@samebase/identity-broker 0.1.0 → 0.2.0

package/README.md

@@ -18,6 +18,9 @@ registers each deployment as a client at deploy time and never touches GitHub or
   your own action. `github()`, `google()` and `email()` are included.
 - A hub is a small Convex app that mounts the component. Fork
   [samebase/identity-hub](https://github.com/samebase/identity-hub) for one.
+- `@samebase/alchemy-identity-hub`: an Alchemy v2 resource, `IdentityHub.Client`, that registers a
+  deployment as a client at deploy time. See
+  [packages/alchemy-identity-hub](https://github.com/samebase/identity-broker/tree/main/packages/alchemy-identity-hub).
 
 ## Mount it
 
@@ -62,12 +65,23 @@ export default http;
 ```ts
 // convex/identityBroker.ts: administration for `npx convex run`
 import { broker } from "./http";
-export const { createApp, mintRegistrationToken, deleteApp, listApps, listClients, cleanup } =
-  broker.admin();
+export const {
+  createApp,
+  mintRegistrationToken,
+  listRegistrationTokens,
+  revokeRegistrationToken,
+  setAllowedCallbackHosts,
+  deleteClient,
+  deleteApp,
+  listApps,
+  listClients,
+  cleanup,
+} = broker.admin();
 ```
 
 Keys: `npx identity-broker keys` prints the value for `IDENTITY_BROKER_KEYS`; `keys --rotate`
-advances it.
+advances it, and `keys --rotate --no-overlap` replaces a compromised key at once. Back up the key
+set: its salt makes every `sub`. `parseKeySet` checks a value before a deploy.
 
 ## Register an app's deployments
 

package/dist/cli/index.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
-import { createKeySet, parseKeySet, rotateKeySet } from "../client/keys.js";
-const USAGE = `identity-broker keys            print a new key set for IDENTITY_BROKER_KEYS
-identity-broker keys --rotate   read the current key set on stdin, print the rotated one`;
+import { createKeySet, parseKeySet, rotateKeySet, rotateKeySetWithoutOverlap, } from "../client/keys.js";
+const USAGE = `identity-broker keys                         print a new key set for IDENTITY_BROKER_KEYS
+identity-broker keys --rotate                read the current key set on stdin, print the rotated
+                                             one; the retired public key stays for 14 days
+identity-broker keys --rotate --no-overlap   the same after a key compromise: retired keys are
+                                             dropped at once; the salt is kept`;
 async function readStdin() {
     const chunks = [];
     for await (const chunk of process.stdin) {
@@ -14,8 +17,18 @@ async function main(argv) {
         console.error(USAGE);
         return 2;
     }
-    if (argv.includes("--rotate")) {
-        const rotated = await rotateKeySet(parseKeySet(await readStdin()));
+    const rotate = argv.includes("--rotate");
+    const noOverlap = argv.includes("--no-overlap");
+    // Without --rotate, --no-overlap would print a new key set with a new salt: every sub changes.
+    if (noOverlap && !rotate) {
+        console.error(USAGE);
+        return 2;
+    }
+    if (rotate) {
+        const current = parseKeySet(await readStdin());
+        const rotated = noOverlap
+            ? await rotateKeySetWithoutOverlap(current)
+            : await rotateKeySet(current);
         process.stdout.write(`${JSON.stringify(rotated)}\n`);
         return 0;
     }

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE5E,MAAM,KAAK,GAAG;yFAC2E,CAAC;AAE1F,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EACL,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,KAAK,GAAG;;;;+EAIiE,CAAC;AAEhF,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChD,+FAA+F;IAC/F,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC,MAAM,0BAA0B,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/client/html.d.ts

@@ -1,5 +1,5 @@
 /** The few pages the broker renders itself. Plain HTML, one stylesheet, no script. */
-export declare function page(title: string, body: string): Response;
+export declare function page(title: string, body: string, status?: number): Response;
 /**
  * The connector choice. A third-party app gets the consent wording and a deny link; a first-party
  * app only sees the buttons.
@@ -7,6 +7,8 @@ export declare function page(title: string, body: string): Response;
 export declare function chooserPage(args: {
     appName: string;
     firstParty: boolean;
+    /** The granted scopes: the consent names only what they release. */
+    scopes: string[];
     connectors: Array<{
         name: string;
         label: string;
@@ -19,6 +21,7 @@ export declare function emailAddressPage(args: {
     action: string;
     requestId: string;
     error?: string;
+    status?: number;
 }): Response;
 export declare function emailCodePage(args: {
     appName: string;
@@ -26,5 +29,6 @@ export declare function emailCodePage(args: {
     requestId: string;
     email: string;
     error?: string;
+    status?: number;
 }): Response;
 export declare function errorPage(title: string, message: string, status?: number): Response;

package/dist/client/html.js

@@ -20,7 +20,7 @@ const STYLE = `
   .error { color: #b00020; }
   .muted { color: #555; }
 `;
-export function page(title, body) {
+export function page(title, body, status = 200) {
     const html = `<!doctype html>
 <html lang="en">
 <head>
@@ -33,7 +33,7 @@ export function page(title, body) {
 <body><main>${body}</main></body>
 </html>`;
     return new Response(html, {
-        status: 200,
+        status,
         headers: {
             "Content-Type": "text/html; charset=utf-8",
             "Cache-Control": "no-store",
@@ -49,9 +49,17 @@ export function chooserPage(args) {
     const buttons = args.connectors
         .map((connector) => `<a class="button" href="${escape(connector.href)}">Continue with ${escape(connector.label)}</a>`)
         .join("\n");
+    const released = [
+        "a stable id",
+        ...(args.scopes.includes("profile") ? ["your name and picture"] : []),
+        ...(args.scopes.includes("email") ? ["your verified email address"] : []),
+    ];
+    const list = released.length <= 2
+        ? released.join(" and ")
+        : `${released.slice(0, -1).join(", ")}, and ${released.slice(-1).join("")}`;
     const consent = args.firstParty
         ? ""
-        : `<p class="muted">${escape(args.appName)} will receive your identity from the provider you choose: a stable id, your name, and your verified email address.</p>`;
+        : `<p class="muted">${escape(args.appName)} will receive your identity from the provider you choose: ${list}.</p>`;
     const deny = args.firstParty
         ? ""
         : `<p><a href="${escape(args.denyHref)}">Cancel and return to ${escape(args.appName)}</a></p>`;
@@ -65,7 +73,7 @@ export function emailAddressPage(args) {
 <input type="hidden" name="step" value="send">
 <input type="email" name="email" required autocomplete="email" autofocus placeholder="you@example.com">
 <button type="submit">Send code</button>
-</form>`);
+</form>`, args.status);
 }
 export function emailCodePage(args) {
     const error = args.error === undefined ? "" : `<p class="error">${escape(args.error)}</p>`;
@@ -75,10 +83,9 @@ export function emailCodePage(args) {
 <input type="hidden" name="step" value="verify">
 <input type="text" name="code" inputmode="numeric" pattern="[0-9]{6}" required autocomplete="one-time-code" autofocus placeholder="000000">
 <button type="submit">Continue</button>
-</form>`);
+</form>`, args.status);
 }
 export function errorPage(title, message, status = 400) {
-    const response = page(title, `<h1>${escape(title)}</h1><p>${escape(message)}</p>`);
-    return new Response(response.body, { status, headers: response.headers });
+    return page(title, `<h1>${escape(title)}</h1><p>${escape(message)}</p>`, status);
 }
 //# sourceMappingURL=html.js.map

package/dist/client/html.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/client/html.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG;;;;;;SAMN,MAAM,CAAC,KAAK,CAAC;SACb,KAAK;;cAEA,IAAI;QACV,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,aAAa;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAK3B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;SAC5B,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,2BAA2B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CACpG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wHAAwH,CAAC;IACrK,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;IACjG,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,OAAO,qBAAqB,OAAO,SAAS,IAAI,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wEAAwE,KAAK;8BACzF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAM7B;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,gEAAgE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK;8BACrE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,MAAM,GAAG,GAAG;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/client/html.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,IAAY,EAAE,MAAM,GAAG,GAAG;IAC5D,MAAM,IAAI,GAAG;;;;;;SAMN,MAAM,CAAC,KAAK,CAAC;SACb,KAAK;;cAEA,IAAI;QACV,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,aAAa;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAO3B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;SAC5B,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,2BAA2B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CACpG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,QAAQ,GAAG;QACf,aAAa;QACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IACF,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,IAAI,CAAC;QAClB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,6DAA6D,IAAI,OAAO,CAAC;IACrH,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;IACjG,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,OAAO,qBAAqB,OAAO,SAAS,IAAI,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAMhC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wEAAwE,KAAK;8BACzF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,EACJ,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAO7B;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,gEAAgE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK;8BACrE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,EACJ,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,MAAM,GAAG,GAAG;IACpE,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC"}

package/dist/client/index.d.ts

@@ -5,7 +5,7 @@ export type { Connector, EmailConnector, OauthConnector, OidcConnector, SendEmai
 export { github } from "./connectors/github.js";
 export { google } from "./connectors/google.js";
 export { email } from "./connectors/email.js";
-export { createKeySet, rotateKeySet, type KeySet } from "./keys.js";
+export { createKeySet, parseKeySet, rotateKeySet, type KeySet } from "./keys.js";
 export type IdentityBrokerConfig = {
     /** `components.identityBroker` of the host app. */
     component: ComponentApi;
@@ -44,6 +44,19 @@ export declare function defineIdentityBroker(config: IdentityBrokerConfig): {
             allowedCallbackHosts: string[];
             appId: string;
         }, Promise<null>>;
+        listRegistrationTokens: import("convex/server").RegisteredQuery<"internal", {
+            appId: string;
+        }, Promise<{
+            createdAt: number;
+            expiresAt: number;
+            tokenHash: string;
+        }[]>>;
+        revokeRegistrationToken: import("convex/server").RegisteredMutation<"internal", {
+            tokenHash: string;
+        }, Promise<null>>;
+        deleteClient: import("convex/server").RegisteredMutation<"internal", {
+            clientId: string;
+        }, Promise<null>>;
         deleteApp: import("convex/server").RegisteredMutation<"internal", {
             appId: string;
         }, Promise<null>>;
@@ -71,7 +84,9 @@ export declare function defineIdentityBroker(config: IdentityBrokerConfig): {
         cleanup: import("convex/server").RegisteredMutation<"internal", {}, Promise<{
             authRequests: number;
             authorizationCodes: number;
+            emailSends: number;
             previewClients: number;
+            registrationTokens: number;
             signIns: number;
         }>>;
     };

package/dist/client/index.js

@@ -11,13 +11,15 @@ import { pairwiseSubject, randomDigits, randomToken, sha256Hex } from "./subject
 export { github } from "./connectors/github.js";
 export { google } from "./connectors/google.js";
 export { email } from "./connectors/email.js";
-export { createKeySet, rotateKeySet } from "./keys.js";
+export { createKeySet, parseKeySet, rotateKeySet } from "./keys.js";
 /** A request lives this long from /authorize to the code redirect. */
 const AUTH_REQUEST_TTL_MS = 10 * 60 * 1000;
 /** A code is redeemed by the client's callback at once. */
 const CODE_TTL_MS = 60 * 1000;
 const EMAIL_CODE_TTL_MS = 10 * 60 * 1000;
 const EMAIL_MAX_ATTEMPTS = 5;
+/** The scopes the broker grants; any other requested scope is dropped. */
+const SCOPES = ["openid", "email", "profile"];
 const REGISTRATION_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 /** Lifecycle values the host's cron passes to `cleanup`. */
 export const PREVIEW_CLIENT_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
@@ -30,6 +32,9 @@ export function defineIdentityBroker(config) {
     const issuer = issuerUrl.href.replace(/\/$/, "");
     const prefix = issuerUrl.pathname.replace(/\/$/, "");
     const path = (suffix) => `${prefix}${suffix}`;
+    /** Binds the chooser's links to its browser. `__Host-` needs Path=/, so a path issuer uses a plain name. */
+    const txnCookieName = prefix === "" ? "__Host-broker_txn" : "broker_txn";
+    const txnCookieAttributes = `HttpOnly; Secure; SameSite=Lax; Path=${prefix === "" ? "/" : prefix}`;
     const component = config.component;
     const connectors = new Map(config.connectors.map((connector) => [connector.name, connector]));
     if (connectors.size !== config.connectors.length) {
@@ -47,7 +52,7 @@ export function defineIdentityBroker(config) {
         userinfo_endpoint: `${issuer}/userinfo`,
         jwks_uri: `${issuer}/.well-known/jwks.json`,
         registration_endpoint: `${issuer}/register`,
-        scopes_supported: ["openid", "email", "profile"],
+        scopes_supported: SCOPES,
         response_types_supported: ["code"],
         response_modes_supported: ["query"],
         grant_types_supported: ["authorization_code"],
@@ -165,6 +170,15 @@ export function defineIdentityBroker(config) {
             });
         }
         const freshLogin = rest.value.prompt.includes("login") || rest.value.maxAge !== undefined;
+        const scopes = SCOPES.filter((scope) => rest.value.scopes.includes(scope));
+        // A first-party app may skip the chooser: the one it named, or the only one. A third-party app
+        // always gets the page, which doubles as consent (RFC 9700 4.11).
+        const named = rest.value.connector === undefined ? undefined : connectors.get(rest.value.connector);
+        const only = connectors.size === 1 ? [...connectors.values()][0] : undefined;
+        const chosen = app.firstParty ? (named ?? only) : undefined;
+        // The chooser's links work only with this cookie, so a client that fetches the chooser itself
+        // cannot send a user's browser on from it.
+        const txnCookie = randomToken(32);
         const now = Date.now();
         const requestId = randomToken(24);
         await ctx.runMutation(component.authRequests.create, {
@@ -172,34 +186,32 @@ export function defineIdentityBroker(config) {
             appId: app.appId,
             clientId: client.clientId,
             redirectUri: client.redirectUri,
-            scope: rest.value.scopes.join(" "),
+            scope: scopes.join(" "),
             ...(rest.value.state === undefined ? {} : { state: rest.value.state }),
             ...(rest.value.nonce === undefined ? {} : { nonce: rest.value.nonce }),
             codeChallenge: rest.value.codeChallenge,
             freshLogin,
+            ...(chosen === undefined ? { txnCookieHash: await sha256Hex(txnCookie) } : {}),
             createdAt: now,
             expiresAt: now + AUTH_REQUEST_TTL_MS,
         });
-        const stored = {
-            requestId,
-            appId: app.appId,
-            redirectUri: client.redirectUri,
-            state: rest.value.state,
-            freshLogin,
-        };
-        // A first-party app may skip the chooser: the one it named, or the only one. A third-party app
-        // always gets the page, which doubles as consent (RFC 9700 4.11).
-        if (app.firstParty) {
-            const named = rest.value.connector === undefined ? undefined : connectors.get(rest.value.connector);
-            const only = connectors.size === 1 ? [...connectors.values()][0] : undefined;
-            const chosen = named ?? only;
-            if (chosen !== undefined) {
-                return await startConnector(ctx, { connector: chosen, request: stored, appName: app.name });
-            }
+        if (chosen !== undefined) {
+            return await startConnector(ctx, {
+                connector: chosen,
+                request: {
+                    requestId,
+                    appId: app.appId,
+                    redirectUri: client.redirectUri,
+                    state: rest.value.state,
+                    freshLogin,
+                },
+                appName: app.name,
+            });
         }
-        return chooserPage({
+        const page = chooserPage({
             appName: app.name,
             firstParty: app.firstParty,
+            scopes,
             connectors: [...connectors.values()].map((connector) => ({
                 name: connector.name,
                 label: connector.label,
@@ -207,6 +219,8 @@ export function defineIdentityBroker(config) {
             })),
             denyHref: `${path("/continue")}?request=${encodeURIComponent(requestId)}&deny=1`,
         });
+        page.headers.append("Set-Cookie", `${txnCookieName}=${txnCookie}; ${txnCookieAttributes}`);
+        return page;
     });
     /** A chooser click: start the chosen connector, or abandon the request on deny. */
     const continueSignIn = httpActionGeneric(async (ctx, request) => {
@@ -216,6 +230,17 @@ export function defineIdentityBroker(config) {
         if (stored === null) {
             return errorPage("Sign-in not found", "This sign-in is unknown or finished. Return to the app and try again.", 404);
         }
+        const txnCookie = request.headers
+            .get("cookie")
+            ?.split(";")
+            .map((pair) => pair.trim())
+            .find((pair) => pair.startsWith(`${txnCookieName}=`))
+            ?.slice(txnCookieName.length + 1);
+        if (stored.txnCookieHash === undefined ||
+            txnCookie === undefined ||
+            (await sha256Hex(txnCookie)) !== stored.txnCookieHash) {
+            return errorPage("Sign-in not continued", "This sign-in did not start in this browser. Return to the app and try again.", 400);
+        }
         const back = { redirectUri: stored.redirectUri, issuer, state: stored.state };
         if (url.searchParams.get("deny") !== null) {
             await ctx.runMutation(component.authRequests.abandon, { requestId });
@@ -262,6 +287,7 @@ export function defineIdentityBroker(config) {
             const now = Date.now();
             const claim = await ctx.runMutation(component.authRequests.claimUpstream, {
                 upstreamStateHash: await sha256Hex(state),
+                connector: connector.name,
                 now,
             });
             if (claim.status === "missing") {
@@ -288,14 +314,24 @@ export function defineIdentityBroker(config) {
             }
             catch (error) {
                 await ctx.runMutation(component.authRequests.abandon, { requestId: claim.requestId });
-                if (error instanceof oauth.AuthorizationResponseError) {
+                // The provider's error code picks one fixed answer; nothing the provider wrote is echoed.
+                if (error instanceof oauth.AuthorizationResponseError && error.error === "access_denied") {
+                    return authorizationError({
+                        ...back,
+                        error: "access_denied",
+                        description: `${connector.label} sign-in was declined.`,
+                    });
+                }
+                if (error instanceof oauth.AuthorizationResponseError &&
+                    error.error === "temporarily_unavailable") {
                     return authorizationError({
                         ...back,
-                        error: error.error === "access_denied" ? "access_denied" : "server_error",
-                        description: `${connector.label} answered ${error.error}.`,
+                        error: "temporarily_unavailable",
+                        description: `${connector.label} is temporarily unavailable.`,
                     });
                 }
-                console.error(`Connector "${connector.name}" failed`, error);
+                // Only the class name: provider errors carry token responses and decoded claims.
+                console.error(`Connector "${connector.name}" failed: ${error instanceof Error ? error.constructor.name : typeof error}`);
                 return authorizationError({
                     ...back,
                     error: "server_error",
@@ -362,24 +398,59 @@ export function defineIdentityBroker(config) {
                 requestId,
                 connector: emailConnector.name,
                 email: address,
+                emailHash: await sha256Hex(address),
                 emailCodeHash: await sha256Hex(code),
                 emailCodeExpiresAt: now + EMAIL_CODE_TTL_MS,
+                maxAttempts: EMAIL_MAX_ATTEMPTS,
                 now,
             });
             if (!started.ok) {
-                return started.error === "not_found"
-                    ? errorPage("Sign-in not found", "This sign-in is unknown. Return to the app and try again.", 404)
-                    : authorizationError({
-                        ...back,
-                        error: "access_denied",
-                        description: "The sign-in expired.",
-                    });
+                switch (started.error) {
+                    case "not_found":
+                        return errorPage("Sign-in not found", "This sign-in is unknown. Return to the app and try again.", 404);
+                    case "expired":
+                    case "wrong_status":
+                        return authorizationError({
+                            ...back,
+                            error: "access_denied",
+                            description: "The sign-in expired.",
+                        });
+                    case "locked":
+                        return authorizationError({
+                            ...back,
+                            error: "access_denied",
+                            description: "Too many wrong codes.",
+                        });
+                    case "too_soon":
+                    case "request_limit":
+                    case "address_limit":
+                    case "global_limit": {
+                        // The page the user is on, with one neutral line: nothing says whether the address is
+                        // known, and neither the address nor a code is logged.
+                        const error = started.error === "too_soon"
+                            ? "Wait a minute before asking for another code."
+                            : "Too many codes were sent. Try again later.";
+                        return stored.status === "emailSent"
+                            ? emailCodePage({
+                                appName: app.name,
+                                action,
+                                requestId,
+                                email: stored.email,
+                                error,
+                                status: 429,
+                            })
+                            : emailAddressPage({ appName: app.name, action, requestId, error, status: 429 });
+                    }
+                    default:
+                        return started;
+                }
             }
             try {
                 await ctx.runAction(emailConnector.send, { to: address, code, appName: app.name });
             }
             catch (error) {
-                console.error("Email code delivery failed", error);
+                // Only the class name: a delivery error can carry the address or the code.
+                console.error(`Connector "${emailConnector.name}" could not send a code: ${error instanceof Error ? error.constructor.name : typeof error}`);
                 return errorPage("Email not sent", "The code could not be sent. Try again in a moment.", 502);
             }
             return emailCodePage({ appName: app.name, action, requestId, email: address });
@@ -511,9 +582,12 @@ export function defineIdentityBroker(config) {
             return oauthError(415, "invalid_request", "The body must be application/x-www-form-urlencoded.");
         }
         const params = new URLSearchParams(await request.text());
-        const clientAuth = readClientAuthentication(request.headers.get("authorization"), params);
+        const authorization = request.headers.get("authorization");
+        // RFC 6749 section 5.2: a client that authenticated with the header gets a 401 with a challenge.
+        const challenge = authorization === null ? {} : { "WWW-Authenticate": 'Basic realm="token"' };
+        const clientAuth = readClientAuthentication(authorization, params);
         if (!clientAuth.ok) {
-            return oauthError(clientAuth.status, clientAuth.error, clientAuth.description);
+            return oauthError(clientAuth.status, clientAuth.error, clientAuth.description, clientAuth.status === 401 ? challenge : {});
         }
         const validation = validateTokenRequest(params, clientAuth.value);
         if (!validation.ok) {
@@ -525,7 +599,7 @@ export function defineIdentityBroker(config) {
         if (client === null ||
             client.tokenEndpointAuthMethod !== clientAuth.value.method ||
             client.secretHash !== (await sha256Hex(clientAuth.value.clientSecret))) {
-            return oauthError(401, "invalid_client", "Client authentication failed.");
+            return oauthError(401, "invalid_client", "Client authentication failed.", challenge);
         }
         const now = Date.now();
         const exchange = await ctx.runMutation(component.authRequests.exchangeCode, {
@@ -547,15 +621,17 @@ export function defineIdentityBroker(config) {
             upstreamId: exchange.identity.upstreamId,
             salt: keys.pairwiseSalt,
         });
+        // Claims follow the granted scopes (OIDC Core 5.4); userinfo reads them from the access token.
+        const scopes = exchange.scope.split(" ");
         const claims = { sub, connector: exchange.identity.connector };
-        if (exchange.identity.email !== undefined) {
+        if (scopes.includes("email") && exchange.identity.email !== undefined) {
             claims.email = exchange.identity.email;
             claims.email_verified = exchange.identity.emailVerified === true;
         }
-        if (exchange.identity.name !== undefined) {
+        if (scopes.includes("profile") && exchange.identity.name !== undefined) {
             claims.name = exchange.identity.name;
         }
-        if (exchange.identity.picture !== undefined) {
+        if (scopes.includes("profile") && exchange.identity.picture !== undefined) {
             claims.picture = exchange.identity.picture;
         }
         const [idToken, accessToken] = await Promise.all([
@@ -690,6 +766,28 @@ export function defineIdentityBroker(config) {
                         return null;
                     },
                 }),
+                listRegistrationTokens: internalQueryGeneric({
+                    args: { appId: string() },
+                    handler: async (ctx, args) => await ctx.runQuery(component.registration.listTokens, { appId: args.appId }),
+                }),
+                revokeRegistrationToken: internalMutationGeneric({
+                    args: { tokenHash: string() },
+                    returns: v.null(),
+                    handler: async (ctx, args) => {
+                        await ctx.runMutation(component.registration.revokeToken, {
+                            tokenHash: args.tokenHash,
+                        });
+                        return null;
+                    },
+                }),
+                deleteClient: internalMutationGeneric({
+                    args: { clientId: string() },
+                    returns: v.null(),
+                    handler: async (ctx, args) => {
+                        await ctx.runMutation(component.clients.remove, { clientId: args.clientId });
+                        return null;
+                    },
+                }),
                 deleteApp: internalMutationGeneric({
                     args: { appId: string() },
                     returns: v.null(),