@spfn/auth 0.3.0-beta.7 → 0.3.0-beta.8

package/dist/nextjs/api.js

@@ -96,7 +96,8 @@ var authLogger = {
     general: rootLogger.child("@spfn/auth:interceptor:general"),
     login: rootLogger.child("@spfn/auth:interceptor:login"),
     keyRotation: rootLogger.child("@spfn/auth:interceptor:key-rotation"),
-    oauth: rootLogger.child("@spfn/auth:interceptor:oauth")
+    oauth: rootLogger.child("@spfn/auth:interceptor:oauth"),
+    csrf: rootLogger.child("@spfn/auth:interceptor:csrf")
   },
   session: rootLogger.child("@spfn/auth:session"),
   service: rootLogger.child("@spfn/auth:service"),
@@ -214,6 +215,10 @@ var COOKIE_NAMES = {
   /** Password-setup session for verified-email signup — temporary, single-purpose */
   get SIGNUP_SETUP() {
     return `spfn_signup_setup${getCookieSuffix()}`;
+  },
+  /** CSRF token — the only cookie here the browser can read */
+  get CSRF() {
+    return `spfn_csrf${getCookieSuffix()}`;
   }
 };
 function parseDuration(duration) {
@@ -256,6 +261,28 @@ function getSessionTtl(override) {
   }
   return 7 * 24 * 60 * 60;
 }
+var CSRF_MODES = ["off", "warn", "enforce"];
+var unrecognizedCsrfModeReported = false;
+function getCsrfMode() {
+  const configured = globalConfig.csrf?.mode ?? env2.SPFN_AUTH_CSRF;
+  if (!configured) {
+    return "warn";
+  }
+  const normalized = String(configured).trim().toLowerCase();
+  if (!CSRF_MODES.includes(normalized)) {
+    if (!unrecognizedCsrfModeReported) {
+      unrecognizedCsrfModeReported = true;
+      authLogger.interceptor.csrf.error(
+        `Unrecognized CSRF mode "${configured}" \u2014 expected off | warn | enforce. Enforcing.`
+      );
+    }
+    return "enforce";
+  }
+  return normalized;
+}
+function getCsrfExemptPaths() {
+  return globalConfig.csrf?.exemptPaths ?? [];
+}
 
 // src/nextjs/interceptors/cookie-options.ts
 function resolveSecure() {
@@ -267,6 +294,140 @@ function resolveSecure() {
 }
 var cookieSecure = resolveSecure();
 
+// src/server/lib/csrf.ts
+import { env as env3 } from "@spfn/auth/config";
+var CSRF_HEADER = "x-spfn-csrf";
+var CSRF_SUBKEY_LABEL = "spfn-auth-csrf-token-v1";
+var MAX_CANDIDATES = 32;
+function sessionSecret() {
+  const secret = env3.SPFN_AUTH_SESSION_SECRET;
+  if (!secret) {
+    throw new Error(
+      "SPFN_AUTH_SESSION_SECRET is required for CSRF protection. Set it (sessions need it anyway), or set SPFN_AUTH_CSRF=off."
+    );
+  }
+  return secret;
+}
+async function hmacSha256(key, message) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    key.buffer,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(message));
+  return new Uint8Array(signature);
+}
+function toHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function deriveCsrfToken(keyId) {
+  const subkey = await hmacSha256(new TextEncoder().encode(sessionSecret()), CSRF_SUBKEY_LABEL);
+  return toHex(await hmacSha256(subkey, keyId));
+}
+function timingSafeEqualString(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let i = 0; i < a.length; i++) {
+    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return difference === 0;
+}
+function matchesCsrfToken(expected, presented) {
+  if (!presented) {
+    return false;
+  }
+  return presented.split(",", MAX_CANDIDATES).some((candidate) => timingSafeEqualString(expected, candidate.trim()));
+}
+
+// src/nextjs/interceptors/csrf.ts
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function csrfCookie(token, ttl) {
+  return {
+    name: COOKIE_NAMES.CSRF,
+    value: token,
+    options: {
+      httpOnly: false,
+      secure: cookieSecure,
+      sameSite: "lax",
+      maxAge: ttl,
+      path: "/"
+    }
+  };
+}
+function refusal() {
+  return {
+    status: 403,
+    body: {
+      error: "Forbidden",
+      message: "CSRF token missing or invalid"
+    },
+    setCookies: []
+  };
+}
+async function refuseInvalidCsrf(ctx, keyId) {
+  const mode = getCsrfMode();
+  if (mode === "off" || SAFE_METHODS.has(ctx.method.toUpperCase())) {
+    return false;
+  }
+  if (getCsrfExemptPaths().includes(ctx.path)) {
+    authLogger.interceptor.csrf.debug("Path is CSRF-exempt", { path: ctx.path });
+    return false;
+  }
+  let expected;
+  try {
+    expected = await deriveCsrfToken(keyId);
+  } catch (error) {
+    authLogger.interceptor.csrf.error(
+      "Cannot derive the CSRF token \u2014 refusing regardless of mode",
+      error
+    );
+    ctx.abort = refusal();
+    return true;
+  }
+  const presented = ctx.request.headers.get(CSRF_HEADER);
+  if (matchesCsrfToken(expected, presented)) {
+    return false;
+  }
+  const detail = {
+    method: ctx.method,
+    path: ctx.path,
+    headerPresent: !!presented
+  };
+  if (mode === "warn") {
+    authLogger.interceptor.csrf.warn("CSRF check would refuse this request (mode=warn)", detail);
+    return false;
+  }
+  authLogger.interceptor.csrf.warn("CSRF check refused this request", detail);
+  ctx.abort = refusal();
+  ctx.abort.setCookies = [csrfCookie(expected, getSessionTtl())];
+  return true;
+}
+async function pushCsrfCookie(setCookies, keyId, ttl) {
+  setCookies.push(csrfCookie(await deriveCsrfToken(keyId), ttl));
+}
+async function pushCsrfCookieIfStale(setCookies, presented, keyId) {
+  try {
+    const token = await deriveCsrfToken(keyId);
+    if (presented && timingSafeEqualString(token, presented)) {
+      return;
+    }
+    setCookies.push(csrfCookie(token, getSessionTtl()));
+  } catch (error) {
+    authLogger.interceptor.csrf.error("Cannot reissue the CSRF cookie", error);
+  }
+}
+function pushCsrfCookieRemoval(setCookies) {
+  setCookies.push({
+    name: COOKIE_NAMES.CSRF,
+    value: "",
+    options: { maxAge: 0, path: "/" }
+  });
+}
+
 // src/nextjs/interceptors/login-register.ts
 var loginRegisterInterceptor = {
   pathPattern: /^\/_auth\/(login|register|invitations\/accept|signup\/password)$/,
@@ -335,6 +496,7 @@ var loginRegisterInterceptor = {
           path: "/"
         }
       });
+      await pushCsrfCookie(ctx.setCookies, ctx.metadata.keyId, ttl);
     } catch (error) {
       const err = error;
       authLogger.interceptor.login.error("Failed to save session", err);
@@ -393,6 +555,9 @@ var generalAuthInterceptor = {
         userId: session.userId,
         keyId: session.keyId
       });
+      if (await refuseInvalidCsrf(ctx, session.keyId)) {
+        return;
+      }
       const needsRefresh = await shouldRefreshSession(sessionCookie, 24);
       if (needsRefresh) {
         authLogger.interceptor.general.debug("Session needs refresh (within 24h of expiry)");
@@ -413,6 +578,7 @@ var generalAuthInterceptor = {
       ctx.headers["Authorization"] = `Bearer ${token}`;
       ctx.headers["X-Key-Id"] = session.keyId;
       ctx.metadata.userId = session.userId;
+      ctx.metadata.keyId = session.keyId;
       ctx.metadata.sessionValid = true;
     } catch (error) {
       const err = error;
@@ -446,6 +612,7 @@ var generalAuthInterceptor = {
         value: "",
         options: { maxAge: 0, path: "/" }
       });
+      pushCsrfCookieRemoval(ctx.setCookies);
       await next();
       return;
     }
@@ -466,6 +633,7 @@ var generalAuthInterceptor = {
           path: "/"
         }
       });
+      pushCsrfCookieRemoval(ctx.setCookies);
     } else if (ctx.metadata.refreshSession && ctx.response.status === 200) {
       try {
         const sessionData = ctx.metadata.sessionData;
@@ -493,6 +661,7 @@ var generalAuthInterceptor = {
             path: "/"
           }
         });
+        await pushCsrfCookie(ctx.setCookies, sessionData.keyId, ttl);
         authLogger.interceptor.general.info("Session refreshed", {
           userId: sessionData.userId,
           sealedLength: sealed.length,
@@ -524,6 +693,15 @@ var generalAuthInterceptor = {
         value: "",
         options: { ...base, sameSite: "lax" }
       });
+      pushCsrfCookieRemoval(ctx.setCookies);
+    }
+    const csrfQueued = ctx.setCookies.some((cookie) => cookie.name === COOKIE_NAMES.CSRF);
+    if (ctx.metadata.sessionValid && !csrfQueued) {
+      await pushCsrfCookieIfStale(
+        ctx.setCookies,
+        ctx.cookies.get(COOKIE_NAMES.CSRF),
+        ctx.metadata.keyId
+      );
     }
     await next();
   }
@@ -550,10 +728,11 @@ var keyRotationInterceptor = {
       ctx.body.fingerprint = newKeyPair.fingerprint;
       ctx.body.algorithm = newKeyPair.algorithm;
       ctx.body.keySize = Buffer.from(newKeyPair.publicKey, "base64").length;
-      console.log("New key generated:", newKeyPair);
-      console.log("publicKey:", newKeyPair.publicKey);
-      console.log("keyId:", newKeyPair.keyId);
-      console.log("fingerprint:", newKeyPair.fingerprint);
+      authLogger.interceptor.keyRotation.debug("Generated a new key pair", {
+        keyId: newKeyPair.keyId,
+        fingerprint: newKeyPair.fingerprint,
+        algorithm: newKeyPair.algorithm
+      });
       const token = generateClientToken(
         {
           userId: currentSession.userId,
@@ -618,6 +797,7 @@ var keyRotationInterceptor = {
           path: "/"
         }
       });
+      await pushCsrfCookie(ctx.setCookies, ctx.metadata.newKeyId, ttl);
     } catch (error) {
       const err = error;
       authLogger.interceptor.keyRotation.error("Failed to update session after rotation", err);
@@ -628,9 +808,9 @@ var keyRotationInterceptor = {
 
 // src/server/lib/oauth/state.ts
 import * as jose2 from "jose";
-import { env as env3 } from "@spfn/auth/config";
+import { env as env4 } from "@spfn/auth/config";
 async function getStateKey() {
-  const secret = env3.SPFN_AUTH_SESSION_SECRET;
+  const secret = env4.SPFN_AUTH_SESSION_SECRET;
   const encoder = new TextEncoder();
   const data = encoder.encode(`oauth-state:${secret}`);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -663,10 +843,10 @@ async function createOAuthState(params) {
 // src/nextjs/session-helpers.ts
 import * as jose3 from "jose";
 import { cookies } from "next/headers.js";
-import { env as env4 } from "@spfn/auth/config";
+import { env as env5 } from "@spfn/auth/config";
 import { logger } from "@spfn/core/logger";
 async function getPendingSessionKey() {
-  const secret = env4.SPFN_AUTH_SESSION_SECRET;
+  const secret = env5.SPFN_AUTH_SESSION_SECRET;
   const encoder = new TextEncoder();
   const data = encoder.encode(`oauth-pending:${secret}`);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -841,6 +1021,7 @@ var oauthFinalizeInterceptor = {
           path: "/"
         }
       });
+      await pushCsrfCookie(ctx.setCookies, keyId, ttl);
       ctx.setCookies.push({
         name: COOKIE_NAMES.OAUTH_PENDING,
         value: "",