@spfn/auth 0.2.0-beta.87 → 0.2.0-beta.89

package/dist/client-proof.js

@@ -496,6 +496,18 @@ var ClientProofRefusal = class _ClientProofRefusal {
   static unprocessable() {
     return contractViolation("the request could not be processed");
   }
+  /**
+   * A client that ships separately from the server said nothing about which
+   * contract it was built against. Without it the server cannot tell whether
+   * the two ends agree, and answering as though they do is what produces the
+   * undecodable body this check exists to replace.
+   */
+  static contractVersionMissing() {
+    return contractViolation("a client of this kind must state the contract version it was generated from");
+  }
+  static contractVersionUnsupported() {
+    return contractViolation("the stated contract version is outside the range this server serves");
+  }
   // ---- the profile allowlist ----------------------------------------------
   static profileRejected() {
     return new _ClientProofRefusal("PROFILE_REJECTED", "the named auth profile is not on this contract's allowlist");
@@ -983,6 +995,36 @@ var AUTH_SURFACE_OPERATIONS = [
     requestType: "RotateKeyRequest",
     responseType: "RotateKeyResponse",
     summary: "Replaces the authenticated key with a new client-generated public key before its TTL runs out."
+  },
+  {
+    id: "auth.keys.list",
+    method: "POST",
+    path: "/_auth/keys/list",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "ListKeysRequest",
+    responseType: "ListKeysResponse",
+    summary: "Lists the keys registered to the caller, one per device that can sign for them."
+  },
+  {
+    id: "auth.keys.revoke",
+    method: "POST",
+    path: "/_auth/keys/revoke",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "RevokeKeyRequest",
+    responseType: "RevokeKeyResponse",
+    summary: "Revokes one of the caller's keys, signing that device out."
+  },
+  {
+    id: "auth.keys.revokeAll",
+    method: "POST",
+    path: "/_auth/keys/revoke-all",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "RevokeAllKeysRequest",
+    responseType: "RevokeAllKeysResponse",
+    summary: "Revokes every key the caller has, sparing the calling device unless asked otherwise."
   }
 ];
 var ContractTypeError = class extends Error {
@@ -1015,17 +1057,17 @@ function decodeListItemsRequest(value) {
   }
   return request;
 }
-function objectWithKeys(value, required, optional) {
+function objectWithKeys(value, required2, optional2) {
   if (!(value instanceof Map)) {
     throw new ContractTypeError();
   }
-  for (const key of required) {
+  for (const key of required2) {
     if (!value.has(key)) {
       throw new ContractTypeError();
     }
   }
   for (const key of value.keys()) {
-    if (!required.includes(key) && !optional.includes(key)) {
+    if (!required2.includes(key) && !optional2.includes(key)) {
       throw new ContractTypeError();
     }
   }
@@ -1221,6 +1263,289 @@ function answer(status, value) {
   return new Response(buffer, { status, headers: { "content-type": "application/json" } });
 }
 
+// src/server/client-proof/contract-bundle.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/server/types.ts
+var KEY_ALGORITHM = ["ES256", "RS256"];
+
+// src/server/client-proof/wire-headers.ts
+var CLIENT_IDENTITY_HEADERS = {
+  kind: "x-spfn-client-kind",
+  version: "x-spfn-client-version",
+  contractVersion: "x-spfn-client-contract-version"
+};
+var SERVER_CONTRACT_HEADERS = {
+  version: "x-spfn-server-contract-version",
+  supportedRange: "x-spfn-supported-contract-range"
+};
+var CLIENT_KINDS = ["web", "ios", "android"];
+function isAppKind(kind) {
+  return kind !== "web";
+}
+
+// src/server/client-proof/contract-bundle.ts
+var CONTRACT_VERSION = "0.6.0";
+var CONTRACT_MAJOR = 0;
+var CONTRACT_SUPPORTED_RANGE = ">=0.6.0 <0.7.0";
+function required(name, type) {
+  return { name, type, optional: false };
+}
+function optional(name, type) {
+  return { name, type, optional: true };
+}
+var CONTRACT_TYPES = [
+  {
+    name: "HandshakeRequest",
+    fields: [
+      required("clientId", "string"),
+      required("keyId", "string"),
+      required("nonce", "string"),
+      required("issuedAtMillis", "integer")
+    ]
+  },
+  {
+    name: "HandshakeResponse",
+    fields: [
+      required("sessionId", "string"),
+      required("expiresAtMillis", "integer")
+    ]
+  },
+  {
+    name: "EchoRequest",
+    fields: [
+      required("message", "string"),
+      required("sequence", "integer")
+    ]
+  },
+  {
+    name: "EchoResponse",
+    fields: [
+      required("message", "string"),
+      required("sequence", "integer"),
+      required("serverTimeMillis", "integer")
+    ]
+  },
+  {
+    name: "ListItemsRequest",
+    fields: [
+      required("limit", "integer"),
+      optional("cursor", "string")
+    ]
+  },
+  {
+    name: "Item",
+    fields: [
+      required("id", "string"),
+      required("name", "string"),
+      required("updatedAtMillis", "integer")
+    ]
+  },
+  {
+    name: "ListItemsResponse",
+    fields: [
+      required("items", "array<Item>"),
+      optional("nextCursor", "string")
+    ]
+  },
+  {
+    name: "RegisterRequest",
+    fields: [
+      optional("email", "string"),
+      optional("phone", "string"),
+      required("verificationToken", "string"),
+      required("password", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm")
+    ]
+  },
+  {
+    name: "RegisterResponse",
+    fields: [
+      required("userId", "string"),
+      required("publicId", "string"),
+      optional("email", "string"),
+      optional("phone", "string")
+    ]
+  },
+  {
+    name: "LoginRequest",
+    fields: [
+      optional("email", "string"),
+      optional("phone", "string"),
+      required("password", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm"),
+      optional("oldKeyId", "string")
+    ]
+  },
+  {
+    name: "LoginResponse",
+    fields: [
+      required("userId", "string"),
+      required("publicId", "string"),
+      optional("email", "string"),
+      optional("phone", "string"),
+      required("passwordChangeRequired", "boolean")
+    ]
+  },
+  {
+    name: "OauthNativeRequest",
+    fields: [
+      required("idToken", "string"),
+      required("nonce", "string"),
+      optional("accessToken", "string"),
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm")
+    ]
+  },
+  {
+    name: "OauthNativeResponse",
+    fields: [
+      required("userId", "string"),
+      required("keyId", "string"),
+      required("isNewUser", "boolean")
+    ]
+  },
+  {
+    name: "RotateKeyRequest",
+    fields: [
+      required("publicKey", "string"),
+      required("keyId", "string"),
+      required("fingerprint", "string"),
+      required("algorithm", "KeyAlgorithm")
+    ]
+  },
+  {
+    name: "RotateKeyResponse",
+    fields: [
+      required("success", "boolean"),
+      required("keyId", "string")
+    ]
+  },
+  {
+    name: "ListKeysRequest",
+    fields: [
+      optional("includeRevoked", "boolean")
+    ]
+  },
+  {
+    name: "KeySummary",
+    fields: [
+      required("keyId", "string"),
+      optional("deviceName", "string"),
+      optional("platform", "string"),
+      required("algorithm", "KeyAlgorithm"),
+      required("fingerprintPrefix", "string"),
+      required("createdAtMillis", "integer"),
+      optional("lastUsedAtMillis", "integer"),
+      optional("expiresAtMillis", "integer"),
+      required("isExpired", "boolean"),
+      required("isActive", "boolean"),
+      optional("revokedAtMillis", "integer")
+    ]
+  },
+  {
+    name: "ListKeysResponse",
+    fields: [
+      required("keys", "array<KeySummary>")
+    ]
+  },
+  {
+    name: "RevokeKeyRequest",
+    fields: [
+      required("keyId", "string")
+    ]
+  },
+  {
+    name: "RevokeKeyResponse",
+    fields: [
+      required("keyId", "string"),
+      required("selfRevoked", "boolean")
+    ]
+  },
+  {
+    name: "RevokeAllKeysRequest",
+    fields: [
+      optional("includeCurrent", "boolean")
+    ]
+  },
+  {
+    name: "RevokeAllKeysResponse",
+    fields: [
+      required("revokedCount", "integer"),
+      required("currentKeyRevoked", "boolean")
+    ]
+  }
+];
+var CONTRACT_ENUMS = [
+  { name: "KeyAlgorithm", values: [...KEY_ALGORITHM] }
+];
+var BUNDLE_FILENAME = "spfn-mobile-contract.json";
+var BUNDLE_REPO_PATH = `contracts/mobile/${BUNDLE_FILENAME}`;
+
+// src/server/client-proof/wire-version.ts
+function readClientIdentity(headers) {
+  const kind = headers.get(CLIENT_IDENTITY_HEADERS.kind);
+  if (kind === null || !isClientKind(kind)) {
+    return null;
+  }
+  return {
+    kind,
+    version: headers.get(CLIENT_IDENTITY_HEADERS.version),
+    contractVersion: headers.get(CLIENT_IDENTITY_HEADERS.contractVersion)
+  };
+}
+function isClientKind(value) {
+  return CLIENT_KINDS.includes(value);
+}
+function isContractVersionSupported(clientVersion) {
+  const client = parseVersion(clientVersion);
+  if (client === null) {
+    return false;
+  }
+  const server = parseVersion(CONTRACT_VERSION);
+  if (server === null || client.major !== server.major) {
+    return false;
+  }
+  return CONTRACT_MAJOR > 0 || client.minor === server.minor;
+}
+function parseVersion(raw) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(raw);
+  if (match === null) {
+    return null;
+  }
+  return { major: Number(match[1]), minor: Number(match[2]) };
+}
+function judgeClientIdentity(identity) {
+  if (identity === null || !isAppKind(identity.kind)) {
+    return null;
+  }
+  if (identity.contractVersion === null) {
+    return ClientProofRefusal.contractVersionMissing();
+  }
+  if (!isContractVersionSupported(identity.contractVersion)) {
+    return ClientProofRefusal.contractVersionUnsupported();
+  }
+  return null;
+}
+function applyServerContractHeaders(headers) {
+  headers.set(SERVER_CONTRACT_HEADERS.version, CONTRACT_VERSION);
+  headers.set(SERVER_CONTRACT_HEADERS.supportedRange, CONTRACT_SUPPORTED_RANGE);
+}
+function serverContractHeaders() {
+  return {
+    [SERVER_CONTRACT_HEADERS.version]: CONTRACT_VERSION,
+    [SERVER_CONTRACT_HEADERS.supportedRange]: CONTRACT_SUPPORTED_RANGE
+  };
+}
+
 // src/server/client-proof/dev-handler.ts
 var MAX_BODY_BYTES = 1 << 20;
 var HTTP_OK2 = 200;
@@ -1338,7 +1663,7 @@ function listItems(request) {
 function contractResponse(status, body) {
   return new Response(toArrayBuffer(body), {
     status,
-    headers: { "content-type": "application/json" }
+    headers: { "content-type": "application/json", ...serverContractHeaders() }
   });
 }
 async function readBodyCapped(request) {
@@ -1389,7 +1714,8 @@ function createClientProofGuard(state, options = {}) {
       const bytes = admission.refusal.envelopeBytes(newHexId());
       const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
       return c.newResponse(buffer, admission.refusal.httpStatus, {
-        "content-type": "application/json"
+        "content-type": "application/json",
+        ...serverContractHeaders()
       });
     }
     c.set("clientType", "mobile");
@@ -1401,9 +1727,36 @@ function createClientProofGuard(state, options = {}) {
     return void 0;
   };
 }
+
+// src/server/client-proof/version-middleware.ts
+var CLIENT_IDENTITY_CONTEXT_KEY = "clientIdentity";
+function createClientVersionMiddleware() {
+  return async (c, next) => {
+    const identity = readClientIdentity(c.req.raw.headers);
+    const refusal = judgeClientIdentity(identity);
+    if (refusal !== null) {
+      const bytes = refusal.envelopeBytes(newHexId());
+      const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+      const response = c.newResponse(buffer, refusal.httpStatus, {
+        "content-type": "application/json"
+      });
+      applyServerContractHeaders(response.headers);
+      return response;
+    }
+    if (identity !== null) {
+      c.set(CLIENT_IDENTITY_CONTEXT_KEY, identity);
+    }
+    await next();
+    applyServerContractHeaders(c.res.headers);
+    return void 0;
+  };
+}
 export {
   ABSENT_BODY_SHA256,
   AUTH_SURFACE_OPERATIONS,
+  CLIENT_IDENTITY_CONTEXT_KEY,
+  CLIENT_IDENTITY_HEADERS,
+  CLIENT_KINDS,
   CLIENT_PROOF_CONTENT_TYPE,
   CLIENT_PROOF_HEADERS,
   CLIENT_PROOF_PROFILE,
@@ -1424,12 +1777,15 @@ export {
   PROOF_SIGNATURE_HEX_LENGTH,
   ProofInputError,
   RedisReplayStore,
+  SERVER_CONTRACT_HEADERS,
   TestClock,
   admitClientProofRequest,
+  applyServerContractHeaders,
   canonicalProofInput,
   configureClientProofReplayStore,
   createClientProofDevHandler,
   createClientProofGuard,
+  createClientVersionMiddleware,
   decodeEchoRequest,
   decodeHandshakeRequest,
   decodeListItemsRequest,
@@ -1438,13 +1794,18 @@ export {
   encodeHandshakeResponse,
   encodeListItemsResponse,
   getClientProofReplayStore,
+  isAppKind,
   isCanonicalBytes,
+  isContractVersionSupported,
   isRequestContentType,
+  judgeClientIdentity,
   newHexId,
   parseCanonicalJson,
   parseClientProofPublicKey,
+  readClientIdentity,
   readCredentials,
   replayLedgerKey,
+  serverContractHeaders,
   sha256Hex,
   signClientProof,
   systemClock,