cauthy-auth 0.22.0 → 0.24.0

package/dist/index.js

@@ -700,7 +700,6 @@ async function verifyWebhook(request, options = {}) {
   try {
     const verified = await (0, import_jose3.jwtVerify)(signature, options.jwks ?? keysOf(issuer), {
       algorithms: ["RS256"],
-      issuer,
       audience,
       typ: "cauthy-webhook+jwt",
       requiredClaims: ["exp", "iat", "jti", "body_sha256"],
@@ -711,6 +710,9 @@ async function verifyWebhook(request, options = {}) {
   } catch (err) {
     throw new CauthyWebhookError(err instanceof Error ? err.message : "bad signature");
   }
+  if (claims.iss !== issuer && claims.domain_iss !== issuer) {
+    throw new CauthyWebhookError('unexpected "iss" claim value');
+  }
   const now = Math.floor((options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
   if (typeof claims.iat !== "number" || claims.iat > now + 30) throw new CauthyWebhookError("signed in the future");
   const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", raw));
@@ -1191,6 +1193,9 @@ function createCauthy(given = {}) {
       "/me/mfa/phone/remove",
       "/sign-in/mfa/methods",
       "/sign-in/mfa/send",
+      "/sign-in/mfa/push",
+      "/sign-in/mfa/push/events",
+      "/sign-in/mfa/push/finish",
       "/me/sessions",
       "/me/sessions/end",
       "/me/email",
@@ -1420,6 +1425,28 @@ function createCauthy(given = {}) {
       }
       return json({ account: accountOf(res.data) }, 200, mine.headers);
     }
+    if (route === "/sign-in/mfa/push/events" && !post) {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      let upstream;
+      try {
+        upstream = await doFetch(`${issuer}/v1/auth/mfa/push/events`, {
+          headers: { "x-tenant-key": tenant, "x-mfa-token": step.token, accept: "text/event-stream" },
+          signal: request.signal
+        });
+      } catch {
+        return problem(503, "unavailable", "Cauthy could not be reached.");
+      }
+      if (!upstream.ok || !upstream.body) {
+        const b2 = await upstream.json().catch(() => null);
+        return problem(upstream.status, String(b2?.errors?.[0]?.code ?? "error"), String(b2?.errors?.[0]?.message ?? "The request could not be completed."));
+      }
+      return new Response(upstream.body, {
+        status: 200,
+        headers: { "content-type": "text/event-stream", "cache-control": "no-cache, no-store", "x-accel-buffering": "no" }
+      });
+    }
     if (!post) return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
     if (!ownRequest(request)) return problem(403, "cross_site", "This request did not come from this application.");
     if (route === "/sign-out") {
@@ -1471,6 +1498,19 @@ function createCauthy(given = {}) {
       if (res.error) return problem(res.status, res.error.code, res.error.message, "code");
       return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
     }
+    if (route === "/sign-in/mfa/push" || route === "/sign-in/mfa/push/finish") {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      if (route === "/sign-in/mfa/push") {
+        const res2 = await ask(request, "POST", "/v1/auth/mfa/push", { mfa_token: step.token });
+        if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
+        return json({ status: "sent", number: Number(res2.data?.number ?? 0) });
+      }
+      const res = await ask(request, "POST", "/v1/auth/mfa/challenge", { mfa_token: step.token, push: true });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
+    }
     if (route === "/sign-in/mfa/methods" || route === "/sign-in/mfa/send") {
       const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
       const step = sealed ? await unseal(sealed, await key) : null;
@@ -1479,7 +1519,13 @@ function createCauthy(given = {}) {
         const res2 = await ask(request, "POST", "/v1/auth/mfa/methods", { mfa_token: step.token });
         if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
         const p = res2.data?.phone;
-        return json({ status: "ok", totp: res2.data?.totp === true, phone: p ? { number: String(p.number ?? ""), channel: String(p.channel ?? "sms") } : null });
+        const push = res2.data?.push;
+        return json({
+          status: "ok",
+          totp: res2.data?.totp === true,
+          phone: p ? { number: String(p.number ?? ""), channel: String(p.channel ?? "sms") } : null,
+          push: push ? { devices: Number(push.devices ?? 0) } : null
+        });
       }
       const res = await ask(request, "POST", "/v1/auth/mfa/send", { mfa_token: step.token });
       if (res.error) return problem(res.status, res.error.code, res.error.message);