@revealui/auth 0.4.10 → 0.5.1

package/dist/server/sso/state.js

@@ -0,0 +1,101 @@
+/**
+ * Enterprise SSO signed state cookie (GAP-464).
+ *
+ * Separate from social OAuth generateOAuthState / verifyOAuthState so enterprise
+ * IdP bindings (accountId + providerId + PKCE) never overload provider enums.
+ *
+ * Cookie value: `<state>.<hmac-hex>` where state is base64url(JSON payload)
+ * and HMAC-SHA256 is over the state string using REVEALUI_SECRET.
+ */
+import crypto from 'node:crypto';
+function requireSecret() {
+    const secret = process.env.REVEALUI_SECRET;
+    if (!secret) {
+        throw new Error('REVEALUI_SECRET is required for SSO state signing. ' +
+            'Set it in your environment variables.');
+    }
+    return secret;
+}
+/**
+ * Generate a signed SSO state token with PKCE verifier.
+ */
+export function generateSsoState(input) {
+    const { accountId, providerId, redirectTo } = input;
+    if (!(accountId && providerId)) {
+        throw new Error('accountId and providerId are required for SSO state');
+    }
+    const nonce = crypto.randomBytes(16).toString('hex');
+    const codeVerifier = crypto.randomBytes(32).toString('base64url');
+    const codeChallenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url');
+    const payload = {
+        accountId,
+        providerId,
+        redirectTo,
+        nonce,
+        codeVerifier,
+    };
+    const state = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    const secret = requireSecret();
+    // lgtm[js/insufficient-password-hash] - HMAC-SHA256 for SSO CSRF state, not password hashing
+    const hmac = crypto.createHmac('sha256', secret).update(state).digest('hex');
+    return {
+        state,
+        cookieValue: `${state}.${hmac}`,
+        codeChallenge,
+    };
+}
+/**
+ * Verify a signed SSO state token from the callback.
+ * Returns null on any integrity / shape failure (does not throw for bad input).
+ */
+export function verifySsoState(state, cookieValue) {
+    if (!(state && cookieValue))
+        return null;
+    const dotIdx = cookieValue.lastIndexOf('.');
+    if (dotIdx === -1)
+        return null;
+    const storedState = cookieValue.substring(0, dotIdx);
+    const storedHmac = cookieValue.substring(dotIdx + 1);
+    if (storedState.length !== state.length ||
+        !crypto.timingSafeEqual(Buffer.from(storedState), Buffer.from(state))) {
+        return null;
+    }
+    const secret = requireSecret();
+    // lgtm[js/insufficient-password-hash] - HMAC-SHA256 for SSO CSRF state, not password hashing
+    const expectedHmac = crypto.createHmac('sha256', secret).update(state).digest('hex');
+    // Both are hex-encoded SHA-256 HMACs — must be exactly 64 hex characters.
+    if (storedHmac.length !== 64 || expectedHmac.length !== 64)
+        return null;
+    try {
+        if (!crypto.timingSafeEqual(Buffer.from(storedHmac, 'hex'), Buffer.from(expectedHmac, 'hex'))) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(Buffer.from(state, 'base64url').toString());
+        if (typeof parsed.accountId !== 'string' ||
+            typeof parsed.providerId !== 'string' ||
+            typeof parsed.redirectTo !== 'string' ||
+            typeof parsed.nonce !== 'string' ||
+            typeof parsed.codeVerifier !== 'string' ||
+            !parsed.accountId ||
+            !parsed.providerId ||
+            !parsed.nonce ||
+            !parsed.codeVerifier) {
+            return null;
+        }
+        return {
+            accountId: parsed.accountId,
+            providerId: parsed.providerId,
+            redirectTo: parsed.redirectTo,
+            nonce: parsed.nonce,
+            codeVerifier: parsed.codeVerifier,
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/utils/database.d.ts

@@ -18,7 +18,7 @@ export declare function getTestDatabaseUrl(): string;
 /**
  * Creates a test database client
  */
-export declare function createTestDatabaseClient(): import("@revealui/db/client").Database;
+export declare function createTestDatabaseClient(): import("@revealui/db").DatabaseClient;
 /**
  * Cleans up test data from database
  */

package/dist/utils/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/utils/database.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAU3C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,2CAMvC;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B7E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CASxE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAStF;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAClC,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAI3C"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/utils/database.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAU3C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,0CAMvC;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B7E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CASxE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAStF;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAClC,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAI3C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/auth",
-  "version": "0.4.10",
+  "version": "0.5.1",
   "description": "Database-backed session auth for Hono and Next.js — bcrypt, OAuth, brute-force protection, rate limiting, password reset. Ships with RevealUI.",
   "keywords": [
     "auth",
@@ -10,15 +10,17 @@
   ],
   "license": "MIT",
   "dependencies": {
+    "@node-saml/node-saml": "5.1.0",
     "@simplewebauthn/server": "^13.3.2",
     "bcryptjs": "^3.0.3",
     "drizzle-orm": "^0.45.2",
+    "jose": "^5.10.0",
     "zod": "^4.4.3",
     "@revealui/config": "0.6.0",
-    "@revealui/contracts": "0.8.1",
-    "@revealui/core": "0.12.1",
-    "@revealui/db": "0.9.0",
-    "@revealui/security": "0.5.1"
+    "@revealui/contracts": "0.8.2",
+    "@revealui/core": "0.12.4",
+    "@revealui/db": "0.10.0",
+    "@revealui/security": "0.6.1"
   },
   "devDependencies": {
     "@simplewebauthn/browser": "^13.3.0",
@@ -27,9 +29,11 @@
     "@types/react": "^19.2.17",
     "@vitest/coverage-v8": "^4.1.10",
     "happy-dom": "^20.10.6",
-    "react": "^19.2.7",
+    "react": "19.2.8",
+    "selfsigned": "2.4.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
+    "xml-crypto": "6.1.2",
     "@revealui/dev": "0.1.0"
   },
   "engines": {
@@ -46,6 +50,11 @@
       "import": "./dist/server/index.js",
       "default": "./dist/server/index.js"
     },
+    "./audit-storage": {
+      "types": "./dist/server/audit-storage.d.ts",
+      "import": "./dist/server/audit-storage.js",
+      "default": "./dist/server/audit-storage.js"
+    },
     "./react": {
       "types": "./dist/react/index.d.ts",
       "import": "./dist/react/index.js",