cauthy-auth 0.38.2 → 0.40.0

package/README.md

@@ -235,7 +235,7 @@ npx cauthy-auth init
 npx cauthy-auth init --system ledger --app-url https://app.example.com   # production
 ```
 
-The same client is your application's own identity: it manages its organizations with no person's token.
+The same client is your application's own identity: it manages its organizations with no person's token. When people sign in with a public client (no secret) and the application's identity is a confidential client beside it, give the key that client's id: `systemKey: { privateKey, keyId, clientId }`. Its sign-ins then carry the proof that tells Cauthy which application signed the person in, and from what address. The proof also goes with the code exchange at the end of a sign-in through Cauthy's page, which a contract can require (`sign_in.require_system_proof`).
 
 ```ts
 const org = await auth.system.organizations.create({ name: 'Acme' })

package/dist/index.js

@@ -1212,13 +1212,13 @@ function createCauthy(given = {}) {
     return proto === "https" || proto === "http" ? `${proto}://${url.host}` : url.origin;
   };
   const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
-  async function token(form) {
+  async function token(form, proof = {}) {
     const body2 = new URLSearchParams({ client_id: clientId, ...form });
     if (clientSecret) body2.set("client_secret", clientSecret);
     try {
       const res = await doFetch(`${issuer}/v1/oauth/token`, {
         method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json", ...proof },
         body: body2
       });
       if (res.ok) return { ok: true, body: await res.json() };
@@ -1458,7 +1458,7 @@ function createCauthy(given = {}) {
       code,
       redirect_uri: `${originOf(request)}${basePath}/callback`,
       code_verifier: flow.verifier
-    });
+    }, await passedOn(request));
     const s = res.ok ? await stored(res.body) : null;
     if (s === null) return failed(request, "exchange_failed");
     return redirect(flow.returnTo, [...await write(request, s, had), writeCookie(flowCookie, "", attrs(request, 0)), writeCookie(againCookie, "", attrs(request, 0))]);
@@ -1561,16 +1561,16 @@ function createCauthy(given = {}) {
       return null;
     }
   }
-  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").pop()?.trim() || void 0);
+  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").map((a) => a.trim()).reverse().find((a) => a !== "" && !ownNetwork(a)));
   let noProofUntil = 0;
   async function passedOn(request) {
     if (Date.now() < noProofUntil) return {};
     const ip = clientIp(request);
     try {
-      const proof = { "x-cauthy-system-token": await ownSystem.token() };
+      const proof = { "x-cauthy-system-token": await ownSystem.token(), "x-cauthy-app-origin": originOf(request) };
       return ip ? { ...proof, "x-cauthy-client-ip": ip } : proof;
     } catch {
-      noProofUntil = Date.now() + 5 * 6e4;
+      noProofUntil = Date.now() + 3e4;
       return {};
     }
   }
@@ -2472,6 +2472,10 @@ function legalOf(raw) {
     consentPurposes: purposes.map((p) => ({ key: String(p.key ?? ""), label: String(p.label ?? ""), required: p.required === true }))
   };
 }
+function ownNetwork(address) {
+  const a = address.toLowerCase();
+  return /^(127\.|10\.|192\.168\.|169\.254\.|0\.)/.test(a) || /^172\.(1[6-9]|2\d|3[01])\./.test(a) || a === "::1" || /^f[cd]/.test(a) || /^fe[89ab]/.test(a) || a.startsWith("::ffff:127.") || a === "localhost";
+}
 
 // src/connect.ts
 function sessionSecret() {