npm - @spfn/auth - Versions diffs - 0.3.0-beta.20 → 0.3.0-beta.22 - Mend

@spfn/auth 0.3.0-beta.20 → 0.3.0-beta.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (24) hide show

package/README.md +131 -3
package/dist/client-proof.js +5 -3
package/dist/client-proof.js.map +1 -1
package/dist/config.d.ts +40 -0
package/dist/config.js +19 -0
package/dist/config.js.map +1 -1
package/dist/errors.d.ts +28 -2
package/dist/errors.js +12 -0
package/dist/errors.js.map +1 -1
package/dist/index.d.ts +19 -2
package/dist/index.js +21 -1
package/dist/index.js.map +1 -1
package/dist/{machine-principals-BD4tnASp.d.ts → machine-principals-B7N8gux0.d.ts} +355 -7
package/dist/nextjs/server.d.ts +107 -1
package/dist/nextjs/server.js +182 -0
package/dist/nextjs/server.js.map +1 -1
package/dist/server.d.ts +506 -268
package/dist/server.js +1405 -950
package/dist/server.js.map +1 -1
package/migrations/20260918142743_smart_cassandra_nova/migration.sql +2 -0
package/migrations/20260918142743_smart_cassandra_nova/snapshot.json +5297 -0
package/migrations/20260918143800_fat_princess_powerful/migration.sql +17 -0
package/migrations/20260918143800_fat_princess_powerful/snapshot.json +5523 -0
package/package.json +1 -1

package/dist/nextjs/server.js CHANGED Viewed

@@ -778,6 +778,187 @@ function createOAuth2AuthorizeHandlers(options) {
   }
   return { GET, POST };
 }
+// src/nextjs/revoke-all-page-handlers.ts
+import { cookies as cookies4 } from "next/headers.js";
+import { NextResponse as NextResponse3 } from "next/server";
+import { authApi as authApi3 } from "@spfn/auth";
+import { logger as logger4 } from "@spfn/core/logger";
+var CSRF_COOKIE = "spfn_revoke_all_csrf";
+var CSRF_TTL_SECONDS = 15 * 60;
+var FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+function screen2(status, body) {
+  return new NextResponse3(body, {
+    status,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Security-Policy": "frame-ancestors 'none'",
+      "Cache-Control": "no-store"
+    }
+  });
+}
+function refusalScreen2(status, heading, message) {
+  return screen2(status, [
+    "<!DOCTYPE html>",
+    '<html lang="en"><head><meta charset="utf-8"><title>Sign out everywhere</title></head>',
+    `<body><h1>${heading}</h1><p>${message}</p></body></html>`
+  ].join("\n"));
+}
+function missingTokenScreen() {
+  return refusalScreen2(
+    400,
+    "Incomplete link",
+    "This address is missing the part that identifies the request. Open the link from your email again, in full."
+  );
+}
+function unavailableScreen2() {
+  return refusalScreen2(
+    500,
+    "Sign-out unavailable",
+    "This link could not be checked. Nothing was changed. Please try again."
+  );
+}
+function unverifiedScreen() {
+  return refusalScreen2(
+    403,
+    "Request could not be verified",
+    "This form did not carry the token the page set for it. Open the link from your email again and press the button on the page it opens."
+  );
+}
+function unsupportedScreen() {
+  return refusalScreen2(
+    415,
+    "Unsupported request",
+    "This page is answered for a browser form. Open the link from your email again."
+  );
+}
+function hiddenFields2(fields, csrfToken) {
+  return [...Object.entries(fields), ["csrf", csrfToken]].map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`).join("\n        ");
+}
+function confirmBody(view) {
+  return `<h1>Sign out everywhere</h1>
+    <p>This will sign out <strong>${view.activeKeyCount}</strong> signed-in device(s), including
+        this one. You will need to sign in again afterwards.</p>
+    <p>The link stops working at <time datetime="${escapeHtml(view.expiresAt ?? "")}"
+        >${escapeHtml(view.expiresAt ?? "")}</time>.</p>
+    <form method="post">
+        ${hiddenFields2(view.fields, view.csrfToken)}
+        <button type="submit">Sign out every device</button>
+    </form>`;
+}
+function stageBody(view) {
+  if (view.stage === "confirm") {
+    return confirmBody(view);
+  }
+  if (view.stage === "done") {
+    return `<h1>Signed out</h1>
+    <p>${view.revokedCount} device(s) signed out. Sign in again to carry on.</p>`;
+  }
+  return `<h1>Link no longer valid</h1>
+    <p>This link cannot be used. Ask for a new one, and open the most recent email you were sent.</p>`;
+}
+function defaultRender2(view) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8"><title>Sign out everywhere</title></head>
+<body>
+    ${stageBody(view)}
+</body>
+</html>`;
+}
+function stageView(stage, revokedCount) {
+  return { stage, revokedCount, fields: {}, csrfToken: "" };
+}
+function statusOf2(thrown) {
+  const error = thrown;
+  return Number(error?.status ?? error?.statusCode ?? 0);
+}
+function answerRefusal2(thrown, render) {
+  if (statusOf2(thrown) === 404) {
+    return screen2(404, render(stageView("invalid")));
+  }
+  logger4.error("Revoke-all link could not be answered", { status: statusOf2(thrown) });
+  return unavailableScreen2();
+}
+function mintCsrfToken() {
+  return Array.from(crypto.getRandomValues(new Uint8Array(32))).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function setCsrfCookie(response, csrfToken, path) {
+  response.cookies.set(CSRF_COOKIE, csrfToken, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "strict",
+    path,
+    maxAge: CSRF_TTL_SECONDS
+  });
+  return response;
+}
+function clearCsrfCookie(response, path) {
+  response.cookies.delete({ name: CSRF_COOKIE, path });
+  return response;
+}
+async function renderConfirm(request, token, render) {
+  const described = await authApi3.confirmRevokeAllLink.call({ body: { token } });
+  const csrfToken = mintCsrfToken();
+  const response = screen2(200, render({
+    stage: "confirm",
+    expiresAt: described.expiresAt,
+    activeKeyCount: described.activeKeyCount,
+    fields: { token },
+    csrfToken
+  }));
+  return setCsrfCookie(response, csrfToken, request.nextUrl.pathname);
+}
+async function refuseUnverifiedPost2(form) {
+  const presented = form.get("csrf");
+  const expected = (await cookies4()).get(CSRF_COOKIE)?.value;
+  if (!expected || !matchesCsrfToken(expected, typeof presented === "string" ? presented : null)) {
+    return unverifiedScreen();
+  }
+  return null;
+}
+function isFormPost2(request) {
+  return (request.headers.get("content-type") ?? "").startsWith(FORM_CONTENT_TYPE);
+}
+async function consume(token, render) {
+  const { revokedCount } = await authApi3.consumeRevokeAllLink.call({ body: { token } });
+  return screen2(200, render(stageView("done", revokedCount)));
+}
+function createRevokeAllPageHandlers(options = {}) {
+  const render = options.render ?? defaultRender2;
+  async function GET(request) {
+    const token = request.nextUrl.searchParams.get("token");
+    if (!token) {
+      return missingTokenScreen();
+    }
+    try {
+      return await renderConfirm(request, token, render);
+    } catch (error) {
+      return answerRefusal2(error, render);
+    }
+  }
+  async function POST(request) {
+    if (!isFormPost2(request)) {
+      return unsupportedScreen();
+    }
+    const form = await request.formData();
+    const refusal = await refuseUnverifiedPost2(form);
+    if (refusal) {
+      return refusal;
+    }
+    const path = request.nextUrl.pathname;
+    const token = form.get("token");
+    if (typeof token !== "string" || !token) {
+      return clearCsrfCookie(missingTokenScreen(), path);
+    }
+    try {
+      return clearCsrfCookie(await consume(token, render), path);
+    } catch (error) {
+      return clearCsrfCookie(answerRefusal2(error, render), path);
+    }
+  }
+  return { GET, POST };
+}
 export {
   RequireAuth,
   RequirePermission,
@@ -787,6 +968,7 @@ export {
   clearSessionCookies,
   createOAuth2AuthorizeHandlers,
   createOAuthCallbackHandler,
+  createRevokeAllPageHandlers,
   escapeHtml,
   getAuthSessionData,
   getPendingSession,