@oxyhq/core 3.10.0 → 3.11.0

package/dist/esm/mixins/OxyServices.utility.js

@@ -688,33 +688,45 @@ export function OxyServicesUtilityMixin(Base) {
                         }
                         return next(new Error('Invalid token'));
                     }
-                    const userId = decoded.userId || decoded.id;
-                    if (!userId) {
+                    const claimedUserId = decoded.userId || decoded.id;
+                    if (!claimedUserId) {
                         return next(new Error('Invalid token payload'));
                     }
                     // Check expiration — reject tokens at exact expiry second (use <=)
                     if (decoded.exp && decoded.exp <= Math.floor(Date.now() / 1000)) {
                         return next(new Error('Token expired'));
                     }
-                    // Validate session if available
-                    if (decoded.sessionId) {
-                        try {
-                            const result = await oxyInstance.validateSession(decoded.sessionId, {
-                                useHeaderValidation: true,
-                            });
-                            if (!result || !result.valid) {
-                                return next(new Error('Session invalid'));
-                            }
+                    // A server-validated session is mandatory. A bare decoded JWT proves
+                    // nothing — the signature is not verified here, so without a session
+                    // round-trip a forged token could claim any user id.
+                    if (!decoded.sessionId) {
+                        return next(new Error('Session required'));
+                    }
+                    let userId = claimedUserId;
+                    try {
+                        const result = await oxyInstance.validateSession(decoded.sessionId, {
+                            useHeaderValidation: true,
+                        });
+                        if (!result || !result.valid || !result.user) {
+                            return next(new Error('Session invalid'));
                         }
-                        catch (validateErr) {
-                            if (debug) {
-                                logger.debug('[oxy.authSocket] Session validation failed', {
-                                    component: 'auth',
-                                    method: 'authSocket',
-                                }, validateErr);
-                            }
-                            return next(new Error('Session validation failed'));
+                        // The session is the source of truth. The client-claimed user id
+                        // must match the server-validated identity, otherwise a valid
+                        // session could be paired with a forged user id.
+                        const validatedUserId = getUserIdentityId(result.user);
+                        if (!validatedUserId || validatedUserId !== claimedUserId) {
+                            return next(new Error('Session user mismatch'));
                         }
+                        userId = validatedUserId;
+                    }
+                    catch (validateErr) {
+                        if (debug) {
+                            logger.debug('[oxy.authSocket] Session validation failed', {
+                                component: 'auth',
+                                method: 'authSocket',
+                            }, validateErr);
+                        }
+                        return next(new Error('Session validation failed'));
                     }
                     // Attach user data to socket. We expose BOTH `socket.data.userId`
                     // (the official Socket.IO data slot) and `socket.user` because
@@ -779,9 +791,9 @@ export function OxyServicesUtilityMixin(Base) {
          * Express.js middleware that enforces a specific service-token scope.
          *
          * Mount AFTER `auth()` / `serviceAuth()` — relies on `req.serviceApp` and
-         * (when delegation is in effect) `req.serviceActingAs.scopes`. The scope
-         * is granted if EITHER list contains it, mirroring the OAuth2 model where
-         * the app's app-level scopes and the per-user delegated scopes both count.
+         * (when delegation is in effect) `req.serviceActingAs.scopes`. App-only
+         * service requests require the app scope. Delegated user requests require
+         * BOTH the app scope and the per-user delegation scope.
          *
          * Requests authenticated as a regular user (no service token) are rejected
          * with 403 — scope-protected endpoints are service-to-service by design.
@@ -811,7 +823,12 @@ export function OxyServicesUtilityMixin(Base) {
                     });
                     return;
                 }
-                if (appScopes.includes(scope) || delegatedScopes.includes(scope)) {
+                const appHasScope = appScopes.includes(scope);
+                const delegationHasScope = delegatedScopes.includes(scope);
+                const hasRequiredScope = req.serviceActingAs
+                    ? appHasScope && delegationHasScope
+                    : appHasScope;
+                if (hasRequiredScope) {
                     next();
                     return;
                 }
@@ -869,6 +886,18 @@ async function verifyServiceTokenSignature(token, secret) {
  * access token signed by the same shared secret could be replayed as a
  * service token because no claim binding existed.
  */
+/**
+ * Resolve the canonical user id from a validated session's user object.
+ *
+ * The API serializer emits `id`, but some upstream shapes carry the raw Mongo
+ * `_id` instead. We accept either, but only a non-empty string — anything else
+ * means the validated identity is unusable and the caller must reject.
+ */
+function getUserIdentityId(user) {
+    const candidate = user.id
+        ?? user._id;
+    return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
+}
 function verifyServiceTokenClaims(decoded, expected) {
     if (decoded.type !== 'service') {
         throw new ServiceTokenClaimError(`Service token has unexpected type '${String(decoded.type)}'`);

package/dist/esm/mixins/index.js

@@ -11,6 +11,7 @@ import { OxyServicesSilentAuthMixin } from './OxyServices.silent.js';
 import { OxyServicesRedirectAuthMixin } from './OxyServices.redirect.js';
 import { OxyServicesSsoMixin } from './OxyServices.sso.js';
 import { OxyServicesUserMixin } from './OxyServices.user.js';
+import { OxyServicesIdentityMixin } from './OxyServices.identity.js';
 import { OxyServicesPrivacyMixin } from './OxyServices.privacy.js';
 import { OxyServicesLanguageMixin } from './OxyServices.language.js';
 import { OxyServicesPaymentMixin } from './OxyServices.payment.js';
@@ -54,6 +55,8 @@ const MIXIN_PIPELINE = [
     OxyServicesSsoMixin,
     // User management (requires auth)
     OxyServicesUserMixin,
+    // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping)
+    OxyServicesIdentityMixin,
     OxyServicesPrivacyMixin,
     // Feature mixins
     OxyServicesLanguageMixin,

package/dist/esm/server/cors.js

@@ -11,10 +11,9 @@
  *
  * `createOxyCors` returns a self-contained Express middleware (no `cors`
  * package dependency) that:
- *   - allows the Oxy apex origin family (anything under `*.${CENTRAL_IDP_APEX}`,
- *     i.e. `oxy.so` — covering `auth.oxy.so`, `api.oxy.so`, `accounts.oxy.so`,
- *     `console.oxy.so`, `inbox.oxy.so`, the marketing site, …) reusing the
- *     central-origin constants already in core, NOT a fresh hardcoded list,
+ *   - allows the Oxy apex origin family over HTTPS only: the apex plus
+ *     one-label subdomains such as `auth.oxy.so`, `api.oxy.so`,
+ *     `accounts.oxy.so`, `console.oxy.so`, and `inbox.oxy.so`,
  *   - allows the caller's explicit `appOrigins`,
  *   - DENIES everything else (no reflection, never a wildcard with credentials),
  *   - echoes back the EXACT matched origin (so credentialed requests work) and
@@ -24,7 +23,6 @@
  * Node/Express-only: exported solely from `@oxyhq/core/server`.
  */
 import { CENTRAL_IDP_APEX } from '../utils/authWebUrl.js';
-import { registrableApex } from '../utils/fapiAutoDetect.js';
 /** Default HTTP methods allowed across origins. */
 const DEFAULT_ALLOWED_METHODS = ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE', 'OPTIONS'];
 /** Default request headers a browser may send on a credentialed cross-origin call. */
@@ -38,29 +36,30 @@ const DEFAULT_ALLOWED_HEADERS = [
 ];
 /** How long (seconds) a browser may cache a successful preflight. */
 const DEFAULT_MAX_AGE_SECONDS = 86400;
+const OXY_ONE_LABEL_SUBDOMAIN_PATTERN = new RegExp(`^[a-z0-9-]+\\.${CENTRAL_IDP_APEX.replace('.', '\\.')}$`);
 /**
- * Whether `candidate` belongs to the Oxy apex origin family — i.e. its
- * registrable apex equals {@link CENTRAL_IDP_APEX} (`oxy.so`). This matches the
- * apex itself (`https://oxy.so`) and any subdomain (`https://auth.oxy.so`,
- * `https://api.oxy.so`, …) over http or https, ports allowed. Returns false on
- * any parse failure (fail closed).
+ * Whether `candidate` belongs to the built-in Oxy apex origin family. This
+ * intentionally mirrors the API allowlist shape: HTTPS only, no custom port,
+ * the apex itself (`https://oxy.so`), or exactly one lowercase subdomain label
+ * (`https://auth.oxy.so`, `https://api.oxy.so`, …).
+ *
+ * Arbitrary/multi-level subdomains and `http://*.oxy.so` are not implicitly
+ * trusted for credentialed CORS. If a service needs a non-standard development
+ * or tenant origin, it must opt in explicitly via `appOrigins`.
  */
 function isOxyFamilyOrigin(candidate) {
-    let hostname;
-    let protocol;
     try {
         const url = new URL(candidate);
-        hostname = url.hostname.toLowerCase();
-        protocol = url.protocol;
+        if (url.protocol !== 'https:' || url.port !== '')
+            return false;
+        const hostname = url.hostname;
+        if (hostname === CENTRAL_IDP_APEX)
+            return true;
+        return OXY_ONE_LABEL_SUBDOMAIN_PATTERN.test(hostname);
     }
     catch {
         return false;
     }
-    if (protocol !== 'https:' && protocol !== 'http:')
-        return false;
-    if (hostname === CENTRAL_IDP_APEX)
-        return true;
-    return registrableApex(hostname) === CENTRAL_IDP_APEX;
 }
 /** Normalize a raw origin string to its canonical `scheme://host[:port]` form. */
 function normalizeOrigin(raw) {
@@ -72,8 +71,8 @@ function normalizeOrigin(raw) {
     }
 }
 /**
- * Build the origin-matching predicate: true iff `origin` is in the Oxy apex
- * family OR exactly matches one of the configured app origins.
+ * Build the origin-matching predicate: true iff `origin` is in the built-in
+ * HTTPS Oxy apex family OR exactly matches one of the configured app origins.
  */
 function buildOriginAllowed(appOrigins) {
     const explicit = new Set();

package/dist/esm/server/rateLimit.js

@@ -19,12 +19,36 @@ function isBuiltInExempt(req) {
 function ipKeyGenerator(ip) {
     return ip.replace(/:/g, '_');
 }
-/** Resolve the rate-limit key: per authenticated user, else per (IPv6-safe) IP. */
-function resolveKey(req) {
+/**
+ * Resolve the trusted authenticated rate-limit key.
+ *
+ * `oxy.auth({ optional: true })` preserves legacy non-session user tokens by
+ * decoding their JWT claims locally. Those claims are not cryptographically
+ * verified and therefore MUST NOT influence abuse-control buckets. Only use
+ * identities that came from a server-validated session or a verified service
+ * token/delegation.
+ */
+function resolveTrustedAuthenticatedKey(req) {
     const userId = req.userId ?? req.user?.id ?? req.user?._id;
-    if (userId) {
+    if (userId && req.sessionId) {
         return `user:${userId}`;
     }
+    const delegatedUserId = req.serviceActingAs?.userId;
+    if (delegatedUserId && req.serviceApp?.appId) {
+        return `user:${delegatedUserId}`;
+    }
+    const serviceAppId = req.serviceApp?.appId;
+    if (serviceAppId) {
+        return `service:${serviceAppId}`;
+    }
+    return null;
+}
+/** Resolve the rate-limit key: per trusted authenticated identity, else per (IPv6-safe) IP. */
+function resolveKey(req) {
+    const authenticatedKey = resolveTrustedAuthenticatedKey(req);
+    if (authenticatedKey) {
+        return authenticatedKey;
+    }
     const ip = req.ip || req.socket.remoteAddress || 'unknown';
     return ipKeyGenerator(ip);
 }
@@ -41,9 +65,9 @@ export function createOxyRateLimit(oxy, options = {}) {
         windowMs,
         ...(store ? { store } : {}),
         max: (req) => {
-            const authed = req;
-            const userId = authed.userId ?? authed.user?.id ?? authed.user?._id;
-            return userId ? authenticatedMax : anonymousMax;
+            return resolveTrustedAuthenticatedKey(req)
+                ? authenticatedMax
+                : anonymousMax;
         },
         keyGenerator: (req) => resolveKey(req),
         message,
@@ -61,8 +85,8 @@ export function createOxyRateLimit(oxy, options = {}) {
         resolveSession(req, res, (err) => {
             if (err) {
                 // Optional auth never rejects; a token error just means "anonymous".
-                // Swallow the error and continue to limit as anonymous.
-                next();
+                // Swallow the error and continue through the anonymous limiter.
+                limiter(req, res, next);
                 return;
             }
             limiter(req, res, next);

package/dist/esm/utils/fapiAutoDetect.js

@@ -20,10 +20,9 @@
  *   - SSR / non-browser (no `window`).
  *   - `localhost`, `127.0.0.1`, IPv4/IPv6 literals.
  *   - Hostnames with fewer than two labels.
- *   - Hostnames whose trailing two labels form a known multi-part public
- *     suffix (e.g. `co.uk`), where the naive `labels.slice(-2)` apex would be
- *     an attacker-registrable suffix like `auth.co.uk` rather than the real
- *     registrable domain.
+ *   - Hostnames where a registrable domain cannot be determined from the
+ *     Public Suffix List, including private hosted suffixes such as
+ *     `github.io`, `pages.dev`, and `netlify.app`.
  *
  * When the page is already loaded ON the IdP itself (`auth.<anything>`),
  * the helper returns the current origin so the SDK keeps everything
@@ -34,33 +33,10 @@
  * (`packages/auth/server/index.ts`), so an honest CNAME pair is all that
  * is required for end-to-end FedCM correctness — no per-RP config.
  */
+import { getDomain } from 'tldts';
 /**
- * Known multi-part public suffixes where the registrable domain is the LAST
- * THREE labels, not two. Deriving an apex from `labels.slice(-2)` against any
- * of these would yield an attacker-registrable suffix (e.g. `auth.co.uk`),
- * so we bail out instead.
- *
- * This is intentionally a small, explicit allow-list rather than the full
- * Public Suffix List — it covers the suffixes the Oxy ecosystem's RPs use.
- * Any multi-part-TLD RP MUST extend this set (or wire in a proper PSL check)
- * before relying on this helper, otherwise auto-detection silently bails to
- * `undefined` and the consumer must pass `authWebUrl` explicitly.
- */
-export const MULTIPART_TLDS = new Set([
-    'co.uk',
-    'com.au',
-    'co.jp',
-    'co.nz',
-    'com.br',
-    'co.za',
-    'com.mx',
-    'co.in',
-    'co.kr',
-    'com.sg',
-]);
-/**
- * Compute the bare registrable apex (eTLD+1) of a hostname, guarding against
- * multi-part public suffixes.
+ * Compute the bare registrable apex (eTLD+1) of a hostname using the Public
+ * Suffix List, including private hosted suffixes.
  *
  * This is the pure host-handling kernel shared by {@link autoDetectAuthWebUrl}
  * and the IdP worker — it performs NO protocol handling, NO `auth.` prefixing,
@@ -72,10 +48,7 @@ export const MULTIPART_TLDS = new Set([
  *   - IPv4 literals (`192.168.1.10`);
  *   - IPv6 literals or any host carrying a port (`[::1]`, anything with `:`);
  *   - single-label hosts (`intranet`, `localhost`);
- *   - hosts whose trailing two labels form a known multi-part public suffix
- *     (e.g. `foo.co.uk`), where `labels.slice(-2)` would yield an
- *     attacker-registrable suffix (`co.uk`) rather than a real registrable
- *     domain. Such hosts MUST configure `authWebUrl` explicitly.
+ *   - public suffixes without a registrable label (e.g. `co.uk`, `github.io`).
  *
  * @param hostname - A bare hostname (no scheme), e.g. `www.mention.earth`.
  * @returns The eTLD+1 (`mention.earth`), or `null` when undefinable.
@@ -90,13 +63,11 @@ export function registrableApex(hostname) {
     // yields a registrable apex.
     if (host.startsWith('[') || host.includes(':'))
         return null;
-    const labels = host.split('.');
-    if (labels.length < 2)
-        return null;
-    const lastTwo = labels.slice(-2).join('.');
-    if (MULTIPART_TLDS.has(lastTwo))
-        return null;
-    return lastTwo;
+    // The Public Suffix List (private suffixes included) is the source of truth
+    // for what an attacker can register. A multi-part public suffix like `co.uk`
+    // or a hosted suffix like `github.io` returns no registrable domain, so
+    // deriving `auth.<apex>` against it is impossible — `getDomain` returns null.
+    return getDomain(host, { allowPrivateDomains: true });
 }
 export function autoDetectAuthWebUrl(location = typeof window !== 'undefined' ? window.location : undefined) {
     if (!location)

package/dist/esm/utils/ssoReturn.js

@@ -237,7 +237,7 @@ export async function consumeSsoReturn(oxy, deps = {}) {
     }
     let session;
     try {
-        session = await oxy.exchangeSsoCode(ret.code);
+        session = await oxy.exchangeSsoCode(ret.code, ret.state);
     }
     catch (error) {
         onExchangeError?.(error);