@wtfalch/auth 0.4.1 → 0.6.0

package/dist/cookies.js

@@ -4,6 +4,13 @@ const SESSION = 'wtfalch_auth';
 const TRANSACTION = 'wtfalch_auth_tx';
 const LINK = 'wtfalch_auth_link';
 const TRANSACTION_TTL = 10 * 60;
+/**
+ * A namespace session handle lives as long as a browser will keep a cookie.
+ * It grants nothing by itself: the server record decides, and slides its own
+ * expiry. Refreshing never sets it again, which is what stops a late response
+ * from putting back a cookie the person has since replaced.
+ */
+const HANDLE_TTL = 400 * 24 * 60 * 60;
 export function sessionCookieName(options) {
     return options.secure ? `__Host-${SESSION}` : SESSION;
 }
@@ -25,6 +32,37 @@ export async function openSession(options, value) {
 export function clearSession(options) {
     return setCookie(sessionCookieName(options), '', 0, options.secure);
 }
+/** The namespace session cookie: a random handle to a server record, nothing else. */
+export async function sealHandle(options, sid) {
+    const value = await seal(options, 'handle', { sid }, HANDLE_TTL);
+    return setCookie(sessionCookieName(options), value, HANDLE_TTL, options.secure);
+}
+export async function openHandle(options, value) {
+    const payload = await open(options, 'handle', value);
+    return payload && typeof payload.sid === 'string' ? payload.sid : null;
+}
+export function sealRecord(options, payload) {
+    return seal(options, 'record', payload, HANDLE_TTL);
+}
+/** The tokens, if this payload was sealed for this record under this binding. */
+export async function openRecord(options, key, value) {
+    const payload = await open(options, 'record', value);
+    return payload && payload.k === key && typeof payload.idt === 'string' ? payload : null;
+}
+/** The binding digest a namespace record is filed under. */
+export async function contextDigest(options) {
+    if (!options.namespace)
+        throw new Error('@wtfalch/auth: no namespace binding');
+    return digest(options.namespace.context);
+}
+/** SHA-256, base64url. */
+export async function digest(value) {
+    const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
+    return btoa(String.fromCharCode(...new Uint8Array(bytes)))
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replace(/=+$/, '');
+}
 export async function sealTransaction(options, payload) {
     const value = await seal(options, 'transaction', payload, TRANSACTION_TTL);
     return setCookie(transactionCookieName(options), value, TRANSACTION_TTL, options.secure);
@@ -61,11 +99,21 @@ export async function openLink(options, value) {
 export function clearLink(options) {
     return setCookie(linkCookieName(options), '', 0, options.secure);
 }
+// A different audience also prevents old static consumers from accepting a
+// namespace cookie. Hashing keeps the encrypted session below browser limits.
+async function audience(options, kind) {
+    if (!options.namespace)
+        return kind;
+    return `${kind}:namespace:1:${await digest(options.namespace.context)}`;
+}
 async function seal(options, kind, payload, ttl) {
-    return new EncryptJWT(payload)
+    return new EncryptJWT({
+        ...payload,
+        ...(options.namespace ? { ns: options.namespace.namespaceId } : {}),
+    })
         .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
         .setIssuer(options.appUrl.origin)
-        .setAudience(kind)
+        .setAudience(await audience(options, kind))
         .setIssuedAt()
         .setExpirationTime(Math.floor(Date.now() / 1000) + ttl)
         .encrypt(options.cookieKey);
@@ -76,7 +124,7 @@ async function open(options, kind, value) {
     try {
         const { payload } = await jwtDecrypt(value, options.cookieKey, {
             issuer: options.appUrl.origin,
-            audience: kind,
+            audience: await audience(options, kind),
             contentEncryptionAlgorithms: ['A256GCM'],
             keyManagementAlgorithms: ['dir'],
         });

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, type NewUser, type ReadResult, type ResetError, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, createAuth, } from './auth.js';
 export { type AuthOptions, ISSUER } from './config.js';
 export type { SetCookie } from './cookies.js';
+export type { SessionRecord, SessionStore, SessionUpdate } from './sessions.js';
 export { BrokerError } from './broker.js';
 export { AuthError, type AuthErrorReason, ORG_CLAIM } from './oidc.js';
 export { safeNextPath } from './redirect.js';

package/dist/namespace-browser.d.ts

@@ -0,0 +1,4 @@
+import type { BrowserAuth, BrowserAuthOptions } from './browser.js';
+import { type NamespaceSelection } from './namespaces.js';
+/** Isolated implementation: legacy storage and callback behavior stay unchanged. */
+export declare function createNamespaceBrowserAuth(options: BrowserAuthOptions, selection: NamespaceSelection): BrowserAuth;

package/dist/namespace-browser.js

@@ -0,0 +1,232 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { resolveNamespaceContext } from './namespaces.js';
+import { safeNextPath } from './redirect.js';
+const OWNER = 'urn:zitadel:iam:user:resourceowner:id';
+const ttl = 10 * 60_000;
+const random = () => base64url(crypto.getRandomValues(new Uint8Array(32)));
+function base64url(bytes) {
+    return btoa(String.fromCharCode(...bytes))
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replace(/=+$/, '');
+}
+function read(storage, key) {
+    try {
+        return JSON.parse(storage.getItem(key) ?? 'null');
+    }
+    catch {
+        return null;
+    }
+}
+/** Isolated implementation: legacy storage and callback behavior stay unchanged. */
+export function createNamespaceBrowserAuth(options, selection) {
+    const origin = options.origin ?? window.location.origin;
+    if (origin !== window.location.origin)
+        throw new Error('Namespace client must run on its registered origin');
+    const redirectUri = `${origin}${options.callbackPath ?? '/auth/callback'}`;
+    const binding = resolveNamespaceContext(selection, {
+        issuer: options.issuer,
+        clientId: options.clientId,
+        appOrigin: origin,
+        redirectUri,
+    });
+    const scope = options.scope ?? 'openid email profile offline_access';
+    const scopes = new Set(scope.split(/\s+/).filter(Boolean));
+    if (!scopes.has('openid') ||
+        [...scopes].some((s) => s.startsWith('urn:zitadel:iam:org:') &&
+            s !== `urn:zitadel:iam:org:id:${binding.organizationId}`))
+        throw new Error('Namespace client has conflicting organization scopes');
+    scopes.add(`urn:zitadel:iam:org:id:${binding.organizationId}`);
+    scopes.add('urn:zitadel:iam:user:resourceowner');
+    const prefix = `wtfalch.auth.namespace.v1:${binding.context}`;
+    const tokenKey = `${prefix}:token`;
+    const txKey = `${prefix}:transaction`;
+    const triedKey = `${prefix}:tried`;
+    // Shared across tabs and namespace clients in this service, never a token.
+    const serviceKey = `wtfalch.auth.active.v1:${JSON.stringify([origin, binding.serviceId, binding.deploymentId])}`;
+    const pendingKey = `${serviceKey}:pending`;
+    const pending = () => read(localStorage, pendingKey);
+    const ownsPending = (state) => {
+        const current = pending();
+        return current?.context === binding.context && current.state === state;
+    };
+    let keys;
+    const active = () => read(localStorage, serviceKey);
+    const stored = () => read(sessionStorage, tokenKey);
+    const accountChanged = () => {
+        const current = active();
+        const session = stored();
+        return (!!current &&
+            (current.context !== binding.context ||
+                (!!session && current.generation !== session.generation)));
+    };
+    const currentSession = () => {
+        const session = stored();
+        const current = active();
+        return session &&
+            current?.context === binding.context &&
+            current.generation === session.generation &&
+            typeof session.accessToken === 'string' &&
+            Number.isFinite(session.expiresAt) &&
+            session.expiresAt - 60_000 > Date.now()
+            ? session
+            : null;
+    };
+    const silentSignInAvailable = () => !accountChanged() && !currentSession() && !sessionStorage.getItem(triedKey);
+    const authorize = async (prompt, returnTo) => {
+        const transaction = {
+            context: binding.context,
+            state: random(),
+            nonce: random(),
+            verifier: random(),
+            returnTo: safeNextPath(returnTo, '/'),
+            started: Date.now(),
+        };
+        // Storage is required in namespace mode. If unavailable, fail before leaving.
+        sessionStorage.setItem(txKey, JSON.stringify(transaction));
+        localStorage.setItem(pendingKey, JSON.stringify({ context: binding.context, state: transaction.state }));
+        const url = new URL(`${binding.issuer}/oauth/v2/authorize`);
+        const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(transaction.verifier));
+        url.search = new URLSearchParams({
+            client_id: binding.clientId,
+            redirect_uri: redirectUri,
+            response_type: 'code',
+            scope: [...scopes].join(' '),
+            state: transaction.state,
+            nonce: transaction.nonce,
+            code_challenge: base64url(new Uint8Array(digest)),
+            code_challenge_method: 'S256',
+            ...(prompt ? { prompt } : {}),
+        }).toString();
+        if (!ownsPending(transaction.state))
+            throw new Error('Another sign-in replaced this attempt');
+        window.location.assign(url.href);
+    };
+    const completeSignIn = async (search = window.location.search) => {
+        const reject = () => ({
+            kind: 'error',
+            error: 'This sign-in no longer matches the active namespace; start again',
+        });
+        const params = new URLSearchParams(search);
+        const tx = read(sessionStorage, txKey);
+        if (!tx ||
+            tx.context !== binding.context ||
+            typeof tx.state !== 'string' ||
+            typeof tx.nonce !== 'string' ||
+            typeof tx.verifier !== 'string' ||
+            typeof tx.returnTo !== 'string' ||
+            !Number.isFinite(tx.started) ||
+            tx.started > Date.now() ||
+            Date.now() - tx.started > ttl ||
+            params.getAll('state').length !== 1 ||
+            params.get('state') !== tx.state ||
+            !ownsPending(tx.state) ||
+            (params.has('iss') && params.get('iss') !== binding.issuer))
+            return reject();
+        sessionStorage.removeItem(txKey);
+        const error = params.get('error');
+        if (error) {
+            localStorage.removeItem(pendingKey);
+            return ['login_required', 'interaction_required', 'consent_required'].includes(error)
+                ? { kind: 'silent-refused' }
+                : { kind: 'error', error: 'The issuer refused this sign-in' };
+        }
+        if (params.getAll('code').length !== 1 || !params.get('code'))
+            return reject();
+        try {
+            const response = await fetch(`${binding.issuer}/oauth/v2/token`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    client_id: binding.clientId,
+                    redirect_uri: redirectUri,
+                    code: params.get('code'),
+                    code_verifier: tx.verifier,
+                }),
+                signal: AbortSignal.timeout(15_000),
+            });
+            if (!response.ok)
+                return reject();
+            const token = await response.json();
+            if (typeof token.access_token !== 'string' ||
+                !token.access_token ||
+                typeof token.id_token !== 'string' ||
+                !Number.isFinite(token.expires_in) ||
+                token.expires_in <= 0)
+                return reject();
+            if (!keys) {
+                const discoveryResponse = await fetch(`${binding.issuer}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(15_000) });
+                if (!discoveryResponse.ok)
+                    return reject();
+                const discovery = await discoveryResponse.json();
+                if (discovery.issuer !== binding.issuer || typeof discovery.jwks_uri !== 'string')
+                    return reject();
+                const jwks = new URL(discovery.jwks_uri);
+                if (jwks.origin !== binding.issuer || jwks.username || jwks.password || jwks.hash)
+                    return reject();
+                keys = createRemoteJWKSet(jwks);
+            }
+            const { payload } = await jwtVerify(token.id_token, keys, {
+                issuer: binding.issuer,
+                audience: binding.clientId,
+                algorithms: ['RS256'],
+                requiredClaims: ['exp', 'iat', 'sub'],
+                clockTolerance: 60,
+            });
+            if (payload.nonce !== tx.nonce ||
+                payload[OWNER] !== binding.organizationId ||
+                (payload.azp !== undefined && payload.azp !== binding.clientId) ||
+                (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== binding.clientId))
+                return reject();
+            // A different tab may have switched or signed out during the network calls.
+            if (!ownsPending(tx.state))
+                return reject();
+            const generation = random();
+            const session = {
+                accessToken: token.access_token,
+                expiresAt: Date.now() + token.expires_in * 1000,
+                namespaceId: binding.namespaceId,
+                bindingId: binding.id,
+                generation,
+            };
+            localStorage.setItem(serviceKey, JSON.stringify({ context: binding.context, generation }));
+            localStorage.removeItem(pendingKey);
+            sessionStorage.setItem(tokenKey, JSON.stringify(session));
+            sessionStorage.removeItem(triedKey);
+            return { kind: 'signed-in', session, returnTo: safeNextPath(tx.returnTo, '/') };
+        }
+        catch {
+            return reject();
+        }
+    };
+    return {
+        accountChanged,
+        currentSession,
+        silentSignInAvailable,
+        completeSignIn,
+        async trySilentSignIn(returnTo = window.location.pathname) {
+            if (!silentSignInAvailable())
+                return false;
+            sessionStorage.setItem(triedKey, '1');
+            await authorize('none', returnTo);
+            return true;
+        },
+        async signIn(returnTo = window.location.pathname) {
+            sessionStorage.removeItem(triedKey);
+            await authorize(undefined, returnTo);
+        },
+        forget() {
+            sessionStorage.removeItem(tokenKey);
+            sessionStorage.removeItem(txKey);
+            sessionStorage.setItem(triedKey, '1');
+            // Cancel this namespace's pending exchange even when another account is active.
+            if (pending()?.context === binding.context)
+                localStorage.removeItem(pendingKey);
+            // A stale X tab must not sign Y out.
+            if (!active() || active()?.context === binding.context) {
+                localStorage.setItem(serviceKey, JSON.stringify({ context: binding.context, generation: random() }));
+            }
+        },
+    };
+}

package/dist/namespace-server.d.ts

@@ -0,0 +1,12 @@
+import { type NamespaceRegistry, type NamespaceSelection } from './namespaces.js';
+/** Resolve a shared callback from its authenticated transaction, never a URL
+ * namespace hint. The second open checks the entire current registry binding. */
+export declare function resolveNamespaceCallback(input: {
+    registry: NamespaceRegistry;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+    cookieSecret: string;
+    cookieHeader: string | null;
+    basePath?: string;
+}): Promise<NamespaceSelection | null>;

package/dist/namespace-server.js

@@ -0,0 +1,64 @@
+import { jwtDecrypt } from 'jose';
+import { resolveOptions } from './config.js';
+import { cookieFrom, openTransaction, transactionCookieName } from './cookies.js';
+import { parseNamespaceRegistry, } from './namespaces.js';
+/** Resolve a shared callback from its authenticated transaction, never a URL
+ * namespace hint. The second open checks the entire current registry binding. */
+export async function resolveNamespaceCallback(input) {
+    try {
+        const registry = parseNamespaceRegistry(input.registry);
+        const callback = new URL(`${input.basePath ?? '/auth'}/callback`, input.appOrigin).href;
+        const candidates = registry.namespaces.filter((n) => n.status === 'active' &&
+            n.services.some((s) => s.serviceId === input.serviceId &&
+                s.deploymentId === input.deploymentId &&
+                s.appOrigin === input.appOrigin &&
+                s.redirectUris.includes(callback)));
+        const optionsFor = (namespace) => {
+            const service = namespace.services.find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
+            if (!service)
+                throw new Error('Missing service');
+            const selection = {
+                registry,
+                namespaceId: namespace.id,
+                serviceId: input.serviceId,
+                deploymentId: input.deploymentId,
+            };
+            return resolveOptions({
+                namespace: selection,
+                issuer: registry.issuer,
+                appUrl: input.appOrigin,
+                clientId: service.clientId,
+                organizationId: namespace.organizationId,
+                cookieSecret: input.cookieSecret,
+                basePath: input.basePath,
+                afterLogout: service.postLogoutRedirectUris[0],
+            });
+        };
+        if (!candidates.length)
+            return null;
+        const first = optionsFor(candidates[0]);
+        const value = cookieFrom(input.cookieHeader, transactionCookieName(first));
+        if (!value)
+            return null;
+        // No identity is returned based on this hint alone. It only chooses which
+        // current binding's audience to validate next, so decryption is bounded.
+        const { payload } = await jwtDecrypt(value, first.cookieKey, {
+            issuer: input.appOrigin,
+            requiredClaims: ['exp', 'iat', 'aud'],
+            contentEncryptionAlgorithms: ['A256GCM'],
+            keyManagementAlgorithms: ['dir'],
+        });
+        const namespace = candidates.find((n) => n.id === payload.ns);
+        if (!namespace || !(await openTransaction(optionsFor(namespace), value)))
+            return null;
+        return {
+            registry,
+            namespaceId: namespace.id,
+            serviceId: input.serviceId,
+            deploymentId: input.deploymentId,
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/namespace-session.d.ts

@@ -0,0 +1,42 @@
+import type { JWTPayload } from 'jose';
+import { type Broker } from './broker.js';
+import type { ResolvedOptions } from './config.js';
+import { type SetCookie } from './cookies.js';
+import { type Oidc, type Tokens } from './oidc.js';
+/** How long a binding status answer is trusted. The propagation bound for a suspension. */
+export declare const STATUS_FRESH_MS = 60000;
+/** How long the last good answer carries on while the service cannot be asked. */
+export declare const STATUS_STALE_IF_ERROR_MS: number;
+export type SessionRead = {
+    kind: 'none';
+}
+/** A cookie for another binding, revision or format. */
+ | {
+    kind: 'changed';
+}
+/** The binding is suspended, or its status cannot be confirmed. */
+ | {
+    kind: 'unavailable';
+} | {
+    kind: 'user';
+    claims: JWTPayload;
+};
+/**
+ * Server-side sessions for namespace mode. The cookie holds a random handle;
+ * the record holds the tokens. Refreshes are serialised across replicas by a
+ * lease on the record, so the issuer's refresh-token rotation cannot log a
+ * person out when two requests arrive together, and no refresh ever sets a
+ * cookie.
+ */
+export declare function namespaceSessions(deps: {
+    options: () => ResolvedOptions;
+    oidc: () => Oidc;
+    broker: () => Broker;
+}): {
+    bindingActive: () => Promise<boolean>;
+    create: (tokens: Tokens) => Promise<SetCookie>;
+    end: (value: string | undefined) => Promise<"ended" | "changed" | "none">;
+    read: (value: string | undefined, force?: boolean) => Promise<SessionRead>;
+    revokeSubject: (subject: string) => Promise<number>;
+    keyOf: (value: string | undefined) => Promise<string | null>;
+};