@silkweave/auth 1.3.0

package/src/store/redis-store.ts

@@ -0,0 +1,69 @@
+import type { OAuthStore } from '../provider/store.js'
+
+export interface RedisClient {
+  get(key: string): Promise<unknown>
+  set(key: string, value: string, options?: { ex?: number }): Promise<unknown>
+  del(key: string): Promise<unknown>
+}
+
+export interface RedisStoreOptions {
+  client: RedisClient
+  prefix?: string
+}
+
+export function createRedisStore(options: RedisStoreOptions): OAuthStore {
+  const { client, prefix = 'silkweave:oauth:' } = options
+
+  function key(namespace: string, id: string) {
+    return `${prefix}${namespace}:${id}`
+  }
+
+  function ttlFromExpiry(expiresAt: number): number | undefined {
+    const seconds = Math.floor(expiresAt - Date.now() / 1000)
+    return seconds > 0 ? seconds : undefined
+  }
+
+  async function save<T>(namespace: string, id: string, data: T, expiresAt?: number) {
+    const opts: { ex?: number } = {}
+    const ttl = expiresAt != null ? ttlFromExpiry(expiresAt) : undefined
+    if (ttl != null) { opts.ex = ttl }
+    await client.set(key(namespace, id), JSON.stringify(data), opts)
+  }
+
+  async function load<T>(namespace: string, id: string): Promise<T | undefined> {
+    const raw = await client.get(key(namespace, id))
+    if (raw == null) { return undefined }
+    return (typeof raw === 'string' ? JSON.parse(raw) : raw) as T
+  }
+
+  async function remove(namespace: string, id: string) {
+    await client.del(key(namespace, id))
+  }
+
+  return {
+    async saveAuthCode(code, data) { await save('auth-code', code, data, data.expiresAt) },
+    async getAuthCode(code) { return load('auth-code', code) },
+    async deleteAuthCode(code) { await remove('auth-code', code) },
+
+    async savePendingAuth(state, data) { await save('pending-auth', state, data, data.expiresAt) },
+    async getPendingAuth(state) { return load('pending-auth', state) },
+    async deletePendingAuth(state) { await remove('pending-auth', state) },
+
+    async savePkceVerifier(state, verifier) {
+      const expiresAt = Date.now() / 1000 + 600
+      await save('pkce-verifier', state, { verifier, expiresAt }, expiresAt)
+    },
+    async getPkceVerifier(state) {
+      const item = await load<{ verifier: string; expiresAt: number }>('pkce-verifier', state)
+      return item?.verifier
+    },
+    async deletePkceVerifier(state) { await remove('pkce-verifier', state) },
+
+    async saveClient(clientId, data) { await save('client', clientId, data) },
+    async getClient(clientId) { return load('client', clientId) },
+
+    async saveRefreshToken(token, data) { await save('refresh-token', token, data, data.expiresAt) },
+    async getRefreshToken(token) { return load('refresh-token', token) },
+    async deleteRefreshToken(token) { await remove('refresh-token', token) }
+  }
+}

package/src/types.ts

@@ -0,0 +1,21 @@
+import type { OAuthProvider } from './provider/types.js'
+
+export interface AuthInfo {
+  token: string
+  clientId?: string
+  scopes?: string[]
+  expiresAt?: number
+  [key: string]: unknown
+}
+
+export type VerifyToken = (token: string) => Promise<AuthInfo | undefined>
+
+export interface AuthConfig {
+  verifyToken: VerifyToken
+  required?: boolean
+  resourceUrl?: string
+  authorizationServers?: string[]
+  requiredScopes?: string[]
+  provider?: OAuthProvider
+  callbackPath?: string
+}

package/src/validate.ts

@@ -0,0 +1,87 @@
+import { AuthError, insufficientScope, invalidToken } from './errors.js'
+import { extractBearerToken, buildWWWAuthenticate } from './extract.js'
+import { AuthConfig, AuthInfo } from './types.js'
+
+export interface ValidateResult {
+  auth?: AuthInfo
+  error?: {
+    statusCode: number
+    headers: Record<string, string>
+    body: { error: string; error_description: string }
+  }
+}
+
+export async function validateToken(
+  authorizationHeader: string | null | undefined,
+  config: AuthConfig
+): Promise<ValidateResult> {
+  const required = config.required ?? true
+  const resourceMetadataUrl = config.resourceUrl
+    ? `${config.resourceUrl}/.well-known/oauth-protected-resource`
+    : undefined
+
+  const token = extractBearerToken(authorizationHeader)
+
+  if (!token) {
+    if (!required) { return {} }
+    return buildChallengeResult(resourceMetadataUrl)
+  }
+
+  let authInfo: AuthInfo | undefined
+  try {
+    authInfo = await config.verifyToken(token)
+  } catch (_e) {
+    const err = invalidToken()
+    return buildErrorResult(err, resourceMetadataUrl)
+  }
+
+  if (!authInfo) {
+    const err = invalidToken()
+    return buildErrorResult(err, resourceMetadataUrl)
+  }
+
+  if (authInfo.expiresAt && authInfo.expiresAt < Date.now() / 1000) {
+    const err = invalidToken('Token has expired')
+    return buildErrorResult(err, resourceMetadataUrl)
+  }
+
+  if (config.requiredScopes?.length) {
+    const scopes = authInfo.scopes ?? []
+    const hasAll = config.requiredScopes.every((s) => scopes.includes(s))
+    if (!hasAll) {
+      const err = insufficientScope()
+      return buildErrorResult(err, resourceMetadataUrl)
+    }
+  }
+
+  return { auth: authInfo }
+}
+
+function buildChallengeResult(resourceMetadataUrl?: string): ValidateResult {
+  return {
+    error: {
+      statusCode: 401,
+      headers: {
+        'WWW-Authenticate': buildWWWAuthenticate(undefined, undefined, resourceMetadataUrl),
+        'Content-Type': 'application/json'
+      },
+      body: { error: 'missing_token', error_description: 'No authorization provided' }
+    }
+  }
+}
+
+function buildErrorResult(
+  err: AuthError,
+  resourceMetadataUrl?: string
+): ValidateResult {
+  return {
+    error: {
+      statusCode: err.statusCode,
+      headers: {
+        'WWW-Authenticate': buildWWWAuthenticate(err.code, err.message, resourceMetadataUrl),
+        'Content-Type': 'application/json'
+      },
+      body: { error: err.code, error_description: err.message }
+    }
+  }
+}

package/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": ["ES2022"],
+    "outDir": "build",
+    "rootDir": ".",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "allowSyntheticDefaultImports": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  },
+  "include": ["src"],
+  "exclude": ["node_modules", "build"]
+}

package/tsup.config.ts

@@ -0,0 +1,13 @@
+import { defineConfig } from 'tsup'
+
+export default defineConfig({
+  entry: ['src/index.ts'],
+  outDir: 'build',
+  format: ['esm'],
+  target: 'node18',
+  dts: true,
+  clean: true,
+  sourcemap: true,
+  splitting: false,
+  external: [/^[^./]/]
+})