@tern-secure/backend 1.2.0-canary.v20251030165007 → 1.2.0-canary.v20251125170702

package/dist/index.js

@@ -54,15 +54,28 @@ var Attributes = {
 };
 var Cookies = {
   Session: "__session",
-  CsrfToken: "__session_terncf",
+  CsrfToken: "__terncf",
   IdToken: "TernSecure_[DEFAULT]",
   Refresh: "TernSecureID_[DEFAULT]",
   Custom: "__custom",
+  TernAut: "tern_aut",
   Handshake: "__ternsecure_handshake",
   DevBrowser: "__ternsecure_db_jwt",
   RedirectCount: "__ternsecure_redirect_count",
   HandshakeNonce: "__ternsecure_handshake_nonce"
 };
+var QueryParameters = {
+  TernSynced: "__tern_synced",
+  SuffixedCookies: "suffixed_cookies",
+  TernRedirectUrl: "__tern_redirect_url",
+  // use the reference to Cookies to indicate that it's the same value
+  DevBrowser: Cookies.DevBrowser,
+  Handshake: Cookies.Handshake,
+  HandshakeHelp: "__tern_help",
+  LegacyDevBrowser: "__dev_session",
+  HandshakeReason: "__tern_hs_reason",
+  HandshakeNonce: Cookies.HandshakeNonce
+};
 var Headers2 = {
   Accept: "accept",
   AuthMessage: "x-ternsecure-auth-message",
@@ -99,7 +112,8 @@ var constants = {
   Attributes,
   Cookies,
   Headers: Headers2,
-  ContentTypes
+  ContentTypes,
+  QueryParameters
 };
 
 // src/createRedirect.ts
@@ -233,16 +247,20 @@ function mapJwtPayloadToDecodedIdToken(payload) {
 // src/tokens/authstate.ts
 var AuthStatus = {
   SignedIn: "signed-in",
-  SignedOut: "signed-out"
+  SignedOut: "signed-out",
+  Handshake: "handshake"
 };
 var AuthErrorReason = {
-  SessionTokenAndUATMissing: "session-token-and-uat-missing",
+  AuthTimeout: "auth-timeout",
+  SessionTokenAndAuthMissing: "session-token-and-aut-missing",
   SessionTokenMissing: "session-token-missing",
   SessionTokenExpired: "session-token-expired",
-  SessionTokenIATBeforeClientUAT: "session-token-iat-before-client-uat",
+  SessionTokenIATBeforeTernAUT: "session-token-iat-before-tern-aut",
   SessionTokenNBF: "session-token-nbf",
   SessionTokenIatInTheFuture: "session-token-iat-in-the-future",
-  ActiveOrganizationMismatch: "active-organization-mismatch",
+  SessionTokenWithoutTernAUT: "session-token-but-no-tern-uat",
+  TernAutWithoutSessionToken: "tern-aut-but-no-session-token",
+  SyncRequired: "sync-required",
   UnexpectedError: "unexpected-error"
 };
 function createHasAuthorization(decodedIdToken) {
@@ -294,6 +312,7 @@ function signedIn(authCtx, sessionClaims, headers = new Headers(), token) {
   const authObject = signedInAuthObject(token, sessionClaims);
   return {
     status: AuthStatus.SignedIn,
+    message: null,
     reason: null,
     signInUrl: authCtx.signInUrl || "",
     signUpUrl: authCtx.signUpUrl || "",
@@ -318,6 +337,12 @@ function signedOut(authCtx, reason, message = "", headers = new Headers()) {
 }
 var decorateHeaders = (requestState) => {
   const headers = new Headers(requestState.headers || {});
+  if (requestState.message) {
+    try {
+      headers.set(constants.Headers.AuthMessage, requestState.message);
+    } catch {
+    }
+  }
   if (requestState.reason) {
     try {
       headers.set(constants.Headers.AuthReason, requestState.reason);
@@ -399,6 +424,30 @@ var PasswordApi = class extends AbstractAPI {
   }
 };
 
+// src/fireRestApi/endpoints/SignInApi.ts
+var SignInApi = class extends AbstractAPI {
+  async resetPasswordEmail(apiKey, params) {
+    try {
+      this.requireApiKey(apiKey);
+      const { ...restParams } = params;
+      const response = await this.request({
+        endpoint: "sendOobCode",
+        method: "POST",
+        apiKey,
+        bodyParams: restParams
+      });
+      if (response.errors) {
+        const errorMessage = response.errors[0]?.message || "Failed to send reset password email";
+        throw new Error(errorMessage);
+      }
+      return response.data;
+    } catch (error) {
+      const contextualMessage = `Failed to send reset password email: ${error instanceof Error ? error.message : "Unknown error"}`;
+      throw new Error(contextualMessage);
+    }
+  }
+};
+
 // src/fireRestApi/endpoints/SignInTokenApi.ts
 var SignInTokenApi = class extends AbstractAPI {
   async createCustomToken(apiKey, params) {
@@ -531,6 +580,9 @@ var signInWithPassword = (apiKey) => {
 var signUpEndpoint = (apiKey) => {
   return `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${apiKey}`;
 };
+var sendOobCode = (apiKey) => {
+  return `https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode?key=${apiKey}`;
+};
 var getCustomTokenEndpoint = (apiKey) => {
   if (useEmulator() && FIREBASE_AUTH_EMULATOR_HOST) {
     let protocol = "http://";
@@ -541,9 +593,6 @@ var getCustomTokenEndpoint = (apiKey) => {
   }
   return `https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${apiKey}`;
 };
-var passwordResetEndpoint = (apiKey) => {
-  return `https://identitytoolkit.googleapis.com/v1/accounts:resetPassword?key=${apiKey}`;
-};
 
 // src/fireRestApi/request.ts
 var FIREBASE_ENDPOINT_MAP = {
@@ -551,8 +600,8 @@ var FIREBASE_ENDPOINT_MAP = {
   signInWithPassword,
   signUp: signUpEndpoint,
   signInWithCustomToken: getCustomTokenEndpoint,
-  passwordReset: passwordResetEndpoint,
-  sendOobCode: signInWithPassword,
+  passwordReset: sendOobCode,
+  sendOobCode,
   lookup: lookupEndpoint
 };
 function createRequest(options) {
@@ -685,7 +734,8 @@ function createFireApi(options) {
   return {
     email: new EmailApi(request),
     password: new PasswordApi(request),
-    signIn: new SignInTokenApi(request),
+    signIn: new SignInApi(request),
+    signInToken: new SignInTokenApi(request),
     signUp: new SignUpApi(request),
     tokens: new TokenApi(request),
     userData: new UserData(request)
@@ -705,6 +755,9 @@ function mergePreDefinedOptions(userOptions = {}) {
   };
 }
 
+// src/tokens/request.ts
+var import_ms = require("@tern-secure/shared/ms");
+
 // src/jwt/customJwt.ts
 var import_jose = require("jose");
 var CustomTokenError = class extends Error {
@@ -1041,44 +1094,33 @@ async function verifySignature(jwt, key) {
   }
 }
 function ternDecodeJwt(token) {
-  try {
-    const header = (0, import_jose3.decodeProtectedHeader)(token);
-    const payload = (0, import_jose3.decodeJwt)(token);
-    const tokenParts = (token || "").toString().split(".");
-    if (tokenParts.length !== 3) {
-      return {
-        errors: [
-          new TokenVerificationError({
-            reason: TokenVerificationErrorReason.TokenInvalid,
-            message: "Invalid JWT format"
-          })
-        ]
-      };
-    }
-    const [rawHeader, rawPayload, rawSignature] = tokenParts;
-    const signature = base64url.parse(rawSignature, { loose: true });
-    const data = {
-      header,
-      payload,
-      signature,
-      raw: {
-        header: rawHeader,
-        payload: rawPayload,
-        signature: rawSignature,
-        text: token
-      }
-    };
-    return { data };
-  } catch (error) {
+  const header = (0, import_jose3.decodeProtectedHeader)(token);
+  const payload = (0, import_jose3.decodeJwt)(token);
+  const tokenParts = (token || "").toString().split(".");
+  if (tokenParts.length !== 3) {
     return {
       errors: [
         new TokenVerificationError({
           reason: TokenVerificationErrorReason.TokenInvalid,
-          message: error.message
+          message: "Invalid JWT format"
         })
       ]
     };
   }
+  const [rawHeader, rawPayload, rawSignature] = tokenParts;
+  const signature = base64url.parse(rawSignature, { loose: true });
+  const data = {
+    header,
+    payload,
+    signature,
+    raw: {
+      header: rawHeader,
+      payload: rawPayload,
+      signature: rawSignature,
+      text: token
+    }
+  };
+  return { data };
 }
 async function verifyJwt(token, options) {
   const { key } = options;
@@ -1326,9 +1368,14 @@ function getAuth(options) {
     const idAndRefreshTokens = await customForIdAndRefreshToken(customToken, {
       referer: opts.referer
     });
+    const decodedCustomIdToken = await verifyToken(idAndRefreshTokens.idToken, options);
+    if (decodedCustomIdToken.errors) {
+      throw decodedCustomIdToken.errors[0];
+    }
     return {
       ...idAndRefreshTokens,
-      customToken
+      customToken,
+      auth_time: decodedCustomIdToken.data.auth_time
     };
   }
   return {
@@ -1346,6 +1393,7 @@ var RequestProcessorContext = class {
     this.options = options;
     this.initHeaderValues();
     this.initCookieValues();
+    this.initHandshakeValues();
     this.initUrlValues();
     Object.assign(this, options);
     this.ternUrl = this.ternSecureRequest.ternUrl;
@@ -1374,6 +1422,11 @@ var RequestProcessorContext = class {
     this.refreshTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.Refresh}`);
     this.csrfTokenInCookie = this.getCookie(constants.Cookies.CsrfToken);
     this.customTokenInCookie = this.getCookie(constants.Cookies.Custom);
+    this.ternAuth = Number.parseInt(this.getCookie(constants.Cookies.TernAut) || "0", 10);
+  }
+  initHandshakeValues() {
+    this.handshakeToken = this.getQueryParam(constants.QueryParameters.Handshake) || this.getCookie(constants.Cookies.Handshake);
+    this.handshakeNonce = this.getQueryParam(constants.QueryParameters.HandshakeNonce) || this.getCookie(constants.Cookies.HandshakeNonce);
   }
   initUrlValues() {
     this.method = this.ternSecureRequest.method;
@@ -1381,6 +1434,9 @@ var RequestProcessorContext = class {
     this.endpoint = this.pathSegments[2];
     this.subEndpoint = this.pathSegments[3];
   }
+  getQueryParam(name) {
+    return this.ternSecureRequest.ternUrl.searchParams.get(name);
+  }
   getHeader(name) {
     return this.ternSecureRequest.headers.get(name) || void 0;
   }
@@ -1412,6 +1468,9 @@ var import_cookie2 = require("@tern-secure/shared/cookie");
 function hasAuthorizationHeader(request) {
   return request.headers.has("Authorization");
 }
+function convertToSeconds(value) {
+  return (0, import_ms.ms)(value) / 1e3;
+}
 function isRequestForRefresh(error, context, request) {
   return error.reason === TokenVerificationErrorReason.TokenExpired && !!context.refreshTokenInCookie && request.method === "GET";
 }
@@ -1419,6 +1478,16 @@ async function authenticateRequest(request, options) {
   const context = createRequestProcessor(createTernSecureRequest(request), options);
   const { refreshTokenInCookie } = context;
   const { refreshExpiredIdToken } = getAuth(options);
+  function checkSessionTimeout(authTimeValue) {
+    const defaultMaxAgeSeconds = convertToSeconds("5 days");
+    const REAUTH_PERIOD_SECONDS = context.session?.maxAge ? convertToSeconds(context.session.maxAge) : defaultMaxAgeSeconds;
+    const currentTime = Math.floor(Date.now() / 1e3);
+    const authAge = currentTime - authTimeValue;
+    if (authTimeValue > 0 && authAge > REAUTH_PERIOD_SECONDS) {
+      return signedOut(context, AuthErrorReason.AuthTimeout, "Authentication expired");
+    }
+    return null;
+  }
   async function refreshToken() {
     if (!refreshTokenInCookie) {
       return {
@@ -1440,10 +1509,10 @@ async function authenticateRequest(request, options) {
     }
     const headers = new Headers();
     const { idToken } = refreshedData;
-    const maxAge = 3600;
+    const maxAge = 365 * 24 * 60 * 60;
     const cookiePrefix = (0, import_cookie2.getCookiePrefix)();
     const idTokenCookieName = (0, import_cookie2.getCookieName)(constants.Cookies.IdToken, cookiePrefix);
-    const baseCookieAttributes = "HttpOnly; Secure; SameSite=Strict; Path=/";
+    const baseCookieAttributes = `HttpOnly; Secure; SameSite=Strict; Max-Age=${maxAge}; Path=/`;
     const idTokenCookie = `${idTokenCookieName}=${idToken}; ${baseCookieAttributes};`;
     headers.append("Set-Cookie", idTokenCookie);
     const { data: decoded, errors } = await verifyToken(idToken, options);
@@ -1455,7 +1524,78 @@ async function authenticateRequest(request, options) {
     }
     return { data: { decoded, token: idToken, headers }, error: null };
   }
+  async function handleLocalHandshakeWithErrorCheck(context2, reason, message, skipSessionCheck = false) {
+    const hasRefreshTokenInCookie = !!context2.refreshTokenInCookie;
+    if (!hasRefreshTokenInCookie) {
+      return signedOut(context2, reason, "Refresh token missing in cookie");
+    }
+    if (reason === AuthErrorReason.TernAutWithoutSessionToken) {
+      if (!skipSessionCheck) {
+        const sessionTimeoutResult = checkSessionTimeout(context2.ternAuth);
+        if (sessionTimeoutResult) {
+          return sessionTimeoutResult;
+        }
+      }
+      const { data, error } = await handleRefresh();
+      if (data) {
+        return signedIn(context2, data.decoded, data.headers, data.token);
+      }
+      return signedOut(context2, reason, "Failed to refresh idToken");
+    }
+    if (reason === AuthErrorReason.SessionTokenWithoutTernAUT || reason === AuthErrorReason.SessionTokenIATBeforeTernAUT) {
+      const { data, errors } = ternDecodeJwt(context2.idTokenInCookie);
+      if (errors) {
+        throw errors[0];
+      }
+      const authTime = data.payload.auth_time;
+      if (!authTime || typeof authTime !== "number") {
+        return signedOut(context2, reason, "Token missing auth_time");
+      }
+      if (!skipSessionCheck) {
+        const sessionTimeoutResult = checkSessionTimeout(authTime);
+        if (sessionTimeoutResult) {
+          return sessionTimeoutResult;
+        }
+      }
+      const { data: verifiedToken, errors: verifyErrors } = await verifyToken(context2.idTokenInCookie, options);
+      if (verifyErrors) {
+        throw verifyErrors[0];
+      }
+      const headers = new Headers();
+      const oneYearInSeconds = 365 * 24 * 60 * 60;
+      const ternAutCookie = `${constants.Cookies.TernAut}=${authTime}; Max-Age=${oneYearInSeconds}; Secure; SameSite=Strict; Path=/`;
+      headers.append("Set-Cookie", ternAutCookie);
+      return signedIn(context2, verifiedToken, headers, context2.idTokenInCookie);
+    }
+    return signedOut(context2, reason, message);
+  }
   async function authenticateRequestWithTokenInCookie() {
+    const hasTernAuth = context.ternAuth;
+    const hasIdTokenInCookie = !!context.idTokenInCookie;
+    if (!hasTernAuth && !hasIdTokenInCookie) {
+      return signedOut(context, AuthErrorReason.SessionTokenAndAuthMissing);
+    }
+    if (!hasTernAuth && hasIdTokenInCookie) {
+      return await handleLocalHandshakeWithErrorCheck(context, AuthErrorReason.SessionTokenWithoutTernAUT, "");
+    }
+    if (hasTernAuth && !hasIdTokenInCookie) {
+      return await handleLocalHandshakeWithErrorCheck(context, AuthErrorReason.TernAutWithoutSessionToken, "");
+    }
+    const sessionTimeoutResult = checkSessionTimeout(context.ternAuth);
+    if (sessionTimeoutResult) {
+      return sessionTimeoutResult;
+    }
+    const { data: decodedResult, errors: decodeErrors } = ternDecodeJwt(context.idTokenInCookie);
+    if (decodeErrors) {
+      return handleError(decodeErrors[0], "cookie");
+    }
+    const tokenIat = decodedResult.payload.iat;
+    if (!tokenIat) {
+      return signedOut(context, AuthErrorReason.SessionTokenMissing, "");
+    }
+    if (tokenIat < context.ternAuth) {
+      return await handleLocalHandshakeWithErrorCheck(context, AuthErrorReason.SessionTokenIATBeforeTernAUT, "", true);
+    }
     try {
       const { data, errors } = await verifyToken(context.idTokenInCookie, options);
       if (errors) {
@@ -1466,6 +1606,7 @@ async function authenticateRequest(request, options) {
     } catch (err) {
       return handleError(err, "cookie");
     }
+    return signedOut(context, AuthErrorReason.UnexpectedError);
   }
   async function authenticateRequestWithTokenInHeader() {
     const { sessionTokenInHeader } = context;