@spfn/auth 0.3.0-beta.2 → 0.3.0-beta.20

package/dist/nextjs/api.js

@@ -96,7 +96,8 @@ var authLogger = {
     general: rootLogger.child("@spfn/auth:interceptor:general"),
     login: rootLogger.child("@spfn/auth:interceptor:login"),
     keyRotation: rootLogger.child("@spfn/auth:interceptor:key-rotation"),
-    oauth: rootLogger.child("@spfn/auth:interceptor:oauth")
+    oauth: rootLogger.child("@spfn/auth:interceptor:oauth"),
+    csrf: rootLogger.child("@spfn/auth:interceptor:csrf")
   },
   session: rootLogger.child("@spfn/auth:session"),
   service: rootLogger.child("@spfn/auth:service"),
@@ -190,8 +191,9 @@ async function shouldRefreshSession(jwt2, thresholdHours = 24) {
 
 // src/server/lib/config.ts
 import { env as env2 } from "@spfn/auth/config";
+import { PasskeyConfigError } from "@spfn/auth/errors";
 function getCookieSuffix() {
-  const port = process.env.PORT;
+  const port = process.env.SPFN_PORT;
   return port ? `_${port}` : "";
 }
 var COOKIE_NAMES = {
@@ -210,6 +212,18 @@ var COOKIE_NAMES = {
   /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
   get OAUTH_CSRF() {
     return `spfn_oauth_csrf${getCookieSuffix()}`;
+  },
+  /** Password-setup session for verified-email signup — temporary, single-purpose */
+  get SIGNUP_SETUP() {
+    return `spfn_signup_setup${getCookieSuffix()}`;
+  },
+  /** Password-setup session for a password reset — temporary, single-purpose */
+  get PASSWORD_RESET_SETUP() {
+    return `spfn_password_reset_setup${getCookieSuffix()}`;
+  },
+  /** CSRF token — the only cookie here the browser can read */
+  get CSRF() {
+    return `spfn_csrf${getCookieSuffix()}`;
   }
 };
 function parseDuration(duration) {
@@ -252,6 +266,33 @@ function getSessionTtl(override) {
   }
   return 7 * 24 * 60 * 60;
 }
+var CSRF_MODES = ["off", "warn", "enforce"];
+var unrecognizedCsrfModeReported = false;
+function getCsrfMode() {
+  const configured = globalConfig.csrf?.mode ?? env2.SPFN_AUTH_CSRF;
+  if (!configured) {
+    return "warn";
+  }
+  const normalized = String(configured).trim().toLowerCase();
+  if (!CSRF_MODES.includes(normalized)) {
+    if (!unrecognizedCsrfModeReported) {
+      unrecognizedCsrfModeReported = true;
+      authLogger.interceptor.csrf.error(
+        `Unrecognized CSRF mode "${configured}" \u2014 expected off | warn | enforce. Enforcing.`
+      );
+    }
+    return "enforce";
+  }
+  return normalized;
+}
+var PACKAGE_CSRF_EXEMPT_PATHS = [
+  "/_auth/oauth2/register",
+  "/_auth/oauth2/token",
+  "/_auth/oauth2/revoke"
+];
+function getCsrfExemptPaths() {
+  return [...PACKAGE_CSRF_EXEMPT_PATHS, ...globalConfig.csrf?.exemptPaths ?? []];
+}
 
 // src/nextjs/interceptors/cookie-options.ts
 function resolveSecure() {
@@ -263,9 +304,144 @@ function resolveSecure() {
 }
 var cookieSecure = resolveSecure();
 
+// src/server/lib/csrf.ts
+import { env as env3 } from "@spfn/auth/config";
+var CSRF_HEADER = "x-spfn-csrf";
+var CSRF_SUBKEY_LABEL = "spfn-auth-csrf-token-v1";
+var MAX_CANDIDATES = 32;
+function sessionSecret() {
+  const secret = env3.SPFN_AUTH_SESSION_SECRET;
+  if (!secret) {
+    throw new Error(
+      "SPFN_AUTH_SESSION_SECRET is required for CSRF protection. Set it (sessions need it anyway), or set SPFN_AUTH_CSRF=off."
+    );
+  }
+  return secret;
+}
+async function hmacSha256(key, message) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    key.buffer,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(message));
+  return new Uint8Array(signature);
+}
+function toHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function deriveCsrfToken(keyId) {
+  const subkey = await hmacSha256(new TextEncoder().encode(sessionSecret()), CSRF_SUBKEY_LABEL);
+  return toHex(await hmacSha256(subkey, keyId));
+}
+function timingSafeEqualString(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let i = 0; i < a.length; i++) {
+    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return difference === 0;
+}
+function matchesCsrfToken(expected, presented) {
+  if (!presented) {
+    return false;
+  }
+  return presented.split(",", MAX_CANDIDATES).some((candidate) => timingSafeEqualString(expected, candidate.trim()));
+}
+
+// src/nextjs/interceptors/csrf.ts
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function csrfCookie(token, ttl) {
+  return {
+    name: COOKIE_NAMES.CSRF,
+    value: token,
+    options: {
+      httpOnly: false,
+      secure: cookieSecure,
+      sameSite: "lax",
+      maxAge: ttl,
+      path: "/"
+    }
+  };
+}
+function refusal() {
+  return {
+    status: 403,
+    body: {
+      error: "Forbidden",
+      message: "CSRF token missing or invalid"
+    },
+    setCookies: []
+  };
+}
+async function refuseInvalidCsrf(ctx, keyId) {
+  const mode = getCsrfMode();
+  if (mode === "off" || SAFE_METHODS.has(ctx.method.toUpperCase())) {
+    return false;
+  }
+  if (getCsrfExemptPaths().includes(ctx.path)) {
+    authLogger.interceptor.csrf.debug("Path is CSRF-exempt", { path: ctx.path });
+    return false;
+  }
+  let expected;
+  try {
+    expected = await deriveCsrfToken(keyId);
+  } catch (error) {
+    authLogger.interceptor.csrf.error(
+      "Cannot derive the CSRF token \u2014 refusing regardless of mode",
+      error
+    );
+    ctx.abort = refusal();
+    return true;
+  }
+  const presented = ctx.request.headers.get(CSRF_HEADER);
+  if (matchesCsrfToken(expected, presented)) {
+    return false;
+  }
+  const detail = {
+    method: ctx.method,
+    path: ctx.path,
+    headerPresent: !!presented
+  };
+  if (mode === "warn") {
+    authLogger.interceptor.csrf.warn("CSRF check would refuse this request (mode=warn)", detail);
+    return false;
+  }
+  authLogger.interceptor.csrf.warn("CSRF check refused this request", detail);
+  ctx.abort = refusal();
+  ctx.abort.setCookies = [csrfCookie(expected, getSessionTtl())];
+  return true;
+}
+async function pushCsrfCookie(setCookies, keyId, ttl) {
+  setCookies.push(csrfCookie(await deriveCsrfToken(keyId), ttl));
+}
+async function pushCsrfCookieIfStale(setCookies, presented, keyId) {
+  try {
+    const token = await deriveCsrfToken(keyId);
+    if (presented && timingSafeEqualString(token, presented)) {
+      return;
+    }
+    setCookies.push(csrfCookie(token, getSessionTtl()));
+  } catch (error) {
+    authLogger.interceptor.csrf.error("Cannot reissue the CSRF cookie", error);
+  }
+}
+function pushCsrfCookieRemoval(setCookies) {
+  setCookies.push({
+    name: COOKIE_NAMES.CSRF,
+    value: "",
+    options: { maxAge: 0, path: "/" }
+  });
+}
+
 // src/nextjs/interceptors/login-register.ts
+var ROTATING_SIGN_IN_PATHS = /* @__PURE__ */ new Set(["/_auth/login", "/_auth/passkeys/login/verify"]);
 var loginRegisterInterceptor = {
-  pathPattern: /^\/_auth\/(login|register|invitations\/accept)$/,
+  pathPattern: /^\/_auth\/(login|register|invitations\/accept|signup\/password|password\/reset\/complete|passkeys\/login\/verify)$/,
   method: "POST",
   request: async (ctx, next) => {
     const oldKeyId = ctx.cookies.get(COOKIE_NAMES.SESSION_KEY_ID);
@@ -279,7 +455,7 @@ var loginRegisterInterceptor = {
     ctx.body.fingerprint = keyPair.fingerprint;
     ctx.body.algorithm = keyPair.algorithm;
     ctx.body.keySize = Buffer.from(keyPair.publicKey, "base64").length;
-    if (ctx.path === "/_auth/login" && oldKeyId) {
+    if (ROTATING_SIGN_IN_PATHS.has(ctx.path) && oldKeyId) {
       ctx.body.oldKeyId = oldKeyId;
     }
     delete ctx.body.remember;
@@ -331,6 +507,7 @@ var loginRegisterInterceptor = {
           path: "/"
         }
       });
+      await pushCsrfCookie(ctx.setCookies, ctx.metadata.keyId, ttl);
     } catch (error) {
       const err = error;
       authLogger.interceptor.login.error("Failed to save session", err);
@@ -389,6 +566,9 @@ var generalAuthInterceptor = {
         userId: session.userId,
         keyId: session.keyId
       });
+      if (await refuseInvalidCsrf(ctx, session.keyId)) {
+        return;
+      }
       const needsRefresh = await shouldRefreshSession(sessionCookie, 24);
       if (needsRefresh) {
         authLogger.interceptor.general.debug("Session needs refresh (within 24h of expiry)");
@@ -409,6 +589,7 @@ var generalAuthInterceptor = {
       ctx.headers["Authorization"] = `Bearer ${token}`;
       ctx.headers["X-Key-Id"] = session.keyId;
       ctx.metadata.userId = session.userId;
+      ctx.metadata.keyId = session.keyId;
       ctx.metadata.sessionValid = true;
     } catch (error) {
       const err = error;
@@ -442,6 +623,7 @@ var generalAuthInterceptor = {
         value: "",
         options: { maxAge: 0, path: "/" }
       });
+      pushCsrfCookieRemoval(ctx.setCookies);
       await next();
       return;
     }
@@ -462,6 +644,7 @@ var generalAuthInterceptor = {
           path: "/"
         }
       });
+      pushCsrfCookieRemoval(ctx.setCookies);
     } else if (ctx.metadata.refreshSession && ctx.response.status === 200) {
       try {
         const sessionData = ctx.metadata.sessionData;
@@ -489,6 +672,7 @@ var generalAuthInterceptor = {
             path: "/"
           }
         });
+        await pushCsrfCookie(ctx.setCookies, sessionData.keyId, ttl);
         authLogger.interceptor.general.info("Session refreshed", {
           userId: sessionData.userId,
           sealedLength: sealed.length,
@@ -520,6 +704,15 @@ var generalAuthInterceptor = {
         value: "",
         options: { ...base, sameSite: "lax" }
       });
+      pushCsrfCookieRemoval(ctx.setCookies);
+    }
+    const csrfQueued = ctx.setCookies.some((cookie) => cookie.name === COOKIE_NAMES.CSRF);
+    if (ctx.metadata.sessionValid && !csrfQueued) {
+      await pushCsrfCookieIfStale(
+        ctx.setCookies,
+        ctx.cookies.get(COOKIE_NAMES.CSRF),
+        ctx.metadata.keyId
+      );
     }
     await next();
   }
@@ -546,10 +739,11 @@ var keyRotationInterceptor = {
       ctx.body.fingerprint = newKeyPair.fingerprint;
       ctx.body.algorithm = newKeyPair.algorithm;
       ctx.body.keySize = Buffer.from(newKeyPair.publicKey, "base64").length;
-      console.log("New key generated:", newKeyPair);
-      console.log("publicKey:", newKeyPair.publicKey);
-      console.log("keyId:", newKeyPair.keyId);
-      console.log("fingerprint:", newKeyPair.fingerprint);
+      authLogger.interceptor.keyRotation.debug("Generated a new key pair", {
+        keyId: newKeyPair.keyId,
+        fingerprint: newKeyPair.fingerprint,
+        algorithm: newKeyPair.algorithm
+      });
       const token = generateClientToken(
         {
           userId: currentSession.userId,
@@ -614,6 +808,7 @@ var keyRotationInterceptor = {
           path: "/"
         }
       });
+      await pushCsrfCookie(ctx.setCookies, ctx.metadata.newKeyId, ttl);
     } catch (error) {
       const err = error;
       authLogger.interceptor.keyRotation.error("Failed to update session after rotation", err);
@@ -624,9 +819,9 @@ var keyRotationInterceptor = {
 
 // src/server/lib/oauth/state.ts
 import * as jose2 from "jose";
-import { env as env3 } from "@spfn/auth/config";
+import { env as env4 } from "@spfn/auth/config";
 async function getStateKey() {
-  const secret = env3.SPFN_AUTH_SESSION_SECRET;
+  const secret = env4.SPFN_AUTH_SESSION_SECRET;
   const encoder = new TextEncoder();
   const data = encoder.encode(`oauth-state:${secret}`);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -656,13 +851,28 @@ async function createOAuthState(params) {
   return encodeURIComponent(jwe);
 }
 
+// src/lib/return-path.ts
+var URL_STRIPPED_CHARACTER = /[\t\n\r]/;
+function isSafeReturnPath(returnPath) {
+  if (!returnPath.startsWith("/")) {
+    return false;
+  }
+  if (returnPath.startsWith("//") || returnPath.includes("\\")) {
+    return false;
+  }
+  if (returnPath.includes("..") || URL_STRIPPED_CHARACTER.test(returnPath)) {
+    return false;
+  }
+  return !/^\/[^/?#]*:/.test(returnPath);
+}
+
 // src/nextjs/session-helpers.ts
 import * as jose3 from "jose";
 import { cookies } from "next/headers.js";
-import { env as env4 } from "@spfn/auth/config";
+import { env as env5 } from "@spfn/auth/config";
 import { logger } from "@spfn/core/logger";
 async function getPendingSessionKey() {
-  const secret = env4.SPFN_AUTH_SESSION_SECRET;
+  const secret = env5.SPFN_AUTH_SESSION_SECRET;
   const encoder = new TextEncoder();
   const data = encoder.encode(`oauth-pending:${secret}`);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -682,6 +892,20 @@ async function unsealPendingSession(jwt2) {
 }
 
 // src/nextjs/interceptors/oauth.ts
+var UNSAFE_RETURN_URL_MESSAGE = "returnUrl must be a relative path within the app";
+function refuseUnsafeReturnUrl() {
+  return {
+    status: 400,
+    body: {
+      __type: "ValidationError",
+      message: UNSAFE_RETURN_URL_MESSAGE,
+      error: {
+        code: "ValidationError",
+        message: UNSAFE_RETURN_URL_MESSAGE
+      }
+    }
+  };
+}
 var oauthUrlInterceptor = {
   pathPattern: /^\/_auth\/oauth\/\w+\/url$/,
   method: "POST",
@@ -689,6 +913,13 @@ var oauthUrlInterceptor = {
     const provider = ctx.path.split("/")[3];
     const returnUrl = ctx.body?.returnUrl || "/";
     const metadata = ctx.body?.metadata;
+    if (typeof returnUrl !== "string" || !isSafeReturnPath(returnUrl)) {
+      authLogger.interceptor.oauth?.warn?.("OAuth start refused: returnUrl is not a path within the app", {
+        provider
+      });
+      ctx.abort = refuseUnsafeReturnUrl();
+      return;
+    }
     const keyPair = generateKeyPair("ES256");
     const csrfNonce = generateOAuthNonce();
     const state = await createOAuthState({
@@ -837,6 +1068,7 @@ var oauthFinalizeInterceptor = {
           path: "/"
         }
       });
+      await pushCsrfCookie(ctx.setCookies, keyId, ttl);
       ctx.setCookies.push({
         name: COOKIE_NAMES.OAUTH_PENDING,
         value: "",
@@ -861,8 +1093,114 @@ var oauthFinalizeInterceptor = {
   }
 };
 
+// src/nextjs/interceptors/signup-link.ts
+var SETUP_COOKIE_TTL_SECONDS = 60 * 60;
+function setupCookie(value, maxAge) {
+  return {
+    name: COOKIE_NAMES.SIGNUP_SETUP,
+    value,
+    options: {
+      httpOnly: true,
+      secure: cookieSecure,
+      sameSite: "lax",
+      maxAge,
+      path: "/"
+    }
+  };
+}
+var signupLinkInterceptor = {
+  pathPattern: /^\/_auth\/signup\/(email\/confirm|password)$/,
+  method: "POST",
+  request: async (ctx, next) => {
+    if (ctx.path === "/_auth/signup/password") {
+      const cookie = ctx.cookies.get(COOKIE_NAMES.SIGNUP_SETUP);
+      if (cookie) {
+        if (!ctx.body) {
+          ctx.body = {};
+        }
+        ctx.body.setupSecret = cookie;
+      }
+    }
+    await next();
+  },
+  response: async (ctx, next) => {
+    if (!ctx.response.ok) {
+      await next();
+      return;
+    }
+    if (ctx.path === "/_auth/signup/email/confirm") {
+      const secret = ctx.response.body?.setupSecret;
+      if (!secret) {
+        authLogger.interceptor.oauth?.error?.("Signup confirm response carried no setup secret");
+        await next();
+        return;
+      }
+      ctx.setCookies.push(setupCookie(secret, SETUP_COOKIE_TTL_SECONDS));
+      delete ctx.response.body.setupSecret;
+    }
+    if (ctx.path === "/_auth/signup/password") {
+      ctx.setCookies.push(setupCookie("", 0));
+    }
+    await next();
+  }
+};
+
+// src/nextjs/interceptors/password-reset.ts
+var SETUP_COOKIE_TTL_SECONDS2 = 60 * 60;
+function setupCookie2(value, maxAge) {
+  return {
+    name: COOKIE_NAMES.PASSWORD_RESET_SETUP,
+    value,
+    options: {
+      httpOnly: true,
+      secure: cookieSecure,
+      sameSite: "lax",
+      maxAge,
+      path: "/"
+    }
+  };
+}
+var passwordResetInterceptor = {
+  pathPattern: /^\/_auth\/password\/reset\/(confirm|complete)$/,
+  method: "POST",
+  request: async (ctx, next) => {
+    if (ctx.path === "/_auth/password/reset/complete") {
+      const cookie = ctx.cookies.get(COOKIE_NAMES.PASSWORD_RESET_SETUP);
+      if (cookie) {
+        if (!ctx.body) {
+          ctx.body = {};
+        }
+        ctx.body.setupSecret = cookie;
+      }
+    }
+    await next();
+  },
+  response: async (ctx, next) => {
+    if (!ctx.response.ok) {
+      await next();
+      return;
+    }
+    if (ctx.path === "/_auth/password/reset/confirm") {
+      const secret = ctx.response.body?.setupSecret;
+      if (!secret) {
+        authLogger.interceptor.oauth?.error?.("Password reset confirm response carried no setup secret");
+        await next();
+        return;
+      }
+      ctx.setCookies.push(setupCookie2(secret, SETUP_COOKIE_TTL_SECONDS2));
+      delete ctx.response.body.setupSecret;
+    }
+    if (ctx.path === "/_auth/password/reset/complete") {
+      ctx.setCookies.push(setupCookie2("", 0));
+    }
+    await next();
+  }
+};
+
 // src/nextjs/interceptors/index.ts
 var authInterceptors = [
+  signupLinkInterceptor,
+  passwordResetInterceptor,
   loginRegisterInterceptor,
   keyRotationInterceptor,
   oauthUrlInterceptor,