@portaidentity/server 1.7.0

package/dist/routes/interactions.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Interaction route handlers for the OIDC login, consent, and logout flows.
+ *
+ * These routes handle the `/interaction/:uid` path where the UID is a
+ * node-oidc-provider interaction identifier. The provider redirects users
+ * here during the OIDC authorization flow for login and consent prompts.
+ *
+ * Route structure:
+ *   GET  /interaction/:uid              → showLogin or showConsent (based on prompt)
+ *   POST /interaction/:uid/login        → processLogin (password auth)
+ *   POST /interaction/:uid/magic-link   → sendMagicLink (passwordless auth)
+ *   GET  /interaction/:uid/consent      → showConsent
+ *   POST /interaction/:uid/confirm      → processConsent (approve/deny)
+ *   GET  /interaction/:uid/abort        → abortInteraction
+ *
+ * Security features:
+ *   - CSRF protection on all POST endpoints
+ *   - Rate limiting on login and magic link endpoints
+ *   - User enumeration prevention (generic error messages)
+ *   - Audit logging for all auth events
+ */
+import Router from '@koa/router';
+import type { Context } from 'koa';
+import type Provider from 'oidc-provider';
+import { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie } from '../auth/csrf.js';
+import { checkRateLimit, resetRateLimit, buildLoginRateLimitKey, buildMagicLinkRateLimitKey, loadLoginRateLimitConfig, loadMagicLinkRateLimitConfig } from '../auth/rate-limiter.js';
+import { enqueueAccountRecovery } from '../auth/recovery-service.js';
+import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
+import { renderPage } from '../auth/template-engine.js';
+import { prepareUserForPasswordLogin, verifyLoginPassword, recordLogin, recordPasswordFailure } from '../users/service.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import type { Organization } from '../organizations/types.js';
+/**
+ * Extended Koa context with organization from tenant resolver.
+ * The tenant resolver middleware sets ctx.state.organization.
+ */
+interface InteractionContext extends Context {
+    state: {
+        organization: Organization;
+        [key: string]: unknown;
+    };
+}
+/** Injectable boundaries used by enumeration-sensitive interaction handlers. */
+export interface EnumerationSensitiveInteractionDependencies {
+    /** Read the request's CSRF cookie. */
+    readonly getCsrfFromCookie: typeof getCsrfFromCookie;
+    /** Verify the submitted CSRF value. */
+    readonly verifyCsrfToken: typeof verifyCsrfToken;
+    /** Generate a response CSRF value. */
+    readonly generateCsrfToken: typeof generateCsrfToken;
+    /** Set the response CSRF cookie. */
+    readonly setCsrfCookie: typeof setCsrfCookie;
+    /** Build a tenant/IP/address login-rate key. */
+    readonly buildLoginRateLimitKey: typeof buildLoginRateLimitKey;
+    /** Build a tenant/address magic-link-rate key. */
+    readonly buildMagicLinkRateLimitKey: typeof buildMagicLinkRateLimitKey;
+    /** Load the configured login limit. */
+    readonly loadLoginRateLimitConfig: typeof loadLoginRateLimitConfig;
+    /** Load the configured magic-link limit. */
+    readonly loadMagicLinkRateLimitConfig: typeof loadMagicLinkRateLimitConfig;
+    /** Apply one admitted rate-limit operation. */
+    readonly checkRateLimit: typeof checkRateLimit;
+    /** Clear the successful-login rate-limit state. */
+    readonly resetRateLimit: typeof resetRateLimit;
+    /** Resolve a locale without exposing identity state. */
+    readonly resolveLocale: typeof resolveLocale;
+    /** Resolve the page translation function. */
+    readonly getTranslationFunction: typeof getTranslationFunction;
+    /** Render a public HTML response. */
+    readonly renderPage: typeof renderPage;
+    /** Resolve the account and fixed cooldown work. */
+    readonly prepareUserForPasswordLogin: typeof prepareUserForPasswordLogin;
+    /** Perform exactly one account or dummy Argon2id verification. */
+    readonly verifyLoginPassword: typeof verifyLoginPassword;
+    /** Execute the fixed-shape rejected-login operation. */
+    readonly recordPasswordFailure: typeof recordPasswordFailure;
+    /** Record a successful eligible login. */
+    readonly recordLogin: typeof recordLogin;
+    /** Durably enqueue account-independent recovery work. */
+    readonly enqueueAccountRecovery: typeof enqueueAccountRecovery;
+    /** Write a privacy-safe audit event. */
+    readonly writeAuditLog: typeof writeAuditLog;
+}
+/**
+ * Resolve the organization from the OIDC interaction's client_id.
+ *
+ * Interaction routes (`/interaction/:uid`) don't go through the tenant
+ * resolver middleware, so `ctx.state.organization` is not set automatically.
+ * This helper resolves the org by looking up the client → organization chain
+ * from the interaction's `client_id` parameter, and sets `ctx.state.organization`.
+ *
+ * Also used by two-factor routes which share the same `/interaction` prefix
+ * and likewise don't go through the tenant resolver middleware.
+ *
+ * @param ctx - Koa context to populate with organization
+ * @param clientId - OIDC client_id from the interaction params
+ * @throws Error if client or organization cannot be found
+ */
+export declare function resolveOrganizationForInteraction(ctx: InteractionContext, clientId: string, interactionUid?: string): Promise<void>;
+/**
+ * Create the interaction router with all OIDC interaction handlers.
+ *
+ * The router handles login, consent, magic link, and abort flows.
+ * Requires a Provider instance to interact with the OIDC session state.
+ *
+ * @param provider - node-oidc-provider instance for interaction management
+ * @returns Koa router with interaction routes mounted at /interaction
+ */
+export declare function createInteractionRouter(provider: Provider, enumerationDependencies?: EnumerationSensitiveInteractionDependencies): Router;
+export {};
+//# sourceMappingURL=interactions.d.ts.map

package/dist/routes/interactions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions.d.ts","sourceRoot":"","sources":["../../src/routes/interactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAY9D;;;GAGG;AACH,UAAU,kBAAmB,SAAQ,OAAO;IAC1C,KAAK,EAAE;QACL,YAAY,EAAE,YAAY,CAAC;QAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,gFAAgF;AAChF,MAAM,WAAW,2CAA2C;IAC1D,sCAAsC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IACrD,uCAAuC;IACvC,QAAQ,CAAC,eAAe,EAAE,OAAO,eAAe,CAAC;IACjD,sCAAsC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IACrD,oCAAoC;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;IAC7C,gDAAgD;IAChD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,kDAAkD;IAClD,QAAQ,CAAC,0BAA0B,EAAE,OAAO,0BAA0B,CAAC;IACvE,uCAAuC;IACvC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IACnE,4CAA4C;IAC5C,QAAQ,CAAC,4BAA4B,EAAE,OAAO,4BAA4B,CAAC;IAC3E,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,EAAE,OAAO,cAAc,CAAC;IAC/C,mDAAmD;IACnD,QAAQ,CAAC,cAAc,EAAE,OAAO,cAAc,CAAC;IAC/C,wDAAwD;IACxD,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;IAC7C,6CAA6C;IAC7C,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,UAAU,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,2BAA2B,EAAE,OAAO,2BAA2B,CAAC;IACzE,kEAAkE;IAClE,QAAQ,CAAC,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;IACzD,wDAAwD;IACxD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,qBAAqB,CAAC;IAC7D,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,OAAO,WAAW,CAAC;IACzC,yDAAyD;IACzD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IAC/D,wCAAwC;IACxC,QAAQ,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC;CAC9C;AA6HD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iCAAiC,CACrD,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAgED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,EAClB,uBAAuB,GAAE,2CAA4E,GACpG,MAAM,CA4DR"}