@voyant-travel/apps 0.1.0 → 0.2.0

package/dist/oauth-service.js

@@ -1,381 +0,0 @@
-import { ApiHttpError } from "@voyant-travel/hono";
-import { and, eq } from "drizzle-orm";
-import { computeAppConsent } from "./consent.js";
-import { APP_ACCESS_TOKEN_PREFIX, APP_AUTH_CODE_PREFIX, APP_REFRESH_TOKEN_PREFIX, constantTimeEqual, randomToken, sha256Hex, verifyPkceS256, } from "./oauth-crypto.js";
-import { appAccessCredentials, appAuditEvents, appCredentials, appGrants, appInstallations, appOAuthAuthorizationCodes, appOAuthRefreshTokens, appRedirectUris, appReleases, apps, } from "./schema.js";
-const CODE_TTL_MS = 5 * 60 * 1000;
-const OFFLINE_ACCESS_TTL_MS = 60 * 60 * 1000;
-const ONLINE_ACCESS_TTL_MS = 10 * 60 * 1000;
-const REFRESH_TTL_MS = 90 * 24 * 60 * 60 * 1000;
-export function createAppOAuthService(options) {
-    const now = () => options.now?.() ?? new Date();
-    async function authorize(db, input) {
-        assertState(input.state);
-        if (input.codeChallengeMethod !== "S256") {
-            throw oauthError("invalid_request", "PKCE S256 is required");
-        }
-        const release = await requireRelease(db, input.appId, input.releaseId);
-        await requireExactRedirectUri(db, input.appId, input.redirectUri);
-        const consent = computeAppConsent({
-            release,
-            accessCatalog: options.accessCatalog,
-            operatorGrantedScopes: input.operatorGrantedScopes,
-            grantedOptionalScopes: input.grantedOptionalScopes,
-        });
-        const installation = await ensureAuthorizedInstallation(db, {
-            appId: input.appId,
-            releaseId: input.releaseId,
-            deploymentId: options.deploymentId,
-            actorId: input.actorId,
-            grantedScopes: consent.grantedScopes,
-            deniedOptionalScopes: consent.deniedOptionalScopes,
-        });
-        const code = randomToken(APP_AUTH_CODE_PREFIX);
-        const expiresAt = new Date(now().getTime() + CODE_TTL_MS);
-        await db.insert(appOAuthAuthorizationCodes).values({
-            appId: input.appId,
-            installationId: installation.id,
-            releaseId: input.releaseId,
-            deploymentId: options.deploymentId,
-            codeHash: sha256Hex(code),
-            stateHash: sha256Hex(input.state),
-            redirectUri: input.redirectUri,
-            codeChallenge: input.codeChallenge,
-            codeChallengeMethod: input.codeChallengeMethod,
-            requestedScopes: [...consent.requiredScopes, ...consent.optionalScopes].sort(),
-            grantedScopes: consent.grantedScopes,
-            deniedOptionalScopes: consent.deniedOptionalScopes,
-            actorId: input.actorId,
-            expiresAt,
-        });
-        await audit(db, installation, input.actorId, "consent", "oauth.consent.recorded", {
-            grantedScopes: consent.grantedScopes,
-            deniedOptionalScopes: consent.deniedOptionalScopes,
-        });
-        return { code, state: input.state, redirectUri: input.redirectUri, expiresAt };
-    }
-    async function token(db, input) {
-        await authenticateClient(db, input.clientId, input.clientSecret);
-        if (input.grantType === "authorization_code")
-            return exchangeCode(db, input);
-        if (input.grantType === "refresh_token")
-            return refresh(db, input);
-        return exchangeActorToken(db, input);
-    }
-    async function resolveAccessToken(db, rawToken) {
-        if (!rawToken.startsWith(APP_ACCESS_TOKEN_PREFIX))
-            return null;
-        const [credential] = await db
-            .select()
-            .from(appAccessCredentials)
-            .where(and(eq(appAccessCredentials.credentialHash, sha256Hex(rawToken)), eq(appAccessCredentials.status, "active")))
-            .limit(1);
-        if (!credential || (credential.expiresAt && credential.expiresAt <= now()))
-            return null;
-        const installation = await selectInstallation(db, credential.installationId);
-        if (!installation || !isInstallationUsable(installation, credential.generation))
-            return null;
-        const scopes = await grantedScopes(db, installation.id);
-        return {
-            callerType: "app",
-            actor: "staff",
-            audience: "staff",
-            appId: installation.appId,
-            appInstallationId: installation.id,
-            appReleaseId: installation.releaseId,
-            appCredentialGeneration: credential.generation,
-            appTokenMode: credential.tokenMode,
-            appViewerId: credential.viewerId ?? undefined,
-            scopes,
-        };
-    }
-    async function revokeInstallationCredentials(db, installationId, actorId) {
-        return db.transaction(async (tx) => {
-            const installation = await requireInstallation(tx, installationId);
-            const generation = installation.credentialGeneration + 1;
-            await tx
-                .update(appInstallations)
-                .set({ credentialGeneration: generation, updatedAt: now() })
-                .where(eq(appInstallations.id, installation.id));
-            await tx
-                .update(appAccessCredentials)
-                .set({ status: "revoked", deactivatedAt: now() })
-                .where(eq(appAccessCredentials.installationId, installation.id));
-            await tx
-                .update(appOAuthRefreshTokens)
-                .set({ status: "revoked", revokedAt: now() })
-                .where(eq(appOAuthRefreshTokens.installationId, installation.id));
-            await audit(tx, installation, actorId, "credential", "credential.revoked", { generation });
-            return { installationId: installation.id, generation };
-        });
-    }
-    return { authorize, token, resolveAccessToken, revokeInstallationCredentials };
-    async function exchangeCode(db, input) {
-        return db.transaction(async (tx) => {
-            const codeHash = sha256Hex(input.code);
-            const [code] = await tx
-                .select()
-                .from(appOAuthAuthorizationCodes)
-                .where(eq(appOAuthAuthorizationCodes.codeHash, codeHash))
-                .for("update")
-                .limit(1);
-            if (!code || code.consumedAt || code.expiresAt <= now()) {
-                throw oauthError("invalid_grant", "Authorization code is invalid, expired, or consumed");
-            }
-            if (code.appId !== input.clientId || code.redirectUri !== input.redirectUri) {
-                throw oauthError("invalid_grant", "Authorization code was issued to different client data");
-            }
-            if (!verifyPkceS256(input.codeVerifier, code.codeChallenge)) {
-                throw oauthError("invalid_grant", "PKCE verifier does not match the authorization code");
-            }
-            await tx
-                .update(appOAuthAuthorizationCodes)
-                .set({ consumedAt: now() })
-                .where(eq(appOAuthAuthorizationCodes.id, code.id));
-            const installation = await requireInstallation(tx, code.installationId);
-            assertActiveInstallation(installation);
-            const tokens = await mintTokens(tx, installation, code.actorId, null, code.grantedScopes);
-            await audit(tx, installation, code.actorId, "token", "oauth.code.exchanged", {});
-            return tokens;
-        });
-    }
-    async function refresh(db, input) {
-        return db.transaction(async (tx) => {
-            const [tokenRow] = await tx
-                .select()
-                .from(appOAuthRefreshTokens)
-                .where(eq(appOAuthRefreshTokens.tokenHash, sha256Hex(input.refreshToken)))
-                .for("update")
-                .limit(1);
-            if (tokenRow?.status !== "active" || isExpired(tokenRow.expiresAt)) {
-                throw oauthError("invalid_grant", "Refresh token is invalid");
-            }
-            const installation = await requireInstallation(tx, tokenRow.installationId);
-            assertTokenClient(installation, input.clientId);
-            assertActiveInstallation(installation);
-            if (installation.credentialGeneration !== tokenRow.generation) {
-                throw oauthError("invalid_grant", "Refresh token generation was revoked");
-            }
-            await tx
-                .update(appOAuthRefreshTokens)
-                .set({ status: "inactive", revokedAt: now() })
-                .where(eq(appOAuthRefreshTokens.id, tokenRow.id));
-            const tokens = await mintTokens(tx, installation, "app", null, await grantedScopes(tx, installation.id), {
-                rotatedFromId: tokenRow.id,
-            });
-            await audit(tx, installation, "app", "token", "oauth.refresh.rotated", {
-                generation: installation.credentialGeneration,
-            });
-            return tokens;
-        });
-    }
-    async function exchangeActorToken(db, input) {
-        const installation = await requireInstallation(db, input.installationId);
-        assertTokenClient(installation, input.clientId);
-        assertActiveInstallation(installation);
-        const grants = await grantedScopes(db, installation.id);
-        const contextual = input.contextualScopes ?? grants;
-        const scopes = intersectAppTokenScopes(grants, input.viewerScopes, contextual);
-        const accessToken = randomToken(APP_ACCESS_TOKEN_PREFIX);
-        const expiresAt = new Date(now().getTime() + ONLINE_ACCESS_TTL_MS);
-        await db.insert(appAccessCredentials).values({
-            installationId: installation.id,
-            generation: installation.credentialGeneration,
-            tokenMode: "online",
-            credentialHash: sha256Hex(accessToken),
-            encryptedMetadata: { scopeCount: scopes.length },
-            status: "active",
-            actorId: input.viewerId,
-            viewerId: input.viewerId,
-            expiresAt,
-        });
-        await audit(db, installation, input.viewerId, "token", "oauth.actor_token.exchanged", {
-            grantedScopes: scopes,
-        });
-        return tokenResponse(accessToken, null, expiresAt, scopes, "online");
-    }
-    async function mintTokens(db, installation, actorId, viewerId, scopes, refreshOptions = {}) {
-        const accessToken = randomToken(APP_ACCESS_TOKEN_PREFIX);
-        const refreshToken = randomToken(APP_REFRESH_TOKEN_PREFIX);
-        const accessExpiresAt = new Date(now().getTime() + OFFLINE_ACCESS_TTL_MS);
-        const refreshExpiresAt = new Date(now().getTime() + REFRESH_TTL_MS);
-        const generation = installation.credentialGeneration;
-        await db.insert(appAccessCredentials).values({
-            installationId: installation.id,
-            generation,
-            tokenMode: "offline",
-            credentialHash: sha256Hex(accessToken),
-            encryptedMetadata: { scopeCount: scopes.length },
-            status: "active",
-            actorId,
-            viewerId,
-            expiresAt: accessExpiresAt,
-        });
-        await db.insert(appOAuthRefreshTokens).values({
-            installationId: installation.id,
-            tokenHash: sha256Hex(refreshToken),
-            generation,
-            rotatedFromId: refreshOptions.rotatedFromId,
-            expiresAt: refreshExpiresAt,
-        });
-        return tokenResponse(accessToken, refreshToken, accessExpiresAt, scopes, "offline");
-    }
-    function isExpired(expiresAt) {
-        return Boolean(expiresAt && expiresAt <= now());
-    }
-}
-function tokenResponse(accessToken, refreshToken, expiresAt, scopes, tokenMode) {
-    return {
-        accessToken,
-        tokenType: "Bearer",
-        expiresIn: Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1000)),
-        scope: scopes.join(" "),
-        tokenMode,
-        ...(refreshToken ? { refreshToken } : {}),
-    };
-}
-async function authenticateClient(db, appId, clientSecret) {
-    const [secret] = await db
-        .select()
-        .from(appCredentials)
-        .where(and(eq(appCredentials.appId, appId), eq(appCredentials.kind, "client_secret")))
-        .limit(1);
-    if (!secret)
-        return;
-    if (!clientSecret || !secret.kmsKeyRef.startsWith("sha256:")) {
-        throw oauthError("invalid_client", "Client authentication failed", 401);
-    }
-    const expected = secret.kmsKeyRef.slice("sha256:".length);
-    if (!constantTimeEqual(sha256Hex(clientSecret), expected)) {
-        throw oauthError("invalid_client", "Client authentication failed", 401);
-    }
-}
-async function requireRelease(db, appId, releaseId) {
-    const [release] = await db
-        .select()
-        .from(appReleases)
-        .where(and(eq(appReleases.id, releaseId), eq(appReleases.appId, appId)))
-        .limit(1);
-    if (!release)
-        throw oauthError("invalid_request", "App release not found", 404);
-    return release;
-}
-async function requireExactRedirectUri(db, appId, redirectUri) {
-    const [row] = await db
-        .select()
-        .from(appRedirectUris)
-        .where(and(eq(appRedirectUris.appId, appId), eq(appRedirectUris.redirectUri, redirectUri)))
-        .limit(1);
-    if (!row)
-        throw oauthError("invalid_request", "Redirect URI is not registered for this app");
-}
-async function ensureAuthorizedInstallation(db, input) {
-    return db.transaction(async (tx) => {
-        const [app] = await tx.select().from(apps).where(eq(apps.id, input.appId)).limit(1);
-        if (!app)
-            throw oauthError("invalid_request", "App registration not found", 404);
-        const [existing] = await tx
-            .select()
-            .from(appInstallations)
-            .where(and(eq(appInstallations.deploymentId, input.deploymentId), eq(appInstallations.appId, input.appId)))
-            .limit(1);
-        const installation = existing ??
-            (await tx
-                .insert(appInstallations)
-                .values({
-                appId: input.appId,
-                deploymentId: input.deploymentId,
-                releaseId: input.releaseId,
-                status: "active",
-                namespace: app.platformNamespace,
-                installedBy: input.actorId,
-                authorizedAt: new Date(),
-                activatedAt: new Date(),
-            })
-                .returning())[0];
-        if (!installation)
-            throw oauthError("server_error", "Could not create installation", 500);
-        for (const scope of input.grantedScopes) {
-            await tx
-                .insert(appGrants)
-                .values({
-                installationId: installation.id,
-                scope,
-                status: "granted",
-                optional: false,
-                grantedAt: new Date(),
-            })
-                .onConflictDoUpdate({
-                target: [appGrants.installationId, appGrants.scope],
-                set: { status: "granted", grantedAt: new Date(), revokedAt: null },
-            });
-        }
-        for (const scope of input.deniedOptionalScopes) {
-            await tx
-                .insert(appGrants)
-                .values({ installationId: installation.id, scope, status: "optional", optional: true })
-                .onConflictDoUpdate({
-                target: [appGrants.installationId, appGrants.scope],
-                set: { status: "optional", optional: true },
-            });
-        }
-        return installation;
-    });
-}
-async function requireInstallation(db, installationId) {
-    const installation = await selectInstallation(db, installationId);
-    if (!installation)
-        throw oauthError("invalid_grant", "App installation not found", 404);
-    return installation;
-}
-async function selectInstallation(db, installationId) {
-    const [installation] = await db
-        .select()
-        .from(appInstallations)
-        .where(eq(appInstallations.id, installationId))
-        .limit(1);
-    return installation ?? null;
-}
-async function grantedScopes(db, installationId) {
-    const rows = await db
-        .select({ scope: appGrants.scope })
-        .from(appGrants)
-        .where(and(eq(appGrants.installationId, installationId), eq(appGrants.status, "granted")))
-        .orderBy(appGrants.scope);
-    return rows.map((row) => row.scope);
-}
-function assertActiveInstallation(installation) {
-    if (installation.status !== "active") {
-        throw oauthError("invalid_grant", "App installation is not active");
-    }
-}
-function isInstallationUsable(installation, generation) {
-    return installation?.status === "active" && installation.credentialGeneration === generation;
-}
-function assertTokenClient(installation, clientId) {
-    if (installation.appId !== clientId) {
-        throw oauthError("invalid_grant", "Token belongs to a different app");
-    }
-}
-export function intersectAppTokenScopes(...sets) {
-    const [first = [], ...rest] = sets;
-    return first.filter((scope) => rest.every((set) => set.includes(scope))).sort();
-}
-function assertState(state) {
-    if (!state.trim())
-        throw oauthError("invalid_request", "OAuth state is required");
-}
-function oauthError(error, description, status = 400) {
-    return new ApiHttpError(description, { status, code: error });
-}
-async function audit(db, installation, actorId, kind, action, details) {
-    await db.insert(appAuditEvents).values({
-        installationId: installation.id,
-        appId: installation.appId,
-        deploymentId: installation.deploymentId,
-        actorId,
-        kind,
-        action,
-        details,
-    });
-}

package/dist/oauth-service.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/oauth-service.test.js

@@ -1,8 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { intersectAppTokenScopes } from "./oauth-service.js";
-describe("app OAuth online token scope intersection", () => {
-    it("never exceeds either app grants, viewer grants, or contextual restrictions", () => {
-        expect(intersectAppTokenScopes(["bookings:read", "invoices:read"], ["bookings:read", "customers:read"], ["bookings:read", "invoices:read"])).toEqual(["bookings:read"]);
-        expect(intersectAppTokenScopes(["bookings:read"], ["bookings:read", "invoices:read"], ["bookings:read", "invoices:read"])).toEqual(["bookings:read"]);
-    });
-});

package/migrations/20260717143000_app_oauth_authorization.sql

@@ -1,47 +0,0 @@
-ALTER TYPE "public"."app_audit_event_kind" ADD VALUE IF NOT EXISTS 'consent';--> statement-breakpoint
-ALTER TYPE "public"."app_audit_event_kind" ADD VALUE IF NOT EXISTS 'token';--> statement-breakpoint
-CREATE TYPE "public"."app_access_token_mode" AS ENUM('offline', 'online');--> statement-breakpoint
-ALTER TABLE "app_installations" ADD COLUMN "credential_generation" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
-ALTER TABLE "app_access_credentials" ADD COLUMN "token_mode" "app_access_token_mode" DEFAULT 'offline' NOT NULL;--> statement-breakpoint
-ALTER TABLE "app_access_credentials" ADD COLUMN "actor_id" text;--> statement-breakpoint
-ALTER TABLE "app_access_credentials" ADD COLUMN "viewer_id" text;--> statement-breakpoint
-DROP INDEX "public"."uidx_app_access_credentials_generation";--> statement-breakpoint
-CREATE INDEX "idx_app_access_credentials_generation" ON "app_access_credentials" USING btree ("installation_id","token_mode","generation");--> statement-breakpoint
-CREATE TABLE "app_oauth_authorization_codes" (
-	"id" text PRIMARY KEY NOT NULL,
-	"app_id" text NOT NULL,
-	"installation_id" text NOT NULL,
-	"release_id" text NOT NULL,
-	"deployment_id" text NOT NULL,
-	"code_hash" text NOT NULL,
-	"state_hash" text NOT NULL,
-	"redirect_uri" text NOT NULL,
-	"code_challenge" text NOT NULL,
-	"code_challenge_method" text NOT NULL,
-	"requested_scopes" jsonb NOT NULL,
-	"granted_scopes" jsonb NOT NULL,
-	"denied_optional_scopes" jsonb NOT NULL,
-	"actor_id" text NOT NULL,
-	"expires_at" timestamp with time zone NOT NULL,
-	"consumed_at" timestamp with time zone,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL
-);--> statement-breakpoint
-CREATE TABLE "app_oauth_refresh_tokens" (
-	"id" text PRIMARY KEY NOT NULL,
-	"installation_id" text NOT NULL,
-	"token_hash" text NOT NULL,
-	"generation" integer NOT NULL,
-	"status" "app_access_credential_status" DEFAULT 'active' NOT NULL,
-	"rotated_from_id" text,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
-	"expires_at" timestamp with time zone,
-	"revoked_at" timestamp with time zone
-);--> statement-breakpoint
-ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_authorization_codes_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_authorization_codes_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_authorization_codes_release_id_app_releases_id_fk" FOREIGN KEY ("release_id") REFERENCES "public"."app_releases"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "app_oauth_refresh_tokens" ADD CONSTRAINT "app_oauth_refresh_tokens_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-CREATE UNIQUE INDEX "uidx_app_oauth_codes_hash" ON "app_oauth_authorization_codes" USING btree ("code_hash");--> statement-breakpoint
-CREATE INDEX "idx_app_oauth_codes_installation" ON "app_oauth_authorization_codes" USING btree ("installation_id","expires_at");--> statement-breakpoint
-CREATE UNIQUE INDEX "uidx_app_oauth_refresh_tokens_hash" ON "app_oauth_refresh_tokens" USING btree ("token_hash");--> statement-breakpoint
-CREATE INDEX "idx_app_oauth_refresh_tokens_installation" ON "app_oauth_refresh_tokens" USING btree ("installation_id","status");