@tern-secure/backend 1.2.0-canary.v20251003171521 → 1.2.0-canary.v20251008165428

package/dist/auth/index.js

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/auth/index.ts
@@ -34,191 +24,103 @@ __export(auth_exports, {
 });
 module.exports = __toCommonJS(auth_exports);
 
-// src/admin/sessionTernSecure.ts
-var import_errors = require("@tern-secure/shared/errors");
-
-// src/constants.ts
-var GOOGLE_PUBLIC_KEYS_URL = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com";
-var MAX_CACHE_LAST_UPDATED_AT_SECONDS = 5 * 60;
-var DEFAULT_CACHE_DURATION = 3600 * 1e3;
-var CACHE_CONTROL_REGEX = /max-age=(\d+)/;
-var Attributes = {
-  AuthToken: "__ternsecureAuthToken",
-  AuthSignature: "__ternsecureAuthSignature",
-  AuthStatus: "__ternsecureAuthStatus",
-  AuthReason: "__ternsecureAuthReason",
-  AuthMessage: "__ternsecureAuthMessage",
-  TernSecureUrl: "__ternsecureUrl"
-};
-var Cookies = {
-  Session: "__session",
-  CsrfToken: "__session_terncf",
-  IdToken: "FIREBASE_[DEFAULT]",
-  Refresh: "FIREBASEID_[DEFAULT]",
-  Custom: "__custom",
-  Handshake: "__ternsecure_handshake",
-  DevBrowser: "__ternsecure_db_jwt",
-  RedirectCount: "__ternsecure_redirect_count",
-  HandshakeNonce: "__ternsecure_handshake_nonce"
-};
-var Headers2 = {
-  Accept: "accept",
-  AuthMessage: "x-ternsecure-auth-message",
-  Authorization: "authorization",
-  AuthReason: "x-ternsecure-auth-reason",
-  AuthSignature: "x-ternsecure-auth-signature",
-  AuthStatus: "x-ternsecure-auth-status",
-  AuthToken: "x-ternsecure-auth-token",
-  CacheControl: "cache-control",
-  TernSecureRedirectTo: "x-ternsecure-redirect-to",
-  TernSecureRequestData: "x-ternsecure-request-data",
-  TernSecureUrl: "x-ternsecure-url",
-  CloudFrontForwardedProto: "cloudfront-forwarded-proto",
-  ContentType: "content-type",
-  ContentSecurityPolicy: "content-security-policy",
-  ContentSecurityPolicyReportOnly: "content-security-policy-report-only",
-  EnableDebug: "x-ternsecure-debug",
-  ForwardedHost: "x-forwarded-host",
-  ForwardedPort: "x-forwarded-port",
-  ForwardedProto: "x-forwarded-proto",
-  Host: "host",
-  Location: "location",
-  Nonce: "x-nonce",
-  Origin: "origin",
-  Referrer: "referer",
-  SecFetchDest: "sec-fetch-dest",
-  UserAgent: "user-agent",
-  ReportingEndpoints: "reporting-endpoints"
-};
-var ContentTypes = {
-  Json: "application/json"
-};
-var constants = {
-  Attributes,
-  Cookies,
-  Headers: Headers2,
-  ContentTypes
-};
-
-// src/utils/admin-init.ts
-var import_firebase_admin = __toESM(require("firebase-admin"));
-
-// src/utils/config.ts
-var loadAdminConfig = () => ({
-  projectId: process.env.FIREBASE_PROJECT_ID || "",
-  clientEmail: process.env.FIREBASE_CLIENT_EMAIL || "",
-  privateKey: process.env.FIREBASE_PRIVATE_KEY || ""
-});
-var validateAdminConfig = (config) => {
-  const requiredFields = [
-    "projectId",
-    "clientEmail",
-    "privateKey"
-  ];
-  const errors = [];
-  requiredFields.forEach((field) => {
-    if (!config[field]) {
-      errors.push(`Missing required field: FIREBASE_${String(field).toUpperCase()}`);
-    }
-  });
-  return {
-    isValid: errors.length === 0,
-    errors,
-    config
-  };
-};
-var initializeAdminConfig = () => {
-  const config = loadAdminConfig();
-  const validationResult = validateAdminConfig(config);
-  if (!validationResult.isValid) {
-    throw new Error(
-      `Firebase Admin configuration validation failed:
-${validationResult.errors.join("\n")}`
-    );
+// src/jwt/customJwt.ts
+var import_jose = require("jose");
+var CustomTokenError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "CustomTokenError";
   }
-  return config;
 };
-
-// src/utils/admin-init.ts
-if (!import_firebase_admin.default.apps.length) {
+var RESERVED_CLAIMS = [
+  "acr",
+  "amr",
+  "at_hash",
+  "aud",
+  "auth_time",
+  "azp",
+  "cnf",
+  "c_hash",
+  "exp",
+  "firebase",
+  "iat",
+  "iss",
+  "jti",
+  "nbf",
+  "nonce",
+  "sub"
+];
+async function createCustomTokenJwt(uid, developerClaims) {
   try {
-    const config = initializeAdminConfig();
-    import_firebase_admin.default.initializeApp({
-      credential: import_firebase_admin.default.credential.cert({
-        ...config,
-        privateKey: config.privateKey.replace(/\\n/g, "\n")
-      })
-    });
+    const privateKey = process.env.FIREBASE_PRIVATE_KEY;
+    const clientEmail = process.env.FIREBASE_CLIENT_EMAIL;
+    if (!privateKey || !clientEmail) {
+      return {
+        errors: [
+          new CustomTokenError(
+            "Missing FIREBASE_PRIVATE_KEY or FIREBASE_CLIENT_EMAIL environment variables",
+            "MISSING_ENV_VARS"
+          )
+        ]
+      };
+    }
+    if (!uid || typeof uid !== "string") {
+      return {
+        errors: [new CustomTokenError("uid must be a non-empty string", "INVALID_UID")]
+      };
+    }
+    if (uid.length > 128) {
+      return {
+        errors: [new CustomTokenError("uid must not exceed 128 characters", "UID_TOO_LONG")]
+      };
+    }
+    if (developerClaims) {
+      for (const claim of Object.keys(developerClaims)) {
+        if (RESERVED_CLAIMS.includes(claim)) {
+          return {
+            errors: [new CustomTokenError(`Custom claim '${claim}' is reserved`, "RESERVED_CLAIM")]
+          };
+        }
+      }
+    }
+    const expiresIn = 3600;
+    const now = Math.floor(Date.now() / 1e3);
+    const parsedPrivateKey = await (0, import_jose.importPKCS8)(privateKey.replace(/\\n/g, "\n"), "RS256");
+    const payload = {
+      iss: clientEmail,
+      sub: clientEmail,
+      aud: "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit",
+      iat: now,
+      exp: now + expiresIn,
+      uid,
+      ...developerClaims
+    };
+    const jwt = await new import_jose.SignJWT(payload).setProtectedHeader({ alg: "RS256", typ: "JWT" }).setIssuedAt(now).setExpirationTime(now + expiresIn).setIssuer(clientEmail).setSubject(clientEmail).setAudience(
+      "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit"
+    ).sign(parsedPrivateKey);
+    return {
+      data: jwt
+    };
   } catch (error) {
-    console.error("Firebase admin initialization error", error);
+    const message = error instanceof Error ? error.message : "Unknown error occurred";
+    return {
+      errors: [
+        new CustomTokenError(`Failed to create custom token: ${message}`, "TOKEN_CREATION_FAILED")
+      ]
+    };
   }
 }
-var adminTernSecureAuth = import_firebase_admin.default.auth();
-var adminTernSecureDb = import_firebase_admin.default.firestore();
-var TernSecureTenantManager = import_firebase_admin.default.auth().tenantManager();
-function getAuthForTenant(tenantId) {
-  if (tenantId) {
-    return TernSecureTenantManager.authForTenant(tenantId);
-  }
-  return import_firebase_admin.default.auth();
-}
-
-// src/admin/sessionTernSecure.ts
-var SESSION_CONSTANTS = {
-  COOKIE_NAME: "_session_cookie",
-  //DEFAULT_EXPIRES_IN_MS: 60 * 60 * 24 * 5 * 1000, // 5 days
-  //DEFAULT_EXPIRES_IN_SECONDS: 60 * 60 * 24 * 5, // 5days
-  DEFAULT_EXPIRES_IN_MS: 5 * 60 * 1e3,
-  // 5 minutes
-  DEFAULT_EXPIRES_IN_SECONDS: 5 * 60,
-  REVOKE_REFRESH_TOKENS_ON_SIGNOUT: true
-};
-var COOKIE_OPTIONS = {
-  httpOnly: true,
-  secure: process.env.NODE_ENV === "production",
-  sameSite: "strict",
-  path: "/"
-};
-var DEFAULT_COOKIE_CONFIG = {
-  DEFAULT_EXPIRES_IN_MS: 5 * 60 * 1e3,
-  // 5 minutes
-  DEFAULT_EXPIRES_IN_SECONDS: 5 * 60,
-  REVOKE_REFRESH_TOKENS_ON_SIGNOUT: true
-};
-var DEFAULT_COOKIE_OPTIONS = {
-  httpOnly: true,
-  secure: process.env.NODE_ENV === "production",
-  sameSite: "strict",
-  path: "/"
-};
-async function createCustomTokenClaims(uid, developerClaims) {
-  const adminAuth = getAuthForTenant();
-  try {
-    const customToken = await adminAuth.createCustomToken(uid, developerClaims);
-    return customToken;
-  } catch (error) {
-    console.error("[createCustomToken] Error creating custom token:", error);
-    return "";
+async function createCustomToken(uid, developerClaims) {
+  const { data, errors } = await createCustomTokenJwt(uid, developerClaims);
+  if (errors) {
+    throw errors[0];
   }
+  return data;
 }
 
-// src/admin/nextSessionTernSecure.ts
-var import_cookie = require("@tern-secure/shared/cookie");
-var import_errors2 = require("@tern-secure/shared/errors");
-var import_headers = require("next/headers");
-var SESSION_CONSTANTS2 = {
-  COOKIE_NAME: constants.Cookies.Session,
-  DEFAULT_EXPIRES_IN_MS: 60 * 60 * 24 * 5 * 1e3,
-  // 5 days
-  DEFAULT_EXPIRES_IN_SECONDS: 60 * 60 * 24 * 5,
-  REVOKE_REFRESH_TOKENS_ON_SIGNOUT: true
-};
-
-// src/tokens/ternSecureRequest.ts
-var import_cookie2 = require("cookie");
-
 // src/jwt/verifyJwt.ts
-var import_jose2 = require("jose");
+var import_jose3 = require("jose");
 
 // src/utils/errors.ts
 var TokenVerificationErrorReason = {
@@ -265,7 +167,7 @@ function mapJwtPayloadToDecodedIdToken(payload) {
 // src/utils/rfc4648.ts
 var base64url = {
   parse(string, opts) {
-    return parse2(string, base64UrlEncoding, opts);
+    return parse(string, base64UrlEncoding, opts);
   },
   stringify(data, opts) {
     return stringify(data, base64UrlEncoding, opts);
@@ -275,7 +177,7 @@ var base64UrlEncoding = {
   chars: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",
   bits: 6
 };
-function parse2(string, encoding, opts = {}) {
+function parse(string, encoding, opts = {}) {
   if (!encoding.codes) {
     encoding.codes = {};
     for (let i = 0; i < encoding.chars.length; ++i) {
@@ -339,10 +241,10 @@ function stringify(data, encoding, opts = {}) {
 }
 
 // src/jwt/cryptoKeys.ts
-var import_jose = require("jose");
+var import_jose2 = require("jose");
 async function importKey(key, algorithm) {
   if (typeof key === "object") {
-    const result = await (0, import_jose.importJWK)(key, algorithm);
+    const result = await (0, import_jose2.importJWK)(key, algorithm);
     if (result instanceof Uint8Array) {
       throw new Error("Unexpected Uint8Array result from JWK import");
     }
@@ -350,13 +252,13 @@ async function importKey(key, algorithm) {
   }
   const keyString = key.trim();
   if (keyString.includes("-----BEGIN CERTIFICATE-----")) {
-    return await (0, import_jose.importX509)(keyString, algorithm);
+    return await (0, import_jose2.importX509)(keyString, algorithm);
   }
   if (keyString.includes("-----BEGIN PUBLIC KEY-----")) {
-    return await (0, import_jose.importSPKI)(keyString, algorithm);
+    return await (0, import_jose2.importSPKI)(keyString, algorithm);
   }
   try {
-    return await (0, import_jose.importSPKI)(keyString, algorithm);
+    return await (0, import_jose2.importSPKI)(keyString, algorithm);
   } catch (error) {
     throw new Error(
       `Unsupported key format. Supported formats: X.509 certificate (PEM), SPKI (PEM), JWK (JSON object or string). Error: ${error}`
@@ -439,7 +341,7 @@ async function verifySignature(jwt, key) {
   const joseAlgorithm = header.alg || "RS256";
   try {
     const publicKey = await importKey(key, joseAlgorithm);
-    const { payload } = await (0, import_jose2.jwtVerify)(raw.text, publicKey);
+    const { payload } = await (0, import_jose3.jwtVerify)(raw.text, publicKey);
     return { data: payload };
   } catch (error) {
     return {
@@ -454,8 +356,8 @@ async function verifySignature(jwt, key) {
 }
 function ternDecodeJwt(token) {
   try {
-    const header = (0, import_jose2.decodeProtectedHeader)(token);
-    const payload = (0, import_jose2.decodeJwt)(token);
+    const header = (0, import_jose3.decodeProtectedHeader)(token);
+    const payload = (0, import_jose3.decodeJwt)(token);
     const tokenParts = (token || "").toString().split(".");
     if (tokenParts.length !== 3) {
       return {
@@ -523,6 +425,12 @@ async function verifyJwt(token, options) {
   return { data: decodedIdToken };
 }
 
+// src/constants.ts
+var GOOGLE_PUBLIC_KEYS_URL = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com";
+var MAX_CACHE_LAST_UPDATED_AT_SECONDS = 5 * 60;
+var DEFAULT_CACHE_DURATION = 3600 * 1e3;
+var CACHE_CONTROL_REGEX = /max-age=(\d+)/;
+
 // src/tokens/keys.ts
 var cache = {};
 var lastUpdatedAt = 0;
@@ -649,6 +557,8 @@ async function verifyToken(token, options) {
 }
 
 // src/auth/getauth.ts
+var API_KEY_ERROR = "API Key is required";
+var NO_DATA_ERROR = "No token data received";
 function parseFirebaseResponse(data) {
   if (typeof data === "string") {
     try {
@@ -660,13 +570,38 @@ function parseFirebaseResponse(data) {
   return data;
 }
 function getAuth(options) {
-  const { apiKey } = options.firebaseConfig || {};
+  const { apiKey } = options;
+  const firebaseApiKey = options.firebaseConfig?.apiKey;
+  const effectiveApiKey = apiKey || firebaseApiKey;
+  async function refreshExpiredIdToken(refreshToken, opts) {
+    if (!effectiveApiKey) {
+      return { data: null, error: new Error(API_KEY_ERROR) };
+    }
+    const response = await options.apiClient?.tokens.refreshToken(effectiveApiKey, {
+      refresh_token: refreshToken,
+      request_origin: opts.referer
+    });
+    if (!response?.data) {
+      return {
+        data: null,
+        error: new Error(NO_DATA_ERROR)
+      };
+    }
+    const parsedData = parseFirebaseResponse(response.data);
+    return {
+      data: {
+        idToken: parsedData.id_token,
+        refreshToken: parsedData.refresh_token
+      },
+      error: null
+    };
+  }
   async function customForIdAndRefreshToken(customToken, opts) {
-    if (!apiKey) {
+    if (!effectiveApiKey) {
       throw new Error("API Key is required to create custom token");
     }
     const response = await options.apiClient?.tokens.exchangeCustomForIdAndRefreshTokens(
-      apiKey,
+      effectiveApiKey,
       {
         token: customToken,
         returnSecureToken: true
@@ -690,7 +625,7 @@ function getAuth(options) {
     if (errors) {
       throw errors[0];
     }
-    const customToken = await createCustomTokenClaims(data.uid, {
+    const customToken = await createCustomToken(data.uid, {
       emailVerified: data.email_verified,
       source_sign_in_provider: data.firebase.sign_in_provider
     });
@@ -704,7 +639,8 @@ function getAuth(options) {
   }
   return {
     customForIdAndRefreshToken,
-    createCustomIdAndRefreshToken
+    createCustomIdAndRefreshToken,
+    refreshExpiredIdToken
   };
 }
 // Annotate the CommonJS export names for ESM import in node: