@tern-secure/backend 1.2.0-canary.v20251030165007 → 1.2.0-canary.v20251125170702

package/dist/index.mjs

@@ -1,19 +1,20 @@
 import {
   createTernSecureRequest
-} from "./chunk-IBABNFOK.mjs";
+} from "./chunk-ASGV4MFO.mjs";
 import {
   getAuth,
   verifyToken
-} from "./chunk-A5G3CWO5.mjs";
+} from "./chunk-MS6L7M3C.mjs";
 import {
   constants
-} from "./chunk-VY5FVZL2.mjs";
+} from "./chunk-DFAJCSBJ.mjs";
 import {
   RefreshTokenErrorReason,
   TokenVerificationError,
   TokenVerificationErrorReason,
-  mapJwtPayloadToDecodedIdToken
-} from "./chunk-5AP2WM3W.mjs";
+  mapJwtPayloadToDecodedIdToken,
+  ternDecodeJwt
+} from "./chunk-DDUNOEIM.mjs";
 
 // src/createRedirect.ts
 var buildUrl = (_baseUrl, _targetUrl, _returnBackUrl) => {
@@ -76,16 +77,20 @@ var createRedirect = (params) => {
 // src/tokens/authstate.ts
 var AuthStatus = {
   SignedIn: "signed-in",
-  SignedOut: "signed-out"
+  SignedOut: "signed-out",
+  Handshake: "handshake"
 };
 var AuthErrorReason = {
-  SessionTokenAndUATMissing: "session-token-and-uat-missing",
+  AuthTimeout: "auth-timeout",
+  SessionTokenAndAuthMissing: "session-token-and-aut-missing",
   SessionTokenMissing: "session-token-missing",
   SessionTokenExpired: "session-token-expired",
-  SessionTokenIATBeforeClientUAT: "session-token-iat-before-client-uat",
+  SessionTokenIATBeforeTernAUT: "session-token-iat-before-tern-aut",
   SessionTokenNBF: "session-token-nbf",
   SessionTokenIatInTheFuture: "session-token-iat-in-the-future",
-  ActiveOrganizationMismatch: "active-organization-mismatch",
+  SessionTokenWithoutTernAUT: "session-token-but-no-tern-uat",
+  TernAutWithoutSessionToken: "tern-aut-but-no-session-token",
+  SyncRequired: "sync-required",
   UnexpectedError: "unexpected-error"
 };
 function createHasAuthorization(decodedIdToken) {
@@ -137,6 +142,7 @@ function signedIn(authCtx, sessionClaims, headers = new Headers(), token) {
   const authObject = signedInAuthObject(token, sessionClaims);
   return {
     status: AuthStatus.SignedIn,
+    message: null,
     reason: null,
     signInUrl: authCtx.signInUrl || "",
     signUpUrl: authCtx.signUpUrl || "",
@@ -161,6 +167,12 @@ function signedOut(authCtx, reason, message = "", headers = new Headers()) {
 }
 var decorateHeaders = (requestState) => {
   const headers = new Headers(requestState.headers || {});
+  if (requestState.message) {
+    try {
+      headers.set(constants.Headers.AuthMessage, requestState.message);
+    } catch {
+    }
+  }
   if (requestState.reason) {
     try {
       headers.set(constants.Headers.AuthReason, requestState.reason);
@@ -242,6 +254,30 @@ var PasswordApi = class extends AbstractAPI {
   }
 };
 
+// src/fireRestApi/endpoints/SignInApi.ts
+var SignInApi = class extends AbstractAPI {
+  async resetPasswordEmail(apiKey, params) {
+    try {
+      this.requireApiKey(apiKey);
+      const { ...restParams } = params;
+      const response = await this.request({
+        endpoint: "sendOobCode",
+        method: "POST",
+        apiKey,
+        bodyParams: restParams
+      });
+      if (response.errors) {
+        const errorMessage = response.errors[0]?.message || "Failed to send reset password email";
+        throw new Error(errorMessage);
+      }
+      return response.data;
+    } catch (error) {
+      const contextualMessage = `Failed to send reset password email: ${error instanceof Error ? error.message : "Unknown error"}`;
+      throw new Error(contextualMessage);
+    }
+  }
+};
+
 // src/fireRestApi/endpoints/SignInTokenApi.ts
 var SignInTokenApi = class extends AbstractAPI {
   async createCustomToken(apiKey, params) {
@@ -374,6 +410,9 @@ var signInWithPassword = (apiKey) => {
 var signUpEndpoint = (apiKey) => {
   return `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${apiKey}`;
 };
+var sendOobCode = (apiKey) => {
+  return `https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode?key=${apiKey}`;
+};
 var getCustomTokenEndpoint = (apiKey) => {
   if (useEmulator() && FIREBASE_AUTH_EMULATOR_HOST) {
     let protocol = "http://";
@@ -384,9 +423,6 @@ var getCustomTokenEndpoint = (apiKey) => {
   }
   return `https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${apiKey}`;
 };
-var passwordResetEndpoint = (apiKey) => {
-  return `https://identitytoolkit.googleapis.com/v1/accounts:resetPassword?key=${apiKey}`;
-};
 
 // src/fireRestApi/request.ts
 var FIREBASE_ENDPOINT_MAP = {
@@ -394,8 +430,8 @@ var FIREBASE_ENDPOINT_MAP = {
   signInWithPassword,
   signUp: signUpEndpoint,
   signInWithCustomToken: getCustomTokenEndpoint,
-  passwordReset: passwordResetEndpoint,
-  sendOobCode: signInWithPassword,
+  passwordReset: sendOobCode,
+  sendOobCode,
   lookup: lookupEndpoint
 };
 function createRequest(options) {
@@ -528,7 +564,8 @@ function createFireApi(options) {
   return {
     email: new EmailApi(request),
     password: new PasswordApi(request),
-    signIn: new SignInTokenApi(request),
+    signIn: new SignInApi(request),
+    signInToken: new SignInTokenApi(request),
     signUp: new SignUpApi(request),
     tokens: new TokenApi(request),
     userData: new UserData(request)
@@ -548,6 +585,9 @@ function mergePreDefinedOptions(userOptions = {}) {
   };
 }
 
+// src/tokens/request.ts
+import { ms } from "@tern-secure/shared/ms";
+
 // src/tokens/c-authenticateRequestProcessor.ts
 var RequestProcessorContext = class {
   constructor(ternSecureRequest, options) {
@@ -555,6 +595,7 @@ var RequestProcessorContext = class {
     this.options = options;
     this.initHeaderValues();
     this.initCookieValues();
+    this.initHandshakeValues();
     this.initUrlValues();
     Object.assign(this, options);
     this.ternUrl = this.ternSecureRequest.ternUrl;
@@ -583,6 +624,11 @@ var RequestProcessorContext = class {
     this.refreshTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.Refresh}`);
     this.csrfTokenInCookie = this.getCookie(constants.Cookies.CsrfToken);
     this.customTokenInCookie = this.getCookie(constants.Cookies.Custom);
+    this.ternAuth = Number.parseInt(this.getCookie(constants.Cookies.TernAut) || "0", 10);
+  }
+  initHandshakeValues() {
+    this.handshakeToken = this.getQueryParam(constants.QueryParameters.Handshake) || this.getCookie(constants.Cookies.Handshake);
+    this.handshakeNonce = this.getQueryParam(constants.QueryParameters.HandshakeNonce) || this.getCookie(constants.Cookies.HandshakeNonce);
   }
   initUrlValues() {
     this.method = this.ternSecureRequest.method;
@@ -590,6 +636,9 @@ var RequestProcessorContext = class {
     this.endpoint = this.pathSegments[2];
     this.subEndpoint = this.pathSegments[3];
   }
+  getQueryParam(name) {
+    return this.ternSecureRequest.ternUrl.searchParams.get(name);
+  }
   getHeader(name) {
     return this.ternSecureRequest.headers.get(name) || void 0;
   }
@@ -621,6 +670,9 @@ import { getCookieName as getCookieNameEnvironment, getCookiePrefix } from "@ter
 function hasAuthorizationHeader(request) {
   return request.headers.has("Authorization");
 }
+function convertToSeconds(value) {
+  return ms(value) / 1e3;
+}
 function isRequestForRefresh(error, context, request) {
   return error.reason === TokenVerificationErrorReason.TokenExpired && !!context.refreshTokenInCookie && request.method === "GET";
 }
@@ -628,6 +680,16 @@ async function authenticateRequest(request, options) {
   const context = createRequestProcessor(createTernSecureRequest(request), options);
   const { refreshTokenInCookie } = context;
   const { refreshExpiredIdToken } = getAuth(options);
+  function checkSessionTimeout(authTimeValue) {
+    const defaultMaxAgeSeconds = convertToSeconds("5 days");
+    const REAUTH_PERIOD_SECONDS = context.session?.maxAge ? convertToSeconds(context.session.maxAge) : defaultMaxAgeSeconds;
+    const currentTime = Math.floor(Date.now() / 1e3);
+    const authAge = currentTime - authTimeValue;
+    if (authTimeValue > 0 && authAge > REAUTH_PERIOD_SECONDS) {
+      return signedOut(context, AuthErrorReason.AuthTimeout, "Authentication expired");
+    }
+    return null;
+  }
   async function refreshToken() {
     if (!refreshTokenInCookie) {
       return {
@@ -649,10 +711,10 @@ async function authenticateRequest(request, options) {
     }
     const headers = new Headers();
     const { idToken } = refreshedData;
-    const maxAge = 3600;
+    const maxAge = 365 * 24 * 60 * 60;
     const cookiePrefix = getCookiePrefix();
     const idTokenCookieName = getCookieNameEnvironment(constants.Cookies.IdToken, cookiePrefix);
-    const baseCookieAttributes = "HttpOnly; Secure; SameSite=Strict; Path=/";
+    const baseCookieAttributes = `HttpOnly; Secure; SameSite=Strict; Max-Age=${maxAge}; Path=/`;
     const idTokenCookie = `${idTokenCookieName}=${idToken}; ${baseCookieAttributes};`;
     headers.append("Set-Cookie", idTokenCookie);
     const { data: decoded, errors } = await verifyToken(idToken, options);
@@ -664,7 +726,78 @@ async function authenticateRequest(request, options) {
     }
     return { data: { decoded, token: idToken, headers }, error: null };
   }
+  async function handleLocalHandshakeWithErrorCheck(context2, reason, message, skipSessionCheck = false) {
+    const hasRefreshTokenInCookie = !!context2.refreshTokenInCookie;
+    if (!hasRefreshTokenInCookie) {
+      return signedOut(context2, reason, "Refresh token missing in cookie");
+    }
+    if (reason === AuthErrorReason.TernAutWithoutSessionToken) {
+      if (!skipSessionCheck) {
+        const sessionTimeoutResult = checkSessionTimeout(context2.ternAuth);
+        if (sessionTimeoutResult) {
+          return sessionTimeoutResult;
+        }
+      }
+      const { data, error } = await handleRefresh();
+      if (data) {
+        return signedIn(context2, data.decoded, data.headers, data.token);
+      }
+      return signedOut(context2, reason, "Failed to refresh idToken");
+    }
+    if (reason === AuthErrorReason.SessionTokenWithoutTernAUT || reason === AuthErrorReason.SessionTokenIATBeforeTernAUT) {
+      const { data, errors } = ternDecodeJwt(context2.idTokenInCookie);
+      if (errors) {
+        throw errors[0];
+      }
+      const authTime = data.payload.auth_time;
+      if (!authTime || typeof authTime !== "number") {
+        return signedOut(context2, reason, "Token missing auth_time");
+      }
+      if (!skipSessionCheck) {
+        const sessionTimeoutResult = checkSessionTimeout(authTime);
+        if (sessionTimeoutResult) {
+          return sessionTimeoutResult;
+        }
+      }
+      const { data: verifiedToken, errors: verifyErrors } = await verifyToken(context2.idTokenInCookie, options);
+      if (verifyErrors) {
+        throw verifyErrors[0];
+      }
+      const headers = new Headers();
+      const oneYearInSeconds = 365 * 24 * 60 * 60;
+      const ternAutCookie = `${constants.Cookies.TernAut}=${authTime}; Max-Age=${oneYearInSeconds}; Secure; SameSite=Strict; Path=/`;
+      headers.append("Set-Cookie", ternAutCookie);
+      return signedIn(context2, verifiedToken, headers, context2.idTokenInCookie);
+    }
+    return signedOut(context2, reason, message);
+  }
   async function authenticateRequestWithTokenInCookie() {
+    const hasTernAuth = context.ternAuth;
+    const hasIdTokenInCookie = !!context.idTokenInCookie;
+    if (!hasTernAuth && !hasIdTokenInCookie) {
+      return signedOut(context, AuthErrorReason.SessionTokenAndAuthMissing);
+    }
+    if (!hasTernAuth && hasIdTokenInCookie) {
+      return await handleLocalHandshakeWithErrorCheck(context, AuthErrorReason.SessionTokenWithoutTernAUT, "");
+    }
+    if (hasTernAuth && !hasIdTokenInCookie) {
+      return await handleLocalHandshakeWithErrorCheck(context, AuthErrorReason.TernAutWithoutSessionToken, "");
+    }
+    const sessionTimeoutResult = checkSessionTimeout(context.ternAuth);
+    if (sessionTimeoutResult) {
+      return sessionTimeoutResult;
+    }
+    const { data: decodedResult, errors: decodeErrors } = ternDecodeJwt(context.idTokenInCookie);
+    if (decodeErrors) {
+      return handleError(decodeErrors[0], "cookie");
+    }
+    const tokenIat = decodedResult.payload.iat;
+    if (!tokenIat) {
+      return signedOut(context, AuthErrorReason.SessionTokenMissing, "");
+    }
+    if (tokenIat < context.ternAuth) {
+      return await handleLocalHandshakeWithErrorCheck(context, AuthErrorReason.SessionTokenIATBeforeTernAUT, "", true);
+    }
     try {
       const { data, errors } = await verifyToken(context.idTokenInCookie, options);
       if (errors) {
@@ -675,6 +808,7 @@ async function authenticateRequest(request, options) {
     } catch (err) {
       return handleError(err, "cookie");
     }
+    return signedOut(context, AuthErrorReason.UnexpectedError);
   }
   async function authenticateRequestWithTokenInHeader() {
     const { sessionTokenInHeader } = context;