@terrafirmagreg-team/auth 0.0.0-stage → 1.2.0

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "@terrafirmagreg-team/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.2.0",
+  "type": "module",
+  "description": "GitHub OAuth sign-in and cookie sessions",
+  "license": "LGPL-3.0-only",
+  "exports": {
+    ".": "./src/lib/index.ts",
+    "./lib/*": [
+      "./src/lib/*.ts",
+      "./src/lib/*/index.ts"
+    ]
+  },
+  "files": [
+    "src"
+  ],
+  "dependencies": {
+    "@terrafirmagreg-team/data": "1.2.0",
+    "arctic": "^3.7.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TerraFirmaGreg-Team/Web-Foundation.git",
+    "directory": "packages/auth"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/src/lib/adapters.ts

@@ -0,0 +1,73 @@
+import {
+  githubFetch,
+  parseCookies,
+  readTokenFromCookieHeader,
+} from '@terrafirmagreg-team/data';
+
+export type Awaitable<T> = T | Promise<T>;
+
+export interface CookieRequest {
+  headers: {
+    get(key: string): string | readonly string[] | null | undefined;
+  };
+}
+
+export interface CookieSession {
+  id: string;
+}
+
+export interface SessionAdapter<R extends CookieRequest = CookieRequest> {
+  getSession(request: R): Awaitable<CookieSession | null>;
+}
+
+const headerValue = (value: string | readonly string[] | null | undefined) =>
+  Array.isArray(value) ? value[0] : (value ?? undefined);
+
+export function githubCookieAuth({
+  cookieName,
+  tokenSecret,
+}: {
+  cookieName: string;
+  tokenSecret: string;
+}): SessionAdapter {
+  const cache = new Map<string, Promise<CookieSession | null>>();
+  return {
+    getSession(request) {
+      const token = readTokenFromCookieHeader(
+        headerValue(request.headers.get('cookie')),
+        cookieName,
+        tokenSecret,
+      );
+      if (!token) return null;
+      let session = cache.get(token);
+      if (!session) {
+        session = githubFetch('/user', { token })
+          .then(async (res) =>
+            res.ok ? { id: ((await res.json()) as { login: string }).login } : null,
+          )
+          .catch(() => null);
+        cache.set(token, session);
+        session.then((s) => {
+          if (!s && cache.get(token) === session) cache.delete(token);
+        });
+      }
+      return session;
+    },
+  };
+}
+
+export function devCookieAuth({
+  cookieName,
+}: {
+  cookieName: string;
+}): SessionAdapter {
+  return {
+    getSession(request) {
+      const name = parseCookies(
+        headerValue(request.headers.get('cookie')),
+      )[cookieName]?.trim();
+      return name ? { id: name } : null;
+    },
+  };
+}
+

package/src/lib/config.ts

@@ -0,0 +1,43 @@
+import { env } from '@terrafirmagreg-team/data';
+
+export type AuthMode = 'dev' | 'github';
+export const authCookie = 'fcgd_token';
+export const devAuthCookie = 'fc_dev_user';
+
+export function authMode(): AuthMode {
+  const mode = env('COMMENTS_AUTH');
+  if (mode) return mode === 'dev' ? 'dev' : 'github';
+  return process.env.NODE_ENV === 'development' ? 'dev' : 'github';
+}
+
+export function authEnabled() {
+  if (authMode() === 'dev') return true;
+  return Boolean(env('DISCUSSIONS_SECRET') && env('APP_CLIENT_ID'));
+}
+
+export interface AuthConfig {
+  clientId: string;
+  clientSecret: string;
+  tokenSecret: string;
+  cookieName: string;
+  devCookieName: string;
+  callbackPath: string;
+  loginPath: string;
+  scope: string;
+  mode: AuthMode;
+}
+
+export function authConfig(): AuthConfig {
+  return {
+    clientId: env('APP_CLIENT_ID')!,
+    clientSecret: env('APP_SECRET')!,
+    tokenSecret: env('DISCUSSIONS_SECRET') ?? 'dev-token-secret',
+    cookieName: authCookie,
+    devCookieName: devAuthCookie,
+    callbackPath: '/api/comments/oauth/callback',
+    loginPath: '/api/comments/oauth/login',
+    scope: '',
+    mode: authMode(),
+  };
+}
+

package/src/lib/index.ts

@@ -0,0 +1,25 @@
+export {
+  authConfig,
+  authEnabled,
+  authMode,
+  authCookie,
+  devAuthCookie,
+  type AuthConfig,
+  type AuthMode,
+} from './config';
+export { createOAuthFlow, type OAuthFlow } from './oauth';
+export {
+  devCookieAuth,
+  githubCookieAuth,
+  type CookieRequest,
+  type CookieSession,
+  type SessionAdapter,
+} from './adapters';
+
+import { createOAuthFlow } from './oauth';
+import { authConfig } from './config';
+
+const flow = createOAuthFlow(authConfig);
+
+export const { login, callback, logout, devLogin } = flow;
+

package/src/lib/oauth.ts

@@ -0,0 +1,175 @@
+import { decrypt, encrypt } from '@terrafirmagreg-team/data';
+import { GitHub } from 'arctic';
+import type { AuthConfig } from './config';
+
+const STATE_TTL = 10 * 60 * 1000;
+const COOKIE_MAX_AGE = 60 * 60 * 24 * 365;
+const COOKIE_BASE = 'Path=/; Max-Age=%d; SameSite=Lax; HttpOnly; Secure';
+const DEV_NAME_MAX = 40;
+
+export interface OAuthFlow {
+  login(request: Request): Response;
+  devLogin(request: Request): Promise<Response>;
+  callback(request: Request): Promise<Response>;
+  logout(request: Request): Response;
+}
+
+function sameOrigin(candidate: string | null, self: string): string {
+  if (!candidate) return `${self}/`;
+  try {
+    const parsed = new URL(candidate, self);
+    return parsed.origin === self ? parsed.href : `${self}/`;
+  } catch {
+    return `${self}/`;
+  }
+}
+
+function setCookieHeader(name: string, value: string, maxAge: number) {
+  return `${name}=${encodeURIComponent(value)}; ${COOKIE_BASE.replace('%d', String(maxAge))}`;
+}
+
+function encodeState(returnUrl: string, secret: string) {
+  return encrypt(
+    JSON.stringify({ r: returnUrl, e: Date.now() + STATE_TTL }),
+    secret,
+  );
+}
+
+function decodeState(state: string, secret: string): string {
+  const payload = JSON.parse(decrypt(state, secret)) as { r?: unknown; e?: unknown };
+  if (typeof payload.e !== 'number' || Date.now() > payload.e)
+    throw new Error('expired');
+  if (typeof payload.r !== 'string') throw new Error('invalid');
+  return payload.r;
+}
+
+function devName(value: unknown): string | null {
+  if (typeof value !== 'string') return null;
+  const name = value
+    .replace(/[^\p{L}\p{N} _.\-]/gu, '')
+    .trim()
+    .slice(0, DEV_NAME_MAX);
+  return name || null;
+}
+
+function devLoginForm(request: Request, config: AuthConfig): Response {
+  const self = new URL(request.url).origin;
+  const returnUrl = sameOrigin(new URL(request.url).searchParams.get('return'), self);
+  const html = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign in</title><style>
+:root{color-scheme:light dark;font-family:ui-sans-serif,system-ui,sans-serif}
+body{margin:0;min-height:100vh;display:grid;place-items:center;background:light-dark(#fafafa,#0a0a0a);color:light-dark(#171717,#ededed)}
+form{display:flex;flex-direction:column;gap:12px;min-width:280px;padding:28px;border:1px solid light-dark(#e5e5e5,#262626);border-radius:16px;background:light-dark(#fff,#141414);box-shadow:0 1px 2px rgb(0 0 0/.05)}
+h1{font-size:20px;font-weight:600;margin:0 0 4px}
+input,button{font:inherit;padding:8px 12px;border-radius:8px;border:1px solid light-dark(#e5e5e5,#262626);background:transparent;color:inherit}
+input:focus-visible{outline:2px solid light-dark(#171717,#ededed);outline-offset:2px}
+button{background:light-dark(#171717,#ededed);color:light-dark(#fafafa,#0a0a0a);border:0;font-weight:500;cursor:pointer}
+button:hover{opacity:.85}
+</style></head><body>
+<form method="post" action="${config.loginPath}">
+<h1>Sign in to comment</h1>
+<input name="name" required maxlength="${DEV_NAME_MAX}" placeholder="Display name" autocomplete="username" />
+<input type="hidden" name="return" value="${returnUrl.replaceAll('"', '&quot;')}" />
+<button type="submit">Sign in</button>
+</form></body></html>`;
+  return new Response(html, {
+    headers: { 'content-type': 'text/html; charset=utf-8' },
+  });
+}
+
+export function createOAuthFlow(getConfig: () => AuthConfig): OAuthFlow {
+  function github(config: AuthConfig, self: string): GitHub {
+    return new GitHub(
+      config.clientId,
+      config.clientSecret,
+      `${self}${config.callbackPath}`,
+    );
+  }
+
+  function login(request: Request): Response {
+    const config = getConfig();
+    if (config.mode === 'dev') return devLoginForm(request, config);
+    const self = new URL(request.url).origin;
+    const returnUrl = sameOrigin(new URL(request.url).searchParams.get('return'), self);
+    const url = github(config, self).createAuthorizationURL(
+      encodeState(returnUrl, config.tokenSecret),
+      config.scope.split(' ').filter(Boolean),
+    );
+    return Response.redirect(url, 302);
+  }
+
+  async function devLogin(request: Request): Promise<Response> {
+    const config = getConfig();
+    if (config.mode !== 'dev')
+      return Response.json({ message: 'Dev auth disabled' }, { status: 404 });
+    const form = await request.formData();
+    const name = devName(form.get('name'));
+    const self = new URL(request.url).origin;
+    const returnUrl = sameOrigin(
+      typeof form.get('return') === 'string' ? (form.get('return') as string) : null,
+      self,
+    );
+    if (!name)
+      return Response.json({ message: 'Invalid name' }, { status: 400 });
+    return new Response(null, {
+      status: 302,
+      headers: {
+        location: returnUrl,
+        'set-cookie': setCookieHeader(config.devCookieName, name, COOKIE_MAX_AGE),
+      },
+    });
+  }
+
+  async function callback(request: Request): Promise<Response> {
+    const config = getConfig();
+    const url = new URL(request.url);
+    const self = url.origin;
+    let returnUrl = `${self}/`;
+    const state = url.searchParams.get('state');
+    if (state) {
+      try {
+        returnUrl = decodeState(state, config.tokenSecret);
+      } catch {
+        return Response.json(
+          { message: 'Invalid or expired sign-in state' },
+          { status: 400 },
+        );
+      }
+    }
+    const code = url.searchParams.get('code');
+    if (url.searchParams.get('error') || !code)
+      return Response.redirect(returnUrl, 302);
+    try {
+      const tokens = await github(config, self).validateAuthorizationCode(code);
+      return new Response(null, {
+        status: 302,
+        headers: {
+          location: returnUrl,
+          'set-cookie': setCookieHeader(
+            config.cookieName,
+            encrypt(tokens.accessToken(), config.tokenSecret),
+            COOKIE_MAX_AGE,
+          ),
+        },
+      });
+    } catch {
+      return Response.json({ message: 'GitHub sign-in failed' }, { status: 502 });
+    }
+  }
+
+  function logout(request: Request): Response {
+    const config = getConfig();
+    const self = new URL(request.url).origin;
+    const returnUrl = sameOrigin(new URL(request.url).searchParams.get('return'), self);
+    return new Response(null, {
+      status: 302,
+      headers: [
+        ['location', returnUrl],
+        ['set-cookie', setCookieHeader(config.cookieName, '', 0)],
+        ['set-cookie', setCookieHeader(config.devCookieName, '', 0)],
+      ],
+    });
+  }
+
+  return { login, devLogin, callback, logout };
+}
+

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.