@voltro/plugin-auth 0.86.0 → 0.87.0

package/dist/guestSecrets.js

@@ -0,0 +1,10 @@
+import { sessionSecretsOf as e } from "./session.js";
+import { assertProductionSessionSecret as t } from "@voltro/protocol/session";
+//#region src/guestSecrets.ts
+var n = (n) => {
+	let r = e(n);
+	for (let e of [r.current, ...r.previous ? [r.previous] : []]) t({ VOLTRO_SESSION_SECRET: e.secret });
+	return n;
+};
+//#endregion
+export { n as validateGuestSecrets };

package/dist/guestService.js

@@ -0,0 +1,224 @@
+import { newAuthId as e } from "./userStore.js";
+import { dataStoreSessionRegistry as t, issueRegisteredSession as n } from "./sessionRegistry.js";
+import { validateGuestSecrets as r } from "./guestSecrets.js";
+import { parseGuestCredential as i } from "./guestCredential.js";
+import { createHash as a, randomBytes as o, timingSafeEqual as s } from "node:crypto";
+import { Data as c, Effect as l } from "effect";
+import { noteSigningLifetime as u } from "@voltro/protocol/session";
+import { and as d, eq as f } from "@voltro/database";
+//#region src/guestService.ts
+var p = class extends c.TaggedError("GuestAuthError") {}, m = "authGuests", h = "authGuestDevices", g = 86400, _ = () => new p({ code: "credential_rejected" }), v = (e) => a("sha256").update(e).digest("hex"), y = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : NaN, b = (e, t) => ({
+	table: e,
+	predicate: t,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), x = (e, t, n) => d(f(e, t), f("tenantId", n)), S = (e, t) => typeof e != "string" || !/^[a-f0-9]{64}$/.test(e) ? !1 : s(Buffer.from(e, "hex"), Buffer.from(v(t), "hex")), C = (e) => {
+	let t = i(e);
+	if (!t) throw _();
+	return t;
+}, w = (e) => l.tryPromise({
+	try: e,
+	catch: (e) => e instanceof p ? e : new p({ code: "store_unavailable" })
+}), T = (i, a) => {
+	if (!a.tenantId.trim()) throw Error("Guest authentication requires a server-owned tenant");
+	let s = a.ttlSeconds ?? 365 * g, c = a.sessionTtlSeconds ?? 7 * g;
+	if (![s, c].every((e) => Number.isSafeInteger(e) && e > 0 && e <= 3650 * g)) throw Error("Guest authentication lifetimes must be positive bounded whole seconds");
+	u("session", c * 1e3);
+	let l = a.now ?? Date.now, d = (e, t, n, r) => e.query(b(t, x(n, r, a.tenantId))), f = async (e, t, n) => {
+		let r = await e.update(m, t, { lastSeenAt: new Date(n) });
+		if (!r || r.tenantId !== a.tenantId) throw _();
+		return r;
+	}, T = async (e, t, n) => {
+		let r = C(t), i = await f(e, r.guestId, n), a = (await d(e, h, "id", r.deviceId))[0];
+		if (!a || a.guestId !== r.guestId || !S(a.secretHash, r.secret) || !(y(i.expiresAt) > n) || !(y(a.expiresAt) > n) || !Number.isSafeInteger(a.generation) || Number(a.generation) < 0) throw _();
+		return {
+			guest: i,
+			device: a,
+			parsed: r
+		};
+	}, E = async (e, i, o, s) => {
+		let l = Math.floor((Math.min(y(i.expiresAt), y(o.expiresAt)) - s) / 1e3);
+		if (l < 1) throw _();
+		let u = {
+			type: "user",
+			kind: "guest",
+			id: String(i.id),
+			tenantId: a.tenantId,
+			metadata: {
+				guestDeviceId: o.id,
+				guestDeviceGeneration: o.generation
+			}
+		}, d = await n(t(e), u, r(typeof a.secret == "function" ? a.secret() : a.secret), {
+			ttlSeconds: Math.min(c, l),
+			now: () => s,
+			...a.secure === void 0 ? {} : { secure: a.secure }
+		});
+		return {
+			...d,
+			subject: {
+				...u,
+				metadata: {
+					...u.metadata,
+					sessionId: d.sessionId
+				}
+			}
+		};
+	}, D = async (e, t) => {
+		for (let n of await d(e, "sessions", "userId", t)) await e.delete("sessions", String(n.id));
+	};
+	return {
+		create: () => w(async () => {
+			let t = l(), n = e("guest"), r = e("gdev"), c = o(32).toString("base64url"), u = {
+				id: n,
+				tenantId: a.tenantId,
+				upgradeable: a.upgradeable ?? !0,
+				expiresAt: new Date(t + s * 1e3),
+				createdAt: new Date(t),
+				lastSeenAt: new Date(t)
+			}, d = {
+				id: r,
+				guestId: n,
+				tenantId: a.tenantId,
+				secretHash: v(c),
+				generation: 0,
+				expiresAt: u.expiresAt,
+				createdAt: new Date(t)
+			};
+			return i.transactional(async (e) => (await e.insert(m, u), await e.insert(h, d), {
+				...await E(e, u, d, t),
+				deviceCredential: `${n}.${r}.${c}`
+			}));
+		}),
+		resume: (e) => w(async () => {
+			let t = l();
+			return i.transactional(async (n) => {
+				let { guest: r, device: i } = await T(n, e, t);
+				return E(n, r, i, t);
+			});
+		}),
+		prepareRotation: (e) => w(async () => {
+			r(typeof a.secret == "function" ? a.secret() : a.secret);
+			let t = l(), n = o(32).toString("base64url");
+			return i.transactional(async (r) => {
+				let { parsed: i } = await T(r, e, t);
+				return { deviceCredential: `${i.guestId}.${i.deviceId}.${n}` };
+			});
+		}),
+		rotate: (e, t) => w(async () => {
+			let n = l(), r = C(t);
+			return i.transactional(async (i) => {
+				let { guest: a, device: o, parsed: s } = await T(i, e, n);
+				if (r.guestId !== s.guestId || r.deviceId !== s.deviceId || r.secret === s.secret) throw _();
+				let c = Number(o.generation) + 1;
+				if (!Number.isSafeInteger(c)) throw _();
+				let l = await i.update(h, s.deviceId, {
+					secretHash: v(r.secret),
+					generation: c
+				});
+				if (!l) throw _();
+				return await D(i, s.guestId), {
+					...await E(i, a, l, n),
+					deviceCredential: t
+				};
+			});
+		}),
+		revoke: (e) => w(async () => {
+			let t = l();
+			await i.transactional(async (n) => {
+				let { parsed: r } = await T(n, e, t);
+				await n.delete(h, r.deviceId), await D(n, r.guestId);
+			});
+		}),
+		upgrade: (e, t) => w(async () => {
+			r(typeof a.secret == "function" ? a.secret() : a.secret);
+			let n = l();
+			return i.transactional(async (r) => {
+				let { guest: i, parsed: o } = await T(r, e, n);
+				if (i.upgradeable !== !0 && i.upgradeable !== 1) throw _();
+				if ((await d(r, "users", "id", o.guestId)).length !== 0) throw new p({ code: "upgrade_conflict" });
+				await D(r, o.guestId);
+				let s = await t({
+					store: r,
+					subjectId: o.guestId,
+					tenantId: a.tenantId,
+					createdAt: new Date(y(i.createdAt))
+				}), c = (await d(r, "users", "id", o.guestId))[0];
+				if (!c || c.id !== o.guestId || c.tenantId !== a.tenantId) throw new p({ code: "upgrade_conflict" });
+				for (let e of await d(r, h, "guestId", o.guestId)) await r.delete(h, String(e.id));
+				if (!await r.delete(m, o.guestId)) throw _();
+				return s;
+			});
+		}),
+		erase: (e) => w(async () => i.transactional(async (t) => {
+			let n = await t.update(m, e, { lastSeenAt: new Date(l()) });
+			if (!n) return !1;
+			if (n.tenantId !== a.tenantId) throw _();
+			for (let n of await d(t, h, "guestId", e)) await t.delete(h, String(n.id));
+			return await D(t, e), t.delete(m, e);
+		})),
+		mergeInto: (e, t, n) => w(async () => {
+			r(typeof a.secret == "function" ? a.secret() : a.secret);
+			let o = l();
+			if (typeof t != "string" || !t.trim()) throw _();
+			return i.transactional(async (r) => {
+				let { guest: i, parsed: s } = await T(r, e, o);
+				if (i.upgradeable !== !0 && i.upgradeable !== 1) throw _();
+				if (t === s.guestId) throw new p({ code: "upgrade_conflict" });
+				let c = await r.update("users", t, { updatedAt: new Date(o) });
+				if (!c || c.id !== t || c.tenantId !== a.tenantId || c.deactivatedAt !== null && c.deactivatedAt !== void 0 || (await d(r, m, "id", t)).length !== 0 || (await d(r, "users", "id", s.guestId)).length !== 0) throw _();
+				await D(r, s.guestId);
+				let l = await n({
+					store: r,
+					subjectId: s.guestId,
+					targetId: t,
+					tenantId: a.tenantId,
+					createdAt: new Date(y(i.createdAt))
+				}), u = (await d(r, "users", "id", t))[0];
+				if (!u || u.id !== t || u.tenantId !== a.tenantId || (await d(r, "users", "id", s.guestId)).length !== 0) throw new p({ code: "upgrade_conflict" });
+				for (let e of await d(r, h, "guestId", s.guestId)) await r.delete(h, String(e.id));
+				if (!await r.delete(m, s.guestId)) throw _();
+				return l;
+			});
+		}),
+		export: (e) => w(async () => {
+			let t = (await d(i, m, "id", e))[0];
+			if (!t) return null;
+			let n = await d(i, h, "guestId", e), r = await d(i, "sessions", "userId", e);
+			return {
+				subject: {
+					id: e,
+					tenantId: a.tenantId,
+					kind: "guest",
+					upgradeable: t.upgradeable === !0 || t.upgradeable === 1,
+					createdAt: y(t.createdAt),
+					expiresAt: y(t.expiresAt)
+				},
+				devices: n.map((e) => ({
+					id: String(e.id),
+					generation: Number(e.generation),
+					createdAt: y(e.createdAt),
+					expiresAt: y(e.expiresAt)
+				})),
+				sessions: r.map((e) => ({
+					id: String(e.id),
+					expiresAt: y(e.expiresAt)
+				}))
+			};
+		}),
+		isLive: (e) => w(async () => {
+			if (e.type !== "user" || e.kind !== "guest" || e.tenantId !== a.tenantId) return !1;
+			let t = e.metadata?.sessionId, n = e.metadata?.guestDeviceId, r = e.metadata?.guestDeviceGeneration;
+			if (typeof t != "string" || typeof n != "string" || !Number.isSafeInteger(r)) return !1;
+			let o = l(), s = (await d(i, m, "id", e.id))[0];
+			if (!s || !(y(s.expiresAt) > o)) return !1;
+			let c = (await d(i, h, "id", n))[0];
+			if (!c || c.guestId !== e.id || c.generation !== r || !(y(c.expiresAt) > o)) return !1;
+			let u = (await d(i, "sessions", "id", t))[0];
+			return u?.userId === e.id && y(u.expiresAt) > o;
+		})
+	};
+};
+//#endregion
+export { p as GuestAuthError, T as dataStoreGuestAuth };