@silkweave/auth 1.3.1 → 1.3.2

package/build/index.js

@@ -15,9 +15,6 @@ function invalidToken(message = "Invalid token") {
 function insufficientScope(message = "Insufficient scope") {
   return new AuthError(message, "insufficient_scope", 403);
 }
-function missingToken(message = "No authorization provided") {
-  return new AuthError(message, "missing_token", 401);
-}
 
 // src/extract.ts
 function extractBearerToken(header) {
@@ -50,6 +47,10 @@ function generateProtectedResourceMetadata(resourceUrl, authorizationServers) {
   };
 }
 
+// src/provider/proxy.ts
+import { randomBytes, randomUUID } from "crypto";
+import { SignJWT, jwtVerify } from "jose";
+
 // src/store/memory-store.ts
 function withTtl(map, key) {
   const item = map.get(key);
@@ -122,10 +123,6 @@ function createMemoryStore() {
   };
 }
 
-// src/provider/proxy.ts
-import { randomBytes, randomUUID } from "crypto";
-import { SignJWT, jwtVerify } from "jose";
-
 // src/provider/uri.ts
 function matchRedirectUri(uri, patterns) {
   return patterns.some((pattern) => {
@@ -144,6 +141,233 @@ var CORS_HEADERS = {
   "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
   "Access-Control-Allow-Headers": "*"
 };
+function generateCode() {
+  return randomBytes(32).toString("base64url");
+}
+async function generatePkce() {
+  const verifier = randomBytes(32).toString("base64url");
+  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  const challenge = Buffer.from(hash).toString("base64url");
+  return { verifier, challenge };
+}
+async function verifyPkce(verifier, challenge) {
+  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  const computed = Buffer.from(hash).toString("base64url");
+  return computed === challenge;
+}
+function jsonResponse(status, body, headers = {}) {
+  return {
+    status,
+    headers: { "Content-Type": "application/json", ...CORS_HEADERS, ...headers },
+    body
+  };
+}
+function redirectResponse(url) {
+  return {
+    status: 302,
+    headers: { Location: url, ...CORS_HEADERS },
+    body: void 0
+  };
+}
+function errorResponse(status, error, description) {
+  return jsonResponse(status, { error, error_description: description });
+}
+async function signAccessToken(key, opts) {
+  const now = Math.floor(Date.now() / 1e3);
+  return new SignJWT({ scope: opts.scopes.join(" "), email: opts.email }).setProtectedHeader({ alg: "HS256" }).setSubject(opts.sub ?? opts.email ?? opts.clientId).setIssuer(opts.issuer).setAudience(opts.issuer).setIssuedAt(now).setExpirationTime(now + opts.ttl).sign(key);
+}
+async function handleRegister(req, store, allowedRedirectUris) {
+  const body = req.body;
+  if (!body) {
+    return errorResponse(400, "invalid_request", "Missing request body");
+  }
+  const redirectUris = body.redirect_uris;
+  if (!redirectUris) {
+    return errorResponse(400, "invalid_request", "redirect_uris is required");
+  }
+  let uris;
+  try {
+    uris = typeof redirectUris === "string" ? JSON.parse(redirectUris) : redirectUris;
+  } catch {
+    uris = [redirectUris];
+  }
+  if (!Array.isArray(uris) || uris.length === 0) {
+    return errorResponse(400, "invalid_request", "redirect_uris must be a non-empty array");
+  }
+  for (const uri of uris) {
+    if (!matchRedirectUri(uri, allowedRedirectUris)) {
+      return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
+    }
+  }
+  const clientId = randomUUID();
+  const clientSecret = randomBytes(32).toString("base64url");
+  const registration = {
+    clientId,
+    clientSecret,
+    redirectUris: uris,
+    clientName: body.client_name,
+    createdAt: Date.now() / 1e3
+  };
+  await store.saveClient(clientId, registration);
+  return jsonResponse(201, {
+    client_id: clientId,
+    client_secret: clientSecret,
+    redirect_uris: uris,
+    client_name: body.client_name,
+    token_endpoint_auth_method: "none"
+  });
+}
+async function resolveClient(clientId, store, allowedRedirectUris) {
+  const existing = await store.getClient(clientId);
+  if (existing) {
+    return existing;
+  }
+  if (!clientId.startsWith("https://")) {
+    return errorResponse(400, "invalid_client", "Unknown client_id");
+  }
+  try {
+    const metaRes = await fetch(clientId);
+    if (!metaRes.ok) {
+      return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
+    }
+    const meta = await metaRes.json();
+    const metaRedirectUris = meta.redirect_uris;
+    if (!Array.isArray(metaRedirectUris) || metaRedirectUris.length === 0) {
+      return errorResponse(400, "invalid_client", "Client metadata must include redirect_uris");
+    }
+    for (const uri of metaRedirectUris) {
+      if (!matchRedirectUri(uri, allowedRedirectUris)) {
+        return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
+      }
+    }
+    const client = {
+      clientId,
+      clientSecret: "",
+      redirectUris: metaRedirectUris,
+      clientName: meta.client_name,
+      createdAt: Date.now() / 1e3
+    };
+    await store.saveClient(clientId, client);
+    return client;
+  } catch {
+    return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
+  }
+}
+async function exchangeUpstreamCode(code, config, callbackPath, pkceVerifier) {
+  const tokenBody = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: `${config.resourceUrl}${callbackPath}`,
+    client_id: config.clientId,
+    client_secret: config.clientSecret,
+    code_verifier: pkceVerifier
+  });
+  const tokenResponse = await fetch(config.tokenUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: tokenBody.toString()
+  });
+  if (!tokenResponse.ok) {
+    const errorBody = await tokenResponse.text();
+    console.error("Upstream token exchange failed:", errorBody);
+    return errorResponse(502, "upstream_error", "Failed to exchange code with upstream provider");
+  }
+  const tokens = await tokenResponse.json();
+  return {
+    accessToken: tokens.access_token,
+    idToken: tokens.id_token
+  };
+}
+async function fetchUserinfo(userinfoUrl, accessToken) {
+  if (!userinfoUrl || !accessToken) {
+    return {};
+  }
+  try {
+    const res = await fetch(userinfoUrl, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (res.ok) {
+      const userinfo = await res.json();
+      return { email: userinfo.email, sub: userinfo.sub };
+    }
+  } catch {
+  }
+  return {};
+}
+async function handleRefreshToken(body, store, getSigningKey, config) {
+  const refreshToken = body.refresh_token;
+  if (!refreshToken) {
+    return errorResponse(400, "invalid_request", "Missing refresh_token");
+  }
+  const tokenData = await store.getRefreshToken(refreshToken);
+  if (!tokenData) {
+    return errorResponse(400, "invalid_grant", "Invalid or expired refresh token");
+  }
+  const key = await getSigningKey();
+  const accessToken = await signAccessToken(key, {
+    scopes: tokenData.scopes,
+    email: tokenData.email,
+    sub: tokenData.sub,
+    clientId: tokenData.clientId,
+    issuer: config.resourceUrl,
+    ttl: config.tokenTtl
+  });
+  return jsonResponse(200, {
+    access_token: accessToken,
+    token_type: "Bearer",
+    expires_in: config.tokenTtl,
+    scope: tokenData.scopes.join(" "),
+    refresh_token: refreshToken
+  });
+}
+async function handleAuthorizationCode(body, store, getSigningKey, config) {
+  const code = body.code;
+  const redirectUri = body.redirect_uri;
+  const clientId = body.client_id;
+  const codeVerifier = body.code_verifier;
+  if (!code || !codeVerifier || !clientId) {
+    return errorResponse(400, "invalid_request", "Missing required parameters");
+  }
+  const authCode = await store.getAuthCode(code);
+  if (!authCode) {
+    return errorResponse(400, "invalid_grant", "Invalid or expired authorization code");
+  }
+  await store.deleteAuthCode(code);
+  if (authCode.clientId !== clientId) {
+    return errorResponse(400, "invalid_grant", "client_id mismatch");
+  }
+  if (redirectUri && authCode.redirectUri !== redirectUri) {
+    return errorResponse(400, "invalid_grant", "redirect_uri mismatch");
+  }
+  const pkceValid = await verifyPkce(codeVerifier, authCode.codeChallenge);
+  if (!pkceValid) {
+    return errorResponse(400, "invalid_grant", "PKCE verification failed");
+  }
+  const key = await getSigningKey();
+  const accessToken = await signAccessToken(key, {
+    scopes: authCode.scopes,
+    email: authCode.email,
+    sub: authCode.sub,
+    clientId: authCode.clientId,
+    issuer: config.resourceUrl,
+    ttl: config.tokenTtl
+  });
+  const refreshToken = randomBytes(32).toString("base64url");
+  await store.saveRefreshToken(refreshToken, {
+    clientId: authCode.clientId,
+    scopes: authCode.scopes,
+    email: authCode.email,
+    sub: authCode.sub,
+    expiresAt: Math.floor(Date.now() / 1e3) + 30 * 24 * 3600
+  });
+  return jsonResponse(200, {
+    access_token: accessToken,
+    token_type: "Bearer",
+    expires_in: config.tokenTtl,
+    scope: authCode.scopes.join(" "),
+    refresh_token: refreshToken
+  });
+}
 function createOAuthProxy(config) {
   const store = config.store ?? createMemoryStore();
   const callbackPath = config.callbackPath ?? "/auth/callback";
@@ -161,38 +385,7 @@ function createOAuthProxy(config) {
     }
     return signingKey;
   }
-  function generateCode() {
-    return randomBytes(32).toString("base64url");
-  }
-  async function generatePkce() {
-    const verifier = randomBytes(32).toString("base64url");
-    const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-    const challenge = Buffer.from(hash).toString("base64url");
-    return { verifier, challenge };
-  }
-  async function verifyPkce(verifier, challenge) {
-    const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-    const computed = Buffer.from(hash).toString("base64url");
-    return computed === challenge;
-  }
-  function jsonResponse(status, body, headers = {}) {
-    return {
-      status,
-      headers: { "Content-Type": "application/json", ...CORS_HEADERS, ...headers },
-      body
-    };
-  }
-  function redirectResponse(url) {
-    return {
-      status: 302,
-      headers: { Location: url, ...CORS_HEADERS },
-      body: void 0
-    };
-  }
-  function errorResponse(status, error, description) {
-    return jsonResponse(status, { error, error_description: description });
-  }
-  const provider = {
+  return {
     metadata() {
       return jsonResponse(200, {
         issuer: config.resourceUrl,
@@ -206,46 +399,8 @@ function createOAuthProxy(config) {
         scopes_supported: scopes
       }, { "Cache-Control": "max-age=3600" });
     },
-    async register(req) {
-      const body = req.body;
-      if (!body) {
-        return errorResponse(400, "invalid_request", "Missing request body");
-      }
-      const redirectUris = body.redirect_uris;
-      if (!redirectUris) {
-        return errorResponse(400, "invalid_request", "redirect_uris is required");
-      }
-      let uris;
-      try {
-        uris = typeof redirectUris === "string" ? JSON.parse(redirectUris) : redirectUris;
-      } catch {
-        uris = [redirectUris];
-      }
-      if (!Array.isArray(uris) || uris.length === 0) {
-        return errorResponse(400, "invalid_request", "redirect_uris must be a non-empty array");
-      }
-      for (const uri of uris) {
-        if (!matchRedirectUri(uri, config.redirectUris)) {
-          return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
-        }
-      }
-      const clientId = randomUUID();
-      const clientSecret = randomBytes(32).toString("base64url");
-      const registration = {
-        clientId,
-        clientSecret,
-        redirectUris: uris,
-        clientName: body.client_name,
-        createdAt: Date.now() / 1e3
-      };
-      await store.saveClient(clientId, registration);
-      return jsonResponse(201, {
-        client_id: clientId,
-        client_secret: clientSecret,
-        redirect_uris: uris,
-        client_name: body.client_name,
-        token_endpoint_auth_method: "none"
-      });
+    register(req) {
+      return handleRegister(req, store, config.redirectUris);
     },
     async authorize(req) {
       const params = req.url.searchParams;
@@ -269,38 +424,11 @@ function createOAuthProxy(config) {
       if (!codeChallenge || codeChallengeMethod !== "S256") {
         return errorResponse(400, "invalid_request", "PKCE with S256 is required");
       }
-      let client = await store.getClient(clientId);
-      if (!client && clientId.startsWith("https://")) {
-        try {
-          const metaRes = await fetch(clientId);
-          if (!metaRes.ok) {
-            return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
-          }
-          const meta = await metaRes.json();
-          const metaRedirectUris = meta.redirect_uris;
-          if (!Array.isArray(metaRedirectUris) || metaRedirectUris.length === 0) {
-            return errorResponse(400, "invalid_client", "Client metadata must include redirect_uris");
-          }
-          for (const uri of metaRedirectUris) {
-            if (!matchRedirectUri(uri, config.redirectUris)) {
-              return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
-            }
-          }
-          client = {
-            clientId,
-            clientSecret: "",
-            redirectUris: metaRedirectUris,
-            clientName: meta.client_name,
-            createdAt: Date.now() / 1e3
-          };
-          await store.saveClient(clientId, client);
-        } catch {
-          return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
-        }
-      }
-      if (!client) {
-        return errorResponse(400, "invalid_client", "Unknown client_id");
+      const result = await resolveClient(clientId, store, config.redirectUris);
+      if ("status" in result) {
+        return result;
       }
+      const client = result;
       if (!client.redirectUris.includes(redirectUri)) {
         return errorResponse(400, "invalid_redirect_uri", "redirect_uri does not match registered URIs");
       }
@@ -352,42 +480,11 @@ function createOAuthProxy(config) {
       }
       await store.deletePendingAuth(proxyState);
       await store.deletePkceVerifier(proxyState);
-      const tokenBody = new URLSearchParams({
-        grant_type: "authorization_code",
-        code: upstreamCode,
-        redirect_uri: `${config.resourceUrl}${callbackPath}`,
-        client_id: config.clientId,
-        client_secret: config.clientSecret,
-        code_verifier: pkceVerifier
-      });
-      const tokenResponse = await fetch(config.tokenUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: tokenBody.toString()
-      });
-      if (!tokenResponse.ok) {
-        const errorBody = await tokenResponse.text();
-        console.error("Upstream token exchange failed:", errorBody);
-        return errorResponse(502, "upstream_error", "Failed to exchange code with upstream provider");
-      }
-      const tokens = await tokenResponse.json();
-      const upstreamAccessToken = tokens.access_token;
-      const upstreamIdToken = tokens.id_token;
-      let email;
-      let sub;
-      if (config.userinfoUrl && upstreamAccessToken) {
-        try {
-          const userinfoResponse = await fetch(config.userinfoUrl, {
-            headers: { Authorization: `Bearer ${upstreamAccessToken}` }
-          });
-          if (userinfoResponse.ok) {
-            const userinfo = await userinfoResponse.json();
-            email = userinfo.email;
-            sub = userinfo.sub;
-          }
-        } catch {
-        }
+      const upstream = await exchangeUpstreamCode(upstreamCode, config, callbackPath, pkceVerifier);
+      if ("status" in upstream) {
+        return upstream;
       }
+      const userinfo = await fetchUserinfo(config.userinfoUrl, upstream.accessToken);
       const mcpCode = generateCode();
       await store.saveAuthCode(mcpCode, {
         clientId: pending.clientId,
@@ -395,10 +492,10 @@ function createOAuthProxy(config) {
         codeChallenge: pending.codeChallenge,
         codeChallengeMethod: pending.codeChallengeMethod,
         scopes: pending.scope.split(" ").filter(Boolean),
-        upstreamAccessToken,
-        upstreamIdToken,
-        email,
-        sub,
+        upstreamAccessToken: upstream.accessToken,
+        upstreamIdToken: upstream.idToken,
+        email: userinfo.email,
+        sub: userinfo.sub,
         expiresAt: Date.now() / 1e3 + 600
       });
       const clientRedirect = new URL(pending.redirectUri);
@@ -413,76 +510,14 @@ function createOAuthProxy(config) {
       if (!body) {
         return errorResponse(400, "invalid_request", "Missing request body");
       }
-      const grantType = body.grant_type;
-      if (grantType === "refresh_token") {
-        const refreshToken2 = body.refresh_token;
-        if (!refreshToken2) {
-          return errorResponse(400, "invalid_request", "Missing refresh_token");
-        }
-        const tokenData = await store.getRefreshToken(refreshToken2);
-        if (!tokenData) {
-          return errorResponse(400, "invalid_grant", "Invalid or expired refresh token");
-        }
-        const key2 = await getSigningKey();
-        const now2 = Math.floor(Date.now() / 1e3);
-        const accessToken2 = await new SignJWT({
-          scope: tokenData.scopes.join(" "),
-          email: tokenData.email
-        }).setProtectedHeader({ alg: "HS256" }).setSubject(tokenData.sub ?? tokenData.email ?? tokenData.clientId).setIssuer(config.resourceUrl).setAudience(config.resourceUrl).setIssuedAt(now2).setExpirationTime(now2 + tokenTtl).sign(key2);
-        return jsonResponse(200, {
-          access_token: accessToken2,
-          token_type: "Bearer",
-          expires_in: tokenTtl,
-          scope: tokenData.scopes.join(" "),
-          refresh_token: refreshToken2
-        });
+      const tokenConfig = { resourceUrl: config.resourceUrl, tokenTtl };
+      if (body.grant_type === "refresh_token") {
+        return handleRefreshToken(body, store, getSigningKey, tokenConfig);
       }
-      if (grantType !== "authorization_code") {
+      if (body.grant_type !== "authorization_code") {
         return errorResponse(400, "unsupported_grant_type", "Supported grant types: authorization_code, refresh_token");
       }
-      const code = body.code;
-      const redirectUri = body.redirect_uri;
-      const clientId = body.client_id;
-      const codeVerifier = body.code_verifier;
-      if (!code || !codeVerifier || !clientId) {
-        return errorResponse(400, "invalid_request", "Missing required parameters");
-      }
-      const authCode = await store.getAuthCode(code);
-      if (!authCode) {
-        return errorResponse(400, "invalid_grant", "Invalid or expired authorization code");
-      }
-      await store.deleteAuthCode(code);
-      if (authCode.clientId !== clientId) {
-        return errorResponse(400, "invalid_grant", "client_id mismatch");
-      }
-      if (redirectUri && authCode.redirectUri !== redirectUri) {
-        return errorResponse(400, "invalid_grant", "redirect_uri mismatch");
-      }
-      const pkceValid = await verifyPkce(codeVerifier, authCode.codeChallenge);
-      if (!pkceValid) {
-        return errorResponse(400, "invalid_grant", "PKCE verification failed");
-      }
-      const key = await getSigningKey();
-      const now = Math.floor(Date.now() / 1e3);
-      const accessToken = await new SignJWT({
-        scope: authCode.scopes.join(" "),
-        email: authCode.email
-      }).setProtectedHeader({ alg: "HS256" }).setSubject(authCode.sub ?? authCode.email ?? authCode.clientId).setIssuer(config.resourceUrl).setAudience(config.resourceUrl).setIssuedAt(now).setExpirationTime(now + tokenTtl).sign(key);
-      const refreshToken = randomBytes(32).toString("base64url");
-      await store.saveRefreshToken(refreshToken, {
-        clientId: authCode.clientId,
-        scopes: authCode.scopes,
-        email: authCode.email,
-        sub: authCode.sub,
-        expiresAt: now + 30 * 24 * 3600
-      });
-      return jsonResponse(200, {
-        access_token: accessToken,
-        token_type: "Bearer",
-        expires_in: tokenTtl,
-        scope: authCode.scopes.join(" "),
-        refresh_token: refreshToken
-      });
+      return handleAuthorizationCode(body, store, getSigningKey, tokenConfig);
     },
     async verifyToken(token) {
       try {
@@ -503,7 +538,6 @@ function createOAuthProxy(config) {
       }
     }
   };
-  return provider;
 }
 
 // src/provider/google.ts
@@ -779,7 +813,6 @@ export {
   insufficientScope,
   invalidToken,
   matchRedirectUri,
-  missingToken,
   validateToken
 };
 //# sourceMappingURL=index.js.map