@pablozaiden/webapp 0.5.8 → 0.6.0

package/src/cli/device-auth.ts

@@ -1,4 +1,4 @@
-import { createJsonFileStore, type JsonFileStore } from "./credentials";
+import { createJsonFileStore, type JsonFileStore, type JsonFileStoreLockOptions } from "./credentials";
 
 export interface StoredDeviceCredentials {
   baseUrl: string;
@@ -12,6 +12,22 @@ export interface StoredDeviceCredentials {
   updatedAt: string;
 }
 
+type DeviceCredentialsStoreWrite = {
+  write(value: StoredDeviceCredentials): Promise<void>;
+};
+
+type ReadableDeviceCredentialsStore = DeviceCredentialsStoreWrite & {
+  read(): Promise<StoredDeviceCredentials | undefined>;
+  withLock?: <T>(callback: () => Promise<T>, options?: JsonFileStoreLockOptions) => Promise<T>;
+};
+
+export type DeviceCredentialsStore =
+  | (DeviceCredentialsStoreWrite & {
+      read?: () => Promise<StoredDeviceCredentials | undefined>;
+      withLock?: never;
+    })
+  | ReadableDeviceCredentialsStore;
+
 export function normalizeBaseUrl(value: string): string {
   const url = new URL(value.trim());
   if (url.protocol !== "http:" && url.protocol !== "https:") {
@@ -90,48 +106,93 @@ function tokenError(body: unknown, status: number): string {
   return `Request failed with status ${status}`;
 }
 
-function tokenCredentials(baseUrl: string, clientId: string, tokenSet: Record<string, unknown>, now: Date): StoredDeviceCredentials {
-  const expiresIn = Number(tokenSet["expires_in"] ?? 0);
+function tokenCredentials(baseUrl: string, clientId: string, tokenSet: unknown, now: Date): StoredDeviceCredentials {
+  if (!tokenSet || typeof tokenSet !== "object" || Array.isArray(tokenSet)) {
+    throw new Error("Token response is invalid");
+  }
+  const record = tokenSet as Record<string, unknown>;
+  const accessToken = record["access_token"];
+  const refreshToken = record["refresh_token"];
+  const tokenType = record["token_type"];
+  const expiresIn = record["expires_in"];
+  const scope = record["scope"];
+  if (
+    typeof accessToken !== "string" ||
+    accessToken.length === 0 ||
+    typeof refreshToken !== "string" ||
+    refreshToken.length === 0 ||
+    tokenType !== "Bearer" ||
+    typeof expiresIn !== "number" ||
+    !Number.isFinite(expiresIn) ||
+    expiresIn < 0 ||
+    (scope !== undefined && typeof scope !== "string")
+  ) {
+    throw new Error("Token response is invalid");
+  }
   return {
     baseUrl,
     clientId,
-    accessToken: String(tokenSet["access_token"] ?? ""),
-    refreshToken: String(tokenSet["refresh_token"] ?? ""),
+    accessToken,
+    refreshToken,
     tokenType: "Bearer",
-    scope: String(tokenSet["scope"] ?? ""),
+    scope: scope ?? "",
     accessTokenExpiresAt: new Date(now.getTime() + expiresIn * 1000).toISOString(),
     createdAt: now.toISOString(),
     updatedAt: now.toISOString(),
   };
 }
 
-export async function refreshDeviceCredentials(input: {
-  credentials: StoredDeviceCredentials;
-  store?: { write(value: StoredDeviceCredentials): Promise<void> };
-  fetchFn?: typeof fetch;
-  now?: () => Date;
-}): Promise<StoredDeviceCredentials | undefined> {
-  if (!isExpired(input.credentials, (input.now ?? (() => new Date()))())) {
-    return input.credentials;
-  }
-  const now = input.now?.() ?? new Date();
-  const { response, body } = await requestJson(input.fetchFn ?? fetch, `${input.credentials.baseUrl}/api/auth/token`, {
+async function refreshCredentialsOnce(
+  credentials: StoredDeviceCredentials,
+  store: DeviceCredentialsStore | undefined,
+  fetchFn: typeof fetch,
+  now: () => Date,
+): Promise<StoredDeviceCredentials | undefined> {
+  const issuedAt = now();
+  const { response, body } = await requestJson(fetchFn, `${credentials.baseUrl}/api/auth/token`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
       grant_type: "refresh_token",
-      refresh_token: input.credentials.refreshToken,
-      client_id: input.credentials.clientId,
+      refresh_token: credentials.refreshToken,
+      client_id: credentials.clientId,
     }),
   });
   if (!response.ok) {
     return undefined;
   }
-  const next = tokenCredentials(input.credentials.baseUrl, input.credentials.clientId, body as Record<string, unknown>, now);
-  await input.store?.write(next);
+  const next = tokenCredentials(credentials.baseUrl, credentials.clientId, body, issuedAt);
+  await store?.write(next);
   return next;
 }
 
+export async function refreshDeviceCredentials(input: {
+  credentials: StoredDeviceCredentials;
+  store?: DeviceCredentialsStore;
+  fetchFn?: typeof fetch;
+  now?: () => Date;
+}): Promise<StoredDeviceCredentials | undefined> {
+  const now = input.now ?? (() => new Date());
+  if (!isExpired(input.credentials, now())) {
+    return input.credentials;
+  }
+  const fetchFn = input.fetchFn ?? fetch;
+  const store = input.store;
+  if (store?.withLock) {
+    return store.withLock(async () => {
+      const current = await store.read();
+      if (!current) {
+        throw new Error("Credentials store is unavailable after acquiring refresh lock");
+      }
+      if (!isExpired(current, now())) {
+        return current;
+      }
+      return refreshCredentialsOnce(current, store, fetchFn, now);
+    });
+  }
+  return refreshCredentialsOnce(input.credentials, store, fetchFn, now);
+}
+
 export async function runDeviceAuthCommand(input: {
   baseUrl: string;
   clientId: string;
@@ -168,7 +229,7 @@ export async function runDeviceAuthCommand(input: {
       }),
     });
     if (token.response.ok) {
-      await input.store.write(tokenCredentials(baseUrl, input.clientId, token.body as Record<string, unknown>, now()));
+      await input.store.write(tokenCredentials(baseUrl, input.clientId, token.body, now()));
       out(`Authenticated with ${baseUrl}`);
       return 0;
     }

package/src/cli/environment-auth.ts

@@ -0,0 +1,57 @@
+import { assertEnvPrefix } from "../server/runtime-config";
+import { normalizeBaseUrl } from "./device-auth";
+
+export interface CliAuthEnvironmentNames {
+  baseUrl: string;
+  apiKey: string;
+}
+
+export interface EnvironmentApiKeyAuth {
+  baseUrl: string;
+  apiKey: string;
+  source: "explicit-base-url" | "environment";
+}
+
+export type CliEnvironment = Readonly<Record<string, string | undefined>>;
+
+function nonEmptyEnvValue(environment: CliEnvironment, name: string): string | undefined {
+  const value = environment[name];
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed || undefined;
+}
+
+export function cliAuthEnvironmentNames(envPrefix: string): CliAuthEnvironmentNames {
+  const prefix = assertEnvPrefix(envPrefix);
+  return {
+    baseUrl: `${prefix}_BASE_URL`,
+    apiKey: `${prefix}_API_KEY`,
+  };
+}
+
+export function resolveEnvironmentApiKeyAuth(input: {
+  envPrefix: string;
+  explicitBaseUrl?: string;
+  environment?: CliEnvironment;
+}): EnvironmentApiKeyAuth | undefined {
+  const names = cliAuthEnvironmentNames(input.envPrefix);
+  const environment = input.environment ?? process.env;
+  const apiKey = nonEmptyEnvValue(environment, names.apiKey);
+  if (!apiKey) return undefined;
+
+  if (input.explicitBaseUrl !== undefined) {
+    return {
+      baseUrl: normalizeBaseUrl(input.explicitBaseUrl),
+      apiKey,
+      source: "explicit-base-url",
+    };
+  }
+
+  const baseUrl = nonEmptyEnvValue(environment, names.baseUrl);
+  if (!baseUrl) return undefined;
+  return {
+    baseUrl: normalizeBaseUrl(baseUrl),
+    apiKey,
+    source: "environment",
+  };
+}

package/src/cli/index.ts

@@ -1,4 +1,5 @@
 export * from "./runtime";
 export * from "./credentials";
 export * from "./device-auth";
+export * from "./environment-auth";
 export * from "./api-command";

package/src/package-resolution.ts

@@ -0,0 +1,34 @@
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+const REACT_DOM_CLIENT_SPECIFIER = "react-dom/client";
+
+export function findPackageRoot(startDirectory: string): string {
+  const start = resolve(startDirectory);
+  let current = start;
+
+  while (true) {
+    if (existsSync(resolve(current, "package.json"))) {
+      return current;
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      throw new Error(`Unable to find an application package root from "${start}". Add a package.json to the application package.`);
+    }
+    current = parent;
+  }
+}
+
+export function resolveReactDomClient(applicationRoot: string, resolutionContext: string): string {
+  const root = resolve(applicationRoot);
+  const context = resolve(resolutionContext);
+
+  try {
+    return Bun.resolveSync(REACT_DOM_CLIENT_SPECIFIER, context);
+  } catch (error) {
+    throw new Error(
+      `Unable to resolve "${REACT_DOM_CLIENT_SPECIFIER}" from application package "${root}" using "${context}". Install "react-dom" in the application package and ensure its React peer dependencies are declared.`,
+      { cause: error },
+    );
+  }
+}

package/src/server/auth/device-auth.ts

@@ -11,7 +11,7 @@ import type { AuthSessionSummary, CurrentUser, DeviceAuthorizationResponse, Devi
 import type { RuntimeConfig } from "../runtime-config";
 import type { RefreshSessionRecord, WebAppStore } from "./store";
 import { addSeconds, isExpired, nowIso, randomToken, sha256 } from "./crypto";
-import { getRequestOriginInfo } from "./request-origin";
+import { getRequestBaseUrl } from "./request-origin";
 import { AuthError, type AccessTokenClaims } from "./types";
 import { toCurrentUser } from "./users";
 
@@ -40,7 +40,7 @@ function generateUserCode(): string {
 }
 
 function getPublicBaseUrl(req: Request, config: RuntimeConfig): string {
-  return config.publicBaseUrl ?? getRequestOriginInfo(req).origin;
+  return getRequestBaseUrl(req, config);
 }
 
 async function createSigningKey(): Promise<SigningKeyPair> {

package/src/server/auth/passkeys.ts

@@ -83,10 +83,10 @@ function getCookie(req: Request, name: string): string | undefined {
   return undefined;
 }
 
-function cookieHeader(req: Request, name: string, value: string, maxAge: number, secure: boolean): string {
+function cookieHeader(req: Request, config: RuntimeConfig, name: string, value: string, maxAge: number, secure: boolean): string {
   return [
     `${name}=${value}`,
-    `Path=${getCookiePath(req)}`,
+    `Path=${getCookiePath(req, config)}`,
     "HttpOnly",
     "SameSite=Strict",
     `Max-Age=${maxAge}`,
@@ -94,12 +94,12 @@ function cookieHeader(req: Request, name: string, value: string, maxAge: number,
   ].filter(Boolean).join("; ");
 }
 
-function expiredCookie(req: Request, name: string, secure: boolean): string {
-  return cookieHeader(req, name, "", 0, secure);
+function expiredCookie(req: Request, config: RuntimeConfig, name: string, secure: boolean): string {
+  return cookieHeader(req, config, name, "", 0, secure);
 }
 
 function setSessionHeaders(req: Request, store: WebAppStore, config: RuntimeConfig, user: UserRecord): Headers {
-  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const origin = getRequestOriginInfo(req, config);
   const secret = getSecret(store);
   const payload: SessionPayload = {
     nonce: randomToken(16),
@@ -108,16 +108,16 @@ function setSessionHeaders(req: Request, store: WebAppStore, config: RuntimeConf
     expiresAt: Date.now() + SESSION_TTL_SECONDS * 1000,
   };
   const headers = new Headers();
-  headers.append("set-cookie", cookieHeader(req, SESSION_COOKIE, encodeSigned(payload, secret), SESSION_TTL_SECONDS, origin.secure));
-  headers.append("set-cookie", expiredCookie(req, CHALLENGE_COOKIE, origin.secure));
+  headers.append("set-cookie", cookieHeader(req, config, SESSION_COOKIE, encodeSigned(payload, secret), SESSION_TTL_SECONDS, origin.secure));
+  headers.append("set-cookie", expiredCookie(req, config, CHALLENGE_COOKIE, origin.secure));
   return headers;
 }
 
 function setChallengeHeaders(req: Request, store: WebAppStore, config: RuntimeConfig, payload: Omit<ChallengePayload, "expiresAt">): Headers {
-  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const origin = getRequestOriginInfo(req, config);
   const secret = getSecret(store);
   const headers = new Headers();
-  headers.append("set-cookie", cookieHeader(req, CHALLENGE_COOKIE, encodeSigned({
+  headers.append("set-cookie", cookieHeader(req, config, CHALLENGE_COOKIE, encodeSigned({
     ...payload,
     expiresAt: Date.now() + CHALLENGE_TTL_SECONDS * 1000,
   }, secret), CHALLENGE_TTL_SECONDS, origin.secure));
@@ -145,7 +145,7 @@ function webauthnRpId(hostname: string): string {
 }
 
 async function beginRegistrationForUser(req: Request, store: WebAppStore, config: RuntimeConfig, user: { id: string; username: string }, type: ChallengePayload["type"], setupTokenHash?: string) {
-  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const origin = getRequestOriginInfo(req, config);
   const rpID = webauthnRpId(origin.hostname);
   const options = await generateRegistrationOptions({
     rpName: config.appName,
@@ -163,7 +163,7 @@ async function beginRegistrationForUser(req: Request, store: WebAppStore, config
 }
 
 async function verifyAndSavePasskey(req: Request, store: WebAppStore, config: RuntimeConfig, response: RegistrationResponseJSON, user: UserRecord, challenge: ChallengePayload): Promise<Headers> {
-  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const origin = getRequestOriginInfo(req, config);
   const rpID = webauthnRpId(origin.hostname);
   const verification = await verifyRegistrationResponse({
     response,
@@ -334,7 +334,7 @@ export async function beginAuthentication(req: Request, store: WebAppStore, conf
   if (passkeys.length === 0) {
     throw new AuthError("passkey_missing", "No passkey is configured", 409);
   }
-  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const origin = getRequestOriginInfo(req, config);
   const rpID = webauthnRpId(origin.hostname);
   const options = await generateAuthenticationOptions({
     rpID,
@@ -354,7 +354,7 @@ export async function completeAuthentication(req: Request, store: WebAppStore, c
   if (!passkey || !user) {
     throw new AuthError("passkey_not_found", "Passkey credential is not registered", 404);
   }
-  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const origin = getRequestOriginInfo(req, config);
   const rpID = webauthnRpId(origin.hostname);
   const verification = await verifyAuthenticationResponse({
     response,
@@ -380,10 +380,10 @@ export async function completeAuthentication(req: Request, store: WebAppStore, c
 }
 
 export function logoutHeaders(req: Request, config: RuntimeConfig): Headers {
-  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const origin = getRequestOriginInfo(req, config);
   const headers = new Headers();
-  headers.append("set-cookie", expiredCookie(req, SESSION_COOKIE, origin.secure));
-  headers.append("set-cookie", expiredCookie(req, CHALLENGE_COOKIE, origin.secure));
+  headers.append("set-cookie", expiredCookie(req, config, SESSION_COOKIE, origin.secure));
+  headers.append("set-cookie", expiredCookie(req, config, CHALLENGE_COOKIE, origin.secure));
   return headers;
 }
 

package/src/server/auth/request-origin.ts

@@ -1,33 +1,114 @@
+import type { RuntimeConfig, TrustProxyHeader } from "../runtime-config";
+
 export interface RequestOriginInfo {
   origin: string;
   hostname: string;
   secure: boolean;
+  pathPrefix: string;
+}
+
+const FORWARDED_HEADER_NAMES: Record<TrustProxyHeader, string> = {
+  proto: "x-forwarded-proto",
+  host: "x-forwarded-host",
+  prefix: "x-forwarded-prefix",
+};
+
+function forwardedValue(req: Request, config: Pick<RuntimeConfig, "trustProxy">, header: TrustProxyHeader): string | undefined {
+  if (!config.trustProxy.enabled || !config.trustProxy.headers.includes(header)) {
+    return undefined;
+  }
+  const raw = req.headers.get(FORWARDED_HEADER_NAMES[header]);
+  if (raw === null) {
+    return undefined;
+  }
+  const values = raw.split(",").map((value) => value.trim()).filter(Boolean);
+  if (values.length === 0) {
+    return undefined;
+  }
+  return config.trustProxy.chain === "last" ? values[values.length - 1] : values[0];
 }
 
-export function getRequestOriginInfo(req: Request, publicBaseUrl?: string): RequestOriginInfo {
-  if (publicBaseUrl) {
-    const parsed = new URL(publicBaseUrl);
+function parseOrigin(protocol: string, host: string): RequestOriginInfo | undefined {
+  if (!protocol || !host || /[\u0000-\u0020\u007f]/.test(host) || /[/?#\\]/.test(host)) {
+    return undefined;
+  }
+  try {
+    const parsed = new URL(`${protocol}://${host}`);
+    if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      return undefined;
+    }
     return {
       origin: parsed.origin,
       hostname: parsed.hostname,
       secure: parsed.protocol === "https:",
+      pathPrefix: "/",
     };
+  } catch {
+    return undefined;
   }
+}
+
+function directOrigin(req: Request): RequestOriginInfo {
   const url = new URL(req.url);
-  const forwardedProto = req.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
-  const forwardedHost = req.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
-  const proto = forwardedProto || url.protocol.replace(":", "");
-  const host = forwardedHost || req.headers.get("host") || url.host;
-  const origin = `${proto}://${host}`;
-  const parsed = new URL(origin);
-  return {
-    origin: parsed.origin,
-    hostname: parsed.hostname,
-    secure: parsed.protocol === "https:",
+  const protocol = url.protocol.replace(/:$/, "").toLowerCase();
+  const host = req.headers.get("host")?.trim() || url.host;
+  return parseOrigin(protocol, host) ?? {
+    origin: url.origin,
+    hostname: url.hostname,
+    secure: url.protocol === "https:",
+    pathPrefix: "/",
   };
 }
 
-export function getCookiePath(req: Request): string {
-  const prefix = req.headers.get("x-forwarded-prefix")?.trim().replace(/\/+$/, "");
-  return prefix || "/";
+function forwardedProtocol(value: string | undefined): string | undefined {
+  const normalized = value?.toLowerCase();
+  return normalized === "http" || normalized === "https" ? normalized : undefined;
+}
+
+function forwardedHost(value: string | undefined): string | undefined {
+  if (!value || !parseOrigin("http", value)) {
+    return undefined;
+  }
+  return value;
+}
+
+function forwardedPrefix(value: string | undefined): string | undefined {
+  if (!value || !value.startsWith("/") || /[\u0000-\u0020\u007f?#\\]/.test(value)) {
+    return undefined;
+  }
+  const normalized = value.replace(/\/+$/, "");
+  if (!normalized || normalized === "/") {
+    return "/";
+  }
+  if (normalized.startsWith("//")) {
+    return undefined;
+  }
+  return normalized;
+}
+
+export function getRequestOriginInfo(req: Request, config: Pick<RuntimeConfig, "publicBaseUrl" | "trustProxy">): RequestOriginInfo {
+  const direct = directOrigin(req);
+  const prefix = forwardedPrefix(forwardedValue(req, config, "prefix")) ?? "/";
+  if (config.publicBaseUrl) {
+    const parsed = new URL(config.publicBaseUrl);
+    return {
+      origin: parsed.origin,
+      hostname: parsed.hostname,
+      secure: parsed.protocol === "https:",
+      pathPrefix: prefix,
+    };
+  }
+  const protocol = forwardedProtocol(forwardedValue(req, config, "proto")) ?? new URL(direct.origin).protocol.replace(/:$/, "");
+  const host = forwardedHost(forwardedValue(req, config, "host")) ?? new URL(direct.origin).host;
+  const resolved = parseOrigin(protocol, host);
+  return resolved ? { ...resolved, pathPrefix: prefix } : { ...direct, pathPrefix: prefix };
+}
+
+export function getCookiePath(req: Request, config: Pick<RuntimeConfig, "publicBaseUrl" | "trustProxy">): string {
+  return getRequestOriginInfo(req, config).pathPrefix;
+}
+
+export function getRequestBaseUrl(req: Request, config: Pick<RuntimeConfig, "publicBaseUrl" | "trustProxy">): string {
+  const { origin, pathPrefix } = getRequestOriginInfo(req, config);
+  return `${origin}${pathPrefix === "/" ? "" : pathPrefix}`;
 }