@spfn/auth 0.2.0-beta.71 → 0.2.0-beta.74

package/dist/server.js

@@ -7604,6 +7604,10 @@ var COOKIE_NAMES = {
   /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
   get OAUTH_PENDING() {
     return `spfn_oauth_pending${getCookieSuffix()}`;
+  },
+  /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
+  get OAUTH_CSRF() {
+    return `spfn_oauth_csrf${getCookieSuffix()}`;
   }
 };
 function parseDuration(duration) {
@@ -8317,11 +8321,14 @@ function generateNonce() {
   crypto.getRandomValues(array);
   return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
 }
+function generateOAuthNonce() {
+  return generateNonce();
+}
 async function createOAuthState(params) {
   const key = await getStateKey();
   const state = {
     returnUrl: params.returnUrl,
-    nonce: generateNonce(),
+    nonce: params.nonce ?? generateNonce(),
     provider: params.provider,
     publicKey: params.publicKey,
     keyId: params.keyId,
@@ -8539,7 +8546,7 @@ function tokenExpiryDate(expiresIn) {
   return new Date(Date.now() + expiresIn * 1e3);
 }
 async function oauthStartService(params) {
-  const { provider, returnUrl, publicKey, keyId, fingerprint, algorithm, metadata } = params;
+  const { provider, returnUrl, publicKey, keyId, fingerprint, algorithm, metadata, nonce } = params;
   const oauthProvider = requireEnabledProvider(provider);
   const state = await createOAuthState({
     provider,
@@ -8548,13 +8555,19 @@ async function oauthStartService(params) {
     keyId,
     fingerprint,
     algorithm,
-    metadata
+    metadata,
+    nonce
   });
   return { authUrl: oauthProvider.getAuthUrl(state) };
 }
 async function oauthCallbackService(params) {
-  const { provider, code, state } = params;
+  const { provider, code, state, expectedNonce } = params;
   const stateData = await verifyOAuthState(state);
+  if (!expectedNonce || stateData.nonce !== expectedNonce) {
+    throw new ValidationError5({
+      message: "OAuth state validation failed"
+    });
+  }
   if (stateData.provider !== provider) {
     throw new ValidationError5({
       message: "OAuth state provider mismatch"
@@ -8764,7 +8777,56 @@ async function persistNativeLogin(identity, params) {
 // src/server/routes/auth/index.ts
 init_esm();
 import { Transactional } from "@spfn/core/db";
-import { rateLimit } from "@spfn/core/middleware";
+import { rateLimitPolicy } from "@spfn/core/middleware";
+
+// src/server/lib/rate-limit-keys.ts
+import { getClientIp } from "@spfn/core/middleware";
+async function readJsonBody(c) {
+  try {
+    return await c.req.json();
+  } catch {
+    return {};
+  }
+}
+function accountKey(body) {
+  if (typeof body.email === "string" && body.email.trim()) {
+    return `email:${body.email.trim().toLowerCase()}`;
+  }
+  if (typeof body.phone === "string" && body.phone.trim()) {
+    return `phone:${body.phone.trim()}`;
+  }
+  return void 0;
+}
+function targetKey(body) {
+  if (typeof body.target !== "string" || !body.target.trim()) {
+    return void 0;
+  }
+  const type = typeof body.targetType === "string" ? body.targetType : "target";
+  const value = type === "email" ? body.target.trim().toLowerCase() : body.target.trim();
+  return `${type}:${value}`;
+}
+function byIpAndAccount(options = {}) {
+  return async (c) => {
+    const body = await readJsonBody(c);
+    const account = accountKey(body);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      account ? `acct:${account}` : void 0
+    ];
+  };
+}
+function byIpAndTarget(options = {}) {
+  return async (c) => {
+    const body = await readJsonBody(c);
+    const target = targetKey(body);
+    return [
+      { key: `ip:${getClientIp(c)}`, limit: options.ipLimit },
+      target ? `tgt:${target}` : void 0
+    ];
+  };
+}
+
+// src/server/routes/auth/index.ts
 import { defineRouter, route } from "@spfn/core/route";
 var sendVerificationCode = route.post("/_auth/codes").input({
   body: Type.Object({
@@ -8774,7 +8836,7 @@ var sendVerificationCode = route.post("/_auth/codes").input({
     targetType: TargetTypeSchema,
     purpose: VerificationPurposeSchema
   })
-}).use([rateLimit({ limit: 5, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy("auth-code-send", { limit: 5, windowMs: 6e4, by: byIpAndTarget({ ipLimit: 20 }) })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await sendVerificationCodeService(body);
 });
@@ -8792,7 +8854,7 @@ var verifyCode = route.post("/_auth/codes/verify").input({
     }),
     purpose: VerificationPurposeSchema
   })
-}).use([rateLimit({ limit: 10, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy("auth-code-verify", { limit: 10, windowMs: 6e4, by: byIpAndTarget({ ipLimit: 50 }) })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await verifyCodeService(body);
 });
@@ -8819,7 +8881,7 @@ var register = route.post("/_auth/register").input({
     fingerprint: Type.String({ description: "Key fingerprint" }),
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" })
   })
-}).use([Transactional()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy("auth-register", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 100 }) }), Transactional()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await registerService(body);
 });
@@ -8844,7 +8906,7 @@ var login = route.post("/_auth/login").input({
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" }),
     oldKeyId: Type.Optional(Type.String({ description: "Previous key ID for rotation" }))
   })
-}).use([rateLimit({ limit: 10, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy("auth-login", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 100 }) }), Transactional()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await loginService(body);
 });
@@ -8884,7 +8946,7 @@ var changePassword = route.put("/_auth/password").input({
     })),
     newPassword: PasswordSchema
   })
-}).handler(async (c) => {
+}).use([rateLimitPolicy("auth-password-change", { limit: 10, windowMs: 6e4 })]).handler(async (c) => {
   const { body } = await c.data();
   const user = getUser(c);
   await changePasswordService({
@@ -9244,6 +9306,7 @@ function extractOTTHeader(header) {
 init_types();
 init_esm();
 import { Transactional as Transactional2 } from "@spfn/core/db";
+import { rateLimitPolicy as rateLimitPolicy2 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter2, route as route2 } from "@spfn/core/route";
 var INVITATION_STATUSES2 = ["pending", "accepted", "expired", "cancelled"];
 var getInvitation = route2.get("/_auth/invitations/:token").input({
@@ -9253,7 +9316,7 @@ var getInvitation = route2.get("/_auth/invitations/:token").input({
       description: "Invitation token (UUID v4)"
     })
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy2("auth-invitation-lookup", { limit: 30, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params } = await c.data();
   const token = params.token;
   const validation = await validateInvitation(token);
@@ -9292,7 +9355,7 @@ var acceptInvitation2 = route2.post("/_auth/invitations/accept").input({
     fingerprint: Type.String({ description: "Key fingerprint" }),
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" })
   })
-}).use([Transactional2()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy2("auth-invitation-accept", { limit: 10, windowMs: 6e4 }), Transactional2()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await acceptInvitation({
     token: body.token,
@@ -9442,6 +9505,7 @@ var invitationRouter = defineRouter2({
 
 // src/server/routes/users/index.ts
 init_esm();
+import { rateLimitPolicy as rateLimitPolicy3 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter3, route as route3 } from "@spfn/core/route";
 var getUserProfile = route3.get("/_auth/users/profile").handler(async (c) => {
   const { userId } = getAuth(c);
@@ -9473,7 +9537,7 @@ var checkUsername = route3.get("/_auth/users/username/check").input({
   query: Type.Object({
     username: Type.String({ minLength: 1 })
   })
-}).handler(async (c) => {
+}).use([rateLimitPolicy3("auth-username-check", { limit: 30, windowMs: 6e4 })]).handler(async (c) => {
   const { query } = await c.data();
   return { available: await checkUsernameAvailableService(query.username) };
 });
@@ -9508,10 +9572,197 @@ var userRouter = defineRouter3({
 
 // src/server/routes/oauth/index.ts
 init_esm();
+
+// ../../node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/url.js
+var tryDecode = (str, decoder) => {
+  try {
+    return decoder(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
+      try {
+        return decoder(match);
+      } catch {
+        return match;
+      }
+    });
+  }
+};
+var decodeURIComponent_ = decodeURIComponent;
+
+// ../../node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/cookie.js
+var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
+var trimCookieWhitespace = (value) => {
+  let start = 0;
+  let end = value.length;
+  while (start < end) {
+    const charCode = value.charCodeAt(start);
+    if (charCode !== 32 && charCode !== 9) {
+      break;
+    }
+    start++;
+  }
+  while (end > start) {
+    const charCode = value.charCodeAt(end - 1);
+    if (charCode !== 32 && charCode !== 9) {
+      break;
+    }
+    end--;
+  }
+  return start === 0 && end === value.length ? value : value.slice(start, end);
+};
+var parse = (cookie, name) => {
+  if (name && cookie.indexOf(name) === -1) {
+    return {};
+  }
+  const pairs = cookie.split(";");
+  const parsedCookie = /* @__PURE__ */ Object.create(null);
+  for (const pairStr of pairs) {
+    const valueStartPos = pairStr.indexOf("=");
+    if (valueStartPos === -1) {
+      continue;
+    }
+    const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
+    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
+      continue;
+    }
+    let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));
+    if (cookieValue.startsWith('"') && cookieValue.endsWith('"')) {
+      cookieValue = cookieValue.slice(1, -1);
+    }
+    if (validCookieValueRegEx.test(cookieValue)) {
+      parsedCookie[cookieName] = cookieValue.indexOf("%") !== -1 ? tryDecode(cookieValue, decodeURIComponent_) : cookieValue;
+      if (name) {
+        break;
+      }
+    }
+  }
+  return parsedCookie;
+};
+var _serialize = (name, value, opt = {}) => {
+  if (!validCookieNameRegEx.test(name)) {
+    throw new Error("Invalid cookie name");
+  }
+  let cookie = `${name}=${value}`;
+  if (name.startsWith("__Secure-") && !opt.secure) {
+    throw new Error("__Secure- Cookie must have Secure attributes");
+  }
+  if (name.startsWith("__Host-")) {
+    if (!opt.secure) {
+      throw new Error("__Host- Cookie must have Secure attributes");
+    }
+    if (opt.path !== "/") {
+      throw new Error('__Host- Cookie must have Path attributes with "/"');
+    }
+    if (opt.domain) {
+      throw new Error("__Host- Cookie must not have Domain attributes");
+    }
+  }
+  for (const key of ["domain", "path", "sameSite", "priority"]) {
+    if (opt[key] && /[;\r\n]/.test(opt[key])) {
+      throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
+    }
+  }
+  if (opt && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
+    if (opt.maxAge > 3456e4) {
+      throw new Error(
+        "Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration."
+      );
+    }
+    cookie += `; Max-Age=${opt.maxAge | 0}`;
+  }
+  if (opt.domain && opt.prefix !== "host") {
+    cookie += `; Domain=${opt.domain}`;
+  }
+  if (opt.path) {
+    cookie += `; Path=${opt.path}`;
+  }
+  if (opt.expires) {
+    if (opt.expires.getTime() - Date.now() > 3456e7) {
+      throw new Error(
+        "Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future."
+      );
+    }
+    cookie += `; Expires=${opt.expires.toUTCString()}`;
+  }
+  if (opt.httpOnly) {
+    cookie += "; HttpOnly";
+  }
+  if (opt.secure) {
+    cookie += "; Secure";
+  }
+  if (opt.sameSite) {
+    cookie += `; SameSite=${opt.sameSite.charAt(0).toUpperCase() + opt.sameSite.slice(1)}`;
+  }
+  if (opt.priority) {
+    cookie += `; Priority=${opt.priority.charAt(0).toUpperCase() + opt.priority.slice(1)}`;
+  }
+  if (opt.partitioned) {
+    if (!opt.secure) {
+      throw new Error("Partitioned Cookie must have Secure attributes");
+    }
+    cookie += "; Partitioned";
+  }
+  return cookie;
+};
+var serialize = (name, value, opt) => {
+  value = encodeURIComponent(value);
+  return _serialize(name, value, opt);
+};
+
+// ../../node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/helper/cookie/index.js
+var getCookie = (c, key, prefix) => {
+  const cookie = c.req.raw.headers.get("Cookie");
+  if (typeof key === "string") {
+    if (!cookie) {
+      return void 0;
+    }
+    let finalKey = key;
+    if (prefix === "secure") {
+      finalKey = "__Secure-" + key;
+    } else if (prefix === "host") {
+      finalKey = "__Host-" + key;
+    }
+    const obj2 = parse(cookie, finalKey);
+    return obj2[finalKey];
+  }
+  if (!cookie) {
+    return {};
+  }
+  const obj = parse(cookie);
+  return obj;
+};
+var generateCookie = (name, value, opt) => {
+  let cookie;
+  if (opt?.prefix === "secure") {
+    cookie = serialize("__Secure-" + name, value, { path: "/", ...opt, secure: true });
+  } else if (opt?.prefix === "host") {
+    cookie = serialize("__Host-" + name, value, {
+      ...opt,
+      path: "/",
+      secure: true,
+      domain: void 0
+    });
+  } else {
+    cookie = serialize(name, value, { path: "/", ...opt });
+  }
+  return cookie;
+};
+var setCookie = (c, name, value, opt) => {
+  const cookie = generateCookie(name, value, opt);
+  c.header("Set-Cookie", cookie, { append: true });
+};
+var deleteCookie = (c, name, opt) => {
+  const deletedCookie = getCookie(c, name, opt?.prefix);
+  setCookie(c, name, "", { ...opt, maxAge: 0 });
+  return deletedCookie;
+};
+
+// src/server/routes/oauth/index.ts
 init_types();
 import { Transactional as Transactional3 } from "@spfn/core/db";
 import { ValidationError as ValidationError7 } from "@spfn/core/errors";
-import { rateLimit as rateLimit2 } from "@spfn/core/middleware";
+import { rateLimitPolicy as rateLimitPolicy4 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter4, route as route4 } from "@spfn/core/route";
 var providerParams = Type.Object({
   provider: Type.Union(SOCIAL_PROVIDERS.map((p) => Type.Literal(p)), {
@@ -9524,7 +9775,7 @@ var oauthGoogleStart = route4.get("/_auth/oauth/google").input({
       description: "Encrypted OAuth state (returnUrl, publicKey, keyId, fingerprint, algorithm)"
     })
   })
-}).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { query } = await c.data();
   if (!isGoogleOAuthEnabled()) {
     return c.redirect(buildOAuthErrorUrl("Google OAuth is not configured"));
@@ -9547,7 +9798,7 @@ var oauthGoogleCallback = route4.get("/_auth/oauth/google/callback").input({
       description: "Error description from Google"
     }))
   })
-}).use([Transactional3()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-callback", { limit: 30, windowMs: 6e4 }), Transactional3()]).skip(["auth"]).handler(async (c) => {
   const { query } = await c.data();
   if (query.error) {
     const errorMessage = query.error_description || query.error;
@@ -9556,11 +9807,14 @@ var oauthGoogleCallback = route4.get("/_auth/oauth/google/callback").input({
   if (!query.code || !query.state) {
     return c.redirect(buildOAuthErrorUrl("Missing authorization code or state"));
   }
+  const expectedNonce = getCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF);
+  deleteCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, { path: "/" });
   try {
     const result = await oauthCallbackService({
       provider: "google",
       code: query.code,
-      state: query.state
+      state: query.state,
+      expectedNonce
     });
     return c.redirect(result.redirectUrl);
   } catch (err) {
@@ -9592,9 +9846,17 @@ var oauthStart = route4.post("/_auth/oauth/start").input({
       description: "Custom metadata passed to authRegisterEvent (e.g. referral code, UTM params)"
     }))
   })
-}).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
-  const result = await oauthStartService(body);
+  const nonce = generateOAuthNonce();
+  setCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, nonce, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "Lax",
+    maxAge: 600,
+    path: "/"
+  });
+  const result = await oauthStartService({ ...body, nonce });
   return result;
 });
 var oauthProviders = route4.get("/_auth/oauth/providers").skip(["auth"]).handler(async () => {
@@ -9611,7 +9873,7 @@ var getGoogleOAuthUrl = route4.post("/_auth/oauth/google/url").input({
       description: "Encrypted OAuth state (injected by interceptor)"
     }))
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (!isGoogleOAuthEnabled()) {
     throw new ValidationError7({ message: "Google OAuth is not configured" });
@@ -9629,7 +9891,7 @@ var oauthFinalize = route4.post("/_auth/oauth/finalize").input({
     keyId: Type.String({ description: "Key ID from OAuth state" }),
     returnUrl: Type.Optional(Type.String({ description: "URL to redirect after login" }))
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return {
     success: true,
@@ -9645,7 +9907,7 @@ var oauthProviderStart = route4.get("/_auth/oauth/:provider").input({
       description: "Encrypted OAuth state (returnUrl, publicKey, keyId, fingerprint, algorithm)"
     })
   })
-}).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params, query } = await c.data();
   const provider = getOAuthProvider(params.provider);
   if (!provider?.isEnabled()) {
@@ -9669,7 +9931,7 @@ var oauthProviderCallback = route4.get("/_auth/oauth/:provider/callback").input(
       description: "Error description from provider"
     }))
   })
-}).use([Transactional3()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-callback", { limit: 30, windowMs: 6e4 }), Transactional3()]).skip(["auth"]).handler(async (c) => {
   const { params, query } = await c.data();
   if (query.error) {
     const errorMessage = query.error_description || query.error;
@@ -9678,11 +9940,14 @@ var oauthProviderCallback = route4.get("/_auth/oauth/:provider/callback").input(
   if (!query.code || !query.state) {
     return c.redirect(buildOAuthErrorUrl("Missing authorization code or state"));
   }
+  const expectedNonce = getCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF);
+  deleteCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, { path: "/" });
   try {
     const result = await oauthCallbackService({
       provider: params.provider,
       code: query.code,
-      state: query.state
+      state: query.state,
+      expectedNonce
     });
     return c.redirect(result.redirectUrl);
   } catch (err) {
@@ -9700,7 +9965,7 @@ var getProviderOAuthUrl = route4.post("/_auth/oauth/:provider/url").input({
       description: "Encrypted OAuth state (injected by interceptor)"
     }))
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params, body } = await c.data();
   const provider = requireEnabledProvider(params.provider);
   if (!body.state) {
@@ -9730,7 +9995,7 @@ var oauthNative = route4.post("/_auth/oauth/:provider/native").input({
       description: "Custom metadata passed to auth events (e.g. referral code, UTM params)"
     }))
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy4("oauth-native", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params, body } = await c.data();
   return await oauthNativeService({ provider: params.provider, ...body });
 });
@@ -10264,6 +10529,7 @@ export {
   generateKeyPair,
   generateKeyPairES256,
   generateKeyPairRS256,
+  generateOAuthNonce,
   generateToken,
   getAllRoles,
   getAuth,