@spfn/auth 0.3.0-beta.24 → 0.3.0-beta.25

package/dist/nextjs/server.d.ts

@@ -369,6 +369,18 @@ interface OAuthCallbackOptions {
      * @default '/auth/error'
      */
     errorRedirectUrl?: string;
+    /**
+     * App page that asks for the second factor, when the callback carries a
+     * step-up challenge instead of a session (#95).
+     *
+     * An override for `SPFN_AUTH_MFA_CONFIRM_PATH`, which is where every other
+     * app-page path in this package lives; the env var is the one to set, and
+     * this exists for an app mounting two handlers on different screens. The
+     * handler redirects to it with `?challenge=` and `?returnUrl=`.
+     *
+     * @default env SPFN_AUTH_MFA_CONFIRM_PATH, then '/auth/mfa'
+     */
+    mfaPath?: string;
 }
 /**
  * Create OAuth callback handler for Next.js API Route
@@ -379,6 +391,11 @@ interface OAuthCallbackOptions {
  * 3. Creates full session and saves to cookie
  * 4. Redirects to returnUrl
  *
+ * When the account has a second factor and this device is new to it (#95) the
+ * backend sends `mfaChallenge` in place of `userId` and `keyId`. No session is
+ * sealed; the browser goes to `SPFN_AUTH_MFA_CONFIRM_PATH` with the challenge,
+ * and the session is sealed by `mfaVerifyInterceptor` once the page proves it.
+ *
  * @example
  * ```typescript
  * // /api/auth/callback/route.ts

package/dist/nextjs/server.js

@@ -158,6 +158,18 @@ var COOKIE_NAMES = {
   get OAUTH_PENDING() {
     return `spfn_oauth_pending${getCookieSuffix()}`;
   },
+  /**
+   * Pending second-factor session (privateKey, keyId, challengeHash) (#95)
+   *
+   * Its own name and its own audience, separate from OAUTH_PENDING. The two
+   * coexist: a person who starts a social login in one tab while a password
+   * step-up is outstanding in another has both flows live, and one name would
+   * mean the second overwrote the first — sealing a session with a private key
+   * that does not match the key being activated.
+   */
+  get MFA_PENDING() {
+    return `spfn_mfa_pending${getCookieSuffix()}`;
+  },
   /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
   get OAUTH_CSRF() {
     return `spfn_oauth_csrf${getCookieSuffix()}`;
@@ -272,20 +284,21 @@ async function clearSession() {
   cookieStore.delete(COOKIE_NAMES.SESSION_KEY_ID);
   cookieStore.delete(COOKIE_NAMES.CSRF);
 }
-async function getPendingSessionKey() {
+async function getPendingSessionKey(purpose) {
   const secret = env4.SPFN_AUTH_SESSION_SECRET;
   const encoder = new TextEncoder();
-  const data = encoder.encode(`oauth-pending:${secret}`);
+  const data = encoder.encode(purpose === "oauth" ? `oauth-pending:${secret}` : `mfa-pending:${secret}`);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
   return new Uint8Array(hashBuffer);
 }
 async function sealPendingSession(data, ttl = 600) {
-  const key = await getPendingSessionKey();
-  return await new jose2.EncryptJWT({ data }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${ttl}s`).setIssuer("spfn-auth").setAudience("spfn-oauth").encrypt(key);
+  return await sealFor("oauth", data, ttl);
+}
+async function sealFor(purpose, data, ttl) {
+  return await new jose2.EncryptJWT({ data }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${ttl}s`).setIssuer("spfn-auth").setAudience(purpose === "oauth" ? "spfn-oauth" : "spfn-mfa").encrypt(await getPendingSessionKey(purpose));
 }
 async function unsealPendingSession(jwt) {
-  const key = await getPendingSessionKey();
-  const { payload } = await jose2.jwtDecrypt(jwt, key, {
+  const { payload } = await jose2.jwtDecrypt(jwt, await getPendingSessionKey("oauth"), {
     issuer: "spfn-auth",
     audience: "spfn-oauth"
   });
@@ -461,6 +474,7 @@ function clearSessionCookies(response) {
 import { NextResponse } from "next/server";
 import { cookies as cookies2 } from "next/headers.js";
 import { env as env5 } from "@spfn/core/config";
+import { env as authEnv } from "@spfn/auth/config";
 import { logger as logger2 } from "@spfn/core/logger";
 
 // src/lib/return-path.ts
@@ -528,6 +542,15 @@ function bindingFromQuery(searchParams) {
   }
   return { sessionBinding: "passkey", keyExpiresAtMillis: expiresAt };
 }
+function mfaRedirect(request, challenge, returnUrl, configured) {
+  const path = configured || authEnv.SPFN_AUTH_MFA_CONFIRM_PATH || DEFAULT_MFA_CONFIRM_PATH;
+  const target = new URL(path, request.url);
+  target.searchParams.set("challenge", challenge);
+  target.searchParams.set("returnUrl", returnUrl);
+  logger2.debug("OAuth callback needs a second factor", { path });
+  return NextResponse.redirect(target);
+}
+var DEFAULT_MFA_CONFIRM_PATH = "/auth/mfa";
 function createOAuthCallbackHandler(options) {
   const defaultRedirect = options?.defaultRedirectUrl || "/";
   const errorRedirect = options?.errorRedirectUrl || "/auth/error";
@@ -542,6 +565,10 @@ function createOAuthCallbackHandler(options) {
       errorUrl.searchParams.set("error", error);
       return NextResponse.redirect(errorUrl);
     }
+    const mfaChallenge = searchParams.get("mfaChallenge");
+    if (mfaChallenge) {
+      return mfaRedirect(request, mfaChallenge, returnUrl, options?.mfaPath);
+    }
     if (!userId || !keyId) {
       logger2.error("OAuth callback missing required params", { userId: !!userId, keyId: !!keyId });
       const errorUrl = new URL(errorRedirect, request.url);