dauth-md-node 4.0.0 → 4.1.0

package/src/router.ts

@@ -45,11 +45,9 @@ function clearStaleLocks(): void {
 async function resolveConfig(
   opts: DauthRouterOptions
 ): Promise<ResolvedConfig> {
-  const secure =
-    opts.secure ?? process.env.NODE_ENV !== 'development';
+  const secure = opts.secure ?? process.env.NODE_ENV !== 'development';
   const cookieName =
-    opts.cookieName ??
-    (secure ? '__Host-dauth-session' : 'dauth-session');
+    opts.cookieName ?? (secure ? '__Host-dauth-session' : 'dauth-session');
   const csrfCookieName =
     opts.csrfCookieName ?? (secure ? '__Host-csrf' : 'csrf-token');
   const maxAgeMs = (opts.maxAge ?? 30 * 24 * 3600) * 1000;
@@ -57,9 +55,7 @@ async function resolveConfig(
   const keys: Buffer[] = [];
   keys.push(await deriveEncryptionKey(opts.tsk, opts.sessionSalt));
   if (opts.previousTsk) {
-    keys.push(
-      await deriveEncryptionKey(opts.previousTsk, opts.sessionSalt)
-    );
+    keys.push(await deriveEncryptionKey(opts.previousTsk, opts.sessionSalt));
   }
 
   let dauthBasePath: string;
@@ -308,21 +304,16 @@ export function dauthRouter(opts: DauthRouterOptions): Router {
     const session = readSession(req, config);
     if (session) {
       // Revoke refresh token server-to-server (fire-and-forget)
-      fetch(
-        `${config.dauthBasePath}/app/${config.domainName}/logout`,
-        {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            refreshToken: session.refreshToken,
-          }),
-        }
-      ).catch(() => {});
+      fetch(`${config.dauthBasePath}/app/${config.domainName}/logout`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          refreshToken: session.refreshToken,
+        }),
+      }).catch(() => {});
     }
     clearCookies(res, config);
-    return res
-      .status(200)
-      .send({ status: 'success', message: 'Logged out' });
+    return res.status(200).send({ status: 'success', message: 'Logged out' });
   });
 
   // PATCH /user — CSRF required
@@ -384,61 +375,54 @@ export function dauthRouter(opts: DauthRouterOptions): Router {
   });
 
   // GET /profile-redirect — CSRF required (generates profile code)
-  router.get(
-    '/profile-redirect',
-    async (req: Request, res: Response) => {
-      const config = await getConfig();
-      if (!verifyCsrf(req, config.csrfCookieName)) {
-        return res.status(403).send({
-          status: 'csrf-invalid',
-          message: 'CSRF token invalid',
-        });
-      }
-      const session = readSession(req, config);
-      if (!session) {
-        return res.status(401).send({
-          status: 'no-session',
-          message: 'Not authenticated',
-        });
-      }
-      const refreshed = await maybeRefreshTokens(
-        session,
-        config,
-        res
-      );
+  router.get('/profile-redirect', async (req: Request, res: Response) => {
+    const config = await getConfig();
+    if (!verifyCsrf(req, config.csrfCookieName)) {
+      return res.status(403).send({
+        status: 'csrf-invalid',
+        message: 'CSRF token invalid',
+      });
+    }
+    const session = readSession(req, config);
+    if (!session) {
+      return res.status(401).send({
+        status: 'no-session',
+        message: 'Not authenticated',
+      });
+    }
+    const refreshed = await maybeRefreshTokens(session, config, res);
 
-      const response = await fetch(
-        `${config.dauthBasePath}/app/${config.domainName}/profile-code`,
-        {
-          method: 'POST',
-          headers: {
-            'Content-Type': 'application/json',
-            Authorization: refreshed.accessToken,
-          },
-        }
-      );
-      if (!response.ok) {
-        return res.status(response.status).send({
-          status: 'profile-code-error',
-          message: 'Could not generate profile code',
-        });
+    const response = await fetch(
+      `${config.dauthBasePath}/app/${config.domainName}/profile-code`,
+      {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: refreshed.accessToken,
+        },
       }
-      const data = (await response.json()) as { code: string };
-
-      // Build redirect URL to dauth frontend
-      const dauthFrontendUrl = opts.dauthUrl
-        ? opts.dauthUrl.replace(/\/+$/, '')
-        : process.env.DAUTH_URL
-          ? process.env.DAUTH_URL.replace(/\/+$/, '')
-          : process.env.NODE_ENV === 'development'
-            ? 'http://localhost:5185'
-            : 'https://dauth.ovh';
-
-      return res.status(200).send({
-        redirectUrl: `${dauthFrontendUrl}/${config.domainName}/update-user?code=${data.code}`,
+    );
+    if (!response.ok) {
+      return res.status(response.status).send({
+        status: 'profile-code-error',
+        message: 'Could not generate profile code',
       });
     }
-  );
+    const data = (await response.json()) as { code: string };
+
+    // Build redirect URL to dauth frontend
+    const dauthFrontendUrl = opts.dauthUrl
+      ? opts.dauthUrl.replace(/\/+$/, '')
+      : process.env.DAUTH_URL
+        ? process.env.DAUTH_URL.replace(/\/+$/, '')
+        : process.env.NODE_ENV === 'development'
+          ? 'http://localhost:5185'
+          : 'https://dauth.ovh';
+
+    return res.status(200).send({
+      redirectUrl: `${dauthFrontendUrl}/${config.domainName}/update-user?code=${data.code}`,
+    });
+  });
 
   return router;
 }

package/src/session.ts

@@ -31,10 +31,7 @@ export async function deriveEncryptionKey(
   });
 }
 
-export function encryptSession(
-  payload: SessionPayload,
-  key: Buffer
-): string {
+export function encryptSession(payload: SessionPayload, key: Buffer): string {
   const nonce = crypto.randomBytes(12);
   const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);
   const plaintext = JSON.stringify(payload);

package/dist/chunk-4A7BR4EM.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/api/utils/config.ts","../src/session.ts"],"sourcesContent":["export const apiVersion = 'v1';\nexport const serverDomain = 'dauth.ovh';\n\nexport function getServerBasePath(): string {\n  if (process.env.DAUTH_URL) {\n    const base = process.env.DAUTH_URL.replace(/\\/+$/, '');\n    return `${base}/api/${apiVersion}`;\n  }\n\n  const isLocalhost = process.env.NODE_ENV === 'development';\n  const serverPort = 4012;\n  const serverLocalUrl = `http://localhost:${serverPort}/api/${apiVersion}`;\n  const serverProdUrl = `https://${serverDomain}/api/${apiVersion}`;\n  return isLocalhost ? serverLocalUrl : serverProdUrl;\n}\n","import crypto from 'crypto';\n\nexport interface SessionPayload {\n  accessToken: string;\n  refreshToken: string;\n}\n\nconst INFO = 'dauth-cookie-enc-v1';\nconst DEFAULT_SALT = Buffer.from(\n  'a3f8c1d7e9b24f6081c5d3a7e2f49b0653d81f7a2e94c0b6d8f3a5e1c7b09d42',\n  'hex'\n);\n\nexport async function deriveEncryptionKey(\n  tsk: string,\n  salt?: string\n): Promise<Buffer> {\n  const saltBuf = salt ? Buffer.from(salt, 'hex') : DEFAULT_SALT;\n  return new Promise((resolve, reject) => {\n    crypto.hkdf(\n      'sha256',\n      Buffer.from(tsk),\n      saltBuf,\n      INFO,\n      32,\n      (err, derivedKey) => {\n        if (err) return reject(err);\n        resolve(Buffer.from(derivedKey));\n      }\n    );\n  });\n}\n\nexport function encryptSession(\n  payload: SessionPayload,\n  key: Buffer\n): string {\n  const nonce = crypto.randomBytes(12);\n  const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);\n  const plaintext = JSON.stringify(payload);\n  const encrypted = Buffer.concat([\n    cipher.update(plaintext, 'utf8'),\n    cipher.final(),\n  ]);\n  const authTag = cipher.getAuthTag();\n  // Format: base64(nonce + ciphertext + authTag)\n  return Buffer.concat([nonce, encrypted, authTag]).toString('base64');\n}\n\nexport function decryptSession(\n  ciphertext: string,\n  key: Buffer\n): SessionPayload | null {\n  try {\n    const buf = Buffer.from(ciphertext, 'base64');\n    if (buf.length < 12 + 16) return null; // nonce(12) + authTag(16) minimum\n    const nonce = buf.subarray(0, 12);\n    const authTag = buf.subarray(buf.length - 16);\n    const encrypted = buf.subarray(12, buf.length - 16);\n    const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);\n    decipher.setAuthTag(authTag);\n    const decrypted = Buffer.concat([\n      decipher.update(encrypted),\n      decipher.final(),\n    ]);\n    return JSON.parse(decrypted.toString('utf8')) as SessionPayload;\n  } catch {\n    return null;\n  }\n}\n\nexport function decryptSessionWithKeys(\n  ciphertext: string,\n  keys: Buffer[]\n): SessionPayload | null {\n  for (const key of keys) {\n    const result = decryptSession(ciphertext, key);\n    if (result) return result;\n  }\n  return null;\n}\n"],"mappings":";AAAO,IAAM,aAAa;AACnB,IAAM,eAAe;AAErB,SAAS,oBAA4B;AAC1C,MAAI,QAAQ,IAAI,WAAW;AACzB,UAAM,OAAO,QAAQ,IAAI,UAAU,QAAQ,QAAQ,EAAE;AACrD,WAAO,GAAG,IAAI,QAAQ,UAAU;AAAA,EAClC;AAEA,QAAM,cAAc,QAAQ,IAAI,aAAa;AAC7C,QAAM,aAAa;AACnB,QAAM,iBAAiB,oBAAoB,UAAU,QAAQ,UAAU;AACvE,QAAM,gBAAgB,WAAW,YAAY,QAAQ,UAAU;AAC/D,SAAO,cAAc,iBAAiB;AACxC;;;ACdA,OAAO,YAAY;AAOnB,IAAM,OAAO;AACb,IAAM,eAAe,OAAO;AAAA,EAC1B;AAAA,EACA;AACF;AAEA,eAAsB,oBACpB,KACA,MACiB;AACjB,QAAM,UAAU,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI;AAClD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,WAAO;AAAA,MACL;AAAA,MACA,OAAO,KAAK,GAAG;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC,KAAK,eAAe;AACnB,YAAI,IAAK,QAAO,OAAO,GAAG;AAC1B,gBAAQ,OAAO,KAAK,UAAU,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eACd,SACA,KACQ;AACR,QAAM,QAAQ,OAAO,YAAY,EAAE;AACnC,QAAM,SAAS,OAAO,eAAe,eAAe,KAAK,KAAK;AAC9D,QAAM,YAAY,KAAK,UAAU,OAAO;AACxC,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACf,CAAC;AACD,QAAM,UAAU,OAAO,WAAW;AAElC,SAAO,OAAO,OAAO,CAAC,OAAO,WAAW,OAAO,CAAC,EAAE,SAAS,QAAQ;AACrE;AAEO,SAAS,eACd,YACA,KACuB;AACvB,MAAI;AACF,UAAM,MAAM,OAAO,KAAK,YAAY,QAAQ;AAC5C,QAAI,IAAI,SAAS,KAAK,GAAI,QAAO;AACjC,UAAM,QAAQ,IAAI,SAAS,GAAG,EAAE;AAChC,UAAM,UAAU,IAAI,SAAS,IAAI,SAAS,EAAE;AAC5C,UAAM,YAAY,IAAI,SAAS,IAAI,IAAI,SAAS,EAAE;AAClD,UAAM,WAAW,OAAO,iBAAiB,eAAe,KAAK,KAAK;AAClE,aAAS,WAAW,OAAO;AAC3B,UAAM,YAAY,OAAO,OAAO;AAAA,MAC9B,SAAS,OAAO,SAAS;AAAA,MACzB,SAAS,MAAM;AAAA,IACjB,CAAC;AACD,WAAO,KAAK,MAAM,UAAU,SAAS,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,uBACd,YACA,MACuB;AACvB,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,eAAe,YAAY,GAAG;AAC7C,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,SAAO;AACT;","names":[]}