@wtfalch/auth 0.1.0

package/dist/oidc.js

@@ -0,0 +1,128 @@
+import * as jose from 'jose';
+import * as client from 'openid-client';
+export const ORG_CLAIM = 'urn:zitadel:iam:user:resourceowner:id';
+export class Oidc {
+    options;
+    configuration = null;
+    jwks = null;
+    refreshing = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    config() {
+        if (!this.configuration) {
+            this.configuration = client
+                .discovery(new URL(this.options.issuer), this.options.clientId, { id_token_signed_response_alg: 'RS256' }, client.None(), { [client.customFetch]: (url, init) => this.options.fetch(url, init) })
+                .then((config) => {
+                if (config.serverMetadata().issuer !== this.options.issuer) {
+                    throw new Error(`@wtfalch/auth: discovered issuer ${config.serverMetadata().issuer} is not ${this.options.issuer}`);
+                }
+                return config;
+            })
+                .catch((error) => {
+                this.configuration = null;
+                throw error;
+            });
+        }
+        return this.configuration;
+    }
+    async keys() {
+        if (!this.jwks) {
+            const { jwks_uri } = (await this.config()).serverMetadata();
+            if (!jwks_uri)
+                throw new Error('@wtfalch/auth: the issuer publishes no jwks_uri');
+            this.jwks = jose.createRemoteJWKSet(new URL(jwks_uri), {
+                // jose's default 30s would reject tokens signed with a freshly rotated key for that long
+                cooldownDuration: 5_000,
+                [jose.customFetch]: (url, init) => this.options.fetch(url, init),
+            });
+        }
+        return this.jwks;
+    }
+    get redirectUri() {
+        return new URL(`${this.options.basePath}/callback`, this.options.appUrl);
+    }
+    async authorizationUrl(state, nonce, codeVerifier, { create = false } = {}) {
+        return client.buildAuthorizationUrl(await this.config(), {
+            ...(create ? { prompt: 'create' } : {}),
+            redirect_uri: this.redirectUri.href,
+            scope: [
+                'openid',
+                'email',
+                'profile',
+                'offline_access',
+                `urn:zitadel:iam:org:id:${this.options.organizationId}`,
+                'urn:zitadel:iam:user:resourceowner',
+            ].join(' '),
+            state,
+            nonce,
+            code_challenge: await client.calculatePKCECodeChallenge(codeVerifier),
+            code_challenge_method: 'S256',
+        });
+    }
+    async exchange(callbackParams, transaction) {
+        // The library derives redirect_uri from this URL, and behind a proxy the request's own URL is not the registered one.
+        const current = new URL(this.redirectUri);
+        current.search = callbackParams.toString();
+        const response = await client.authorizationCodeGrant(await this.config(), current, {
+            expectedState: transaction.state,
+            expectedNonce: transaction.nonce,
+            pkceCodeVerifier: transaction.codeVerifier,
+            idTokenExpected: true,
+        });
+        return this.tokensFrom(response);
+    }
+    // Parallel requests holding the same refresh token share one grant; the issuer rotates it, so a second grant would fail.
+    refresh(refreshToken) {
+        let pending = this.refreshing.get(refreshToken);
+        if (!pending) {
+            pending = this.config()
+                .then((config) => client.refreshTokenGrant(config, refreshToken))
+                .then((response) => this.tokensFrom(response, refreshToken))
+                .finally(() => this.refreshing.delete(refreshToken));
+            this.refreshing.set(refreshToken, pending);
+        }
+        return pending;
+    }
+    tokensFrom(response, previousRefreshToken) {
+        const claims = response.claims();
+        if (!response.id_token || !claims) {
+            throw new AuthError('exchange', 'the issuer returned no id token');
+        }
+        this.assertOrganization(claims);
+        return {
+            idToken: response.id_token,
+            refreshToken: response.refresh_token ?? previousRefreshToken,
+            claims,
+        };
+    }
+    async verify(idToken) {
+        const { payload } = await jose.jwtVerify(idToken, await this.keys(), {
+            issuer: this.options.issuer,
+            audience: this.options.clientId,
+            algorithms: ['RS256'],
+            clockTolerance: 60,
+        });
+        // ZITADEL puts the project in aud as well, so azp has to name us. Same rule openid-client applies on exchange.
+        if (Array.isArray(payload.aud) &&
+            payload.aud.length !== 1 &&
+            payload.azp !== this.options.clientId) {
+            throw new AuthError('exchange', 'the token was authorised for another party');
+        }
+        this.assertOrganization(payload);
+        return payload;
+    }
+    assertOrganization(claims) {
+        if (claims[ORG_CLAIM] !== this.options.organizationId) {
+            throw new AuthError('organization', `the token's organisation ${String(claims[ORG_CLAIM])} is not this app's`);
+        }
+    }
+}
+export class AuthError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = 'AuthError';
+    }
+}

package/dist/redirect.d.ts

@@ -0,0 +1,2 @@
+/** A path on this app, or the fallback. Refuses absolute, scheme-relative and backslash forms. */
+export declare function safeNextPath(next: string | null | undefined, fallback: string): string;

package/dist/redirect.js

@@ -0,0 +1,16 @@
+/** A path on this app, or the fallback. Refuses absolute, scheme-relative and backslash forms. */
+export function safeNextPath(next, fallback) {
+    if (!next || !next.startsWith('/') || next.startsWith('//') || next.startsWith('/\\')) {
+        return fallback;
+    }
+    let url;
+    try {
+        url = new URL(next, 'https://app.invalid');
+    }
+    catch {
+        return fallback;
+    }
+    if (url.origin !== 'https://app.invalid')
+        return fallback;
+    return `${url.pathname}${url.search}`;
+}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@wtfalch/auth",
+  "version": "0.1.0",
+  "description": "Sign in against auth.wtfalch.dev from a Next.js app.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/wtfalch/auth",
+    "directory": "packages/auth"
+  },
+  "type": "module",
+  "files": ["dist"],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "default": "./dist/next.js"
+    }
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "prepack": "pnpm build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "jose": "^6.2.10",
+    "openid-client": "6.8.7"
+  },
+  "peerDependencies": {
+    "next": ">=15.0.0"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "@types/react": "^19",
+    "@wtfalch/auth-broker": "workspace:*",
+    "next": "^16",
+    "playwright-core": "^1.62.1",
+    "react": "^19",
+    "typescript": "^5.9.0",
+    "vitest": "^4.1.6"
+  }
+}