alinea 1.7.0-preview.8 → 1.7.0

package/dist/.init/content/pages/welcome.json

@@ -1,5 +1,5 @@
 {
-  "_id": "3AAFNBSBqm6OwSCqZ2z4QoOx6xE",
+  "_id": "3FfV0NSwBQrEU7mbIBV6bd2LEJM",
   "_type": "Page",
   "_index": "a0",
   "_seeded": "welcome.json",

package/dist/LICENSES.md

@@ -28,11 +28,11 @@ SOFTWARE.
 
 ===
 
-# react-query@3.39.3 (MIT)
+# lib0@0.2.88 (MIT)
 
-MIT License
+The MIT License (MIT)
 
-Copyright (c) 2019 Tanner Linsley
+Copyright (c) 2019 Kevin Jahns <kevin.jahns@protonmail.com>.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -55,11 +55,11 @@ SOFTWARE.
 
 ===
 
-# lib0@0.2.88 (MIT)
+# react-query@3.39.3 (MIT)
 
-The MIT License (MIT)
+MIT License
 
-Copyright (c) 2019 Kevin Jahns <kevin.jahns@protonmail.com>.
+Copyright (c) 2019 Tanner Linsley
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -189,6 +189,33 @@ THIS IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRE
 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
+===
+
+# @badgateway/oauth2-client@3.2.0 (MIT)
+
+MIT License
+
+Copyright (c) 2019-2023 Evert Pot
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 ===
 
 # entities@4.5.0 (BSD-2-Clause)
@@ -208,11 +235,11 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ===
 
-# @badgateway/oauth2-client@3.2.0 (MIT)
+# prop-types@15.8.1 (MIT)
 
 MIT License
 
-Copyright (c) 2019-2023 Evert Pot
+Copyright (c) 2013-present, Facebook, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -440,33 +467,6 @@ SOFTWARE.
    limitations under the License.
 
 
-===
-
-# prop-types@15.8.1 (MIT)
-
-MIT License
-
-Copyright (c) 2013-present, Facebook, Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
 ===
 
 # react-is@16.13.1 (MIT)
@@ -523,33 +523,6 @@ MIT
 
 MIT
 
-===
-
-# y-prosemirror@1.2.15 (MIT)
-
-The MIT License (MIT)
-
-Copyright (c) 2019 Kevin Jahns <kevin.jahns@protonmail.com>.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
 ===
 
 # @babel/runtime@7.25.4 (MIT)
@@ -578,6 +551,33 @@ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
+===
+
+# y-prosemirror@1.2.15 (MIT)
+
+The MIT License (MIT)
+
+Copyright (c) 2019 Kevin Jahns <kevin.jahns@protonmail.com>.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 ===
 
 # @react-aria/focus@3.19.1 (Apache-2.0)

package/dist/adapter/next/handler.js

@@ -19,7 +19,7 @@ import { requestContext } from "./context.js";
 var handlers = /* @__PURE__ */ new WeakMap();
 function createHandler(input) {
   const options = input instanceof NextCMS ? { cms: input } : input;
-  const remote = options.remote ?? (options.backend ? createBackend(options.cms.config, options.backend) : (context) => new CloudRemote(context, options.cms));
+  const remote = options.remote ?? (options.backend ? createBackend(options.cms.config, options.backend) : (context) => new CloudRemote(context, options.cms.config));
   if (handlers.has(options.cms)) return handlers.get(options.cms);
   const config = options.cms.config;
   const db = PLazy.from(async () => {

package/dist/backend/api/OAuth2.d.ts

@@ -1,6 +1,7 @@
 import { Request, Response } from '@alinea/iso';
 import { Config } from 'alinea/core/Config';
 import type { AuthApi, AuthedContext, RequestContext } from 'alinea/core/Connection';
+import { JWTPayload } from 'alinea/core/util/JWT';
 export interface OAuth2Options {
     /**
      * OAuth2 clientId
@@ -36,6 +37,11 @@ export interface OAuth2Options {
      * Required for revoking tokens. Not supported by all servers.
      */
     revocationEndpoint?: string;
+    /**
+     * Extra claims to validate, such as `iss` or `aud`,
+     * If the claims are invalid, an error should be thrown.
+     */
+    validateClaims?(claims: JWTPayload): void;
 }
 export declare class OAuth2 implements AuthApi {
     #private;

package/dist/backend/api/OAuth2.js

@@ -457,13 +457,15 @@ var OAuth2 = class {
   #config;
   #client;
   #jwks;
+  #validateClaims;
   constructor(context, config, options) {
     this.#context = context;
     this.#config = config;
+    this.#validateClaims = options.validateClaims;
     this.#client = new OAuth2Client({
       ...options,
       authenticationMethod: "client_secret_basic_interop",
-      async fetch(input, init) {
+      fetch: async (input, init) => {
         const request = new Request2(input, init);
         const response = await fetch(request);
         if (!response.ok) {
@@ -526,7 +528,8 @@ var OAuth2 = class {
                   value: codeVerifier,
                   path: redirectUri.pathname,
                   secure: redirectUri.protocol === "https:",
-                  httpOnly: true
+                  httpOnly: true,
+                  sameSite: "lax"
                 })
               }
             }
@@ -601,31 +604,29 @@ var OAuth2 = class {
         throw new MissingCredentialsError("Missing access token cookie");
       const key = selectKey(jwks, accessToken);
       const user = await verify(accessToken, key);
+      this.#validateClaims?.(user);
+      assert(user.exp, "Missing exp claim in access token");
       const expiresSoon = user.exp - Math.floor(Date.now() / 1e3) < 30;
       if (expiresSoon && refreshToken)
         throw new InvalidCredentialsError("Access token will expire soon");
       return { ...ctx, user, token: accessToken };
     } catch (error) {
       if (!refreshToken) throw error;
-      const key = selectKey(jwks, refreshToken);
-      const [, failed] = await outcome(verify(refreshToken, key));
-      if (failed)
-        throw new InvalidCredentialsError("Invalid refresh token", {
-          cause: [failed, error]
-        });
       const token = { accessToken, refreshToken, expiresAt: null };
       const newToken = await this.#client.refreshToken(token).catch((cause) => {
         throw new InvalidCredentialsError("Failed to refresh token", {
           cause: [cause, error]
         });
       });
-      await verify(newToken.accessToken, key, {
+      const key = selectKey(jwks, newToken.accessToken);
+      const user = await verify(newToken.accessToken, key, {
         clockTolerance: 30
       }).catch((cause) => {
         throw new InvalidCredentialsError("Failed to verify user", {
           cause: [cause, error]
         });
       });
+      this.#validateClaims?.(user);
       throw Response.json(
         { type: AuthResultType.NeedsRefresh },
         {
@@ -639,10 +640,29 @@ var OAuth2 = class {
   }
 };
 function selectKey(jwks, token) {
-  const kid = decode(token).header.kid;
-  if (!kid) return jwks[0];
+  const { header } = decode(token);
+  const kid = header.kid;
+  const alg = header.alg;
+  if (!kid) {
+    if (jwks.length === 1) {
+      const key2 = jwks[0];
+      if (key2.alg && alg && key2.alg !== alg) {
+        throw new Error(
+          `Algorithm mismatch: token uses ${alg}, but key specifies ${key2.alg}`
+        );
+      }
+      return key2;
+    }
+    throw new Error(
+      'Token is missing "kid" header, and JWKS contains multiple keys'
+    );
+  }
   const key = jwks.find((k) => k.kid === kid);
   if (!key) throw new Error(`No key found for kid: ${kid}`);
+  if (key.alg && alg && key.alg !== alg)
+    throw new Error(
+      `Algorithm mismatch: token uses ${alg}, but key specifies ${key.alg}`
+    );
   return key;
 }
 function clearCookies(redirectUri) {
@@ -653,7 +673,8 @@ function clearCookies(redirectUri) {
       expires: /* @__PURE__ */ new Date(0),
       path: "/",
       secure: redirectUri.protocol === "https:",
-      httpOnly: true
+      httpOnly: true,
+      sameSite: "lax"
     },
     {
       name: COOKIE_REFRESH_TOKEN,
@@ -675,7 +696,8 @@ function tokenToCookie(token, redirectUri) {
       expires: token.expiresAt ? new Date(token.expiresAt) : void 0,
       path: "/",
       secure: redirectUri.protocol === "https:",
-      httpOnly: true
+      httpOnly: true,
+      sameSite: "lax"
     },
     {
       name: COOKIE_REFRESH_TOKEN,

package/dist/backend/router/Router.d.ts

@@ -38,6 +38,11 @@ export declare namespace router {
             url: URL;
             params: Record<string, unknown>;
         }>;
+        options(path: string): Route<globalThis.Request, {
+            request: globalThis.Request;
+            url: URL;
+            params: Record<string, unknown>;
+        }>;
         all(path: string): Route<globalThis.Request, {
             request: globalThis.Request;
             url: URL;
@@ -65,6 +70,11 @@ export declare namespace router {
             url: URL;
             params: Record<string, unknown>;
         }>;
+        options(path: string): Route<globalThis.Request, {
+            request: globalThis.Request;
+            url: URL;
+            params: Record<string, unknown>;
+        }>;
         all(path: string): Route<globalThis.Request, {
             request: globalThis.Request;
             url: URL;
@@ -92,6 +102,11 @@ export declare namespace router {
             url: URL;
             params: Record<string, unknown>;
         }>;
+        options(path: string): Route<globalThis.Request, {
+            request: globalThis.Request;
+            url: URL;
+            params: Record<string, unknown>;
+        }>;
         all(path: string): Route<globalThis.Request, {
             request: globalThis.Request;
             url: URL;

package/dist/backend/router/Router.js

@@ -91,6 +91,9 @@ function callHandler(handler, input) {
       delete(path) {
         return withMethod("DELETE").map(withPath(path, getPathname));
       },
+      options(path) {
+        return withMethod("OPTIONS").map(withPath(path, getPathname));
+      },
       all(path) {
         return withPath(path, getPathname);
       }

package/dist/backend/util/ExecGit.d.ts

@@ -1,8 +1,8 @@
 import PLazy from 'p-lazy';
 export declare function execGit(cwd: string, args: string[]): Promise<string>;
 export declare function gitUser(cwd: string): PLazy<{
-    name: string;
-    email: string;
     sub: string;
     roles: string[];
+    name: string;
+    email: string;
 }>;