@udibo/oauth2 0.35.0 → 0.36.0

package/dist/server/services/token.d.ts

@@ -162,6 +162,13 @@ export interface TokenServiceInterface<Client extends ClientInterface, User, Sco
      * Returns true if any tokens were revoked, which the grant reports as a code
      * replay (RFC 6819 §4.4.1.1).
      *
+     * After the client check below passes, revoke every live member of the
+     * rotation families of those tokens too, as {@linkcode revokeFamily} does,
+     * keeping them revoked against a rotation in flight. A refresh token rotated
+     * from the code's token carries no `code`, so revoking only the tokens saved
+     * with the code leaves the stolen code's session refreshing once it has
+     * rotated.
+     *
      * `client` is the client that presented the code. Revoke only when it is the
      * client the code's tokens were issued to; for any other client revoke
      * nothing and resolve `false`. A different confidential client could never

package/dist/testing/contract/token-rotation.js

@@ -235,6 +235,19 @@ export function runTokenRotationContractTests(options) {
                 "successor that rotation commits afterwards stays live in a " +
                 "family the server revoked").toStrictEqual([]);
         });
+        it("leaves no live member when the code that issued the family is replayed while a rotation is in flight", async () => {
+            const code = "replayed-while-rotating";
+            const parent = { ...(await member(family)), code };
+            await tokenService.save(parent);
+            const next = await member(family);
+            const [rotated, revoked] = await whileRotating(parent, next, () => tokenService.revokeCode(code, client));
+            assert(revoked.status === "fulfilled");
+            assert(rotated.status === "fulfilled");
+            expect([undefined, next.refreshToken]).toContain(rotated.value?.refreshToken);
+            expect(await live([parent, next]), "revokeCode must revoke the code's families as revokeFamily does, " +
+                "waiting for a rotation holding one, or the successor that " +
+                "rotation commits afterwards stays live after the code's replay").toStrictEqual([]);
+        });
         it("revokes the successor of a rotation that committed before the family was revoked", async () => {
             const parent = await savedMember(family);
             const next = await member(family);

package/dist/testing/contract/token.js

@@ -52,6 +52,41 @@ export function runTokenServiceContractTests(options) {
             await options.addUser(userService, user, "pw");
             await options.addClient(clientService, client);
         });
+        async function familyMember(familyId, refreshTokenExpiresAt = new Date(Date.now() + 600_000)) {
+            const accessToken = await tokenService.generateAccessToken(client, user);
+            const refreshToken = (await tokenService.generateRefreshToken(client, user));
+            return {
+                accessToken,
+                accessTokenExpiresAt: new Date(Date.now() + 60_000),
+                refreshToken,
+                refreshTokenExpiresAt,
+                familyId,
+                familyCreatedAt: new Date(Date.now() - 60_000),
+                client,
+                user,
+            };
+        }
+        async function saveFamilyMember(familyId, refreshTokenExpiresAt) {
+            const token = await familyMember(familyId, refreshTokenExpiresAt);
+            await tokenService.save(token);
+            return token;
+        }
+        async function isLive(token) {
+            return ((await tokenService.getRefreshToken(token.refreshToken)) !==
+                undefined ||
+                (await tokenService.getToken(token.accessToken)) !== undefined);
+        }
+        async function rotateTo(current, next) {
+            if (tokenService.rotate) {
+                assert(await tokenService.rotate(current, next));
+                return;
+            }
+            const claimed = tokenService.revokeRotated
+                ? await tokenService.revokeRotated(current)
+                : await tokenService.revoke(current);
+            assert(claimed);
+            await tokenService.save(next);
+        }
         describe("generateAccessToken / generateRefreshToken", () => {
             it("produces unique access tokens", async () => {
                 const a = await tokenService.generateAccessToken(client, user);
@@ -237,6 +272,22 @@ export function runTokenServiceContractTests(options) {
                     expect(await tokenService.revokeCode("replayed-code", client)).toBe(true);
                     expect(await tokenService.getToken(accessToken)).toBe(undefined);
                 });
+                it("revokes nothing in a rotated family for a client other than the one the code's tokens were issued to", async () => {
+                    const other = makeClient(2);
+                    await options.addClient(clientService, other);
+                    const family = makeFamilyId();
+                    const issued = {
+                        ...(await familyMember(family)),
+                        code: "rotated-replayed-code",
+                    };
+                    await tokenService.save(issued);
+                    const rotated = await familyMember(family);
+                    await rotateTo(issued, rotated);
+                    expect(await tokenService.revokeCode("rotated-replayed-code", other)).toBe(false);
+                    expect(await isLive(rotated), "the client check comes before any family is revoked — a " +
+                        "client that could never have redeemed the code must not end " +
+                        "the session rotated from it").toBe(true);
+                });
             }
             else {
                 it.skip("revokeCode ignores the presenting client — any client that presents a spent code revokes its tokens (revokeCodeChecksClient: false)", () => { });
@@ -250,25 +301,6 @@ export function runTokenServiceContractTests(options) {
                     family = makeFamilyId();
                     otherFamily = makeFamilyId();
                 });
-                async function familyMember(familyId, refreshTokenExpiresAt = new Date(Date.now() + 600_000)) {
-                    const accessToken = await tokenService.generateAccessToken(client, user);
-                    const refreshToken = (await tokenService.generateRefreshToken(client, user));
-                    return {
-                        accessToken,
-                        accessTokenExpiresAt: new Date(Date.now() + 60_000),
-                        refreshToken,
-                        refreshTokenExpiresAt,
-                        familyId,
-                        familyCreatedAt: new Date(Date.now() - 60_000),
-                        client,
-                        user,
-                    };
-                }
-                async function saveFamilyMember(familyId, refreshTokenExpiresAt) {
-                    const token = await familyMember(familyId, refreshTokenExpiresAt);
-                    await tokenService.save(token);
-                    return token;
-                }
                 it("implements both halves of reuse detection", () => {
                     assert(typeof tokenService.getRevokedRefreshToken === "function" &&
                         typeof tokenService.revokeFamily === "function", "getRevokedRefreshToken and revokeFamily are optional, but " +
@@ -404,6 +436,49 @@ export function runTokenServiceContractTests(options) {
                     assert((await tokenService.getRefreshToken(unrelated.refreshToken)) !==
                         undefined);
                 });
+                it("revokes the rotated successors of a replayed code's tokens, leaving other families live", async () => {
+                    const code = "rotated-code";
+                    const issued = { ...(await familyMember(family)), code };
+                    await tokenService.save(issued);
+                    const rotated = await familyMember(family);
+                    await rotateTo(issued, rotated);
+                    const latest = await familyMember(family);
+                    await rotateTo(rotated, latest);
+                    const unrelated = await saveFamilyMember(otherFamily);
+                    expect(await isLive(latest)).toBe(true);
+                    expect(await tokenService.revokeCode(code, client), "the replay ended a live token, so the grant must report it").toBe(true);
+                    expect(await tokenService.getRefreshToken(latest.refreshToken), "a rotated successor carries no code, so revoking only the " +
+                        "rows issued with the code leaves the stolen code's session " +
+                        "refreshing — revoke every live member of their families").toBe(undefined);
+                    expect(await tokenService.getToken(latest.accessToken), "the successor's access token ends with its family").toBe(undefined);
+                    if (tokenService.hasLiveRefreshToken) {
+                        expect(await tokenService.hasLiveRefreshToken(family)).toBe(false);
+                    }
+                    assert((await tokenService.getRefreshToken(unrelated.refreshToken)) !==
+                        undefined, "a replayed code must not end families it did not issue");
+                });
+                it("keeps a replayed code's family revoked: a successor saved after revokeCode is not live", async ({ skip, }) => {
+                    skip(typeof tokenService.rotate === "function", "the service implements rotate, so the refresh grant never saves " +
+                        "a successor separately; runTokenRotationContractTests checks " +
+                        "revokeCode against rotate");
+                    const code = "claimed-code";
+                    const issued = { ...(await familyMember(family)), code };
+                    await tokenService.save(issued);
+                    const next = await familyMember(family);
+                    const claimed = tokenService.revokeRotated
+                        ? await tokenService.revokeRotated(issued)
+                        : await tokenService.revoke(issued);
+                    expect(claimed).toBe(true);
+                    await tokenService.revokeCode(code, client);
+                    await tokenService.save(next);
+                    expect(await isLive(next), "a successor saved after its code was replayed must be stored " +
+                        "already revoked: the refresh grant claims a token and saves " +
+                        "its successor in two calls, and a replay that lands between " +
+                        "them otherwise leaves the successor live").toBe(false);
+                    if (tokenService.hasLiveRefreshToken) {
+                        expect(await tokenService.hasLiveRefreshToken(family)).toBe(false);
+                    }
+                });
                 it("leaves rotatedAt unset on a token revoked other than by rotation", async () => {
                     const token = await saveFamilyMember(family);
                     await tokenService.revoke(token.refreshToken, "refresh_token");

package/dist/testing/services.d.ts

@@ -294,7 +294,9 @@ export declare class MemoryTokenService<C extends ClientInterface, U extends Mem
     revokeFamily(familyId: string): Promise<boolean>;
     /**
      * Removes every token issued from the given authorization code, used when a
-     * code is replayed. Resolves `true` when at least one token was removed.
+     * code is replayed, and revokes the rotation families of those tokens as
+     * {@linkcode revokeFamily} does, so their rotated successors end with them.
+     * Resolves `true` when tokens were issued from the code.
      * Removes nothing and resolves `false` when `client` is given and is not the
      * client the code's tokens were issued to.
      */

package/dist/testing/services.js

@@ -367,10 +367,16 @@ export class MemoryTokenService {
         if (stored.codeHash) {
             let bucket = this.#tokensByCodeHash.get(stored.codeHash);
             if (!bucket) {
-                bucket = { clientId: stored.clientId, accessTokenHashes: new Set() };
+                bucket = {
+                    clientId: stored.clientId,
+                    accessTokenHashes: new Set(),
+                    familyIds: new Set(),
+                };
                 this.#tokensByCodeHash.set(stored.codeHash, bucket);
             }
             bucket.accessTokenHashes.add(stored.accessTokenHash);
+            if (stored.familyId)
+                bucket.familyIds.add(stored.familyId);
         }
         if (stored.refreshTokenHash) {
             if (stored.familyId && this.#revokedFamilies.has(stored.familyId)) {
@@ -483,6 +489,9 @@ export class MemoryTokenService {
      * live token was removed.
      */
     revokeFamily(familyId) {
+        return Promise.resolve(this.#revokeFamily(familyId));
+    }
+    #revokeFamily(familyId) {
         this.#revokedFamilies.add(familyId);
         let revoked = false;
         for (const [hash, stored] of this.#tokensByRefreshHash) {
@@ -499,11 +508,13 @@ export class MemoryTokenService {
                 revoked = true;
             }
         }
-        return Promise.resolve(revoked);
+        return revoked;
     }
     /**
      * Removes every token issued from the given authorization code, used when a
-     * code is replayed. Resolves `true` when at least one token was removed.
+     * code is replayed, and revokes the rotation families of those tokens as
+     * {@linkcode revokeFamily} does, so their rotated successors end with them.
+     * Resolves `true` when tokens were issued from the code.
      * Removes nothing and resolves `false` when `client` is given and is not the
      * client the code's tokens were issued to.
      */
@@ -515,6 +526,8 @@ export class MemoryTokenService {
         if (client && client.id.toString() !== bucket.clientId.toString()) {
             return false;
         }
+        for (const familyId of bucket.familyIds)
+            this.#revokeFamily(familyId);
         for (const accessTokenHash of bucket.accessTokenHashes) {
             const stored = this.#tokensByAccessHash.get(accessTokenHash);
             if (stored) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",