cauthy-auth 0.23.0 → 0.24.1

package/dist/index.mjs

@@ -57,10 +57,29 @@ async function unseal(sealed, key) {
 // src/system.ts
 import { exportJWK, importJWK, importPKCS8, SignJWT } from "jose";
 
+// src/url.ts
+function withoutTrailingSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
+  return s.slice(0, end);
+}
+
 // src/theme.ts
 var MAX_RADIUS = 40;
+function withoutComments(css) {
+  let out2 = "";
+  let i = 0;
+  for (; ; ) {
+    const open = css.indexOf("/*", i);
+    if (open < 0) return out2 + css.slice(i);
+    out2 += css.slice(i, open);
+    const close = css.indexOf("*/", open + 2);
+    if (close < 0) return out2;
+    i = close + 2;
+  }
+}
 function declarations(css) {
-  const text = css.replace(/\/\*[\s\S]*?\*\//g, "");
+  const text = withoutComments(css);
   const out2 = [];
   const within = [];
   let chunk = "";
@@ -155,7 +174,11 @@ function tokenValue(value) {
   if (/^\(|[ ,(]\(/.test(v)) return null;
   return v;
 }
-var THEME_SCOPE = /^(?:\s*(?::root|html|body|\[data-(?:theme|mode|color-scheme)(?:=["']?[\w-]+["']?)?\])\s*,?)+$/i;
+var THEME_SELECTOR = /^(?::root|html|body|\[data-(?:theme|mode|color-scheme)(?:=["']?[\w-]+["']?)?\])$/i;
+var isThemeScope = (selectors) => {
+  const parts = selectors.split(/[\s,]+/).filter(Boolean);
+  return parts.length > 0 && parts.every((one) => THEME_SELECTOR.test(one));
+};
 function tokensFromStackmyth(css, options = {}) {
   const mode = options.mode ?? "light";
   const all = (Array.isArray(css) ? css : [css]).flatMap(declarations);
@@ -163,7 +186,7 @@ function tokensFromStackmyth(css, options = {}) {
   const vars = /* @__PURE__ */ new Map();
   for (const d of all) {
     if (!applies(d, { mode, theme: named })) continue;
-    if (!d.within.every((w) => w.startsWith("@") || THEME_SCOPE.test(w))) continue;
+    if (!d.within.every((w) => w.startsWith("@") || isThemeScope(w))) continue;
     vars.set(d.name, d.value);
   }
   const inline = (value, depth = 0) => {
@@ -385,7 +408,7 @@ function fromWire(wire) {
 }
 async function pushTheme(o) {
   const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env4("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
   const clientId = o.clientId ?? env4("CAUTHY_CLIENT_ID") ?? "";
   const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
   const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
@@ -453,7 +476,7 @@ async function loadKey(k) {
   return jwk ? importJWK(jwk, "RS256") : importPKCS8(k.privateKey, "RS256", { extractable: true });
 }
 function createSystem(given = {}) {
-  const issuer = (given.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const issuer = withoutTrailingSlashes(given.issuer ?? env("CAUTHY_ISSUER") ?? "");
   const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
   const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET") ?? "";
   const envKey = env("CAUTHY_SYSTEM_KEY");
@@ -642,7 +665,7 @@ function keysOf(issuer) {
 var hex = (s) => typeof s === "string" && s !== "" ? s : void 0;
 async function verifyWebhook(request, options = {}) {
   const env4 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
-  const issuer = (options.issuer ?? env4 ?? "").replace(/\/+$/, "");
+  const issuer = withoutTrailingSlashes(options.issuer ?? env4 ?? "");
   if (issuer === "") throw new CauthyWebhookError("issuer (CAUTHY_ISSUER) is not set");
   const signature = request.headers.get("x-cauthy-signature-jwt");
   if (!signature) throw new CauthyWebhookError("no signature");
@@ -652,7 +675,6 @@ async function verifyWebhook(request, options = {}) {
   try {
     const verified = await jwtVerify(signature, options.jwks ?? keysOf(issuer), {
       algorithms: ["RS256"],
-      issuer,
       audience,
       typ: "cauthy-webhook+jwt",
       requiredClaims: ["exp", "iat", "jti", "body_sha256"],
@@ -663,6 +685,9 @@ async function verifyWebhook(request, options = {}) {
   } catch (err) {
     throw new CauthyWebhookError(err instanceof Error ? err.message : "bad signature");
   }
+  if (claims.iss !== issuer && claims.domain_iss !== issuer) {
+    throw new CauthyWebhookError('unexpected "iss" claim value');
+  }
   const now = Math.floor((options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
   if (typeof claims.iat !== "number" || claims.iat > now + 30) throw new CauthyWebhookError("signed in the future");
   const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", raw));
@@ -733,7 +758,7 @@ function redirect(location, cookies = []) {
   return new Response(null, { status: 302, headers: h });
 }
 function createCauthy(given = {}) {
-  const issuer = (given.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const issuer = withoutTrailingSlashes(given.issuer ?? env2("CAUTHY_ISSUER") ?? "");
   const clientId = given.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
   const clientSecret = given.clientSecret ?? env2("CAUTHY_CLIENT_SECRET");
   const secret = given.secret ?? env2("CAUTHY_SECRET") ?? "";
@@ -757,7 +782,7 @@ function createCauthy(given = {}) {
     verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0
   };
   const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch });
-  const originOf = (request) => (given.baseURL ?? new URL(request.url).origin).replace(/\/+$/, "");
+  const originOf = (request) => withoutTrailingSlashes(given.baseURL ?? new URL(request.url).origin);
   const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
   async function token(form) {
     const body2 = new URLSearchParams({ client_id: clientId, ...form });
@@ -1756,7 +1781,7 @@ function createCauthy(given = {}) {
   async function handler(request) {
     const url = new URL(request.url);
     if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) return new Response("Not found", { status: 404 });
-    const route = url.pathname.slice(basePath.length).replace(/\/+$/, "") || "/";
+    const route = withoutTrailingSlashes(url.pathname.slice(basePath.length)) || "/";
     const get = request.method === "GET" || request.method === "HEAD";
     const mine = await ownRoute(request, url, route);
     if (mine !== null) return mine;
@@ -1903,7 +1928,7 @@ export type Permission = PermissionOf<typeof policy>
 }
 async function pullPolicy(o = {}) {
   const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env4("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
   const system = o.system ?? env4("CAUTHY_SYSTEM") ?? "";
   const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
   const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
@@ -1919,7 +1944,7 @@ async function pullPolicy(o = {}) {
 }
 async function pushPolicy(o) {
   const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env4("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
   const system = o.system ?? env4("CAUTHY_SYSTEM") ?? "";
   const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
   const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
@@ -1946,7 +1971,7 @@ function sessionSecret() {
 }
 async function connectSystem(o) {
   const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env4("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
   const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
   const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
@@ -2009,7 +2034,7 @@ function bearer(from) {
   return /^Bearer\s+/i.test(header) ? header.replace(/^Bearer\s+/i, "").trim() : "";
 }
 async function verifyToken(from, options = {}) {
-  const issuer = (options.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const issuer = withoutTrailingSlashes(options.issuer ?? env3("CAUTHY_ISSUER") ?? "");
   if (issuer === "") throw new CauthyTokenError("issuer (CAUTHY_ISSUER) is not set");
   const token = bearer(from);
   if (token === "") throw new CauthyTokenError("no token");