cauthy-auth 0.2.0 → 0.3.0

package/dist/index.js

@@ -20,10 +20,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  CauthyApiError: () => CauthyApiError,
   CauthyConfigError: () => CauthyConfigError,
   CauthyWebhookError: () => CauthyWebhookError,
   can: () => can,
+  connectSystem: () => connectSystem,
   createCauthy: () => createCauthy,
+  createSystem: () => createSystem,
   pushPolicy: () => pushPolicy,
   pushTheme: () => pushTheme,
   themeFromStackmyth: () => themeFromStackmyth,
@@ -87,8 +90,179 @@ async function unseal(sealed, key) {
   }
 }
 
-// src/webhook.ts
+// src/system.ts
 var import_jose2 = require("jose");
+
+// src/types.ts
+var CauthyConfigError = class extends Error {
+  constructor(message) {
+    super(`cauthy-auth: ${message}`);
+    this.name = "CauthyConfigError";
+  }
+};
+
+// src/system.ts
+var ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var SKEW_MS = 3e4;
+var CauthyApiError = class extends Error {
+  constructor(status, code, message) {
+    super(`cauthy-auth: ${message}`);
+    this.status = status;
+    this.code = code;
+    this.name = "CauthyApiError";
+  }
+  status;
+  code;
+};
+function env(name) {
+  return typeof process !== "undefined" ? process.env?.[name] : void 0;
+}
+function toOrganization(o) {
+  return {
+    id: o.id,
+    system: o.system,
+    name: o.name,
+    kind: o.kind,
+    externalId: o.external_id,
+    status: o.status,
+    metadata: o.metadata ?? {},
+    members: o.members,
+    createdAt: o.created_at,
+    updatedAt: o.updated_at
+  };
+}
+function toMember(m) {
+  return { userId: m.user_id, email: m.email, name: m.name, status: m.status, role: m.role, ...m.invited === void 0 ? {} : { invited: m.invited } };
+}
+function asJwk(k) {
+  if (typeof k.privateKey !== "string") return k.privateKey;
+  return k.privateKey.includes("BEGIN") ? void 0 : JSON.parse(k.privateKey);
+}
+async function loadKey(k) {
+  const jwk = asJwk(k);
+  return jwk ? (0, import_jose2.importJWK)(jwk, "RS256") : (0, import_jose2.importPKCS8)(k.privateKey, "RS256", { extractable: true });
+}
+function createSystem(given = {}) {
+  const issuer = (given.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET") ?? "";
+  const envKey = env("CAUTHY_SYSTEM_KEY");
+  const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env("CAUTHY_SYSTEM_KEY_ID") ?? "" } : void 0);
+  const doFetch = (...args) => (given.fetch ?? fetch)(...args);
+  const tokenEndpoint = `${issuer}/v1/oauth/token`;
+  function configured() {
+    if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address");
+    if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
+    if (key ? key.keyId === "" : clientSecret === "") {
+      throw new CauthyConfigError(key ? "the key needs its id (CAUTHY_SYSTEM_KEY_ID)" : "to act on its own the application needs its secret (CAUTHY_CLIENT_SECRET) or a key (CAUTHY_SYSTEM_KEY)");
+    }
+  }
+  let imported;
+  const signingKey = () => imported ??= loadKey(key);
+  async function fail(res, what) {
+    const body = await res.json().catch(() => null);
+    const first = body?.errors?.[0];
+    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused ${what} (${res.status}): ${first?.message ?? res.statusText}`);
+  }
+  let held;
+  let asking;
+  async function ask() {
+    configured();
+    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: clientId });
+    if (key) {
+      const assertion = await new import_jose2.SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(clientId).setSubject(clientId).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
+      form.set("client_assertion_type", ASSERTION_TYPE);
+      form.set("client_assertion", assertion);
+    } else {
+      form.set("client_secret", clientSecret);
+    }
+    const res = await doFetch(tokenEndpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form });
+    if (!res.ok) await fail(res, "the application's own token");
+    const t = await res.json();
+    held = { value: t.access_token, until: Date.now() + t.expires_in * 1e3 - SKEW_MS };
+    return t.access_token;
+  }
+  function token() {
+    if (held && Date.now() < held.until) return Promise.resolve(held.value);
+    return asking ??= ask().finally(() => {
+      asking = void 0;
+    });
+  }
+  async function call(method, path, body) {
+    const send = async () => doFetch(`${issuer}${path}`, {
+      method,
+      headers: { authorization: `Bearer ${await token()}`, ...body === void 0 ? {} : { "content-type": "application/json" } },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+    let res = await send();
+    if (res.status === 401 && held) {
+      held = void 0;
+      res = await send();
+    }
+    if (!res.ok) await fail(res, `${method} ${path}`);
+    return res.status === 204 ? void 0 : res.json();
+  }
+  const data = async (method, path, body) => (await call(method, path, body))?.data;
+  const id = encodeURIComponent;
+  return {
+    token,
+    request: data,
+    organizations: {
+      async list(query = {}) {
+        const q = new URLSearchParams();
+        for (const [k, v] of Object.entries(query)) if (v !== void 0) q.set(k, String(v));
+        const out2 = await call("GET", `/v1/organizations${q.size ? `?${q}` : ""}`);
+        return { items: out2.data.map(toOrganization), total: out2.total_count };
+      },
+      async create(input) {
+        return toOrganization(await data(
+          "POST",
+          "/v1/organizations",
+          { name: input.name, kind: input.kind, external_id: input.externalId, metadata: input.metadata }
+        ));
+      },
+      async get(orgId) {
+        return toOrganization(await data("GET", `/v1/organizations/${id(orgId)}`));
+      },
+      async update(orgId, patch) {
+        return toOrganization(await data("PATCH", `/v1/organizations/${id(orgId)}`, patch));
+      },
+      async remove(orgId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}`);
+      }
+    },
+    members: {
+      async list(orgId) {
+        return (await data("GET", `/v1/organizations/${id(orgId)}/members`)).map(toMember);
+      },
+      async add(orgId, m) {
+        return toMember(await data(
+          "POST",
+          `/v1/organizations/${id(orgId)}/members`,
+          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId }
+        ));
+      },
+      async setRole(orgId, userId, role) {
+        return toMember(await data("PUT", `/v1/organizations/${id(orgId)}/members/${id(userId)}`, { role }));
+      },
+      async remove(orgId, userId) {
+        await call("DELETE", `/v1/organizations/${id(orgId)}/members/${id(userId)}`);
+      }
+    },
+    async invite(person) {
+      const u = await data("POST", "/v1/users", { ...person, client_id: clientId });
+      return { id: u.id, email: u.email };
+    },
+    async publicJwks() {
+      if (!key) return { keys: [] };
+      const { kty, n, e } = asJwk(key) ?? await (0, import_jose2.exportJWK)(await signingKey());
+      return { keys: [{ kty, n, e, kid: key.keyId, alg: "RS256", use: "sig" }] };
+    }
+  };
+}
+
+// src/webhook.ts
+var import_jose3 = require("jose");
 var CauthyWebhookError = class extends Error {
   constructor(reason) {
     super(`cauthy-auth: webhook refused: ${reason}`);
@@ -101,15 +275,15 @@ var keys = /* @__PURE__ */ new Map();
 function keysOf(issuer) {
   let set = keys.get(issuer);
   if (set === void 0) {
-    set = (0, import_jose2.createRemoteJWKSet)(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 3e4 });
+    set = (0, import_jose3.createRemoteJWKSet)(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 3e4 });
     keys.set(issuer, set);
   }
   return set;
 }
 var hex = (s) => typeof s === "string" && s !== "" ? s : void 0;
 async function verifyWebhook(request, options = {}) {
-  const env2 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
-  const issuer = (options.issuer ?? env2 ?? "").replace(/\/+$/, "");
+  const env3 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
+  const issuer = (options.issuer ?? env3 ?? "").replace(/\/+$/, "");
   if (issuer === "") throw new CauthyWebhookError("issuer (CAUTHY_ISSUER) is not set");
   const signature = request.headers.get("x-cauthy-signature-jwt");
   if (!signature) throw new CauthyWebhookError("no signature");
@@ -117,7 +291,7 @@ async function verifyWebhook(request, options = {}) {
   const audience = options.url ?? request.url.split("?")[0];
   let claims;
   try {
-    const verified = await (0, import_jose2.jwtVerify)(signature, options.jwks ?? keysOf(issuer), {
+    const verified = await (0, import_jose3.jwtVerify)(signature, options.jwks ?? keysOf(issuer), {
       algorithms: ["RS256"],
       issuer,
       audience,
@@ -158,20 +332,12 @@ async function verifyWebhook(request, options = {}) {
   };
 }
 
-// src/types.ts
-var CauthyConfigError = class extends Error {
-  constructor(message) {
-    super(`cauthy-auth: ${message}`);
-    this.name = "CauthyConfigError";
-  }
-};
-
 // src/cauthy.ts
 var SESSION_DAYS = 30;
 var FLOW_SECONDS = 600;
 var SKEW_SECONDS = 30;
 var ORGANIZATIONS_TTL_MS = 6e4;
-function env(name) {
+function env2(name) {
   return typeof process !== "undefined" ? process.env?.[name] : void 0;
 }
 function b64url(bytes) {
@@ -198,11 +364,11 @@ function redirect(location, cookies = []) {
   return new Response(null, { status: 302, headers: h });
 }
 function createCauthy(given = {}) {
-  const issuer = (given.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
-  const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET");
-  const secret = given.secret ?? env("CAUTHY_SECRET") ?? "";
-  const system = given.system ?? env("CAUTHY_SYSTEM") ?? "";
+  const issuer = (given.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = given.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = given.clientSecret ?? env2("CAUTHY_CLIENT_SECRET");
+  const secret = given.secret ?? env2("CAUTHY_SECRET") ?? "";
+  const system = given.system ?? env2("CAUTHY_SYSTEM") ?? "";
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
   if (secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
@@ -471,6 +637,7 @@ function createCauthy(given = {}) {
   return {
     handler,
     webhook,
+    system: createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch }),
     getSession,
     status,
     resolve: resolve2,
@@ -683,11 +850,11 @@ function toWire(theme) {
   return wire;
 }
 async function pushTheme(o) {
-  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const clientId = o.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
-  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = o.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
   }
@@ -716,11 +883,11 @@ function can(organization, resource, action) {
   return organization.permissions.some((p) => matches(p, resource, action));
 }
 async function pushPolicy(o) {
-  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const system = o.system ?? env2("CAUTHY_SYSTEM") ?? "";
-  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const system = o.system ?? env3("CAUTHY_SYSTEM") ?? "";
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a policy`);
   }
@@ -734,12 +901,59 @@ async function pushPolicy(o) {
     throw new Error(`cauthy-auth: Cauthy refused the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
   }
 }
+
+// src/connect.ts
+function sessionSecret() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function connectSystem(o) {
+  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to connect a system`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/connect`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify({
+      system: o.system,
+      app_url: o.appUrl,
+      name: o.name,
+      callback_path: o.callbackPath,
+      events_url: o.eventsUrl,
+      events: o.events,
+      jwks_uri: o.jwksUri
+    })
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.data) {
+    const why = (body?.errors ?? []).map((e) => e.message).filter(Boolean).join("; ") || res.statusText;
+    throw new Error(`cauthy-auth: Cauthy did not connect the system (${res.status}): ${why}`);
+  }
+  const d = body.data;
+  return {
+    system: d.system,
+    clientId: d.client.client_id,
+    clientSecret: d.client_secret,
+    redirectUris: d.client.redirect_uris,
+    webhook: d.webhook,
+    env: { ...d.env, CAUTHY_SECRET: sessionSecret() }
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CauthyApiError,
   CauthyConfigError,
   CauthyWebhookError,
   can,
+  connectSystem,
   createCauthy,
+  createSystem,
   pushPolicy,
   pushTheme,
   themeFromStackmyth,