cauthy-auth 0.27.1 → 0.28.1

package/dist/index.mjs

@@ -609,7 +609,111 @@ function createSystem(given = {}) {
 // src/validate.ts
 var MIN_PASSWORD = 12;
 var MAX_PASSWORD = 128;
+var FLOOR_PASSWORD = 8;
 var MAX_NAME = 120;
+var CLASSES = ["lowercase", "uppercase", "digit", "symbol"];
+var DEFAULT_PASSWORD_POLICY = Object.freeze({ min: MIN_PASSWORD, max: MAX_PASSWORD, requires: [], min_classes: 0, reject_breached: false });
+var int = (v, fallback) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : fallback;
+function passwordPolicyOf(raw) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  const min = Math.min(Math.max(int(r.min ?? r.min_length, MIN_PASSWORD) || MIN_PASSWORD, FLOOR_PASSWORD), MAX_PASSWORD);
+  const max = Math.max(Math.min(int(r.max ?? r.max_length, MAX_PASSWORD) || MAX_PASSWORD, MAX_PASSWORD), min);
+  const asked = Array.isArray(r.requires) ? r.requires : [];
+  return {
+    min,
+    max,
+    requires: CLASSES.filter((c) => asked.includes(c)),
+    min_classes: Math.min(Math.max(int(r.min_classes ?? r.minClasses, 0), 0), CLASSES.length),
+    reject_breached: (r.reject_breached ?? r.rejectBreached) === true
+  };
+}
+function utf8Length(v) {
+  let n = 0;
+  for (const ch of v) {
+    const c = ch.codePointAt(0);
+    n += c < 128 ? 1 : c < 2048 ? 2 : c < 65536 ? 3 : 4;
+  }
+  return n;
+}
+function classesOf(v) {
+  const has = /* @__PURE__ */ new Set();
+  for (const ch of v) {
+    if (/\p{Ll}/u.test(ch)) has.add("lowercase");
+    else if (/\p{Lu}/u.test(ch)) has.add("uppercase");
+    else if (/\p{Nd}/u.test(ch)) has.add("digit");
+    else if (!/\p{L}/u.test(ch)) has.add("symbol");
+  }
+  return has;
+}
+function passwordProblems(value, policy = DEFAULT_PASSWORD_POLICY) {
+  const p = passwordPolicyOf(policy);
+  const out2 = [];
+  const length = utf8Length(value);
+  if (length < p.min) out2.push("too_short");
+  if (length > p.max) out2.push("too_long");
+  const has = classesOf(value);
+  for (const c of p.requires) if (!has.has(c)) out2.push(`needs_${c}`);
+  if (p.min_classes > 0 && CLASSES.filter((c) => has.has(c)).length < p.min_classes) out2.push("needs_classes");
+  return out2;
+}
+var RULES = {
+  en: {
+    between: "Between {min} and {max} characters.",
+    requires: "Include {kinds}.",
+    and: "and",
+    classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+    breached: "Passwords found in known data breaches are not accepted.",
+    kinds: { lowercase: "a lowercase letter", uppercase: "an uppercase letter", digit: "a digit", symbol: "a symbol" },
+    reasons: {
+      too_short: "Use at least {min} characters.",
+      too_long: "Use at most {max} characters.",
+      needs_lowercase: "Include a lowercase letter.",
+      needs_uppercase: "Include an uppercase letter.",
+      needs_digit: "Include a digit.",
+      needs_symbol: "Include a symbol.",
+      needs_classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+      breached: "This password appears in a known data breach. Choose a different one."
+    }
+  },
+  es: {
+    between: "Entre {min} y {max} caracteres.",
+    requires: "Incluye {kinds}.",
+    and: "y",
+    classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+    breached: "No se aceptan contrase\xF1as que aparecen en filtraciones de datos conocidas.",
+    kinds: { lowercase: "una min\xFAscula", uppercase: "una may\xFAscula", digit: "un n\xFAmero", symbol: "un s\xEDmbolo" },
+    reasons: {
+      too_short: "Usa al menos {min} caracteres.",
+      too_long: "Usa como m\xE1ximo {max} caracteres.",
+      needs_lowercase: "Incluye una min\xFAscula.",
+      needs_uppercase: "Incluye una may\xFAscula.",
+      needs_digit: "Incluye un n\xFAmero.",
+      needs_symbol: "Incluye un s\xEDmbolo.",
+      needs_classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+      breached: "Esta contrase\xF1a aparece en una filtraci\xF3n de datos conocida. Elige otra."
+    }
+  }
+};
+var fill = (s, p) => s.replace("{min}", String(p.min)).replace("{max}", String(p.max)).replace("{n}", String(p.min_classes));
+function describePasswordPolicy(policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const parts = [fill(t.between, p)];
+  if (p.requires.length > 0) {
+    const kinds = p.requires.map((c) => t.kinds[c]);
+    const listed = kinds.length === 1 ? kinds[0] : `${kinds.slice(0, -1).join(", ")} ${t.and} ${kinds[kinds.length - 1]}`;
+    parts.push(t.requires.replace("{kinds}", listed));
+  }
+  if (p.min_classes > 0) parts.push(fill(t.classes, p));
+  if (p.reject_breached) parts.push(t.breached);
+  return parts.join(" ");
+}
+function explainPasswordProblems(reasons, policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const said = reasons.filter((r) => r in t.reasons).map((r) => fill(t.reasons[r], p));
+  return said.length > 0 ? said.join(" ") : describePasswordPolicy(p, locale);
+}
 var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function checkEmail(value) {
   const v = typeof value === "string" ? value.trim() : "";
@@ -622,13 +726,12 @@ function checkPassword(value) {
   if (value.length > MAX_PASSWORD) return { field: "password", code: "too_long", message: "That password is too long." };
   return null;
 }
-function checkNewPassword(value) {
-  const basic = checkPassword(value);
-  if (basic) return basic;
-  if (value.length < MIN_PASSWORD) {
-    return { field: "password", code: "too_short", message: `Use at least ${MIN_PASSWORD} characters.` };
-  }
-  return null;
+function checkNewPassword(value, policy) {
+  if (typeof value !== "string" || value === "") return { field: "password", code: "required", message: "Enter your password." };
+  const p = policy ? passwordPolicyOf(policy) : DEFAULT_PASSWORD_POLICY;
+  const reasons = passwordProblems(value, p);
+  if (reasons.length === 0) return null;
+  return { field: "password", code: reasons[0], message: explainPasswordProblems(reasons, p) };
 }
 function checkName(value) {
   if (value === void 0 || value === null || value === "") return null;
@@ -743,6 +846,13 @@ function providerIn(segment) {
 function env2(name) {
   return typeof process !== "undefined" ? process.env?.[name] : void 0;
 }
+function hostOf(origin) {
+  try {
+    return new URL(origin).hostname;
+  } catch {
+    return void 0;
+  }
+}
 function b64url(bytes) {
   let s = "";
   for (const b of bytes) s += String.fromCharCode(b);
@@ -776,6 +886,10 @@ function createCauthy(given = {}) {
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
   if (secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
+  const baseURL = given.baseURL ?? env2("CAUTHY_BASE_URL");
+  if (baseURL !== void 0 && baseURL !== "" && !/^https?:\/\/[^/]+\/*$/.test(baseURL)) {
+    throw new CauthyConfigError("baseURL (CAUTHY_BASE_URL) must be the application's public origin, e.g. https://app.example.com");
+  }
   const basePath = "/" + (given.basePath ?? "/api/auth").replace(/^\/+|\/+$/g, "");
   const afterSignIn = localPath(given.afterSignIn, "/");
   const afterSignOut = localPath(given.afterSignOut, "/");
@@ -791,7 +905,12 @@ function createCauthy(given = {}) {
     verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0
   };
   const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch });
-  const originOf = (request) => withoutTrailingSlashes(given.baseURL ?? new URL(request.url).origin);
+  const originOf = (request) => {
+    if (baseURL) return withoutTrailingSlashes(baseURL);
+    const url = new URL(request.url);
+    const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
+    return proto === "https" || proto === "http" ? `${proto}://${url.host}` : url.origin;
+  };
   const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
   async function token(form) {
     const body2 = new URLSearchParams({ client_id: clientId, ...form });
@@ -1087,11 +1206,20 @@ function createCauthy(given = {}) {
     connectedAt: String(d?.created_at ?? ""),
     lastUsedAt: String(d?.last_used_at ?? "")
   });
-  const problem = (status2, code, message, field, headers) => json({ error: { code, message, ...field ? { field } : {} } }, status2, headers);
+  const problem = (status2, code, message, field, headers, reasons) => json({ error: { code, message, ...field ? { field } : {}, ...reasons && reasons.length > 0 ? { reasons } : {} } }, status2, headers);
   const invalid = (p) => problem(400, p.code, p.message, p.field);
+  let explained = false;
   function ownRequest(request) {
     const origin = request.headers.get("origin");
-    if (origin !== null) return origin === originOf(request) || origin === new URL(request.url).origin;
+    if (origin !== null) {
+      const own = originOf(request);
+      if (origin === own || origin === new URL(request.url).origin) return true;
+      if (!explained && hostOf(origin) === new URL(own).hostname) {
+        explained = true;
+        console.warn(`cauthy-auth: refused a request from ${origin} as cross_site: this application sees itself as ${own}. Behind a proxy? Set CAUTHY_BASE_URL (or baseURL) to the public origin.`);
+      }
+      return false;
+    }
     return (request.headers.get("sec-fetch-site") ?? "same-origin") === "same-origin";
   }
   async function body(request) {
@@ -1145,7 +1273,8 @@ function createCauthy(given = {}) {
       const b = res.status === 204 || res.status === 202 ? null : await res.json().catch(() => null);
       if (res.ok) return { status: res.status, data: b?.data ?? b };
       const first = b?.errors?.[0];
-      return { status: res.status, data: null, error: { code: String(first?.code ?? "error"), message: String(first?.message ?? "The request could not be completed.") } };
+      const reasons = Array.isArray(first?.meta?.reasons) ? first.meta.reasons.map(String) : void 0;
+      return { status: res.status, data: null, error: { code: String(first?.code ?? "error"), message: String(first?.message ?? "The request could not be completed."), ...reasons ? { reasons } : {} } };
     } catch {
       return { status: 503, data: null, error: { code: "unavailable", message: "Sign-in is unavailable right now. Try again in a moment." } };
     }
@@ -1173,6 +1302,19 @@ function createCauthy(given = {}) {
     return json({ status: "signed_in", session: await toPublic(toSession(s)), ...more }, 200, h);
   }
   let lookCache = null;
+  let policyCache = null;
+  const keepPolicy = (settings) => {
+    policyCache = { until: Date.now() + LOOK_TTL_MS, policy: settings.error || !settings.data?.password_policy ? null : passwordPolicyOf(settings.data.password_policy) };
+    return policyCache.policy;
+  };
+  async function workspacePolicy(request) {
+    if (policyCache !== null && policyCache.until >= Date.now()) return policyCache.policy;
+    return keepPolicy(await ask(request, "GET", "/v1/auth/settings"));
+  }
+  async function newPasswordProblem(request, value) {
+    const policy = await workspacePolicy(request);
+    return checkNewPassword(value, policy ?? { min: 8, max: 128, requires: [], min_classes: 0, reject_breached: false });
+  }
   async function ownRoute(request, url, route) {
     const post = request.method === "POST";
     const own = [
@@ -1250,6 +1392,7 @@ function createCauthy(given = {}) {
         ask(request, "GET", "/v1/auth/sso/connections")
       ]);
       const list = Array.isArray(providers.data) ? providers.data : [];
+      const password = keepPolicy(settings);
       const here = place.data?.here === true;
       return json({
         providers: list.map((p) => ({ id: String(p.provider ?? p.id ?? ""), name: String(p.label ?? p.name ?? p.provider ?? "") })).filter((p) => p.id !== ""),
@@ -1265,7 +1408,9 @@ function createCauthy(given = {}) {
         sso: Array.isArray(sso.data) && sso.data.some((c) => c?.discoverable === true),
         // The terms a sign-up accepts and the consents it answers, when the workspace asks any.
         ...settings.data?.legal ? { legal: legalOf(settings.data.legal) } : {},
-        ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {}
+        ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {},
+        // What a new password must be: for the form to say it and check it.
+        ...password ? { password } : {}
       });
     }
     if (route === "/sign-in/sso" && !post) {
@@ -1555,13 +1700,13 @@ function createCauthy(given = {}) {
       return json({ status: "sent", sentTo: String(res.data?.sent_to ?? ""), channel: String(res.data?.channel ?? "sms") });
     }
     if (route === "/sign-up/email") {
-      const bad = firstProblem(checkName(b.name), checkEmail(b.email), checkNewPassword(b.password), checkOrganization(b.organization));
+      const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password), checkOrganization(b.organization));
       if (bad) return invalid(bad);
       const email = String(b.email).trim();
       const organization = typeof b.organization === "string" && b.organization.trim() !== "" ? { organization: { name: b.organization.trim() } } : {};
       const legal = { ...b.acceptLegal === true ? { accept_legal: true } : {}, ...b.consents && typeof b.consents === "object" ? { consents: b.consents } : {} };
       const made = await ask(request, "POST", "/v1/auth/register", { email, password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "", ...organization, ...legal }, pages.verifyEmail);
-      if (made.error) return problem(made.status, made.error.code, made.error.message);
+      if (made.error) return problem(made.status, made.error.code, made.error.message, made.error.code === "weak_password" ? "password" : void 0, void 0, made.error.reasons);
       if (made.data?.verification_required === true) return json({ status: "verification_required", email });
       const res = await ask(request, "POST", "/v1/auth/login", { email, password: b.password });
       if (res.error || res.data?.mfa_required === true) return json({ status: "verification_required", email });
@@ -1577,7 +1722,7 @@ function createCauthy(given = {}) {
       const mine = await signedInAs(request);
       if ("response" in mine) return mine.response;
       const as = (path, payload, method = "POST") => ask(request, method, path, payload, void 0, mine.token);
-      const refused = (res, field) => problem(res.status, res.error.code, res.error.message, field, mine.headers);
+      const refused = (res, field) => problem(res.status, res.error.code, res.error.message, field, mine.headers, res.error.reasons);
       const password = typeof b.password === "string" ? b.password : "";
       if (route === "/me") {
         const bad = checkName(b.name);
@@ -1598,7 +1743,7 @@ function createCauthy(given = {}) {
         return json({ status: "accepted" }, 200, mine.headers);
       }
       if (route === "/me/password") {
-        const bad = checkNewPassword(b.newPassword);
+        const bad = await newPasswordProblem(request, b.newPassword);
         if (bad) return problem(400, bad.code, bad.message, "newPassword");
         const res = await as("/v1/auth/me/password", { current_password: password, new_password: b.newPassword });
         if (res.error) return refused(res, res.error.code === "wrong_password" ? "password" : res.error.code === "weak_password" ? "newPassword" : void 0);
@@ -1691,7 +1836,7 @@ function createCauthy(given = {}) {
         return json({ status: "removed", id }, 200, mine.headers);
       }
       if (route === "/me/upgrade") {
-        const bad = firstProblem(checkName(b.name), checkEmail(b.email), checkNewPassword(b.password));
+        const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password));
         if (bad) return invalid(bad);
         const res = await as("/v1/auth/anonymous/upgrade", { email: String(b.email).trim(), password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "" });
         if (res.error) return refused(res, res.error.code === "weak_password" ? "password" : "email");
@@ -1758,10 +1903,10 @@ function createCauthy(given = {}) {
     const badLink = () => problem(422, "invalid_token", "This link is not valid, or it has expired.");
     if (route === "/reset-password") {
       if (!isToken(b.token)) return badLink();
-      const bad = checkNewPassword(b.password);
+      const bad = await newPasswordProblem(request, b.password);
       if (bad) return invalid(bad);
       const res = await ask(request, "POST", "/v1/auth/password/change", { token: String(b.token), new_password: b.password });
-      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === "weak_password" ? "password" : void 0);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === "weak_password" ? "password" : void 0, void 0, res.error.reasons);
       return json({ status: "changed" });
     }
     if (route === "/verify-email") {
@@ -2134,6 +2279,7 @@ export {
   CauthyConfigError,
   CauthyTokenError,
   CauthyWebhookError,
+  DEFAULT_PASSWORD_POLICY,
   MIN_PASSWORD,
   can,
   checkCode,
@@ -2145,6 +2291,10 @@ export {
   createCauthy,
   createSystem,
   definePolicy,
+  describePasswordPolicy,
+  explainPasswordProblems,
+  passwordPolicyOf,
+  passwordProblems,
   policySource,
   pullPolicy,
   pushPolicy,