@stacksjs/auth 0.75.263 → 0.75.267

package/dist/tokens.d.ts

@@ -1,4 +1,10 @@
 import type { AccessToken, CreateClientOptions, CreateClientResult, OAuthClient, PersonalAccessTokenResult, RefreshTokenResult, TokenScopes } from '@stacksjs/types';
+/**
+ * The refresh token read-back is exactly the row that was written.
+ *
+ * Exported for tests.
+ */
+export declare function verifyRefreshTokenRow(rows: RefreshTokenReadBack[], expected: { accessTokenId: number }): void;
 /**
  * The row that came back is the row that was written.
  *
@@ -336,6 +342,12 @@ export declare const DEFAULT_TOKENABLE_TYPE: 'users';
  * const t = await token()
  */
 export declare const token: unknown;
+declare interface RefreshTokenReadBack {
+  access_token_id: unknown
+  revoked: unknown
+  expires_at: unknown
+  expires_at_matches: boolean | number | null | undefined
+}
 export declare interface TokenOwnerCredentialState {
   exists: boolean
   passwordChangedAt: Date | null

package/dist/tokens.js

@@ -1,6 +1,8 @@
 import{createHash,randomBytes}from"node:crypto";import{config}from"@stacksjs/config";import{db,getDatabaseDialect,markContextWrote,mutationCount}from"@stacksjs/database/runtime";import{HttpError}from"@stacksjs/error-handling";import{getCurrentRequest}from"@stacksjs/router";import{makeHash}from"@stacksjs/security";import{revokeTokenPair,revokeTokenPairs}from"./token-revocation";import{requestToken}from"./request-token";import{tokenDate,tokenTimestamps}from"./token-dates";import{parseSqlDateTime,sqlDateTime,sqlDateTimeLiteral,sqlHelpers}from"@stacksjs/database/runtime";function tokenSql(){return sqlHelpers(getDatabaseDialect())}function appNow(){return sqlDateTimeLiteral()}function validTokenExpiry(value){if(value==null)return!0;const expiry=parseSqlDateTime(value);return expiry!=null&&expiry.getTime()>Date.now()}async function verifyRefreshTokenInsert(trx,hash,accessTokenId,expiresAt){const{param}=tokenSql(),rows=await trx.unsafe(`
-    SELECT access_token_id, revoked, expires_at FROM oauth_refresh_tokens WHERE token = ${param(1)}
-  `,[hash]),row=rows[0],storedExpiry=parseSqlDateTime(row?.expires_at)?.getTime(),expectedExpiry=expiresAt.getTime();if(rows.length!==1||!row||String(row.access_token_id)!==String(accessTokenId)||row.revoked!==!1&&row.revoked!==0||storedExpiry!==expectedExpiry)throw new HttpError(500,"Failed to persist the requested refresh token")}function storedAsWritten(matches){return matches===!0||matches===1}export function verifyAccessTokenInsert(row,expected){if(String(row.tokenable_id)!==String(expected.ownerId)||String(row.user_id)!==String(expected.ownerId)||row.tokenable_type!==expected.ownerType||String(row.oauth_client_id)!==String(expected.clientId)||row.revoked!==!1&&row.revoked!==0||!storedAsWritten(row.expires_at_matches)||JSON.stringify(parseScopes(row.scopes))!==JSON.stringify(expected.scopes))throw new HttpError(500,"Failed to persist the requested access token")}function refreshDeadline(days){const{isMysql}=tokenSql(),deadline=new Date(Date.now()+days*24*60*60*1000);if(isMysql)deadline.setUTCMilliseconds(0);return deadline}function hashToken(token){return createHash("sha256").update(token).digest("hex")}function bearerLookupHash(bearer){const colonIdx=bearer.indexOf(":"),lookup=colonIdx===-1?bearer:bearer.substring(0,colonIdx);return hashToken(lookup)}function generateSecureToken(bytes=40){return randomBytes(bytes).toString("hex")}export const DEFAULT_TOKENABLE_TYPE="users";function databaseBoolean(value){return value===!0||value===1||value===1n||value==="1"||value==="t"}function delegatedContext(row){return{grantId:row.oauth_grant_id??null,resources:row.oauth_grant_id?parseScopes(row.resources):[],audiences:row.oauth_grant_id?parseScopes(row.audiences):[],workspaceId:row.oauth_grant_id?row.workspace_id??null:null}}export async function getTokenOwnerCredentialState(ownerId,q=db,ownerType=DEFAULT_TOKENABLE_TYPE){const{isMysql,isPostgres,param}=tokenSql();if(ownerId===null||ownerId===void 0)return{exists:!1,passwordChangedAt:null};const quote=isMysql?"`":'"',table=`${quote}${ownerType.replaceAll(quote,quote+quote)}${quote}`,readOwner=async(includePasswordStamp)=>{const row=(await q.unsafe(`
+    SELECT access_token_id, revoked, expires_at,
+      (expires_at = ${param(1)}) AS expires_at_matches
+    FROM oauth_refresh_tokens WHERE token = ${param(2)}
+  `,[sqlDateTime(expiresAt),hash]);verifyRefreshTokenRow(rows,{accessTokenId})}export function verifyRefreshTokenRow(rows,expected){const row=rows[0];if(rows.length!==1||!row)throw new HttpError(500,`Failed to persist the requested refresh token: ${rows.length===0?"no row came back":`${rows.length} rows came back`}`);failOnMismatch("refresh token",[["access_token_id",String(row.access_token_id)===String(expected.accessTokenId)],["revoked",row.revoked===!1||row.revoked===0],["expires_at",storedAsWritten(row.expires_at_matches)]])}function failOnMismatch(what,checks){const differed=checks.filter(([,ok])=>!ok).map(([field])=>field);if(differed.length>0)throw new HttpError(500,`Failed to persist the requested ${what}: ${differed.join(", ")} did not match what was written`)}function storedAsWritten(matches){return matches===!0||matches===1}export function verifyAccessTokenInsert(row,expected){failOnMismatch("access token",[["tokenable_id",String(row.tokenable_id)===String(expected.ownerId)],["user_id",String(row.user_id)===String(expected.ownerId)],["tokenable_type",row.tokenable_type===expected.ownerType],["oauth_client_id",String(row.oauth_client_id)===String(expected.clientId)],["revoked",row.revoked===!1||row.revoked===0],["expires_at",storedAsWritten(row.expires_at_matches)],["scopes",JSON.stringify(parseScopes(row.scopes))===JSON.stringify(expected.scopes)]])}function refreshDeadline(days){const{isMysql}=tokenSql(),deadline=new Date(Date.now()+days*24*60*60*1000);if(isMysql)deadline.setUTCMilliseconds(0);return deadline}function hashToken(token){return createHash("sha256").update(token).digest("hex")}function bearerLookupHash(bearer){const colonIdx=bearer.indexOf(":"),lookup=colonIdx===-1?bearer:bearer.substring(0,colonIdx);return hashToken(lookup)}function generateSecureToken(bytes=40){return randomBytes(bytes).toString("hex")}export const DEFAULT_TOKENABLE_TYPE="users";function databaseBoolean(value){return value===!0||value===1||value===1n||value==="1"||value==="t"}function delegatedContext(row){return{grantId:row.oauth_grant_id??null,resources:row.oauth_grant_id?parseScopes(row.resources):[],audiences:row.oauth_grant_id?parseScopes(row.audiences):[],workspaceId:row.oauth_grant_id?row.workspace_id??null:null}}export async function getTokenOwnerCredentialState(ownerId,q=db,ownerType=DEFAULT_TOKENABLE_TYPE){const{isMysql,isPostgres,param}=tokenSql();if(ownerId===null||ownerId===void 0)return{exists:!1,passwordChangedAt:null};const quote=isMysql?"`":'"',table=`${quote}${ownerType.replaceAll(quote,quote+quote)}${quote}`,readOwner=async(includePasswordStamp)=>{const row=(await q.unsafe(`
       SELECT ${includePasswordStamp?"id, password_changed_at":"id"} FROM ${table} WHERE id = ${param(1)} LIMIT 1
     `,[ownerId]))[0];if(!row)return{exists:!1,passwordChangedAt:null};const value=row.password_changed_at;return{exists:!0,passwordChangedAt:value===null||value===void 0?null:parseSqlDateTime(value)}};try{if(isMysql){const schema=(await q.unsafe(`
         SELECT

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.263",
+  "version": "0.75.267",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -59,19 +59,19 @@
   },
   "dependencies": {
     "@stacksjs/bun-router": "^0.1.24",
-    "@stacksjs/cache": "0.75.263",
-    "@stacksjs/config": "0.75.263",
-    "@stacksjs/database": "0.75.263",
-    "@stacksjs/email": "0.75.263",
-    "@stacksjs/env": "0.75.263",
-    "@stacksjs/error-handling": "0.75.263",
-    "@stacksjs/logging": "0.75.263",
-    "@stacksjs/orm": "0.75.263",
-    "@stacksjs/path": "0.75.263",
-    "@stacksjs/router": "0.75.263",
-    "@stacksjs/security": "0.75.263",
-    "@stacksjs/socials": "0.75.263",
-    "@stacksjs/storage": "0.75.263",
+    "@stacksjs/cache": "0.75.267",
+    "@stacksjs/config": "0.75.267",
+    "@stacksjs/database": "0.75.267",
+    "@stacksjs/email": "0.75.267",
+    "@stacksjs/env": "0.75.267",
+    "@stacksjs/error-handling": "0.75.267",
+    "@stacksjs/logging": "0.75.267",
+    "@stacksjs/orm": "0.75.267",
+    "@stacksjs/path": "0.75.267",
+    "@stacksjs/router": "0.75.267",
+    "@stacksjs/security": "0.75.267",
+    "@stacksjs/socials": "0.75.267",
+    "@stacksjs/storage": "0.75.267",
     "@stacksjs/ts-auth": "^0.4.7",
     "ts-qr-codes": "^0.1.8"
   },