@stacksjs/auth 0.75.182 → 0.75.184

package/dist/tokens.d.ts

@@ -1,4 +1,39 @@
 import type { AccessToken, CreateClientOptions, CreateClientResult, OAuthClient, PersonalAccessTokenResult, RefreshTokenResult, TokenScopes } from '@stacksjs/types';
+/**
+ * The row that came back is the row that was written.
+ *
+ * `expires_at` is checked by the database, through `expires_at_matches`, and
+ * not by comparing a parsed Date against the instant asked for. A zoneless
+ * column carries no offset, so the value a driver hands back is its own
+ * reading of it: the same naive literal came back as a Date eight hours early
+ * in one API process while a standalone script against the same column and the
+ * same `db` export round-tripped exactly, which rejected correctly stored
+ * tokens and 500'd every login and register on that host
+ * (stacksjs/stacks#2902).
+ *
+ * Asking the database compares the stored value against the literal that was
+ * written, in the type system that stored it, which is the question this check
+ * was always asking. Nothing in the path then depends on how a driver chose to
+ * localize a column that names no zone.
+ *
+ * One consequence worth stating: on a column Postgres holds as `timestamptz`
+ * this now passes. The literal is read through the session zone on the way in
+ * and again on the way out, so it equals itself while the instant stored is
+ * not the instant the app asked for. That is a schema fault rather than a
+ * failed insert, and it has its own louder report in
+ * `ensureUtcDatetimeColumns`, which names the column and prints the statement
+ * that converts it. This check used to fail on it by accident, while also
+ * failing on correctly stored rows, which is what took logins down.
+ *
+ * Exported for tests.
+ */
+export declare function verifyAccessTokenInsert(row: AccessTokenRow, expected: {
+  ownerId: number
+  ownerType: string
+  clientId: number
+  scopes: TokenScopes
+  expiresAt: Date
+}): void;
 export declare function getTokenOwnerCredentialState(ownerId: unknown, q?: { unsafe: (sql: string, params?: any[]) => any }, ownerType?: string): Promise<TokenOwnerCredentialState>;
 export declare function getPasswordChangedAt(ownerId: unknown, q?: { unsafe: (sql: string, params?: any[]) => any }, ownerType?: string): Promise<Date | null>;
 /**
@@ -302,3 +337,41 @@ export declare interface TokenOwnerCredentialState {
   exists: boolean
   passwordChangedAt: Date | null
 }
+/**
+ * The token tables, as these queries select them.
+ *
+ * `db.unsafe` answers `Record<string, unknown>`, so every field read off a
+ * result was `unknown` and eleven call sites cast the whole array to `any[]`
+ * to get at it - which meant a column renamed in a migration, or misspelt in
+ * one of the SQL strings below, read as `undefined` and flowed silently into a
+ * token record.
+ *
+ * These tables are not in the generated `database/types.d.ts`, so the shapes
+ * are written here, beside the queries that select them. Fields are typed as
+ * the drivers return them: sqlite gives 0/1 for booleans and strings for
+ * dates, which is why the code coerces at each use.
+ */
+declare interface AccessTokenRow {
+  id: number
+  tokenable_type: string
+  tokenable_id: number
+  user_id: number
+  name: string
+  scopes: string | null
+  revoked: number | boolean | null
+  expires_at: string | null
+  expires_at_matches?: boolean | number | null
+  created_at: string
+  updated_at: string | null
+  ip_address: string | null
+  user_agent: string | null
+  oauth_client_id: number
+  oauth_grant_id: string | null
+  resources: string | null
+  audiences: string | null
+  workspace_id: string | null
+  grant_scopes: string | null
+  password_changed_at: string | null
+  access_token_id: number | null
+  provider: string | null
+}

package/dist/tokens.js

@@ -1,6 +1,6 @@
 import{createHash,randomBytes}from"node:crypto";import{config}from"@stacksjs/config";import{db,getDatabaseDialect,markContextWrote,mutationCount}from"@stacksjs/database/runtime";import{HttpError}from"@stacksjs/error-handling";import{getCurrentRequest}from"@stacksjs/router";import{makeHash}from"@stacksjs/security";import{revokeTokenPair,revokeTokenPairs}from"./token-revocation";import{requestToken}from"./request-token";import{tokenDate,tokenTimestamps}from"./token-dates";import{parseSqlDateTime,sqlDateTime,sqlDateTimeLiteral,sqlHelpers}from"@stacksjs/database/runtime";function tokenSql(){return sqlHelpers(getDatabaseDialect())}function appNow(){return sqlDateTimeLiteral()}function validTokenExpiry(value){if(value==null)return!0;const expiry=parseSqlDateTime(value);return expiry!=null&&expiry.getTime()>Date.now()}async function verifyRefreshTokenInsert(trx,hash,accessTokenId,expiresAt){const{param}=tokenSql(),rows=await trx.unsafe(`
     SELECT access_token_id, revoked, expires_at FROM oauth_refresh_tokens WHERE token = ${param(1)}
-  `,[hash]),row=rows[0],storedExpiry=parseSqlDateTime(row?.expires_at)?.getTime(),expectedExpiry=expiresAt.getTime();if(rows.length!==1||!row||String(row.access_token_id)!==String(accessTokenId)||row.revoked!==!1&&row.revoked!==0||storedExpiry!==expectedExpiry)throw new HttpError(500,"Failed to persist the requested refresh token")}function verifyAccessTokenInsert(row,expected){if(String(row.tokenable_id)!==String(expected.ownerId)||String(row.user_id)!==String(expected.ownerId)||row.tokenable_type!==expected.ownerType||String(row.oauth_client_id)!==String(expected.clientId)||row.revoked!==!1&&row.revoked!==0||parseSqlDateTime(row.expires_at)?.getTime()!==expected.expiresAt.getTime()||JSON.stringify(parseScopes(row.scopes))!==JSON.stringify(expected.scopes))throw new HttpError(500,"Failed to persist the requested access token")}function refreshDeadline(days){const{isMysql}=tokenSql(),deadline=new Date(Date.now()+days*24*60*60*1000);if(isMysql)deadline.setUTCMilliseconds(0);return deadline}function hashToken(token){return createHash("sha256").update(token).digest("hex")}function bearerLookupHash(bearer){const colonIdx=bearer.indexOf(":"),lookup=colonIdx===-1?bearer:bearer.substring(0,colonIdx);return hashToken(lookup)}function generateSecureToken(bytes=40){return randomBytes(bytes).toString("hex")}export const DEFAULT_TOKENABLE_TYPE="users";function databaseBoolean(value){return value===!0||value===1||value===1n||value==="1"||value==="t"}function delegatedContext(row){return{grantId:row.oauth_grant_id??null,resources:row.oauth_grant_id?parseScopes(row.resources):[],audiences:row.oauth_grant_id?parseScopes(row.audiences):[],workspaceId:row.oauth_grant_id?row.workspace_id??null:null}}export async function getTokenOwnerCredentialState(ownerId,q=db,ownerType=DEFAULT_TOKENABLE_TYPE){const{isMysql,isPostgres,param}=tokenSql();if(ownerId===null||ownerId===void 0)return{exists:!1,passwordChangedAt:null};const quote=isMysql?"`":'"',table=`${quote}${ownerType.replaceAll(quote,quote+quote)}${quote}`,readOwner=async(includePasswordStamp)=>{const row=(await q.unsafe(`
+  `,[hash]),row=rows[0],storedExpiry=parseSqlDateTime(row?.expires_at)?.getTime(),expectedExpiry=expiresAt.getTime();if(rows.length!==1||!row||String(row.access_token_id)!==String(accessTokenId)||row.revoked!==!1&&row.revoked!==0||storedExpiry!==expectedExpiry)throw new HttpError(500,"Failed to persist the requested refresh token")}function storedAsWritten(matches){return matches===!0||matches===1}export function verifyAccessTokenInsert(row,expected){if(String(row.tokenable_id)!==String(expected.ownerId)||String(row.user_id)!==String(expected.ownerId)||row.tokenable_type!==expected.ownerType||String(row.oauth_client_id)!==String(expected.clientId)||row.revoked!==!1&&row.revoked!==0||!storedAsWritten(row.expires_at_matches)||JSON.stringify(parseScopes(row.scopes))!==JSON.stringify(expected.scopes))throw new HttpError(500,"Failed to persist the requested access token")}function refreshDeadline(days){const{isMysql}=tokenSql(),deadline=new Date(Date.now()+days*24*60*60*1000);if(isMysql)deadline.setUTCMilliseconds(0);return deadline}function hashToken(token){return createHash("sha256").update(token).digest("hex")}function bearerLookupHash(bearer){const colonIdx=bearer.indexOf(":"),lookup=colonIdx===-1?bearer:bearer.substring(0,colonIdx);return hashToken(lookup)}function generateSecureToken(bytes=40){return randomBytes(bytes).toString("hex")}export const DEFAULT_TOKENABLE_TYPE="users";function databaseBoolean(value){return value===!0||value===1||value===1n||value==="1"||value==="t"}function delegatedContext(row){return{grantId:row.oauth_grant_id??null,resources:row.oauth_grant_id?parseScopes(row.resources):[],audiences:row.oauth_grant_id?parseScopes(row.audiences):[],workspaceId:row.oauth_grant_id?row.workspace_id??null:null}}export async function getTokenOwnerCredentialState(ownerId,q=db,ownerType=DEFAULT_TOKENABLE_TYPE){const{isMysql,isPostgres,param}=tokenSql();if(ownerId===null||ownerId===void 0)return{exists:!1,passwordChangedAt:null};const quote=isMysql?"`":'"',table=`${quote}${ownerType.replaceAll(quote,quote+quote)}${quote}`,readOwner=async(includePasswordStamp)=>{const row=(await q.unsafe(`
       SELECT ${includePasswordStamp?"id, password_changed_at":"id"} FROM ${table} WHERE id = ${param(1)} LIMIT 1
     `,[ownerId]))[0];if(!row)return{exists:!1,passwordChangedAt:null};const value=row.password_changed_at;return{exists:!0,passwordChangedAt:value===null||value===void 0?null:parseSqlDateTime(value)}};try{if(isMysql){const schema=(await q.unsafe(`
         SELECT
@@ -65,9 +65,11 @@ import{createHash,randomBytes}from"node:crypto";import{config}from"@stacksjs/con
         VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ${appNow()}, ${appNow()})
       `,[tokenableType,userId,userId,client.id,hashedToken,name,JSON.stringify(scopes),sqlDateTime(expiresAt),agent,address]);const row=(await trx.unsafe(`
       SELECT id, user_id, tokenable_type, tokenable_id, oauth_client_id,
-        name, scopes, revoked, expires_at, created_at, updated_at
-      FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
-    `,[hashedToken]))[0];if(!row)throw new HttpError(500,"Failed to create access token - inserted row not found");verifyAccessTokenInsert(row,{ownerId:userId,ownerType:tokenableType,clientId:client.id,scopes,expiresAt});const accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name,scopes:parseScopes(row.scopes),revoked:!1,expiresAt,...tokenTimestamps(row)};let refreshTokenPlain;if(withRefreshToken){refreshTokenPlain=generateSecureToken(40);const hashedRefreshToken=hashToken(refreshTokenPlain),refreshExpiresAt=refreshDeadline(refreshExpiresInDays);if(isPostgres)await trx.unsafe(`
+        name, scopes, revoked, expires_at,
+        (expires_at = ${param(1)}) AS expires_at_matches,
+        created_at, updated_at
+      FROM oauth_access_tokens WHERE token = ${param(2)} LIMIT 1
+    `,[sqlDateTime(expiresAt),hashedToken]))[0];if(!row)throw new HttpError(500,"Failed to create access token - inserted row not found");verifyAccessTokenInsert(row,{ownerId:userId,ownerType:tokenableType,clientId:client.id,scopes,expiresAt});const accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name,scopes:parseScopes(row.scopes),revoked:!1,expiresAt,...tokenTimestamps(row)};let refreshTokenPlain;if(withRefreshToken){refreshTokenPlain=generateSecureToken(40);const hashedRefreshToken=hashToken(refreshTokenPlain),refreshExpiresAt=refreshDeadline(refreshExpiresInDays);if(isPostgres)await trx.unsafe(`
           INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
           VALUES ($1, $2, false, $3, ${appNow()})
         `,[accessToken.id,hashedRefreshToken,sqlDateTime(refreshExpiresAt)]);else await trx.unsafe(`
@@ -98,9 +100,11 @@ import{createHash,randomBytes}from"node:crypto";import{config}from"@stacksjs/con
         VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ${appNow()}, ${appNow()})
       `,[refreshRow.tokenable_type,refreshRow.tokenable_id,refreshRow.tokenable_id,refreshRow.oauth_client_id,hashedToken,refreshRow.name,refreshRow.scopes,sqlDateTime(expiresAt)]);const row=(await trx.unsafe(`
       SELECT id, user_id, tokenable_type, tokenable_id, oauth_client_id,
-        name, scopes, revoked, expires_at, created_at, updated_at
-      FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
-    `,[hashedToken]))[0];if(!row)throw new HttpError(500,"Failed to read back the access token that was just created.");verifyAccessTokenInsert(row,{ownerId:refreshRow.tokenable_id,ownerType:refreshRow.tokenable_type,clientId:refreshRow.oauth_client_id,scopes:parseScopes(refreshRow.scopes),expiresAt});const accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name||"access-token",scopes:parseScopes(row.scopes),revoked:!1,expiresAt,...tokenTimestamps(row)};if(isIssuedBeforePasswordChange(row.created_at,await getPasswordChangedAt(refreshRow.tokenable_id,trx,refreshRow.tokenable_type??DEFAULT_TOKENABLE_TYPE)))throw new HttpError(401,"Invalid or expired refresh token");const newRefreshTokenPlain=generateSecureToken(40),newHashedRefreshToken=hashToken(newRefreshTokenPlain),refreshExpiresAt=refreshDeadline(refreshExpiresInDays);if(isPostgres)await trx.unsafe(`
+        name, scopes, revoked, expires_at,
+        (expires_at = ${param(1)}) AS expires_at_matches,
+        created_at, updated_at
+      FROM oauth_access_tokens WHERE token = ${param(2)} LIMIT 1
+    `,[sqlDateTime(expiresAt),hashedToken]))[0];if(!row)throw new HttpError(500,"Failed to read back the access token that was just created.");verifyAccessTokenInsert(row,{ownerId:refreshRow.tokenable_id,ownerType:refreshRow.tokenable_type,clientId:refreshRow.oauth_client_id,scopes:parseScopes(refreshRow.scopes),expiresAt});const accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name||"access-token",scopes:parseScopes(row.scopes),revoked:!1,expiresAt,...tokenTimestamps(row)};if(isIssuedBeforePasswordChange(row.created_at,await getPasswordChangedAt(refreshRow.tokenable_id,trx,refreshRow.tokenable_type??DEFAULT_TOKENABLE_TYPE)))throw new HttpError(401,"Invalid or expired refresh token");const newRefreshTokenPlain=generateSecureToken(40),newHashedRefreshToken=hashToken(newRefreshTokenPlain),refreshExpiresAt=refreshDeadline(refreshExpiresInDays);if(isPostgres)await trx.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
         VALUES ($1, $2, false, $3, ${appNow()})
       `,[accessToken.id,newHashedRefreshToken,sqlDateTime(refreshExpiresAt)]);else await trx.unsafe(`

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.182",
+  "version": "0.75.184",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -58,18 +58,18 @@
   },
   "dependencies": {
     "@stacksjs/bun-router": "^0.1.24",
-    "@stacksjs/cache": "0.75.182",
-    "@stacksjs/config": "0.75.182",
-    "@stacksjs/database": "0.75.182",
-    "@stacksjs/email": "0.75.182",
-    "@stacksjs/env": "0.75.182",
-    "@stacksjs/error-handling": "0.75.182",
-    "@stacksjs/logging": "0.75.182",
-    "@stacksjs/orm": "0.75.182",
-    "@stacksjs/path": "0.75.182",
-    "@stacksjs/router": "0.75.182",
-    "@stacksjs/security": "0.75.182",
-    "@stacksjs/storage": "0.75.182",
+    "@stacksjs/cache": "0.75.184",
+    "@stacksjs/config": "0.75.184",
+    "@stacksjs/database": "0.75.184",
+    "@stacksjs/email": "0.75.184",
+    "@stacksjs/env": "0.75.184",
+    "@stacksjs/error-handling": "0.75.184",
+    "@stacksjs/logging": "0.75.184",
+    "@stacksjs/orm": "0.75.184",
+    "@stacksjs/path": "0.75.184",
+    "@stacksjs/router": "0.75.184",
+    "@stacksjs/security": "0.75.184",
+    "@stacksjs/storage": "0.75.184",
     "@stacksjs/ts-auth": "^0.4.5",
     "ts-qr-codes": "^0.1.8"
   },