npm - mikser-io-auth - Versions diffs - 0.14.0 → 0.15.0 - Mend

mikser-io-auth 0.14.0 → 0.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/lib/login-page.js CHANGED Viewed

@@ -49,7 +49,7 @@ body{
   margin:0; min-height:100vh; display:grid; place-items:center; background:var(--bg);
   color:var(--text); font:14px/1.5 ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
 }
-form{
+form,.card{
   width:320px; padding:32px; display:flex; flex-direction:column; align-items:center; gap:10px;
   background:var(--panel); border:1px solid var(--border);
   border-radius:var(--radius); box-shadow:var(--shadow);
@@ -62,6 +62,12 @@ h1{font-size:17px;font-weight:700;margin:0 0 6px;color:var(--text-strong)}
   width:100%; margin:0 0 2px; padding:8px 10px; border-radius:8px; font-size:13px;
   background:#fef2f2; border:1px solid #fecaca; color:#b91c1c; text-align:center;
 }
+.msg{margin:0;font-size:13px;text-align:center;opacity:.85}
+.msg code{
+  font:12px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;
+  background:#f1f5f9;border:1px solid var(--border);border-radius:4px;padding:1px 4px;
+  color:var(--text-strong);word-break:break-all;
+}
 /* 8px on the fields against the card's 6px is WhiteBox's own combination, not a slip. */
 input{
   width:100%; padding:9px 10px; border:1px solid var(--border-2); border-radius:8px;
@@ -113,4 +119,82 @@ ${notice}
 </body></html>`
 }
+// The same page, when signing in is not the answer.
+//
+// A request that names a client the server has never registered cannot be
+// fixed by a password, so it gets an explanation rather than a form. It was a
+// bare `res.send('Unknown client_id')`: seventeen bytes of unstyled text on a
+// white page, reached from a polished consent screen, which reads as a broken
+// deployment rather than as a request that could not be honoured.
+//
+// Not a redirect back to the client, deliberately — RFC 6749 §4.1.2.1 says an
+// unregistered client_id or an unregistered redirect_uri MUST be shown to the
+// user rather than sent to that URI, because the URI is exactly the part that
+// cannot be trusted yet.
+export function messagePage({ appName, logoUrl, title, error, detail }) {
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+/* Values measured off WhiteBox's running console login, not copied from its
+   stylesheet fallbacks — its PrimeVue theme overrides --accent, --text and
+   --radius at runtime, so the source would have produced a page that looked
+   adjacent to it rather than identical.
+   Light only, also deliberately: WhiteBox's login stays light under
+   prefers-color-scheme: dark, so a dark block here would create exactly the
+   mismatch it looks like it prevents. */
+:root{
+  --bg:#f1f5f9; --panel:#fff; --border:#e2e8f0; --border-2:#cbd5e1;
+  --text:#334155; --text-strong:#0f172a; --accent:#09090b;
+  --radius:6px; --shadow:0 6px 18px rgba(15,23,42,.10);
+}
+*{box-sizing:border-box}
+body{
+  margin:0; min-height:100vh; display:grid; place-items:center; background:var(--bg);
+  color:var(--text); font:14px/1.5 ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
+}
+form,.card{
+  width:320px; padding:32px; display:flex; flex-direction:column; align-items:center; gap:10px;
+  background:var(--panel); border:1px solid var(--border);
+  border-radius:var(--radius); box-shadow:var(--shadow);
+}
+img{width:36px;height:36px;margin-bottom:2px}
+h1{font-size:17px;font-weight:700;margin:0 0 6px;color:var(--text-strong)}
+.sub{margin:-4px 0 4px;font-size:13px;text-align:center;opacity:.8}
+.sub strong{color:var(--text-strong);font-weight:600}
+.err{
+  width:100%; margin:0 0 2px; padding:8px 10px; border-radius:8px; font-size:13px;
+  background:#fef2f2; border:1px solid #fecaca; color:#b91c1c; text-align:center;
+}
+.msg{margin:0;font-size:13px;text-align:center;opacity:.85}
+.msg code{
+  font:12px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;
+  background:#f1f5f9;border:1px solid var(--border);border-radius:4px;padding:1px 4px;
+  color:var(--text-strong);word-break:break-all;
+}
+/* 8px on the fields against the card's 6px is WhiteBox's own combination, not a slip. */
+input{
+  width:100%; padding:9px 10px; border:1px solid var(--border-2); border-radius:8px;
+  font-size:14px; background:var(--panel); color:var(--text);
+}
+input:focus{outline:2px solid color-mix(in srgb,var(--accent) 25%,transparent);border-color:var(--accent)}
+button{
+  width:100%; margin-top:6px; padding:9px; border:none; border-radius:8px;
+  background:var(--accent); color:#fff; font-size:14px; font-weight:500; cursor:pointer;
+}
+button:hover{opacity:.92}
+button[disabled]{opacity:.65;cursor:default}
+</style>
+</head><body>
+<div class="card">
+<img src="${escapeHtml(logoUrl)}" alt="" onerror="this.remove()">
+<h1>${escapeHtml(title)}${appName ? ` — ${escapeHtml(appName)}` : ''}</h1>
+${error ? `<p class="err">${escapeHtml(error)}</p>` : ''}
+${detail ? `<p class="msg">${detail}</p>` : ''}
+</div>
+</body></html>`
+}
 export { escapeHtml }

package/lib/routes.js CHANGED Viewed

@@ -6,7 +6,7 @@ import { jwks, ALG } from './keys.js'
 import { issueToken } from './tokens.js'
 import { verifyPkce } from './pkce.js'
 import { redirectUriAllowed, registerDynamicClient, RegistrationError } from './clients.js'
-import { loginPage } from './login-page.js'
+import { loginPage, messagePage, escapeHtml } from './login-page.js'
 import * as grants from './grants.js'
 const CODE_TTL_SEC    = 60
@@ -87,12 +87,39 @@ export function mountRoutes(router, ctx) {
     // error directly rather than redirecting. Redirecting to an unvalidated
     // URI is itself the vulnerability — an open redirect through the
     // authorization endpoint.
-    async function resolveClient(params, res) {
+    // Shown, not redirected. RFC 6749 §4.1.2.1: when the client_id or the
+    // redirect_uri is not registered, the error goes to the person rather than
+    // to that URI — the URI being the part that cannot be trusted yet.
+    function refuse(req, res, { error, detail }) {
+        res.status(400).type('html').send(messagePage({
+            appName: nameOf(req), logoUrl, title: 'Cannot authorise', error, detail,
+        }))
+        return null
+    }
+    async function resolveClient(params, res, req) {
         const client = params.client_id ? await grants.getDynamicClient(params.client_id) : null
-        if (!client) { res.status(400).send('Unknown client_id'); return null }
+        if (!client) {
+            // Almost always a client_id typed in by hand. Connectors register
+            // themselves at /auth/register and are handed one; a value that
+            // looks like a person — an email, a username — is a sign the field
+            // was filled in where it should have been left empty.
+            return refuse(req, res, {
+                error: 'Unknown client_id',
+                detail: params.client_id
+                    ? `No application is registered as <code>${escapeHtml(params.client_id)}</code>. `
+                      + 'Connectors register themselves and are issued an ID, so leave the client ID '
+                      + 'field empty and let it do that. Your username and password are asked for on '
+                      + 'the next screen, not here.'
+                    : 'The request did not name a client.',
+            })
+        }
         if (!redirectUriAllowed(client, params.redirect_uri)) {
-            res.status(400).send('redirect_uri is not registered for this client')
-            return null
+            return refuse(req, res, {
+                error: 'redirect_uri is not registered for this client',
+                detail: `<code>${escapeHtml(params.redirect_uri ?? '')}</code> is not one of the `
+                    + 'addresses this application registered, so sending you back to it would not be safe.',
+            })
         }
         return client
     }
@@ -119,7 +146,7 @@ export function mountRoutes(router, ctx) {
     router.get('/authorize', async (req, res) => {
         const params = authParams(req.query)
-        const client = await resolveClient(params, res)
+        const client = await resolveClient(params, res, req)
         if (!client) return
         if (!checkRequest(params, res)) return
         res.type('html').send(loginPage({ params, client, appName: nameOf(req), logoUrl }))
@@ -127,7 +154,7 @@ export function mountRoutes(router, ctx) {
     router.post('/authorize', async (req, res) => {
         const params = authParams(req.body)
-        const client = await resolveClient(params, res)
+        const client = await resolveClient(params, res, req)
         if (!client) return
         if (!checkRequest(params, res)) return

package/lib/verifiers.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { explainRefusal, actingRole, runtime } from 'mikser-io'
+import { hasCapability } from 'mikser-io'
 // The two verifiers, both implementing the ADR-0012 contract:
 //
 //   { name, verify(req) → null | false | { subject, capabilities }, challenge? }
@@ -170,7 +171,7 @@ export function jwt({ verifyToken, issuer, audience, resource, scopes = [], requ
                 }
             }
-            if (requiredCapability && !principal.capabilities.includes(requiredCapability)) {
+            if (requiredCapability && !hasCapability(principal, requiredCapability)) {
                 // 403, not 401: the token is perfectly good and a fresh one
                 // for the same subject would be refused identically. A client
                 // that reads this as an expiry refreshes in a loop.

package/package.json CHANGED Viewed

@@ -1,9 +1,12 @@
 {
   "name": "mikser-io-auth",
-  "version": "0.14.0",
-  "description": "Authentication for mikser-io: an OAuth 2.1 authorization server (self-registering clients, authorization code + PKCE, refresh rotation) and HTTP Basic / JWT verifiers over Apache-format htpasswd and htgroup files in the working folder. Implements the ADR-0012 verifier contract, so it plugs in wherever a static token does — api, mcp, forms.",
+  "version": "0.15.0",
+  "description": "Authentication for mikser-io: an OAuth 2.1 authorization server (self-registering clients, authorization code + PKCE, refresh rotation) and HTTP Basic / JWT verifiers over Apache-format htpasswd and htgroup files in the working folder. Implements the ADR-0012 verifier contract, so it plugs in wherever a static token does \u2014 api, mcp, forms.",
   "main": "index.js",
   "type": "module",
+  "allowScripts": {
+    "better-sqlite3": true
+  },
   "scripts": {
     "test": "node --no-warnings --test --test-reporter=spec 'test/**/*.test.js'"
   },

package/test/authorize.test.js CHANGED Viewed

@@ -685,3 +685,69 @@ describe('unattended renewal is granted out loud, not just made possible', () =>
         assert.ok(second.scope.split(' ').includes('offline_access'))
     })
 })
+// A request that cannot be honoured still lands on a page, not on bare text.
+//
+// `res.send('Unknown client_id')` is seventeen bytes of unstyled text on a
+// white background, reached from a polished consent screen. It reads as a
+// broken deployment rather than as a request that could not be served, and it
+// says nothing about what to do — which matters most here, because the
+// commonest cause is a client ID typed into a field that should have been left
+// empty: connectors register themselves at /auth/register and are issued one.
+//
+// Not a redirect, deliberately. RFC 6749 §4.1.2.1: an unregistered client_id
+// or redirect_uri is shown to the person rather than sent to that URI, the URI
+// being the part that cannot be trusted yet.
+describe('a request that cannot be authorised', () => {
+    const looksLikeTheLoginPage = (html) => {
+        // Same shell, same tokens, same card — asserted rather than eyeballed,
+        // because "make it look like the login page" is only true while both
+        // are rendered from the one style block.
+        assert.match(html, /<!doctype html>/i)
+        assert.match(html, /--accent:#09090b/, 'shares the login page palette')
+        assert.match(html, /width:320px/, 'shares the card geometry')
+        assert.match(html, /class="err"/, 'shares the error treatment')
+    }
+    it('renders an unknown client_id as a page, naming what was sent', async () => {
+        const res = await fetch(authorizeUrl(pkcePair().challenge, { client_id: 'dk@almero.bg' }))
+        assert.equal(res.status, 400)
+        assert.match(res.headers.get('content-type') ?? '', /text\/html/)
+        const html = await res.text()
+        looksLikeTheLoginPage(html)
+        assert.match(html, /Unknown client_id/)
+        assert.match(html, /dk@almero\.bg/, 'says which id was not found')
+        assert.match(html, /leave the client ID/i, 'and what to do instead')
+    })
+    it('does not redirect an unregistered client back to its redirect_uri', async () => {
+        // The URI is the untrusted part; bouncing an error to it hands an
+        // attacker a redirector.
+        const res = await fetch(authorizeUrl(pkcePair().challenge, {
+            client_id: 'nope', redirect_uri: 'https://example.invalid/cb',
+        }), { redirect: 'manual' })
+        assert.equal(res.status, 400)
+        assert.equal(res.headers.get('location'), null)
+    })
+    it('renders an unregistered redirect_uri as a page too', async () => {
+        const res = await fetch(authorizeUrl(pkcePair().challenge, {
+            redirect_uri: 'https://example.invalid/somewhere-else',
+        }))
+        assert.equal(res.status, 400)
+        const html = await res.text()
+        looksLikeTheLoginPage(html)
+        assert.match(html, /redirect_uri is not registered/)
+        assert.match(html, /example\.invalid/)
+    })
+    it('escapes what it echoes back', async () => {
+        // Everything on this page came from the query string.
+        const res = await fetch(authorizeUrl(pkcePair().challenge, {
+            client_id: '<script>alert(1)</script>',
+        }))
+        const html = await res.text()
+        assert.doesNotMatch(html, /<script>alert\(1\)<\/script>/)
+        assert.match(html, /&lt;script&gt;/)
+    })
+})