@uln/auth 0.1.0 → 0.3.0

package/src/middleware.ts

@@ -1,35 +1,65 @@
-import { extractCookie } from "./cookie.ts";
+import { extractCookie, makeSessionCookie } from "./cookie.ts";
 import { validateToken } from "./token.ts";
-import type { CookieConfig, TokenConfig, TokenPayload } from "./types.ts";
+import type { CookieConfig, TokenPayload, VerifyConfig } from "./types.ts";
 
 export function getClientIP(request: Request): string {
-	return (
-		request.headers.get("cf-connecting-ip") ??
-		request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
-		"unknown"
-	);
+  return (
+    request.headers.get("cf-connecting-ip") ??
+    request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
+    "unknown"
+  );
 }
 
 export function checkBearerToken(request: Request, expectedToken: string): boolean {
-	const header = request.headers.get("Authorization");
-	return header === `Bearer ${expectedToken}`;
+  const header = request.headers.get("Authorization");
+  return header === `Bearer ${expectedToken}`;
 }
 
 export async function getAuthUser(
-	request: Request,
-	tokenConfig: TokenConfig,
-	cookieConfig: CookieConfig,
+  request: Request,
+  verifyConfig: VerifyConfig,
+  cookieConfig: CookieConfig,
 ): Promise<TokenPayload | null> {
-	const cookieHeader = request.headers.get("Cookie");
-	if (!cookieHeader) return null;
+  const cookieHeader = request.headers.get("Cookie");
+  if (!cookieHeader) return null;
 
-	const token = extractCookie(cookieHeader, cookieConfig.name);
-	if (!token) return null;
+  const token = extractCookie(cookieHeader, cookieConfig.name);
+  if (!token) return null;
 
-	return validateToken(tokenConfig, token);
+  return validateToken(verifyConfig, token);
 }
 
 export function redirectToLogin(currentUrl: string): Response {
-	const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
-	return Response.redirect(loginUrl, 302);
+  const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
+  return Response.redirect(loginUrl, 302);
+}
+
+/**
+ * Handle the auth callback on consuming sites.
+ * If the request URL has a `?token=` param, validates it, sets a session cookie,
+ * and redirects to the same URL without the token param.
+ * Returns null if there's no token param (not a callback request).
+ */
+export async function handleCallback(
+  request: Request,
+  verifyConfig: VerifyConfig,
+  cookieConfig: CookieConfig,
+): Promise<Response | null> {
+  const url = new URL(request.url);
+  const token = url.searchParams.get("token");
+  if (!token) return null;
+
+  const payload = await validateToken(verifyConfig, token);
+  if (!payload) {
+    return redirectToLogin(url.origin);
+  }
+
+  url.searchParams.delete("token");
+  return new Response(null, {
+    status: 302,
+    headers: {
+      Location: url.toString(),
+      "Set-Cookie": makeSessionCookie(cookieConfig, token),
+    },
+  });
 }

package/src/password.ts

@@ -3,55 +3,55 @@ const KEY_LENGTH = 64;
 const ITERATIONS = 100_000;
 
 function toHex(buffer: ArrayBuffer): string {
-	return Array.from(new Uint8Array(buffer))
-		.map((b) => b.toString(16).padStart(2, "0"))
-		.join("");
+  return Array.from(new Uint8Array(buffer))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
 }
 
 function fromHex(hex: string): Uint8Array<ArrayBuffer> {
-	const bytes = new Uint8Array(hex.length / 2);
-	for (let i = 0; i < hex.length; i += 2) {
-		bytes[i / 2] = Number.parseInt(hex.substring(i, i + 2), 16);
-	}
-	return bytes;
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < hex.length; i += 2) {
+    bytes[i / 2] = Number.parseInt(hex.substring(i, i + 2), 16);
+  }
+  return bytes;
 }
 
 async function deriveKey(password: string, salt: Uint8Array<ArrayBuffer>): Promise<ArrayBuffer> {
-	const encoder = new TextEncoder();
-	const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(password), "PBKDF2", false, ["deriveBits"]);
-	return crypto.subtle.deriveBits(
-		{
-			name: "PBKDF2",
-			salt,
-			iterations: ITERATIONS,
-			hash: "SHA-256",
-		},
-		keyMaterial,
-		KEY_LENGTH * 8,
-	);
+  const encoder = new TextEncoder();
+  const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(password), "PBKDF2", false, ["deriveBits"]);
+  return crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: ITERATIONS,
+      hash: "SHA-256",
+    },
+    keyMaterial,
+    KEY_LENGTH * 8,
+  );
 }
 
 export async function hashPassword(password: string): Promise<string> {
-	const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
-	const derived = await deriveKey(password, salt);
-	return `${toHex(salt.buffer)}:${toHex(derived)}`;
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+  const derived = await deriveKey(password, salt);
+  return `${toHex(salt.buffer)}:${toHex(derived)}`;
 }
 
 export async function verifyPassword(password: string, storedHash: string): Promise<boolean> {
-	const separatorIndex = storedHash.indexOf(":");
-	if (separatorIndex === -1) return false;
-
-	const saltHex = storedHash.substring(0, separatorIndex);
-	const keyHex = storedHash.substring(separatorIndex + 1);
-	const salt = fromHex(saltHex);
-	const expectedKey = fromHex(keyHex);
-	const derived = new Uint8Array(await deriveKey(password, salt));
-
-	if (derived.length !== expectedKey.length) return false;
-
-	let diff = 0;
-	for (let i = 0; i < derived.length; i++) {
-		diff |= (derived[i] ?? 0) ^ (expectedKey[i] ?? 0);
-	}
-	return diff === 0;
+  const separatorIndex = storedHash.indexOf(":");
+  if (separatorIndex === -1) return false;
+
+  const saltHex = storedHash.substring(0, separatorIndex);
+  const keyHex = storedHash.substring(separatorIndex + 1);
+  const salt = fromHex(saltHex);
+  const expectedKey = fromHex(keyHex);
+  const derived = new Uint8Array(await deriveKey(password, salt));
+
+  if (derived.length !== expectedKey.length) return false;
+
+  let diff = 0;
+  for (let i = 0; i < derived.length; i++) {
+    diff |= (derived[i] ?? 0) ^ (expectedKey[i] ?? 0);
+  }
+  return diff === 0;
 }

package/src/rate-limit.ts

@@ -1,38 +1,38 @@
 import type { RateLimitConfig, RateLimitStore } from "./types.ts";
 
 export interface RateLimitResult {
-	blocked: boolean;
-	remainingSeconds?: number;
+  blocked: boolean;
+  remainingSeconds?: number;
 }
 
 export async function checkRateLimit(
-	store: RateLimitStore,
-	key: string,
-	config: RateLimitConfig,
+  store: RateLimitStore,
+  key: string,
+  config: RateLimitConfig,
 ): Promise<RateLimitResult> {
-	const entry = await store.get(key);
-	if (!entry) return { blocked: false };
+  const entry = await store.get(key);
+  if (!entry) return { blocked: false };
 
-	if (entry.attempts >= config.maxAttempts) {
-		const elapsed = Math.floor((Date.now() - entry.firstAttempt) / 1000);
-		const remaining = config.windowSeconds - elapsed;
-		if (remaining > 0) return { blocked: true, remainingSeconds: remaining };
-		await store.delete(key);
-		return { blocked: false };
-	}
+  if (entry.attempts >= config.maxAttempts) {
+    const elapsed = Math.floor((Date.now() - entry.firstAttempt) / 1000);
+    const remaining = config.windowSeconds - elapsed;
+    if (remaining > 0) return { blocked: true, remainingSeconds: remaining };
+    await store.delete(key);
+    return { blocked: false };
+  }
 
-	return { blocked: false };
+  return { blocked: false };
 }
 
 export async function recordFailedAttempt(store: RateLimitStore, key: string, config: RateLimitConfig): Promise<void> {
-	const entry = await store.get(key);
-	if (entry) {
-		await store.set(key, { attempts: entry.attempts + 1, firstAttempt: entry.firstAttempt }, config.windowSeconds);
-	} else {
-		await store.set(key, { attempts: 1, firstAttempt: Date.now() }, config.windowSeconds);
-	}
+  const entry = await store.get(key);
+  if (entry) {
+    await store.set(key, { attempts: entry.attempts + 1, firstAttempt: entry.firstAttempt }, config.windowSeconds);
+  } else {
+    await store.set(key, { attempts: 1, firstAttempt: Date.now() }, config.windowSeconds);
+  }
 }
 
 export async function clearRateLimit(store: RateLimitStore, key: string): Promise<void> {
-	await store.delete(key);
+  await store.delete(key);
 }

package/src/service.ts

@@ -8,23 +8,34 @@ export type { TokenPayload, CookieConfig } from "./types.ts";
  * Returns the token payload or null if invalid.
  */
 export async function verifyToken(authService: Fetcher, token: string): Promise<TokenPayload | null> {
-	const res = await authService.fetch("https://auth/api/verify-token", {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ token }),
-	});
-	if (!res.ok) return null;
-	const data: { user: { id: string; email: string; name: string; admin: boolean; scopes: string[] } } =
-		await res.json();
-	return {
-		sub: data.user.id,
-		email: data.user.email,
-		name: data.user.name,
-		admin: data.user.admin,
-		scopes: data.user.scopes,
-		iat: 0,
-		exp: 0,
-	};
+  const res = await authService.fetch("https://auth/api/verify-token", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ token }),
+  });
+  if (!res.ok) return null;
+  const data = (await res.json()) as {
+    user: {
+      id: string;
+      email: string;
+      name: string;
+      admin: boolean;
+      scopes: string[];
+      flags: Record<string, string[]>;
+      kid: string;
+    };
+  };
+  return {
+    sub: data.user.id,
+    email: data.user.email,
+    name: data.user.name,
+    admin: data.user.admin,
+    scopes: data.user.scopes,
+    flags: data.user.flags,
+    kid: data.user.kid,
+    iat: 0,
+    exp: 0,
+  };
 }
 
 /**
@@ -32,23 +43,23 @@ export async function verifyToken(authService: Fetcher, token: string): Promise<
  * Returns the token payload or null if not authenticated.
  */
 export async function getAuthUser(
-	request: Request,
-	authService: Fetcher,
-	cookieConfig: CookieConfig,
+  request: Request,
+  authService: Fetcher,
+  cookieConfig: CookieConfig,
 ): Promise<TokenPayload | null> {
-	const cookieHeader = request.headers.get("Cookie");
-	if (!cookieHeader) return null;
+  const cookieHeader = request.headers.get("Cookie");
+  if (!cookieHeader) return null;
 
-	const token = extractCookie(cookieHeader, cookieConfig.name);
-	if (!token) return null;
+  const token = extractCookie(cookieHeader, cookieConfig.name);
+  if (!token) return null;
 
-	return verifyToken(authService, token);
+  return verifyToken(authService, token);
 }
 
 /**
  * Redirect to the centralized login page at auth.uln.industries.
  */
 export function redirectToLogin(currentUrl: string): Response {
-	const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
-	return Response.redirect(loginUrl, 302);
+  const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
+  return Response.redirect(loginUrl, 302);
 }

package/src/token.ts

@@ -1,87 +1,109 @@
-import type { TokenConfig, TokenPayload } from "./types.ts";
+import type { SigningConfig, TokenPayload, VerifyConfig } from "./types.ts";
 
 const encoder = new TextEncoder();
 
 function base64urlEncode(data: Uint8Array): string {
-	let binary = "";
-	for (const byte of data) {
-		binary += String.fromCharCode(byte);
-	}
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  let binary = "";
+  for (const byte of data) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
 function base64urlDecode(str: string): Uint8Array {
-	const padded = str.replace(/-/g, "+").replace(/_/g, "/");
-	const binary = atob(padded);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i);
-	}
-	return bytes;
+  const padded = str.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
 }
 
-async function hmacSign(secret: string, data: string): Promise<string> {
-	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
-		"sign",
-	]);
-	const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
-	return base64urlEncode(new Uint8Array(signature));
+const ECDSA_PARAMS = { name: "ECDSA", namedCurve: "P-256" } as const;
+const SIGN_PARAMS = { name: "ECDSA", hash: "SHA-256" } as const;
+
+export async function generateKeyPair(): Promise<{ kid: string; privateKeyJwk: JsonWebKey; publicKeyJwk: JsonWebKey }> {
+  const kid = crypto.randomUUID().slice(0, 8);
+  const keyPair = await crypto.subtle.generateKey(ECDSA_PARAMS, true, ["sign", "verify"]);
+  if (!("privateKey" in keyPair)) throw new Error("Expected CryptoKeyPair from ECDSA generateKey");
+  const privateExport = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
+  const publicExport = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  if (privateExport instanceof ArrayBuffer || publicExport instanceof ArrayBuffer)
+    throw new Error("Expected JWK from exportKey");
+  return { kid, privateKeyJwk: privateExport, publicKeyJwk: publicExport };
+}
+
+export async function importPrivateKey(jwk: JsonWebKey): Promise<CryptoKey> {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["sign"]);
 }
 
-function timingSafeEqual(a: string, b: string): boolean {
-	if (a.length !== b.length) return false;
-	let diff = 0;
-	for (let i = 0; i < a.length; i++) {
-		diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-	}
-	return diff === 0;
+export async function importPublicKey(jwk: JsonWebKey): Promise<CryptoKey> {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["verify"]);
 }
 
 export interface CreateTokenInput {
-	id: string;
-	email: string;
-	name: string;
-	isAdmin: boolean;
-	scopes: string[];
+  id: string;
+  email: string;
+  name: string;
+  isAdmin: boolean;
+  scopes: string[];
+  flags: Record<string, string[]>;
 }
 
-export async function createToken(config: TokenConfig, user: CreateTokenInput): Promise<string> {
-	const now = Math.floor(Date.now() / 1000);
-	const payload: TokenPayload = {
-		sub: user.id,
-		email: user.email,
-		name: user.name,
-		admin: user.isAdmin,
-		scopes: user.scopes,
-		iat: now,
-		exp: now + config.maxAgeSeconds,
-	};
-	const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
-	const sig = await hmacSign(config.secret, payloadB64);
-	return `${payloadB64}.${sig}`;
+export async function createToken(config: SigningConfig, user: CreateTokenInput): Promise<string> {
+  const now = Math.floor(Date.now() / 1000);
+  const payload: TokenPayload = {
+    sub: user.id,
+    email: user.email,
+    name: user.name,
+    admin: user.isAdmin,
+    scopes: user.scopes,
+    flags: user.flags,
+    kid: config.kid,
+    iat: now,
+    exp: now + config.maxAgeSeconds,
+  };
+  const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
+  const payloadBytes = encoder.encode(payloadB64);
+  const signature = await crypto.subtle.sign(SIGN_PARAMS, config.privateKey, payloadBytes);
+  const sigB64 = base64urlEncode(new Uint8Array(signature));
+  return `${payloadB64}.${sigB64}`;
 }
 
-export async function validateToken(config: TokenConfig, token: string): Promise<TokenPayload | null> {
-	const dotIndex = token.indexOf(".");
-	if (dotIndex === -1) return null;
+export async function validateToken(config: VerifyConfig, token: string): Promise<TokenPayload | null> {
+  const dotIndex = token.indexOf(".");
+  if (dotIndex === -1) return null;
+
+  const payloadB64 = token.substring(0, dotIndex);
+  const sigB64 = token.substring(dotIndex + 1);
 
-	const payloadB64 = token.substring(0, dotIndex);
-	const sig = token.substring(dotIndex + 1);
+  let payload: TokenPayload;
+  try {
+    const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
+    payload = JSON.parse(decoded) as TokenPayload;
+  } catch {
+    return null;
+  }
 
-	const expectedSig = await hmacSign(config.secret, payloadB64);
-	if (!timingSafeEqual(sig, expectedSig)) return null;
+  if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || typeof payload.kid !== "string") {
+    return null;
+  }
 
-	try {
-		const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
-		const payload = JSON.parse(decoded) as TokenPayload;
+  const now = Math.floor(Date.now() / 1000);
+  if (now > payload.exp) return null;
 
-		if (typeof payload.sub !== "string" || typeof payload.exp !== "number") return null;
+  const entry = config.publicKeys.find((k) => k.kid === payload.kid);
+  if (!entry) return null;
 
-		const now = Math.floor(Date.now() / 1000);
-		if (now > payload.exp) return null;
+  try {
+    const signatureBytes = base64urlDecode(sigB64);
+    const payloadBytes = encoder.encode(payloadB64);
+    const valid = await crypto.subtle.verify(SIGN_PARAMS, entry.key, signatureBytes, payloadBytes);
+    if (!valid) return null;
+  } catch {
+    return null;
+  }
 
-		return payload;
-	} catch {
-		return null;
-	}
+  return payload;
 }

package/src/types.ts

@@ -1,55 +1,68 @@
 export interface User {
-	id: string;
-	email: string;
-	name: string;
-	passwordHash: string;
-	isAdmin: boolean;
-	emailVerified: boolean;
-	createdAt: string;
-	updatedAt: string;
+  id: string;
+  email: string;
+  name: string;
+  passwordHash: string;
+  isAdmin: boolean;
+  emailVerified: boolean;
+  createdAt: string;
+  updatedAt: string;
 }
 
 export interface UserStore {
-	getUser(id: string): Promise<User | null>;
-	getUserByEmail(email: string): Promise<User | null>;
-	listUsers(): Promise<User[]>;
-	saveUser(user: User): Promise<void>;
-	deleteUser(id: string): Promise<void>;
+  getUser(id: string): Promise<User | null>;
+  getUserByEmail(email: string): Promise<User | null>;
+  listUsers(): Promise<User[]>;
+  saveUser(user: User): Promise<void>;
+  deleteUser(id: string): Promise<void>;
 }
 
 export interface RateLimitEntry {
-	attempts: number;
-	firstAttempt: number;
+  attempts: number;
+  firstAttempt: number;
 }
 
 export interface RateLimitStore {
-	get(key: string): Promise<RateLimitEntry | null>;
-	set(key: string, entry: RateLimitEntry, ttlSeconds: number): Promise<void>;
-	delete(key: string): Promise<void>;
+  get(key: string): Promise<RateLimitEntry | null>;
+  set(key: string, entry: RateLimitEntry, ttlSeconds: number): Promise<void>;
+  delete(key: string): Promise<void>;
 }
 
 export interface RateLimitConfig {
-	maxAttempts: number;
-	windowSeconds: number;
+  maxAttempts: number;
+  windowSeconds: number;
 }
 
 export interface TokenPayload {
-	sub: string;
-	email: string;
-	name: string;
-	admin: boolean;
-	scopes: string[];
-	iat: number;
-	exp: number;
+  sub: string;
+  email: string;
+  name: string;
+  admin: boolean;
+  scopes: string[];
+  flags: Record<string, string[]>;
+  kid: string;
+  iat: number;
+  exp: number;
 }
 
-export interface TokenConfig {
-	secret: string;
-	maxAgeSeconds: number;
+export interface PublicKeyEntry {
+  kid: string;
+  key: CryptoKey;
+}
+
+export interface SigningConfig {
+  privateKey: CryptoKey;
+  kid: string;
+  maxAgeSeconds: number;
+}
+
+export interface VerifyConfig {
+  publicKeys: PublicKeyEntry[];
+  maxAgeSeconds: number;
 }
 
 export interface CookieConfig {
-	name: string;
-	maxAgeSeconds: number;
-	secure: boolean;
+  name: string;
+  maxAgeSeconds: number;
+  secure: boolean;
 }