@oxyhq/core 3.10.0 → 3.11.0

package/src/server/rateLimit.ts

@@ -41,6 +41,9 @@ import type { OxyServices } from '../OxyServices';
 interface OxyAuthedRequest extends Request {
   userId?: string | null;
   user?: { id?: string; _id?: string } | null;
+  sessionId?: string | null;
+  serviceApp?: { appId?: string } | null;
+  serviceActingAs?: { userId?: string } | null;
 }
 
 export interface OxyRateLimitOptions {
@@ -101,12 +104,40 @@ function ipKeyGenerator(ip: string): string {
   return ip.replace(/:/g, '_');
 }
 
-/** Resolve the rate-limit key: per authenticated user, else per (IPv6-safe) IP. */
-function resolveKey(req: OxyAuthedRequest): string {
+/**
+ * Resolve the trusted authenticated rate-limit key.
+ *
+ * `oxy.auth({ optional: true })` preserves legacy non-session user tokens by
+ * decoding their JWT claims locally. Those claims are not cryptographically
+ * verified and therefore MUST NOT influence abuse-control buckets. Only use
+ * identities that came from a server-validated session or a verified service
+ * token/delegation.
+ */
+function resolveTrustedAuthenticatedKey(req: OxyAuthedRequest): string | null {
   const userId = req.userId ?? req.user?.id ?? req.user?._id;
-  if (userId) {
+  if (userId && req.sessionId) {
     return `user:${userId}`;
   }
+
+  const delegatedUserId = req.serviceActingAs?.userId;
+  if (delegatedUserId && req.serviceApp?.appId) {
+    return `user:${delegatedUserId}`;
+  }
+
+  const serviceAppId = req.serviceApp?.appId;
+  if (serviceAppId) {
+    return `service:${serviceAppId}`;
+  }
+
+  return null;
+}
+
+/** Resolve the rate-limit key: per trusted authenticated identity, else per (IPv6-safe) IP. */
+function resolveKey(req: OxyAuthedRequest): string {
+  const authenticatedKey = resolveTrustedAuthenticatedKey(req);
+  if (authenticatedKey) {
+    return authenticatedKey;
+  }
   const ip = req.ip || req.socket.remoteAddress || 'unknown';
   return ipKeyGenerator(ip);
 }
@@ -139,9 +170,9 @@ export function createOxyRateLimit(
     windowMs,
     ...(store ? { store } : {}),
     max: (req: Request): number => {
-      const authed = req as OxyAuthedRequest;
-      const userId = authed.userId ?? authed.user?.id ?? authed.user?._id;
-      return userId ? authenticatedMax : anonymousMax;
+      return resolveTrustedAuthenticatedKey(req as OxyAuthedRequest)
+        ? authenticatedMax
+        : anonymousMax;
     },
     keyGenerator: (req: Request): string => resolveKey(req as OxyAuthedRequest),
     message,
@@ -160,8 +191,8 @@ export function createOxyRateLimit(
     resolveSession(req, res, (err?: unknown) => {
       if (err) {
         // Optional auth never rejects; a token error just means "anonymous".
-        // Swallow the error and continue to limit as anonymous.
-        next();
+        // Swallow the error and continue through the anonymous limiter.
+        limiter(req, res, next);
         return;
       }
       limiter(req, res, next);

package/src/utils/__tests__/consumeSsoReturn.test.ts

@@ -218,7 +218,7 @@ describe('consumeSsoReturn', () => {
     });
 
     expect(result).toEqual(SESSION);
-    expect(oxy.exchangeSsoCode).toHaveBeenCalledWith('opaque-code');
+    expect(oxy.exchangeSsoCode).toHaveBeenCalledWith('opaque-code', 's');
     expect(storage.map.has(ssoStateKey(ORIGIN))).toBe(false);
     expect(storage.map.has(ssoGuardKey(ORIGIN))).toBe(false);
     expect(storage.map.has(ssoNoSessionKey(ORIGIN))).toBe(false);

package/src/utils/__tests__/fapiAutoDetect.test.ts

@@ -6,8 +6,8 @@
  * one subdomain over.
  *
  * Ported verbatim from packages/auth-sdk/__tests__/utils/fapiAutoDetect.test.ts
- * plus multi-part-TLD bail-out cases that are unique to the core copy's
- * MULTIPART_TLDS guard.
+ * plus Public Suffix List regression cases that are unique to the core
+ * implementation's registrable-apex guard.
  */
 
 import { autoDetectAuthWebUrl, registrableApex } from '../fapiAutoDetect';
@@ -81,13 +81,28 @@ describe('autoDetectAuthWebUrl', () => {
     });
   });
 
-  describe('bails out on multi-part public suffixes (would derive an attacker-registrable apex)', () => {
-    it('does not derive auth.co.uk from a two-label co.uk host', () => {
-      expect(autoDetectAuthWebUrl(loc('foo.co.uk'))).toBeUndefined();
+  describe('uses the Public Suffix List for registrable apex detection', () => {
+    it('derives from the registrable domain under multi-part public suffixes', () => {
+      expect(autoDetectAuthWebUrl(loc('foo.co.uk'))).toBe('https://auth.foo.co.uk');
+      expect(autoDetectAuthWebUrl(loc('shop.com.au'))).toBe('https://auth.shop.com.au');
+      expect(autoDetectAuthWebUrl(loc('shop.victim.com.tr'))).toBe('https://auth.victim.com.tr');
     });
 
-    it('does not derive auth.com.au from a two-label com.au host', () => {
-      expect(autoDetectAuthWebUrl(loc('shop.com.au'))).toBeUndefined();
+    it('derives from the registrable domain under private hosted suffixes', () => {
+      expect(autoDetectAuthWebUrl(loc('honest.github.io'))).toBe('https://auth.honest.github.io');
+      expect(autoDetectAuthWebUrl(loc('app.victim.pages.dev'))).toBe(
+        'https://auth.victim.pages.dev'
+      );
+      expect(autoDetectAuthWebUrl(loc('site.victim.netlify.app'))).toBe(
+        'https://auth.victim.netlify.app'
+      );
+    });
+
+    it('returns undefined for bare public and private suffixes', () => {
+      expect(autoDetectAuthWebUrl(loc('co.uk'))).toBeUndefined();
+      expect(autoDetectAuthWebUrl(loc('github.io'))).toBeUndefined();
+      expect(autoDetectAuthWebUrl(loc('pages.dev'))).toBeUndefined();
+      expect(autoDetectAuthWebUrl(loc('netlify.app'))).toBeUndefined();
     });
   });
 
@@ -105,7 +120,7 @@ describe('autoDetectAuthWebUrl', () => {
       ['[::1]', undefined],
       ['intranet', undefined],
       ['', undefined],
-      ['foo.co.uk', undefined],
+      ['foo.co.uk', 'https://auth.foo.co.uk'],
     ];
     it.each(cases)('autoDetectAuthWebUrl(%s) === %s', (hostname, expected) => {
       const protocol = hostname === 'localhost' || hostname === '[::1]' ? 'http:' : 'https:';
@@ -128,9 +143,23 @@ describe('registrableApex', () => {
     expect(registrableApex('WWW.Mention.EARTH')).toBe('mention.earth');
   });
 
-  it('returns null for a multi-part public suffix (foo.co.uk -> null)', () => {
-    expect(registrableApex('foo.co.uk')).toBeNull();
-    expect(registrableApex('shop.com.au')).toBeNull();
+  it('returns the eTLD+1 for hosts under multi-part public suffixes', () => {
+    expect(registrableApex('foo.co.uk')).toBe('foo.co.uk');
+    expect(registrableApex('www.foo.co.uk')).toBe('foo.co.uk');
+    expect(registrableApex('shop.victim.com.tr')).toBe('victim.com.tr');
+  });
+
+  it('returns the eTLD+1 for hosts under private hosted suffixes', () => {
+    expect(registrableApex('honest.github.io')).toBe('honest.github.io');
+    expect(registrableApex('app.victim.pages.dev')).toBe('victim.pages.dev');
+    expect(registrableApex('site.victim.netlify.app')).toBe('victim.netlify.app');
+  });
+
+  it('returns null for bare public and private suffixes', () => {
+    expect(registrableApex('co.uk')).toBeNull();
+    expect(registrableApex('github.io')).toBeNull();
+    expect(registrableApex('pages.dev')).toBeNull();
+    expect(registrableApex('netlify.app')).toBeNull();
   });
 
   it('returns null for IPv4 literals', () => {

package/src/utils/__tests__/ssoReturn.test.ts

@@ -188,7 +188,7 @@ describe('consumeSsoReturn pre-hydration callback bootstrap', () => {
     );
 
     expect(session).toBe(exchangedSession);
-    expect(exchangeSsoCode).toHaveBeenCalledWith('opaque-code');
+    expect(exchangeSsoCode).toHaveBeenCalledWith('opaque-code', 'state-ok');
     expect(replaceStateCalls).toEqual(['/', '/explore?tab=home#top']);
     expect(dispatchPopState).toHaveBeenCalledTimes(1);
     expect(hardRedirect).not.toHaveBeenCalled();

package/src/utils/fapiAutoDetect.ts

@@ -20,10 +20,9 @@
  *   - SSR / non-browser (no `window`).
  *   - `localhost`, `127.0.0.1`, IPv4/IPv6 literals.
  *   - Hostnames with fewer than two labels.
- *   - Hostnames whose trailing two labels form a known multi-part public
- *     suffix (e.g. `co.uk`), where the naive `labels.slice(-2)` apex would be
- *     an attacker-registrable suffix like `auth.co.uk` rather than the real
- *     registrable domain.
+ *   - Hostnames where a registrable domain cannot be determined from the
+ *     Public Suffix List, including private hosted suffixes such as
+ *     `github.io`, `pages.dev`, and `netlify.app`.
  *
  * When the page is already loaded ON the IdP itself (`auth.<anything>`),
  * the helper returns the current origin so the SDK keeps everything
@@ -35,34 +34,11 @@
  * is required for end-to-end FedCM correctness — no per-RP config.
  */
 
-/**
- * Known multi-part public suffixes where the registrable domain is the LAST
- * THREE labels, not two. Deriving an apex from `labels.slice(-2)` against any
- * of these would yield an attacker-registrable suffix (e.g. `auth.co.uk`),
- * so we bail out instead.
- *
- * This is intentionally a small, explicit allow-list rather than the full
- * Public Suffix List — it covers the suffixes the Oxy ecosystem's RPs use.
- * Any multi-part-TLD RP MUST extend this set (or wire in a proper PSL check)
- * before relying on this helper, otherwise auto-detection silently bails to
- * `undefined` and the consumer must pass `authWebUrl` explicitly.
- */
-export const MULTIPART_TLDS: ReadonlySet<string> = new Set([
-  'co.uk',
-  'com.au',
-  'co.jp',
-  'co.nz',
-  'com.br',
-  'co.za',
-  'com.mx',
-  'co.in',
-  'co.kr',
-  'com.sg',
-]);
+import { getDomain } from 'tldts';
 
 /**
- * Compute the bare registrable apex (eTLD+1) of a hostname, guarding against
- * multi-part public suffixes.
+ * Compute the bare registrable apex (eTLD+1) of a hostname using the Public
+ * Suffix List, including private hosted suffixes.
  *
  * This is the pure host-handling kernel shared by {@link autoDetectAuthWebUrl}
  * and the IdP worker — it performs NO protocol handling, NO `auth.` prefixing,
@@ -74,10 +50,7 @@ export const MULTIPART_TLDS: ReadonlySet<string> = new Set([
  *   - IPv4 literals (`192.168.1.10`);
  *   - IPv6 literals or any host carrying a port (`[::1]`, anything with `:`);
  *   - single-label hosts (`intranet`, `localhost`);
- *   - hosts whose trailing two labels form a known multi-part public suffix
- *     (e.g. `foo.co.uk`), where `labels.slice(-2)` would yield an
- *     attacker-registrable suffix (`co.uk`) rather than a real registrable
- *     domain. Such hosts MUST configure `authWebUrl` explicitly.
+ *   - public suffixes without a registrable label (e.g. `co.uk`, `github.io`).
  *
  * @param hostname - A bare hostname (no scheme), e.g. `www.mention.earth`.
  * @returns The eTLD+1 (`mention.earth`), or `null` when undefinable.
@@ -89,11 +62,11 @@ export function registrableApex(hostname: string): string | null {
   // IPv6 literals are bracketed; any remaining ':' implies a port — neither
   // yields a registrable apex.
   if (host.startsWith('[') || host.includes(':')) return null;
-  const labels = host.split('.');
-  if (labels.length < 2) return null;
-  const lastTwo = labels.slice(-2).join('.');
-  if (MULTIPART_TLDS.has(lastTwo)) return null;
-  return lastTwo;
+  // The Public Suffix List (private suffixes included) is the source of truth
+  // for what an attacker can register. A multi-part public suffix like `co.uk`
+  // or a hosted suffix like `github.io` returns no registrable domain, so
+  // deriving `auth.<apex>` against it is impossible — `getDomain` returns null.
+  return getDomain(host, { allowPrivateDomains: true });
 }
 
 export function autoDetectAuthWebUrl(

package/src/utils/ssoReturn.ts

@@ -202,7 +202,7 @@ export interface ConsumeSsoReturnDeps {
  * @returns The exchanged session on success, otherwise `null`.
  */
 export async function consumeSsoReturn(
-  oxy: { exchangeSsoCode: (code: string) => Promise<SessionLoginResponse> },
+  oxy: { exchangeSsoCode: (code: string, state?: string) => Promise<SessionLoginResponse> },
   deps: ConsumeSsoReturnDeps = {},
 ): Promise<SessionLoginResponse | null> {
   const isWeb =
@@ -344,7 +344,7 @@ export async function consumeSsoReturn(
 
   let session: SessionLoginResponse | undefined;
   try {
-    session = await oxy.exchangeSsoCode(ret.code);
+    session = await oxy.exchangeSsoCode(ret.code, ret.state);
   } catch (error) {
     onExchangeError?.(error);
     markNoSession();