@spfn/auth 0.3.0-beta.23 → 0.3.0-beta.24

package/dist/nextjs/api.js

@@ -438,10 +438,113 @@ function pushCsrfCookieRemoval(setCookies) {
   });
 }
 
+// src/nextjs/interceptors/session-binding.ts
+import { SessionResealFailedError } from "@spfn/auth/errors";
+
+// src/server/lib/ua-family.ts
+var FAMILY_MARKERS = [
+  { family: "edge", marker: /\bEdg(?:A|iOS)?\// },
+  { family: "chrome", marker: /\b(?:Chrome|CriOS)\// },
+  { family: "firefox", marker: /\b(?:Firefox|FxiOS)\// },
+  { family: "safari", marker: /\bSafari\// }
+];
+function uaFamily(userAgent) {
+  if (!userAgent) {
+    return "other";
+  }
+  return FAMILY_MARKERS.find((entry) => entry.marker.test(userAgent))?.family ?? "other";
+}
+
+// src/nextjs/interceptors/error-envelope.ts
+function refusalEnvelope(error, setCookies = []) {
+  const body = error.toJSON();
+  return {
+    status: error.statusCode,
+    body: {
+      ...body,
+      error: {
+        code: body.__type,
+        message: body.message,
+        requestId: mintRequestId()
+      }
+    },
+    setCookies
+  };
+}
+function mintRequestId() {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/nextjs/interceptors/session-binding.ts
+function bindingSessionFields(body, userAgent) {
+  if (body?.sessionBinding !== "passkey" || typeof body.keyExpiresAtMillis !== "number") {
+    return {};
+  }
+  return {
+    binding: "passkey",
+    keyExpiresAt: body.keyExpiresAtMillis,
+    ...userAgent ? { uaFamily: uaFamily(userAgent) } : {}
+  };
+}
+var sessionBindingInterceptor = {
+  pathPattern: "/_auth/session/binding",
+  method: "POST",
+  response: async (ctx, next) => {
+    const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);
+    if (ctx.response.status !== 200 || !sessionCookie) {
+      await next();
+      return;
+    }
+    try {
+      const session = await unsealSession(sessionCookie);
+      await pushResealed(ctx.setCookies, applyBinding(session, ctx.response.body, ctx.request.headers));
+    } catch (error) {
+      authLogger.interceptor.general.error("Failed to re-seal the session after a binding change", error);
+      refuseAsUnsealable(ctx);
+    }
+    await next();
+  }
+};
+function refuseAsUnsealable(ctx) {
+  const refusal2 = refusalEnvelope(new SessionResealFailedError());
+  ctx.response.status = refusal2.status;
+  ctx.response.ok = false;
+  ctx.response.body = refusal2.body;
+  for (const name of [COOKIE_NAMES.SESSION, COOKIE_NAMES.SESSION_KEY_ID]) {
+    ctx.setCookies.push({ name, value: "", options: { maxAge: 0, path: "/" } });
+  }
+  pushCsrfCookieRemoval(ctx.setCookies);
+}
+function applyBinding(session, body, requestHeaders) {
+  const { binding, keyExpiresAt, uaFamily: sealedFamily, ...unbound } = session;
+  if (body?.mode !== "passkey") {
+    return unbound;
+  }
+  const fields = bindingSessionFields(
+    { sessionBinding: body.mode, keyExpiresAtMillis: body.keyExpiresAtMillis },
+    requestHeaders["user-agent"]
+  );
+  return { ...unbound, ...fields, ...sealedFamily ? { uaFamily: sealedFamily } : {} };
+}
+async function pushResealed(setCookies, session) {
+  const ttl = getSessionTtl();
+  const options = {
+    httpOnly: true,
+    secure: cookieSecure,
+    sameSite: "lax",
+    maxAge: ttl,
+    path: "/"
+  };
+  setCookies.push({ name: COOKIE_NAMES.SESSION, value: await sealSession(session, ttl), options });
+  setCookies.push({ name: COOKIE_NAMES.SESSION_KEY_ID, value: session.keyId, options });
+  await pushCsrfCookie(setCookies, session.keyId, ttl);
+}
+
 // src/nextjs/interceptors/login-register.ts
 var ROTATING_SIGN_IN_PATHS = /* @__PURE__ */ new Set(["/_auth/login", "/_auth/passkeys/login/verify"]);
 var loginRegisterInterceptor = {
-  pathPattern: /^\/_auth\/(login|register|invitations\/accept|signup\/password|password\/reset\/complete|passkeys\/login\/verify)$/,
+  pathPattern: /^\/_auth\/(login|register|invitations\/accept|signup\/password|password\/reset\/complete|passkeys\/login\/verify|session\/renew\/verify)$/,
   method: "POST",
   request: async (ctx, next) => {
     const oldKeyId = ctx.cookies.get(COOKIE_NAMES.SESSION_KEY_ID);
@@ -482,7 +585,8 @@ var loginRegisterInterceptor = {
         userId: userData.userId,
         privateKey: ctx.metadata.privateKey,
         keyId: ctx.metadata.keyId,
-        algorithm: ctx.metadata.algorithm
+        algorithm: ctx.metadata.algorithm,
+        ...bindingSessionFields(userData, ctx.request.headers["user-agent"])
       };
       const sealed = await sealSession(sessionData, ttl);
       ctx.setCookies.push({
@@ -516,6 +620,12 @@ var loginRegisterInterceptor = {
   }
 };
 
+// src/nextjs/interceptors/general-auth.ts
+import { SessionContextChangedError, SessionRenewalRequiredError } from "@spfn/auth/errors";
+
+// src/nextjs/interceptors/session-renew.ts
+var SESSION_RENEW_PATH_PATTERN = /^\/_auth\/session\/renew\/(options|verify)$/;
+
 // src/nextjs/interceptors/general-auth.ts
 function requiresAuth(path) {
   const publicPaths = [
@@ -530,6 +640,25 @@ function requiresAuth(path) {
   ];
   return !publicPaths.some((pattern) => pattern.test(path));
 }
+function contextChanged(session, userAgent) {
+  return session.binding === "passkey" && Boolean(session.uaFamily) && Boolean(userAgent) && uaFamily(userAgent) !== session.uaFamily;
+}
+function refuseAsContextChanged(ctx) {
+  authLogger.interceptor.general.warn("Bound session presented from a different browser family", {
+    path: ctx.path,
+    sealed: ctx.metadata.sealedUaFamily,
+    presented: ctx.metadata.presentedUaFamily
+  });
+  const cleared = [
+    { name: COOKIE_NAMES.SESSION, value: "", options: { maxAge: 0, path: "/" } },
+    { name: COOKIE_NAMES.SESSION_KEY_ID, value: "", options: { maxAge: 0, path: "/" } },
+    { name: COOKIE_NAMES.CSRF, value: "", options: { maxAge: 0, path: "/" } }
+  ];
+  ctx.abort = refusalEnvelope(new SessionContextChangedError(), cleared);
+}
+function isKeyExpiredRefusal(body) {
+  return body?.__type === "KeyExpiredError";
+}
 var generalAuthInterceptor = {
   pathPattern: "*",
   // Match all paths, filter by requiresAuth()
@@ -569,6 +698,13 @@ var generalAuthInterceptor = {
       if (await refuseInvalidCsrf(ctx, session.keyId)) {
         return;
       }
+      const presented = ctx.request.headers.get("user-agent");
+      if (contextChanged(session, presented)) {
+        ctx.metadata.sealedUaFamily = session.uaFamily;
+        ctx.metadata.presentedUaFamily = uaFamily(presented);
+        refuseAsContextChanged(ctx);
+        return;
+      }
       const needsRefresh = await shouldRefreshSession(sessionCookie, 24);
       if (needsRefresh) {
         authLogger.interceptor.general.debug("Session needs refresh (within 24h of expiry)");
@@ -591,6 +727,7 @@ var generalAuthInterceptor = {
       ctx.metadata.userId = session.userId;
       ctx.metadata.keyId = session.keyId;
       ctx.metadata.sessionValid = true;
+      ctx.metadata.sessionBound = session.binding === "passkey";
     } catch (error) {
       const err = error;
       const msg = err.message.toLowerCase();
@@ -611,7 +748,12 @@ var generalAuthInterceptor = {
     await next();
   },
   response: async (ctx, next) => {
-    if (ctx.response.status === 401 && ctx.metadata.sessionValid) {
+    if (ctx.response.status === 401 && ctx.metadata.sessionValid && ctx.metadata.sessionBound && isKeyExpiredRefusal(ctx.response.body)) {
+      ctx.response.body = refusalEnvelope(new SessionRenewalRequiredError()).body;
+      await next();
+      return;
+    }
+    if (ctx.response.status === 401 && ctx.metadata.sessionValid && !SESSION_RENEW_PATH_PATTERN.test(ctx.path)) {
       authLogger.interceptor.general.warn("Backend returned 401, clearing session");
       ctx.setCookies.push({
         name: COOKIE_NAMES.SESSION,
@@ -761,6 +903,11 @@ var keyRotationInterceptor = {
       ctx.metadata.newKeyId = newKeyPair.keyId;
       ctx.metadata.newAlgorithm = newKeyPair.algorithm;
       ctx.metadata.userId = currentSession.userId;
+      ctx.metadata.bindingFields = currentSession.binding ? {
+        binding: currentSession.binding,
+        keyExpiresAt: currentSession.keyExpiresAt,
+        ...currentSession.uaFamily ? { uaFamily: currentSession.uaFamily } : {}
+      } : {};
     } catch (error) {
       const err = error;
       authLogger.interceptor.keyRotation.error("Failed to prepare key rotation", err);
@@ -783,7 +930,8 @@ var keyRotationInterceptor = {
         userId: ctx.metadata.userId,
         privateKey: ctx.metadata.newPrivateKey,
         keyId: ctx.metadata.newKeyId,
-        algorithm: ctx.metadata.newAlgorithm
+        algorithm: ctx.metadata.newAlgorithm,
+        ...ctx.metadata.bindingFields
       };
       const sealed = await sealSession(newSessionData, ttl);
       ctx.setCookies.push({
@@ -1044,7 +1192,8 @@ var oauthFinalizeInterceptor = {
         userId,
         privateKey: pendingSession.privateKey,
         keyId: pendingSession.keyId,
-        algorithm: pendingSession.algorithm
+        algorithm: pendingSession.algorithm,
+        ...bindingSessionFields(ctx.response.body, ctx.request.headers["user-agent"])
       }, ttl);
       ctx.setCookies.push({
         name: COOKIE_NAMES.SESSION,
@@ -1205,7 +1354,8 @@ var authInterceptors = [
   keyRotationInterceptor,
   oauthUrlInterceptor,
   oauthFinalizeInterceptor,
-  generalAuthInterceptor
+  generalAuthInterceptor,
+  sessionBindingInterceptor
 ];
 
 // src/nextjs/api.ts