@wtfalch/auth 0.15.0 → 0.19.0

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { type NextRequest, NextResponse } from 'next/server';
-import { type Auth, type AuthRequest, type ChangePasswordResult, type DeletePasskeyResult, type EmailChangeResult, type GateRules, type Intent, type MaxAge, type NewUser, type Passkey, type PasskeyRegistrationResult, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollStatus, type ResetError, type SignInError, type SignUpError, type User } from './auth.js';
+import { type Auth, type AuthRequest, type ChangePasswordResult, type DeletePasskeyResult, type EmailChangeResult, type GateRules, type Intent, type MaxAge, type NewUser, type Passkey, type PasskeyRegistrationResult, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollStatus, type ResetError, type SetNewPasswordError, type SetNewPasswordResult, type SignInError, type SignUpError, type User } from './auth.js';
 import type { AuthEvent, AuthOptions } from './config.js';
 import type { SessionRecord } from './sessions.js';
 type SearchParams = Record<string, string | string[] | undefined>;
@@ -57,12 +57,31 @@ export interface NextAuth {
         password: string;
     }) => Promise<{
         error: SignInError;
+    } | {
+        error: 'password_change_required';
+        changeToken: string;
+    }>;
+    /**
+     * For a server action, after `signIn` returned `password_change_required`:
+     * sets the person's own password with no old one, signs them in and
+     * redirects. Returns the error otherwise.
+     */
+    setNewPassword: (input: {
+        authRequestId: string;
+        changeToken: string;
+        newPassword: string;
+    }) => Promise<{
+        error: SetNewPasswordError;
     }>;
     signUp: (input: {
         authRequestId: string;
     } & NewUser) => Promise<{
         error: SignUpError;
         message: string;
+    } | {
+        error: 'password_change_required';
+        changeToken: string;
+        message: string;
     }>;
     /** Emails a fresh verification link. Never says whether the address exists. */
     resendVerification: (email: string, next?: string) => Promise<void>;
@@ -138,6 +157,9 @@ export interface NextAuth {
         credential: unknown;
     }) => Promise<{
         error: SignInError;
+    } | {
+        error: 'password_change_required';
+        changeToken: string;
     }>;
     /**
      * Starts a QR sign-in from a server action or route handler, setting the
@@ -157,4 +179,4 @@ export interface NextAuth {
     }>;
 }
 export declare function nextAuth(options: AuthOptions): NextAuth;
-export type { Auth, AuthEvent, AuthOptions, AuthRequest, ChangePasswordResult, DeletePasskeyResult, EmailChangeResult, GateRules, Intent, MaxAge, NewUser, Passkey, PasskeyRegistrationResult, PasskeyRegistrationStart, PasskeySignInStart, Prompt, QrPollStatus, SessionRecord, User, };
+export type { Auth, AuthEvent, AuthOptions, AuthRequest, ChangePasswordResult, DeletePasskeyResult, EmailChangeResult, GateRules, Intent, MaxAge, NewUser, Passkey, PasskeyRegistrationResult, PasskeyRegistrationStart, PasskeySignInStart, SetNewPasswordError, SetNewPasswordResult, Prompt, QrPollStatus, SessionRecord, User, };

package/dist/next.js

@@ -138,10 +138,7 @@ export function nextAuth(options) {
         const request = await requestFromCookies();
         const { location, cookies: set } = await auth.complete(callbackUrl, request.headers.get('cookie'), request.headers);
         for (const c of set) {
-            if (c.value)
-                store.set(c.name, c.value, c.attributes);
-            else
-                store.delete({ name: c.name, path: '/' });
+            store.set(c.name, c.value, c.attributes);
         }
         const url = new URL(location);
         redirect(`${url.pathname}${url.search}`);
@@ -184,6 +181,9 @@ export function nextAuth(options) {
                 redirect(result.redirectTo);
             return finish(result.redirectTo);
         }
+        if (result.error === 'password_change_required') {
+            return { error: result.error, changeToken: result.changeToken };
+        }
         return { error: result.error };
     };
     const resetPassword = async (input) => {
@@ -192,10 +192,7 @@ export function nextAuth(options) {
             return { error: result.error, message: result.message };
         const store = await cookies();
         for (const c of result.cookies) {
-            if (c.value)
-                store.set(c.name, c.value, c.attributes);
-            else
-                store.delete({ name: c.name, path: '/' });
+            store.set(c.name, c.value, c.attributes);
         }
         if (result.hosted)
             redirect(result.location);
@@ -209,6 +206,23 @@ export function nextAuth(options) {
                 redirect(result.redirectTo);
             return finish(result.redirectTo);
         }
+        if (result.error === 'password_change_required') {
+            return { error: result.error, changeToken: result.changeToken };
+        }
+        return { error: result.error };
+    };
+    const setNewPassword = async (input) => {
+        // Named fields: a Server Action's argument is whatever the client sent.
+        const result = await auth.setNewPassword({
+            authRequestId: String(input?.authRequestId),
+            changeToken: String(input?.changeToken),
+            newPassword: String(input?.newPassword),
+        });
+        if (result.ok) {
+            if (result.hosted)
+                redirect(result.redirectTo);
+            return finish(result.redirectTo);
+        }
         return { error: result.error };
     };
     const signUp = async (input) => {
@@ -218,16 +232,16 @@ export function nextAuth(options) {
                 redirect(result.redirectTo);
             return finish(result.redirectTo);
         }
+        if (result.error === 'password_change_required') {
+            return { error: result.error, changeToken: result.changeToken, message: result.message };
+        }
         return { error: result.error, message: result.message };
     };
     const startQrSignIn = async () => {
         const { cookies: set, ...start } = await auth.startQrSignIn();
         const store = await cookies();
         for (const c of set) {
-            if (c.value)
-                store.set(c.name, c.value, c.attributes);
-            else
-                store.delete({ name: c.name, path: '/' });
+            store.set(c.name, c.value, c.attributes);
         }
         return start;
     };
@@ -235,10 +249,7 @@ export function nextAuth(options) {
         const { status, reason, cookies: set } = await auth.pollQrSignIn(await requestFromCookies());
         const store = await cookies();
         for (const c of set) {
-            if (c.value)
-                store.set(c.name, c.value, c.attributes);
-            else
-                store.delete({ name: c.name, path: '/' });
+            store.set(c.name, c.value, c.attributes);
         }
         return reason ? { status, reason } : { status };
     };
@@ -253,6 +264,7 @@ export function nextAuth(options) {
         requireFreshUser,
         authRequest,
         signIn,
+        setNewPassword,
         signUp,
         resendVerification: auth.resendVerification,
         requestPasswordReset: auth.requestPasswordReset,

package/dist/oidc.d.ts

@@ -44,7 +44,7 @@ export declare class Oidc {
     get redirectUri(): URL;
     authorizationUrl(state: string, nonce: string, codeVerifier: string, { create, prompt, maxAge, }?: {
         create?: boolean;
-        prompt?: 'select_account' | 'login';
+        prompt?: 'select_account' | 'login' | 'none';
         maxAge?: number;
     }): Promise<URL>;
     exchange(callbackParams: URLSearchParams, transaction: {
@@ -61,6 +61,7 @@ export declare class Oidc {
     endSessionUrl(idToken: string, postLogoutRedirectUri: string): Promise<URL | null>;
     private tokensFrom;
     verify(idToken: string): Promise<jose.JWTPayload>;
+    private assertIdentityClaims;
     private assertOrganization;
 }
 export type AuthErrorReason = 'expired' | 'state' | 'denied' | 'exchange' | 'organization' | 'cookie' | 'request' | 'account_changed' | 'unavailable'

package/dist/oidc.js

@@ -147,6 +147,7 @@ export class Oidc {
         if (!response.id_token || !claims) {
             throw new AuthError('exchange', 'the issuer returned no id token');
         }
+        this.assertIdentityClaims(claims);
         this.assertOrganization(claims);
         const expiresIn = response.expiresIn();
         return {
@@ -163,6 +164,7 @@ export class Oidc {
             audience: this.options.clientId,
             algorithms: ['RS256'],
             clockTolerance: 60,
+            requiredClaims: ['exp', 'iat', 'sub'],
         });
         // ZITADEL puts the project in aud as well, so azp has to name us. Same rule openid-client applies on exchange.
         if (Array.isArray(payload.aud) &&
@@ -170,9 +172,28 @@ export class Oidc {
             payload.azp !== this.options.clientId) {
             throw new AuthError('exchange', 'the token was authorised for another party');
         }
+        this.assertIdentityClaims(payload);
         this.assertOrganization(payload);
         return payload;
     }
+    // Both grant responses and stored/device tokens become a User. Keep their
+    // identity and time shapes consistent, including optional freshness claims.
+    assertIdentityClaims(claims) {
+        if (typeof claims.sub !== 'string' || claims.sub.length === 0) {
+            throw new AuthError('exchange', 'the id token has no valid subject');
+        }
+        for (const name of ['exp', 'iat']) {
+            if (typeof claims[name] !== 'number' || !Number.isFinite(claims[name])) {
+                throw new AuthError('exchange', `the id token has no valid ${name}`);
+            }
+        }
+        if (Object.hasOwn(claims, 'auth_time') &&
+            (typeof claims.auth_time !== 'number' ||
+                !Number.isFinite(claims.auth_time) ||
+                claims.auth_time < 0)) {
+            throw new AuthError('exchange', 'the id token has no valid auth_time');
+        }
+    }
     assertOrganization(claims) {
         if (claims[ORG_CLAIM] !== this.options.organizationId) {
             throw new AuthError('organization', `the token's organisation ${String(claims[ORG_CLAIM])} is not this app's`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.15.0",
-  "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
+  "version": "0.19.0",
+  "description": "Sign in against a self-hosted ZITADEL issuer: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/wtfalch/auth.git",
@@ -30,6 +30,10 @@
       "types": "./dist/namespaces.d.ts",
       "default": "./dist/namespaces.js"
     },
+    "./names": {
+      "types": "./dist/names.d.ts",
+      "default": "./dist/names.js"
+    },
     "./namespace-server": {
       "types": "./dist/namespace-server.d.ts",
       "default": "./dist/namespace-server.js"
@@ -51,11 +55,14 @@
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "prepack": "pnpm build",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    "test": "vitest run",
+    "test:cookie-browser": "vitest run --config vitest.cookie-browser.config.ts"
   },
   "dependencies": {
     "jose": "^6.2.10",
-    "openid-client": "6.8.7"
+    "obscenity": "^0.4.6",
+    "openid-client": "6.8.7",
+    "reserved-usernames": "^1.1.6"
   },
   "peerDependencies": {
     "next": ">=15.0.0"