cauthy-auth 0.1.0 → 0.3.0

package/dist/index.mjs

@@ -54,6 +54,9 @@ async function unseal(sealed, key) {
   }
 }
 
+// src/system.ts
+import { exportJWK, importJWK, importPKCS8, SignJWT } from "jose";
+
 // src/types.ts
 var CauthyConfigError = class extends Error {
   constructor(message) {
@@ -62,12 +65,243 @@ var CauthyConfigError = class extends Error {
   }
 };
 
+// src/system.ts
+var ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var SKEW_MS = 3e4;
+var CauthyApiError = class extends Error {
+  constructor(status, code, message) {
+    super(`cauthy-auth: ${message}`);
+    this.status = status;
+    this.code = code;
+    this.name = "CauthyApiError";
+  }
+  status;
+  code;
+};
+function env(name) {
+  return typeof process !== "undefined" ? process.env?.[name] : void 0;
+}
+function toOrganization(o) {
+  return {
+    id: o.id,
+    system: o.system,
+    name: o.name,
+    kind: o.kind,
+    externalId: o.external_id,
+    status: o.status,
+    metadata: o.metadata ?? {},
+    members: o.members,
+    createdAt: o.created_at,
+    updatedAt: o.updated_at
+  };
+}
+function toMember(m) {
+  return { userId: m.user_id, email: m.email, name: m.name, status: m.status, role: m.role, ...m.invited === void 0 ? {} : { invited: m.invited } };
+}
+function asJwk(k) {
+  if (typeof k.privateKey !== "string") return k.privateKey;
+  return k.privateKey.includes("BEGIN") ? void 0 : JSON.parse(k.privateKey);
+}
+async function loadKey(k) {
+  const jwk = asJwk(k);
+  return jwk ? importJWK(jwk, "RS256") : importPKCS8(k.privateKey, "RS256", { extractable: true });
+}
+function createSystem(given = {}) {
+  const issuer = (given.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET") ?? "";
+  const envKey = env("CAUTHY_SYSTEM_KEY");
+  const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env("CAUTHY_SYSTEM_KEY_ID") ?? "" } : void 0);
+  const doFetch = (...args) => (given.fetch ?? fetch)(...args);
+  const tokenEndpoint = `${issuer}/v1/oauth/token`;
+  function configured() {
+    if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address");
+    if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
+    if (key ? key.keyId === "" : clientSecret === "") {
+      throw new CauthyConfigError(key ? "the key needs its id (CAUTHY_SYSTEM_KEY_ID)" : "to act on its own the application needs its secret (CAUTHY_CLIENT_SECRET) or a key (CAUTHY_SYSTEM_KEY)");
+    }
+  }
+  let imported;
+  const signingKey = () => imported ??= loadKey(key);
+  async function fail(res, what) {
+    const body = await res.json().catch(() => null);
+    const first = body?.errors?.[0];
+    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused ${what} (${res.status}): ${first?.message ?? res.statusText}`);
+  }
+  let held;
+  let asking;
+  async function ask() {
+    configured();
+    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: clientId });
+    if (key) {
+      const assertion = await new SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(clientId).setSubject(clientId).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
+      form.set("client_assertion_type", ASSERTION_TYPE);
+      form.set("client_assertion", assertion);
+    } else {
+      form.set("client_secret", clientSecret);
+    }
+    const res = await doFetch(tokenEndpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form });
+    if (!res.ok) await fail(res, "the application's own token");
+    const t = await res.json();
+    held = { value: t.access_token, until: Date.now() + t.expires_in * 1e3 - SKEW_MS };
+    return t.access_token;
+  }
+  function token() {
+    if (held && Date.now() < held.until) return Promise.resolve(held.value);
+    return asking ??= ask().finally(() => {
+      asking = void 0;
+    });
+  }
+  async function call(method, path, body) {
+    const send = async () => doFetch(`${issuer}${path}`, {
+      method,
+      headers: { authorization: `Bearer ${await token()}`, ...body === void 0 ? {} : { "content-type": "application/json" } },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+    let res = await send();
+    if (res.status === 401 && held) {
+      held = void 0;
+      res = await send();
+    }
+    if (!res.ok) await fail(res, `${method} ${path}`);
+    return res.status === 204 ? void 0 : res.json();
+  }
+  const data = async (method, path, body) => (await call(method, path, body))?.data;
+  const id = encodeURIComponent;
+  return {
+    token,
+    request: data,
+    organizations: {
+      async list(query = {}) {
+        const q = new URLSearchParams();
+        for (const [k, v] of Object.entries(query)) if (v !== void 0) q.set(k, String(v));
+        const out2 = await call("GET", `/v1/organizations${q.size ? `?${q}` : ""}`);
+        return { items: out2.data.map(toOrganization), total: out2.total_count };
+      },
+      async create(input) {
+        return toOrganization(await data(
+          "POST",
+          "/v1/organizations",
+          { name: input.name, kind: input.kind, external_id: input.externalId, metadata: input.metadata }
+        ));
+      },
+      async get(orgId) {
+        return toOrganization(await data("GET", `/v1/organizations/${id(orgId)}`));
+      },
+      async update(orgId, patch) {
+        return toOrganization(await data("PATCH", `/v1/organizations/${id(orgId)}`, patch));
+      },
+      async remove(orgId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}`);
+      }
+    },
+    members: {
+      async list(orgId) {
+        return (await data("GET", `/v1/organizations/${id(orgId)}/members`)).map(toMember);
+      },
+      async add(orgId, m) {
+        return toMember(await data(
+          "POST",
+          `/v1/organizations/${id(orgId)}/members`,
+          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId }
+        ));
+      },
+      async setRole(orgId, userId, role) {
+        return toMember(await data("PUT", `/v1/organizations/${id(orgId)}/members/${id(userId)}`, { role }));
+      },
+      async remove(orgId, userId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}/members/${id(userId)}`);
+      }
+    },
+    async invite(person) {
+      const u = await data("POST", "/v1/users", { ...person, client_id: clientId });
+      return { id: u.id, email: u.email };
+    },
+    async publicJwks() {
+      if (!key) return { keys: [] };
+      const { kty, n, e } = asJwk(key) ?? await exportJWK(await signingKey());
+      return { keys: [{ kty, n, e, kid: key.keyId, alg: "RS256", use: "sig" }] };
+    }
+  };
+}
+
+// src/webhook.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var CauthyWebhookError = class extends Error {
+  constructor(reason) {
+    super(`cauthy-auth: webhook refused: ${reason}`);
+    this.reason = reason;
+    this.name = "CauthyWebhookError";
+  }
+  reason;
+};
+var keys = /* @__PURE__ */ new Map();
+function keysOf(issuer) {
+  let set = keys.get(issuer);
+  if (set === void 0) {
+    set = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 3e4 });
+    keys.set(issuer, set);
+  }
+  return set;
+}
+var hex = (s) => typeof s === "string" && s !== "" ? s : void 0;
+async function verifyWebhook(request, options = {}) {
+  const env3 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
+  const issuer = (options.issuer ?? env3 ?? "").replace(/\/+$/, "");
+  if (issuer === "") throw new CauthyWebhookError("issuer (CAUTHY_ISSUER) is not set");
+  const signature = request.headers.get("x-cauthy-signature-jwt");
+  if (!signature) throw new CauthyWebhookError("no signature");
+  const raw = new Uint8Array(await request.arrayBuffer());
+  const audience = options.url ?? request.url.split("?")[0];
+  let claims;
+  try {
+    const verified = await jwtVerify(signature, options.jwks ?? keysOf(issuer), {
+      algorithms: ["RS256"],
+      issuer,
+      audience,
+      typ: "cauthy-webhook+jwt",
+      requiredClaims: ["exp", "iat", "jti", "body_sha256"],
+      currentDate: options.now,
+      clockTolerance: 30
+    });
+    claims = verified.payload;
+  } catch (err) {
+    throw new CauthyWebhookError(err instanceof Error ? err.message : "bad signature");
+  }
+  const now = Math.floor((options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
+  if (typeof claims.iat !== "number" || claims.iat > now + 30) throw new CauthyWebhookError("signed in the future");
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", raw));
+  let b64 = "";
+  for (const b of digest) b64 += String.fromCharCode(b);
+  const hash = btoa(b64).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  if (hash !== claims.body_sha256) throw new CauthyWebhookError("the body is not the one that was signed");
+  let body;
+  try {
+    body = JSON.parse(new TextDecoder().decode(raw));
+  } catch {
+    throw new CauthyWebhookError("the body is not JSON");
+  }
+  if (body.id !== claims.jti || body.event !== claims.evt || body.tenant_id !== claims.tid) {
+    throw new CauthyWebhookError("the body and its signature disagree");
+  }
+  const inner = body.data ?? {};
+  return {
+    id: String(body.id),
+    type: String(body.event),
+    tenantId: String(body.tenant_id),
+    createdAt: String(inner.created_at ?? body.created_at ?? ""),
+    ...hex(inner.user_id) ? { userId: inner.user_id } : {},
+    ...hex(inner.actor_id) ? { actorId: inner.actor_id } : {},
+    data: inner.data ?? {}
+  };
+}
+
 // src/cauthy.ts
 var SESSION_DAYS = 30;
 var FLOW_SECONDS = 600;
 var SKEW_SECONDS = 30;
 var ORGANIZATIONS_TTL_MS = 6e4;
-function env(name) {
+function env2(name) {
   return typeof process !== "undefined" ? process.env?.[name] : void 0;
 }
 function b64url(bytes) {
@@ -94,11 +328,11 @@ function redirect(location, cookies = []) {
   return new Response(null, { status: 302, headers: h });
 }
 function createCauthy(given = {}) {
-  const issuer = (given.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
-  const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET");
-  const secret = given.secret ?? env("CAUTHY_SECRET") ?? "";
-  const system = given.system ?? env("CAUTHY_SYSTEM") ?? "";
+  const issuer = (given.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = given.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = given.clientSecret ?? env2("CAUTHY_CLIENT_SECRET");
+  const secret = given.secret ?? env2("CAUTHY_SECRET") ?? "";
+  const system = given.system ?? env2("CAUTHY_SYSTEM") ?? "";
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
   if (secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
@@ -236,7 +470,8 @@ function createCauthy(given = {}) {
         kind: String(o.kind ?? ""),
         role: String(o.role ?? ""),
         metadata: o.metadata ?? {},
-        ...o.external_id ? { externalId: String(o.external_id) } : {}
+        ...o.external_id ? { externalId: String(o.external_id) } : {},
+        ...Array.isArray(o.permissions) ? { permissions: o.permissions.map(String), denied: Array.isArray(o.denied) ? o.denied.map(String) : [] } : {}
       })
     );
     if (orgCache.size > 5e3) orgCache.clear();
@@ -362,8 +597,11 @@ function createCauthy(given = {}) {
     const to = value === null ? urls.signIn(back) : `${basePath}/refresh?return_to=${encodeURIComponent(back)}`;
     return { response: redirect(to) };
   }
+  const webhook = (request, o = {}) => verifyWebhook(request, { issuer, url: o.url ?? `${originOf(request)}${new URL(request.url).pathname}`, jwks: o.jwks, now: o.now });
   return {
     handler,
+    webhook,
+    system: createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch }),
     getSession,
     status,
     resolve: resolve2,
@@ -576,11 +814,11 @@ function toWire(theme) {
   return wire;
 }
 async function pushTheme(o) {
-  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const clientId = o.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
-  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = o.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
   }
@@ -594,10 +832,94 @@ async function pushTheme(o) {
     throw new Error(`cauthy-auth: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
   }
 }
+
+// src/permissions.ts
+function matches(entry, resource, action) {
+  const i = entry.lastIndexOf(":");
+  if (i < 0) return false;
+  const r = entry.slice(0, i);
+  const a = entry.slice(i + 1);
+  return (r === "*" || r === resource) && (a === "*" || a === action);
+}
+function can(organization, resource, action) {
+  if (!organization?.permissions) return false;
+  if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
+  return organization.permissions.some((p) => matches(p, resource, action));
+}
+async function pushPolicy(o) {
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const system = o.system ?? env3("CAUTHY_SYSTEM") ?? "";
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a policy`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/systems/${encodeURIComponent(system)}/policy`, {
+    method: "PUT",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify({ roles: o.roles })
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(`cauthy-auth: Cauthy refused the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  }
+}
+
+// src/connect.ts
+function sessionSecret() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function connectSystem(o) {
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to connect a system`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/connect`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify({
+      system: o.system,
+      app_url: o.appUrl,
+      name: o.name,
+      callback_path: o.callbackPath,
+      events_url: o.eventsUrl,
+      events: o.events,
+      jwks_uri: o.jwksUri
+    })
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.data) {
+    const why = (body?.errors ?? []).map((e) => e.message).filter(Boolean).join("; ") || res.statusText;
+    throw new Error(`cauthy-auth: Cauthy did not connect the system (${res.status}): ${why}`);
+  }
+  const d = body.data;
+  return {
+    system: d.system,
+    clientId: d.client.client_id,
+    clientSecret: d.client_secret,
+    redirectUris: d.client.redirect_uris,
+    webhook: d.webhook,
+    env: { ...d.env, CAUTHY_SECRET: sessionSecret() }
+  };
+}
 export {
+  CauthyApiError,
   CauthyConfigError,
+  CauthyWebhookError,
+  can,
+  connectSystem,
   createCauthy,
+  createSystem,
+  pushPolicy,
   pushTheme,
-  themeFromStackmyth
+  themeFromStackmyth,
+  verifyWebhook
 };
 //# sourceMappingURL=index.mjs.map