cauthy-auth 0.9.0 → 0.11.0

package/dist/index.mjs

@@ -921,7 +921,11 @@ function createCauthy(given = {}) {
     if (prompt === "login" || prompt === "none") q.set("prompt", prompt);
     const locale = url.searchParams.get("locale") ?? url.searchParams.get("ui_locales");
     if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set("ui_locales", locale);
-    const passkey = url.searchParams.get("method") === "passkey" ? "#passkey" : "";
+    let passkey = "";
+    if (url.searchParams.get("method") === "passkey") {
+      q.set("method", "passkey");
+      passkey = "#passkey";
+    }
     return redirect(`${issuer}/v1/oauth/authorize?${q}${passkey}`, [
       writeCookie(flowCookie, await seal(flow, await key), attrs(request, FLOW_SECONDS))
     ]);
@@ -946,6 +950,10 @@ function createCauthy(given = {}) {
     const error = url.searchParams.get("error");
     if (error !== null) {
       if (error === "login_required") return redirect(flow.returnTo, [writeCookie(flowCookie, "", attrs(request, 0))]);
+      if (error === "access_denied") {
+        const back = pages.signIn ?? flow.returnTo;
+        return redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=cancelled`, [writeCookie(flowCookie, "", attrs(request, 0))]);
+      }
       return failed(request, error.slice(0, 60));
     }
     const code = url.searchParams.get("code");
@@ -976,6 +984,14 @@ function createCauthy(given = {}) {
     return redirect(`${issuer}/v1/oauth/logout?${q}`, clearParts(cookieName, attrs(request, 0), had));
   }
   const STEP_SECONDS = 600;
+  const PASSKEY_SECONDS = 300;
+  const isCredential = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.id === "string" && typeof v.response === "object";
+  const passkeyOf = (d) => ({
+    id: String(d?.id ?? ""),
+    name: String(d?.nickname ?? ""),
+    createdAt: String(d?.created_at ?? ""),
+    lastUsedAt: d?.last_used_at ? String(d.last_used_at) : null
+  });
   const problem = (status2, code, message, field, headers) => json({ error: { code, message, ...field ? { field } : {} } }, status2, headers);
   const invalid = (p) => problem(400, p.code, p.message, p.field);
   function ownRequest(request) {
@@ -1013,10 +1029,15 @@ function createCauthy(given = {}) {
           accept: "application/json",
           // A link Cauthy mails opens the application's page for it when it
           // has one; otherwise Cauthy's own. Either way in the reader's language.
-          ...page ? { "x-cauthy-link-to": `${originOf(request)}${page}`, "x-cauthy-client-id": clientId } : { "x-cauthy-links": "hosted" },
+          ...page ? { "x-cauthy-link-to": `${originOf(request)}${page}` } : { "x-cauthy-links": "hosted" },
+          // Whose request it is: what Cauthy mails goes in this application's
+          // name, under its logo.
+          ...clientId ? { "x-cauthy-client-id": clientId } : {},
           ...await passedOn(request),
           ...bearer2 ? { authorization: `Bearer ${bearer2}` } : {},
           ...request.headers.get("accept-language") ? { "accept-language": request.headers.get("accept-language") } : {},
+          // The language the application says its person reads, over the browser's.
+          ...request.headers.get("x-cauthy-locale") ? { "x-cauthy-locale": request.headers.get("x-cauthy-locale") } : {},
           ...request.headers.get("user-agent") ? { "user-agent": request.headers.get("user-agent") } : {},
           ...payload === void 0 ? {} : { "content-type": "application/json" }
         },
@@ -1055,7 +1076,37 @@ function createCauthy(given = {}) {
   let lookCache = null;
   async function ownRoute(request, url, route) {
     const post = request.method === "POST";
-    const own = ["/sign-in/email", "/sign-in/mfa", "/sign-up/email", "/forgot-password", "/reset-password", "/verify-email", "/sign-in/magic-link", "/sign-in/magic-link/verify", "/sign-in/email-code", "/me", "/me/password", "/me/mfa/setup", "/me/mfa/verify", "/me/mfa/disable", "/me/mfa/recovery-codes", "/me/sessions", "/me/sessions/end", "/me/email", "/me/identities", "/me/identities/unlink", "/sign-out", "/methods", "/look"].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/");
+    const own = [
+      "/sign-in/email",
+      "/sign-in/mfa",
+      "/sign-up/email",
+      "/forgot-password",
+      "/reset-password",
+      "/verify-email",
+      "/sign-in/magic-link",
+      "/sign-in/magic-link/verify",
+      "/sign-in/email-code",
+      "/me",
+      "/me/password",
+      "/me/mfa/setup",
+      "/me/mfa/verify",
+      "/me/mfa/disable",
+      "/me/mfa/recovery-codes",
+      "/me/sessions",
+      "/me/sessions/end",
+      "/me/email",
+      "/me/identities",
+      "/me/identities/unlink",
+      "/sign-out",
+      "/methods",
+      "/look",
+      "/sign-in/passkey/begin",
+      "/sign-in/passkey/finish",
+      "/me/passkeys",
+      "/me/passkeys/add/begin",
+      "/me/passkeys/add/finish",
+      "/me/passkeys/remove"
+    ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/");
     if (!own) return null;
     if (tenant === "") {
       return problem(500, "not_configured", "cauthy-auth: tenant (CAUTHY_TENANT) is required for the application's own sign-in screens");
@@ -1068,15 +1119,21 @@ function createCauthy(given = {}) {
       return json(lookCache.look);
     }
     if (route === "/methods" && !post) {
-      const [providers, settings] = await Promise.all([ask(request, "GET", "/v1/auth/social/providers"), ask(request, "GET", "/v1/auth/settings")]);
+      const [providers, settings, place] = await Promise.all([
+        ask(request, "GET", "/v1/auth/social/providers"),
+        ask(request, "GET", "/v1/auth/settings"),
+        ask(request, "GET", `/v1/auth/webauthn/place?origin=${encodeURIComponent(originOf(request))}`)
+      ]);
       const list = Array.isArray(providers.data) ? providers.data : [];
+      const here = place.data?.here === true;
       return json({
         providers: list.map((p) => ({ id: String(p.provider ?? p.id ?? ""), name: String(p.label ?? p.name ?? p.provider ?? "") })).filter((p) => p.id !== ""),
         signUp: settings.data?.allow_signup !== false,
         // A sign-in link needs a page of the application to open.
         magicLink: settings.data?.allow_magic_link === true && pages.signIn !== void 0,
-        // Asked for on Cauthy's page: the person goes there for that step and comes back.
-        passkey: true
+        passkey: place.error ? true : here || place.data?.on_cauthy === true,
+        passkeyHere: here,
+        passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true
       });
     }
     if (route.startsWith("/sign-in/social/") && !post) {
@@ -1138,6 +1195,14 @@ function createCauthy(given = {}) {
       const list = Array.isArray(res.data) ? res.data : [];
       return json({ identities: list.map((x) => ({ provider: String(x.provider ?? ""), email: String(x.email ?? ""), name: String(x.name ?? ""), linkedAt: String(x.linked_at ?? "") })) }, 200, mine.headers);
     }
+    if (route === "/me/passkeys" && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", "/v1/auth/webauthn/credentials", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      const list = Array.isArray(res.data) ? res.data : [];
+      return json({ passkeys: list.map(passkeyOf) }, 200, mine.headers);
+    }
     if ((route === "/me" || route === "/me/sessions") && !post) {
       const mine = await signedInAs(request);
       if ("response" in mine) return mine.response;
@@ -1269,6 +1334,33 @@ function createCauthy(given = {}) {
         if (res.error) return refused(res);
         return json({ status: "unlinked", provider }, 200, mine.headers);
       }
+      if (route === "/me/passkeys/add/begin") {
+        const res = await as("/v1/auth/webauthn/register/begin", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        const step = { kind: "enrol", token: String(res.data?.session_id ?? ""), returnTo: afterSignIn };
+        const h = new Headers(mine.headers);
+        h.append("set-cookie", writeCookie(stepCookie, await seal(step, await key), attrs(request, PASSKEY_SECONDS)));
+        return json({ status: "started", options: res.data?.options?.publicKey ?? res.data?.options ?? null }, 200, h);
+      }
+      if (route === "/me/passkeys/add/finish") {
+        const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+        const step = sealed ? await unseal(sealed, await key) : null;
+        if (step === null || step.kind !== "enrol") return problem(400, "step_expired", "Start adding the passkey again: it was asked for too long ago.", void 0, mine.headers);
+        if (!isCredential(b.credential)) return problem(400, "bad_request", "Send the passkey the browser made.", void 0, mine.headers);
+        const name = typeof b.name === "string" ? b.name.trim().slice(0, 60) : "";
+        const res = await as("/v1/auth/webauthn/register/finish", { session_id: step.token, nickname: name, credential: b.credential });
+        const h = new Headers(mine.headers);
+        h.append("set-cookie", writeCookie(stepCookie, "", attrs(request, 0)));
+        if (res.error) return problem(res.status, res.error.code === "attestation_invalid" ? "passkey_failed" : res.error.code, res.error.code === "attestation_invalid" ? "The passkey could not be added. Try again." : res.error.message, void 0, h);
+        return json({ status: "added", passkey: passkeyOf(res.data) }, 200, h);
+      }
+      if (route === "/me/passkeys/remove") {
+        const id = typeof b.id === "string" ? b.id : "";
+        if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, "invalid_passkey", "Say which passkey to remove.", void 0, mine.headers);
+        const res = await as(`/v1/auth/webauthn/credentials/${id}`, void 0, "DELETE");
+        if (res.error) return refused(res);
+        return json({ status: "removed", id }, 200, mine.headers);
+      }
       if (route === "/me/sessions/end") {
         const res = await as("/v1/auth/me/sessions", void 0, "DELETE");
         if (res.error) return refused(res);
@@ -1295,6 +1387,29 @@ function createCauthy(given = {}) {
       if (res.error) return problem(res.status, res.error.code, res.error.message);
       return json({ status: "verified" });
     }
+    if (route === "/sign-in/passkey/begin") {
+      const res = await ask(request, "POST", "/v1/auth/webauthn/login/begin", {});
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      const step = { kind: "passkey", token: String(res.data?.session_id ?? ""), returnTo: afterSignIn };
+      return json(
+        { status: "started", options: res.data?.options?.publicKey ?? res.data?.options ?? null },
+        200,
+        new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, PASSKEY_SECONDS)) })
+      );
+    }
+    if (route === "/sign-in/passkey/finish") {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      if (step === null || step.kind !== "passkey") return problem(400, "step_expired", "Try the passkey again: it was asked for too long ago.");
+      if (!isCredential(b.credential)) return problem(400, "bad_request", "Send the passkey the browser answered with.");
+      const res = await ask(request, "POST", "/v1/auth/webauthn/login/finish", { session_id: step.token, credential: b.credential });
+      const clear = writeCookie(stepCookie, "", attrs(request, 0));
+      if (res.error) {
+        const failed2 = ["assertion_invalid", "session_expired", "clone_detected", "not_found"].includes(res.error.code);
+        return problem(res.status, failed2 ? "passkey_failed" : res.error.code, failed2 ? "The passkey sign-in could not be completed. Try again, or sign in another way." : res.error.message, void 0, new Headers({ "set-cookie": clear }));
+      }
+      return signedIn(request, res.data, [clear]);
+    }
     if (route === "/sign-in/magic-link") {
       const bad = checkEmail(b.email);
       if (bad) return invalid(bad);