@rebasepro/server 0.22.0 → 0.24.0

package/dist/{jwt-C4OW-DNq.js → jwt-R6bSPMjk.js}

@@ -3,8 +3,8 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-dW7B1o5h.js";
-import { r as logger } from "./logger-DO2PZc4i.js";
-import { i as canonicalStorageId } from "./keys-Qfc4XieN.js";
+import { r as logger } from "./logger-D-S-hO5e.js";
+import { a as canonicalStorageId } from "./keys-GAVZqbqx.js";
 import { createPrivateKey, createPublicKey } from "crypto";
 //#region src/utils/portable-crypto.ts
 /**
@@ -4423,6 +4423,8 @@ var jwt_exports = /* @__PURE__ */ __exportAll({
 	MCP_ACCESS_PURPOSE: () => MCP_ACCESS_PURPOSE,
 	MFA_PENDING_PURPOSE: () => MFA_PENDING_PURPOSE,
 	configureJwt: () => configureJwt,
+	configuredJwtSecret: () => configuredJwtSecret,
+	customClaimsOf: () => customClaimsOf,
 	generateAccessToken: () => generateAccessToken,
 	generateDownloadToken: () => generateDownloadToken,
 	generateMcpAccessToken: () => generateMcpAccessToken,
@@ -4436,6 +4438,7 @@ var jwt_exports = /* @__PURE__ */ __exportAll({
 	hasAsymmetricSigningKey: () => hasAsymmetricSigningKey,
 	hashRefreshToken: () => hashRefreshToken,
 	isJwtConfigured: () => isJwtConfigured,
+	parseDurationMs: () => parseDurationMs,
 	signPurposeToken: () => signPurposeToken,
 	verifyAccessToken: () => verifyAccessToken,
 	verifyDownloadToken: () => verifyDownloadToken,
@@ -4458,6 +4461,7 @@ var RESERVED_TOKEN_CLAIMS = /* @__PURE__ */ new Set([
 	"roles",
 	"aal",
 	"isAnonymous",
+	"sid",
 	"purpose",
 	"iat",
 	"exp",
@@ -4466,7 +4470,13 @@ var RESERVED_TOKEN_CLAIMS = /* @__PURE__ */ new Set([
 	"aud",
 	"jti"
 ]);
-/** The custom half of a verified token, or nothing when there is none. */
+/**
+* The custom half of a verified token, or nothing when there is none.
+*
+* Exported for the one other place that builds a request identity's claims
+* without a token to verify — `resolveUser`, which reads what a token minted
+* now would carry — so both drop the same identity claims.
+*/
 function customClaimsOf(decoded) {
 	const claims = {};
 	for (const [key, value] of Object.entries(decoded)) {
@@ -4523,9 +4533,18 @@ function configureJwt(config) {
 		active = resolved.find((key) => key.kid === config.activeKid) ?? null;
 		if (!active) throw new Error(`auth.activeKid is "${config.activeKid}", which is not among the configured signing keys (${resolved.map((k) => `"${k.kid}"`).join(", ")}). Signing with a key nobody published produces tokens no verifier can check.`);
 	} else active = resolved[0];
+	const lifetimes = {};
+	for (const key of ["accessExpiresIn", "refreshExpiresIn"]) {
+		const value = config[key];
+		if (value === void 0) continue;
+		if (parseDurationMs(value) === null) throw new Error(`auth.${key} is "${value}", which is not a lifetime. Give a positive number and a unit — "15m", "1h", "30d", "1w", "2 weeks" — in the grammar the token signer reads (vercel/ms). A bare number is refused: the signer reads it as milliseconds.`);
+		lifetimes[key] = value;
+	}
 	jwtConfig = {
 		...jwtConfig,
-		...config
+		...config,
+		accessExpiresIn: lifetimes.accessExpiresIn ?? jwtConfig.accessExpiresIn,
+		refreshExpiresIn: lifetimes.refreshExpiresIn ?? jwtConfig.refreshExpiresIn
 	};
 	signingKeys = resolved;
 	activeSigningKey = active;
@@ -4541,6 +4560,14 @@ function configureJwt(config) {
 function getJwks() {
 	return toJwks(signingKeys);
 }
+/**
+* The secret `configureJwt` was given, or undefined before it is called. For
+* `mfa-crypto.ts`, which falls back to it when no MFA key is set — the secret
+* passed in code, not only the one in `JWT_SECRET`.
+*/
+function configuredJwtSecret() {
+	return jwtConfig.secret || void 0;
+}
 /** Is this backend signing access tokens asymmetrically? */
 function hasAsymmetricSigningKey() {
 	return activeSigningKey !== null;
@@ -4562,14 +4589,15 @@ function isJwtConfigured() {
 /**
 * Generate an access token (short-lived, 1 hour by default)
 */
-async function generateAccessToken(uid, roles, aal = "aal1", customClaims, isAnonymous = false) {
+async function generateAccessToken(uid, roles, aal = "aal1", customClaims, isAnonymous = false, sessionId) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	const payload = {
 		...customClaims,
 		uid,
 		roles,
 		aal,
-		...isAnonymous ? { isAnonymous: true } : {}
+		...isAnonymous ? { isAnonymous: true } : {},
+		...sessionId ? { sid: sessionId } : {}
 	};
 	if (activeSigningKey) return signJwt(payload, activeSigningKey.privateKey, {
 		expiresIn: jwtConfig.accessExpiresIn,
@@ -4585,16 +4613,59 @@ async function generateAccessToken(uid, roles, aal = "aal1", customClaims, isAno
 * Get the expiration time of an access token in milliseconds from now
 */
 function getAccessTokenExpiryMs() {
-	const match = (jwtConfig.accessExpiresIn || "1h").match(/^(\d+)([dhms])$/);
-	if (!match) return 3600 * 1e3;
-	const value = parseInt(match[1], 10);
-	switch (match[2]) {
-		case "d": return value * 24 * 60 * 60 * 1e3;
-		case "h": return value * 60 * 60 * 1e3;
-		case "m": return value * 60 * 1e3;
-		case "s": return value * 1e3;
-		default: return 3600 * 1e3;
-	}
+	return parseDurationMs(jwtConfig.accessExpiresIn || "1h") ?? 3600 * 1e3;
+}
+var DURATION_UNIT_MS = {
+	ms: 1,
+	msec: 1,
+	msecs: 1,
+	millisecond: 1,
+	milliseconds: 1,
+	s: 1e3,
+	sec: 1e3,
+	secs: 1e3,
+	second: 1e3,
+	seconds: 1e3,
+	m: 6e4,
+	min: 6e4,
+	mins: 6e4,
+	minute: 6e4,
+	minutes: 6e4,
+	h: 36e5,
+	hr: 36e5,
+	hrs: 36e5,
+	hour: 36e5,
+	hours: 36e5,
+	d: 864e5,
+	day: 864e5,
+	days: 864e5,
+	w: 6048e5,
+	week: 6048e5,
+	weeks: 6048e5,
+	y: 315576e5,
+	yr: 315576e5,
+	yrs: 315576e5,
+	year: 315576e5,
+	years: 315576e5
+};
+/**
+* A lifetime setting in milliseconds, or null when it is not one.
+*
+* The grammar is vercel/ms, because that is what `jsonwebtoken` reads
+* `expiresIn` with: the token's `exp` and the expiry this module reports
+* have to come from one reading of the same string, and they used to come
+* from two — ours understood `<integer><d|h|m|s>` and nothing else.
+*
+* Stricter than ms in two ways, both about values nobody means: a bare number
+* (ms reads "3600" as 3.6 seconds) and a lifetime of zero or less.
+*/
+function parseDurationMs(value) {
+	const match = /^(\d+(?:\.\d+)?|\.\d+) *([a-z]+)$/i.exec(value);
+	if (!match) return null;
+	const unit = DURATION_UNIT_MS[match[2].toLowerCase()];
+	if (unit === void 0) return null;
+	const ms = parseFloat(match[1]) * unit;
+	return ms > 0 && Number.isFinite(ms) ? ms : null;
 }
 /**
 * Get the expiration timestamp for an access token
@@ -4638,21 +4709,21 @@ async function verifyAccessToken(token) {
 			aal,
 			...decoded.isAnonymous === true ? { isAnonymous: true } : {},
 			iat: decoded.iat,
+			...typeof decoded.exp === "number" ? { exp: decoded.exp } : {},
+			...typeof decoded.sid === "string" && decoded.sid ? { sid: decoded.sid } : {},
 			...(() => {
 				const claims = customClaimsOf(decoded);
 				return claims ? { claims } : {};
 			})()
 		};
 	} catch (error) {
-		logger.error("[JWT] Verification failed", {
-			error,
-			detail: token.substring(0, 15)
-		});
+		logger.error("[JWT] Verification failed", { error });
 		return null;
 	}
 }
 /**
-* Generate a random refresh token (long-lived, 30 days by default)
+* Generate a random refresh token. Long-lived: 400 days by default, sliding —
+* see {@link getRefreshTokenTtlMs}.
 */
 function generateRefreshToken() {
 	return randomHex(40);
@@ -4670,7 +4741,7 @@ function hashRefreshToken(token) {
 * what is actually enforced, which is worse than knowing the ceiling.
 */
 var MAX_COOKIE_AGE_MS = 400 * 24 * 60 * 60 * 1e3;
-/** Fallback when `refreshExpiresIn` is unset or unparseable. */
+/** Fallback when `refreshExpiresIn` is unset. {@link configureJwt} refuses an unparseable one. */
 var DEFAULT_REFRESH_TTL_MS = MAX_COOKIE_AGE_MS;
 /**
 * How long a refresh token is valid for, in milliseconds.
@@ -4682,16 +4753,8 @@ var DEFAULT_REFRESH_TTL_MS = MAX_COOKIE_AGE_MS;
 * when they say they expect to still be signed in.
 */
 function getRefreshTokenTtlMs() {
-	const match = jwtConfig.refreshExpiresIn?.match(/^(\d+)([dhms])$/);
-	if (!match) return DEFAULT_REFRESH_TTL_MS;
-	const value = parseInt(match[1], 10);
-	switch (match[2]) {
-		case "d": return value * 24 * 60 * 60 * 1e3;
-		case "h": return value * 60 * 60 * 1e3;
-		case "m": return value * 60 * 1e3;
-		case "s": return value * 1e3;
-		default: return DEFAULT_REFRESH_TTL_MS;
-	}
+	const duration = jwtConfig.refreshExpiresIn;
+	return (duration ? parseDurationMs(duration) : null) ?? DEFAULT_REFRESH_TTL_MS;
 }
 /**
 * Calculate refresh token expiration date
@@ -4732,13 +4795,20 @@ async function generateMfaPendingToken(uid, expiresInSeconds = 300) {
 *
 * Returns `null` for anything else — including a perfectly valid *access*
 * token, which must not be interchangeable with this one in either direction.
+*
+* `iat` comes back with the uid because this token is a first factor that was
+* accepted at that instant, and a sign-out everywhere after it has to void it
+* the way it voids an access token — see `isAccessTokenRevoked`.
 */
 async function verifyMfaPendingToken(token) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	try {
 		const decoded = await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
 		if (decoded.purpose !== "mfa-pending" || !decoded.uid) return null;
-		return { uid: decoded.uid };
+		return {
+			uid: decoded.uid,
+			iat: typeof decoded.iat === "number" ? decoded.iat : void 0
+		};
 	} catch {
 		return null;
 	}
@@ -4760,17 +4830,22 @@ async function verifyMfaPendingToken(token) {
 * site that forgets to pass a named source produces a default-scoped token,
 * which fails closed at `/file/*` rather than over-granting.
 */
-async function generateDownloadToken(path, expiresInSeconds = 300, storageId) {
+async function generateDownloadToken(path, expiresInSeconds = 300, storageId, principal) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	return signJwt({
 		purpose: "file-read",
 		path,
-		storageId: canonicalStorageId(storageId)
+		storageId: canonicalStorageId(storageId),
+		...principal ? { rl: await downloadTokenRateLimitMark(principal) } : {}
 	}, jwtConfig.secret, {
 		expiresIn: expiresInSeconds,
 		algorithm: "HS256"
 	});
 }
+/** See {@link DownloadTokenPayload.rl}. */
+async function downloadTokenRateLimitMark(principal) {
+	return (await sha256Hex(`download-token-rl:${principal}`)).slice(0, 32);
+}
 /**
 * Verify and decode a download token.
 *
@@ -4788,7 +4863,8 @@ async function verifyDownloadToken(token) {
 		if (decoded && decoded.purpose === "file-read" && typeof decoded.path === "string") return {
 			purpose: "file-read",
 			path: decoded.path,
-			storageId: canonicalStorageId(typeof decoded.storageId === "string" ? decoded.storageId : null)
+			storageId: canonicalStorageId(typeof decoded.storageId === "string" ? decoded.storageId : null),
+			...typeof decoded.rl === "string" ? { rl: decoded.rl } : {}
 		};
 		return null;
 	} catch (error) {
@@ -4914,6 +4990,6 @@ async function verifyMcpAccessToken(token, expectedAudience) {
 	}
 }
 //#endregion
-export { require_jsonwebtoken as C, sha256Bytes as D, randomInt as E, sha256Hex as O, normalizePemFromEnv as S, randomHex as T, verifyAccessToken as _, generateMcpAccessToken as a, verifyMfaPendingToken as b, getAccessTokenExpiry as c, getRefreshTokenTtlMs as d, hasAsymmetricSigningKey as f, signPurposeToken as g, jwt_exports as h, generateDownloadToken as i, getJwks as l, isJwtConfigured as m, configureJwt as n, generateMfaPendingToken as o, hashRefreshToken as p, generateAccessToken as r, generateRefreshToken as s, MAX_COOKIE_AGE_MS as t, getRefreshTokenExpiry as u, verifyDownloadToken as v, constantTimeEqual as w, verifyPurposeToken as x, verifyMcpAccessToken as y };
+export { sha256Bytes as A, verifyPurposeToken as C, constantTimeEqual as D, require_jsonwebtoken as E, randomHex as O, verifyMfaPendingToken as S, verifyJwt as T, jwt_exports as _, generateAccessToken as a, verifyDownloadToken as b, generateMfaPendingToken as c, getJwks as d, getRefreshTokenExpiry as f, isJwtConfigured as g, hashRefreshToken as h, customClaimsOf as i, sha256Hex as j, randomInt as k, generateRefreshToken as l, hasAsymmetricSigningKey as m, configureJwt as n, generateDownloadToken as o, getRefreshTokenTtlMs as p, configuredJwtSecret as r, generateMcpAccessToken as s, MAX_COOKIE_AGE_MS as t, getAccessTokenExpiry as u, signPurposeToken as v, normalizePemFromEnv as w, verifyMcpAccessToken as x, verifyAccessToken as y };
 
-//# sourceMappingURL=jwt-C4OW-DNq.js.map
+//# sourceMappingURL=jwt-R6bSPMjk.js.map