@xignet/payload 0.0.0-stage → 0.1.0-beta.1

package/dist/native-session.js

@@ -0,0 +1,305 @@
+import { errors, jwtVerify } from 'jose';
+import { APIError, JWT_AUTH_VERSION, createLocalReq, getFieldsToSign, jwtSign, } from 'payload';
+import { parseCookies } from 'payload/shared';
+export const SESSION_COLLECTION = 'xignet-sessions';
+export const SESSION_CLAIM = '__xignet_sso';
+// Match Payload 3.93's credential precedence and CSRF rules. extractJWT is
+// not a public export, so the pinned adapter tests native browser auth.
+function selectedToken(req) {
+    for (const method of req.payload.config.auth.jwtOrder) {
+        if (method === 'Bearer' || method === 'JWT') {
+            const header = req.headers.get('authorization');
+            if (header?.startsWith(`${method} `))
+                return header.slice(method.length + 1);
+        }
+        else {
+            const token = parseCookies(req.headers).get(`${req.payload.config.cookiePrefix}-token`);
+            if (!token)
+                continue;
+            const origin = req.headers.get('origin');
+            const csrf = req.payload.config.csrf;
+            if (origin
+                ? csrf.length === 0 || csrf.includes(origin)
+                : csrf.length === 0 ||
+                    ['same-origin', 'same-site', 'none'].includes(req.headers.get('sec-fetch-site') ?? ''))
+                return token;
+        }
+    }
+    return undefined;
+}
+async function reference(req) {
+    const token = selectedToken(req);
+    if (!token)
+        return undefined;
+    try {
+        const result = await jwtVerify(token, new TextEncoder().encode(req.payload.secret), { algorithms: ['HS256'], requiredClaims: ['exp'] });
+        return result.protectedHeader.authVersion === JWT_AUTH_VERSION &&
+            result.payload[SESSION_CLAIM] === true
+            ? result.payload
+            : undefined;
+    }
+    catch (error) {
+        if (error instanceof errors.JOSEError)
+            return undefined;
+        throw error;
+    }
+}
+export function createNativeSessions(options) {
+    const maxAge = options.login?.session.maxAgeSeconds ?? 7200;
+    const absoluteMaxAge = options.login?.session.absoluteMaxAgeSeconds ?? 7200;
+    if (![maxAge, absoluteMaxAge].every((n) => Number.isInteger(n) && n > 0 && n <= 604800) ||
+        maxAge > absoluteMaxAge)
+        throw new Error('Invalid SSO session lifetimes');
+    const record = async (req, sid) => typeof sid === 'string'
+        ? req.payload.db.findOne({
+            collection: SESSION_COLLECTION,
+            req,
+            where: { sid: { equals: sid } },
+        })
+        : null;
+    const allowed = async (req, entry, userId) => {
+        if (entry.user !== userId ||
+            entry.resource !== options.resource ||
+            entry.identity?.issuer !== options.issuer ||
+            !Number.isFinite(Date.parse(entry.absoluteExpiresAt)) ||
+            Date.parse(entry.absoluteExpiresAt) <= Date.now())
+            return false;
+        const resolved = await options.resolveUser({
+            identity: entry.identity,
+            channel: 'session',
+            payload: req.payload,
+        });
+        return (resolved.status === 'allowed' &&
+            resolved.user.id === userId &&
+            resolved.user.collection === options.userCollection);
+    };
+    const collection = {
+        slug: SESSION_COLLECTION,
+        admin: { hidden: true },
+        access: {
+            create: () => false,
+            read: () => false,
+            update: () => false,
+            delete: () => false,
+        },
+        fields: [
+            { name: 'sid', type: 'text', required: true, unique: true },
+            { name: 'resource', type: 'text', required: true },
+            {
+                name: 'user',
+                type: 'relationship',
+                relationTo: options.userCollection,
+                required: true,
+                index: true,
+            },
+            { name: 'absoluteExpiresAt', type: 'date', required: true, index: true },
+            { name: 'identity', type: 'json', required: true },
+        ],
+    };
+    const revokeUserSessions = async ({ payload, userId, req: existingReq, }) => {
+        const req = existingReq ?? (await createLocalReq({}, payload));
+        const entries = await payload.find({
+            collection: SESSION_COLLECTION,
+            req,
+            overrideAccess: true,
+            pagination: false,
+            depth: 0,
+            where: { user: { equals: userId } },
+        });
+        const ids = new Set(entries.docs.map((doc) => doc.sid));
+        const user = (await payload.db.findOne({
+            collection: options.userCollection,
+            req,
+            where: { id: { equals: userId } },
+        }));
+        if (user)
+            await payload.db.updateOne({
+                collection: options.userCollection,
+                id: userId,
+                req,
+                returning: false,
+                data: {
+                    sessions: (user.sessions ?? []).filter((s) => !ids.has(s.id)),
+                },
+            });
+        await payload.delete({
+            collection: SESSION_COLLECTION,
+            req,
+            overrideAccess: true,
+            where: { user: { equals: userId } },
+        });
+    };
+    const revokeSession = async (req, userId, sid) => {
+        const current = (await req.payload.db.findOne({
+            collection: options.userCollection,
+            req,
+            where: { id: { equals: userId } },
+        }));
+        if (current)
+            await req.payload.db.updateOne({
+                collection: options.userCollection,
+                id: userId,
+                req,
+                returning: false,
+                data: {
+                    sessions: (current.sessions ?? []).filter((s) => s.id !== sid),
+                },
+            });
+        await req.payload.delete({
+            collection: SESSION_COLLECTION,
+            req,
+            overrideAccess: true,
+            where: { sid: { equals: sid } },
+        });
+    };
+    const protectSession = async ({ doc, req }) => {
+        const ref = await reference(req);
+        if (!ref || ref.collection !== options.userCollection || ref.id !== doc.id)
+            return doc;
+        if (!(doc.sessions ?? []).some((s) => s.id === ref.sid))
+            return doc;
+        try {
+            const entry = await record(req, ref.sid);
+            if (entry && (await allowed(req, entry, doc.id)))
+                return doc;
+        }
+        catch (error) {
+            // Payload's native JWT strategy catches auth failures. Log the service
+            // failure here so an outage cannot silently look like an expired login.
+            req.payload.logger.error({
+                event: 'xignet_session_verification_failed',
+                category: error instanceof Error ? error.name : 'unknown',
+            });
+            throw error;
+        }
+        // Revocation must survive re-enabling/rebinding the account. Merely
+        // filtering this one auth response would let an old cookie revive later.
+        await revokeSession(req, doc.id, ref.sid);
+        req.payload.logger.info({
+            event: 'xignet_session_revoked',
+            userId: doc.id,
+            reason: 'expired_disabled_or_unbound',
+        });
+        return {
+            ...doc,
+            sessions: (doc.sessions ?? []).filter((s) => s.id !== ref.sid),
+        };
+    };
+    const enhanceUser = (config) => {
+        const auth = typeof config.auth === 'object' ? config.auth : {};
+        if (!config.auth ||
+            auth.disableLocalStrategy ||
+            auth.useSessions === false) {
+            if (options.login?.enabled)
+                throw new Error('SSO requires native Payload auth with sessions');
+            return config;
+        }
+        const previousRefresh = config.hooks?.refresh ?? [];
+        const refresh = async (args) => {
+            const ref = await reference(args.args.req);
+            if (!ref) {
+                for (const hook of previousRefresh) {
+                    const result = await hook(args);
+                    if (result)
+                        return result;
+                }
+                return;
+            }
+            const req = args.args.req;
+            const entry = await record(req, ref.sid);
+            if (!entry || !(await allowed(req, entry, args.user.id)))
+                throw new APIError('SSO session expired or revoked', 403);
+            let prior;
+            for (const hook of previousRefresh) {
+                prior = await hook(args);
+                if (prior)
+                    break;
+            }
+            const user = prior?.user ?? args.user;
+            if (user.id !== entry.user)
+                throw new APIError('SSO user mismatch', 403);
+            const ttl = Math.min(maxAge, Math.floor(Date.parse(entry.absoluteExpiresAt) / 1000) -
+                Math.floor(Date.now() / 1000));
+            if (ttl < 1)
+                throw new APIError('SSO session expired', 403);
+            const signed = await jwtSign({
+                fieldsToSign: {
+                    ...getFieldsToSign({
+                        collectionConfig: args.args.collection.config,
+                        user,
+                        email: user.email,
+                        sid: entry.sid,
+                    }),
+                    [SESSION_CLAIM]: true,
+                },
+                secret: req.payload.secret,
+                tokenExpiration: ttl,
+            });
+            const current = (await req.payload.db.findOne({
+                collection: options.userCollection,
+                req,
+                where: { id: { equals: user.id } },
+            }));
+            if (!current?.sessions?.some((s) => s.id === entry.sid))
+                throw new APIError('SSO session revoked', 403);
+            await req.payload.db.updateOne({
+                collection: options.userCollection,
+                id: user.id,
+                req,
+                returning: false,
+                data: {
+                    sessions: current.sessions.map((s) => s.id === entry.sid
+                        ? { ...s, expiresAt: new Date(signed.exp * 1000) }
+                        : s),
+                },
+            });
+            // A refresh hook runs before Payload applies user read/field access.
+            return {
+                ...prior,
+                exp: signed.exp,
+                refreshedToken: signed.token,
+                user,
+                setCookie: true,
+            };
+        };
+        return {
+            ...config,
+            auth: {
+                ...auth,
+                useSessions: true,
+                cookies: {
+                    ...auth.cookies,
+                    ...(options.login?.enabled &&
+                        new URL(options.resource).protocol === 'https:'
+                        ? { secure: true }
+                        : {}),
+                },
+            },
+            hooks: {
+                ...config.hooks,
+                afterRead: [...(config.hooks?.afterRead ?? []), protectSession],
+                refresh: [refresh],
+                afterLogout: [
+                    ...(config.hooks?.afterLogout ?? []),
+                    async ({ req }) => {
+                        if (req.user?._sid)
+                            await req.payload.delete({
+                                collection: SESSION_COLLECTION,
+                                req,
+                                overrideAccess: true,
+                                where: { sid: { equals: req.user._sid } },
+                            });
+                    },
+                ],
+            },
+        };
+    };
+    return {
+        collection,
+        revokeSession,
+        enhanceUser,
+        revokeUserSessions,
+        maxAge,
+        absoluteMaxAge,
+    };
+}

package/dist/next.d.ts

@@ -0,0 +1,10 @@
+import type { Payload } from 'payload';
+import type { XignetPayloadIntegration } from './types.js';
+/** Standard Request/Response handlers for Next.js server route modules. */
+export declare function createXignetRouteHandlers(integration: XignetPayloadIntegration, options?: {
+    getPayload: () => Promise<Payload>;
+}): {
+    metadata: () => Promise<Response>;
+    login: (request: Request) => Promise<Response>;
+    callback: (request: Request) => Promise<Response>;
+};

package/dist/next.js

@@ -0,0 +1,24 @@
+/** Standard Request/Response handlers for Next.js server route modules. */
+export function createXignetRouteHandlers(integration, options) {
+    if (integration.loginEnabled && !options)
+        throw new Error('SSO routes require a getPayload provider');
+    return {
+        metadata: async () => integration.metadata(),
+        login: (request) => integration.login(request),
+        callback: async (request) => {
+            if (!integration.loginEnabled || !options)
+                return new Response(null, { status: 404 });
+            const payload = await options.getPayload();
+            if (!payload.config.serverURL)
+                return integration.callback(request, payload);
+            // Standalone Next requests may use an internal hostname and port.
+            // Only configured serverURL supplies the public origin, never headers.
+            const incoming = new URL(request.url);
+            const callback = new URL(payload.config.serverURL);
+            callback.pathname = incoming.pathname;
+            callback.search = incoming.search;
+            callback.hash = incoming.hash;
+            return integration.callback(new Request(callback, request), payload);
+        },
+    };
+}

package/dist/rpc-audit.d.ts

@@ -0,0 +1,3 @@
+export declare function inspectRpc(message: Request): Promise<Record<string, unknown> | undefined>;
+export declare function observeRpc(response: Response, complete: (rpc: Record<string, unknown> | undefined, completed: boolean) => void): ReadableStream<Uint8Array> | null;
+export declare function rpcMethod(value: unknown): string;

package/dist/rpc-audit.js

@@ -0,0 +1,115 @@
+const byteLimit = 64 * 1024;
+function parseRpc(chunks, contentType) {
+    const text = Buffer.concat(chunks).toString('utf8');
+    const json = contentType?.includes('text/event-stream')
+        ? text
+            .split(/\r?\n/)
+            .filter((line) => line.startsWith('data:'))
+            .map((line) => line.slice(5).trimStart())
+            .join('\n')
+        : text;
+    try {
+        const parsed = JSON.parse(json);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : undefined;
+    }
+    catch {
+        return;
+    }
+}
+// Inspect a bounded request clone without consuming the transport's body.
+export async function inspectRpc(message) {
+    const reader = message.body?.getReader();
+    if (!reader)
+        return;
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > byteLimit) {
+                // Awaiting one tee branch's cancellation can wait for the other one.
+                void reader.cancel().catch(() => undefined);
+                return;
+            }
+            chunks.push(value);
+        }
+        return parseRpc(chunks, message.headers.get('content-type'));
+    }
+    catch {
+        return;
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+// Observe only bytes the consumer requests. Forward every chunk immediately;
+// EOF, source error and cancellation each produce exactly one terminal record.
+export function observeRpc(response, complete) {
+    const reader = response.body?.getReader();
+    if (!reader) {
+        complete(undefined, true);
+        return null;
+    }
+    let chunks = [];
+    let size = 0;
+    let finished = false;
+    const finish = (valid) => {
+        if (finished)
+            return;
+        finished = true;
+        complete(valid && size <= byteLimit
+            ? parseRpc(chunks, response.headers.get('content-type'))
+            : undefined, valid);
+        chunks = [];
+    };
+    return new ReadableStream({
+        async pull(controller) {
+            try {
+                const { done, value } = await reader.read();
+                if (done) {
+                    finish(true);
+                    reader.releaseLock();
+                    controller.close();
+                    return;
+                }
+                size += value.byteLength;
+                if (size <= byteLimit)
+                    chunks.push(value);
+                else
+                    chunks = [];
+                controller.enqueue(value);
+            }
+            catch (error) {
+                finish(false);
+                reader.releaseLock();
+                controller.error(error);
+            }
+        },
+        async cancel(reason) {
+            finish(false);
+            try {
+                await reader.cancel(reason);
+            }
+            finally {
+                reader.releaseLock();
+            }
+        },
+    });
+}
+export function rpcMethod(value) {
+    return typeof value === 'string' &&
+        [
+            'initialize',
+            'ping',
+            'tools/list',
+            'tools/call',
+            'notifications/initialized',
+        ].includes(value)
+        ? value
+        : 'unknown';
+}

package/dist/types.d.ts

@@ -0,0 +1,76 @@
+import type { TokenVerifierOptions, VerifiedIdentity } from '@xignet/core';
+import type { CollectionSlug, Payload, PayloadRequest, Plugin, TypedUser } from 'payload';
+export type UserResolution<TUser extends TypedUser = TypedUser> = {
+    readonly status: 'allowed';
+    readonly user: TUser;
+} | {
+    readonly status: 'denied';
+    readonly reason: 'unbound' | 'disabled' | 'not_allowed';
+};
+export type ResolveUser<TUser extends TypedUser = TypedUser> = (input: {
+    identity: VerifiedIdentity;
+    channel: 'login' | 'mcp' | 'session';
+    payload: Payload;
+    login?: {
+        idTokenClaims: Readonly<Record<string, unknown>>;
+    };
+}) => Promise<UserResolution<TUser>>;
+export type MCPOperation = 'find' | 'create' | 'update';
+export interface OperationPolicy {
+    readonly scopes: readonly string[];
+}
+export interface MutationInput {
+    readonly operation: 'create' | 'update';
+    readonly data: Record<string, unknown>;
+    readonly originalDoc?: Record<string, unknown>;
+    readonly req: PayloadRequest;
+    readonly identity: VerifiedIdentity;
+}
+/** Return additional required scopes, or false to refuse the mutation. */
+export type MutationPolicy = (input: MutationInput) => readonly string[] | false | Promise<readonly string[] | false>;
+export interface EntityPolicy {
+    readonly find?: OperationPolicy;
+    readonly create?: OperationPolicy;
+    readonly update?: OperationPolicy;
+    readonly mutationPolicy?: MutationPolicy;
+}
+export interface XignetPayloadOptions<TUser extends TypedUser = TypedUser> extends Omit<TokenVerifierOptions, 'audience'> {
+    readonly resource: string;
+    readonly admissionScopes: readonly string[];
+    readonly userCollection: CollectionSlug;
+    readonly resolveUser: ResolveUser<TUser>;
+    readonly login?: {
+        readonly enabled: boolean;
+        readonly clientId: string;
+        readonly redirectUri: string;
+        readonly scopes: readonly string[];
+        readonly transactionSecret: string;
+        readonly successRedirect: string;
+        readonly session: {
+            readonly maxAgeSeconds: number;
+            readonly absoluteMaxAgeSeconds: number;
+        };
+    };
+    readonly mcp: {
+        readonly enabled: boolean;
+        /** Disable mutation capabilities without changing configured schemas. Defaults to true. */
+        readonly writesEnabled?: boolean;
+        readonly collections: Readonly<Record<string, EntityPolicy>>;
+        readonly globals?: Readonly<Record<string, Omit<EntityPolicy, 'create'>>>;
+        /** Include scopes returned dynamically by mutationPolicy. */
+        readonly scopesSupported?: readonly string[];
+    };
+}
+export interface XignetPayloadIntegration {
+    readonly loginEnabled: boolean;
+    plugin(): Plugin;
+    /** HTTP metadata response; mount at the resource's well-known path. */
+    metadata(): Response;
+    login(request: Request): Promise<Response>;
+    callback(request: Request, payload: Payload): Promise<Response>;
+    revokeUserSessions(input: {
+        payload: Payload;
+        userId: string | number;
+        req?: PayloadRequest;
+    }): Promise<void>;
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/dist/v3.d.ts

@@ -0,0 +1,5 @@
+import { type TypedUser } from 'payload';
+import type { XignetPayloadIntegration, XignetPayloadOptions } from './types.js';
+export type * from './types.js';
+/** Compose official v3 MCP transport with request-scoped Xignet authorization. */
+export declare function createXignetPayload<TUser extends TypedUser>(input: XignetPayloadOptions<TUser>): XignetPayloadIntegration;