jamdesk 1.1.203 → 1.1.205

package/vendored/shared/auth-cookie.ts

@@ -15,15 +15,23 @@
  * which is not available in Edge runtime. This module reimplements a
  * minimal constant-time compare over Uint8Array outputs from Web Crypto.
  *
- * Cookie wire format:
+ * Cookie wire format (v1, password-gated sites — unchanged, byte-for-byte):
  *   base64url(`v1.${version}.${expiresAt}.${base64url(HMAC_SHA256(`v1|${slug}|${host}|${version}|${expiresAt}`, secret))}`)
  *
- * The "v1" prefix on both the HMAC input and the body makes it safe to
- * rotate the payload format in the future without silently accepting old
- * cookies with a different binding.
+ * Cookie wire format (v2, JWT-gated sites — carries signed groups + playground
+ * inputs, raw dotted string with NO outer base64 wrap to reclaim cookie budget):
+ *   `v2.${version}.${expiresAt}.${extrasB64}.${sigB64}`
+ *   where sigB64 = base64url(HMAC_SHA256(`v2|${slug}|${host}|${version}|${expiresAt}|${extrasB64}`, secret))
+ *
+ * The "v1"/"v2" prefix on both the HMAC input and the body makes it safe to
+ * rotate the payload format without silently accepting a cookie signed under
+ * a different binding. verifyAuthCookie() branches on the RAW `v2.` prefix
+ * before attempting the v1 base64 decode, so both formats verify correctly
+ * from the same function.
  */
 
 const FORMAT_VERSION = 'v1';
+const FORMAT_VERSION_V2 = 'v2';
 
 export interface AuthCookiePayload {
   slug: string;
@@ -38,9 +46,19 @@ export interface VerifyExpectation {
   version: number;
 }
 
+/** Signed extras carried by v2 cookies: JWT-sourced groups + playground inputs. */
+export interface SessionExtras {
+  /** User groups from the JWT payload. */
+  g?: string[];
+  /** apiPlaygroundInputs from the JWT payload (size-capped by the callback route). */
+  api?: Record<string, unknown>;
+}
+
 export interface VerifyResult {
   valid: boolean;
   expiresAt?: number;
+  formatVersion?: 'v1' | 'v2';
+  extras?: SessionExtras;
 }
 
 function base64url(bytes: Uint8Array): string {
@@ -102,6 +120,20 @@ function buildSignInput(
   return `${FORMAT_VERSION}|${slug}|${host}|${version}|${expiresAt}`;
 }
 
+function utf8ToBase64url(s: string): string {
+  return base64url(new TextEncoder().encode(s));
+}
+
+function buildSignInputV2(
+  slug: string,
+  host: string,
+  version: number,
+  expiresAt: number,
+  extrasB64: string
+): string {
+  return `${FORMAT_VERSION_V2}|${slug}|${host}|${version}|${expiresAt}|${extrasB64}`;
+}
+
 /**
  * Sign a cookie payload. Returns the full cookie value string to put in Set-Cookie.
  */
@@ -119,15 +151,44 @@ export async function signAuthCookie(
   return base64url(new TextEncoder().encode(body));
 }
 
+/**
+ * Sign a v2 cookie payload carrying signed extras (groups + playground inputs).
+ *
+ * Wire format: the raw string `v2.${version}.${expiresAt}.${extrasB64}.${sigB64}`
+ * — NO outer base64 wrap (every segment is already cookie-safe base64url or
+ * digits; v1's whole-body wrap costs ~25% of the ~4KB cookie budget, and v2
+ * carries groups in the cookie, so the headroom is load-bearing).
+ * extrasB64 = base64url(utf8(JSON.stringify(extras))). The extras segment is
+ * inside the HMAC, so groups/playground data can't be forged.
+ */
+export async function signAuthCookieV2(
+  payload: AuthCookiePayload,
+  extras: SessionExtras,
+  secret: string
+): Promise<string> {
+  const extrasB64 = utf8ToBase64url(JSON.stringify(extras));
+  const sig = await hmac(
+    secret,
+    buildSignInputV2(payload.slug, payload.host, payload.version, payload.expiresAt, extrasB64)
+  );
+  return `${FORMAT_VERSION_V2}.${payload.version}.${payload.expiresAt}.${extrasB64}.${base64url(sig)}`;
+}
+
 /**
  * Verify a cookie value against the expected slug, host, and version.
  * Returns { valid: false } on any failure (including malformed input).
+ * Handles both the legacy v1 (whole-body base64-wrapped) format and the v2
+ * (raw dotted, unwrapped) format — identified by the raw `v2.` prefix, which
+ * is checked before the v1 base64 decode since v2 is never base64-wrapped.
  */
 export async function verifyAuthCookie(
   cookie: string,
   expected: VerifyExpectation,
   secret: string
 ): Promise<VerifyResult> {
+  if (cookie.startsWith(`${FORMAT_VERSION_V2}.`)) {
+    return verifyV2(cookie, expected, secret);
+  }
   try {
     if (!cookie) return { valid: false };
     const bodyBytes = fromBase64url(cookie);
@@ -156,8 +217,40 @@ export async function verifyAuthCookie(
     const actualSig = fromBase64url(sigB64);
     if (!constantTimeEqual(expectedSig, actualSig)) return { valid: false };
 
-    return { valid: true, expiresAt };
+    return { valid: true, expiresAt, formatVersion: 'v1' };
   } catch {
     return { valid: false };
   }
 }
+
+/**
+ * Verify a v2 (raw dotted, unwrapped) cookie. Split out of verifyAuthCookie
+ * so the v1 path stays byte-for-byte unchanged for existing password sites.
+ */
+async function verifyV2(
+  cookie: string,
+  expected: VerifyExpectation,
+  secret: string
+): Promise<VerifyResult> {
+  const parts = cookie.split('.');
+  if (parts.length !== 5) return { valid: false };
+  const [, versionStr, expiresAtStr, extrasB64, sigB64] = parts;
+  const version = Number(versionStr);
+  const expiresAt = Number(expiresAtStr);
+  if (!Number.isSafeInteger(version) || !Number.isSafeInteger(expiresAt)) {
+    return { valid: false };
+  }
+  if (version !== expected.version) return { valid: false };
+  if (expiresAt <= Date.now()) return { valid: false };
+  try {
+    const expectedSig = await hmac(
+      secret,
+      buildSignInputV2(expected.slug, expected.host, version, expiresAt, extrasB64)
+    );
+    if (!constantTimeEqual(expectedSig, fromBase64url(sigB64))) return { valid: false };
+    const extras = JSON.parse(new TextDecoder().decode(fromBase64url(extrasB64))) as SessionExtras;
+    return { valid: true, expiresAt, formatVersion: 'v2', extras };
+  } catch {
+    return { valid: false }; // malformed base64 / JSON — same catch discipline as v1
+  }
+}