol handling, NO `auth.` prefixing,
@@ -74,10 +50,7 @@ export const MULTIPART_TLDS: ReadonlySet<string> = new Set([
  *   - IPv4 literals (`192.168.1.10`);
  *   - IPv6 literals or any host carrying a port (`[::1]`, anything with `:`);
  *   - single-label hosts (`intranet`, `localhost`);
- *   - hosts whose trailing two labels form a known multi-part public suffix
- *     (e.g. `foo.co.uk`), where `labels.slice(-2)` would yield an
- *     attacker-registrable suffix (`co.uk`) rather than a real registrable
- *     domain. Such hosts MUST configure `authWebUrl` explicitly.
+ *   - public suffixes without a registrable label (e.g. `co.uk`, `github.io`).
  *
  * @param hostname - A bare hostname (no scheme), e.g. `www.mention.earth`.
  * @returns The eTLD+1 (`mention.earth`), or `null` when undefinable.
@@ -89,11 +62,11 @@ export function registrableApex(hostname: string): string | null {
   // IPv6 literals are bracketed; any remaining ':' implies a port — neither
   // yields a registrable apex.
   if (host.startsWith('[') || host.includes(':')) return null;
-  const labels = host.split('.');
-  if (labels.length < 2) return null;
-  const lastTwo = labels.slice(-2).join('.');
-  if (MULTIPART_TLDS.has(lastTwo)) return null;
-  return lastTwo;
+  // The Public Suffix List (private suffixes included) is the source of truth
+  // for what an attacker can register. A multi-part public suffix like `co.uk`
+  // or a hosted suffix like `github.io` returns no registrable domain, so
+  // deriving `auth.<apex>` against it is impossible — `getDomain` returns null.
+  return getDomain(host, { allowPrivateDomains: true });
 }
 
 export function autoDetectAuthWebUrl(