@spfn/auth 0.3.0-beta.26 → 0.3.0-beta.27

package/dist/server.js

@@ -8505,6 +8505,77 @@ var init_mfa_enrolment_repository = __esm({
   }
 });
 
+// src/server/lib/device-auth-waiters.ts
+import { onAfterCommit } from "@spfn/core/db";
+function announceDeviceAuthAnswered(ids) {
+  if (ids.length === 0) {
+    return;
+  }
+  onAfterCommit(() => {
+    for (const id26 of ids) {
+      wake(id26);
+    }
+  });
+}
+function wake(id26) {
+  const parked = waiters.get(id26);
+  if (!parked) {
+    return;
+  }
+  waiters.delete(id26);
+  for (const resolve of parked) {
+    resolve();
+  }
+}
+function waitForDeviceAuthAnswer(id26, timeoutMs, signal) {
+  if (signal?.aborted) {
+    return Promise.resolve();
+  }
+  return new Promise((resolve) => {
+    const parked = waiters.get(id26) ?? /* @__PURE__ */ new Set();
+    const done = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done);
+      unpark(id26, parked, done);
+      resolve();
+    };
+    const timer = setTimeout(done, timeoutMs);
+    signal?.addEventListener("abort", done, { once: true });
+    parked.add(done);
+    waiters.set(id26, parked);
+  });
+}
+function unpark(id26, parked, resolver) {
+  parked.delete(resolver);
+  if (parked.size === 0 && waiters.get(id26) === parked) {
+    waiters.delete(id26);
+  }
+}
+function waitingOnDeviceAuth(id26) {
+  return waiting.get(id26) ?? 0;
+}
+async function holdDeviceAuthWait(id26, wait) {
+  waiting.set(id26, waitingOnDeviceAuth(id26) + 1);
+  try {
+    return await wait();
+  } finally {
+    const left = waitingOnDeviceAuth(id26) - 1;
+    if (left > 0) {
+      waiting.set(id26, left);
+    } else {
+      waiting.delete(id26);
+    }
+  }
+}
+var waiters, waiting;
+var init_device_auth_waiters = __esm({
+  "src/server/lib/device-auth-waiters.ts"() {
+    "use strict";
+    waiters = /* @__PURE__ */ new Map();
+    waiting = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/server/repositories/device-authorizations.repository.ts
 import { BaseRepository as BaseRepository14 } from "@spfn/core/db";
 import { eq as eq14, and as and14, gt as gt7, inArray as inArray2, sql as sql9 } from "drizzle-orm";
@@ -8513,6 +8584,7 @@ var init_device_authorizations_repository = __esm({
   "src/server/repositories/device-authorizations.repository.ts"() {
     "use strict";
     init_device_authorizations();
+    init_device_auth_waiters();
     notExpired = () => gt7(deviceAuthorizations.expiresAt, sql9`now()`);
     DeviceAuthorizationsRepository = class extends BaseRepository14 {
       /**
@@ -8555,6 +8627,19 @@ var init_device_authorizations_repository = __esm({
         const result = await this.readDb.select().from(deviceAuthorizations).where(eq14(deviceAuthorizations.deviceCodeHash, deviceCodeHash)).limit(1);
         return result[0] ?? null;
       }
+      /**
+       * `findByDeviceCodeHash`, read from the primary even outside a transaction.
+       *
+       * For the long poll's wait, which runs before any transaction opens: it is
+       * woken right after an answer commits, and a replica that has not caught up
+       * yet would show it the record still pending and send it back to sleep.
+       *
+       * Write primary.
+       */
+      async findByDeviceCodeHashOnPrimary(deviceCodeHash) {
+        const result = await this.db.select().from(deviceAuthorizations).where(eq14(deviceAuthorizations.deviceCodeHash, deviceCodeHash)).limit(1);
+        return result[0] ?? null;
+      }
       /**
        * Bind the approving user and move the record to `approved`, but only from
        * `pending`.
@@ -8572,7 +8657,7 @@ var init_device_authorizations_repository = __esm({
             notExpired()
           )
         ).returning();
-        return result[0] ?? null;
+        return this.answered(result[0] ?? null);
       }
       /**
        * Move the record to `denied`, but only from `pending`.
@@ -8589,7 +8674,7 @@ var init_device_authorizations_repository = __esm({
             notExpired()
           )
         ).returning();
-        return result[0] ?? null;
+        return this.answered(result[0] ?? null);
       }
       /**
        * Refuse every authorization a user still has in flight.
@@ -8617,12 +8702,14 @@ var init_device_authorizations_repository = __esm({
        * @returns the rows this call refused
        */
       async denyAllActiveByUserId(userId) {
-        return await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
+        const denied = await this.db.update(deviceAuthorizations).set({ status: "denied" }).where(
           and14(
             eq14(deviceAuthorizations.userId, userId),
             inArray2(deviceAuthorizations.status, ["pending", "approved"])
           )
         ).returning();
+        announceDeviceAuthAnswered(denied.map((record) => record.id));
+        return denied;
       }
       /**
        * Spend an approved record, but only from `approved`, and address it by the
@@ -8645,6 +8732,13 @@ var init_device_authorizations_repository = __esm({
         ).returning();
         return result[0] ?? null;
       }
+      /** Wake the polls parked on a record this call moved, and hand the row back. */
+      answered(record) {
+        if (record) {
+          announceDeviceAuthAnswered([record.id]);
+        }
+        return record;
+      }
     };
     deviceAuthorizationsRepository = new DeviceAuthorizationsRepository();
   }
@@ -11587,7 +11681,7 @@ import { InvalidKeyFingerprintError, KeyIdAlreadyRegisteredError } from "@spfn/a
 import { ValidationError as ValidationError3 } from "@spfn/core/errors";
 
 // src/server/services/device-registration.service.ts
-import { onAfterCommit } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit2 } from "@spfn/core/db";
 
 // src/server/events/index.ts
 init_esm();
@@ -11739,7 +11833,7 @@ init_repositories();
 var DEVICE_EVENT_FINGERPRINT_PREFIX_LENGTH = 12;
 async function emitDeviceRegistered(row, channel) {
   const mfaEnrolled = await mfaEnrolmentRepository.isEnrolled(row.userId);
-  onAfterCommit(() => authDeviceRegisteredEvent.emit({
+  onAfterCommit2(() => authDeviceRegisteredEvent.emit({
     userId: String(row.userId),
     keyId: row.keyId,
     algorithm: row.algorithm,
@@ -11757,7 +11851,7 @@ async function emitDeviceRegistered(row, channel) {
 // src/server/services/mfa.service.ts
 init_logger();
 init_config();
-import { onAfterCommit as onAfterCommit2, runInTransaction as runInTransaction2 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit3, runInTransaction as runInTransaction2 } from "@spfn/core/db";
 import { ValidationError as ValidationError2 } from "@spfn/core/errors";
 import {
   MfaAlreadyEnrolledError,
@@ -12230,7 +12324,7 @@ async function releaseDeferredAnnouncements(row, key) {
     return;
   }
   const mfaEnrolled = await mfaEnrolledForUser(row.userId);
-  onAfterCommit2(() => authLoginEvent.emit({ ...row.loginEvent, userId: String(row.userId), mfaEnrolled }));
+  onAfterCommit3(() => authLoginEvent.emit({ ...row.loginEvent, userId: String(row.userId), mfaEnrolled }));
 }
 async function verifyMfaChallengeService(params) {
   const challengeHash = hashCredential(params.challenge);
@@ -12324,7 +12418,7 @@ async function countConfirmFailure(userId) {
 function readSecret(secretEnc, userId) {
   const { value, needsRotation } = decryptMfaSecret(secretEnc, userId);
   if (needsRotation) {
-    onAfterCommit2(() => mfaTotpRepository.updateSecret(userId, encryptMfaSecret(value, userId)));
+    onAfterCommit3(() => mfaTotpRepository.updateSecret(userId, encryptMfaSecret(value, userId)));
   }
   return value;
 }
@@ -12633,7 +12727,7 @@ init_key_policy();
 // src/server/services/account-deletion.service.ts
 init_repositories();
 import { ValidationError as ValidationError4, NotFoundError as NotFoundError2 } from "@spfn/core/errors";
-import { runInTransaction as runInTransaction3, onAfterCommit as onAfterCommit3 } from "@spfn/core/db";
+import { runInTransaction as runInTransaction3, onAfterCommit as onAfterCommit4 } from "@spfn/core/db";
 import { sendEmail as sendEmail3 } from "@spfn/notification/server";
 import {
   InvalidCredentialsError,
@@ -12790,13 +12884,13 @@ async function requestAccountDeletionService(userId, params) {
   await keysRepository.revokeAllActiveByUserId(user.id, "Account deletion requested");
   await deviceAuthorizationsRepository.denyAllActiveByUserId(user.id);
   await revokeAllOAuth2GrantsForUser(user.id);
-  onAfterCommit3(() => authDeletionRequestedEvent.emit({
+  onAfterCommit4(() => authDeletionRequestedEvent.emit({
     userId: String(user.id),
     userPublicId: user.publicId,
     purgeScheduledAt: purgeScheduledAt.toISOString(),
     requestedBy
   }));
-  onAfterCommit3(() => notifyDeletionRequested(user, purgeScheduledAt));
+  onAfterCommit4(() => notifyDeletionRequested(user, purgeScheduledAt));
   if (gracePeriodDays === 0) {
     await purgePendingRequest(request);
   }
@@ -12828,11 +12922,11 @@ async function cancelAccountDeletionService(params) {
     throw new DeletionNotRequestedError();
   }
   await usersRepository.reactivateFromPendingDeletion(user.id);
-  onAfterCommit3(() => authDeletionCancelledEvent.emit({
+  onAfterCommit4(() => authDeletionCancelledEvent.emit({
     userId: String(user.id),
     userPublicId: user.publicId
   }));
-  onAfterCommit3(() => notifyDeletionCancelled(user));
+  onAfterCommit4(() => notifyDeletionCancelled(user));
   return { userId: String(user.id) };
 }
 async function anonymizeUser(user) {
@@ -12919,9 +13013,9 @@ async function purgePendingRequest(request) {
   }
   const { email, publicId } = purgedUser;
   if (email) {
-    onAfterCommit3(() => notifyPurgeFinal(email));
+    onAfterCommit4(() => notifyPurgeFinal(email));
   }
-  onAfterCommit3(() => authDeletionCompletedEvent.emit({
+  onAfterCommit4(() => authDeletionCompletedEvent.emit({
     userPublicId: publicId,
     purgeStrategy
   }));
@@ -13275,7 +13369,7 @@ init_repositories();
 import { env as env11 } from "@spfn/auth/config";
 import { PasswordResetLinkError, PasswordResetSessionError } from "@spfn/auth/errors";
 import { ValidationError as ValidationError6 } from "@spfn/core/errors";
-import { onAfterCommit as onAfterCommit4 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit5 } from "@spfn/core/db";
 init_key_policy();
 async function activeUserOf(userId) {
   const user = await usersRepository.findByIdOnPrimary(userId);
@@ -13376,7 +13470,7 @@ async function completePasswordResetService(params) {
     throw new PasswordResetSessionError();
   }
   const registered = await replaceCredentials(row, user, params);
-  onAfterCommit4(() => authPasswordResetEvent.emit({
+  onAfterCommit5(() => authPasswordResetEvent.emit({
     userId: String(user.id),
     email: row.email
   }));
@@ -13468,21 +13562,26 @@ import {
   DeviceAuthDeniedError,
   InvalidKeyFingerprintError as InvalidKeyFingerprintError2
 } from "@spfn/auth/errors";
-import { onAfterCommit as onAfterCommit5 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit6 } from "@spfn/core/db";
+import { getShutdownManager } from "@spfn/core/server";
 
 // src/server/lib/device-auth-config.ts
 var DEFAULT_DEVICE_AUTH_TTL_MS = 10 * 60 * 1e3;
 var DEFAULT_DEVICE_AUTH_INTERVAL_MS = 5 * 1e3;
+var DEFAULT_DEVICE_AUTH_MAX_WAIT_MS = 20 * 1e3;
 var config2 = {
   ttlMs: DEFAULT_DEVICE_AUTH_TTL_MS,
-  intervalMs: DEFAULT_DEVICE_AUTH_INTERVAL_MS
+  intervalMs: DEFAULT_DEVICE_AUTH_INTERVAL_MS,
+  maxWaitMs: DEFAULT_DEVICE_AUTH_MAX_WAIT_MS
 };
 function configureDeviceAuth(options) {
   const ttlMs = options?.ttlMs ?? DEFAULT_DEVICE_AUTH_TTL_MS;
   const intervalMs = options?.intervalMs ?? DEFAULT_DEVICE_AUTH_INTERVAL_MS;
+  const maxWaitMs = options?.maxWaitMs ?? DEFAULT_DEVICE_AUTH_MAX_WAIT_MS;
   assertWholeMillis("ttlMs", ttlMs);
   assertWholeMillis("intervalMs", intervalMs);
-  config2 = { ttlMs, intervalMs };
+  assertWholeMillis("maxWaitMs", maxWaitMs);
+  config2 = { ttlMs, intervalMs, maxWaitMs };
 }
 function assertWholeMillis(name, value) {
   if (!Number.isInteger(value) || value <= 0) {
@@ -13495,6 +13594,9 @@ function getDeviceAuthConfig() {
   return config2;
 }
 
+// src/server/services/device-auth.service.ts
+init_device_auth_waiters();
+
 // src/server/lib/device-code.ts
 import { createHash, randomBytes, randomInt } from "crypto";
 var USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
@@ -13524,6 +13626,8 @@ function hashDeviceCode(deviceCode) {
 // src/server/services/device-auth.service.ts
 init_key_policy();
 var USER_CODE_ATTEMPTS = 3;
+var WAIT_RECHECK_MS = 1e3;
+var MAX_WAITERS_PER_RECORD = 3;
 function assertActionable(record) {
   if (!record || record.status === "consumed") {
     throw new DeviceAuthNotFoundError();
@@ -13623,6 +13727,37 @@ async function denyDeviceAuthService(params) {
     );
   }
 }
+async function waitForDeviceAuthAnswerService(params) {
+  const requested = Math.min(params.waitMillis, getDeviceAuthConfig().maxWaitMs);
+  const deviceCodeHash = hashDeviceCode(params.deviceCode);
+  const record = requested > 0 ? await readWaitable(deviceCodeHash) : null;
+  if (!record || waitingOnDeviceAuth(record.id) >= MAX_WAITERS_PER_RECORD) {
+    return 0;
+  }
+  const startedAt = Date.now();
+  const deadline = Math.min(startedAt + requested, record.expiresAt.getTime());
+  await holdDeviceAuthWait(record.id, () => waitUntil(record.id, deviceCodeHash, deadline, params.signal));
+  return Date.now() - startedAt;
+}
+async function waitUntil(id26, deviceCodeHash, deadline, signal) {
+  while (!signal?.aborted && !getShutdownManager().isShuttingDown()) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      return;
+    }
+    await waitForDeviceAuthAnswer(id26, Math.min(remaining, WAIT_RECHECK_MS), signal);
+    if (!await readWaitable(deviceCodeHash)) {
+      return;
+    }
+  }
+}
+async function readWaitable(deviceCodeHash) {
+  const record = await deviceAuthorizationsRepository.findByDeviceCodeHashOnPrimary(deviceCodeHash).catch(() => null);
+  return isWaitable(record) ? record : null;
+}
+function isWaitable(record) {
+  return record?.status === "pending" && record.expiresAt.getTime() > Date.now();
+}
 async function pollDeviceAuthService(params) {
   const deviceCodeHash = hashDeviceCode(params.deviceCode);
   const record = assertActionable(
@@ -13632,7 +13767,10 @@ async function pollDeviceAuthService(params) {
     throw new DeviceAuthDeniedError();
   }
   if (record.status === "pending") {
-    return { status: "pending", intervalMillis: getDeviceAuthConfig().intervalMs };
+    return {
+      status: "pending",
+      intervalMillis: Math.max(0, getDeviceAuthConfig().intervalMs - (params.waitedMillis ?? 0))
+    };
   }
   const consumed = await deviceAuthorizationsRepository.consumeApproved(deviceCodeHash);
   if (!consumed) {
@@ -13688,7 +13826,7 @@ async function completeDeviceLogin(record, provenance) {
     ...loginBindingFields(registeredBinding(registered))
   };
   const mfaEnrolled = await mfaEnrolledForUser(user.id);
-  onAfterCommit5(() => authLoginEvent.emit({
+  onAfterCommit6(() => authLoginEvent.emit({
     userId: String(user.id),
     provider: "device",
     email: result.email,
@@ -13701,7 +13839,7 @@ async function completeDeviceLogin(record, provenance) {
 // src/server/services/passkey.service.ts
 init_logger();
 init_config();
-import { onAfterCommit as onAfterCommit6, runInTransaction as runInTransaction4 } from "@spfn/core/db";
+import { onAfterCommit as onAfterCommit7, runInTransaction as runInTransaction4 } from "@spfn/core/db";
 import { ValidationError as ValidationError8 } from "@spfn/core/errors";
 import {
   AccountDisabledError as AccountDisabledError3,
@@ -13819,7 +13957,7 @@ async function finishPasskeyEnrollmentService(params) {
     aaguid: verified.aaguid,
     label: params.label ?? null
   });
-  onAfterCommit6(() => passkeyEnrolledEvent.emit({
+  onAfterCommit7(() => passkeyEnrolledEvent.emit({
     userId: String(params.userId),
     passkeyId: String(row.id),
     label: row.label ?? void 0
@@ -13919,7 +14057,7 @@ async function startSession(user, params) {
     ...loginBindingFields(registeredBinding(registered))
   };
   const mfaEnrolled = await mfaEnrolledForUser(user.id);
-  onAfterCommit6(() => authLoginEvent.emit({
+  onAfterCommit7(() => authLoginEvent.emit({
     userId: String(user.id),
     provider: "passkey",
     email: result.email,
@@ -14002,7 +14140,7 @@ async function revokePasskeyService(params) {
   if (!revoked) {
     throw new PasskeyNotFoundError2();
   }
-  onAfterCommit6(() => passkeyRevokedEvent.emit({
+  onAfterCommit7(() => passkeyRevokedEvent.emit({
     userId: String(params.userId),
     passkeyId: String(revoked.id),
     reason: "user"
@@ -15830,7 +15968,7 @@ async function oauthUnlinkNotifyService(provider, notification) {
 }
 
 // src/server/services/oauth-native.service.ts
-import { runInTransaction as runInTransaction5, onAfterCommit as onAfterCommit7 } from "@spfn/core/db";
+import { runInTransaction as runInTransaction5, onAfterCommit as onAfterCommit8 } from "@spfn/core/db";
 import {
   InvalidKeyFingerprintError as InvalidKeyFingerprintError3,
   NativeSignInUnsupportedError as NativeSignInUnsupportedError5,
@@ -15903,7 +16041,7 @@ async function persistNativeLogin(identity, params) {
     }
     await updateLastLoginService(userId);
     const mfaEnrolled = isNewUser ? false : await mfaEnrolledForUser(userId);
-    onAfterCommit7(() => isNewUser ? authRegisterEvent.emit(eventPayload) : authLoginEvent.emit({ ...eventPayload, mfaEnrolled }));
+    onAfterCommit8(() => isNewUser ? authRegisterEvent.emit(eventPayload) : authLoginEvent.emit({ ...eventPayload, mfaEnrolled }));
     return { mfaRequired: false, userId: String(userId), keyId: params.keyId, isNewUser };
   }, { context: "auth:oauth-native" });
 }
@@ -16937,6 +17075,31 @@ function attestedClientIp(c) {
   return provenance.webProxy ? provenance.ip ?? null : null;
 }
 
+// src/server/middleware/device-auth-long-poll.ts
+var DEVICE_AUTH_WAITED_MILLIS = "deviceAuthWaitedMillis";
+function deviceAuthLongPoll() {
+  return async (c, next) => {
+    const target = waitTarget(await c.req.json().catch(() => null));
+    if (!target) {
+      return next();
+    }
+    const signal = c.req.raw.signal;
+    const waitedMillis = await waitForDeviceAuthAnswerService({ ...target, signal });
+    if (signal.aborted) {
+      return c.body(null, 204);
+    }
+    c.set(DEVICE_AUTH_WAITED_MILLIS, waitedMillis);
+    return next();
+  };
+}
+function waitTarget(body) {
+  const { deviceCode, waitMillis } = body ?? {};
+  if (typeof deviceCode !== "string" || !Number.isInteger(waitMillis) || waitMillis <= 0) {
+    return null;
+  }
+  return { deviceCode, waitMillis };
+}
+
 // src/server/routes/auth/index.ts
 var sendVerificationCode = route.post("/_auth/codes").input({
   body: Type.Object({
@@ -17095,11 +17258,23 @@ var startDeviceAuth = route.post("/_auth/device/start").input({
 });
 var pollDeviceAuth = route.post("/_auth/device/poll").input({
   body: Type.Object({
-    deviceCode: Type.String({ description: "Device code returned by /_auth/device/start" })
+    deviceCode: Type.String({ description: "Device code returned by /_auth/device/start" }),
+    waitMillis: Type.Optional(Type.Integer({
+      minimum: 0,
+      description: "Longest to hold the request while nobody has answered; capped by the server"
+    }))
   })
-}).use([rateLimitPolicy("auth-device-poll", { limit: 30, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
+}).use([
+  rateLimitPolicy("auth-device-poll", { limit: 30, windowMs: 6e4 }),
+  deviceAuthLongPoll(),
+  Transactional()
+]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
-  return await pollDeviceAuthService({ ...body, ...deviceProvenance(c.raw) });
+  return await pollDeviceAuthService({
+    deviceCode: body.deviceCode,
+    ...deviceProvenance(c.raw),
+    waitedMillis: Number(c.raw.get(DEVICE_AUTH_WAITED_MILLIS) ?? 0)
+  });
 });
 var getDeviceAuthInfo = route.post("/_auth/device/info").input({
   body: Type.Object({
@@ -18176,7 +18351,7 @@ var CORE_PREREQUISITE_OPERATIONS = [
 
 // src/server/client-proof/contract-bundle.ts
 init_wire_headers();
-var CONTRACT_VERSION = "0.13.0";
+var CONTRACT_VERSION = "0.13.1";
 var CONTRACT_SUPPORTED_RANGE = ">=0.13.0 <0.14.0";
 function required(name, type) {
   return { name, type, optional: false };
@@ -18510,7 +18685,8 @@ var CONTRACT_TYPES = [
   {
     name: "PollDeviceAuthRequest",
     fields: [
-      required("deviceCode", "string")
+      required("deviceCode", "string"),
+      optional("waitMillis", "integer")
     ]
   },
   /**
@@ -21479,6 +21655,7 @@ export {
   DEFAULT_DELETION_PURGE_STRATEGY,
   DEFAULT_DELETION_SEND_NOTIFICATIONS,
   DEFAULT_DEVICE_AUTH_INTERVAL_MS,
+  DEFAULT_DEVICE_AUTH_MAX_WAIT_MS,
   DEFAULT_DEVICE_AUTH_TTL_MS,
   DEFAULT_REFRESH_TOKEN_TTL_MS,
   DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON,