@~lyre/auth 0.11.0 → 0.12.0

package/dist/sveltekit.js

@@ -1,19 +1,27 @@
 import {
   beginAccountsLoginRedirect,
+  clearLoginStateCookie,
   clearPlatformSessionCookie,
+  createLoginStateCookie,
+  createOidcClientFromConfig,
+  createPlatformSessionCookie,
   handleAccountsCallback,
+  identityFromClaims,
   identityPassthroughSync,
   introspectServiceKey,
-  logoutFromAccounts,
+  isOidcError,
   normalizeAccountsWebhook,
+  readLoginStateCookie,
   readPlatformSessionCookie,
+  safeNextPath,
   serviceKeyFromRequest,
   verifyWebhookSignature
-} from "./chunk-TQNQLX3C.js";
+} from "./chunk-F2GDXTY4.js";
 
 // src/sveltekit.ts
 import { createHash } from "crypto";
 var STATE_COOKIE = "accounts_auth_state";
+var REFRESH_SKEW_MS = 6e4;
 function redirectWithCookies(location, cookies) {
   const headers = new Headers({ location });
   for (const c of cookies) if (c) headers.append("set-cookie", c);
@@ -27,58 +35,155 @@ function createAuthHandle(opts) {
   const postLogoutPath = opts.postLogoutPath ?? "/";
   const cookieOptions = opts.cookieOptions;
   const sessionSecret = opts.sessionSecret;
-  return async ({ event, resolve }) => {
-    const session = readPlatformSessionCookie(event.request.headers.get("cookie"), {
-      secret: sessionSecret
+  const mock = Boolean(opts.config.useMock) && !opts.client;
+  const refreshTokens = opts.refreshTokens ?? true;
+  let client = opts.client ?? null;
+  const getClient = () => client ??= createOidcClientFromConfig(opts.config, { fetchImpl: opts.fetchImpl, ...opts.oidc });
+  const refreshes = /* @__PURE__ */ new Map();
+  function refreshOnce(refreshToken) {
+    const key = createHash("sha256").update(refreshToken).digest("hex");
+    const now = Date.now();
+    for (const [k, v] of refreshes) if (v.expires <= now) refreshes.delete(k);
+    const hit = refreshes.get(key);
+    if (hit) return hit.promise;
+    const promise = getClient().refresh(refreshToken);
+    refreshes.set(key, { promise, expires: now + 3e4 });
+    promise.catch(() => refreshes.delete(key));
+    return promise;
+  }
+  const authError = async (error, event) => {
+    const response = opts.onAuthError ? await opts.onAuthError(error, event) : new Response(`Sign-in failed (${isOidcError(error) ? error.code : "error"}).`, {
+      status: 400,
+      headers: { "content-type": "text/plain; charset=utf-8" }
     });
-    event.locals.session = session;
-    event.locals.principal = session.principal;
+    try {
+      response.headers.append("set-cookie", clearLoginStateCookie(cookieOptions));
+    } catch {
+    }
+    return response;
+  };
+  return async ({ event, resolve }) => {
+    const cookieHeader = event.request.headers.get("cookie");
+    let session = readPlatformSessionCookie(cookieHeader, { secret: sessionSecret });
+    const setLocals = () => {
+      event.locals.session = session;
+      event.locals.principal = session.principal;
+    };
+    setLocals();
     const path = event.url.pathname;
     if (path === loginPath) {
-      const next = event.url.searchParams.get("next") ?? "/";
-      const flow = beginAccountsLoginRedirect(opts.config, { nextPath: next, cookieOptions });
-      return redirectWithCookies(flow.redirectUrl, [flow.stateCookie]);
+      const next = safeNextPath(event.url.searchParams.get("next"));
+      if (mock) {
+        const flow = beginAccountsLoginRedirect(opts.config, { nextPath: next, cookieOptions });
+        return redirectWithCookies(flow.redirectUrl, [flow.stateCookie]);
+      }
+      const login = await getClient().beginLogin();
+      return redirectWithCookies(login.url, [
+        createLoginStateCookie(login, { nextPath: next, secret: sessionSecret, cookieOptions })
+      ]);
     }
     if (path === callbackPath) {
-      const code = event.url.searchParams.get("code") ?? "";
-      const state = event.url.searchParams.get("state") ?? "";
-      const storedState = event.cookies.get(STATE_COOKIE);
-      const result = await handleAccountsCallback({
-        config: opts.config,
-        code,
-        state,
-        storedState,
-        syncAccountsUser: sync,
-        cookieOptions,
-        secret: sessionSecret
-      });
-      return redirectWithCookies(result.nextPath || "/", [
-        result.sessionCookie,
-        result.clearStateCookie
-      ]);
+      if (mock) {
+        const result = await handleAccountsCallback({
+          config: opts.config,
+          code: event.url.searchParams.get("code") ?? "",
+          state: event.url.searchParams.get("state") ?? "",
+          storedState: event.cookies.get(STATE_COOKIE),
+          syncAccountsUser: sync,
+          cookieOptions,
+          secret: sessionSecret
+        });
+        return redirectWithCookies(result.nextPath || "/", [result.sessionCookie, result.clearStateCookie]);
+      }
+      const stored = readLoginStateCookie(cookieHeader, { secret: sessionSecret });
+      try {
+        const { claims, tokens } = await getClient().handleCallback({ url: event.url, expected: stored });
+        const identity = identityFromClaims(claims);
+        const local = await sync(identity);
+        const next = {
+          principal: {
+            identity,
+            user: local.user,
+            tenantAccess: { activeTenantId: local.activeTenantId, memberships: local.memberships }
+          },
+          tenant: null,
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+          expiresAt: new Date(tokens.expiresAt).toISOString()
+        };
+        return redirectWithCookies(stored?.nextPath ?? "/", [
+          createPlatformSessionCookie(next, cookieOptions, sessionSecret),
+          clearLoginStateCookie(cookieOptions)
+        ]);
+      } catch (error) {
+        return authError(error, event);
+      }
     }
     if (path === logoutPath) {
-      if (session.accessToken) {
-        const all = event.url.searchParams.get("all") === "1" || event.url.searchParams.get("all") === "true";
-        await logoutFromAccounts({ config: opts.config, accessToken: session.accessToken, all });
+      let location = postLogoutPath;
+      if (!mock) {
+        if (session.refreshToken) {
+          await getClient().revoke(session.refreshToken, "refresh_token").catch(() => void 0);
+        }
+        if (opts.endAccountsSession) {
+          location = await getClient().logoutUrl().catch(() => postLogoutPath);
+        }
       }
-      return redirectWithCookies(postLogoutPath, [
+      return redirectWithCookies(location, [
         clearPlatformSessionCookie(cookieOptions),
+        clearLoginStateCookie(cookieOptions),
         `${STATE_COOKIE}=; ${cookieOptions?.sameSite === "none" ? "Path=/; HttpOnly; SameSite=None; Secure" : "Path=/; HttpOnly; SameSite=Lax"}; Max-Age=0`
       ]);
     }
+    let sessionCookieUpdate = null;
+    if (!mock && refreshTokens && session.principal && session.refreshToken && (!session.expiresAt || Date.parse(session.expiresAt) - Date.now() < REFRESH_SKEW_MS)) {
+      try {
+        const tokens = await refreshOnce(session.refreshToken);
+        session = {
+          ...session,
+          accessToken: tokens.accessToken,
+          // Rotation: always keep the NEW refresh token; the old one is dead.
+          refreshToken: tokens.refreshToken,
+          expiresAt: new Date(tokens.expiresAt).toISOString()
+        };
+        sessionCookieUpdate = createPlatformSessionCookie(session, cookieOptions, sessionSecret);
+      } catch (error) {
+        if (isOidcError(error, "token_request_failed") && error.status && error.status < 500) {
+          session = { principal: null, tenant: null };
+          sessionCookieUpdate = clearPlatformSessionCookie(cookieOptions);
+        }
+      }
+      setLocals();
+    }
     if (opts.protect && opts.protect(event) && !session.principal) {
       if (path.startsWith("/api")) {
-        return new Response(JSON.stringify({ message: "Authentication required." }), {
-          status: 401,
-          headers: { "content-type": "application/json" }
-        });
+        return withCookie(
+          new Response(JSON.stringify({ message: "Authentication required." }), {
+            status: 401,
+            headers: { "content-type": "application/json" }
+          }),
+          sessionCookieUpdate
+        );
       }
-      return redirectWithCookies(`${loginPath}?next=${encodeURIComponent(path + event.url.search)}`, []);
+      return redirectWithCookies(
+        `${loginPath}?next=${encodeURIComponent(path + event.url.search)}`,
+        sessionCookieUpdate ? [sessionCookieUpdate] : []
+      );
     }
-    return resolve(event);
+    return withCookie(await resolve(event), sessionCookieUpdate);
   };
 }
+function withCookie(response, cookie) {
+  if (!cookie) return response;
+  try {
+    response.headers.append("set-cookie", cookie);
+    return response;
+  } catch {
+    const copy = new Response(response.body, response);
+    copy.headers.append("set-cookie", cookie);
+    return copy;
+  }
+}
 function createServiceKeyHandle(opts) {
   const match = opts.match ?? ((event) => event.url.pathname.startsWith("/api"));
   const ttl = opts.cacheTtlMs ?? 6e4;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@~lyre/auth",
-  "version": "0.11.0",
-  "description": "Shared Axis Accounts auth SDK \u2014 framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
+  "version": "0.12.0",
+  "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -51,7 +51,8 @@
   ],
   "scripts": {
     "build": "tsup src/index.ts src/sveltekit.ts src/nest.ts src/admin.ts --format esm --dts --clean",
-    "check": "tsc --noEmit"
+    "check": "tsc --noEmit",
+    "test": "vitest run"
   },
   "peerDependencies": {
     "@sveltejs/kit": "^2.0.0"
@@ -65,7 +66,8 @@
     "@sveltejs/kit": "^2.0.0",
     "@types/node": "^22",
     "tsup": "^8.3.5",
-    "typescript": "^6.0.2"
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.12"
   },
   "publishConfig": {
     "access": "public"

package/dist/chunk-TQNQLX3C.js

@@ -1,338 +0,0 @@
-// src/index.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var SESSION_COOKIE_NAME = "platform_session";
-var STATE_COOKIE_NAME = "accounts_auth_state";
-function normalizeOptionalString(value) {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : void 0;
-}
-function createAccountsClientConfig(input = {}) {
-  return {
-    baseUrl: normalizeOptionalString(input.baseUrl ?? process.env.ACCOUNTS_BASE_URL),
-    clientId: input.clientId ?? process.env.ACCOUNTS_CLIENT_ID ?? "accounts-app",
-    clientSecret: normalizeOptionalString(input.clientSecret ?? process.env.ACCOUNTS_CLIENT_SECRET),
-    redirectUri: input.redirectUri ?? process.env.ACCOUNTS_REDIRECT_URI ?? "http://localhost:5173/auth/callback",
-    logoutRedirectUri: input.logoutRedirectUri ?? process.env.ACCOUNTS_LOGOUT_REDIRECT_URI ?? "http://localhost:5173/",
-    useMock: input.useMock ?? (process.env.ACCOUNTS_USE_MOCK === "true" || !process.env.ACCOUNTS_BASE_URL || !process.env.ACCOUNTS_CLIENT_ID)
-  };
-}
-function createPlatformAuth() {
-  return {
-    readSession(cookieHeader) {
-      return readPlatformSessionCookie(cookieHeader);
-    },
-    requirePrincipal(session) {
-      if (!session.principal) {
-        throw new Error("Authentication required.");
-      }
-      return session.principal;
-    }
-  };
-}
-function beginAccountsLoginRedirect(config, options) {
-  const nonce = globalThis.crypto?.randomUUID?.() ?? Math.random().toString(36).slice(2);
-  const state = {
-    nonce,
-    nextPath: options.nextPath && options.nextPath.startsWith("/") ? options.nextPath : "/",
-    tenantSlug: options.tenantSlug
-  };
-  if (config.useMock) {
-    const redirectUrl = new URL(config.redirectUri);
-    redirectUrl.searchParams.set("code", `demo_${nonce}`);
-    redirectUrl.searchParams.set("state", serializeAuthorizationState(state));
-    return {
-      redirectUrl: redirectUrl.toString(),
-      stateValue: serializeAuthorizationState(state),
-      stateCookie: createStateCookie(serializeAuthorizationState(state), options.cookieOptions)
-    };
-  }
-  const authorizeUrl = new URL("/auth/authorize", config.baseUrl);
-  authorizeUrl.searchParams.set("app_id", config.clientId);
-  authorizeUrl.searchParams.set("redirect_uri", config.redirectUri);
-  authorizeUrl.searchParams.set("state", serializeAuthorizationState(state));
-  return {
-    redirectUrl: authorizeUrl.toString(),
-    stateValue: serializeAuthorizationState(state),
-    stateCookie: createStateCookie(serializeAuthorizationState(state))
-  };
-}
-async function handleAccountsCallback(input) {
-  if (!input.code) {
-    throw new Error("Missing authorization code.");
-  }
-  if (input.storedState && input.state !== input.storedState) {
-    throw new Error("Invalid authorization state.");
-  }
-  const parsedState = parseAuthorizationState(input.state);
-  const tokenResponse = await exchangeAuthorizationCode({
-    config: input.config,
-    code: input.code,
-    fetchImpl: input.fetchImpl
-  });
-  const identity = normalizeIdentity(tokenResponse.user);
-  const local = await input.syncAccountsUser(identity);
-  const session = {
-    principal: {
-      identity,
-      user: local.user,
-      tenantAccess: {
-        activeTenantId: local.activeTenantId,
-        memberships: local.memberships
-      }
-    },
-    tenant: null,
-    accessToken: tokenResponse.access_token,
-    refreshToken: tokenResponse.refresh_token,
-    expiresAt: new Date(Date.now() + tokenResponse.expires_in * 1e3).toISOString()
-  };
-  return {
-    session,
-    nextPath: parsedState.nextPath,
-    tenantSlug: parsedState.tenantSlug,
-    sessionCookie: createSessionCookie(session, input.cookieOptions, input.secret),
-    clearStateCookie: clearStateCookie(input.cookieOptions)
-  };
-}
-async function exchangeAuthorizationCode(input) {
-  if (input.config.useMock || input.code.startsWith("demo_")) {
-    return createMockTokenResponse(input.code);
-  }
-  const fetchImpl = input.fetchImpl ?? fetch;
-  const clientSecret = normalizeOptionalString(input.config.clientSecret);
-  const tokenBody = {
-    grant_type: "authorization_code",
-    code: input.code,
-    redirect_uri: input.config.redirectUri,
-    client_id: input.config.clientId
-  };
-  if (clientSecret) {
-    tokenBody.client_secret = clientSecret;
-  }
-  const response = await fetchImpl(new URL("/api/auth/token", input.config.baseUrl), {
-    method: "POST",
-    headers: {
-      "content-type": "application/json"
-    },
-    body: JSON.stringify(tokenBody)
-  });
-  if (!response.ok) {
-    throw new Error(`Accounts token exchange failed with status ${response.status}.`);
-  }
-  return await response.json();
-}
-function syncAccountsUser(identity, syncer) {
-  return syncer(identity);
-}
-var identityPassthroughSync = (identity) => ({
-  user: {
-    id: identity.id,
-    externalIdentityId: identity.id,
-    email: identity.email,
-    name: identity.name,
-    firstName: identity.firstName,
-    lastName: identity.lastName
-  },
-  memberships: []
-});
-function resolveActiveTenant(memberships, preferredTenantId) {
-  if (preferredTenantId && memberships.some((membership) => membership.tenantId === preferredTenantId)) {
-    return preferredTenantId;
-  }
-  return memberships.find((membership) => membership.isDefault)?.tenantId ?? memberships[0]?.tenantId;
-}
-function readPlatformSessionCookie(cookieHeader, opts) {
-  const cookieValue = readCookie(cookieHeader, SESSION_COOKIE_NAME);
-  if (!cookieValue) {
-    return { principal: null, tenant: null };
-  }
-  let raw = cookieValue;
-  if (opts?.secret) {
-    const verified = unsignValue(cookieValue, opts.secret);
-    if (verified == null) return { principal: null, tenant: null };
-    raw = verified;
-  }
-  try {
-    return JSON.parse(decodeURIComponent(raw));
-  } catch {
-    return { principal: null, tenant: null };
-  }
-}
-function cookieAttrs(opts) {
-  const sameSite = opts?.sameSite ?? "lax";
-  const secure = opts?.secure || sameSite === "none";
-  const cap = sameSite.charAt(0).toUpperCase() + sameSite.slice(1);
-  return `Path=/; HttpOnly; SameSite=${cap}${secure ? "; Secure" : ""}`;
-}
-function signValue(value, secret) {
-  const sig = createHmac("sha256", secret).update(value).digest("hex");
-  return `${value}.${sig}`;
-}
-function unsignValue(signed, secret) {
-  const dot = signed.lastIndexOf(".");
-  if (dot < 0) return null;
-  const value = signed.slice(0, dot);
-  const sig = signed.slice(dot + 1);
-  if (!/^[0-9a-f]{64}$/.test(sig)) return null;
-  const expected = createHmac("sha256", secret).update(value).digest("hex");
-  const a = Buffer.from(sig, "hex");
-  const b = Buffer.from(expected, "hex");
-  if (a.length !== b.length) return null;
-  return timingSafeEqual(a, b) ? value : null;
-}
-function clearPlatformSessionCookie(opts) {
-  return `${SESSION_COOKIE_NAME}=; ${cookieAttrs(opts)}; Max-Age=0`;
-}
-function createSessionCookie(session, opts, secret) {
-  const raw = encodeURIComponent(JSON.stringify(session));
-  const value = secret ? signValue(raw, secret) : raw;
-  return `${SESSION_COOKIE_NAME}=${value}; ${cookieAttrs(opts)}; Max-Age=${60 * 60 * 24 * 7}`;
-}
-function createStateCookie(value, opts) {
-  return `${STATE_COOKIE_NAME}=${encodeURIComponent(value)}; ${cookieAttrs(opts)}; Max-Age=${60 * 10}`;
-}
-function clearStateCookie(opts) {
-  return `${STATE_COOKIE_NAME}=; ${cookieAttrs(opts)}; Max-Age=0`;
-}
-function serializeAuthorizationState(state) {
-  return encodeURIComponent(JSON.stringify(state));
-}
-function parseAuthorizationState(value) {
-  try {
-    return JSON.parse(decodeURIComponent(value));
-  } catch {
-    throw new Error("Invalid authorization state payload.");
-  }
-}
-function normalizeIdentity(user) {
-  const firstName = user.firstName ?? user.first_name;
-  const lastName = user.lastName ?? user.last_name;
-  return {
-    id: user.id,
-    // Prefer the real address under either key; only synthesize when truly absent.
-    email: user.emailAddress ?? user.email ?? `${user.id}@accounts.local`,
-    name: user.name ?? ([firstName, lastName].filter(Boolean).join(" ") || "Accounts User"),
-    firstName,
-    lastName,
-    avatarUrl: user.avatarUrl ?? user.avatar_url
-  };
-}
-function createMockTokenResponse(code) {
-  const suffix = code.replace("demo_", "").slice(0, 8) || "demo";
-  return {
-    access_token: `access_${suffix}`,
-    refresh_token: `refresh_${suffix}`,
-    token_type: "Bearer",
-    expires_in: 60 * 60 * 24 * 7,
-    user: {
-      id: "accounts-user-demo-admin",
-      email: "hello@babyplanet.example",
-      name: "Baby Planet Admin",
-      first_name: "Baby",
-      last_name: "Planet"
-    }
-  };
-}
-function readCookie(cookieHeader, name) {
-  if (!cookieHeader) return null;
-  for (const part of cookieHeader.split(";")) {
-    const [key, ...rest] = part.trim().split("=");
-    if (key === name) {
-      return rest.join("=");
-    }
-  }
-  return null;
-}
-function serviceKeyFromRequest(request) {
-  const explicit = request.headers.get("x-api-key");
-  if (explicit && explicit.trim()) return explicit.trim();
-  const auth = request.headers.get("authorization");
-  if (auth && auth.startsWith("Bearer ")) {
-    const token = auth.slice(7).trim();
-    if (token.startsWith("sk_")) return token;
-  }
-  return null;
-}
-async function introspectServiceKey(input) {
-  const base = normalizeOptionalString(input.config.baseUrl);
-  if (!input.key || !base) return null;
-  const fetchImpl = input.fetchImpl ?? fetch;
-  try {
-    const res = await fetchImpl(new URL("/api/auth/service-keys/introspect", base), {
-      method: "POST",
-      headers: { "x-api-key": input.key, accept: "application/json" }
-    });
-    if (!res.ok) return null;
-    const data = await res.json();
-    if (!data.valid || !data.keyId) return null;
-    const accessibleApps = (data.accessibleApps ?? []).filter(
-      (a) => Boolean(a) && typeof a.id === "string" && typeof a.slug === "string"
-    ).map((a) => ({ id: a.id, slug: a.slug, name: a.name }));
-    return {
-      keyId: data.keyId,
-      tenantId: data.tenantId ?? null,
-      scopes: Array.isArray(data.scopes) ? data.scopes : [],
-      accessibleApps,
-      expiresAt: data.expiresAt ?? null
-    };
-  } catch {
-    return null;
-  }
-}
-async function logoutFromAccounts(input) {
-  const base = normalizeOptionalString(input.config.baseUrl);
-  if (!base || !input.accessToken) return { success: false };
-  const fetchImpl = input.fetchImpl ?? fetch;
-  try {
-    const res = await fetchImpl(new URL("/api/auth/logout", base), {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${input.accessToken}`,
-        accept: "application/json"
-      },
-      body: JSON.stringify({ all: input.all ?? false })
-    });
-    if (!res.ok) return { success: false };
-    return await res.json();
-  } catch {
-    return { success: false };
-  }
-}
-function verifyWebhookSignature(rawBody, signature, secret) {
-  if (!signature || !secret) return false;
-  const provided = (signature.startsWith("sha256=") ? signature.slice(7) : signature).toLowerCase();
-  if (!/^[0-9a-f]{64}$/.test(provided)) return false;
-  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
-  const a = Buffer.from(provided, "hex");
-  const b = Buffer.from(expected, "hex");
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(a, b);
-}
-function normalizeAccountsWebhook(payload) {
-  const body = payload && typeof payload === "object" ? payload : {};
-  const type = String(body.event ?? body.type ?? "unknown");
-  return { ...body, type, data: body.data };
-}
-function scopeSatisfied(granted, required) {
-  if (!granted || granted.length === 0) return false;
-  return granted.includes(required);
-}
-
-export {
-  createAccountsClientConfig,
-  createPlatformAuth,
-  beginAccountsLoginRedirect,
-  handleAccountsCallback,
-  exchangeAuthorizationCode,
-  syncAccountsUser,
-  identityPassthroughSync,
-  resolveActiveTenant,
-  readPlatformSessionCookie,
-  clearPlatformSessionCookie,
-  serviceKeyFromRequest,
-  introspectServiceKey,
-  logoutFromAccounts,
-  verifyWebhookSignature,
-  normalizeAccountsWebhook,
-  scopeSatisfied
-};