@silkweave/auth 2.6.1 → 3.1.0

package/build/oauth.mjs

@@ -0,0 +1,621 @@
+import { randomBytes, randomUUID } from "crypto";
+import { SignJWT, jwtVerify } from "jose";
+import { existsSync, readFileSync, writeFileSync } from "fs";
+//#region src/store/memory-store.ts
+function withTtl$1(map, key) {
+	const item = map.get(key);
+	if (!item) return;
+	if (item.expiresAt < Date.now() / 1e3) {
+		map.delete(key);
+		return;
+	}
+	return item;
+}
+function createMemoryStore() {
+	const authCodes = /* @__PURE__ */ new Map();
+	const pendingAuths = /* @__PURE__ */ new Map();
+	const pkceVerifiers = /* @__PURE__ */ new Map();
+	const clients = /* @__PURE__ */ new Map();
+	const refreshTokens = /* @__PURE__ */ new Map();
+	return {
+		async saveAuthCode(code, data) {
+			authCodes.set(code, data);
+		},
+		async getAuthCode(code) {
+			return withTtl$1(authCodes, code);
+		},
+		async deleteAuthCode(code) {
+			authCodes.delete(code);
+		},
+		async savePendingAuth(state, data) {
+			pendingAuths.set(state, data);
+		},
+		async getPendingAuth(state) {
+			return withTtl$1(pendingAuths, state);
+		},
+		async deletePendingAuth(state) {
+			pendingAuths.delete(state);
+		},
+		async savePkceVerifier(state, verifier) {
+			pkceVerifiers.set(state, {
+				verifier,
+				expiresAt: Date.now() / 1e3 + 600
+			});
+		},
+		async getPkceVerifier(state) {
+			const item = pkceVerifiers.get(state);
+			if (!item) return;
+			if (item.expiresAt < Date.now() / 1e3) {
+				pkceVerifiers.delete(state);
+				return;
+			}
+			return item.verifier;
+		},
+		async deletePkceVerifier(state) {
+			pkceVerifiers.delete(state);
+		},
+		async saveClient(clientId, data) {
+			clients.set(clientId, data);
+		},
+		async getClient(clientId) {
+			return clients.get(clientId);
+		},
+		async saveRefreshToken(token, data) {
+			refreshTokens.set(token, data);
+		},
+		async getRefreshToken(token) {
+			return withTtl$1(refreshTokens, token);
+		},
+		async deleteRefreshToken(token) {
+			refreshTokens.delete(token);
+		}
+	};
+}
+//#endregion
+//#region src/provider/uri.ts
+function matchRedirectUri(uri, patterns) {
+	return patterns.some((pattern) => {
+		return patternToRegex(pattern).test(uri);
+	});
+}
+function patternToRegex(pattern) {
+	const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+	return new RegExp(`^${escaped}$`);
+}
+//#endregion
+//#region src/provider/proxy.ts
+const CORS_HEADERS = {
+	"Access-Control-Allow-Origin": "*",
+	"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+	"Access-Control-Allow-Headers": "*"
+};
+function generateCode() {
+	return randomBytes(32).toString("base64url");
+}
+async function generatePkce() {
+	const verifier = randomBytes(32).toString("base64url");
+	const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return {
+		verifier,
+		challenge: Buffer.from(hash).toString("base64url")
+	};
+}
+async function verifyPkce(verifier, challenge) {
+	const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return Buffer.from(hash).toString("base64url") === challenge;
+}
+function jsonResponse(status, body, headers = {}) {
+	return {
+		status,
+		headers: {
+			"Content-Type": "application/json",
+			...CORS_HEADERS,
+			...headers
+		},
+		body
+	};
+}
+function redirectResponse(url) {
+	return {
+		status: 302,
+		headers: {
+			Location: url,
+			...CORS_HEADERS
+		},
+		body: void 0
+	};
+}
+function errorResponse(status, error, description) {
+	return jsonResponse(status, {
+		error,
+		error_description: description
+	});
+}
+async function signAccessToken(key, opts) {
+	const now = Math.floor(Date.now() / 1e3);
+	return new SignJWT({
+		scope: opts.scopes.join(" "),
+		email: opts.email
+	}).setProtectedHeader({ alg: "HS256" }).setSubject(opts.sub ?? opts.email ?? opts.clientId).setIssuer(opts.issuer).setAudience(opts.issuer).setIssuedAt(now).setExpirationTime(now + opts.ttl).sign(key);
+}
+async function handleRegister(req, store, allowedRedirectUris) {
+	const body = req.body;
+	if (!body) return errorResponse(400, "invalid_request", "Missing request body");
+	const redirectUris = body.redirect_uris;
+	if (!redirectUris) return errorResponse(400, "invalid_request", "redirect_uris is required");
+	let uris;
+	try {
+		uris = typeof redirectUris === "string" ? JSON.parse(redirectUris) : redirectUris;
+	} catch {
+		uris = [redirectUris];
+	}
+	if (!Array.isArray(uris) || uris.length === 0) return errorResponse(400, "invalid_request", "redirect_uris must be a non-empty array");
+	for (const uri of uris) if (!matchRedirectUri(uri, allowedRedirectUris)) return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
+	const clientId = randomUUID();
+	const clientSecret = randomBytes(32).toString("base64url");
+	const registration = {
+		clientId,
+		clientSecret,
+		redirectUris: uris,
+		clientName: body.client_name,
+		createdAt: Date.now() / 1e3
+	};
+	await store.saveClient(clientId, registration);
+	return jsonResponse(201, {
+		client_id: clientId,
+		client_secret: clientSecret,
+		redirect_uris: uris,
+		client_name: body.client_name,
+		token_endpoint_auth_method: "none"
+	});
+}
+async function resolveClient(clientId, store, allowedRedirectUris) {
+	const existing = await store.getClient(clientId);
+	if (existing) return existing;
+	if (!clientId.startsWith("https://")) return errorResponse(400, "invalid_client", "Unknown client_id");
+	try {
+		const metaRes = await fetch(clientId);
+		if (!metaRes.ok) return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
+		const meta = await metaRes.json();
+		const metaRedirectUris = meta.redirect_uris;
+		if (!Array.isArray(metaRedirectUris) || metaRedirectUris.length === 0) return errorResponse(400, "invalid_client", "Client metadata must include redirect_uris");
+		for (const uri of metaRedirectUris) if (!matchRedirectUri(uri, allowedRedirectUris)) return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
+		const client = {
+			clientId,
+			clientSecret: "",
+			redirectUris: metaRedirectUris,
+			clientName: meta.client_name,
+			createdAt: Date.now() / 1e3
+		};
+		await store.saveClient(clientId, client);
+		return client;
+	} catch {
+		return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
+	}
+}
+async function exchangeUpstreamCode(code, config, callbackPath, pkceVerifier) {
+	const tokenBody = new URLSearchParams({
+		grant_type: "authorization_code",
+		code,
+		redirect_uri: `${config.resourceUrl}${callbackPath}`,
+		client_id: config.clientId,
+		client_secret: config.clientSecret,
+		code_verifier: pkceVerifier
+	});
+	const tokenResponse = await fetch(config.tokenUrl, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: tokenBody.toString()
+	});
+	if (!tokenResponse.ok) {
+		const errorBody = await tokenResponse.text();
+		console.error("Upstream token exchange failed:", errorBody);
+		return errorResponse(502, "upstream_error", "Failed to exchange code with upstream provider");
+	}
+	const tokens = await tokenResponse.json();
+	return {
+		accessToken: tokens.access_token,
+		idToken: tokens.id_token
+	};
+}
+async function fetchUserinfo(userinfoUrl, accessToken) {
+	if (!userinfoUrl || !accessToken) return {};
+	try {
+		const res = await fetch(userinfoUrl, { headers: { Authorization: `Bearer ${accessToken}` } });
+		if (res.ok) {
+			const userinfo = await res.json();
+			return {
+				email: userinfo.email,
+				sub: userinfo.sub
+			};
+		}
+	} catch {}
+	return {};
+}
+async function handleRefreshToken(body, store, getSigningKey, config) {
+	const refreshToken = body.refresh_token;
+	if (!refreshToken) return errorResponse(400, "invalid_request", "Missing refresh_token");
+	const tokenData = await store.getRefreshToken(refreshToken);
+	if (!tokenData) return errorResponse(400, "invalid_grant", "Invalid or expired refresh token");
+	return jsonResponse(200, {
+		access_token: await signAccessToken(await getSigningKey(), {
+			scopes: tokenData.scopes,
+			email: tokenData.email,
+			sub: tokenData.sub,
+			clientId: tokenData.clientId,
+			issuer: config.resourceUrl,
+			ttl: config.tokenTtl
+		}),
+		token_type: "Bearer",
+		expires_in: config.tokenTtl,
+		scope: tokenData.scopes.join(" "),
+		refresh_token: refreshToken
+	});
+}
+async function handleAuthorizationCode(body, store, getSigningKey, config) {
+	const code = body.code;
+	const redirectUri = body.redirect_uri;
+	const clientId = body.client_id;
+	const codeVerifier = body.code_verifier;
+	if (!code || !codeVerifier || !clientId) return errorResponse(400, "invalid_request", "Missing required parameters");
+	const authCode = await store.getAuthCode(code);
+	if (!authCode) return errorResponse(400, "invalid_grant", "Invalid or expired authorization code");
+	await store.deleteAuthCode(code);
+	if (authCode.clientId !== clientId) return errorResponse(400, "invalid_grant", "client_id mismatch");
+	if (redirectUri && authCode.redirectUri !== redirectUri) return errorResponse(400, "invalid_grant", "redirect_uri mismatch");
+	if (!await verifyPkce(codeVerifier, authCode.codeChallenge)) return errorResponse(400, "invalid_grant", "PKCE verification failed");
+	const accessToken = await signAccessToken(await getSigningKey(), {
+		scopes: authCode.scopes,
+		email: authCode.email,
+		sub: authCode.sub,
+		clientId: authCode.clientId,
+		issuer: config.resourceUrl,
+		ttl: config.tokenTtl
+	});
+	const refreshToken = randomBytes(32).toString("base64url");
+	await store.saveRefreshToken(refreshToken, {
+		clientId: authCode.clientId,
+		scopes: authCode.scopes,
+		email: authCode.email,
+		sub: authCode.sub,
+		expiresAt: Math.floor(Date.now() / 1e3) + 720 * 3600
+	});
+	return jsonResponse(200, {
+		access_token: accessToken,
+		token_type: "Bearer",
+		expires_in: config.tokenTtl,
+		scope: authCode.scopes.join(" "),
+		refresh_token: refreshToken
+	});
+}
+function createOAuthProxy(config) {
+	const store = config.store ?? createMemoryStore();
+	const callbackPath = config.callbackPath ?? "/auth/callback";
+	const tokenTtl = config.tokenTtl ?? 3600;
+	const scopes = config.requiredScopes ?? [];
+	let signingKey = null;
+	async function getSigningKey() {
+		if (signingKey) return signingKey;
+		if (config.signingKey) signingKey = new TextEncoder().encode(config.signingKey);
+		else signingKey = randomBytes(32);
+		return signingKey;
+	}
+	return {
+		metadata() {
+			return jsonResponse(200, {
+				issuer: config.resourceUrl,
+				authorization_endpoint: `${config.resourceUrl}/authorize`,
+				token_endpoint: `${config.resourceUrl}/token`,
+				registration_endpoint: `${config.resourceUrl}/register`,
+				response_types_supported: ["code"],
+				grant_types_supported: ["authorization_code", "refresh_token"],
+				code_challenge_methods_supported: ["S256"],
+				token_endpoint_auth_methods_supported: ["none", "client_secret_post"],
+				scopes_supported: scopes
+			}, { "Cache-Control": "max-age=3600" });
+		},
+		register(req) {
+			return handleRegister(req, store, config.redirectUris);
+		},
+		async authorize(req) {
+			const params = req.url.searchParams;
+			const responseType = params.get("response_type");
+			const clientId = params.get("client_id");
+			const redirectUri = params.get("redirect_uri");
+			const scope = params.get("scope") ?? "";
+			const clientState = params.get("state") ?? "";
+			const codeChallenge = params.get("code_challenge");
+			const codeChallengeMethod = params.get("code_challenge_method");
+			const resource = params.get("resource");
+			if (responseType !== "code") return errorResponse(400, "unsupported_response_type", "Only response_type=code is supported");
+			if (!clientId) return errorResponse(400, "invalid_request", "client_id is required");
+			if (!redirectUri) return errorResponse(400, "invalid_request", "redirect_uri is required");
+			if (!codeChallenge || codeChallengeMethod !== "S256") return errorResponse(400, "invalid_request", "PKCE with S256 is required");
+			const result = await resolveClient(clientId, store, config.redirectUris);
+			if ("status" in result) return result;
+			if (!result.redirectUris.includes(redirectUri)) return errorResponse(400, "invalid_redirect_uri", "redirect_uri does not match registered URIs");
+			const proxyState = randomUUID();
+			const pkce = await generatePkce();
+			await store.savePendingAuth(proxyState, {
+				clientId,
+				redirectUri,
+				codeChallenge,
+				codeChallengeMethod,
+				scope,
+				clientState,
+				resource: resource ?? void 0,
+				expiresAt: Date.now() / 1e3 + 600
+			});
+			await store.savePkceVerifier(proxyState, pkce.verifier);
+			const upstreamScopes = scopes.length > 0 ? scopes.join(" ") : scope;
+			const upstreamUrl = new URL(config.authorizeUrl);
+			upstreamUrl.searchParams.set("response_type", "code");
+			upstreamUrl.searchParams.set("client_id", config.clientId);
+			upstreamUrl.searchParams.set("redirect_uri", `${config.resourceUrl}${callbackPath}`);
+			upstreamUrl.searchParams.set("scope", upstreamScopes);
+			upstreamUrl.searchParams.set("state", proxyState);
+			upstreamUrl.searchParams.set("code_challenge", pkce.challenge);
+			upstreamUrl.searchParams.set("code_challenge_method", "S256");
+			if (params.has("access_type")) upstreamUrl.searchParams.set("access_type", params.get("access_type"));
+			return redirectResponse(upstreamUrl.toString());
+		},
+		async callback(req) {
+			const params = req.url.searchParams;
+			const upstreamCode = params.get("code");
+			const proxyState = params.get("state");
+			const upstreamError = params.get("error");
+			if (upstreamError) return errorResponse(400, "upstream_error", params.get("error_description") ?? upstreamError);
+			if (!upstreamCode || !proxyState) return errorResponse(400, "invalid_request", "Missing code or state");
+			const pending = await store.getPendingAuth(proxyState);
+			if (!pending) return errorResponse(400, "invalid_request", "Unknown or expired state");
+			const pkceVerifier = await store.getPkceVerifier(proxyState);
+			if (!pkceVerifier) return errorResponse(400, "invalid_request", "Missing PKCE verifier");
+			await store.deletePendingAuth(proxyState);
+			await store.deletePkceVerifier(proxyState);
+			const upstream = await exchangeUpstreamCode(upstreamCode, config, callbackPath, pkceVerifier);
+			if ("status" in upstream) return upstream;
+			const userinfo = await fetchUserinfo(config.userinfoUrl, upstream.accessToken);
+			const mcpCode = generateCode();
+			await store.saveAuthCode(mcpCode, {
+				clientId: pending.clientId,
+				redirectUri: pending.redirectUri,
+				codeChallenge: pending.codeChallenge,
+				codeChallengeMethod: pending.codeChallengeMethod,
+				scopes: pending.scope.split(" ").filter(Boolean),
+				upstreamAccessToken: upstream.accessToken,
+				upstreamIdToken: upstream.idToken,
+				email: userinfo.email,
+				sub: userinfo.sub,
+				expiresAt: Date.now() / 1e3 + 600
+			});
+			const clientRedirect = new URL(pending.redirectUri);
+			clientRedirect.searchParams.set("code", mcpCode);
+			if (pending.clientState) clientRedirect.searchParams.set("state", pending.clientState);
+			return redirectResponse(clientRedirect.toString());
+		},
+		async token(req) {
+			const body = req.body;
+			if (!body) return errorResponse(400, "invalid_request", "Missing request body");
+			const tokenConfig = {
+				resourceUrl: config.resourceUrl,
+				tokenTtl
+			};
+			if (body.grant_type === "refresh_token") return handleRefreshToken(body, store, getSigningKey, tokenConfig);
+			if (body.grant_type !== "authorization_code") return errorResponse(400, "unsupported_grant_type", "Supported grant types: authorization_code, refresh_token");
+			return handleAuthorizationCode(body, store, getSigningKey, tokenConfig);
+		},
+		async verifyToken(token) {
+			try {
+				const { payload } = await jwtVerify(token, await getSigningKey(), {
+					issuer: config.resourceUrl,
+					audience: config.resourceUrl
+				});
+				return {
+					token,
+					clientId: payload.sub ?? void 0,
+					scopes: typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [],
+					expiresAt: payload.exp,
+					email: payload.email
+				};
+			} catch {
+				return;
+			}
+		}
+	};
+}
+//#endregion
+//#region src/provider/google.ts
+function google(options) {
+	const provider = createOAuthProxy({
+		authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+		tokenUrl: "https://oauth2.googleapis.com/token",
+		userinfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		resourceUrl: options.resourceUrl,
+		redirectUris: options.redirectUris,
+		requiredScopes: options.requiredScopes ?? ["openid", "email"],
+		callbackPath: options.callbackPath,
+		signingKey: options.signingKey,
+		tokenTtl: options.tokenTtl,
+		store: options.store
+	});
+	return {
+		verifyToken: (token) => provider.verifyToken(token),
+		required: true,
+		resourceUrl: options.resourceUrl,
+		authorizationServers: [options.resourceUrl],
+		provider,
+		callbackPath: options.callbackPath ?? "/auth/callback"
+	};
+}
+//#endregion
+//#region src/store/json-store.ts
+function withTtl(obj, key) {
+	const item = obj[key];
+	if (!item) return;
+	if (item.expiresAt < Date.now() / 1e3) {
+		delete obj[key];
+		return;
+	}
+	return item;
+}
+function writeJsonStore(path, store) {
+	writeFileSync(path, JSON.stringify(store, null, 2), "utf-8");
+}
+function readJsonStore(path) {
+	if (!existsSync(path)) return {
+		authCodes: {},
+		pendingAuths: {},
+		pkceVerifiers: {},
+		clients: {},
+		refreshTokens: {}
+	};
+	const data = JSON.parse(readFileSync(path, "utf-8"));
+	if (!data.refreshTokens) data.refreshTokens = {};
+	return data;
+}
+function createJsonStore(path) {
+	const store = readJsonStore(path);
+	return {
+		async saveAuthCode(code, data) {
+			store.authCodes[code] = data;
+			writeJsonStore(path, store);
+		},
+		async getAuthCode(code) {
+			return withTtl(store.authCodes, code);
+		},
+		async deleteAuthCode(code) {
+			delete store.authCodes[code];
+			writeJsonStore(path, store);
+		},
+		async savePendingAuth(state, data) {
+			store.pendingAuths[state] = data;
+			writeJsonStore(path, store);
+		},
+		async getPendingAuth(state) {
+			return withTtl(store.pendingAuths, state);
+		},
+		async deletePendingAuth(state) {
+			delete store.pendingAuths[state];
+			writeJsonStore(path, store);
+		},
+		async savePkceVerifier(state, verifier) {
+			store.pkceVerifiers[state] = {
+				verifier,
+				expiresAt: Date.now() / 1e3 + 600
+			};
+			writeJsonStore(path, store);
+		},
+		async getPkceVerifier(state) {
+			const item = store.pkceVerifiers[state];
+			if (!item) return;
+			if (item.expiresAt < Date.now() / 1e3) {
+				delete store.pkceVerifiers[state];
+				writeJsonStore(path, store);
+				return;
+			}
+			return item.verifier;
+		},
+		async deletePkceVerifier(state) {
+			delete store.pkceVerifiers[state];
+			writeJsonStore(path, store);
+		},
+		async saveClient(clientId, data) {
+			store.clients[clientId] = data;
+			writeJsonStore(path, store);
+		},
+		async getClient(clientId) {
+			return store.clients[clientId];
+		},
+		async saveRefreshToken(token, data) {
+			store.refreshTokens[token] = data;
+			writeJsonStore(path, store);
+		},
+		async getRefreshToken(token) {
+			return withTtl(store.refreshTokens, token);
+		},
+		async deleteRefreshToken(token) {
+			delete store.refreshTokens[token];
+			writeJsonStore(path, store);
+		}
+	};
+}
+//#endregion
+//#region src/store/redis-store.ts
+function createRedisStore(options) {
+	const { client, prefix = "silkweave:oauth:" } = options;
+	function key(namespace, id) {
+		return `${prefix}${namespace}:${id}`;
+	}
+	function ttlFromExpiry(expiresAt) {
+		const seconds = Math.floor(expiresAt - Date.now() / 1e3);
+		return seconds > 0 ? seconds : void 0;
+	}
+	async function save(namespace, id, data, expiresAt) {
+		const opts = {};
+		const ttl = expiresAt != null ? ttlFromExpiry(expiresAt) : void 0;
+		if (ttl != null) opts.ex = ttl;
+		await client.set(key(namespace, id), JSON.stringify(data), opts);
+	}
+	async function load(namespace, id) {
+		const raw = await client.get(key(namespace, id));
+		if (raw == null) return;
+		return typeof raw === "string" ? JSON.parse(raw) : raw;
+	}
+	async function remove(namespace, id) {
+		await client.del(key(namespace, id));
+	}
+	return {
+		async saveAuthCode(code, data) {
+			await save("auth-code", code, data, data.expiresAt);
+		},
+		async getAuthCode(code) {
+			return load("auth-code", code);
+		},
+		async deleteAuthCode(code) {
+			await remove("auth-code", code);
+		},
+		async savePendingAuth(state, data) {
+			await save("pending-auth", state, data, data.expiresAt);
+		},
+		async getPendingAuth(state) {
+			return load("pending-auth", state);
+		},
+		async deletePendingAuth(state) {
+			await remove("pending-auth", state);
+		},
+		async savePkceVerifier(state, verifier) {
+			const expiresAt = Date.now() / 1e3 + 600;
+			await save("pkce-verifier", state, {
+				verifier,
+				expiresAt
+			}, expiresAt);
+		},
+		async getPkceVerifier(state) {
+			return (await load("pkce-verifier", state))?.verifier;
+		},
+		async deletePkceVerifier(state) {
+			await remove("pkce-verifier", state);
+		},
+		async saveClient(clientId, data) {
+			await save("client", clientId, data);
+		},
+		async getClient(clientId) {
+			return load("client", clientId);
+		},
+		async saveRefreshToken(token, data) {
+			await save("refresh-token", token, data, data.expiresAt);
+		},
+		async getRefreshToken(token) {
+			return load("refresh-token", token);
+		},
+		async deleteRefreshToken(token) {
+			await remove("refresh-token", token);
+		}
+	};
+}
+//#endregion
+export { createJsonStore, createMemoryStore, createOAuthProxy, createRedisStore, google, matchRedirectUri };
+
+//# sourceMappingURL=oauth.mjs.map