houdini 2.0.0-next.8 → 2.0.0

package/build/router/session.js

@@ -0,0 +1,338 @@
+import * as oauth from "oauth4webapi";
+import { getAuthUrl } from "../runtime/config.js";
+import {
+  sessionTokenFingerprint,
+  verifySessionToken,
+  signRedirectTxn,
+  verifyRedirectTxn,
+  randomToken,
+  timingSafeEqual,
+  REDIRECT_TXN_TTL_SECONDS
+} from "./auth-token.js";
+import { parse } from "./cookies.js";
+import { decode, encode, verify } from "./jwt.js";
+const REDIRECT_TXN_COOKIE = "__Host-houdini-txn";
+function redirectTxnCookie(value) {
+  return `${REDIRECT_TXN_COOKIE}=${value}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${REDIRECT_TXN_TTL_SECONDS}`;
+}
+function clearRedirectTxnCookie() {
+  return `${REDIRECT_TXN_COOKIE}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`;
+}
+function isAllowedOrigin(request, server_config) {
+  const origin = request.headers.get("origin");
+  const allowedOrigins = [new URL(request.url).origin, ...server_config?.allowedOrigins ?? []];
+  return !!origin && allowedOrigins.includes(origin);
+}
+const SESSION_TOKEN_TTL_MS = 60 * 1e3;
+const consumedSessionTokens = /* @__PURE__ */ new Map();
+const defaultConsumedTokenStore = {
+  consume(jti, ttlMs) {
+    const now = Date.now();
+    for (const [id, expiry] of consumedSessionTokens) {
+      if (expiry <= now) {
+        consumedSessionTokens.delete(id);
+      }
+    }
+    if (consumedSessionTokens.has(jti)) {
+      return false;
+    }
+    consumedSessionTokens.set(jti, now + ttlMs);
+    return true;
+  }
+};
+async function applySessionToken(args, response, token) {
+  const verified = await verifySessionToken(token, args.session_keys);
+  if (!verified) {
+    return false;
+  }
+  const presenter = await get_session(args.request.headers, args.session_keys);
+  const presenterSid = await sessionTokenFingerprint(presenter, args.session_keys);
+  const store = args.server_config?.auth?.consumedTokenStore ?? defaultConsumedTokenStore;
+  if (!timingSafeEqual(verified.sid, presenterSid) || !await store.consume(verified.jti, SESSION_TOKEN_TTL_MS)) {
+    return false;
+  }
+  if ("clear" in verified) {
+    clear_session(response);
+  } else if (verified.merge) {
+    await set_session(args, response, { ...presenter, ...verified.session });
+  } else {
+    await set_session(args, response, verified.session);
+  }
+  return true;
+}
+async function handle_request(args) {
+  const { pathname } = new URL(args.request.url);
+  const authUrl = getAuthUrl();
+  if (pathname === authUrl + "/login") {
+    return await login_endpoint(args);
+  }
+  if (pathname.startsWith(authUrl)) {
+    return await auth_endpoint(args);
+  }
+}
+function sameOriginRefererPath(request) {
+  const referer = request.headers.get("referer");
+  if (!referer) {
+    return null;
+  }
+  try {
+    const ref = new URL(referer);
+    if (ref.origin !== new URL(request.url).origin) {
+      return null;
+    }
+    return ref.pathname + ref.search;
+  } catch {
+    return null;
+  }
+}
+function oauthCallbackUrl(request) {
+  return `${new URL(request.url).origin}${getAuthUrl()}`;
+}
+async function login_endpoint(args) {
+  const auth = args.server_config?.auth;
+  if (!auth?.redirect?.url && !auth?.providers) {
+    return void 0;
+  }
+  if (args.request.method !== "GET") {
+    return new Response("Method Not Allowed", { status: 405 });
+  }
+  const url = new URL(args.request.url);
+  const redirectTo = safeRelative(
+    url.searchParams.get("redirectTo") ?? sameOriginRefererPath(args.request)
+  );
+  const requested = url.searchParams.get("provider");
+  const provider = requested ? auth.providers?.[requested] : void 0;
+  if (provider) {
+    return oauth_start(args, provider, requested, redirectTo);
+  }
+  if (auth.redirect?.url) {
+    const nonce = randomToken();
+    const target = new URL(auth.redirect.url);
+    for (const [key, value] of url.searchParams) {
+      if (key !== "redirectTo") {
+        target.searchParams.set(key, value);
+      }
+    }
+    target.searchParams.set("state", nonce);
+    target.searchParams.set("return", oauthCallbackUrl(args.request));
+    const txn = await signRedirectTxn({ nonce, redirectTo }, args.session_keys);
+    const response = new Response(null, {
+      status: 302,
+      headers: { Location: target.toString() }
+    });
+    response.headers.append("Set-Cookie", redirectTxnCookie(txn));
+    return response;
+  }
+  return new Response("Unknown provider", { status: 400 });
+}
+async function oauth_start(args, provider, providerName, redirectTo) {
+  const as = await provider.server();
+  const state = oauth.generateRandomState();
+  const oidcNonce = provider.issuer ? oauth.generateRandomNonce() : void 0;
+  const codeVerifier = provider.pkce === "S256" ? oauth.generateRandomCodeVerifier() : void 0;
+  const authorizeUrl = new URL(as.authorization_endpoint);
+  authorizeUrl.searchParams.set("client_id", provider.clientId);
+  authorizeUrl.searchParams.set("redirect_uri", oauthCallbackUrl(args.request));
+  authorizeUrl.searchParams.set("response_type", "code");
+  authorizeUrl.searchParams.set("scope", provider.scopes.join(" "));
+  authorizeUrl.searchParams.set("state", state);
+  if (codeVerifier) {
+    authorizeUrl.searchParams.set(
+      "code_challenge",
+      await oauth.calculatePKCECodeChallenge(codeVerifier)
+    );
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+  }
+  if (oidcNonce) {
+    authorizeUrl.searchParams.set("nonce", oidcNonce);
+  }
+  const txn = await signRedirectTxn(
+    { nonce: state, redirectTo, provider: providerName, codeVerifier, oidcNonce },
+    args.session_keys
+  );
+  const response = new Response(null, {
+    status: 302,
+    headers: { Location: authorizeUrl.toString() }
+  });
+  response.headers.append("Set-Cookie", redirectTxnCookie(txn));
+  return response;
+}
+async function oauth_callback(args, txn, searchParams) {
+  const deny = () => new Response("Forbidden", {
+    status: 403,
+    headers: { "Set-Cookie": clearRedirectTxnCookie() }
+  });
+  const provider = args.server_config.auth.providers[txn.provider];
+  const as = await provider.server();
+  const client = { client_id: provider.clientId };
+  const clientAuth = oauth.ClientSecretPost(provider.clientSecret);
+  let result;
+  try {
+    const params = oauth.validateAuthResponse(as, client, searchParams, txn.nonce);
+    const tokenResponse = await oauth.authorizationCodeGrantRequest(
+      as,
+      client,
+      clientAuth,
+      params,
+      oauthCallbackUrl(args.request),
+      txn.codeVerifier ?? oauth.nopkce,
+      { [oauth.allowInsecureRequests]: Boolean(provider.allowInsecureRequests) }
+    );
+    result = await oauth.processAuthorizationCodeResponse(as, client, tokenResponse, {
+      expectedNonce: txn.oidcNonce,
+      requireIdToken: Boolean(provider.issuer),
+      // permit the http JWKS fetch for local dev providers. The runtime reads this symbol (its
+      // resolveEndpoint honors it), but oauth4webapi omits it from this options type, so cast.
+      [oauth.allowInsecureRequests]: Boolean(provider.allowInsecureRequests)
+    });
+  } catch {
+    return deny();
+  }
+  const tokens = {
+    accessToken: result.access_token,
+    refreshToken: result.refresh_token,
+    expiresAt: typeof result.expires_in === "number" ? Math.floor(Date.now() / 1e3) + result.expires_in : void 0,
+    scope: result.scope,
+    idToken: result.id_token
+  };
+  const claims = oauth.getValidatedIdTokenClaims(result);
+  const user = await provider.user({ tokens, claims });
+  const onSignIn = args.server_config?.auth?.onSignIn;
+  const session = onSignIn ? await onSignIn({ provider: txn.provider, user, tokens }) : {};
+  const response = new Response("ok", { status: 302, headers: { Location: txn.redirectTo } });
+  await set_session(args, response, session ?? {});
+  response.headers.append("Set-Cookie", clearRedirectTxnCookie());
+  return response;
+}
+async function auth_endpoint(args) {
+  if (args.request.method === "GET") {
+    const auth = args.server_config?.auth;
+    if (!auth?.redirect?.url && !auth?.providers) {
+      return void 0;
+    }
+    const { searchParams } = new URL(
+      args.request.url,
+      `http://${args.request.headers.get("host")}`
+    );
+    const cookies = parse(args.request.headers.get("cookie") ?? "");
+    const txn = await verifyRedirectTxn(cookies[REDIRECT_TXN_COOKIE], args.session_keys);
+    const state = searchParams.get("state");
+    if (!txn || !state || !timingSafeEqual(txn.nonce, state)) {
+      return new Response("Forbidden", {
+        status: 403,
+        headers: { "Set-Cookie": clearRedirectTxnCookie() }
+      });
+    }
+    if (txn.provider && auth.providers?.[txn.provider]) {
+      return oauth_callback(args, txn, searchParams);
+    }
+    const response = new Response("ok", { status: 302, headers: { Location: txn.redirectTo } });
+    const applied = await applySessionToken(args, response, searchParams.get("token"));
+    const result = applied ? response : new Response("Forbidden", { status: 403 });
+    result.headers.append("Set-Cookie", clearRedirectTxnCookie());
+    return result;
+  }
+  if (args.request.method === "POST") {
+    if (!isAllowedOrigin(args.request, args.server_config)) {
+      return new Response("Forbidden", { status: 403 });
+    }
+    const contentType = args.request.headers.get("content-type") ?? "";
+    if (contentType.includes("urlencoded") || contentType.includes("multipart")) {
+      const formData = await args.request.formData();
+      if (formData.get("__houdini_logout") == null) {
+        return new Response("Bad Request", { status: 400 });
+      }
+      const response2 = new Response(null, {
+        status: 303,
+        headers: { Location: safeRelative(formData.get("redirectTo")) }
+      });
+      clear_session(response2);
+      return response2;
+    }
+    const body = await args.request.json().catch(() => null);
+    if (!body || typeof body !== "object") {
+      return new Response("Bad Request", { status: 400 });
+    }
+    const response = new Response("ok", { status: 200 });
+    if (typeof body.token === "string") {
+      if (!await applySessionToken(args, response, body.token)) {
+        return new Response("Forbidden", { status: 403 });
+      }
+      return response;
+    }
+    if (body.session === null) {
+      clear_session(response);
+      return response;
+    }
+    const existing = await get_session(args.request.headers, args.session_keys);
+    await set_session(args, response, { ...existing, ...body.session ?? {} });
+    return response;
+  }
+}
+const session_cookie_name = "__houdini__";
+function clear_session(response) {
+  response.headers.set(
+    "Set-Cookie",
+    `${session_cookie_name}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`
+  );
+}
+function safeRelative(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.includes("\\") || value.includes("://")) {
+    return "/";
+  }
+  return value;
+}
+async function sign_session(session, key) {
+  return encode({ ...session }, key);
+}
+async function set_session(req, response, value) {
+  const today = /* @__PURE__ */ new Date();
+  const expires = new Date(today.getTime() + 7 * 24 * 60 * 60 * 1e3);
+  const serialized = await encode(
+    { ...value, exp: Math.floor(expires.getTime() / 1e3) },
+    req.session_keys[0]
+  );
+  response.headers.set(
+    "Set-Cookie",
+    `${session_cookie_name}=${serialized}; Path=/; HttpOnly; Secure; SameSite=Lax; Expires=${expires.toUTCString()} `
+  );
+}
+async function get_session(req, secrets) {
+  const cookies = req.get("cookie");
+  if (!cookies) {
+    return {};
+  }
+  const cookie = parse(cookies)[session_cookie_name];
+  if (!cookie) {
+    return {};
+  }
+  if (cookie === "{}") {
+    return {};
+  }
+  for (const secret of secrets) {
+    try {
+      if (!await verify(cookie, secret)) {
+        continue;
+      }
+      const parsed = decode(cookie);
+      if (!parsed) {
+        return {};
+      }
+      const { exp: _exp, iat: _iat, ...session } = parsed.payload;
+      return session;
+    } catch {
+      continue;
+    }
+  }
+  return {};
+}
+export {
+  applySessionToken,
+  clear_session,
+  get_session,
+  handle_request,
+  isAllowedOrigin,
+  session_cookie_name,
+  set_session,
+  sign_session
+};

package/build/router/types.d.ts

@@ -0,0 +1,44 @@
+import type { createYoga } from 'graphql-yoga';
+import type { MutationArtifact, QueryArtifact } from '../runtime/types.js';
+import type { RouteParam } from './match.js';
+export type YogaServer = ReturnType<typeof createYoga>;
+export type YogaServerOptions = Parameters<typeof createYoga>[0];
+export type RouterManifest<_ComponentType> = {
+    pages: Record<string, RouterPageManifest<_ComponentType>>;
+    pagesByUrl: Record<string, string>;
+    formActions?: Record<string, () => Promise<{
+        default: MutationArtifact;
+    }>>;
+    sessionMutations?: Record<string, {
+        sessionPath: string;
+        merge?: boolean;
+    }>;
+};
+export type { ServerAdapterFactory } from './server.js';
+export type RouterPageManifest<_ComponentType> = {
+    id: string;
+    url: string;
+    pattern: RegExp;
+    params: readonly RouteParam[];
+    searchParams: readonly SearchParam[];
+    documents: Record<string, {
+        artifact: () => Promise<{
+            default: QueryArtifact;
+        }>;
+        loading: boolean;
+        variables: Record<string, {
+            type: string;
+        }>;
+    }>;
+    component: () => Promise<{
+        default: _ComponentType;
+    }>;
+    headers?: Array<() => Promise<RouteHeaderFunction | undefined>>;
+};
+export type SearchParam = {
+    name: string;
+    type: string;
+    wrappers: readonly string[];
+};
+export type RouteHeaderFunction = () => RouteHeaders | Promise<RouteHeaders>;
+export type RouteHeaders = Record<string, string>;

package/build/runtime/cache/benchmarks/cache.bench.d.ts

@@ -0,0 +1 @@
+export {};