@svadmin/sso 0.8.8 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.8.8",
+  "version": "0.10.0",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -35,7 +35,7 @@
     "!src/**/setupTest.*"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.25.3"
+    "@svadmin/core": "^0.26.0"
   },
   "devDependencies": {
     "typescript": "^5.7.0"

package/src/auth-helpers.ts

@@ -0,0 +1,114 @@
+/**
+ * 浏览器端 OIDC/OAuth2 认证辅助函数。
+ *
+ * 提供 PKCE 生成、OIDC Discovery 端点解析、重定向校验、
+ * 反向代理 origin 恢复等通用工具。
+ */
+
+/** 将 Uint8Array 编码为 base64url 格式 (纯 Web API) */
+function base64url(array: Uint8Array): string {
+  let binary = "";
+  for (const byte of array) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+/** 生成随机的 OAuth state 值 */
+export function generateState(): string {
+  const array = new Uint8Array(16);
+  crypto.getRandomValues(array);
+  return base64url(array);
+}
+
+/** 生成 PKCE code verifier */
+export function generateVerifier(): string {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return base64url(array);
+}
+
+/** 基于 code verifier 算得 code challenge (S256) */
+export async function generateChallenge(verifier: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return base64url(new Uint8Array(hash));
+}
+
+/**
+ * 校验 returnTo 重定向地址，防止开放重定向漏洞。
+ * 只允许同源相对路径（必须以 / 开头且非 // 开头）。
+ */
+export function isValidReturnTo(url: string): boolean {
+  if (!url) return false;
+  if (url.includes("\\")) return false;
+  return /^\/[^/].*/.test(url) || url === "/";
+}
+
+/** 从反向代理头恢复公网 origin */
+export function getForwardedOrigin(req: Request, fallbackUrl: URL): string {
+  const forwardedProto = req.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  const forwardedHost = req.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwardedHost || req.headers.get("host") || fallbackUrl.host;
+  const protocol = (forwardedProto || fallbackUrl.protocol.replace(/:$/, "")).replace(/:$/, "");
+  return `${protocol}://${host}`;
+}
+
+interface OidcDiscoveryDocument {
+  authorization_endpoint?: string;
+  token_endpoint?: string;
+}
+
+/** 通过 OIDC Discovery 解析授权端点 URL */
+export async function resolveAuthorizeUrl(
+  issuer: string,
+  overrideUrl = "",
+  fetcher: typeof fetch = fetch,
+): Promise<string> {
+  const normalizedIssuer = issuer.replace(/\/$/, "");
+  const normalizedOverride = overrideUrl.trim();
+
+  if (normalizedOverride) return normalizedOverride;
+
+  if (normalizedIssuer) {
+    try {
+      const response = await fetcher(`${normalizedIssuer}/.well-known/openid-configuration`);
+      if (response.ok) {
+        const discovery = await response.json() as OidcDiscoveryDocument;
+        if (discovery.authorization_endpoint) return discovery.authorization_endpoint;
+      }
+    } catch {
+      // 忽略 discovery 失败，走 fallback
+    }
+  }
+
+  if (normalizedIssuer) return `${normalizedIssuer}/oauth/authorize`;
+
+  return "";
+}
+
+/** 通过 OIDC Discovery 解析 token 端点 URL */
+export async function resolveTokenUrl(
+  issuer: string,
+  overrideUrlOrFetcher: string | typeof fetch = "",
+  fetcherOverride: typeof fetch = fetch,
+): Promise<string> {
+  const normalizedIssuer = issuer.replace(/\/$/, "");
+  const fetcher = typeof overrideUrlOrFetcher === "function" ? overrideUrlOrFetcher : fetcherOverride;
+  const overrideUrl = typeof overrideUrlOrFetcher === "string" ? overrideUrlOrFetcher : "";
+  const normalizedOverride = overrideUrl.trim();
+
+  if (normalizedOverride) return normalizedOverride;
+  if (!normalizedIssuer) return "";
+
+  try {
+    const response = await fetcher(`${normalizedIssuer}/.well-known/openid-configuration`);
+    if (response.ok) {
+      const discovery = await response.json() as OidcDiscoveryDocument;
+      if (discovery.token_endpoint) return discovery.token_endpoint;
+    }
+  } catch {
+    // 忽略 discovery 失败
+  }
+
+  return `${normalizedIssuer}/oauth/token`;
+}

package/src/auth-provider.ts

@@ -32,14 +32,14 @@
 import type { AuthProvider, Identity } from '@svadmin/core';
 
 // Safe base64url decode for JWT payloads
-function decodeJwtPayload(token: string): any {
+function decodeJwtPayload(token: string): Record<string, unknown> | null {
   if (!token) return null;
   const parts = token.split('.');
   if (parts.length < 2) return null;
   const payloadStr = parts[1];
   const padded = payloadStr + '='.repeat((4 - (payloadStr.length % 4)) % 4);
   const binString = atob(padded.replace(/-/g, '+').replace(/_/g, '/'));
-  const bytes = Uint8Array.from(binString, (m) => m.codePointAt(0)!);
+  const bytes = Uint8Array.from(binString, (m) => m.codePointAt(0) ?? 0);
   return JSON.parse(new TextDecoder().decode(bytes));
 }
 
@@ -65,6 +65,8 @@ export interface SSOConfig {
   autoRefresh?: boolean;
   /** Seconds before expiry to trigger refresh. Default: 60 */
   refreshBuffer?: number;
+  /** Additional authorization request parameters, e.g. audience or prompt. */
+  authorizationParams?: Record<string, string>;
   /**
    * Manual OAuth2 endpoints for providers that don't support OIDC discovery
    * (e.g., GitHub). When provided, OIDC auto-discovery is skipped.
@@ -83,6 +85,10 @@ export interface TokenStorage {
   removeItem: (key: string) => void;
 }
 
+export interface SSOAuthProvider extends AuthProvider {
+  getAccessToken: () => Promise<string | null>;
+}
+
 interface OIDCConfig {
   authorization_endpoint: string;
   token_endpoint: string;
@@ -143,7 +149,7 @@ function getStorage(config: SSOConfig): TokenStorage {
 /**
  * Create an OIDC/OAuth2 SSO AuthProvider.
  */
-export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
+export function createSSOAuthProvider(config: SSOConfig): SSOAuthProvider {
   const scopes = config.scopes ?? ['openid', 'profile', 'email'];
   const autoRefresh = config.autoRefresh ?? true;
   const refreshBuffer = config.refreshBuffer ?? 60;
@@ -198,7 +204,8 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
     if (!tokens.expires_at || !tokens.refresh_token) return;
     const now = Math.floor(Date.now() / 1000);
     const delay = Math.max(0, (tokens.expires_at - now - refreshBuffer)) * 1000;
-    refreshTimer = setTimeout(() => refreshAccessToken(tokens.refresh_token!), delay);
+    const refreshToken = tokens.refresh_token;
+    refreshTimer = setTimeout(() => refreshAccessToken(refreshToken), delay);
   }
 
   async function refreshAccessToken(refreshToken: string): Promise<void> {
@@ -216,6 +223,10 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
       });
       if (!res.ok) { clearTokens(); return; }
       const data = await res.json();
+      if (!data.access_token) {
+        clearTokens();
+        return;
+      }
       const newTokens: TokenSet = {
         access_token: data.access_token,
         id_token: data.id_token,
@@ -248,6 +259,7 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
     });
     if (!res.ok) throw new Error(`Token exchange failed: ${res.status}`);
     const data = await res.json();
+    if (!data.access_token) throw new Error('Token exchange failed: missing access_token');
     const tokens: TokenSet = {
       access_token: data.access_token,
       id_token: data.id_token,
@@ -281,28 +293,33 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
       if (typeof window === 'undefined') {
         return { success: false, error: { message: 'SSO login requires a browser environment' } };
       }
-      const cfg = await discover();
-      const { verifier, challenge } = await createPKCEChallenge();
-      const state = generateRandomString(32);
+      try {
+        const cfg = await discover();
+        const { verifier, challenge } = await createPKCEChallenge();
+        const state = generateRandomString(32);
 
-      storage.setItem(`${STORAGE_PREFIX}pkce_verifier`, verifier);
-      storage.setItem(`${STORAGE_PREFIX}state`, state);
+        storage.setItem(`${STORAGE_PREFIX}pkce_verifier`, verifier);
+        storage.setItem(`${STORAGE_PREFIX}state`, state);
 
-      const params = new URLSearchParams({
-        response_type: 'code',
-        client_id: config.clientId,
-        redirect_uri: config.redirectUri,
-        scope: scopes.join(' '),
-        state,
-        code_challenge: challenge,
-        code_challenge_method: 'S256',
-      });
+        const params = new URLSearchParams({
+          response_type: 'code',
+          client_id: config.clientId,
+          redirect_uri: config.redirectUri,
+          scope: scopes.join(' '),
+          state,
+          code_challenge: challenge,
+          code_challenge_method: 'S256',
+          ...config.authorizationParams,
+        });
 
-      // Redirect to authorization endpoint
-      window.location.href = `${cfg.authorization_endpoint}?${params}`;
+        // Redirect to authorization endpoint
+        window.location.href = `${cfg.authorization_endpoint}?${params}`;
 
-      // Won't actually reach here due to redirect
-      return { success: true };
+        // Won't actually reach here due to redirect
+        return { success: true };
+      } catch (err) {
+        return { success: false, error: { message: err instanceof Error ? err.message : 'SSO login failed' } };
+      }
     },
 
     async logout() {
@@ -339,12 +356,26 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
 
       // Handle callback — exchange authorization code for tokens
       const url = new URL(window.location.href);
+      const callbackError = url.searchParams.get('error');
+      if (callbackError) {
+        clearTokens();
+        return {
+          authenticated: false,
+          error: {
+            message: url.searchParams.get('error_description') ?? callbackError,
+            name: callbackError,
+          },
+          logout: true,
+        };
+      }
+
       const code = url.searchParams.get('code');
       const state = url.searchParams.get('state');
 
       if (code) {
         const savedState = storage.getItem(`${STORAGE_PREFIX}state`);
-        if (state && savedState && state !== savedState) {
+        if (!state || !savedState || state !== savedState) {
+          clearTokens();
           return { authenticated: false, error: { message: 'State mismatch' } };
         }
         try {
@@ -352,7 +383,7 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
           // Clean URL
           url.searchParams.delete('code');
           url.searchParams.delete('state');
-          window.history.replaceState({}, '', url.pathname);
+          window.history.replaceState({}, '', `${url.pathname}${url.search}${url.hash}`);
           return { authenticated: true };
         } catch (err) {
           return { authenticated: false, error: { message: String(err) } };
@@ -409,6 +440,7 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
       if (tokens.id_token) {
         try {
           const payload = decodeJwtPayload(tokens.id_token);
+          if (!payload) return null;
           return payload.roles ?? payload.groups ?? payload.permissions ?? null;
         } catch {
           return null;
@@ -418,6 +450,22 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
       return null;
     },
 
+    async getAccessToken() {
+      const tokens = getTokens();
+      if (!tokens) return null;
+
+      if (tokens.expires_at && tokens.expires_at < Math.floor(Date.now() / 1000)) {
+        if (!tokens.refresh_token) {
+          clearTokens();
+          return null;
+        }
+        await refreshAccessToken(tokens.refresh_token);
+        return getTokens()?.access_token ?? null;
+      }
+
+      return tokens.access_token;
+    },
+
     async onError(error) {
       if (typeof error === 'object' && error !== null && 'statusCode' in error) {
         const statusCode = (error as { statusCode: number }).statusCode;
@@ -425,6 +473,12 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
           return { logout: true, redirectTo: '/login' };
         }
       }
+      if (typeof error === 'object' && error !== null && 'status' in error) {
+        const status = (error as { status: number }).status;
+        if (status === 401 || status === 403) {
+          return { logout: true, redirectTo: '/login' };
+        }
+      }
       return {};
     },
   };

package/src/index.ts

@@ -8,7 +8,7 @@
  */
 
 export { createSSOAuthProvider } from './auth-provider';
-export type { SSOConfig, TokenStorage } from './auth-provider';
+export type { SSOAuthProvider, SSOConfig, TokenStorage } from './auth-provider';
 
 // Social login presets
 export {
@@ -18,5 +18,17 @@ export {
   createGitLabAuth,
   createKeycloakAuth,
   createAuth0Auth,
+  createSupauthAuth,
 } from './presets';
 export type { PresetOptions } from './presets';
+
+// Auth helpers (PKCE, OIDC discovery, redirect validation)
+export {
+  generateState,
+  generateVerifier,
+  generateChallenge,
+  isValidReturnTo,
+  getForwardedOrigin,
+  resolveAuthorizeUrl,
+  resolveTokenUrl,
+} from './auth-helpers';

package/src/presets.ts

@@ -177,3 +177,28 @@ export function createAuth0Auth(
 // ─── Type exports ────────────────────────────────────────────
 
 export type { PresetOptions };
+
+// ─── Supauth / GoTrue ────────────────────────────────────────
+
+/**
+ * Supauth OIDC Sign-In (GoTrue-compatible identity provider).
+ *
+ * Compatible with SupaCloud, SupaOAuth, and any GoTrue-based auth backend.
+ * Uses standard OIDC Authorization Code Flow with PKCE.
+ *
+ * @param issuer - Supauth issuer URL (e.g., 'https://auth.example.com')
+ * @param clientId - OAuth2 Client ID
+ */
+export function createSupauthAuth(
+  clientId: string,
+  opts?: PresetOptions & { issuer?: string },
+) {
+  const issuer = opts?.issuer ?? '';
+  return createSSOAuthProvider({
+    issuer,
+    clientId,
+    scopes: ['openid', 'profile', 'email'],
+    redirectUri: resolveRedirectUri(opts),
+    ...opts,
+  });
+}