collabmd 0.1.21 → 0.1.23

package/src/server/auth/create-auth-service.js

@@ -1,6 +1,8 @@
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 
-import { createSessionCookieManager } from './session-cookie.js';
+import * as oidc from 'openid-client';
+
+import { createSessionCookieManager, createSignedCookieManager } from './session-cookie.js';
 
 export const AUTH_STRATEGY_NONE = 'none';
 export const AUTH_STRATEGY_PASSWORD = 'password';
@@ -12,6 +14,9 @@ export const SUPPORTED_AUTH_STRATEGIES = new Set([
   AUTH_STRATEGY_OIDC,
 ]);
 
+const OIDC_FLOW_TTL_MS = 10 * 60 * 1000;
+const OIDC_PROVIDER_GOOGLE = 'google';
+
 export function createRandomAuthPassword(length = 18) {
   const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789';
   const bytes = randomBytes(length);
@@ -36,6 +41,7 @@ function createResponse(statusCode, body, options = {}) {
   return {
     body,
     kind: options.kind || 'response',
+    redirectTo: options.redirectTo || '',
     setCookie: options.setCookie || null,
     statusCode,
   };
@@ -60,7 +66,127 @@ function prependBasePath(basePath, pathname) {
   return pathname === '/' ? basePath : `${basePath}${pathname}`;
 }
 
+function appendHashParam(path, key, value, publicBaseUrl) {
+  const url = new URL(path, publicBaseUrl);
+  const hashParams = new URLSearchParams(url.hash.startsWith('#') ? url.hash.slice(1) : url.hash);
+  hashParams.set(key, value);
+  url.hash = hashParams.toString();
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+
+function getDefaultReturnTo(basePath) {
+  return basePath ? `${basePath}/` : '/';
+}
+
+function sanitizeReturnTo(rawValue, { basePath = '', publicBaseUrl = '' } = {}) {
+  const fallback = getDefaultReturnTo(basePath);
+  const candidate = String(rawValue ?? '').trim();
+  if (!candidate) {
+    return fallback;
+  }
+
+  try {
+    const resolved = new URL(candidate, `${publicBaseUrl || 'http://localhost'}/`);
+    const publicOrigin = publicBaseUrl ? new URL(publicBaseUrl).origin : resolved.origin;
+    if (resolved.origin !== publicOrigin) {
+      return fallback;
+    }
+
+    if (basePath) {
+      const withinBasePath = resolved.pathname === basePath || resolved.pathname.startsWith(`${basePath}/`);
+      if (!withinBasePath) {
+        return fallback;
+      }
+    }
+
+    return `${resolved.pathname}${resolved.search}${resolved.hash}`;
+  } catch {
+    return fallback;
+  }
+}
+
+function isNonEmptyString(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function normalizeEmailAddress(value) {
+  return String(value ?? '').trim().toLowerCase();
+}
+
+function getEmailDomain(email) {
+  const normalized = normalizeEmailAddress(email);
+  const atIndex = normalized.lastIndexOf('@');
+  if (atIndex <= 0 || atIndex === normalized.length - 1) {
+    return '';
+  }
+
+  return normalized.slice(atIndex + 1);
+}
+
+function isOidcUserAllowed(oidcConfig, email) {
+  const normalizedEmail = normalizeEmailAddress(email);
+  const emailDomain = getEmailDomain(normalizedEmail);
+  const allowedEmails = Array.isArray(oidcConfig?.allowedEmails) ? oidcConfig.allowedEmails : [];
+  const allowedDomains = Array.isArray(oidcConfig?.allowedDomains) ? oidcConfig.allowedDomains : [];
+
+  if (allowedEmails.length === 0 && allowedDomains.length === 0) {
+    return { allowed: true };
+  }
+
+  if (allowedEmails.includes(normalizedEmail)) {
+    return { allowed: true, reason: 'email' };
+  }
+
+  if (allowedDomains.includes(emailDomain)) {
+    return { allowed: true, reason: 'domain' };
+  }
+
+  return {
+    allowed: false,
+    error: allowedEmails.length > 0 && allowedDomains.length > 0
+      ? 'This Google account is not in the allowed email or domain list.'
+      : allowedEmails.length > 0
+        ? 'This Google account is not in the allowed email list.'
+        : 'This Google account is not in an allowed domain.',
+  };
+}
+
+function readAuthenticatedOidcSession(sessionCookieManager, req) {
+  const session = sessionCookieManager.readSession(req);
+  if (session?.strategy !== AUTH_STRATEGY_OIDC) {
+    return null;
+  }
+
+  const user = session.user;
+  if (
+    !user
+    || typeof user !== 'object'
+    || !isNonEmptyString(user.sub)
+    || !isNonEmptyString(user.email)
+    || !isNonEmptyString(user.name)
+  ) {
+    return null;
+  }
+
+  const expiresAt = Number(session.expiresAt);
+  if (Number.isFinite(expiresAt) && expiresAt <= Date.now()) {
+    return null;
+  }
+
+  return {
+    ...session,
+    user: {
+      email: user.email,
+      emailVerified: user.emailVerified === true,
+      name: user.name,
+      picture: typeof user.picture === 'string' ? user.picture : '',
+      sub: user.sub,
+    },
+  };
+}
+
 function buildClientConfig(authConfig, { basePath = '' } = {}) {
+  const loginEndpoint = prependBasePath(basePath, '/api/auth/oidc/login');
   const sessionEndpoint = prependBasePath(basePath, '/api/auth/session');
   const statusEndpoint = prependBasePath(basePath, '/api/auth/status');
 
@@ -90,11 +216,14 @@ function buildClientConfig(authConfig, { basePath = '' } = {}) {
 
   return {
     enabled: true,
-    implemented: false,
+    implemented: true,
+    loginEndpoint,
+    provider: OIDC_PROVIDER_GOOGLE,
     requiresLogin: true,
     sessionEndpoint,
     statusEndpoint,
     strategy: AUTH_STRATEGY_OIDC,
+    submitLabel: 'Continue with Google',
   };
 }
 
@@ -107,6 +236,13 @@ function createPasswordStrategy(authConfig, sessionCookieManager, clientConfig)
   }
 
   return {
+    clearSession(req) {
+      return createResponse(200, { ok: true }, {
+        kind: 'logout_ok',
+        setCookie: sessionCookieManager.clearSession(req),
+      });
+    },
+
     createSession(req, body = {}) {
       if (typeof body.password !== 'string' || !body.password) {
         return createResponse(400, { error: 'Missing password' }, { kind: 'invalid_request' });
@@ -128,6 +264,7 @@ function createPasswordStrategy(authConfig, sessionCookieManager, clientConfig)
         auth: clientConfig,
         authenticated: true,
         ok: true,
+        user: null,
       }, {
         kind: 'session_created',
         setCookie: sessionCookieManager.createSessionCookie(req, {
@@ -137,10 +274,15 @@ function createPasswordStrategy(authConfig, sessionCookieManager, clientConfig)
       });
     },
 
+    getAuthenticatedUser() {
+      return null;
+    },
+
     getStatus(req) {
       return createResponse(200, {
         authenticated: hasValidSession(req),
         auth: clientConfig,
+        user: null,
       }, { kind: 'status' });
     },
 
@@ -152,14 +294,23 @@ function createPasswordStrategy(authConfig, sessionCookieManager, clientConfig)
 
 function createNoneStrategy(clientConfig) {
   return {
+    clearSession() {
+      return createResponse(200, { ok: true, user: null }, { kind: 'logout_ok' });
+    },
+
     createSession() {
       return createResponse(405, { error: 'Authentication is disabled' }, { kind: 'disabled' });
     },
 
+    getAuthenticatedUser() {
+      return null;
+    },
+
     getStatus() {
       return createResponse(200, {
         authenticated: true,
         auth: clientConfig,
+        user: null,
       }, { kind: 'status' });
     },
 
@@ -169,25 +320,204 @@ function createNoneStrategy(clientConfig) {
   };
 }
 
-function createOidcStrategy(clientConfig, sessionCookieManager) {
+function createOidcStrategy(authConfig, sessionCookieManager, flowCookieManager, clientConfig, { basePath = '' } = {}) {
+  let oidcConfigPromise = null;
+
+  function clearOidcCookies(req, includeSession = true) {
+    const cookies = [flowCookieManager.clear(req)];
+    if (includeSession) {
+      cookies.unshift(sessionCookieManager.clearSession(req));
+    }
+    return cookies;
+  }
+
+  function createErrorRedirect(req, message, flowPayload = null) {
+    const returnTo = sanitizeReturnTo(flowPayload?.returnTo, {
+      basePath,
+      publicBaseUrl: authConfig.oidc.publicBaseUrl,
+    });
+    return createResponse(302, null, {
+      kind: 'redirect',
+      redirectTo: appendHashParam(returnTo, 'auth_error', message, authConfig.oidc.publicBaseUrl),
+      setCookie: clearOidcCookies(req),
+    });
+  }
+
+  async function getOidcConfiguration() {
+    if (!oidcConfigPromise) {
+      const allowInsecureRequests = new URL(authConfig.oidc.issuer).protocol !== 'https:';
+      oidcConfigPromise = oidc.discovery(
+        new URL(authConfig.oidc.issuer),
+        authConfig.oidc.clientId,
+        authConfig.oidc.clientSecret,
+        undefined,
+        allowInsecureRequests
+          ? { execute: [oidc.allowInsecureRequests] }
+          : undefined,
+      ).catch((error) => {
+        oidcConfigPromise = null;
+        throw error;
+      });
+    }
+
+    return oidcConfigPromise;
+  }
+
+  function getAuthenticatedSession(req) {
+    return readAuthenticatedOidcSession(sessionCookieManager, req);
+  }
+
+  function getAuthenticatedUser(req) {
+    return getAuthenticatedSession(req)?.user ?? null;
+  }
+
   return {
+    async beginLogin(req, requestUrl) {
+      const config = await getOidcConfiguration();
+      const returnTo = sanitizeReturnTo(requestUrl.searchParams.get('returnTo'), {
+        basePath,
+        publicBaseUrl: authConfig.oidc.publicBaseUrl,
+      });
+      const codeVerifier = oidc.randomPKCECodeVerifier();
+      const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
+      const nonce = oidc.randomNonce();
+      const state = oidc.randomState();
+      const redirectTo = oidc.buildAuthorizationUrl(config, {
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+        ...(authConfig.oidc.allowedDomains.length === 1 ? { hd: authConfig.oidc.allowedDomains[0] } : {}),
+        nonce,
+        redirect_uri: authConfig.oidc.callbackUrl,
+        response_type: 'code',
+        scope: 'openid email profile',
+        state,
+      });
+
+      return createResponse(302, null, {
+        kind: 'redirect',
+        redirectTo: redirectTo.href,
+        setCookie: flowCookieManager.create(req, {
+          createdAt: Date.now(),
+          nonce,
+          pkceCodeVerifier: codeVerifier,
+          returnTo,
+          state,
+        }, {
+          expires: new Date(Date.now() + OIDC_FLOW_TTL_MS),
+        }),
+      });
+    },
+
+    async completeLogin(req, requestUrl) {
+      const flowPayload = flowCookieManager.read(req);
+      if (!flowPayload) {
+        return createErrorRedirect(req, 'Authentication session expired. Try again.');
+      }
+
+      if (requestUrl.searchParams.get('error')) {
+        const errorMessage = requestUrl.searchParams.get('error_description')
+          || requestUrl.searchParams.get('error')
+          || 'Authentication failed';
+        return createErrorRedirect(req, errorMessage, flowPayload);
+      }
+
+      if (
+        !isNonEmptyString(flowPayload.state)
+        || !isNonEmptyString(flowPayload.nonce)
+        || !isNonEmptyString(flowPayload.pkceCodeVerifier)
+      ) {
+        return createErrorRedirect(req, 'Authentication session expired. Try again.', flowPayload);
+      }
+
+      try {
+        const config = await getOidcConfiguration();
+        const callbackUrl = new URL(authConfig.oidc.callbackUrl);
+        callbackUrl.search = requestUrl.search;
+        const tokens = await oidc.authorizationCodeGrant(config, callbackUrl, {
+          expectedNonce: flowPayload.nonce,
+          expectedState: flowPayload.state,
+          idTokenExpected: true,
+          pkceCodeVerifier: flowPayload.pkceCodeVerifier,
+        });
+        const claims = tokens.claims();
+
+        if (
+          !claims
+          || !isNonEmptyString(claims.sub)
+          || !isNonEmptyString(claims.email)
+          || claims.email_verified !== true
+          || !isNonEmptyString(claims.name)
+        ) {
+          return createErrorRedirect(req, 'Google account is missing a verified email or name.', flowPayload);
+        }
+
+        const accessDecision = isOidcUserAllowed(authConfig.oidc, claims.email);
+        if (!accessDecision.allowed) {
+          return createErrorRedirect(req, accessDecision.error, flowPayload);
+        }
+
+        const expiresAt = Number.isFinite(claims.exp)
+          ? claims.exp * 1000
+          : Date.now() + (Math.max(Number(tokens.expires_in) || 3600, 1) * 1000);
+        const returnTo = sanitizeReturnTo(flowPayload.returnTo, {
+          basePath,
+          publicBaseUrl: authConfig.oidc.publicBaseUrl,
+        });
+        const user = {
+          email: claims.email,
+          emailVerified: true,
+          name: claims.name,
+          picture: typeof claims.picture === 'string' ? claims.picture : '',
+          sub: claims.sub,
+        };
+
+        return createResponse(302, null, {
+          kind: 'redirect',
+          redirectTo: returnTo,
+          setCookie: [
+            sessionCookieManager.createSessionCookie(req, {
+              authenticatedAt: Date.now(),
+              expiresAt,
+              strategy: AUTH_STRATEGY_OIDC,
+              user,
+            }),
+            flowCookieManager.clear(req),
+          ],
+        });
+      } catch (error) {
+        console.error('[auth] OIDC callback failed:', error.message);
+        return createErrorRedirect(req, 'Google sign-in failed. Try again.', flowPayload);
+      }
+    },
+
+    clearSession(req) {
+      return createResponse(200, { ok: true, user: null }, {
+        kind: 'logout_ok',
+        setCookie: clearOidcCookies(req),
+      });
+    },
+
     createSession() {
-      return createResponse(501, {
+      return createResponse(405, {
         auth: clientConfig,
-        code: 'AUTH_NOT_IMPLEMENTED',
-        error: 'OIDC authentication is not implemented yet',
-      }, { kind: 'not_implemented' });
+        code: 'AUTH_LOGIN_REDIRECT_REQUIRED',
+        error: 'Use the OIDC login endpoint to authenticate.',
+      }, { kind: 'invalid_request' });
     },
 
-    getStatus() {
+    getAuthenticatedUser,
+
+    getStatus(req) {
+      const user = getAuthenticatedUser(req);
       return createResponse(200, {
-        authenticated: false,
+        authenticated: Boolean(user),
         auth: clientConfig,
+        user,
       }, { kind: 'status' });
     },
 
     isAuthenticated(req) {
-      return sessionCookieManager.readSession(req)?.strategy === AUTH_STRATEGY_OIDC;
+      return Boolean(getAuthenticatedSession(req));
     },
   };
 }
@@ -207,7 +537,18 @@ export function createAuthService(config) {
   if (authConfig.strategy === AUTH_STRATEGY_PASSWORD) {
     strategy = createPasswordStrategy(authConfig, sessionCookieManager, clientConfig);
   } else if (authConfig.strategy === AUTH_STRATEGY_OIDC) {
-    strategy = createOidcStrategy(clientConfig, sessionCookieManager);
+    const flowCookieManager = createSignedCookieManager({
+      cookieName: authConfig.oidc.flowCookieName,
+      cookiePath: config.basePath || '/',
+      secret: authConfig.sessionSecret,
+    });
+    strategy = createOidcStrategy(
+      authConfig,
+      sessionCookieManager,
+      flowCookieManager,
+      clientConfig,
+      { basePath: config.basePath ?? '' },
+    );
   } else {
     strategy = createNoneStrategy(clientConfig);
   }
@@ -241,17 +582,34 @@ export function createAuthService(config) {
       };
     },
 
+    beginOidcLogin(req, requestUrl) {
+      if (authConfig.strategy !== AUTH_STRATEGY_OIDC || typeof strategy.beginLogin !== 'function') {
+        return createResponse(404, { error: 'OIDC endpoint not found' }, { kind: 'not_found' });
+      }
+
+      return strategy.beginLogin(req, requestUrl);
+    },
+
     clearSession(req) {
-      return createResponse(200, { ok: true }, {
-        kind: 'logout_ok',
-        setCookie: sessionCookieManager.clearSession(req),
-      });
+      return strategy.clearSession(req);
+    },
+
+    completeOidcLogin(req, requestUrl) {
+      if (authConfig.strategy !== AUTH_STRATEGY_OIDC || typeof strategy.completeLogin !== 'function') {
+        return createResponse(404, { error: 'OIDC endpoint not found' }, { kind: 'not_found' });
+      }
+
+      return strategy.completeLogin(req, requestUrl);
     },
 
     createSession(req, body) {
       return strategy.createSession(req, body);
     },
 
+    getAuthenticatedUser(req) {
+      return strategy.getAuthenticatedUser(req);
+    },
+
     getClientConfig() {
       return clientConfig;
     },

package/src/server/auth/session-cookie.js

@@ -51,6 +51,32 @@ export function createSessionCookieManager({
   cookieName,
   cookiePath = '/',
   secret,
+}) {
+  const signedCookieManager = createSignedCookieManager({
+    cookieName,
+    cookiePath,
+    secret,
+  });
+
+  return {
+    clearSession(req) {
+      return signedCookieManager.clear(req);
+    },
+
+    createSessionCookie(req, payload, options = {}) {
+      return signedCookieManager.create(req, payload, options);
+    },
+
+    readSession(req) {
+      return signedCookieManager.read(req);
+    },
+  };
+}
+
+export function createSignedCookieManager({
+  cookieName,
+  cookiePath = '/',
+  secret,
 }) {
   function createCookieAttributes(req, { expires = null } = {}) {
     const attributes = [
@@ -71,24 +97,24 @@ export function createSessionCookieManager({
   }
 
   return {
-    clearSession(req) {
+    clear(req) {
       return [
         `${cookieName}=`,
         ...createCookieAttributes(req, { expires: new Date(0) }),
       ].join('; ');
     },
 
-    createSessionCookie(req, payload) {
+    create(req, payload, { expires = null } = {}) {
       const serializedPayload = JSON.stringify(payload);
       const encodedPayload = encodeBase64Url(serializedPayload);
       const signature = encodeBase64Url(createSignature(encodedPayload, secret));
       return [
         `${cookieName}=${encodedPayload}.${signature}`,
-        ...createCookieAttributes(req),
+        ...createCookieAttributes(req, { expires }),
       ].join('; ');
     },
 
-    readSession(req) {
+    read(req) {
       const token = parseCookieHeader(req.headers.cookie).get(cookieName);
       if (!token) {
         return null;