@tern-secure/backend 1.2.0-canary.v20251030165007 → 1.2.0-canary.v20251108045933

package/dist/chunk-MS6L7M3C.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tokens/keys.ts","../src/tokens/verify.ts","../src/auth/getauth.ts"],"sourcesContent":["import { type RemoteJWKSetOptions } from 'jose';\n\nimport {\n  CACHE_CONTROL_REGEX,\n  DEFAULT_CACHE_DURATION,\n  GOOGLE_PUBLIC_KEYS_URL,\n  MAX_CACHE_LAST_UPDATED_AT_SECONDS\n} from '../constants';\nimport { TokenVerificationError, TokenVerificationErrorReason } from '../utils/errors';\n\nexport type PublicKeys = { [key: string]: string };\n\ninterface PublicKeysResponse {\n  keys: PublicKeys;\n  expiresAt: number;\n}\n\nexport type LoadJWKFromRemoteOptions = RemoteJWKSetOptions & {\n  kid: string;\n  keyURL?: string;\n  skipJwksCache?: boolean;\n};\n\ntype CertificateCache = Record<string, string>;\n\nlet cache: CertificateCache = {};\nlet lastUpdatedAt = 0;\nlet googleExpiresAt = 0;\n\nfunction getFromCache(kid: string) {\n  return cache[kid];\n}\n\nfunction getCacheValues() {\n  return Object.values(cache);\n}\n\nfunction setInCache(kid: string, certificate: string, shouldExpire = true) {\n  cache[kid] = certificate;\n  lastUpdatedAt = shouldExpire ? Date.now() : -1;\n}\n\nasync function fetchPublicKeys(keyUrl: string): Promise<PublicKeysResponse> {\n  const url = new URL(keyUrl);\n  const response = await fetch(url);\n  if (!response.ok) {\n    throw new TokenVerificationError({\n      message: `Error loading public keys from ${url.href} with code=${response.status} `,\n      reason: TokenVerificationErrorReason.TokenInvalid,\n    });\n  }\n\n  const data = await response.json();\n  const expiresAt = getExpiresAt(response);\n\n  return {\n    keys: data,\n    expiresAt,\n  };\n}\n\nexport async function loadJWKFromRemote({\n  keyURL = GOOGLE_PUBLIC_KEYS_URL,\n  skipJwksCache,\n  kid,\n}: LoadJWKFromRemoteOptions): Promise<string> {\n  if (skipJwksCache || isCacheExpired() || !getFromCache(kid)) {\n    const { keys, expiresAt } = await fetchPublicKeys(keyURL);\n\n    if (!keys || Object.keys(keys).length === 0) {\n      throw new TokenVerificationError({\n        message: `The JWKS endpoint ${keyURL} returned no keys`,\n        reason: TokenVerificationErrorReason.RemoteJWKFailedToLoad,\n      });\n    }\n    googleExpiresAt = expiresAt;\n\n    Object.entries(keys).forEach(([keyId, cert]) => {\n      setInCache(keyId, cert);\n    });\n  }\n  const cert = getFromCache(kid);\n  if (!cert) {\n    getCacheValues();\n    const availableKids = Object.keys(cache).sort().join(', ');\n\n    throw new TokenVerificationError({\n      message: `No public key found for kid \"${kid}\". Available kids: [${availableKids}]`,\n      reason: TokenVerificationErrorReason.TokenInvalid,\n    });\n  }\n  return cert;\n}\n\nfunction isCacheExpired() {\n  const now = Date.now();\n  if (lastUpdatedAt === -1) {\n    return false;\n  }\n\n  const cacheAge = now - lastUpdatedAt;\n  const maxCacheAge = MAX_CACHE_LAST_UPDATED_AT_SECONDS * 1000;\n  const localCacheExpired = cacheAge >= maxCacheAge;\n  const googleCacheExpired = now >= googleExpiresAt;\n\n  const isExpired = localCacheExpired || googleCacheExpired;\n\n  if (isExpired) {\n    cache = {};\n  }\n\n  return isExpired;\n}\n\nfunction getExpiresAt(res: Response) {\n  const cacheControlHeader = res.headers.get('cache-control');\n  if (!cacheControlHeader) {\n    return Date.now() + DEFAULT_CACHE_DURATION;\n  }\n  const maxAgeMatch = cacheControlHeader.match(CACHE_CONTROL_REGEX);\n  const maxAge = maxAgeMatch ? parseInt(maxAgeMatch[1], 10) : DEFAULT_CACHE_DURATION / 1000;\n\n  return Date.now() + maxAge * 1000;\n}\n\nexport const getCacheStats = () => ({\n  localExpiry: lastUpdatedAt + MAX_CACHE_LAST_UPDATED_AT_SECONDS * 1000,\n  googleExpiry: googleExpiresAt,\n  cacheCount: Object.keys(cache).length,\n});\n","import type { DecodedIdToken, TernSecureConfig, TernSecureUserData } from '@tern-secure/types';\n\nimport type { JwtReturnType } from '../jwt/types';\nimport { ternDecodeJwt, verifyJwt, type VerifyJwtOptions } from '../jwt/verifyJwt';\nimport { TokenVerificationError, TokenVerificationErrorReason } from '../utils/errors';\nimport type { LoadJWKFromRemoteOptions } from './keys';\nimport { loadJWKFromRemote } from './keys';\n\nexport type VerifyTokenVOptions = Omit<VerifyJwtOptions, 'key'> & Omit<LoadJWKFromRemoteOptions, 'kid'> & {\n  jwtKey?: string;\n};\n\nexport { TernSecureConfig, TernSecureUserData };\n\nexport async function verifyToken(\n  token: string,\n  options: VerifyTokenVOptions,\n): Promise<JwtReturnType<DecodedIdToken, TokenVerificationError>> {\n  const { data: decodedResult, errors } = ternDecodeJwt(token);\n\n  if (errors) {\n    return { errors };\n  }\n\n  const { header } = decodedResult;\n  const { kid } = header;\n\n  if (!kid) {\n    return {\n      errors: [\n        new TokenVerificationError({\n          reason: TokenVerificationErrorReason.TokenInvalid,\n          message: 'JWT \"kid\" header is missing.',\n        }),\n      ],\n    };\n  }\n\n  try {\n    const key = options.jwtKey || (await loadJWKFromRemote({ ...options, kid }));\n\n    if (!key) {\n      return {\n        errors: [\n          new TokenVerificationError({\n            reason: TokenVerificationErrorReason.TokenInvalid,\n            message: `No public key found for kid \"${kid}\".`,\n          }),\n        ],\n      };\n    }\n    return await verifyJwt(token, { ...options, key });\n  } catch (error) {\n    if (error instanceof TokenVerificationError) {\n      return { errors: [error] };\n    }\n    return {\n      errors: [error as TokenVerificationError],\n    };\n  }\n}\n","import { createCustomToken } from '../jwt/customJwt';\nimport type { AuthenticateRequestOptions, TernSecureUserData } from '../tokens/types';\nimport { verifyToken } from '../tokens/verify';\n\nexport interface IdAndRefreshTokens {\n  idToken: string;\n  refreshToken: string;\n}\n\nexport interface CustomTokens {\n  auth_time: number;\n  idToken: string;\n  refreshToken: string;\n  customToken: string;\n}\n\ninterface CustomForIdAndRefreshTokenOptions {\n  tenantId?: string;\n  appCheckToken?: string;\n  referer?: string;\n}\n\ninterface FirebaseRefreshTokenResponse {\n  kind: string;\n  id_token: string;\n  refresh_token: string;\n  expires_in: string;\n  isNewUser: boolean;\n}\n\ninterface FirebaseCustomTokenResponse {\n  kind: string;\n  idToken: string;\n  refreshToken: string;\n  expiresIn: string;\n  isNewUser: boolean;\n}\n\ntype AuthResult<T = any> = { data: T; error: null } | { data: null; error: any };\n\nconst API_KEY_ERROR = 'API Key is required';\nconst NO_DATA_ERROR = 'No token data received';\n\nfunction parseFirebaseResponse<T>(data: unknown): T {\n  if (typeof data === 'string') {\n    try {\n      return JSON.parse(data) as T;\n    } catch (error) {\n      throw new Error(`Failed to parse Firebase response: ${error}`);\n    }\n  }\n  return data as T;\n}\n\nexport function getAuth(options: AuthenticateRequestOptions) {\n  const { apiKey } = options;\n  const firebaseApiKey = options.firebaseConfig?.apiKey;\n  const effectiveApiKey = apiKey || firebaseApiKey;\n\n  async function getUserData(idToken?: string, localId?: string): Promise<TernSecureUserData> {\n    if (!effectiveApiKey) {\n      throw new Error(API_KEY_ERROR);\n    }\n    const response = await options.apiClient?.userData.getUserData(effectiveApiKey, {\n      idToken,\n      localId,\n    });\n\n    if (!response?.data) {\n      throw new Error(NO_DATA_ERROR);\n    }\n\n    const parsedData = parseFirebaseResponse<TernSecureUserData>(response.data);\n    return parsedData;\n  }\n\n  async function refreshExpiredIdToken(\n    refreshToken: string,\n    opts: CustomForIdAndRefreshTokenOptions,\n  ): Promise<AuthResult> {\n    if (!effectiveApiKey) {\n      return { data: null, error: new Error(API_KEY_ERROR) };\n    }\n    const response = await options.apiClient?.tokens.refreshToken(effectiveApiKey, {\n      refresh_token: refreshToken,\n      request_origin: opts.referer,\n    });\n\n    if (!response?.data) {\n      return {\n        data: null,\n        error: new Error(NO_DATA_ERROR),\n      };\n    }\n\n    const parsedData = parseFirebaseResponse<FirebaseRefreshTokenResponse>(response.data);\n\n    return {\n      data: {\n        idToken: parsedData.id_token,\n        refreshToken: parsedData.refresh_token,\n      },\n      error: null,\n    };\n  }\n\n  async function customForIdAndRefreshToken(\n    customToken: string,\n    opts: CustomForIdAndRefreshTokenOptions,\n  ): Promise<IdAndRefreshTokens> {\n    if (!effectiveApiKey) {\n      throw new Error('API Key is required to create custom token');\n    }\n    const response = await options.apiClient?.tokens.exchangeCustomForIdAndRefreshTokens(\n      effectiveApiKey,\n      {\n        token: customToken,\n        returnSecureToken: true,\n      },\n      {\n        referer: opts.referer,\n      },\n    );\n\n    if (!response?.data) {\n      throw new Error('No data received from Firebase token exchange');\n    }\n\n    const parsedData = parseFirebaseResponse<FirebaseCustomTokenResponse>(response.data);\n\n    return {\n      idToken: parsedData.idToken,\n      refreshToken: parsedData.refreshToken,\n    };\n  }\n\n  async function createCustomIdAndRefreshToken(\n    idToken: string,\n    opts: CustomForIdAndRefreshTokenOptions,\n  ): Promise<CustomTokens> {\n    const decoded = await verifyToken(idToken, options);\n    const { data, errors } = decoded;\n    if (errors) {\n      throw errors[0];\n    }\n\n    //todo:\n    /**\n     * For sensitive applications, the auth_time should be checked before issuing the session cookie, minimizing the window of attack in case an ID token is stolen:\n    */\n    //if (new Date().getTime() / 1000 - data.auth_time < 5 * 60) {\n    //proceed\n    //}\n\n    const customToken = await createCustomToken(data.uid, {\n      emailVerified: data.email_verified,\n      source_sign_in_provider: data.firebase.sign_in_provider,\n    });\n\n    const idAndRefreshTokens = await customForIdAndRefreshToken(customToken, {\n      referer: opts.referer,\n    });\n\n    const decodedCustomIdToken = await verifyToken(idAndRefreshTokens.idToken, options);\n    if (decodedCustomIdToken.errors) {\n      throw decodedCustomIdToken.errors[0];\n    }\n\n    return {\n      ...idAndRefreshTokens,\n      customToken,\n      auth_time: decodedCustomIdToken.data.auth_time,\n    };\n  }\n\n  return {\n    getUserData,\n    customForIdAndRefreshToken,\n    createCustomIdAndRefreshToken,\n    refreshExpiredIdToken,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAyBA,IAAI,QAA0B,CAAC;AAC/B,IAAI,gBAAgB;AACpB,IAAI,kBAAkB;AAEtB,SAAS,aAAa,KAAa;AACjC,SAAO,MAAM,GAAG;AAClB;AAEA,SAAS,iBAAiB;AACxB,SAAO,OAAO,OAAO,KAAK;AAC5B;AAEA,SAAS,WAAW,KAAa,aAAqB,eAAe,MAAM;AACzE,QAAM,GAAG,IAAI;AACb,kBAAgB,eAAe,KAAK,IAAI,IAAI;AAC9C;AAEA,eAAe,gBAAgB,QAA6C;AAC1E,QAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,uBAAuB;AAAA,MAC/B,SAAS,kCAAkC,IAAI,IAAI,cAAc,SAAS,MAAM;AAAA,MAChF,QAAQ,6BAA6B;AAAA,IACvC,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAM,YAAY,aAAa,QAAQ;AAEvC,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,EACF;AACF;AAEA,eAAsB,kBAAkB;AAAA,EACtC,SAAS;AAAA,EACT;AAAA,EACA;AACF,GAA8C;AAC5C,MAAI,iBAAiB,eAAe,KAAK,CAAC,aAAa,GAAG,GAAG;AAC3D,UAAM,EAAE,MAAM,UAAU,IAAI,MAAM,gBAAgB,MAAM;AAExD,QAAI,CAAC,QAAQ,OAAO,KAAK,IAAI,EAAE,WAAW,GAAG;AAC3C,YAAM,IAAI,uBAAuB;AAAA,QAC/B,SAAS,qBAAqB,MAAM;AAAA,QACpC,QAAQ,6BAA6B;AAAA,MACvC,CAAC;AAAA,IACH;AACA,sBAAkB;AAElB,WAAO,QAAQ,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAOA,KAAI,MAAM;AAC9C,iBAAW,OAAOA,KAAI;AAAA,IACxB,CAAC;AAAA,EACH;AACA,QAAM,OAAO,aAAa,GAAG;AAC7B,MAAI,CAAC,MAAM;AACT,mBAAe;AACf,UAAM,gBAAgB,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI;AAEzD,UAAM,IAAI,uBAAuB;AAAA,MAC/B,SAAS,gCAAgC,GAAG,uBAAuB,aAAa;AAAA,MAChF,QAAQ,6BAA6B;AAAA,IACvC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB;AACxB,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,kBAAkB,IAAI;AACxB,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,MAAM;AACvB,QAAM,cAAc,oCAAoC;AACxD,QAAM,oBAAoB,YAAY;AACtC,QAAM,qBAAqB,OAAO;AAElC,QAAM,YAAY,qBAAqB;AAEvC,MAAI,WAAW;AACb,YAAQ,CAAC;AAAA,EACX;AAEA,SAAO;AACT;AAEA,SAAS,aAAa,KAAe;AACnC,QAAM,qBAAqB,IAAI,QAAQ,IAAI,eAAe;AAC1D,MAAI,CAAC,oBAAoB;AACvB,WAAO,KAAK,IAAI,IAAI;AAAA,EACtB;AACA,QAAM,cAAc,mBAAmB,MAAM,mBAAmB;AAChE,QAAM,SAAS,cAAc,SAAS,YAAY,CAAC,GAAG,EAAE,IAAI,yBAAyB;AAErF,SAAO,KAAK,IAAI,IAAI,SAAS;AAC/B;;;AC7GA,eAAsB,YACpB,OACA,SACgE;AAChE,QAAM,EAAE,MAAM,eAAe,OAAO,IAAI,cAAc,KAAK;AAE3D,MAAI,QAAQ;AACV,WAAO,EAAE,OAAO;AAAA,EAClB;AAEA,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,EAAE,IAAI,IAAI;AAEhB,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,IAAI,uBAAuB;AAAA,UACzB,QAAQ,6BAA6B;AAAA,UACrC,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ,UAAW,MAAM,kBAAkB,EAAE,GAAG,SAAS,IAAI,CAAC;AAE1E,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,IAAI,uBAAuB;AAAA,YACzB,QAAQ,6BAA6B;AAAA,YACrC,SAAS,gCAAgC,GAAG;AAAA,UAC9C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,WAAO,MAAM,UAAU,OAAO,EAAE,GAAG,SAAS,IAAI,CAAC;AAAA,EACnD,SAAS,OAAO;AACd,QAAI,iBAAiB,wBAAwB;AAC3C,aAAO,EAAE,QAAQ,CAAC,KAAK,EAAE;AAAA,IAC3B;AACA,WAAO;AAAA,MACL,QAAQ,CAAC,KAA+B;AAAA,IAC1C;AAAA,EACF;AACF;;;ACpBA,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AAEtB,SAAS,sBAAyB,MAAkB;AAClD,MAAI,OAAO,SAAS,UAAU;AAC5B,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,SAAS,OAAO;AACd,YAAM,IAAI,MAAM,sCAAsC,KAAK,EAAE;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,QAAQ,SAAqC;AAC3D,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,iBAAiB,QAAQ,gBAAgB;AAC/C,QAAM,kBAAkB,UAAU;AAElC,iBAAe,YAAY,SAAkB,SAA+C;AAC1F,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,MAAM,aAAa;AAAA,IAC/B;AACA,UAAM,WAAW,MAAM,QAAQ,WAAW,SAAS,YAAY,iBAAiB;AAAA,MAC9E;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,CAAC,UAAU,MAAM;AACnB,YAAM,IAAI,MAAM,aAAa;AAAA,IAC/B;AAEA,UAAM,aAAa,sBAA0C,SAAS,IAAI;AAC1E,WAAO;AAAA,EACT;AAEA,iBAAe,sBACb,cACA,MACqB;AACrB,QAAI,CAAC,iBAAiB;AACpB,aAAO,EAAE,MAAM,MAAM,OAAO,IAAI,MAAM,aAAa,EAAE;AAAA,IACvD;AACA,UAAM,WAAW,MAAM,QAAQ,WAAW,OAAO,aAAa,iBAAiB;AAAA,MAC7E,eAAe;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,QAAI,CAAC,UAAU,MAAM;AACnB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,IAAI,MAAM,aAAa;AAAA,MAChC;AAAA,IACF;AAEA,UAAM,aAAa,sBAAoD,SAAS,IAAI;AAEpF,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,SAAS,WAAW;AAAA,QACpB,cAAc,WAAW;AAAA,MAC3B;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAEA,iBAAe,2BACb,aACA,MAC6B;AAC7B,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AACA,UAAM,WAAW,MAAM,QAAQ,WAAW,OAAO;AAAA,MAC/C;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB;AAAA,MACA;AAAA,QACE,SAAS,KAAK;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,CAAC,UAAU,MAAM;AACnB,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,UAAM,aAAa,sBAAmD,SAAS,IAAI;AAEnF,WAAO;AAAA,MACL,SAAS,WAAW;AAAA,MACpB,cAAc,WAAW;AAAA,IAC3B;AAAA,EACF;AAEA,iBAAe,8BACb,SACA,MACuB;AACvB,UAAM,UAAU,MAAM,YAAY,SAAS,OAAO;AAClD,UAAM,EAAE,MAAM,OAAO,IAAI;AACzB,QAAI,QAAQ;AACV,YAAM,OAAO,CAAC;AAAA,IAChB;AAUA,UAAM,cAAc,MAAM,kBAAkB,KAAK,KAAK;AAAA,MACpD,eAAe,KAAK;AAAA,MACpB,yBAAyB,KAAK,SAAS;AAAA,IACzC,CAAC;AAED,UAAM,qBAAqB,MAAM,2BAA2B,aAAa;AAAA,MACvE,SAAS,KAAK;AAAA,IAChB,CAAC;AAED,UAAM,uBAAuB,MAAM,YAAY,mBAAmB,SAAS,OAAO;AAClF,QAAI,qBAAqB,QAAQ;AAC/B,YAAM,qBAAqB,OAAO,CAAC;AAAA,IACrC;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,MACA,WAAW,qBAAqB,KAAK;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":["cert"]}

package/dist/constants.d.ts

@@ -17,10 +17,11 @@ export declare const constants: {
     };
     readonly Cookies: {
         readonly Session: "__session";
-        readonly CsrfToken: "__session_terncf";
+        readonly CsrfToken: "__terncf";
         readonly IdToken: "TernSecure_[DEFAULT]";
         readonly Refresh: "TernSecureID_[DEFAULT]";
         readonly Custom: "__custom";
+        readonly TernAut: "tern_aut";
         readonly Handshake: "__ternsecure_handshake";
         readonly DevBrowser: "__ternsecure_db_jwt";
         readonly RedirectCount: "__ternsecure_redirect_count";
@@ -58,6 +59,17 @@ export declare const constants: {
     readonly ContentTypes: {
         readonly Json: "application/json";
     };
+    readonly QueryParameters: {
+        readonly TernSynced: "__tern_synced";
+        readonly SuffixedCookies: "suffixed_cookies";
+        readonly TernRedirectUrl: "__tern_redirect_url";
+        readonly DevBrowser: "__ternsecure_db_jwt";
+        readonly Handshake: "__ternsecure_handshake";
+        readonly HandshakeHelp: "__tern_help";
+        readonly LegacyDevBrowser: "__dev_session";
+        readonly HandshakeReason: "__tern_hs_reason";
+        readonly HandshakeNonce: "__ternsecure_handshake_nonce";
+    };
 };
 export type Constants = typeof constants;
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,6FACyD,CAAC;AAC7F,eAAO,MAAM,8BAA8B,0EAC8B,CAAC;AAE1E,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAClD,eAAO,MAAM,mBAAmB,QAAkB,CAAC;AAyDnD;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKZ,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,6FACyD,CAAC;AAC7F,eAAO,MAAM,8BAA8B,0EAC8B,CAAC;AAE1E,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAClD,eAAO,MAAM,mBAAmB,QAAkB,CAAC;AAwEnD;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMZ,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC"}

package/dist/index.js

@@ -54,15 +54,28 @@ var Attributes = {
 };
 var Cookies = {
   Session: "__session",
-  CsrfToken: "__session_terncf",
+  CsrfToken: "__terncf",
   IdToken: "TernSecure_[DEFAULT]",
   Refresh: "TernSecureID_[DEFAULT]",
   Custom: "__custom",
+  TernAut: "tern_aut",
   Handshake: "__ternsecure_handshake",
   DevBrowser: "__ternsecure_db_jwt",
   RedirectCount: "__ternsecure_redirect_count",
   HandshakeNonce: "__ternsecure_handshake_nonce"
 };
+var QueryParameters = {
+  TernSynced: "__tern_synced",
+  SuffixedCookies: "suffixed_cookies",
+  TernRedirectUrl: "__tern_redirect_url",
+  // use the reference to Cookies to indicate that it's the same value
+  DevBrowser: Cookies.DevBrowser,
+  Handshake: Cookies.Handshake,
+  HandshakeHelp: "__tern_help",
+  LegacyDevBrowser: "__dev_session",
+  HandshakeReason: "__tern_hs_reason",
+  HandshakeNonce: Cookies.HandshakeNonce
+};
 var Headers2 = {
   Accept: "accept",
   AuthMessage: "x-ternsecure-auth-message",
@@ -99,7 +112,8 @@ var constants = {
   Attributes,
   Cookies,
   Headers: Headers2,
-  ContentTypes
+  ContentTypes,
+  QueryParameters
 };
 
 // src/createRedirect.ts
@@ -233,16 +247,20 @@ function mapJwtPayloadToDecodedIdToken(payload) {
 // src/tokens/authstate.ts
 var AuthStatus = {
   SignedIn: "signed-in",
-  SignedOut: "signed-out"
+  SignedOut: "signed-out",
+  Handshake: "handshake"
 };
 var AuthErrorReason = {
-  SessionTokenAndUATMissing: "session-token-and-uat-missing",
+  AuthTimeout: "auth-timeout",
+  SessionTokenAndAuthMissing: "session-token-and-aut-missing",
   SessionTokenMissing: "session-token-missing",
   SessionTokenExpired: "session-token-expired",
-  SessionTokenIATBeforeClientUAT: "session-token-iat-before-client-uat",
+  SessionTokenIATBeforeTernAUT: "session-token-iat-before-tern-aut",
   SessionTokenNBF: "session-token-nbf",
   SessionTokenIatInTheFuture: "session-token-iat-in-the-future",
-  ActiveOrganizationMismatch: "active-organization-mismatch",
+  SessionTokenWithoutTernAUT: "session-token-but-no-tern-uat",
+  TernAutWithoutSessionToken: "tern-aut-but-no-session-token",
+  SyncRequired: "sync-required",
   UnexpectedError: "unexpected-error"
 };
 function createHasAuthorization(decodedIdToken) {
@@ -294,6 +312,7 @@ function signedIn(authCtx, sessionClaims, headers = new Headers(), token) {
   const authObject = signedInAuthObject(token, sessionClaims);
   return {
     status: AuthStatus.SignedIn,
+    message: null,
     reason: null,
     signInUrl: authCtx.signInUrl || "",
     signUpUrl: authCtx.signUpUrl || "",
@@ -318,6 +337,12 @@ function signedOut(authCtx, reason, message = "", headers = new Headers()) {
 }
 var decorateHeaders = (requestState) => {
   const headers = new Headers(requestState.headers || {});
+  if (requestState.message) {
+    try {
+      headers.set(constants.Headers.AuthMessage, requestState.message);
+    } catch {
+    }
+  }
   if (requestState.reason) {
     try {
       headers.set(constants.Headers.AuthReason, requestState.reason);
@@ -705,6 +730,9 @@ function mergePreDefinedOptions(userOptions = {}) {
   };
 }
 
+// src/tokens/request.ts
+var import_ms = require("@tern-secure/shared/ms");
+
 // src/jwt/customJwt.ts
 var import_jose = require("jose");
 var CustomTokenError = class extends Error {
@@ -1041,44 +1069,33 @@ async function verifySignature(jwt, key) {
   }
 }
 function ternDecodeJwt(token) {
-  try {
-    const header = (0, import_jose3.decodeProtectedHeader)(token);
-    const payload = (0, import_jose3.decodeJwt)(token);
-    const tokenParts = (token || "").toString().split(".");
-    if (tokenParts.length !== 3) {
-      return {
-        errors: [
-          new TokenVerificationError({
-            reason: TokenVerificationErrorReason.TokenInvalid,
-            message: "Invalid JWT format"
-          })
-        ]
-      };
-    }
-    const [rawHeader, rawPayload, rawSignature] = tokenParts;
-    const signature = base64url.parse(rawSignature, { loose: true });
-    const data = {
-      header,
-      payload,
-      signature,
-      raw: {
-        header: rawHeader,
-        payload: rawPayload,
-        signature: rawSignature,
-        text: token
-      }
-    };
-    return { data };
-  } catch (error) {
+  const header = (0, import_jose3.decodeProtectedHeader)(token);
+  const payload = (0, import_jose3.decodeJwt)(token);
+  const tokenParts = (token || "").toString().split(".");
+  if (tokenParts.length !== 3) {
     return {
       errors: [
         new TokenVerificationError({
           reason: TokenVerificationErrorReason.TokenInvalid,
-          message: error.message
+          message: "Invalid JWT format"
         })
       ]
     };
   }
+  const [rawHeader, rawPayload, rawSignature] = tokenParts;
+  const signature = base64url.parse(rawSignature, { loose: true });
+  const data = {
+    header,
+    payload,
+    signature,
+    raw: {
+      header: rawHeader,
+      payload: rawPayload,
+      signature: rawSignature,
+      text: token
+    }
+  };
+  return { data };
 }
 async function verifyJwt(token, options) {
   const { key } = options;
@@ -1326,9 +1343,14 @@ function getAuth(options) {
     const idAndRefreshTokens = await customForIdAndRefreshToken(customToken, {
       referer: opts.referer
     });
+    const decodedCustomIdToken = await verifyToken(idAndRefreshTokens.idToken, options);
+    if (decodedCustomIdToken.errors) {
+      throw decodedCustomIdToken.errors[0];
+    }
     return {
       ...idAndRefreshTokens,
-      customToken
+      customToken,
+      auth_time: decodedCustomIdToken.data.auth_time
     };
   }
   return {
@@ -1346,6 +1368,7 @@ var RequestProcessorContext = class {
     this.options = options;
     this.initHeaderValues();
     this.initCookieValues();
+    this.initHandshakeValues();
     this.initUrlValues();
     Object.assign(this, options);
     this.ternUrl = this.ternSecureRequest.ternUrl;
@@ -1374,6 +1397,11 @@ var RequestProcessorContext = class {
     this.refreshTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.Refresh}`);
     this.csrfTokenInCookie = this.getCookie(constants.Cookies.CsrfToken);
     this.customTokenInCookie = this.getCookie(constants.Cookies.Custom);
+    this.ternAuth = Number.parseInt(this.getCookie(constants.Cookies.TernAut) || "0", 10);
+  }
+  initHandshakeValues() {
+    this.handshakeToken = this.getQueryParam(constants.QueryParameters.Handshake) || this.getCookie(constants.Cookies.Handshake);
+    this.handshakeNonce = this.getQueryParam(constants.QueryParameters.HandshakeNonce) || this.getCookie(constants.Cookies.HandshakeNonce);
   }
   initUrlValues() {
     this.method = this.ternSecureRequest.method;
@@ -1381,6 +1409,9 @@ var RequestProcessorContext = class {
     this.endpoint = this.pathSegments[2];
     this.subEndpoint = this.pathSegments[3];
   }
+  getQueryParam(name) {
+    return this.ternSecureRequest.ternUrl.searchParams.get(name);
+  }
   getHeader(name) {
     return this.ternSecureRequest.headers.get(name) || void 0;
   }
@@ -1412,6 +1443,9 @@ var import_cookie2 = require("@tern-secure/shared/cookie");
 function hasAuthorizationHeader(request) {
   return request.headers.has("Authorization");
 }
+function convertToSeconds(value) {
+  return (0, import_ms.ms)(value) / 1e3;
+}
 function isRequestForRefresh(error, context, request) {
   return error.reason === TokenVerificationErrorReason.TokenExpired && !!context.refreshTokenInCookie && request.method === "GET";
 }
@@ -1419,6 +1453,17 @@ async function authenticateRequest(request, options) {
   const context = createRequestProcessor(createTernSecureRequest(request), options);
   const { refreshTokenInCookie } = context;
   const { refreshExpiredIdToken } = getAuth(options);
+  function checkSessionTimeout(authTimeValue) {
+    const defaultMaxAgeSeconds = convertToSeconds("5 days");
+    const REAUTH_PERIOD_SECONDS = context.session?.maxAge ? convertToSeconds(context.session.maxAge) : defaultMaxAgeSeconds;
+    const currentTime = Math.floor(Date.now() / 1e3);
+    const authAge = currentTime - authTimeValue;
+    console.log("Current time:", currentTime, "Auth age:", authAge, "Reauth period (s):", REAUTH_PERIOD_SECONDS);
+    if (authTimeValue > 0 && authAge > REAUTH_PERIOD_SECONDS) {
+      return signedOut(context, AuthErrorReason.AuthTimeout, "Authentication expired");
+    }
+    return null;
+  }
   async function refreshToken() {
     if (!refreshTokenInCookie) {
       return {
@@ -1440,10 +1485,10 @@ async function authenticateRequest(request, options) {
     }
     const headers = new Headers();
     const { idToken } = refreshedData;
-    const maxAge = 3600;
+    const maxAge = 365 * 24 * 60 * 60;
     const cookiePrefix = (0, import_cookie2.getCookiePrefix)();
     const idTokenCookieName = (0, import_cookie2.getCookieName)(constants.Cookies.IdToken, cookiePrefix);
-    const baseCookieAttributes = "HttpOnly; Secure; SameSite=Strict; Path=/";
+    const baseCookieAttributes = `HttpOnly; Secure; SameSite=Strict; Max-Age=${maxAge}; Path=/`;
     const idTokenCookie = `${idTokenCookieName}=${idToken}; ${baseCookieAttributes};`;
     headers.append("Set-Cookie", idTokenCookie);
     const { data: decoded, errors } = await verifyToken(idToken, options);
@@ -1455,7 +1500,78 @@ async function authenticateRequest(request, options) {
     }
     return { data: { decoded, token: idToken, headers }, error: null };
   }
+  async function handleLocalHandshakeWithErrorCheck(context2, reason, message, skipSessionCheck = false) {
+    const hasRefreshTokenInCookie = !!context2.refreshTokenInCookie;
+    if (!hasRefreshTokenInCookie) {
+      return signedOut(context2, reason, "Refresh token missing in cookie");
+    }
+    if (reason === AuthErrorReason.TernAutWithoutSessionToken) {
+      if (!skipSessionCheck) {
+        const sessionTimeoutResult = checkSessionTimeout(context2.ternAuth);
+        if (sessionTimeoutResult) {
+          return sessionTimeoutResult;
+        }
+      }
+      const { data, error } = await handleRefresh();
+      if (data) {
+        return signedIn(context2, data.decoded, data.headers, data.token);
+      }
+      return signedOut(context2, reason, "Failed to refresh idToken");
+    }
+    if (reason === AuthErrorReason.SessionTokenWithoutTernAUT || reason === AuthErrorReason.SessionTokenIATBeforeTernAUT) {
+      const { data, errors } = ternDecodeJwt(context2.idTokenInCookie);
+      if (errors) {
+        throw errors[0];
+      }
+      const authTime = data.payload.auth_time;
+      if (!authTime || typeof authTime !== "number") {
+        return signedOut(context2, reason, "Token missing auth_time");
+      }
+      if (!skipSessionCheck) {
+        const sessionTimeoutResult = checkSessionTimeout(authTime);
+        if (sessionTimeoutResult) {
+          return sessionTimeoutResult;
+        }
+      }
+      const { data: verifiedToken, errors: verifyErrors } = await verifyToken(context2.idTokenInCookie, options);
+      if (verifyErrors) {
+        throw verifyErrors[0];
+      }
+      const headers = new Headers();
+      const oneYearInSeconds = 365 * 24 * 60 * 60;
+      const ternAutCookie = `${constants.Cookies.TernAut}=${authTime}; Max-Age=${oneYearInSeconds}; Secure; SameSite=Strict; Path=/`;
+      headers.append("Set-Cookie", ternAutCookie);
+      return signedIn(context2, verifiedToken, headers, context2.idTokenInCookie);
+    }
+    return signedOut(context2, reason, message);
+  }
   async function authenticateRequestWithTokenInCookie() {
+    const hasTernAuth = context.ternAuth;
+    const hasIdTokenInCookie = !!context.idTokenInCookie;
+    if (!hasTernAuth && !hasIdTokenInCookie) {
+      return signedOut(context, AuthErrorReason.SessionTokenAndAuthMissing);
+    }
+    if (!hasTernAuth && hasIdTokenInCookie) {
+      return await handleLocalHandshakeWithErrorCheck(context, AuthErrorReason.SessionTokenWithoutTernAUT, "");
+    }
+    if (hasTernAuth && !hasIdTokenInCookie) {
+      return await handleLocalHandshakeWithErrorCheck(context, AuthErrorReason.TernAutWithoutSessionToken, "");
+    }
+    const sessionTimeoutResult = checkSessionTimeout(context.ternAuth);
+    if (sessionTimeoutResult) {
+      return sessionTimeoutResult;
+    }
+    const { data: decodedResult, errors: decodeErrors } = ternDecodeJwt(context.idTokenInCookie);
+    if (decodeErrors) {
+      return handleError(decodeErrors[0], "cookie");
+    }
+    const tokenIat = decodedResult.payload.iat;
+    if (!tokenIat) {
+      return signedOut(context, AuthErrorReason.SessionTokenMissing, "");
+    }
+    if (tokenIat < context.ternAuth) {
+      return await handleLocalHandshakeWithErrorCheck(context, AuthErrorReason.SessionTokenIATBeforeTernAUT, "", true);
+    }
     try {
       const { data, errors } = await verifyToken(context.idTokenInCookie, options);
       if (errors) {
@@ -1466,6 +1582,7 @@ async function authenticateRequest(request, options) {
     } catch (err) {
       return handleError(err, "cookie");
     }
+    return signedOut(context, AuthErrorReason.UnexpectedError);
   }
   async function authenticateRequestWithTokenInHeader() {
     const { sessionTokenInHeader } = context;