@spfn/auth 0.2.0-beta.70 → 0.2.0-beta.72

package/dist/server.js

@@ -5658,6 +5658,25 @@ var init_keys_repository = __esm({
         ).returning();
         return result[0] ?? null;
       }
+      /**
+       * 사용자의 모든 활성 공개키 revoke (비활성화)
+       *
+       * 비번 변경 시 전체 세션 로그아웃에 사용. authenticate는 활성 키만 검증하므로,
+       * revoke된 키로 서명한 기존 세션의 요청은 즉시 401이 된다.
+       * Write primary 사용
+       */
+      async revokeAllActiveByUserId(userId, reason) {
+        return await this.db.update(userPublicKeys).set({
+          isActive: false,
+          revokedAt: /* @__PURE__ */ new Date(),
+          revokedReason: reason
+        }).where(
+          and2(
+            eq2(userPublicKeys.userId, userId),
+            eq2(userPublicKeys.isActive, true)
+          )
+        ).returning();
+      }
       /**
        * 공개키 삭제
        * Write primary 사용
@@ -6936,13 +6955,23 @@ function getPublicKeyObject(publicKeyB64) {
   publicKeyCache.set(publicKeyB64, keyObject);
   return keyObject;
 }
+var INSECURE_JWT_SECRET = "dev-secret-key-change-in-production";
+function getJwtSecret() {
+  const secret = env2.SPFN_AUTH_JWT_SECRET;
+  if ((!secret || secret === INSECURE_JWT_SECRET) && process.env.NODE_ENV === "production") {
+    throw new Error(
+      "SPFN_AUTH_JWT_SECRET must be set to a strong secret in production (the default is public)."
+    );
+  }
+  return secret;
+}
 function generateToken(payload) {
-  return jwt.sign(payload, env2.SPFN_AUTH_JWT_SECRET, {
+  return jwt.sign(payload, getJwtSecret(), {
     expiresIn: env2.SPFN_AUTH_JWT_EXPIRES_IN
   });
 }
 function verifyToken(token) {
-  return jwt.verify(token, env2.SPFN_AUTH_JWT_SECRET, { algorithms: ["HS256"] });
+  return jwt.verify(token, getJwtSecret(), { algorithms: ["HS256"] });
 }
 function verifyClientToken(token, publicKeyB64, algorithm) {
   const publicKeyObject = getPublicKeyObject(publicKeyB64);
@@ -7082,6 +7111,9 @@ async function validateVerificationCode(target, code, purpose) {
   if (!record) {
     return { valid: false, error: "Invalid verification code" };
   }
+  if (record.attempts >= MAX_VERIFICATION_ATTEMPTS) {
+    return { valid: false, error: "Too many attempts, please request a new code" };
+  }
   if (record.code !== code) {
     await verificationCodesRepository.incrementAttempts(record.id);
     return { valid: false, error: "Invalid verification code" };
@@ -7092,9 +7124,6 @@ async function validateVerificationCode(target, code, purpose) {
   if (/* @__PURE__ */ new Date() > new Date(record.expiresAt)) {
     return { valid: false, error: "Verification code expired" };
   }
-  if (record.attempts >= MAX_VERIFICATION_ATTEMPTS) {
-    return { valid: false, error: "Too many attempts, please request a new code" };
-  }
   return { valid: true, codeId: record.id };
 }
 async function markCodeAsUsed(codeId) {
@@ -7549,6 +7578,7 @@ async function changePasswordService(params) {
   }
   const newPasswordHash = await hashPassword(newPassword);
   await usersRepository.updatePassword(userId, newPasswordHash, true);
+  await keysRepository.revokeAllActiveByUserId(userId, "Revoked by password change");
 }
 
 // src/server/services/rbac.service.ts
@@ -7574,6 +7604,10 @@ var COOKIE_NAMES = {
   /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
   get OAUTH_PENDING() {
     return `spfn_oauth_pending${getCookieSuffix()}`;
+  },
+  /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
+  get OAUTH_CSRF() {
+    return `spfn_oauth_csrf${getCookieSuffix()}`;
   }
 };
 function parseDuration(duration) {
@@ -8287,11 +8321,14 @@ function generateNonce() {
   crypto.getRandomValues(array);
   return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
 }
+function generateOAuthNonce() {
+  return generateNonce();
+}
 async function createOAuthState(params) {
   const key = await getStateKey();
   const state = {
     returnUrl: params.returnUrl,
-    nonce: generateNonce(),
+    nonce: params.nonce ?? generateNonce(),
     provider: params.provider,
     publicKey: params.publicKey,
     keyId: params.keyId,
@@ -8509,7 +8546,7 @@ function tokenExpiryDate(expiresIn) {
   return new Date(Date.now() + expiresIn * 1e3);
 }
 async function oauthStartService(params) {
-  const { provider, returnUrl, publicKey, keyId, fingerprint, algorithm, metadata } = params;
+  const { provider, returnUrl, publicKey, keyId, fingerprint, algorithm, metadata, nonce } = params;
   const oauthProvider = requireEnabledProvider(provider);
   const state = await createOAuthState({
     provider,
@@ -8518,13 +8555,19 @@ async function oauthStartService(params) {
     keyId,
     fingerprint,
     algorithm,
-    metadata
+    metadata,
+    nonce
   });
   return { authUrl: oauthProvider.getAuthUrl(state) };
 }
 async function oauthCallbackService(params) {
-  const { provider, code, state } = params;
+  const { provider, code, state, expectedNonce } = params;
   const stateData = await verifyOAuthState(state);
+  if (!expectedNonce || stateData.nonce !== expectedNonce) {
+    throw new ValidationError5({
+      message: "OAuth state validation failed"
+    });
+  }
   if (stateData.provider !== provider) {
     throw new ValidationError5({
       message: "OAuth state provider mismatch"
@@ -9251,7 +9294,8 @@ var acceptInvitation2 = route2.post("/_auth/invitations/accept").input({
     }),
     password: Type.String({
       minLength: 8,
-      description: "User password (minimum 8 characters)"
+      maxLength: 72,
+      description: "User password (8\u201372 characters). bcrypt silently ignores bytes past 72, so longer inputs are rejected rather than truncated."
     })
   })
 }).interceptor({
@@ -9477,6 +9521,193 @@ var userRouter = defineRouter3({
 
 // src/server/routes/oauth/index.ts
 init_esm();
+
+// ../../node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/url.js
+var tryDecode = (str, decoder) => {
+  try {
+    return decoder(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
+      try {
+        return decoder(match);
+      } catch {
+        return match;
+      }
+    });
+  }
+};
+var decodeURIComponent_ = decodeURIComponent;
+
+// ../../node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/cookie.js
+var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
+var trimCookieWhitespace = (value) => {
+  let start = 0;
+  let end = value.length;
+  while (start < end) {
+    const charCode = value.charCodeAt(start);
+    if (charCode !== 32 && charCode !== 9) {
+      break;
+    }
+    start++;
+  }
+  while (end > start) {
+    const charCode = value.charCodeAt(end - 1);
+    if (charCode !== 32 && charCode !== 9) {
+      break;
+    }
+    end--;
+  }
+  return start === 0 && end === value.length ? value : value.slice(start, end);
+};
+var parse = (cookie, name) => {
+  if (name && cookie.indexOf(name) === -1) {
+    return {};
+  }
+  const pairs = cookie.split(";");
+  const parsedCookie = /* @__PURE__ */ Object.create(null);
+  for (const pairStr of pairs) {
+    const valueStartPos = pairStr.indexOf("=");
+    if (valueStartPos === -1) {
+      continue;
+    }
+    const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
+    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
+      continue;
+    }
+    let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));
+    if (cookieValue.startsWith('"') && cookieValue.endsWith('"')) {
+      cookieValue = cookieValue.slice(1, -1);
+    }
+    if (validCookieValueRegEx.test(cookieValue)) {
+      parsedCookie[cookieName] = cookieValue.indexOf("%") !== -1 ? tryDecode(cookieValue, decodeURIComponent_) : cookieValue;
+      if (name) {
+        break;
+      }
+    }
+  }
+  return parsedCookie;
+};
+var _serialize = (name, value, opt = {}) => {
+  if (!validCookieNameRegEx.test(name)) {
+    throw new Error("Invalid cookie name");
+  }
+  let cookie = `${name}=${value}`;
+  if (name.startsWith("__Secure-") && !opt.secure) {
+    throw new Error("__Secure- Cookie must have Secure attributes");
+  }
+  if (name.startsWith("__Host-")) {
+    if (!opt.secure) {
+      throw new Error("__Host- Cookie must have Secure attributes");
+    }
+    if (opt.path !== "/") {
+      throw new Error('__Host- Cookie must have Path attributes with "/"');
+    }
+    if (opt.domain) {
+      throw new Error("__Host- Cookie must not have Domain attributes");
+    }
+  }
+  for (const key of ["domain", "path", "sameSite", "priority"]) {
+    if (opt[key] && /[;\r\n]/.test(opt[key])) {
+      throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
+    }
+  }
+  if (opt && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
+    if (opt.maxAge > 3456e4) {
+      throw new Error(
+        "Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration."
+      );
+    }
+    cookie += `; Max-Age=${opt.maxAge | 0}`;
+  }
+  if (opt.domain && opt.prefix !== "host") {
+    cookie += `; Domain=${opt.domain}`;
+  }
+  if (opt.path) {
+    cookie += `; Path=${opt.path}`;
+  }
+  if (opt.expires) {
+    if (opt.expires.getTime() - Date.now() > 3456e7) {
+      throw new Error(
+        "Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future."
+      );
+    }
+    cookie += `; Expires=${opt.expires.toUTCString()}`;
+  }
+  if (opt.httpOnly) {
+    cookie += "; HttpOnly";
+  }
+  if (opt.secure) {
+    cookie += "; Secure";
+  }
+  if (opt.sameSite) {
+    cookie += `; SameSite=${opt.sameSite.charAt(0).toUpperCase() + opt.sameSite.slice(1)}`;
+  }
+  if (opt.priority) {
+    cookie += `; Priority=${opt.priority.charAt(0).toUpperCase() + opt.priority.slice(1)}`;
+  }
+  if (opt.partitioned) {
+    if (!opt.secure) {
+      throw new Error("Partitioned Cookie must have Secure attributes");
+    }
+    cookie += "; Partitioned";
+  }
+  return cookie;
+};
+var serialize = (name, value, opt) => {
+  value = encodeURIComponent(value);
+  return _serialize(name, value, opt);
+};
+
+// ../../node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/helper/cookie/index.js
+var getCookie = (c, key, prefix) => {
+  const cookie = c.req.raw.headers.get("Cookie");
+  if (typeof key === "string") {
+    if (!cookie) {
+      return void 0;
+    }
+    let finalKey = key;
+    if (prefix === "secure") {
+      finalKey = "__Secure-" + key;
+    } else if (prefix === "host") {
+      finalKey = "__Host-" + key;
+    }
+    const obj2 = parse(cookie, finalKey);
+    return obj2[finalKey];
+  }
+  if (!cookie) {
+    return {};
+  }
+  const obj = parse(cookie);
+  return obj;
+};
+var generateCookie = (name, value, opt) => {
+  let cookie;
+  if (opt?.prefix === "secure") {
+    cookie = serialize("__Secure-" + name, value, { path: "/", ...opt, secure: true });
+  } else if (opt?.prefix === "host") {
+    cookie = serialize("__Host-" + name, value, {
+      ...opt,
+      path: "/",
+      secure: true,
+      domain: void 0
+    });
+  } else {
+    cookie = serialize(name, value, { path: "/", ...opt });
+  }
+  return cookie;
+};
+var setCookie = (c, name, value, opt) => {
+  const cookie = generateCookie(name, value, opt);
+  c.header("Set-Cookie", cookie, { append: true });
+};
+var deleteCookie = (c, name, opt) => {
+  const deletedCookie = getCookie(c, name, opt?.prefix);
+  setCookie(c, name, "", { ...opt, maxAge: 0 });
+  return deletedCookie;
+};
+
+// src/server/routes/oauth/index.ts
 init_types();
 import { Transactional as Transactional3 } from "@spfn/core/db";
 import { ValidationError as ValidationError7 } from "@spfn/core/errors";
@@ -9525,11 +9756,14 @@ var oauthGoogleCallback = route4.get("/_auth/oauth/google/callback").input({
   if (!query.code || !query.state) {
     return c.redirect(buildOAuthErrorUrl("Missing authorization code or state"));
   }
+  const expectedNonce = getCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF);
+  deleteCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, { path: "/" });
   try {
     const result = await oauthCallbackService({
       provider: "google",
       code: query.code,
-      state: query.state
+      state: query.state,
+      expectedNonce
     });
     return c.redirect(result.redirectUrl);
   } catch (err) {
@@ -9563,7 +9797,15 @@ var oauthStart = route4.post("/_auth/oauth/start").input({
   })
 }).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
-  const result = await oauthStartService(body);
+  const nonce = generateOAuthNonce();
+  setCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, nonce, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "Lax",
+    maxAge: 600,
+    path: "/"
+  });
+  const result = await oauthStartService({ ...body, nonce });
   return result;
 });
 var oauthProviders = route4.get("/_auth/oauth/providers").skip(["auth"]).handler(async () => {
@@ -9647,11 +9889,14 @@ var oauthProviderCallback = route4.get("/_auth/oauth/:provider/callback").input(
   if (!query.code || !query.state) {
     return c.redirect(buildOAuthErrorUrl("Missing authorization code or state"));
   }
+  const expectedNonce = getCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF);
+  deleteCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, { path: "/" });
   try {
     const result = await oauthCallbackService({
       provider: params.provider,
       code: query.code,
-      state: query.state
+      state: query.state,
+      expectedNonce
     });
     return c.redirect(result.redirectUrl);
   } catch (err) {
@@ -10233,6 +10478,7 @@ export {
   generateKeyPair,
   generateKeyPairES256,
   generateKeyPairRS256,
+  generateOAuthNonce,
   generateToken,
   getAllRoles,
   getAuth,