@spfn/auth 0.3.0-beta.2 → 0.3.0-beta.20

package/dist/nextjs/server.js

@@ -22,7 +22,8 @@ var authLogger = {
     general: rootLogger.child("@spfn/auth:interceptor:general"),
     login: rootLogger.child("@spfn/auth:interceptor:login"),
     keyRotation: rootLogger.child("@spfn/auth:interceptor:key-rotation"),
-    oauth: rootLogger.child("@spfn/auth:interceptor:oauth")
+    oauth: rootLogger.child("@spfn/auth:interceptor:oauth"),
+    csrf: rootLogger.child("@spfn/auth:interceptor:csrf")
   },
   session: rootLogger.child("@spfn/auth:session"),
   service: rootLogger.child("@spfn/auth:service"),
@@ -89,10 +90,59 @@ async function unsealSession(jwt) {
   }
 }
 
-// src/server/lib/config.ts
+// src/server/lib/csrf.ts
 import { env as env2 } from "@spfn/auth/config";
+var CSRF_SUBKEY_LABEL = "spfn-auth-csrf-token-v1";
+var MAX_CANDIDATES = 32;
+function sessionSecret() {
+  const secret = env2.SPFN_AUTH_SESSION_SECRET;
+  if (!secret) {
+    throw new Error(
+      "SPFN_AUTH_SESSION_SECRET is required for CSRF protection. Set it (sessions need it anyway), or set SPFN_AUTH_CSRF=off."
+    );
+  }
+  return secret;
+}
+async function hmacSha256(key, message) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    key.buffer,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(message));
+  return new Uint8Array(signature);
+}
+function toHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function deriveCsrfToken(keyId) {
+  const subkey = await hmacSha256(new TextEncoder().encode(sessionSecret()), CSRF_SUBKEY_LABEL);
+  return toHex(await hmacSha256(subkey, keyId));
+}
+function timingSafeEqualString(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let i = 0; i < a.length; i++) {
+    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return difference === 0;
+}
+function matchesCsrfToken(expected, presented) {
+  if (!presented) {
+    return false;
+  }
+  return presented.split(",", MAX_CANDIDATES).some((candidate) => timingSafeEqualString(expected, candidate.trim()));
+}
+
+// src/server/lib/config.ts
+import { env as env3 } from "@spfn/auth/config";
+import { PasskeyConfigError } from "@spfn/auth/errors";
 function getCookieSuffix() {
-  const port = process.env.PORT;
+  const port = process.env.SPFN_PORT;
   return port ? `_${port}` : "";
 }
 var COOKIE_NAMES = {
@@ -111,6 +161,18 @@ var COOKIE_NAMES = {
   /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
   get OAUTH_CSRF() {
     return `spfn_oauth_csrf${getCookieSuffix()}`;
+  },
+  /** Password-setup session for verified-email signup — temporary, single-purpose */
+  get SIGNUP_SETUP() {
+    return `spfn_signup_setup${getCookieSuffix()}`;
+  },
+  /** Password-setup session for a password reset — temporary, single-purpose */
+  get PASSWORD_RESET_SETUP() {
+    return `spfn_password_reset_setup${getCookieSuffix()}`;
+  },
+  /** CSRF token — the only cookie here the browser can read */
+  get CSRF() {
+    return `spfn_csrf${getCookieSuffix()}`;
   }
 };
 function parseDuration(duration) {
@@ -147,7 +209,7 @@ function getSessionTtl(override) {
   if (globalConfig.sessionTtl !== void 0) {
     return parseDuration(globalConfig.sessionTtl);
   }
-  const envTtl = env2.SPFN_AUTH_SESSION_TTL;
+  const envTtl = env3.SPFN_AUTH_SESSION_TTL;
   if (envTtl) {
     return parseDuration(envTtl);
   }
@@ -155,7 +217,7 @@ function getSessionTtl(override) {
 }
 
 // src/nextjs/session-helpers.ts
-import { env as env3 } from "@spfn/auth/config";
+import { env as env4 } from "@spfn/auth/config";
 import { logger } from "@spfn/core/logger";
 async function saveSession(data, options) {
   let maxAge;
@@ -173,6 +235,13 @@ async function saveSession(data, options) {
     path: "/",
     maxAge
   });
+  cookieStore.set(COOKIE_NAMES.CSRF, await deriveCsrfToken(data.keyId), {
+    httpOnly: false,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge
+  });
 }
 async function getSession() {
   const cookieStore = await cookies();
@@ -197,9 +266,10 @@ async function clearSession() {
   const cookieStore = await cookies();
   cookieStore.delete(COOKIE_NAMES.SESSION);
   cookieStore.delete(COOKIE_NAMES.SESSION_KEY_ID);
+  cookieStore.delete(COOKIE_NAMES.CSRF);
 }
 async function getPendingSessionKey() {
-  const secret = env3.SPFN_AUTH_SESSION_SECRET;
+  const secret = env4.SPFN_AUTH_SESSION_SECRET;
   const encoder = new TextEncoder();
   const data = encoder.encode(`oauth-pending:${secret}`);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -351,11 +421,47 @@ async function RequirePermission({
   return /* @__PURE__ */ jsx3(Fragment3, { children });
 }
 
+// src/nextjs/cookie-names.ts
+function sessionCookieNames() {
+  return {
+    session: COOKIE_NAMES.SESSION,
+    keyId: COOKIE_NAMES.SESSION_KEY_ID,
+    oauthPending: COOKIE_NAMES.OAUTH_PENDING,
+    csrf: COOKIE_NAMES.CSRF
+  };
+}
+function clearSessionCookies(response) {
+  for (const name of Object.values(sessionCookieNames())) {
+    response.cookies.delete({ name, path: "/" });
+  }
+  return response;
+}
+
 // src/nextjs/oauth-handlers.ts
 import { NextResponse } from "next/server";
 import { cookies as cookies2 } from "next/headers.js";
-import { env as env4 } from "@spfn/core/config";
+import { env as env5 } from "@spfn/core/config";
 import { logger as logger2 } from "@spfn/core/logger";
+
+// src/lib/return-path.ts
+var URL_STRIPPED_CHARACTER = /[\t\n\r]/;
+function isSafeReturnPath(returnPath) {
+  if (!returnPath.startsWith("/")) {
+    return false;
+  }
+  if (returnPath.startsWith("//") || returnPath.includes("\\")) {
+    return false;
+  }
+  if (returnPath.includes("..") || URL_STRIPPED_CHARACTER.test(returnPath)) {
+    return false;
+  }
+  return !/^\/[^/?#]*:/.test(returnPath);
+}
+
+// src/nextjs/oauth-handlers.ts
+function safeReturnUrl(requested, defaultRedirect) {
+  return requested && isSafeReturnPath(requested) ? requested : defaultRedirect;
+}
 function createOAuthCallbackHandler(options) {
   const defaultRedirect = options?.defaultRedirectUrl || "/";
   const errorRedirect = options?.errorRedirectUrl || "/auth/error";
@@ -363,7 +469,7 @@ function createOAuthCallbackHandler(options) {
     const searchParams = request.nextUrl.searchParams;
     const userId = searchParams.get("userId");
     const keyId = searchParams.get("keyId");
-    const returnUrl = searchParams.get("returnUrl") || defaultRedirect;
+    const returnUrl = safeReturnUrl(searchParams.get("returnUrl"), defaultRedirect);
     const error = searchParams.get("error");
     if (error) {
       const errorUrl = new URL(errorRedirect, request.url);
@@ -397,14 +503,21 @@ function createOAuthCallbackHandler(options) {
       const response = NextResponse.redirect(redirectUrl);
       response.cookies.set(COOKIE_NAMES.SESSION, sessionToken, {
         httpOnly: true,
-        secure: env4.NODE_ENV === "production",
+        secure: env5.NODE_ENV === "production",
         sameSite: "lax",
         maxAge: ttl,
         path: "/"
       });
       response.cookies.set(COOKIE_NAMES.SESSION_KEY_ID, keyId, {
         httpOnly: true,
-        secure: env4.NODE_ENV === "production",
+        secure: env5.NODE_ENV === "production",
+        sameSite: "lax",
+        maxAge: ttl,
+        path: "/"
+      });
+      response.cookies.set(COOKIE_NAMES.CSRF, await deriveCsrfToken(keyId), {
+        httpOnly: false,
+        secure: env5.NODE_ENV === "production",
         sameSite: "lax",
         maxAge: ttl,
         path: "/"
@@ -421,13 +534,260 @@ function createOAuthCallbackHandler(options) {
     }
   };
 }
+
+// src/nextjs/oauth2-authorize-handlers.ts
+import { cookies as cookies3 } from "next/headers.js";
+import { NextResponse as NextResponse2 } from "next/server";
+import { authApi as authApi2 } from "@spfn/auth";
+import { logger as logger3 } from "@spfn/core/logger";
+var AUTHORIZE_PARAMETERS = [
+  "client_id",
+  "redirect_uri",
+  "code_challenge",
+  "code_challenge_method",
+  "resource",
+  "scope",
+  "state"
+];
+var NON_REDIRECTABLE = /* @__PURE__ */ new Set(["unknown_client", "redirect_uri_mismatch"]);
+var FORM_CONTENT_TYPES = ["application/x-www-form-urlencoded", "multipart/form-data"];
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function authorizeFields(read) {
+  const fields = {};
+  for (const name of AUTHORIZE_PARAMETERS) {
+    const value = read(name);
+    if (value) {
+      fields[name] = value;
+    }
+  }
+  return fields;
+}
+function screen(status, body) {
+  return new NextResponse2(body, {
+    status,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Security-Policy": "frame-ancestors 'none'",
+      "Cache-Control": "no-store"
+    }
+  });
+}
+function refusalScreen(status, heading, message) {
+  return screen(status, [
+    "<!DOCTYPE html>",
+    '<html lang="en"><head><meta charset="utf-8"><title>Authorization request refused</title></head>',
+    `<body><h1>${heading}</h1><p>${message}</p></body></html>`
+  ].join("\n"));
+}
+function unknownClientScreen() {
+  return refusalScreen(
+    400,
+    "Unrecognized application",
+    "The application that sent you here is not registered with this service, so the request cannot be completed. Nothing was shared."
+  );
+}
+function redirectMismatchScreen() {
+  return refusalScreen(
+    400,
+    "Address not recognized",
+    "The application asked for the authorization to be returned to an address it never registered. Nothing was shared, and you were not sent there."
+  );
+}
+function unavailableScreen() {
+  return refusalScreen(
+    500,
+    "Authorization unavailable",
+    "This authorization request could not be checked. Nothing was shared. Please try again."
+  );
+}
+function noSessionScreen() {
+  return refusalScreen(
+    403,
+    "Sign-in required",
+    "This authorization request needs a signed-in session and yours is not available. Start the request again from the application."
+  );
+}
+function redirect4(url) {
+  return NextResponse2.redirect(url, { status: 302, headers: { "Cache-Control": "no-store" } });
+}
+function safeUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+function loginRedirect(request, loginPath) {
+  const returnPath = `${request.nextUrl.pathname}${request.nextUrl.search}`;
+  if (!isSafeReturnPath(returnPath)) {
+    return refusalScreen(
+      400,
+      "Malformed authorization request",
+      "This authorization request cannot be signed in to. Start it again from the application."
+    );
+  }
+  const url = new URL(loginPath, request.url);
+  url.searchParams.set("returnUrl", returnPath);
+  return redirect4(url);
+}
+function detailsOf(thrown) {
+  const error = thrown;
+  return error?.details ?? error?.response?.error?.details ?? error?.response?.details ?? {};
+}
+function statusOf(thrown) {
+  const error = thrown;
+  return Number(error?.status ?? error?.statusCode ?? 0);
+}
+function refusalRedirect(details) {
+  const { error, redirectUri, state } = details;
+  if (typeof error !== "string" || NON_REDIRECTABLE.has(error) || typeof redirectUri !== "string") {
+    return null;
+  }
+  const url = safeUrl(redirectUri);
+  if (!url) {
+    return null;
+  }
+  url.searchParams.set("error", error);
+  if (typeof state === "string") {
+    url.searchParams.set("state", state);
+  }
+  return redirect4(url);
+}
+function answerRefusal(thrown, onStaleSession) {
+  const status = statusOf(thrown);
+  if (status === 401) {
+    return onStaleSession();
+  }
+  const details = detailsOf(thrown);
+  if (details.error === "unknown_client") {
+    return unknownClientScreen();
+  }
+  if (details.error === "redirect_uri_mismatch") {
+    return redirectMismatchScreen();
+  }
+  const redirectable = refusalRedirect(details);
+  if (redirectable) {
+    return redirectable;
+  }
+  logger3.error("OAuth2 consent request could not be answered", { status });
+  return unavailableScreen();
+}
+function hiddenFields(fields, csrfToken) {
+  return [...Object.entries(fields), ["csrf", csrfToken]].map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`).join("\n        ");
+}
+function defaultRender(view) {
+  const scopes = view.scopes.map((scope) => `<li><strong>${escapeHtml(scope.name)}</strong> \u2014 ${escapeHtml(scope.description)}</li>`).join("\n        ");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8"><title>Authorize ${escapeHtml(view.clientName)}</title></head>
+<body>
+    <h1>Authorize ${escapeHtml(view.clientName)}</h1>
+    <p><strong>${escapeHtml(view.clientName)}</strong> is asking to act on your behalf at
+        <code>${escapeHtml(view.resource)}</code>. The authorization would be returned to
+        <code>${escapeHtml(view.redirectHost)}</code>.</p>
+    <h2>It is asking for</h2>
+    <ul>
+        ${scopes}
+    </ul>
+    <form method="post">
+        ${hiddenFields(view.fields, view.csrfToken)}
+        <button type="submit" name="decision" value="approve">Approve</button>
+        <button type="submit" name="decision" value="deny">Deny</button>
+    </form>
+</body>
+</html>`;
+}
+async function csrfCookie() {
+  const cookieStore = await cookies3();
+  return cookieStore.get(sessionCookieNames().csrf)?.value ?? null;
+}
+async function renderConsent(request, options) {
+  const csrfToken = await csrfCookie();
+  if (!csrfToken) {
+    return loginRedirect(request, options.loginPath);
+  }
+  const fields = authorizeFields((name) => request.nextUrl.searchParams.get(name));
+  const described = await authApi2.getOAuth2Authorize.call({ query: fields });
+  const render = options.render ?? defaultRender;
+  return screen(200, render({ ...described, fields, csrfToken }));
+}
+async function refuseUnverifiedPost(form) {
+  const presented = form.get("csrf");
+  const expected = await csrfCookie();
+  if (!expected || !matchesCsrfToken(expected, typeof presented === "string" ? presented : null)) {
+    return refusalScreen(
+      403,
+      "Request could not be verified",
+      "This form did not carry a valid token for your session. Start the authorization again from the application."
+    );
+  }
+  return null;
+}
+function isFormPost(request) {
+  const contentType = request.headers.get("content-type") ?? "";
+  return FORM_CONTENT_TYPES.some((type) => contentType.startsWith(type));
+}
+async function recordDecision(fields, decision) {
+  const body = { ...fields, approve: decision === "approve" };
+  const issued = await authApi2.createOAuth2AuthorizationCode.call({ body });
+  const url = safeUrl(issued.redirectUri);
+  if (!url) {
+    return unavailableScreen();
+  }
+  url.searchParams.set("code", issued.code);
+  if (issued.state !== void 0) {
+    url.searchParams.set("state", issued.state);
+  }
+  return redirect4(url);
+}
+function createOAuth2AuthorizeHandlers(options) {
+  async function GET(request) {
+    if (!await getSession()) {
+      return loginRedirect(request, options.loginPath);
+    }
+    try {
+      return await renderConsent(request, options);
+    } catch (error) {
+      return answerRefusal(error, () => loginRedirect(request, options.loginPath));
+    }
+  }
+  async function POST(request) {
+    if (!await getSession()) {
+      return noSessionScreen();
+    }
+    if (!isFormPost(request)) {
+      return refusalScreen(
+        415,
+        "Unsupported request",
+        "The consent form is submitted as a form. Start the authorization again from the application."
+      );
+    }
+    const form = await request.formData();
+    const refusal = await refuseUnverifiedPost(form);
+    if (refusal) {
+      return refusal;
+    }
+    try {
+      const fields = authorizeFields((name) => form.get(name));
+      return await recordDecision(fields, form.get("decision"));
+    } catch (error) {
+      return answerRefusal(error, noSessionScreen);
+    }
+  }
+  return { GET, POST };
+}
 export {
   RequireAuth,
   RequirePermission,
   RequireRole,
   clearPendingSession,
   clearSession,
+  clearSessionCookies,
+  createOAuth2AuthorizeHandlers,
   createOAuthCallbackHandler,
+  escapeHtml,
   getAuthSessionData,
   getPendingSession,
   getSession,
@@ -435,8 +795,10 @@ export {
   getUserRole,
   hasAnyPermission,
   hasAnyRole,
+  isSafeReturnPath,
   saveSession,
   sealPendingSession,
+  sessionCookieNames,
   unsealPendingSession
 };
 //# sourceMappingURL=server.js.map