@voltro/plugin-auth 0.85.0 → 0.87.0

package/dist/guestPlugin.js

@@ -0,0 +1,166 @@
+import { clearSessionCookie as e, resolveSessionSecret as t, sessionSecretsOf as n } from "./session.js";
+import { CSRF_COOKIE_NAME as r, issueCsrfToken as i, verifyCsrf as a } from "./csrf.js";
+import { validateGuestSecrets as o } from "./guestSecrets.js";
+import { GuestAuthError as s, dataStoreGuestAuth as c } from "./guestService.js";
+import { guestTables as l } from "./guestSchema.js";
+import { sessionsTable as u } from "./schema.js";
+import { Duration as d, Effect as f, Result as p } from "effect";
+import { buildSetCookie as m, noteSigningLifetime as h, readCookie as g, readSessionValue as _, verifySessionKeyed as v } from "@voltro/protocol/session";
+import { definePlugin as y } from "@voltro/protocol";
+//#region src/guestPlugin.ts
+var b = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json",
+	headers: {
+		"cache-control": "no-store",
+		...n
+	}
+}), x = (x) => {
+	let S = x.prefix ?? "/auth/guest";
+	if (!/^\/[a-zA-Z0-9/_-]+$/.test(S) || S.endsWith("/")) throw Error("Guest route prefix must be an absolute path without a trailing slash");
+	if (!x.tenantId.trim()) throw Error("Guest authentication requires a server-owned tenant");
+	let C = d.toSeconds(x.ttl ?? "365 days"), w = d.toSeconds(x.sessionTtl ?? "7 days");
+	if (![C, w].every((e) => Number.isSafeInteger(e) && e > 0 && e <= 31536e4)) throw Error("Guest authentication lifetimes must be positive bounded whole seconds");
+	h("session", w * 1e3);
+	let T = () => o(x.secret ?? t()), E, D = /* @__PURE__ */ new WeakMap(), O = (e) => {
+		let t = D.get(e);
+		if (t) return t;
+		let n = x.service?.(e) ?? c(e, {
+			tenantId: x.tenantId,
+			secret: T,
+			ttlSeconds: C,
+			sessionTtlSeconds: w,
+			upgradeable: x.upgradeable ?? !0,
+			...x.secure === void 0 ? {} : { secure: x.secure }
+		});
+		return D.set(e, n), n;
+	}, k = (e) => f.gen(function* () {
+		return e.tenantId !== x.tenantId || e.kind !== "guest" ? yield* f.fail(new s({ code: "credential_rejected" })) : E ? O(E) : yield* f.fail(new s({ code: "store_unavailable" }));
+	}), A = async (t) => {
+		let n = T(), o = typeof n == "string" ? n : n.current.secret;
+		if (t.method === "GET" && t.path === S + "/csrf") {
+			let e = i(o);
+			return b(200, { token: e }, { "set-cookie": m(r, e, {
+				path: "/",
+				sameSite: "lax",
+				secure: x.secure ?? !0,
+				httpOnly: !1,
+				maxAgeSeconds: 3600
+			}) });
+		}
+		if (![
+			"/create",
+			"/resume",
+			"/prepare-rotation",
+			"/rotate",
+			"/revoke"
+		].some((e) => t.path === S + e)) return b(404, { error: "not_found" });
+		if (t.method !== "POST") return b(405, { error: "method_not_allowed" }, { allow: "POST" });
+		if ((t.headers["content-type"] ?? "").split(";")[0]?.trim() !== "application/json") return b(415, { error: "json_required" });
+		if (t.rawBody.byteLength > 2048) return b(413, { error: "body_too_large" });
+		if (t.headers.cookie && !a(t.headers["x-csrf-token"], g(t.headers.cookie, "voltro:csrf"), o)) return b(403, { error: "csrf_rejected" });
+		let s = t.store ?? E;
+		if (!s) return b(503, { error: "store_unavailable" });
+		let c;
+		try {
+			c = JSON.parse(new TextDecoder().decode(t.rawBody));
+		} catch {
+			return b(400, { error: "invalid_input" });
+		}
+		if (typeof c != "object" || !c || Array.isArray(c)) return b(400, { error: "invalid_input" });
+		let l = c, u = t.path === S + "/create", d = t.path === S + "/rotate";
+		if (Object.keys(l).some((e) => u || e !== "credential" && !(d && e === "nextCredential")) || !u && typeof l.credential != "string" || d && typeof l.nextCredential != "string") return b(400, { error: "invalid_input" });
+		let h = O(s);
+		if (u && _(t.headers)) return b(409, { error: "session_already_present" });
+		let v = typeof l.credential == "string" ? l.credential : "";
+		if (t.path === S + "/prepare-rotation") {
+			let e = await f.runPromise(f.result(h.prepareRotation(v)));
+			return p.isFailure(e) ? b(e.failure.code === "credential_rejected" ? 401 : 503, { error: e.failure.code }) : b(200, e.success);
+		}
+		let y = await f.runPromise(f.result(u ? h.create() : t.path === S + "/resume" ? h.resume(v) : d ? h.rotate(v, String(l.nextCredential)) : h.revoke(v).pipe(f.as(null))));
+		if (p.isFailure(y)) return b(y.failure.code === "credential_rejected" ? 401 : 503, { error: y.failure.code });
+		if (y.success === null) return b(200, { revoked: !0 }, { "set-cookie": e({ secure: x.secure ?? !0 }) });
+		let { subject: C, value: w, setCookie: D, deviceCredential: k } = y.success;
+		return b(200, {
+			subject: C,
+			session: w,
+			...k === void 0 ? {} : { deviceCredential: k }
+		}, { "set-cookie": D });
+	};
+	return {
+		...y({
+			name: "@voltro/plugin-auth#guest",
+			baseName: "@voltro/plugin-auth",
+			permissions: ["store:write"],
+			extendSchema: { tables: [...l, u] },
+			declaredEnv: x.secret === void 0 ? [{
+				name: "VOLTRO_SESSION_SECRET",
+				required: !0,
+				secret: !0,
+				generate: "base64url",
+				description: "Signs this project's ordinary and guest sessions"
+			}] : [],
+			privacy: { collects: [{
+				category: "identifiers",
+				linked: !0,
+				tracking: !1,
+				purposes: ["app-functionality"]
+			}] },
+			subjectPrivacy: {
+				tables: [...l, u].map((e) => e.tableName),
+				kinds: ["guest"],
+				erasePhase: "identity"
+			},
+			onErase: (e, t) => k(t).pipe(f.flatMap((t) => t.erase(e)), f.asVoid),
+			onExport: (e, t) => k(t).pipe(f.flatMap((t) => t.export(e))),
+			httpRoutes: [{
+				method: "*",
+				path: S,
+				handle: A
+			}],
+			bindDataStore: (e) => {
+				E = e;
+			},
+			onActivate: () => f.sync(() => {
+				T();
+			}),
+			onDeactivate: () => f.sync(() => {
+				E = void 0;
+			})
+		}),
+		guest: { service: () => {
+			if (!E) throw Error("Guest lifecycle requires the bound app DataStore");
+			return O(E);
+		} },
+		auth: { sessionStrategy: {
+			id: "voltro-guest",
+			resolve: async (e) => {
+				let t = _(e.headers);
+				if (!t) return { kind: "skip" };
+				let r = v(t, n(T()));
+				if (!r) return {
+					kind: "failed",
+					reason: "voltro session cookie failed verification"
+				};
+				if (r.subject.type !== "user" || r.subject.kind !== "guest") return { kind: "skip" };
+				let i = e.store ?? E;
+				if (!i) return {
+					kind: "failed",
+					reason: "guest session registry unavailable"
+				};
+				let a = await f.runPromise(f.result(O(i).isLive(r.subject)));
+				return p.isSuccess(a) && a.success ? {
+					kind: "matched",
+					subject: r.subject,
+					credentialExpiresAt: r.exp * 1e3
+				} : {
+					kind: "failed",
+					reason: "guest session revoked or expired"
+				};
+			}
+		} }
+	};
+};
+//#endregion
+export { x as guestAuthPlugin };

package/dist/guestSchema.js

@@ -0,0 +1,20 @@
+import { boolean as e, id as t, integer as n, table as r, text as i, timestamp as a } from "@voltro/database";
+//#region src/guestSchema.ts
+var o = r("authGuests", {
+	id: t(),
+	tenantId: i(),
+	upgradeable: e(),
+	expiresAt: a(),
+	createdAt: a(),
+	lastSeenAt: a()
+}).index(["tenantId"]), s = r("authGuestDevices", {
+	id: t(),
+	guestId: i(),
+	tenantId: i(),
+	secretHash: i().serverOnly(),
+	generation: n(),
+	expiresAt: a(),
+	createdAt: a()
+}).index(["guestId"]).index(["tenantId"]), c = [o, s];
+//#endregion
+export { s as authGuestDevicesTable, o as authGuestsTable, c as guestTables };

package/dist/guestSecrets.js

@@ -0,0 +1,10 @@
+import { sessionSecretsOf as e } from "./session.js";
+import { assertProductionSessionSecret as t } from "@voltro/protocol/session";
+//#region src/guestSecrets.ts
+var n = (n) => {
+	let r = e(n);
+	for (let e of [r.current, ...r.previous ? [r.previous] : []]) t({ VOLTRO_SESSION_SECRET: e.secret });
+	return n;
+};
+//#endregion
+export { n as validateGuestSecrets };

package/dist/guestService.js

@@ -0,0 +1,224 @@
+import { newAuthId as e } from "./userStore.js";
+import { dataStoreSessionRegistry as t, issueRegisteredSession as n } from "./sessionRegistry.js";
+import { validateGuestSecrets as r } from "./guestSecrets.js";
+import { parseGuestCredential as i } from "./guestCredential.js";
+import { createHash as a, randomBytes as o, timingSafeEqual as s } from "node:crypto";
+import { Data as c, Effect as l } from "effect";
+import { noteSigningLifetime as u } from "@voltro/protocol/session";
+import { and as d, eq as f } from "@voltro/database";
+//#region src/guestService.ts
+var p = class extends c.TaggedError("GuestAuthError") {}, m = "authGuests", h = "authGuestDevices", g = 86400, _ = () => new p({ code: "credential_rejected" }), v = (e) => a("sha256").update(e).digest("hex"), y = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : NaN, b = (e, t) => ({
+	table: e,
+	predicate: t,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), x = (e, t, n) => d(f(e, t), f("tenantId", n)), S = (e, t) => typeof e != "string" || !/^[a-f0-9]{64}$/.test(e) ? !1 : s(Buffer.from(e, "hex"), Buffer.from(v(t), "hex")), C = (e) => {
+	let t = i(e);
+	if (!t) throw _();
+	return t;
+}, w = (e) => l.tryPromise({
+	try: e,
+	catch: (e) => e instanceof p ? e : new p({ code: "store_unavailable" })
+}), T = (i, a) => {
+	if (!a.tenantId.trim()) throw Error("Guest authentication requires a server-owned tenant");
+	let s = a.ttlSeconds ?? 365 * g, c = a.sessionTtlSeconds ?? 7 * g;
+	if (![s, c].every((e) => Number.isSafeInteger(e) && e > 0 && e <= 3650 * g)) throw Error("Guest authentication lifetimes must be positive bounded whole seconds");
+	u("session", c * 1e3);
+	let l = a.now ?? Date.now, d = (e, t, n, r) => e.query(b(t, x(n, r, a.tenantId))), f = async (e, t, n) => {
+		let r = await e.update(m, t, { lastSeenAt: new Date(n) });
+		if (!r || r.tenantId !== a.tenantId) throw _();
+		return r;
+	}, T = async (e, t, n) => {
+		let r = C(t), i = await f(e, r.guestId, n), a = (await d(e, h, "id", r.deviceId))[0];
+		if (!a || a.guestId !== r.guestId || !S(a.secretHash, r.secret) || !(y(i.expiresAt) > n) || !(y(a.expiresAt) > n) || !Number.isSafeInteger(a.generation) || Number(a.generation) < 0) throw _();
+		return {
+			guest: i,
+			device: a,
+			parsed: r
+		};
+	}, E = async (e, i, o, s) => {
+		let l = Math.floor((Math.min(y(i.expiresAt), y(o.expiresAt)) - s) / 1e3);
+		if (l < 1) throw _();
+		let u = {
+			type: "user",
+			kind: "guest",
+			id: String(i.id),
+			tenantId: a.tenantId,
+			metadata: {
+				guestDeviceId: o.id,
+				guestDeviceGeneration: o.generation
+			}
+		}, d = await n(t(e), u, r(typeof a.secret == "function" ? a.secret() : a.secret), {
+			ttlSeconds: Math.min(c, l),
+			now: () => s,
+			...a.secure === void 0 ? {} : { secure: a.secure }
+		});
+		return {
+			...d,
+			subject: {
+				...u,
+				metadata: {
+					...u.metadata,
+					sessionId: d.sessionId
+				}
+			}
+		};
+	}, D = async (e, t) => {
+		for (let n of await d(e, "sessions", "userId", t)) await e.delete("sessions", String(n.id));
+	};
+	return {
+		create: () => w(async () => {
+			let t = l(), n = e("guest"), r = e("gdev"), c = o(32).toString("base64url"), u = {
+				id: n,
+				tenantId: a.tenantId,
+				upgradeable: a.upgradeable ?? !0,
+				expiresAt: new Date(t + s * 1e3),
+				createdAt: new Date(t),
+				lastSeenAt: new Date(t)
+			}, d = {
+				id: r,
+				guestId: n,
+				tenantId: a.tenantId,
+				secretHash: v(c),
+				generation: 0,
+				expiresAt: u.expiresAt,
+				createdAt: new Date(t)
+			};
+			return i.transactional(async (e) => (await e.insert(m, u), await e.insert(h, d), {
+				...await E(e, u, d, t),
+				deviceCredential: `${n}.${r}.${c}`
+			}));
+		}),
+		resume: (e) => w(async () => {
+			let t = l();
+			return i.transactional(async (n) => {
+				let { guest: r, device: i } = await T(n, e, t);
+				return E(n, r, i, t);
+			});
+		}),
+		prepareRotation: (e) => w(async () => {
+			r(typeof a.secret == "function" ? a.secret() : a.secret);
+			let t = l(), n = o(32).toString("base64url");
+			return i.transactional(async (r) => {
+				let { parsed: i } = await T(r, e, t);
+				return { deviceCredential: `${i.guestId}.${i.deviceId}.${n}` };
+			});
+		}),
+		rotate: (e, t) => w(async () => {
+			let n = l(), r = C(t);
+			return i.transactional(async (i) => {
+				let { guest: a, device: o, parsed: s } = await T(i, e, n);
+				if (r.guestId !== s.guestId || r.deviceId !== s.deviceId || r.secret === s.secret) throw _();
+				let c = Number(o.generation) + 1;
+				if (!Number.isSafeInteger(c)) throw _();
+				let l = await i.update(h, s.deviceId, {
+					secretHash: v(r.secret),
+					generation: c
+				});
+				if (!l) throw _();
+				return await D(i, s.guestId), {
+					...await E(i, a, l, n),
+					deviceCredential: t
+				};
+			});
+		}),
+		revoke: (e) => w(async () => {
+			let t = l();
+			await i.transactional(async (n) => {
+				let { parsed: r } = await T(n, e, t);
+				await n.delete(h, r.deviceId), await D(n, r.guestId);
+			});
+		}),
+		upgrade: (e, t) => w(async () => {
+			r(typeof a.secret == "function" ? a.secret() : a.secret);
+			let n = l();
+			return i.transactional(async (r) => {
+				let { guest: i, parsed: o } = await T(r, e, n);
+				if (i.upgradeable !== !0 && i.upgradeable !== 1) throw _();
+				if ((await d(r, "users", "id", o.guestId)).length !== 0) throw new p({ code: "upgrade_conflict" });
+				await D(r, o.guestId);
+				let s = await t({
+					store: r,
+					subjectId: o.guestId,
+					tenantId: a.tenantId,
+					createdAt: new Date(y(i.createdAt))
+				}), c = (await d(r, "users", "id", o.guestId))[0];
+				if (!c || c.id !== o.guestId || c.tenantId !== a.tenantId) throw new p({ code: "upgrade_conflict" });
+				for (let e of await d(r, h, "guestId", o.guestId)) await r.delete(h, String(e.id));
+				if (!await r.delete(m, o.guestId)) throw _();
+				return s;
+			});
+		}),
+		erase: (e) => w(async () => i.transactional(async (t) => {
+			let n = await t.update(m, e, { lastSeenAt: new Date(l()) });
+			if (!n) return !1;
+			if (n.tenantId !== a.tenantId) throw _();
+			for (let n of await d(t, h, "guestId", e)) await t.delete(h, String(n.id));
+			return await D(t, e), t.delete(m, e);
+		})),
+		mergeInto: (e, t, n) => w(async () => {
+			r(typeof a.secret == "function" ? a.secret() : a.secret);
+			let o = l();
+			if (typeof t != "string" || !t.trim()) throw _();
+			return i.transactional(async (r) => {
+				let { guest: i, parsed: s } = await T(r, e, o);
+				if (i.upgradeable !== !0 && i.upgradeable !== 1) throw _();
+				if (t === s.guestId) throw new p({ code: "upgrade_conflict" });
+				let c = await r.update("users", t, { updatedAt: new Date(o) });
+				if (!c || c.id !== t || c.tenantId !== a.tenantId || c.deactivatedAt !== null && c.deactivatedAt !== void 0 || (await d(r, m, "id", t)).length !== 0 || (await d(r, "users", "id", s.guestId)).length !== 0) throw _();
+				await D(r, s.guestId);
+				let l = await n({
+					store: r,
+					subjectId: s.guestId,
+					targetId: t,
+					tenantId: a.tenantId,
+					createdAt: new Date(y(i.createdAt))
+				}), u = (await d(r, "users", "id", t))[0];
+				if (!u || u.id !== t || u.tenantId !== a.tenantId || (await d(r, "users", "id", s.guestId)).length !== 0) throw new p({ code: "upgrade_conflict" });
+				for (let e of await d(r, h, "guestId", s.guestId)) await r.delete(h, String(e.id));
+				if (!await r.delete(m, s.guestId)) throw _();
+				return l;
+			});
+		}),
+		export: (e) => w(async () => {
+			let t = (await d(i, m, "id", e))[0];
+			if (!t) return null;
+			let n = await d(i, h, "guestId", e), r = await d(i, "sessions", "userId", e);
+			return {
+				subject: {
+					id: e,
+					tenantId: a.tenantId,
+					kind: "guest",
+					upgradeable: t.upgradeable === !0 || t.upgradeable === 1,
+					createdAt: y(t.createdAt),
+					expiresAt: y(t.expiresAt)
+				},
+				devices: n.map((e) => ({
+					id: String(e.id),
+					generation: Number(e.generation),
+					createdAt: y(e.createdAt),
+					expiresAt: y(e.expiresAt)
+				})),
+				sessions: r.map((e) => ({
+					id: String(e.id),
+					expiresAt: y(e.expiresAt)
+				}))
+			};
+		}),
+		isLive: (e) => w(async () => {
+			if (e.type !== "user" || e.kind !== "guest" || e.tenantId !== a.tenantId) return !1;
+			let t = e.metadata?.sessionId, n = e.metadata?.guestDeviceId, r = e.metadata?.guestDeviceGeneration;
+			if (typeof t != "string" || typeof n != "string" || !Number.isSafeInteger(r)) return !1;
+			let o = l(), s = (await d(i, m, "id", e.id))[0];
+			if (!s || !(y(s.expiresAt) > o)) return !1;
+			let c = (await d(i, h, "id", n))[0];
+			if (!c || c.guestId !== e.id || c.generation !== r || !(y(c.expiresAt) > o)) return !1;
+			let u = (await d(i, "sessions", "id", t))[0];
+			return u?.userId === e.id && y(u.expiresAt) > o;
+		})
+	};
+};
+//#endregion
+export { p as GuestAuthError, T as dataStoreGuestAuth };