@wtfalch/auth 0.5.0 → 0.7.0

package/dist/namespace-browser.js

@@ -0,0 +1,232 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { resolveNamespaceContext } from './namespaces.js';
+import { safeNextPath } from './redirect.js';
+const OWNER = 'urn:zitadel:iam:user:resourceowner:id';
+const ttl = 10 * 60_000;
+const random = () => base64url(crypto.getRandomValues(new Uint8Array(32)));
+function base64url(bytes) {
+    return btoa(String.fromCharCode(...bytes))
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replace(/=+$/, '');
+}
+function read(storage, key) {
+    try {
+        return JSON.parse(storage.getItem(key) ?? 'null');
+    }
+    catch {
+        return null;
+    }
+}
+/** Isolated implementation: legacy storage and callback behavior stay unchanged. */
+export function createNamespaceBrowserAuth(options, selection) {
+    const origin = options.origin ?? window.location.origin;
+    if (origin !== window.location.origin)
+        throw new Error('Namespace client must run on its registered origin');
+    const redirectUri = `${origin}${options.callbackPath ?? '/auth/callback'}`;
+    const binding = resolveNamespaceContext(selection, {
+        issuer: options.issuer,
+        clientId: options.clientId,
+        appOrigin: origin,
+        redirectUri,
+    });
+    const scope = options.scope ?? 'openid email profile offline_access';
+    const scopes = new Set(scope.split(/\s+/).filter(Boolean));
+    if (!scopes.has('openid') ||
+        [...scopes].some((s) => s.startsWith('urn:zitadel:iam:org:') &&
+            s !== `urn:zitadel:iam:org:id:${binding.organizationId}`))
+        throw new Error('Namespace client has conflicting organization scopes');
+    scopes.add(`urn:zitadel:iam:org:id:${binding.organizationId}`);
+    scopes.add('urn:zitadel:iam:user:resourceowner');
+    const prefix = `wtfalch.auth.namespace.v1:${binding.context}`;
+    const tokenKey = `${prefix}:token`;
+    const txKey = `${prefix}:transaction`;
+    const triedKey = `${prefix}:tried`;
+    // Shared across tabs and namespace clients in this service, never a token.
+    const serviceKey = `wtfalch.auth.active.v1:${JSON.stringify([origin, binding.serviceId, binding.deploymentId])}`;
+    const pendingKey = `${serviceKey}:pending`;
+    const pending = () => read(localStorage, pendingKey);
+    const ownsPending = (state) => {
+        const current = pending();
+        return current?.context === binding.context && current.state === state;
+    };
+    let keys;
+    const active = () => read(localStorage, serviceKey);
+    const stored = () => read(sessionStorage, tokenKey);
+    const accountChanged = () => {
+        const current = active();
+        const session = stored();
+        return (!!current &&
+            (current.context !== binding.context ||
+                (!!session && current.generation !== session.generation)));
+    };
+    const currentSession = () => {
+        const session = stored();
+        const current = active();
+        return session &&
+            current?.context === binding.context &&
+            current.generation === session.generation &&
+            typeof session.accessToken === 'string' &&
+            Number.isFinite(session.expiresAt) &&
+            session.expiresAt - 60_000 > Date.now()
+            ? session
+            : null;
+    };
+    const silentSignInAvailable = () => !accountChanged() && !currentSession() && !sessionStorage.getItem(triedKey);
+    const authorize = async (prompt, returnTo) => {
+        const transaction = {
+            context: binding.context,
+            state: random(),
+            nonce: random(),
+            verifier: random(),
+            returnTo: safeNextPath(returnTo, '/'),
+            started: Date.now(),
+        };
+        // Storage is required in namespace mode. If unavailable, fail before leaving.
+        sessionStorage.setItem(txKey, JSON.stringify(transaction));
+        localStorage.setItem(pendingKey, JSON.stringify({ context: binding.context, state: transaction.state }));
+        const url = new URL(`${binding.issuer}/oauth/v2/authorize`);
+        const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(transaction.verifier));
+        url.search = new URLSearchParams({
+            client_id: binding.clientId,
+            redirect_uri: redirectUri,
+            response_type: 'code',
+            scope: [...scopes].join(' '),
+            state: transaction.state,
+            nonce: transaction.nonce,
+            code_challenge: base64url(new Uint8Array(digest)),
+            code_challenge_method: 'S256',
+            ...(prompt ? { prompt } : {}),
+        }).toString();
+        if (!ownsPending(transaction.state))
+            throw new Error('Another sign-in replaced this attempt');
+        window.location.assign(url.href);
+    };
+    const completeSignIn = async (search = window.location.search) => {
+        const reject = () => ({
+            kind: 'error',
+            error: 'This sign-in no longer matches the active namespace; start again',
+        });
+        const params = new URLSearchParams(search);
+        const tx = read(sessionStorage, txKey);
+        if (!tx ||
+            tx.context !== binding.context ||
+            typeof tx.state !== 'string' ||
+            typeof tx.nonce !== 'string' ||
+            typeof tx.verifier !== 'string' ||
+            typeof tx.returnTo !== 'string' ||
+            !Number.isFinite(tx.started) ||
+            tx.started > Date.now() ||
+            Date.now() - tx.started > ttl ||
+            params.getAll('state').length !== 1 ||
+            params.get('state') !== tx.state ||
+            !ownsPending(tx.state) ||
+            (params.has('iss') && params.get('iss') !== binding.issuer))
+            return reject();
+        sessionStorage.removeItem(txKey);
+        const error = params.get('error');
+        if (error) {
+            localStorage.removeItem(pendingKey);
+            return ['login_required', 'interaction_required', 'consent_required'].includes(error)
+                ? { kind: 'silent-refused' }
+                : { kind: 'error', error: 'The issuer refused this sign-in' };
+        }
+        if (params.getAll('code').length !== 1 || !params.get('code'))
+            return reject();
+        try {
+            const response = await fetch(`${binding.issuer}/oauth/v2/token`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    client_id: binding.clientId,
+                    redirect_uri: redirectUri,
+                    code: params.get('code'),
+                    code_verifier: tx.verifier,
+                }),
+                signal: AbortSignal.timeout(15_000),
+            });
+            if (!response.ok)
+                return reject();
+            const token = await response.json();
+            if (typeof token.access_token !== 'string' ||
+                !token.access_token ||
+                typeof token.id_token !== 'string' ||
+                !Number.isFinite(token.expires_in) ||
+                token.expires_in <= 0)
+                return reject();
+            if (!keys) {
+                const discoveryResponse = await fetch(`${binding.issuer}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(15_000) });
+                if (!discoveryResponse.ok)
+                    return reject();
+                const discovery = await discoveryResponse.json();
+                if (discovery.issuer !== binding.issuer || typeof discovery.jwks_uri !== 'string')
+                    return reject();
+                const jwks = new URL(discovery.jwks_uri);
+                if (jwks.origin !== binding.issuer || jwks.username || jwks.password || jwks.hash)
+                    return reject();
+                keys = createRemoteJWKSet(jwks);
+            }
+            const { payload } = await jwtVerify(token.id_token, keys, {
+                issuer: binding.issuer,
+                audience: binding.clientId,
+                algorithms: ['RS256'],
+                requiredClaims: ['exp', 'iat', 'sub'],
+                clockTolerance: 60,
+            });
+            if (payload.nonce !== tx.nonce ||
+                payload[OWNER] !== binding.organizationId ||
+                (payload.azp !== undefined && payload.azp !== binding.clientId) ||
+                (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== binding.clientId))
+                return reject();
+            // A different tab may have switched or signed out during the network calls.
+            if (!ownsPending(tx.state))
+                return reject();
+            const generation = random();
+            const session = {
+                accessToken: token.access_token,
+                expiresAt: Date.now() + token.expires_in * 1000,
+                namespaceId: binding.namespaceId,
+                bindingId: binding.id,
+                generation,
+            };
+            localStorage.setItem(serviceKey, JSON.stringify({ context: binding.context, generation }));
+            localStorage.removeItem(pendingKey);
+            sessionStorage.setItem(tokenKey, JSON.stringify(session));
+            sessionStorage.removeItem(triedKey);
+            return { kind: 'signed-in', session, returnTo: safeNextPath(tx.returnTo, '/') };
+        }
+        catch {
+            return reject();
+        }
+    };
+    return {
+        accountChanged,
+        currentSession,
+        silentSignInAvailable,
+        completeSignIn,
+        async trySilentSignIn(returnTo = window.location.pathname) {
+            if (!silentSignInAvailable())
+                return false;
+            sessionStorage.setItem(triedKey, '1');
+            await authorize('none', returnTo);
+            return true;
+        },
+        async signIn(returnTo = window.location.pathname) {
+            sessionStorage.removeItem(triedKey);
+            await authorize(undefined, returnTo);
+        },
+        forget() {
+            sessionStorage.removeItem(tokenKey);
+            sessionStorage.removeItem(txKey);
+            sessionStorage.setItem(triedKey, '1');
+            // Cancel this namespace's pending exchange even when another account is active.
+            if (pending()?.context === binding.context)
+                localStorage.removeItem(pendingKey);
+            // A stale X tab must not sign Y out.
+            if (!active() || active()?.context === binding.context) {
+                localStorage.setItem(serviceKey, JSON.stringify({ context: binding.context, generation: random() }));
+            }
+        },
+    };
+}

package/dist/namespace-server.d.ts

@@ -0,0 +1,12 @@
+import { type NamespaceRegistry, type NamespaceSelection } from './namespaces.js';
+/** Resolve a shared callback from its authenticated transaction, never a URL
+ * namespace hint. The second open checks the entire current registry binding. */
+export declare function resolveNamespaceCallback(input: {
+    registry: NamespaceRegistry;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+    cookieSecret: string;
+    cookieHeader: string | null;
+    basePath?: string;
+}): Promise<NamespaceSelection | null>;

package/dist/namespace-server.js

@@ -0,0 +1,68 @@
+import { jwtDecrypt } from 'jose';
+import { resolveOptions } from './config.js';
+import { cookieFrom, openTransaction, transactionCookieName } from './cookies.js';
+import { isWebService, parseNamespaceRegistry, } from './namespaces.js';
+/** Resolve a shared callback from its authenticated transaction, never a URL
+ * namespace hint. The second open checks the entire current registry binding. */
+export async function resolveNamespaceCallback(input) {
+    try {
+        const registry = parseNamespaceRegistry(input.registry);
+        const callback = new URL(`${input.basePath ?? '/auth'}/callback`, input.appOrigin).href;
+        const candidates = registry.namespaces.filter((n) => n.status === 'active' &&
+            n.services
+                .filter(isWebService)
+                .some((s) => s.serviceId === input.serviceId &&
+                s.deploymentId === input.deploymentId &&
+                s.appOrigin === input.appOrigin &&
+                s.redirectUris.includes(callback)));
+        const optionsFor = (namespace) => {
+            const service = namespace.services
+                .filter(isWebService)
+                .find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
+            if (!service)
+                throw new Error('Missing service');
+            const selection = {
+                registry,
+                namespaceId: namespace.id,
+                serviceId: input.serviceId,
+                deploymentId: input.deploymentId,
+            };
+            return resolveOptions({
+                namespace: selection,
+                issuer: registry.issuer,
+                appUrl: input.appOrigin,
+                clientId: service.clientId,
+                organizationId: namespace.organizationId,
+                cookieSecret: input.cookieSecret,
+                basePath: input.basePath,
+                afterLogout: service.postLogoutRedirectUris[0],
+            });
+        };
+        if (!candidates.length)
+            return null;
+        const first = optionsFor(candidates[0]);
+        const value = cookieFrom(input.cookieHeader, transactionCookieName(first));
+        if (!value)
+            return null;
+        // No identity is returned based on this hint alone. It only chooses which
+        // current binding's audience to validate next, so decryption is bounded.
+        const { payload } = await jwtDecrypt(value, first.cookieKey, {
+            issuer: input.appOrigin,
+            requiredClaims: ['exp', 'iat', 'aud'],
+            contentEncryptionAlgorithms: ['A256GCM'],
+            keyManagementAlgorithms: ['dir'],
+        });
+        const namespace = candidates.find((n) => n.id === payload.ns);
+        if (!namespace || !(await openTransaction(optionsFor(namespace), value)))
+            return null;
+        return {
+            registry,
+            namespaceId: namespace.id,
+            serviceId: input.serviceId,
+            deploymentId: input.deploymentId,
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/namespace-session.d.ts

@@ -0,0 +1,42 @@
+import type { JWTPayload } from 'jose';
+import { type Broker } from './broker.js';
+import type { ResolvedOptions } from './config.js';
+import { type SetCookie } from './cookies.js';
+import { type Oidc, type Tokens } from './oidc.js';
+/** How long a binding status answer is trusted. The propagation bound for a suspension. */
+export declare const STATUS_FRESH_MS = 60000;
+/** How long the last good answer carries on while the service cannot be asked. */
+export declare const STATUS_STALE_IF_ERROR_MS: number;
+export type SessionRead = {
+    kind: 'none';
+}
+/** A cookie for another binding, revision or format. */
+ | {
+    kind: 'changed';
+}
+/** The binding is suspended, or its status cannot be confirmed. */
+ | {
+    kind: 'unavailable';
+} | {
+    kind: 'user';
+    claims: JWTPayload;
+};
+/**
+ * Server-side sessions for namespace mode. The cookie holds a random handle;
+ * the record holds the tokens. Refreshes are serialised across replicas by a
+ * lease on the record, so the issuer's refresh-token rotation cannot log a
+ * person out when two requests arrive together, and no refresh ever sets a
+ * cookie.
+ */
+export declare function namespaceSessions(deps: {
+    options: () => ResolvedOptions;
+    oidc: () => Oidc;
+    broker: () => Broker;
+}): {
+    bindingActive: () => Promise<boolean>;
+    create: (tokens: Tokens) => Promise<SetCookie>;
+    end: (value: string | undefined) => Promise<"ended" | "changed" | "none">;
+    read: (value: string | undefined, force?: boolean) => Promise<SessionRead>;
+    revokeSubject: (subject: string) => Promise<number>;
+    keyOf: (value: string | undefined) => Promise<string | null>;
+};

package/dist/namespace-session.js

@@ -0,0 +1,278 @@
+import * as client from 'openid-client';
+import { BrokerError } from './broker.js';
+import { contextDigest, digest, openHandle, openRecord, sealHandle, sealRecord, } from './cookies.js';
+import { AuthError } from './oidc.js';
+/** How long a binding status answer is trusted. The propagation bound for a suspension. */
+export const STATUS_FRESH_MS = 60_000;
+/** How long the last good answer carries on while the service cannot be asked. */
+export const STATUS_STALE_IF_ERROR_MS = 5 * 60_000;
+const STATUS_RETRY_MS = 5_000;
+/**
+ * Twice openid-client's 30 second request timeout, so a slow but live refresh
+ * is never mistaken for a dead one and taken over mid-flight.
+ */
+const LEASE_SECONDS = 60;
+const WAIT_STEP_MS = 100;
+const WAIT_STEPS = 50;
+const now = () => Math.floor(Date.now() / 1000);
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Server-side sessions for namespace mode. The cookie holds a random handle;
+ * the record holds the tokens. Refreshes are serialised across replicas by a
+ * lease on the record, so the issuer's refresh-token rotation cannot log a
+ * person out when two requests arrive together, and no refresh ever sets a
+ * cookie.
+ */
+export function namespaceSessions(deps) {
+    const options = deps.options;
+    const store = () => {
+        const s = options().sessionStore;
+        if (!s)
+            throw new Error('@wtfalch/auth: namespace mode needs a sessionStore');
+        return s;
+    };
+    // ---- binding status -----------------------------------------------------
+    let status = null;
+    let retryAt = 0;
+    let pending = null;
+    // People whose sessions this instance has already ended for the current
+    // deactivation. Someone who leaves the list, by reactivation or by ageing
+    // out of the service's window, is forgotten, so a second deactivation
+    // ends their sessions again.
+    const ended = new Set();
+    const endDeactivated = async (revoked) => {
+        if (!Array.isArray(revoked))
+            return;
+        const current = new Set(revoked.filter((s) => typeof s === 'string' && !!s));
+        for (const subject of ended)
+            if (!current.has(subject))
+                ended.delete(subject);
+        for (const subject of current) {
+            if (ended.has(subject))
+                continue;
+            await revokeSubject(subject);
+            ended.add(subject);
+        }
+    };
+    const askService = async () => {
+        const namespace = options().namespace;
+        if (!namespace)
+            return false;
+        try {
+            const routed = await deps.broker().binding();
+            const active = routed.organizationId === namespace.organizationId &&
+                routed.clientIds.includes(namespace.clientId) &&
+                routed.origins.includes(namespace.appOrigin);
+            // Deactivated anywhere, by any service or in the issuer's console: their
+            // sessions here end before this answer is used, so within the same bound
+            // as a suspension. Only a list about this binding's own organization counts.
+            if (routed.organizationId === namespace.organizationId)
+                await endDeactivated(routed.revoked);
+            return active;
+        }
+        catch (error) {
+            // Suspension removes the binding's key, so the service no longer knows it.
+            if (error instanceof BrokerError && (error.status === 401 || error.status === 403))
+                return false;
+            throw error;
+        }
+    };
+    /**
+     * Whether the service still routes this binding. An answer is trusted for a
+     * minute from when it was asked, so a suspension reaches every request
+     * within that. While the service cannot be asked the last good answer
+     * carries on for five minutes, then this fails closed.
+     */
+    const bindingActive = async () => {
+        const asked = Date.now();
+        if (status && asked - status.at < STATUS_FRESH_MS)
+            return status.active;
+        if (asked >= retryAt) {
+            pending ??= askService().finally(() => {
+                pending = null;
+            });
+            try {
+                const active = await pending;
+                if (!status || status.at < asked)
+                    status = { active, at: asked };
+                return active;
+            }
+            catch (error) {
+                retryAt = Date.now() + STATUS_RETRY_MS;
+                console.error('@wtfalch/auth: could not confirm the namespace binding', error);
+            }
+        }
+        return status?.active === true && Date.now() - status.at < STATUS_STALE_IF_ERROR_MS;
+    };
+    // ---- records ------------------------------------------------------------
+    const load = async (key) => {
+        const record = await store().get(key);
+        if (!record ||
+            record.revokedAt !== null ||
+            record.expiresAt <= now() ||
+            record.context !== (await contextDigest(options())))
+            return null;
+        const tokens = await openRecord(options(), key, record.payload);
+        return tokens ? { key, record, tokens } : null;
+    };
+    const keyOf = async (value) => {
+        const sid = await openHandle(options(), value);
+        return sid ? digest(sid) : null;
+    };
+    const seal = (key, tokens) => sealRecord(options(), { k: key, idt: tokens.idToken, rt: tokens.refreshToken });
+    const revokeToken = (refreshToken) => {
+        if (refreshToken)
+            deps
+                .broker()
+                .revoke(refreshToken)
+                .catch(() => { });
+    };
+    /** A new record and the cookie that points at it. */
+    const create = async (tokens) => {
+        const sid = client.randomState();
+        const key = await digest(sid);
+        await store().create({
+            key,
+            context: await contextDigest(options()),
+            subject: String(tokens.claims.sub),
+            generation: 0,
+            leaseUntil: null,
+            payload: await seal(key, tokens),
+            expiresAt: now() + options().sessionMaxAge,
+            revokedAt: null,
+        });
+        return sealHandle(options(), sid);
+    };
+    /** Ends the record behind this cookie, if it is one of this binding's. */
+    const end = async (value) => {
+        if (!value)
+            return 'none';
+        const key = await keyOf(value);
+        if (!key)
+            return 'changed';
+        const loaded = await load(key);
+        await store().revoke(key, now());
+        revokeToken(loaded?.tokens.rt);
+        return 'ended';
+    };
+    const revokeSubject = async (subject) => store().revokeSubject(await contextDigest(options()), subject, now());
+    // ---- refresh ------------------------------------------------------------
+    const definitive = (error) => error instanceof AuthError ||
+        (error instanceof client.ResponseBodyError && error.error === 'invalid_grant');
+    /**
+     * Refresh under the lease. Resolves the freshest usable tokens: new ones,
+     * another request's, or null when the session is over. While another
+     * request holds the lease, a current token with time left is used as it is;
+     * without one, this waits a few seconds for that refresh to land, and takes
+     * the lease over if its holder has gone quiet past its expiry.
+     */
+    const refresh = async (loaded, stillValid) => {
+        const key = loaded.key;
+        let current = loaded;
+        for (let attempt = 0;; attempt++) {
+            const { record } = current;
+            if (attempt > 0 &&
+                record.generation !== loaded.record.generation &&
+                record.leaseUntil === null)
+                return current;
+            const leased = record.leaseUntil !== null && record.leaseUntil > now();
+            if (!leased &&
+                (await store().advance(key, record.generation, {
+                    payload: record.payload,
+                    expiresAt: record.expiresAt,
+                    leaseUntil: now() + LEASE_SECONDS,
+                })))
+                return refreshLeased(current, stillValid);
+            if (stillValid)
+                return current;
+            if (attempt >= WAIT_STEPS)
+                return null;
+            await sleep(WAIT_STEP_MS);
+            const latest = await load(key);
+            if (!latest)
+                return null;
+            current = latest;
+        }
+    };
+    const refreshLeased = async (leased, stillValid) => {
+        const { key, record, tokens } = leased;
+        const generation = record.generation + 1;
+        let fresh;
+        try {
+            fresh = await deps.oidc().refresh(tokens.rt);
+        }
+        catch (error) {
+            if (definitive(error)) {
+                // The lease means nobody else spent the token: the issuer has ended it.
+                await store().revoke(key, now());
+                return null;
+            }
+            await store()
+                .advance(key, generation, {
+                payload: record.payload,
+                expiresAt: record.expiresAt,
+                leaseUntil: null,
+            })
+                .catch(() => { });
+            return stillValid ? leased : null;
+        }
+        const committed = await store().advance(key, generation, {
+            payload: await seal(key, fresh),
+            expiresAt: now() + options().sessionMaxAge,
+            leaseUntil: null,
+        });
+        if (!committed) {
+            // Revoked while we asked, or our lease ran out and another request took
+            // over. These tokens are kept nowhere, so they are not left live.
+            if (fresh.refreshToken !== tokens.rt)
+                revokeToken(fresh.refreshToken);
+            return load(key);
+        }
+        return {
+            key,
+            record: { ...record, generation: generation + 1, leaseUntil: null },
+            tokens: { k: key, idt: fresh.idToken, rt: fresh.refreshToken },
+        };
+    };
+    /**
+     * The person behind this cookie. Never sets a cookie: a dead or revoked
+     * handle just reads as nobody until the next sign-in replaces it.
+     */
+    const read = async (value, force = false) => {
+        if (!value)
+            return { kind: 'none' };
+        const key = await keyOf(value);
+        if (!key)
+            return { kind: 'changed' };
+        if (!(await bindingActive()))
+            return { kind: 'unavailable' };
+        let loaded = await load(key);
+        if (!loaded)
+            return { kind: 'none' };
+        const exp = expiryOf(loaded.tokens.idt);
+        const valid = exp !== null && exp > now() - 60;
+        const due = force || exp === null || exp - options().refreshWindow <= now();
+        if (due && loaded.tokens.rt) {
+            loaded = await refresh(loaded, valid);
+            if (!loaded)
+                return { kind: 'none' };
+        }
+        try {
+            return { kind: 'user', claims: await deps.oidc().verify(loaded.tokens.idt) };
+        }
+        catch {
+            return { kind: 'none' };
+        }
+    };
+    return { bindingActive, create, end, read, revokeSubject, keyOf };
+}
+function expiryOf(idToken) {
+    try {
+        const [, payload] = idToken.split('.');
+        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
+        return typeof json.exp === 'number' ? json.exp : null;
+    }
+    catch {
+        return null;
+    }
+}