@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/src/api/lib/SignInConsent.ts

@@ -0,0 +1,316 @@
+/**
+ * Grants the key of an app's authorization request when a sign-in on the sign-in page continues it.
+ * The sign-in page shows the request's key before the sign-in, so the sign-in approves it, as the
+ * approval page does. A key that the sign-in cannot sign, such as one that another passkey owns,
+ * keeps the redirect to the approval page. A sign-in that reaches the account step holds its grant
+ * until the user chooses an account.
+ * @module
+ */
+import { verifyOAuthQueryParams } from '@better-auth/oauth-provider'
+import type { Context } from 'hono'
+import { Hex } from 'ox'
+import { env } from 'void/env'
+import * as Authorize from '../../internal/Authorize.js'
+import type { Env } from '../../internal/Env.js'
+import * as ErrorResponse from '../../internal/ErrorResponse.js'
+import * as KeyAuthorization from '../../internal/KeyAuthorization.js'
+import * as Log from '../../internal/Log.js'
+import * as Passkey from '../../internal/Passkey.js'
+import * as RateLimit from '../../internal/RateLimit.js'
+import * as SignInGrant from '../../internal/SignInGrant.js'
+import * as Timing from '../../internal/Timing.js'
+import * as Consent from './Consent.js'
+import { db } from './Database.js'
+
+/**
+ * Returns where an account step continues: `redirect`, which Better Auth returned once the user chose
+ * `account`, or the app's `redirect_uri` with a code when a sign-in held a grant for the request and
+ * the session. The grant is taken once.
+ */
+export async function afterAccountStep(
+  c: Context<Env>,
+  options: afterAccountStep.Options,
+): Promise<string> {
+  // The account step already stored the choice, so an unexpected failure keeps its redirect.
+  return await Timing.measure(
+    c,
+    accountStep(c, options),
+    'SignInConsent.accountStep',
+  ).catch((error: unknown) => {
+    Log.warn(c, {
+      error,
+      message: 'An account step kept its redirect, since its grant failed.',
+    })
+    return options.redirect
+  })
+}
+
+export declare namespace afterAccountStep {
+  type Options = {
+    /** The account that the user chose on the account step. */
+    account: `0x${string}`
+    /** The request headers, with the account step's selection in the cookie. */
+    headers: Headers
+    /** The redirect that Better Auth returned once the user chose the account. */
+    redirect: string
+    /** The signed-in session. */
+    session: Consent.Session
+  }
+}
+
+/**
+ * Returns where a sign-in continues: `redirect`, which Better Auth returned for the app's
+ * authorization request, or the app's `redirect_uri` with a code once the sign-in grants the
+ * request's key. Only a redirect to the approval page or to the account step, for a request with a
+ * key and without a `challenge`, grants anything, and only for the first sign-in of that request.
+ * `setCookie` holds the `Set-Cookie` headers of the sign-in, which carry the new session.
+ */
+export async function afterSignIn(
+  c: Context<Env>,
+  options: afterSignIn.Options,
+): Promise<string> {
+  // Better Auth already created the session, so an unexpected failure keeps the sign-in's redirect.
+  return await Timing.measure(
+    c,
+    signIn(c, options),
+    'SignInConsent.signIn',
+  ).catch((error: unknown) => {
+    Log.warn(c, {
+      error,
+      message: 'A sign-in kept its redirect, since its grant failed.',
+    })
+    return options.redirect
+  })
+}
+
+export declare namespace afterSignIn {
+  type Options = {
+    /** The one-tap sign-in's assertion and witness, for a passkey sign-in whose challenge was the key's digest. */
+    oneTap?: Consent.OneTap | undefined
+    /** The redirect that Better Auth returned for the continued authorization request. */
+    redirect: string
+    /** The `Set-Cookie` headers of the sign-in, which carry the new session. */
+    setCookie: readonly string[]
+  }
+}
+
+/**
+ * Returns the challenge of a one-tap sign-in for the sign-in page's `oauthQuery`: the digest of the
+ * request's key with a random witness, and that witness. Returns `undefined` for a forged or expired
+ * query, a request without a key, and a request with a `challenge`, whose sign-in takes a random
+ * challenge.
+ */
+export async function oneTap(
+  c: Context<Env>,
+  options: oneTap.Options,
+): Promise<oneTap.ReturnType | undefined> {
+  const query = new URLSearchParams(options.oauthQuery)
+  if (!query.has('key_authorization') || query.has('challenge'))
+    return undefined
+
+  const context = await Timing.measure(c, c.var.auth.$context, 'auth.context')
+  const verified = await Timing.measure(
+    c,
+    verifyOAuthQueryParams(options.oauthQuery, context.secret),
+    'auth.verifyOAuthQueryParams',
+  )
+  if (!verified) return undefined
+
+  const key = Authorize.fromQuery(query)
+  if (!key || key instanceof ErrorResponse.ResponseError) return undefined
+  const witness = Hex.fromBytes(crypto.getRandomValues(new Uint8Array(32)))
+  return {
+    digest: KeyAuthorization.digest({ key: { ...key, witness } }),
+    witness,
+  }
+}
+
+export declare namespace oneTap {
+  type Options = {
+    /** The sign-in page's query string, which Better Auth signed. */
+    oauthQuery: string
+  }
+
+  type ReturnType = {
+    /** The digest of the request's key with `witness`, which the passkey signs as its challenge. */
+    digest: Hex.Hex
+    /** The random witness that the digest binds. */
+    witness: Hex.Hex
+  }
+}
+
+/** Continues an account step for {@link afterAccountStep}, which catches its failures. */
+async function accountStep(
+  c: Context<Env>,
+  options: afterAccountStep.Options,
+): Promise<string> {
+  const { account, headers, redirect, session } = options
+  const url = URL.parse(redirect, env.URL)
+  if (
+    !url ||
+    url.origin !== new URL(env.URL).origin ||
+    url.pathname !== '/authorize'
+  )
+    return redirect
+  // A request with a challenge signs a message that only the approval page shows.
+  if (url.searchParams.has('challenge')) return redirect
+
+  const held = await Timing.measure(
+    c,
+    SignInGrant.take(db, {
+      query: url.searchParams,
+      sessionId: session.session.id,
+    }),
+    'SignInGrant.take',
+  )
+  if (!held) return redirect
+  const oneTap = (() => {
+    const assertion = Passkey.schema.assertion.safeParse(held.assertion)
+    if (!assertion.success || !held.witness) return undefined
+    return { assertion: assertion.data, witness: held.witness }
+  })()
+  return await grant(c, { account, headers, oneTap, redirect, session, url })
+}
+
+/**
+ * Approves the request of the approval page's `url`, and returns the app's redirect. A refusal, a
+ * spent rate limit, or a passkey that must sign on the approval page keeps `redirect`, so the
+ * approval page shows the request.
+ */
+async function grant(c: Context<Env>, options: grant.Options) {
+  const { headers, redirect, session, url } = options
+  // A grant reads the user's accounts and calls Privy, as an approval does.
+  const limited = await Timing.measure(
+    c,
+    RateLimit.check(c, {
+      limits: [{ binding: 'AUTHORIZE_LIMIT', key: session.user.id }],
+    }),
+    'RateLimit.check',
+  )
+  if (limited) return redirect
+
+  const approved = await Timing.measure(
+    c,
+    Consent.approve(c, {
+      account: options.account,
+      headers,
+      oauthQuery: url.search.slice(1),
+      oneTap: options.oneTap,
+      session,
+      // The sign-in page shows no account, so a user with several chooses one on a page that does.
+      single: true,
+    }),
+    'Consent.approve',
+  ).catch((error: unknown) => {
+    // An upstream failure, such as a Privy outage, keeps the approval page, which shows it.
+    Log.warn(c, {
+      error,
+      message:
+        'A sign-in could not grant the key that the sign-in page showed.',
+    })
+    return undefined
+  })
+  if (!approved || approved instanceof ErrorResponse.ResponseError)
+    return redirect
+  if ('options' in approved) return redirect
+  return approved.redirect
+}
+
+declare namespace grant {
+  type Options = {
+    /** The account that the user chose on the account step, if any. */
+    account?: `0x${string}` | undefined
+    /** The request headers, with the cookie of the signed-in session. */
+    headers: Headers
+    /** The one-tap sign-in's assertion and witness, if the sign-in was one. */
+    oneTap: Consent.OneTap | undefined
+    /** The redirect that keeps the approval page. */
+    redirect: string
+    /** The signed-in session. */
+    session: Consent.Session
+    /** The approval page's URL, whose query Better Auth signed. */
+    url: URL
+  }
+}
+
+/**
+ * Returns the request's headers with the cookies of `setCookie` in its `Cookie` header, so Better
+ * Auth reads the session that a sign-in just created.
+ */
+function sessionHeaders(c: Context<Env>, options: sessionHeaders.Options) {
+  const cookies = new Map(
+    (c.req.header('cookie') ?? '')
+      .split(';')
+      .map((entry) => entry.trim())
+      .filter(Boolean)
+      .map((entry) => {
+        const index = entry.indexOf('=')
+        return [entry.slice(0, index), entry.slice(index + 1)] as const
+      }),
+  )
+  for (const header of options.setCookie) {
+    const [pair = ''] = header.split(';')
+    const index = pair.indexOf('=')
+    if (index > 0)
+      cookies.set(pair.slice(0, index).trim(), pair.slice(index + 1))
+  }
+  const headers = new Headers(c.req.raw.headers)
+  headers.set(
+    'cookie',
+    [...cookies].map(([name, value]) => `${name}=${value}`).join('; '),
+  )
+  return headers
+}
+
+declare namespace sessionHeaders {
+  type Options = {
+    /** The `Set-Cookie` headers of the sign-in. */
+    setCookie: readonly string[]
+  }
+}
+
+/** Continues a sign-in for {@link afterSignIn}, which catches its failures. */
+async function signIn(
+  c: Context<Env>,
+  options: afterSignIn.Options,
+): Promise<string> {
+  const { oneTap, redirect, setCookie } = options
+  const url = URL.parse(redirect, env.URL)
+  if (!url || url.origin !== new URL(env.URL).origin) return redirect
+  if (url.pathname !== '/authorize' && url.pathname !== '/choose-account')
+    return redirect
+  const query = url.searchParams
+  // A request with a challenge signs a message that only the approval page shows.
+  if (!query.has('key_authorization') || query.has('challenge')) return redirect
+
+  const headers = sessionHeaders(c, { setCookie })
+  const session = await Timing.measure(
+    c,
+    c.var.auth.api.getSession({ headers }),
+    'auth.getSession',
+  )
+  if (!session) return redirect
+
+  // A replayed request grants nothing, so its sign-in opens the approval page.
+  const spent = await Timing.measure(
+    c,
+    SignInGrant.spend(db, { query }),
+    'SignInGrant.spend',
+  )
+  if (!spent) return redirect
+
+  if (url.pathname === '/choose-account') {
+    await Timing.measure(
+      c,
+      SignInGrant.hold(db, {
+        oneTap,
+        query,
+        sessionId: session.session.id,
+      }),
+      'SignInGrant.hold',
+    )
+    return redirect
+  }
+
+  return await grant(c, { headers, oneTap, redirect, session, url })
+}