cauthy-auth 0.38.1 → 0.39.0

package/README.md

@@ -235,7 +235,7 @@ npx cauthy-auth init
 npx cauthy-auth init --system ledger --app-url https://app.example.com   # production
 ```
 
-The same client is your application's own identity: it manages its organizations with no person's token.
+The same client is your application's own identity: it manages its organizations with no person's token. When people sign in with a public client (no secret) and the application's identity is a confidential client beside it, give the key that client's id: `systemKey: { privateKey, keyId, clientId }`. Its sign-ins then carry the proof that tells Cauthy which application signed the person in, and from what address.
 
 ```ts
 const org = await auth.system.organizations.create({ name: 'Acme' })

package/dist/{cauthy-C-GoRXy9.d.mts → cauthy-3h6d8YXl.d.mts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, t as SessionStatus, s as SessionOrganization, f as CheckQuestion, k as OrganizationRef, g as CheckResult, d as CauthySystem, q as PublicSession, c as CauthyOptions } from './system-DUGV040y.mjs';
+import { J as JsonValue, S as Session, t as SessionStatus, s as SessionOrganization, f as CheckQuestion, k as OrganizationRef, g as CheckResult, d as CauthySystem, q as PublicSession, c as CauthyOptions } from './system-CqPa5xR5.mjs';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/{cauthy-BUozWD72.d.ts → cauthy-C-_Bj6-L.d.ts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, t as SessionStatus, s as SessionOrganization, f as CheckQuestion, k as OrganizationRef, g as CheckResult, d as CauthySystem, q as PublicSession, c as CauthyOptions } from './system-Bz4haPrI.js';
+import { J as JsonValue, S as Session, t as SessionStatus, s as SessionOrganization, f as CheckQuestion, k as OrganizationRef, g as CheckResult, d as CauthySystem, q as PublicSession, c as CauthyOptions } from './system-Dssq1JUJ.js';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/cli.js

@@ -1013,9 +1013,10 @@ function createSystem(given = {}) {
   let asking;
   async function ask() {
     configured();
-    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: clientId });
+    const self = key?.clientId || clientId;
+    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: self });
     if (key) {
-      const assertion = await new import_jose.SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(clientId).setSubject(clientId).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
+      const assertion = await new import_jose.SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(self).setSubject(self).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
       form.set("client_assertion_type", ASSERTION_TYPE);
       form.set("client_assertion", assertion);
     } else {

package/dist/client.d.mts

@@ -1,6 +1,6 @@
 import { CauthyTheme } from './theme.mjs';
-import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-DUGV040y.mjs';
-export { h as CheckRule } from './system-DUGV040y.mjs';
+import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-CqPa5xR5.mjs';
+export { h as CheckRule } from './system-CqPa5xR5.mjs';
 import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.mjs';
 export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.mjs';
 import 'jose';

package/dist/client.d.ts

@@ -1,6 +1,6 @@
 import { CauthyTheme } from './theme.js';
-import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-Bz4haPrI.js';
-export { h as CheckRule } from './system-Bz4haPrI.js';
+import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-Dssq1JUJ.js';
+export { h as CheckRule } from './system-Dssq1JUJ.js';
 import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.js';
 export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.js';
 import 'jose';

package/dist/express.d.mts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { C as Cauthy } from './cauthy-C-GoRXy9.mjs';
-import { S as Session } from './system-DUGV040y.mjs';
+import { C as Cauthy } from './cauthy-3h6d8YXl.mjs';
+import { S as Session } from './system-CqPa5xR5.mjs';
 import 'jose';
 import './theme.mjs';
 

package/dist/express.d.ts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { C as Cauthy } from './cauthy-BUozWD72.js';
-import { S as Session } from './system-Bz4haPrI.js';
+import { C as Cauthy } from './cauthy-C-_Bj6-L.js';
+import { S as Session } from './system-Dssq1JUJ.js';
 import 'jose';
 import './theme.js';
 

package/dist/fastify.d.mts

@@ -1,6 +1,6 @@
 import { FastifyReply, FastifyPluginAsync } from 'fastify';
-import { C as Cauthy } from './cauthy-C-GoRXy9.mjs';
-import { S as Session } from './system-DUGV040y.mjs';
+import { C as Cauthy } from './cauthy-3h6d8YXl.mjs';
+import { S as Session } from './system-CqPa5xR5.mjs';
 import 'jose';
 import './theme.mjs';
 

package/dist/fastify.d.ts

@@ -1,6 +1,6 @@
 import { FastifyReply, FastifyPluginAsync } from 'fastify';
-import { C as Cauthy } from './cauthy-BUozWD72.js';
-import { S as Session } from './system-Bz4haPrI.js';
+import { C as Cauthy } from './cauthy-C-_Bj6-L.js';
+import { S as Session } from './system-Dssq1JUJ.js';
 import 'jose';
 import './theme.js';
 

package/dist/hono.d.mts

@@ -1,6 +1,6 @@
 import { MiddlewareHandler } from 'hono';
-import { C as Cauthy } from './cauthy-C-GoRXy9.mjs';
-import { S as Session } from './system-DUGV040y.mjs';
+import { C as Cauthy } from './cauthy-3h6d8YXl.mjs';
+import { S as Session } from './system-CqPa5xR5.mjs';
 import 'jose';
 import './theme.mjs';
 

package/dist/hono.d.ts

@@ -1,6 +1,6 @@
 import { MiddlewareHandler } from 'hono';
-import { C as Cauthy } from './cauthy-BUozWD72.js';
-import { S as Session } from './system-Bz4haPrI.js';
+import { C as Cauthy } from './cauthy-C-_Bj6-L.js';
+import { S as Session } from './system-Dssq1JUJ.js';
 import 'jose';
 import './theme.js';
 

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-C-GoRXy9.mjs';
-export { A as AttributeType, C as CatalogResource, a as CauthyApiError, b as CauthyConfigError, c as CauthyOptions, d as CauthySystem, e as CheckOf, f as CheckQuestion, g as CheckResult, h as CheckRule, i as ConditionalPermission, J as JsonValue, N as NewMember, O as Organization, j as OrganizationMember, k as OrganizationRef, P as PermissionOf, l as Permitted, m as Policy, n as PolicyDefinition, o as PolicyPermission, p as PolicyRole, q as PublicSession, r as PushPolicyOptions, R as RoleOf, S as Session, s as SessionOrganization, t as SessionStatus, u as SessionUser, v as SystemKey, w as SystemOptions, x as SystemPolicy, y as can, z as createSystem, B as definePolicy, D as policySource, E as pullCatalog, F as pullPolicy, G as pushCatalog, H as pushPolicy } from './system-DUGV040y.mjs';
+export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-3h6d8YXl.mjs';
+export { A as AttributeType, C as CatalogResource, a as CauthyApiError, b as CauthyConfigError, c as CauthyOptions, d as CauthySystem, e as CheckOf, f as CheckQuestion, g as CheckResult, h as CheckRule, i as ConditionalPermission, J as JsonValue, N as NewMember, O as Organization, j as OrganizationMember, k as OrganizationRef, P as PermissionOf, l as Permitted, m as Policy, n as PolicyDefinition, o as PolicyPermission, p as PolicyRole, q as PublicSession, r as PushPolicyOptions, R as RoleOf, S as Session, s as SessionOrganization, t as SessionStatus, u as SessionUser, v as SystemKey, w as SystemOptions, x as SystemPolicy, y as can, z as createSystem, B as definePolicy, D as policySource, E as pullCatalog, F as pullPolicy, G as pushCatalog, H as pushPolicy } from './system-CqPa5xR5.mjs';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.mjs';
 export { A as AuthField, D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, b as PasswordPolicy, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.mjs';
 import { JWTVerifyGetKey } from 'jose';

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-BUozWD72.js';
-export { A as AttributeType, C as CatalogResource, a as CauthyApiError, b as CauthyConfigError, c as CauthyOptions, d as CauthySystem, e as CheckOf, f as CheckQuestion, g as CheckResult, h as CheckRule, i as ConditionalPermission, J as JsonValue, N as NewMember, O as Organization, j as OrganizationMember, k as OrganizationRef, P as PermissionOf, l as Permitted, m as Policy, n as PolicyDefinition, o as PolicyPermission, p as PolicyRole, q as PublicSession, r as PushPolicyOptions, R as RoleOf, S as Session, s as SessionOrganization, t as SessionStatus, u as SessionUser, v as SystemKey, w as SystemOptions, x as SystemPolicy, y as can, z as createSystem, B as definePolicy, D as policySource, E as pullCatalog, F as pullPolicy, G as pushCatalog, H as pushPolicy } from './system-Bz4haPrI.js';
+export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-C-_Bj6-L.js';
+export { A as AttributeType, C as CatalogResource, a as CauthyApiError, b as CauthyConfigError, c as CauthyOptions, d as CauthySystem, e as CheckOf, f as CheckQuestion, g as CheckResult, h as CheckRule, i as ConditionalPermission, J as JsonValue, N as NewMember, O as Organization, j as OrganizationMember, k as OrganizationRef, P as PermissionOf, l as Permitted, m as Policy, n as PolicyDefinition, o as PolicyPermission, p as PolicyRole, q as PublicSession, r as PushPolicyOptions, R as RoleOf, S as Session, s as SessionOrganization, t as SessionStatus, u as SessionUser, v as SystemKey, w as SystemOptions, x as SystemPolicy, y as can, z as createSystem, B as definePolicy, D as policySource, E as pullCatalog, F as pullPolicy, G as pushCatalog, H as pushPolicy } from './system-Dssq1JUJ.js';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.js';
 export { A as AuthField, D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, b as PasswordPolicy, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.js';
 import { JWTVerifyGetKey } from 'jose';

package/dist/index.js

@@ -770,9 +770,10 @@ function createSystem(given = {}) {
   let asking;
   async function ask() {
     configured();
-    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: clientId });
+    const self = key?.clientId || clientId;
+    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: self });
     if (key) {
-      const assertion = await new import_jose2.SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(clientId).setSubject(clientId).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
+      const assertion = await new import_jose2.SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(self).setSubject(self).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
       form.set("client_assertion_type", ASSERTION_TYPE);
       form.set("client_assertion", assertion);
     } else {
@@ -1560,13 +1561,13 @@ function createCauthy(given = {}) {
       return null;
     }
   }
-  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").pop()?.trim() || void 0);
+  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").map((a) => a.trim()).reverse().find((a) => a !== "" && !ownNetwork(a)));
   let noProofUntil = 0;
   async function passedOn(request) {
     if (Date.now() < noProofUntil) return {};
     const ip = clientIp(request);
     try {
-      const proof = { "x-cauthy-system-token": await ownSystem.token() };
+      const proof = { "x-cauthy-system-token": await ownSystem.token(), "x-cauthy-app-origin": originOf(request) };
       return ip ? { ...proof, "x-cauthy-client-ip": ip } : proof;
     } catch {
       noProofUntil = Date.now() + 5 * 6e4;
@@ -2471,6 +2472,10 @@ function legalOf(raw) {
     consentPurposes: purposes.map((p) => ({ key: String(p.key ?? ""), label: String(p.label ?? ""), required: p.required === true }))
   };
 }
+function ownNetwork(address) {
+  const a = address.toLowerCase();
+  return /^(127\.|10\.|192\.168\.|169\.254\.|0\.)/.test(a) || /^172\.(1[6-9]|2\d|3[01])\./.test(a) || a === "::1" || /^f[cd]/.test(a) || /^fe[89ab]/.test(a) || a.startsWith("::ffff:127.") || a === "localhost";
+}
 
 // src/connect.ts
 function sessionSecret() {