@wtfalch/auth 0.6.0 → 0.7.0

package/dist/broker.d.ts

@@ -89,11 +89,14 @@ export declare class Broker {
     /**
      * What the service routes this key to. A suspended binding's key is refused.
      * Bounded, because every namespace request waits on this answer when it is due.
+     * `revoked` names the organization's recently deactivated people. It is absent
+     * from an older service, or while the service cannot ask the issuer.
      */
     binding(): Promise<{
         organizationId: string;
         clientIds: string[];
         origins: string[];
+        revoked?: string[];
     }>;
     verifyEmail(userId: string, code: string): Promise<unknown>;
     /** A public client revoking its own token: no key, no service. */

package/dist/broker.js

@@ -99,6 +99,8 @@ export class Broker {
     /**
      * What the service routes this key to. A suspended binding's key is refused.
      * Bounded, because every namespace request waits on this answer when it is due.
+     * `revoked` names the organization's recently deactivated people. It is absent
+     * from an older service, or while the service cannot ask the issuer.
      */
     binding() {
         return this.call('GET', '/binding', {}, AbortSignal.timeout(5_000));

package/dist/namespace-server.js

@@ -1,7 +1,7 @@
 import { jwtDecrypt } from 'jose';
 import { resolveOptions } from './config.js';
 import { cookieFrom, openTransaction, transactionCookieName } from './cookies.js';
-import { parseNamespaceRegistry, } from './namespaces.js';
+import { isWebService, parseNamespaceRegistry, } from './namespaces.js';
 /** Resolve a shared callback from its authenticated transaction, never a URL
  * namespace hint. The second open checks the entire current registry binding. */
 export async function resolveNamespaceCallback(input) {
@@ -9,12 +9,16 @@ export async function resolveNamespaceCallback(input) {
         const registry = parseNamespaceRegistry(input.registry);
         const callback = new URL(`${input.basePath ?? '/auth'}/callback`, input.appOrigin).href;
         const candidates = registry.namespaces.filter((n) => n.status === 'active' &&
-            n.services.some((s) => s.serviceId === input.serviceId &&
+            n.services
+                .filter(isWebService)
+                .some((s) => s.serviceId === input.serviceId &&
                 s.deploymentId === input.deploymentId &&
                 s.appOrigin === input.appOrigin &&
                 s.redirectUris.includes(callback)));
         const optionsFor = (namespace) => {
-            const service = namespace.services.find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
+            const service = namespace.services
+                .filter(isWebService)
+                .find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
             if (!service)
                 throw new Error('Missing service');
             const selection = {

package/dist/namespace-session.js

@@ -35,15 +35,40 @@ export function namespaceSessions(deps) {
     let status = null;
     let retryAt = 0;
     let pending = null;
+    // People whose sessions this instance has already ended for the current
+    // deactivation. Someone who leaves the list, by reactivation or by ageing
+    // out of the service's window, is forgotten, so a second deactivation
+    // ends their sessions again.
+    const ended = new Set();
+    const endDeactivated = async (revoked) => {
+        if (!Array.isArray(revoked))
+            return;
+        const current = new Set(revoked.filter((s) => typeof s === 'string' && !!s));
+        for (const subject of ended)
+            if (!current.has(subject))
+                ended.delete(subject);
+        for (const subject of current) {
+            if (ended.has(subject))
+                continue;
+            await revokeSubject(subject);
+            ended.add(subject);
+        }
+    };
     const askService = async () => {
         const namespace = options().namespace;
         if (!namespace)
             return false;
         try {
             const routed = await deps.broker().binding();
-            return (routed.organizationId === namespace.organizationId &&
+            const active = routed.organizationId === namespace.organizationId &&
                 routed.clientIds.includes(namespace.clientId) &&
-                routed.origins.includes(namespace.appOrigin));
+                routed.origins.includes(namespace.appOrigin);
+            // Deactivated anywhere, by any service or in the issuer's console: their
+            // sessions here end before this answer is used, so within the same bound
+            // as a suspension. Only a list about this binding's own organization counts.
+            if (routed.organizationId === namespace.organizationId)
+                await endDeactivated(routed.revoked);
+            return active;
         }
         catch (error) {
             // Suspension removes the binding's key, so the service no longer knows it.

package/dist/namespaces.d.ts

@@ -9,7 +9,9 @@ export interface NamespaceDomain {
     /** Operator-owned evidence reference; this is not an automated DNS verifier. */
     verificationRef?: string;
 }
+/** A browser service: the SDK's server or browser client at one origin. `kind` is omitted. */
 export interface NamespaceService {
+    kind?: 'web';
     id: string;
     serviceId: string;
     deploymentId: string;
@@ -19,11 +21,42 @@ export interface NamespaceService {
     credentialRef: string;
     registration: boolean;
 }
+/**
+ * Installed software a person signs in to by approving on another device: a
+ * public device-code client with no secret and no redirect URIs.
+ */
+export interface NamespaceNativeService {
+    kind: 'native';
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+}
+/**
+ * A resource server that checks the namespace's tokens at the introspection
+ * endpoint. Its client secret is stored under `credentialRef`, never here.
+ */
+export interface NamespaceApiService {
+    kind: 'api';
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+    credentialRef: string;
+}
+/** Every client of one namespace shares its accounts: one sign-in across all of them. */
+export type NamespaceBinding = NamespaceService | NamespaceNativeService | NamespaceApiService;
+export declare function isWebService<T extends NamespaceBinding>(binding: T): binding is Extract<T, NamespaceService>;
 export interface NamespaceSpec {
     id: string;
     displayName: string;
     revision: number;
     status: Exclude<NamespaceStatus, 'failed'>;
+    /**
+     * `invitation`: nobody signs themselves up. People arrive by invitation,
+     * whether from the organization's admin or when a mailbox is created on
+     * one of its `account` domains. Omitted means open, which is how every
+     * namespace behaved before.
+     */
+    admission?: 'invitation';
     loginOrigin: string;
     domains: NamespaceDomain[];
     mail: {
@@ -31,7 +64,7 @@ export interface NamespaceSpec {
         productName: string;
         locale: string;
     };
-    services: NamespaceService[];
+    services: NamespaceBinding[];
 }
 export interface NamespaceManifest {
     version: 1;
@@ -42,7 +75,7 @@ export interface NamespaceRecord extends Omit<NamespaceSpec, 'status' | 'service
     status: NamespaceStatus;
     organizationId: string;
     projectId: string;
-    services: (NamespaceService & {
+    services: (NamespaceBinding & {
         appId: string;
         clientId: string;
     })[];
@@ -66,6 +99,7 @@ export declare function resolveNamespaceBinding(registry: NamespaceRegistry, inp
     deploymentId: string;
     appOrigin: string;
 }): {
+    kind?: "web";
     id: string;
     serviceId: string;
     deploymentId: string;
@@ -100,6 +134,7 @@ export declare function resolveNamespaceContext(selection: NamespaceSelection, o
     organizationId?: string;
 }): {
     context: string;
+    kind?: "web";
     id: string;
     serviceId: string;
     deploymentId: string;

package/dist/namespaces.js

@@ -1,3 +1,6 @@
+export function isWebService(binding) {
+    return binding.kind === undefined || binding.kind === 'web';
+}
 function invalid(field) {
     throw new Error(`Invalid namespace configuration: ${field}`);
 }
@@ -77,18 +80,39 @@ function domain(value) {
         invalid('active domain needs verificationRef');
     return { domain: name, purpose, status, ...(verificationRef ? { verificationRef } : {}) };
 }
+function credential(value) {
+    const credentialRef = string(value, 'credentialRef');
+    if (!/^[A-Z][A-Z0-9_]{2,100}$/.test(credentialRef) || credentialRef.endsWith('_PAT'))
+        invalid('credentialRef');
+    return credentialRef;
+}
+const WEB_FIELDS = ['appOrigin', 'redirectUris', 'postLogoutRedirectUris', 'registration'];
 function service(value) {
     const s = object(value, 'service');
+    const kind = s.kind === undefined ? 'web' : oneOf(s.kind, ['web', 'native', 'api'], 'kind');
+    const identity = {
+        id: id(s.id, 'binding id'),
+        serviceId: id(s.serviceId, 'serviceId'),
+        deploymentId: id(s.deploymentId, 'deploymentId'),
+    };
+    if (kind !== 'web') {
+        // Nothing is redirected to installed software or a resource server; a
+        // stray browser field is a mistaken kind, not something to ignore.
+        if (WEB_FIELDS.some((field) => s[field] !== undefined))
+            invalid(`${kind} service web fields`);
+        if (kind === 'native') {
+            if (s.credentialRef !== undefined)
+                invalid('native service credentialRef');
+            return { kind, ...identity };
+        }
+        return { kind, ...identity, credentialRef: credential(s.credentialRef) };
+    }
     const appOrigin = url(s.appOrigin, 'appOrigin', true, true);
-    const credentialRef = string(s.credentialRef, 'credentialRef');
-    if (!/^[A-Z][A-Z0-9_]{2,100}$/.test(credentialRef) || credentialRef.endsWith('_PAT'))
-        invalid('credentialRef');
+    const credentialRef = credential(s.credentialRef);
     if (s.registration !== undefined && typeof s.registration !== 'boolean')
         invalid('registration');
     return {
-        id: id(s.id, 'binding id'),
-        serviceId: id(s.serviceId, 'serviceId'),
-        deploymentId: id(s.deploymentId, 'deploymentId'),
+        ...identity,
         appOrigin,
         redirectUris: uris(s.redirectUris, appOrigin, 'redirectUris'),
         postLogoutRedirectUris: uris(s.postLogoutRedirectUris, appOrigin, 'postLogoutRedirectUris'),
@@ -129,11 +153,21 @@ function parse(raw, resolved) {
         if (!services.length)
             invalid('namespace needs a service');
         unique(services.map((s) => `${s.serviceId}:${s.deploymentId}`), 'namespace service/deployment');
+        const admission = oneOf(n.admission ?? 'open', ['open', 'invitation'], 'admission');
+        if (admission === 'invitation') {
+            // The organization's addresses are what an invitation-only namespace
+            // is for: mail provisioning invites from them.
+            if (!domains.some((d) => d.purpose === 'account'))
+                invalid('invitation namespace needs an account domain');
+            if (services.some((s) => isWebService(s) && s.registration))
+                invalid('invitation namespace cannot open registration');
+        }
         const common = {
             id: id(n.id, 'namespace id'),
             displayName: string(n.displayName, 'displayName'),
             revision: n.revision,
             status,
+            ...(admission === 'invitation' ? { admission } : {}),
             loginOrigin,
             domains,
             services,
@@ -153,7 +187,7 @@ function parse(raw, resolved) {
     });
     unique(namespaces.map((n) => n.id), 'namespace id');
     unique(namespaces.flatMap((n) => n.services.map((s) => s.id)), 'binding id');
-    unique(namespaces.flatMap((n) => n.services.map((s) => s.credentialRef)), 'credential reference');
+    unique(namespaces.flatMap((n) => n.services.flatMap((s) => ('credentialRef' in s ? [s.credentialRef] : []))), 'credential reference');
     const domains = new Map();
     for (const n of namespaces)
         for (const d of n.domains) {
@@ -183,7 +217,9 @@ export function resolveNamespaceBinding(registry, input) {
     const namespace = validated.namespaces.find((n) => n.id === input.namespaceId);
     if (!namespace || namespace.status !== 'active')
         invalid('namespace unavailable');
-    const binding = namespace.services.find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
+    const binding = namespace.services
+        .filter(isWebService)
+        .find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
     if (!binding || binding.appOrigin !== url(input.appOrigin, 'appOrigin', true, true))
         invalid('service binding mismatch');
     return {
@@ -206,7 +242,7 @@ export function parseWorkspaceBindings(raw, registry) {
             namespaceId: id(w.namespaceId, 'namespaceId'),
         };
         const namespace = validated.namespaces.find((n) => n.id === binding.namespaceId);
-        if (!namespace?.services.some((s) => s.serviceId === binding.serviceId))
+        if (!namespace?.services.some((s) => isWebService(s) && s.serviceId === binding.serviceId))
             invalid('workspace service/namespace mismatch');
         return binding;
     });

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",
-    "url": "https://github.com/wtfalch/auth",
+    "url": "git+https://github.com/wtfalch/auth.git",
     "directory": "packages/auth"
   },
   "type": "module",