@voltro/plugin-auth 0.84.0 → 0.86.0

package/dist/nativeRoutes.js

@@ -0,0 +1,120 @@
+import { hashToken as e, mintToken as t } from "./tokens.js";
+import { configSigningKey as n, issueUserSession as r } from "./handlers.js";
+import { createHash as i, createHmac as a, randomBytes as o, timingSafeEqual as s } from "node:crypto";
+import { Effect as c } from "effect";
+import { buildSetCookie as l, readCookie as u } from "@voltro/protocol/session";
+//#region src/nativeRoutes.ts
+var d = "voltro:native", f = 600, p = "/login", m = (e) => e.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), h = (e) => Buffer.from(e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4), "base64"), g = (e) => m(i("sha256").update(e, "ascii").digest()), _ = (e, t) => {
+	let n = m(Buffer.from(JSON.stringify(e), "utf8"));
+	return `${n}.${m(a("sha256", t).update(n).digest())}`;
+}, v = (e, t, n = Date.now) => {
+	if (!e) return null;
+	let r = e.indexOf(".");
+	if (r <= 0 || r === e.length - 1) return null;
+	let i = e.slice(0, r), o = h(e.slice(r + 1)), c = a("sha256", t).update(i).digest();
+	if (o.length !== c.length || !s(o, c)) return null;
+	try {
+		let e = JSON.parse(h(i).toString("utf8"));
+		return typeof e.exp != "number" || e.exp * 1e3 < n() ? null : e;
+	} catch {
+		return null;
+	}
+}, y = (e, t) => t.includes(e), b = (e, t) => {
+	let n = new URLSearchParams(t).toString();
+	return `${e}${e.includes("?") ? "&" : "?"}${n}`;
+}, x = (e, t) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8"
+}), S = (e, t) => ({
+	status: 302,
+	body: "",
+	location: e,
+	...t === void 0 ? {} : { setCookie: t }
+}), C = (e) => {
+	if (!e) return null;
+	let { ch: t, r: n, s: r, exp: i } = e;
+	return typeof t != "string" || typeof n != "string" || typeof r != "string" || typeof i != "number" ? null : {
+		ch: t,
+		r: n,
+		s: r,
+		exp: i
+	};
+}, w = (e, t, n) => l(e.native.pendingCookieName ?? "voltro:native", t, {
+	maxAgeSeconds: n,
+	httpOnly: !0,
+	sameSite: "lax",
+	secure: e.config.cookieSecure ?? !0,
+	path: `${e.prefix}/native`
+}), T = (e) => `${e.native.loginPath ?? p}?next=${encodeURIComponent(`${e.prefix}/native/complete`)}`, E = (e, t, r, i) => c.gen(function* () {
+	let a = e.get("redirect_uri") ?? "", o = e.get("code_challenge") ?? "", s = e.get("code_challenge_method") ?? "S256", c = e.get("state") ?? "";
+	if (!y(a, i.native.redirectUris)) return x(400, { error: "redirect_uri_not_allowed" });
+	if (s !== "S256" || o.length < 43 || o.length > 128) return S(b(a, {
+		error: "invalid_request",
+		state: c
+	}));
+	if (c.length === 0) return S(b(a, { error: "invalid_request" }));
+	let l = i.now ?? Date.now, u = i.native.pendingTtlSeconds ?? f, d = {
+		ch: o,
+		r: a,
+		s: c,
+		exp: Math.floor(l() / 1e3) + u
+	}, p = w(i, _({ ...d }, n(i.config)), u);
+	return t && t.subject.type === "user" && t.sessionId ? {
+		...yield* D(d, {
+			userId: t.subject.id,
+			sessionId: t.sessionId
+		}, r, i),
+		setCookie: w(i, "", 0)
+	} : S(T(i), p);
+}), D = (e, r, i, a) => c.gen(function* () {
+	let s = t("native-code", 300);
+	yield* i.insertToken({
+		id: `tok_${m(o(12))}`,
+		tokenHash: s.tokenHash,
+		userId: r.userId,
+		purpose: "native-code",
+		expiresAt: s.expiresAt
+	});
+	let c = _({
+		sid: r.sessionId,
+		uid: r.userId,
+		ch: e.ch,
+		exp: Math.floor(s.expiresAt.getTime() / 1e3)
+	}, n(a.config));
+	return S(b(e.r, {
+		code: `${s.token}.${c}`,
+		state: e.s
+	}));
+}), O = (e, t, r, i) => c.gen(function* () {
+	let a = C(v(u(e, i.native.pendingCookieName ?? "voltro:native"), n(i.config), i.now));
+	return a ? !t || t.subject.type !== "user" || !t.sessionId ? S(T(i)) : {
+		...yield* D(a, {
+			userId: t.subject.id,
+			sessionId: t.sessionId
+		}, r, i),
+		setCookie: w(i, "", 0)
+	} : x(400, { error: "no_pending_native_login" });
+}), k = (t, i, a) => c.gen(function* () {
+	let o = t.code.indexOf(".");
+	if (o <= 0) return x(400, { error: "invalid_code" });
+	let s = t.code.slice(0, o), c = v(t.code.slice(o + 1), n(a.config), a.now), l = c?.sid, u = c?.uid, d = c?.ch;
+	if (typeof l != "string" || typeof u != "string" || typeof d != "string") return x(400, { error: "invalid_code" });
+	let f = yield* i.consumeToken(e(s), "native-code");
+	if (!f || f.userId !== u || t.codeVerifier.length < 43 || g(t.codeVerifier) !== d) return x(400, { error: "invalid_code" });
+	let p = yield* i.findById(u);
+	if (!p) return x(400, { error: "invalid_code" });
+	let m = yield* r(p, i, a.config, {
+		sessionId: l,
+		sessionRow: "existing",
+		clearLoginFailures: !1
+	});
+	return x(200, {
+		ok: !0,
+		session: m.value,
+		expiresAt: m.expiresAt,
+		subject: m.subject
+	});
+});
+//#endregion
+export { d as NATIVE_PENDING_COOKIE, E as handleNativeAuthorize, O as handleNativeComplete, k as handleNativeExchange, y as isAllowedRedirectUri, T as nativeLoginRedirect, g as s256, _ as signClaims, v as verifyClaims };

package/dist/passkeyHandlers.js

@@ -0,0 +1,162 @@
+import { issueSession as e } from "./session.js";
+import { newAuthId as t, subjectFromUser as n } from "./userStore.js";
+import { configSessionSecrets as r, guardSubject as i } from "./handlers.js";
+import { generateChallenge as a, verifyAssertion as o, verifyRegistration as s } from "./webauthn.js";
+import { Effect as c } from "effect";
+//#region src/passkeyHandlers.ts
+var l = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), u = 604800, d = () => {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		put: (t, n, r) => c.sync(() => {
+			e.set(t, {
+				challenge: n,
+				expiresAt: Date.now() + r * 1e3
+			});
+		}),
+		take: (t) => c.sync(() => {
+			let n = e.get(t);
+			return e.delete(t), !n || n.expiresAt < Date.now() ? null : n.challenge;
+		})
+	};
+}, f = (e) => ({
+	put: (n, r, i) => c.gen(function* () {
+		let a = /* @__PURE__ */ new Date(), o = new Date(a.getTime() + i * 1e3);
+		(yield* e`
+        UPDATE "passkeyChallenges"
+           SET challenge = ${r}, "expiresAt" = ${o}, "createdAt" = ${a}
+         WHERE key = ${n}
+        RETURNING key
+      `).length === 0 && (yield* e`
+          INSERT INTO "passkeyChallenges" (id, key, challenge, "expiresAt", "createdAt")
+          VALUES (${t("pkc")}, ${n}, ${r}, ${o}, ${a})
+        `);
+	}).pipe(c.asVoid, c.orElseSucceed(() => void 0)),
+	take: (t) => c.gen(function* () {
+		let n = (yield* e`
+        DELETE FROM "passkeyChallenges" WHERE key = ${t}
+        RETURNING challenge, "expiresAt"
+      `)[0];
+		return n && n.expiresAt.getTime() > Date.now() ? n.challenge : null;
+	}).pipe(c.orElseSucceed(() => null))
+}), p = 300, m = (e, t, n, r) => c.gen(function* () {
+	if (!(yield* t.findById(e.userId))) return l(404, { error: "user_not_found" });
+	let i = a();
+	yield* n.put(`${e.userId}:register`, i, p);
+	let o = yield* t.listPasskeys(e.userId);
+	return l(200, {
+		challenge: i,
+		rp: {
+			id: r.rpId,
+			name: r.rpName
+		},
+		user: {
+			id: e.userId,
+			name: e.userName,
+			displayName: e.userName
+		},
+		pubKeyCredParams: [{
+			type: "public-key",
+			alg: -7
+		}, {
+			type: "public-key",
+			alg: -257
+		}],
+		excludeCredentials: o.map((e) => ({
+			type: "public-key",
+			id: e.credentialId
+		})),
+		authenticatorSelection: {
+			userVerification: "preferred",
+			residentKey: "preferred"
+		},
+		timeout: p * 1e3
+	});
+}), h = (e, n, r, i) => c.gen(function* () {
+	if (!(yield* n.findById(e.userId))) return l(404, { error: "user_not_found" });
+	let a = yield* r.take(`${e.userId}:register`);
+	if (!a) return l(400, { error: "no_pending_challenge" });
+	let o = s({
+		clientDataJSON: e.clientDataJSON,
+		authenticatorData: e.authenticatorData,
+		expectedChallenge: a,
+		expectedOrigin: i.origin,
+		rpId: i.rpId
+	});
+	return o.ok ? (yield* n.insertPasskey({
+		id: t("pk"),
+		credentialId: o.result.credentialId,
+		userId: e.userId,
+		publicKey: o.result.publicKey,
+		counter: o.result.counter,
+		transports: e.transports ?? null
+	}).pipe(c.ignore), l(200, {
+		ok: !0,
+		credentialId: o.result.credentialId
+	})) : l(400, { error: o.error });
+}), g = (e, t, n, r) => c.gen(function* () {
+	let i = a(), o = e.userId ? `${e.userId}:assert` : "*:assert";
+	yield* n.put(o, i, p);
+	let s = e.userId ? (yield* t.listPasskeys(e.userId)).map((e) => ({
+		type: "public-key",
+		id: e.credentialId
+	})) : [];
+	return l(200, {
+		challenge: i,
+		rpId: r.rpId,
+		allowCredentials: s,
+		userVerification: "preferred",
+		timeout: p * 1e3
+	});
+}), _ = (a, s, d, f, p) => c.gen(function* () {
+	let m = yield* s.findPasskey(a.credentialId);
+	if (!m) return l(401, { error: "unknown_credential" });
+	let h = a.userId ? `${a.userId}:assert` : "*:assert", g = yield* d.take(h);
+	if (!g) return l(400, { error: "no_pending_challenge" });
+	let _ = o({
+		clientDataJSON: a.clientDataJSON,
+		authenticatorData: a.authenticatorData,
+		signature: a.signature,
+		expectedChallenge: g,
+		expectedOrigin: f.origin,
+		rpId: f.rpId,
+		storedPublicKey: m.publicKey,
+		storedCounter: m.counter
+	});
+	if (!_.ok) return l(401, { error: _.error });
+	if (!(yield* s.advancePasskeyCounter(a.credentialId, _.result.newCounter)) && _.result.newCounter !== 0) return l(401, { error: "counter_regressed" });
+	let v = yield* s.findById(m.userId);
+	if (!v) return l(401, { error: "unknown_credential" });
+	let y = yield* i(v, p);
+	if (y) return y;
+	let b = yield* s.listMemberships(v.id), x = t("sess");
+	yield* s.insertSession({
+		id: x,
+		userId: v.id,
+		tenantId: v.tenantId,
+		expiresAt: new Date(Date.now() + u * 1e3),
+		ipAddress: null,
+		userAgent: null
+	}).pipe(c.ignore);
+	let S = n(v, { memberships: b }), C = S.type === "user" ? {
+		...S,
+		metadata: {
+			...S.metadata ?? {},
+			sessionId: x
+		}
+	} : S, w = e(C, r(p), {
+		ttlSeconds: u,
+		...p.cookieDomain ? { domain: p.cookieDomain } : {},
+		secure: p.cookieSecure ?? !0
+	});
+	return l(200, {
+		ok: !0,
+		subject: C
+	}, { setCookie: w.setCookie });
+});
+//#endregion
+export { f as dataStoreChallengeStore, g as handlePasskeyAssertOptions, _ as handlePasskeyAssertVerify, m as handlePasskeyRegisterOptions, h as handlePasskeyRegisterVerify, d as memoryChallengeStore };

package/dist/password.js

@@ -1,7 +1,7 @@
 import { randomBytes as e, scrypt as t, timingSafeEqual as n } from "node:crypto";
 import { Data as r, Effect as i } from "effect";
 //#region src/password.ts
-var a = 32768, o = 8, s = 1, c = 32, l = 16, u = (e, t) => 128 * e * t * 2, d = 268435456, f = class extends r.TaggedError("PasswordEmptyError") {}, p = class extends r.TaggedError("PasswordHashError") {}, m = (e, n, r, a) => i.async((o) => {
+var a = 32768, o = 8, s = 1, c = 32, l = 16, u = (e, t) => 128 * e * t * 2, d = 268435456, f = class extends r.TaggedError("PasswordEmptyError") {}, p = class extends r.TaggedError("PasswordHashError") {}, m = (e, n, r, a) => i.callback((o) => {
 	t(e, n, r, {
 		...a,
 		maxmem: u(a.N, a.r)
@@ -35,7 +35,7 @@ var a = 32768, o = 8, s = 1, c = 32, l = 16, u = (e, t) => 128 * e * t * 2, d =
 		p: o
 	});
 	return l.length === c.length && n(l, c);
-}).pipe(i.catchAll(() => i.succeed(!1))), _ = (e) => {
+}).pipe(i.catch(() => i.succeed(!1))), _ = (e) => {
 	let t = e.split("$");
 	if (t.length !== 6) return null;
 	let [n, r, i, a, o, s] = t;

package/dist/plugin.d.ts

@@ -3,7 +3,7 @@ import { ConnectionCredential } from '@voltro/protocol';
 import { DataStore } from '@voltro/database';
 import { Effect } from 'effect';
 import { SessionSecrets } from '@voltro/protocol/session';
-import { SqlClient } from '@effect/sql/SqlClient';
+import { SqlClient } from 'effect/sql/SqlClient';
 import { Subject } from '@voltro/protocol';
 import { VoidIfEmpty } from 'effect/Types';
 import { VoltroPlugin } from '@voltro/protocol';
@@ -648,6 +648,10 @@ declare interface SendEmailInput {
 /** A server-side session row — enumerated so apps can list active
  *  devices + revoke them. Written on sign-in; deleted on revoke. */
 declare interface SessionRecord {
+    /** Stable device lineage. The original row is its transaction lock anchor. */
+    readonly familyId?: string | null;
+    /** A replaced credential remains an inert revocation alias until the device ends. */
+    readonly rotatedAt?: Date | null;
     readonly id: string;
     readonly userId: string;
     readonly tenantId: string;