offrouter-core 0.2.0 → 0.2.2

package/src/auth/oauth-server.ts

@@ -1,296 +0,0 @@
-/**
- * Local OAuth callback server for OffRouter's live PKCE login flow.
- *
- * Binds to 127.0.0.1 ONLY (never 0.0.0.0) so the provider can redirect back
- * to this machine without exposing the callback to the network. The server
- * captures the authorization `code` + `state` from the redirect and hands them
- * to the caller; it never touches tokens, secrets, or the network beyond the
- * single loopback HTTP socket.
- */
-import { createServer, type Server, type IncomingMessage, type ServerResponse } from "node:http";
-import { URL } from "node:url";
-
-/** Loopback-only hostname. Hardcoded to prevent accidental 0.0.0.0 binds. */
-const LOOPBACK_HOST = "127.0.0.1";
-
-/** Path the provider redirects to (http://127.0.0.1:PORT/callback). */
-const CALLBACK_PATH = "/callback";
-
-export interface CallbackServerOptions {
-  /**
-   * State value expected from the provider. Validated in waitForCode against
-   * the state returned by the redirect; a mismatch rejects the promise.
-   * May also be supplied per-call to waitForCode.
-   */
-  expectedState?: string;
-}
-
-export interface WaitForCodeOptions {
-  /** Overrides the server-level expectedState for this call. */
-  expectedState?: string;
-  /** How long to wait for a callback before rejecting (default 5 minutes). */
-  timeoutMs?: number;
-  /** Optional abort signal to cancel the wait early. */
-  signal?: AbortSignal;
-}
-
-export interface CallbackCode {
-  code: string;
-  state: string;
-}
-
-export interface CallbackServerHandle {
-  /** Full redirect_uri to register with the provider (http://127.0.0.1:PORT/callback). */
-  url: string;
-  /** Actual bound port (useful when 0 was requested). */
-  port: number;
-  /** Resolve with {code, state} on a valid callback; reject on timeout/state mismatch. */
-  waitForCode(options?: WaitForCodeOptions): Promise<CallbackCode>;
-  /** Stop listening and free the port. Idempotent. */
-  close(): Promise<void>;
-}
-
-/**
- * Start a loopback HTTP server that captures an OAuth authorization code.
- * Pass port 0 to let the OS choose a free port (read handle.port afterwards).
- */
-export function startCallbackServer(
-  port: number,
-  options: CallbackServerOptions = {},
-): Promise<CallbackServerHandle> {
-  return new Promise((resolve, reject) => {
-    const serverLevelState = options.expectedState;
-
-    // Deferred for the first valid callback (has a `code` param).
-    let captured: CallbackCode | null = null;
-    const waiters: Array<{
-      resolve: (value: CallbackCode) => void;
-      reject: (error: Error) => void;
-    }> = [];
-
-    const httpServer: Server = createServer(
-      (req: IncomingMessage, res: ServerResponse) => {
-        handleCallback(req, res);
-      },
-    );
-
-    function handleCallback(req: IncomingMessage, res: ServerResponse): void {
-      // Only respond to GET on the callback path; everything else 404s.
-      if (req.method !== "GET") {
-        res.writeHead(405, { "content-type": "text/plain; charset=utf-8" });
-        res.end("Method Not Allowed");
-        return;
-      }
-
-      let parsedUrl: URL;
-      try {
-        parsedUrl = new URL(req.url ?? "/", `http://${LOOPBACK_HOST}`);
-      } catch {
-        res.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
-        res.end("Bad Request");
-        return;
-      }
-
-      const pathname = parsedUrl.pathname;
-      const code = parsedUrl.searchParams.get("code");
-      const state = parsedUrl.searchParams.get("state");
-      const error = parsedUrl.searchParams.get("error");
-
-      // OAuth error from the provider (e.g. user denied consent).
-      if (error) {
-        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-        res.end(authorizationDeniedPage(error));
-        return;
-      }
-
-      if (pathname !== CALLBACK_PATH) {
-        res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-        res.end("Not Found");
-        return;
-      }
-
-      // Missing code -> provider returned nothing usable.
-      if (!code) {
-        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-        res.end(missingCodePage());
-        return;
-      }
-
-      // Capture the first valid callback exactly once.
-      const callback: CallbackCode = { code, state: state ?? "" };
-      if (!captured) {
-        captured = callback;
-        // Resolve any pending waiters that accept this callback.
-        const pending = waiters.splice(0, waiters.length);
-        for (const w of pending) {
-          w.resolve(callback);
-        }
-      }
-
-      // Always show the user a friendly page; security validation happens in
-      // waitForCode (state may not be known at request time).
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(successPage());
-    }
-
-    httpServer.on("error", (err: NodeJS.ErrnoException) => {
-      reject(
-        new Error(
-          `Failed to start OAuth callback server on 127.0.0.1:${port}: ${err.message}`,
-          { cause: err },
-        ),
-      );
-    });
-
-    httpServer.listen(port, LOOPBACK_HOST, () => {
-      const address = httpServer.address();
-      const boundPort =
-        address && typeof address === "object" ? address.port : port;
-      const redirectUrl = `http://${LOOPBACK_HOST}:${boundPort}${CALLBACK_PATH}`;
-
-      const handle: CallbackServerHandle = {
-        url: redirectUrl,
-        port: boundPort,
-        waitForCode(waitOpts: WaitForCodeOptions = {}): Promise<CallbackCode> {
-          const expected =
-            waitOpts.expectedState !== undefined
-              ? waitOpts.expectedState
-              : serverLevelState;
-          const timeoutMs = waitOpts.timeoutMs ?? 5 * 60 * 1000;
-
-          return new Promise<CallbackCode>((resolveWait, rejectWait) => {
-            let settled = false;
-
-            const settle = (
-              outcome: CallbackCode | Error,
-              isReject: boolean,
-            ): void => {
-              if (settled) return;
-              settled = true;
-              clearTimeout(timer);
-              waitOpts.signal?.removeEventListener("abort", onAbort);
-              if (isReject) {
-                rejectWait(outcome as Error);
-              } else {
-                resolveWait(outcome as CallbackCode);
-              }
-            };
-
-            const onAbort = (): void => {
-              settle(
-                new Error("OAuth callback wait was aborted."),
-                true,
-              );
-            };
-
-            const timer = setTimeout(() => {
-              settle(new Error("OAuth login timed out waiting for callback."), true);
-            }, timeoutMs);
-
-            if (waitOpts.signal?.aborted) {
-              settle(new Error("OAuth callback wait was aborted."), true);
-              return;
-            }
-            waitOpts.signal?.addEventListener("abort", onAbort);
-
-            const resolveWith = (callback: CallbackCode): void => {
-              if (expected !== undefined && callback.state !== expected) {
-                settle(
-                  new Error(
-                    `OAuth state mismatch: expected "${redactState(expected)}" ` +
-                      `but received "${redactState(callback.state)}". ` +
-                      `This may indicate a CSRF attempt or a stale login tab.`,
-                  ),
-                  true,
-                );
-                return;
-              }
-              settle(callback, false);
-            };
-
-            if (captured) {
-              resolveWith(captured);
-              return;
-            }
-
-            waiters.push({ resolve: resolveWith, reject: rejectWait });
-          });
-        },
-        close(): Promise<void> {
-          return new Promise<void>((resolveClose) => {
-            httpServer.close(() => resolveClose());
-            // close() waits for in-flight connections; closeAllConnections is
-            // available on Node 18+ and speeds shutdown without dropping the
-            // response the user's browser is mid-receiving.
-            // (Not called here to keep the success page delivery intact.)
-          });
-        },
-      };
-
-      resolve(handle);
-    });
-  });
-}
-
-// ---------------------------------------------------------------------------
-// Static HTML pages (ASCII-only, no secret material)
-// ---------------------------------------------------------------------------
-
-function successPage(): string {
-  return [
-    "<!doctype html>",
-    "<html lang=\"en\">",
-    "<head><meta charset=\"utf-8\"><title>OffRouter login</title></head>",
-    "<body>",
-    "<h1>OffRouter login authorized</h1>",
-    "<p>You can close this tab and return to your terminal.</p>",
-    "</body>",
-    "</html>",
-    "",
-  ].join("\n");
-}
-
-function authorizationDeniedPage(error: string): string {
-  const safe = escapeHtml(error);
-  return [
-    "<!doctype html>",
-    "<html lang=\"en\">",
-    "<head><meta charset=\"utf-8\"><title>OffRouter login</title></head>",
-    "<body>",
-    "<h1>OffRouter login not completed</h1>",
-    `<p>The provider reported: ${safe}</p>`,
-    "<p>You can close this tab and try again from your terminal.</p>",
-    "</body>",
-    "</html>",
-    "",
-  ].join("\n");
-}
-
-function missingCodePage(): string {
-  return [
-    "<!doctype html>",
-    "<html lang=\"en\">",
-    "<head><meta charset=\"utf-8\"><title>OffRouter login</title></head>",
-    "<body>",
-    "<h1>OffRouter login incomplete</h1>",
-    "<p>The callback did not include an authorization code.</p>",
-    "</body>",
-    "</html>",
-    "",
-  ].join("\n");
-}
-
-function escapeHtml(value: string): string {
-  return value
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
-/** Truncate a state token for error messages so it is never echoed in full. */
-function redactState(state: string): string {
-  if (state.length <= 8) return "***";
-  return `${state.slice(0, 4)}...${state.slice(-4)}`;
-}