limn-review 0.1.123

package/dist/api/routes/auth.js

@@ -0,0 +1,194 @@
+import { randomBytes } from 'node:crypto';
+import { config } from '../../config.js';
+import { encryptToken } from '../../auth/crypto.js';
+import { getAccessToken, upsertCloudAccount } from '../../auth/account.js';
+// Revoke the OAuth App's grant for a user's token (Basic auth = the app's own id/secret). This
+// forces the NEXT authorize to re-show consent — which is what re-injects the SAML SSO step; a
+// silent re-issue would skip it and re-mint a still-de-authorized token. 404 = already gone.
+async function revokeOAuthGrant(token) {
+    const basic = Buffer.from(`${config.githubOAuthClientId}:${config.githubOAuthClientSecret}`).toString('base64');
+    const res = await fetch(`https://api.github.com/applications/${config.githubOAuthClientId}/grant`, {
+        method: 'DELETE',
+        headers: {
+            authorization: `Basic ${basic}`,
+            accept: 'application/vnd.github+json',
+            'x-github-api-version': '2022-11-28',
+        },
+        body: JSON.stringify({ access_token: token }),
+    });
+    if (!res.ok && res.status !== 404) {
+        throw new Error(`revoke grant -> ${res.status}`);
+    }
+}
+// Per-provider credential + the scope to request (empty for the GitHub App).
+function providerCredentials(provider) {
+    return provider === 'app'
+        ? {
+            clientId: config.githubAppClientId,
+            clientSecret: config.githubAppClientSecret,
+            scope: '',
+            enabled: config.appProviderEnabled,
+        }
+        : {
+            clientId: config.githubOAuthClientId,
+            clientSecret: config.githubOAuthClientSecret,
+            scope: config.oauthScope,
+            enabled: config.oauthProviderEnabled,
+        };
+}
+export async function authRoutes(app) {
+    const redirectUri = `${config.appBaseUrl}/api/auth/callback`;
+    const secureCookie = config.appBaseUrl.startsWith('https://');
+    // The default provider for the bare /api/auth/login link (landing/billing CTAs): prefer the
+    // frictionless OAuth App; fall back to the GitHub App if that's the only one configured.
+    const defaultProvider = config.oauthProviderEnabled ? 'oauth' : 'app';
+    // Which sign-in methods this deployment offers — read by the (signed-out) SignInGate to render
+    // the right button(s), and by the SIGNED-IN Settings "GitHub App" section, which needs the slug
+    // to build the install link (signing in via the App does NOT install it — see
+    // docs/REALTIME-SYNC.md). Unauthenticated: it sits under the /api/auth/* auth-gate exemption.
+    app.get('/api/auth/providers', async () => ({
+        oauth: config.oauthProviderEnabled,
+        app: config.appProviderEnabled,
+        // Slug drives the install link on the gate + in Settings; only meaningful with the App.
+        appSlug: config.appProviderEnabled ? config.githubAppSlug : '',
+    }));
+    const startLogin = (provider, reply) => {
+        const cred = providerCredentials(provider);
+        if (!cred.enabled)
+            return reply.redirect('/app?auth=unavailable');
+        // Fold the provider into the state so the callback knows which credential to exchange with.
+        const state = `${provider}.${randomBytes(16).toString('hex')}`;
+        reply.setCookie('pierre_oauth_state', state, {
+            path: '/',
+            httpOnly: true,
+            sameSite: 'lax',
+            secure: secureCookie,
+            signed: true,
+            maxAge: 600,
+        });
+        const params = new URLSearchParams({
+            client_id: cred.clientId,
+            redirect_uri: redirectUri,
+            state,
+        });
+        if (cred.scope)
+            params.set('scope', cred.scope);
+        return reply.redirect(`https://github.com/login/oauth/authorize?${params.toString()}`);
+    };
+    // Explicit provider choice (the SignInGate's two buttons).
+    app.get('/api/auth/login/:provider', async (req, reply) => {
+        const provider = req.params.provider === 'app' ? 'app' : 'oauth';
+        return startLogin(provider, reply);
+    });
+    // Bare login (landing / billing CTAs). When BOTH providers are configured, don't silently
+    // pick one — bounce to the in-app sign-in gate so the user explicitly chooses OAuth App vs
+    // GitHub App. When only one is configured there's no choice to make, so go straight to it.
+    app.get('/api/auth/login', async (_req, reply) => {
+        if (config.oauthProviderEnabled && config.appProviderEnabled) {
+            return reply.redirect('/app');
+        }
+        return startLogin(defaultProvider, reply);
+    });
+    // "Reconnect GitHub" (the SAML-block banner action): revoke this app's grant so the re-auth
+    // shows FRESH consent — forcing the SAML SSO step that a silent re-issue would skip — then
+    // clear our session (so the callback re-runs the code exchange, not the already-signed-in
+    // short-circuit) and start a fresh OAuth login. Best-effort revoke: even if it fails, the
+    // re-login can still succeed if the user's SAML session is active.
+    app.get('/api/auth/reconnect', async (req, reply) => {
+        const accountId = req.session.get('accountId');
+        if (accountId != null) {
+            try {
+                await revokeOAuthGrant(await getAccessToken(accountId));
+            }
+            catch (err) {
+                req.log.warn({ err }, 'reconnect: grant revoke failed, continuing to re-auth');
+            }
+            req.session.delete();
+        }
+        return startLogin('oauth', reply);
+    });
+    // Verify state → exchange code for a token (against the state's provider) → fetch the user →
+    // upsert account → set session → 302 to the app.
+    app.get('/api/auth/callback', async (req, reply) => {
+        // Already signed in? The callback URL carries a one-time ?code= that GitHub expires in
+        // ~10 min and invalidates on first use. A back-button, a restored tab, or a Chrome profile
+        // switch can re-request this exact URL; re-running the exchange would then fail on the
+        // already-consumed code. Short-circuit a valid session straight to the app instead.
+        if (req.session.get('accountId') != null) {
+            return reply.redirect('/app');
+        }
+        const { code, state } = req.query;
+        const rawCookie = req.cookies.pierre_oauth_state;
+        const unsigned = rawCookie
+            ? req.unsignCookie(rawCookie)
+            : { valid: false, value: null };
+        reply.clearCookie('pierre_oauth_state', { path: '/' });
+        if (!code || !state || !unsigned.valid || unsigned.value !== state) {
+            // Stale/replayed callback (state cookie expired or CSRF mismatch). Bounce back so the
+            // user starts a fresh sign-in — never render raw JSON to a human.
+            return reply.redirect('/app?auth=expired');
+        }
+        // The provider chosen at /login is encoded in the state; pick the matching credential.
+        const provider = state.startsWith('app.') ? 'app' : 'oauth';
+        const cred = providerCredentials(provider);
+        // Exchange the code for a user access token.
+        let token;
+        try {
+            const res = await fetch('https://github.com/login/oauth/access_token', {
+                method: 'POST',
+                headers: { accept: 'application/json', 'content-type': 'application/json' },
+                body: JSON.stringify({
+                    client_id: cred.clientId,
+                    client_secret: cred.clientSecret,
+                    code,
+                    redirect_uri: redirectUri,
+                }),
+            });
+            const json = (await res.json());
+            if (!json.access_token) {
+                req.log.warn({ err: json.error_description ?? json.error, provider }, 'oauth token exchange returned no token');
+                return reply.redirect('/app?auth=failed');
+            }
+            token = json.access_token;
+        }
+        catch (err) {
+            req.log.error({ err, provider }, 'oauth token exchange request failed');
+            return reply.redirect('/app?auth=error');
+        }
+        // Identify the user.
+        let user;
+        try {
+            const res = await fetch('https://api.github.com/user', {
+                headers: {
+                    authorization: `token ${token}`,
+                    accept: 'application/vnd.github+json',
+                    'x-github-api-version': '2022-11-28',
+                },
+            });
+            if (!res.ok) {
+                req.log.warn({ status: res.status }, 'failed to fetch github user');
+                return reply.redirect('/app?auth=failed');
+            }
+            user = (await res.json());
+        }
+        catch (err) {
+            req.log.error({ err }, 'fetching github user failed');
+            return reply.redirect('/app?auth=error');
+        }
+        const account = await upsertCloudAccount({
+            githubUserId: user.node_id,
+            githubLogin: user.login,
+            displayName: user.name ?? null,
+            avatarUrl: user.avatar_url,
+            accessTokenEnc: encryptToken(token),
+        });
+        req.session.set('accountId', account.id);
+        return reply.redirect('/app');
+    });
+    // Clear the session.
+    app.post('/api/auth/logout', async (req, reply) => {
+        req.session.delete();
+        return reply.code(204).send();
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/api/routes/billing.js

@@ -0,0 +1,209 @@
+// Stripe billing seam ("carve the path"): a checkout redirect + the webhook that
+// flips `accounts.plan`. Deliberately dependency-free — signature verification is
+// hand-rolled with node:crypto (no stripe SDK), and the whole feature is inert
+// until STRIPE_PAYMENT_LINK_URL / STRIPE_WEBHOOK_SECRET are set (the webhook
+// replies 501 unconfigured). Registered unconditionally in app.ts, both modes.
+//
+// Entitlement flows from `accounts.plan`: /api/me intersects the capability
+// singleton with the plan (pro/contract.ts entitledProCapabilities) and the cloud
+// auth gate 402s free-plan /api/pro/* requests (api/plugins/auth.ts). Local
+// accounts are always fully entitled — this file never affects local behavior.
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { config } from '../../config.js';
+import { getAccountById, getAccountByStripeCustomerId, setAccountPlan, } from '../../auth/account.js';
+// Stripe's default signature tolerance: reject events older/newer than 5 minutes
+// (replay protection).
+export const STRIPE_SIGNATURE_TOLERANCE_SEC = 300;
+/**
+ * Verify a Stripe webhook signature (the `stripe-signature` header) without the
+ * stripe SDK. Header format: `t=<unix-seconds>,v1=<hex>[,v1=<hex>…]` (multiple
+ * v1 entries appear during secret rotation). The signed payload is
+ * `<t>.<rawBody>`; the signature is HMAC-SHA256(secret) over it, hex-encoded.
+ * Compared timing-safely against every v1; the timestamp must be within
+ * STRIPE_SIGNATURE_TOLERANCE_SEC of `nowMs`.
+ */
+export function verifyStripeSignature(rawBody, header, secret, nowMs = Date.now()) {
+    let ts = null;
+    const v1s = [];
+    for (const part of header.split(',')) {
+        const idx = part.indexOf('=');
+        if (idx < 0)
+            continue;
+        const key = part.slice(0, idx).trim();
+        const value = part.slice(idx + 1).trim();
+        if (!value)
+            continue;
+        if (key === 't') {
+            const n = Number.parseInt(value, 10);
+            if (Number.isFinite(n))
+                ts = n;
+        }
+        else if (key === 'v1') {
+            v1s.push(value);
+        }
+    }
+    if (ts == null || v1s.length === 0)
+        return false;
+    if (Math.abs(nowMs / 1000 - ts) > STRIPE_SIGNATURE_TOLERANCE_SEC)
+        return false;
+    const expected = createHmac('sha256', secret)
+        .update(`${ts}.`)
+        .update(rawBody)
+        .digest('hex');
+    const expectedBuf = Buffer.from(expected, 'utf-8');
+    return v1s.some((sig) => {
+        const sigBuf = Buffer.from(sig, 'utf-8');
+        return (sigBuf.length === expectedBuf.length && timingSafeEqual(sigBuf, expectedBuf));
+    });
+}
+// Stripe `customer` fields are a string id or an expanded object with `.id`.
+function customerIdOf(value) {
+    if (typeof value === 'string' && value !== '')
+        return value;
+    if (value != null &&
+        typeof value === 'object' &&
+        typeof value.id === 'string') {
+        return value.id;
+    }
+    return null;
+}
+/** Map a parsed Stripe event to the plan action it implies. Pure. */
+export function stripeEventAction(event) {
+    if (event == null || typeof event !== 'object')
+        return { kind: 'ignore' };
+    const { type, data } = event;
+    if (typeof type !== 'string')
+        return { kind: 'ignore' };
+    const obj = (data?.object ?? null);
+    if (obj == null || typeof obj !== 'object')
+        return { kind: 'ignore' };
+    if (type === 'checkout.session.completed' ||
+        type === 'checkout.session.async_payment_succeeded') {
+        // Delayed-notification methods (SEPA, ACH…) fire `completed` with
+        // payment_status 'unpaid' and confirm later via async_payment_succeeded —
+        // only grant once the money actually landed. `no_payment_required` covers
+        // trials.
+        const paid = obj['payment_status'] === 'paid' ||
+            obj['payment_status'] === 'no_payment_required';
+        if (!paid)
+            return { kind: 'ignore' };
+        const ref = obj['client_reference_id'];
+        const accountId = typeof ref === 'string' && /^\d+$/.test(ref)
+            ? Number.parseInt(ref, 10)
+            : typeof ref === 'number' && Number.isInteger(ref)
+                ? ref
+                : null;
+        return {
+            kind: 'checkout_completed',
+            accountId,
+            stripeCustomerId: customerIdOf(obj['customer']),
+        };
+    }
+    if (type === 'customer.subscription.updated' ||
+        type === 'customer.subscription.deleted') {
+        const status = obj['status'];
+        const active = type !== 'customer.subscription.deleted' &&
+            (status === 'active' || status === 'trialing');
+        return {
+            kind: 'subscription_status',
+            customerId: customerIdOf(obj['customer']),
+            plan: active ? 'pro' : 'free',
+        };
+    }
+    return { kind: 'ignore' };
+}
+export async function billingRoutes(app) {
+    // Redirect the signed-in user to the Stripe Payment Link, tagging the checkout
+    // with their account id (client_reference_id rides the Payment Link URL and
+    // comes back on checkout.session.completed). Exempted from the cloud auth gate
+    // (it's a plain browser navigation from the public pricing page), so it must
+    // handle anonymous visitors itself: bounce them to sign-in rather than a 401.
+    app.get('/api/billing/checkout', async (req, reply) => {
+        if (!config.stripePaymentLinkUrl) {
+            // No Payment Link configured — which is the state today. Send the visitor to
+            // the contact form rather than back to a marketing page with an error flag on
+            // it: Pro is currently GIVEN, free for a month, to anyone who asks, so there is
+            // a real next step here and "unavailable" would be the wrong word for it.
+            // `?topic=pro` preselects the right subject in the form.
+            return reply.redirect('/contact?topic=pro', 302);
+        }
+        if (!req.account) {
+            return reply.redirect('/api/auth/login', 302);
+        }
+        const url = new URL(config.stripePaymentLinkUrl);
+        url.searchParams.set('client_reference_id', String(req.account.id));
+        return reply.redirect(url.toString(), 302);
+    });
+    // The webhook needs the RAW request body (the signature signs the exact bytes).
+    // Fastify content-type parsers are ENCAPSULATED, so registering the buffer
+    // parser inside this nested plugin scope affects ONLY the routes declared here
+    // — the rest of the API keeps normal JSON parsing (proven by billing.test.ts).
+    await app.register(async (scope) => {
+        scope.addContentTypeParser('application/json', { parseAs: 'buffer' }, (_req, body, done) => {
+            done(null, body);
+        });
+        // Stripe posts unauthenticated (exempted from the auth gate); authenticity
+        // comes from the signature. Never 500 on an unknown account — Stripe retries
+        // on non-2xx, and an unknown account is a data mismatch, not a server fault.
+        scope.post('/api/billing/webhook', async (req, reply) => {
+            if (!config.stripeWebhookSecret) {
+                return reply.code(501).send({ error: 'billing not configured' });
+            }
+            const raw = req.body;
+            if (!Buffer.isBuffer(raw)) {
+                return reply.code(400).send({ error: 'expected a JSON body' });
+            }
+            const sig = req.headers['stripe-signature'];
+            if (typeof sig !== 'string' ||
+                !verifyStripeSignature(raw, sig, config.stripeWebhookSecret)) {
+                return reply.code(400).send({ error: 'invalid signature' });
+            }
+            let event;
+            try {
+                event = JSON.parse(raw.toString('utf-8'));
+            }
+            catch {
+                return reply.code(400).send({ error: 'invalid JSON' });
+            }
+            const action = stripeEventAction(event);
+            if (action.kind === 'checkout_completed') {
+                const account = action.accountId != null ? await getAccountById(action.accountId) : null;
+                if (account) {
+                    // client_reference_id is attacker-influencable (it rides the public
+                    // Payment Link URL), so never let a new checkout re-bind an account
+                    // that already has a DIFFERENT Stripe customer — that would orphan
+                    // the original subscription's webhooks.
+                    const rebind = account.stripeCustomerId != null &&
+                        action.stripeCustomerId != null &&
+                        account.stripeCustomerId !== action.stripeCustomerId;
+                    await setAccountPlan(account.id, 'pro', rebind ? undefined : action.stripeCustomerId);
+                    if (rebind) {
+                        req.log.warn({
+                            accountId: account.id,
+                            existingCustomerId: account.stripeCustomerId,
+                            newCustomerId: action.stripeCustomerId,
+                        }, 'stripe checkout for an account already bound to a different customer — kept the existing binding');
+                    }
+                    req.log.info({ accountId: account.id }, 'stripe checkout completed — plan set to pro');
+                }
+                else {
+                    req.log.warn({ clientReferenceId: action.accountId }, 'stripe checkout completed for unknown account — ignored');
+                }
+            }
+            else if (action.kind === 'subscription_status') {
+                const account = action.customerId
+                    ? await getAccountByStripeCustomerId(action.customerId)
+                    : null;
+                if (account) {
+                    await setAccountPlan(account.id, action.plan);
+                    req.log.info({ accountId: account.id, plan: action.plan }, 'stripe subscription status — plan updated');
+                }
+                else {
+                    req.log.warn({ customerId: action.customerId }, 'stripe subscription event for unknown customer — ignored');
+                }
+            }
+            return { received: true };
+        });
+    });
+}
+//# sourceMappingURL=billing.js.map