passport-steam-openid 1.0.0

package/.eslintrc.js

@@ -0,0 +1,26 @@
+module.exports = {
+  parser: '@typescript-eslint/parser',
+  parserOptions: {
+    project: 'tsconfig.json',
+    sourceType: 'module',
+  },
+  plugins: ['@typescript-eslint/eslint-plugin', 'sonarjs'],
+  extends: [
+    'plugin:@typescript-eslint/recommended',
+    'plugin:prettier/recommended',
+    'plugin:sonarjs/recommended',
+  ],
+  root: true,
+  env: {
+    node: true,
+    jest: true,
+  },
+  ignorePatterns: ['.eslintrc.js', 'sample/*'],
+  rules: {
+    '@typescript-eslint/interface-name-prefix': 'off',
+    '@typescript-eslint/explicit-function-return-type': 'off',
+    '@typescript-eslint/explicit-module-boundary-types': 'off',
+    '@typescript-eslint/no-explicit-any': 'off',
+    'sonarjs/no-duplicate-string': 'off'
+  },
+};

package/.github/workflows/pull-request.yml

@@ -0,0 +1,23 @@
+name: Pull Request
+
+on:
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  test_pull_request:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        name: Checkout repository
+
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 18
+        name: Setup Node.JS
+
+      - run: npm ci
+        name: Install packages
+
+      - run: npm run build
+        name: Compile library

package/.github/workflows/release.yml

@@ -0,0 +1,29 @@
+name: Release
+on: 
+  push:
+    branches:
+      master
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        name: Checkout repository
+
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '18'
+        name: Setup Node.JS
+
+      - name: Install packages
+        run: npm ci
+      
+      - run: npm run build
+        name: Compile library
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npx semantic-release

package/.husky/pre-commit

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+npx lint-staged

package/.husky/prepare-commit-msg

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+exec < /dev/tty && npx cz --hook || true

package/.lintstagedrc.json

@@ -0,0 +1,3 @@
+{
+  "*.ts": "npx eslint"
+}

package/.prettierignore

@@ -0,0 +1 @@
+src/constant.ts

package/.prettierrc

@@ -0,0 +1,4 @@
+{
+  "singleQuote": true,
+  "trailingComma": "all"
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 GlenCoco
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,63 @@
+# passport-steam-openid
+Passport strategy for authenticating with steam openid without the use of 3rd party openid packages,
+which have been proved to be source of many exploits of steam openid system, apparently by design.
+This package only relies on [passport](https://www.passportjs.org/) and [axios](https://axios-http.com/).
+
+## Usage
+```ts
+import { SteamOpenIdStrategy } from 'passport-steam-openid';
+
+passport.use(
+    new SteamOpenIdStrategy({
+        returnURL: 'http://localhost:3000/auth/steam',
+        profile: true,
+        apiKey: '<insert steam api key>'
+    }, (
+        req: Request, 
+        identifier: string, 
+        profile: SteamOpenIdUserProfile, 
+        done: VerifyCallback
+    ) => {
+        // Optional callback called only when successful authentication occurs
+        // You can save the user to database here.
+    })
+)
+
+app.get('/auth/steam', passport.authenticate('steam-openid'), (req, res) => {
+    // When requested first by user,
+    // they will get redirected to steam and this function is never called.
+    // Second time, after user is authenticated, this function is called.
+})
+```
+
+### Error handling
+```ts
+app.use(
+  (err: Error, req: Request, res: Response): void => {
+    if (err instanceof SteamOpenIdError) {
+      switch (err.code) {
+        case SteamOpenIdErrorType.InvalidQuery:
+            // Supplied querystring was invalid
+        case SteamOpenIdErrorType.Unauthorized:
+            // Steam rejected this authentication request
+        case SteamOpenIdErrorType.InvalidSteamId:
+            // Steam profile doesn't exist
+      }
+    }
+    // ...
+  },
+);
+```
+
+### Sample
+Visit [sample](./sample) directory for more elaborate usage example.
+
+## Instalation
+Install using npm:
+```
+npm install passport-steam-openid
+```
+Released in early stage, library's api is subject to change.
+
+## License
+This library is released under MIT license.

package/dist/constant.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Query parameters that are allowed for be on the authentication request.
+ */
+export declare const OPENID_QUERY_PROPS: readonly ["openid.ns", "openid.mode", "openid.op_endpoint", "openid.claimed_id", "openid.identity", "openid.return_to", "openid.response_nonce", "openid.assoc_handle", "openid.signed", "openid.sig"];
+export declare const VALID_NONCE = "http://specs.openid.net/auth/2.0";
+export declare const VALID_ID_SELECT: string;
+export declare const VALID_IDENTITY_ENDPOINT = "https://steamcommunity.com/openid/id";
+export declare const VALID_OPENID_ENDPOINT = "https://steamcommunity.com/openid/login";
+export declare const PLAYER_SUMMARY_URL = "https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v2";
+//# sourceMappingURL=constant.d.ts.map

package/dist/constant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constant.d.ts","sourceRoot":"","sources":["../src/constant.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,kBAAkB,wMAWrB,CAAC;AAGX,eAAO,MAAM,WAAW,qCAAqC,CAAC;AAC9D,eAAO,MAAM,eAAe,QAAqC,CAAC;AAClE,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAC9E,eAAO,MAAM,qBAAqB,4CAA4C,CAAC;AAC/E,eAAO,MAAM,kBAAkB,kEAAkE,CAAC"}

package/dist/constant.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAYER_SUMMARY_URL = exports.VALID_OPENID_ENDPOINT = exports.VALID_IDENTITY_ENDPOINT = exports.VALID_ID_SELECT = exports.VALID_NONCE = exports.OPENID_QUERY_PROPS = void 0;
+/**
+ * Query parameters that are allowed for be on the authentication request.
+ */
+exports.OPENID_QUERY_PROPS = [
+    'openid.ns',
+    'openid.mode',
+    'openid.op_endpoint',
+    'openid.claimed_id',
+    'openid.identity',
+    'openid.return_to',
+    'openid.response_nonce',
+    'openid.assoc_handle',
+    'openid.signed',
+    'openid.sig',
+];
+// All URLs required for this package.
+exports.VALID_NONCE = 'http://specs.openid.net/auth/2.0';
+exports.VALID_ID_SELECT = `${exports.VALID_NONCE}/identifier_select`;
+exports.VALID_IDENTITY_ENDPOINT = 'https://steamcommunity.com/openid/id';
+exports.VALID_OPENID_ENDPOINT = 'https://steamcommunity.com/openid/login';
+exports.PLAYER_SUMMARY_URL = 'https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v2';

package/dist/error.d.ts

@@ -0,0 +1,12 @@
+import { SteamOpenIdErrorType } from './type';
+/**
+ * Class used to distinguish between errors caused by user and internal ones.
+ *
+ * @class SteamOpenIdError
+ * @param code can be used to see which kind of error occured programmatically.
+ */
+export declare class SteamOpenIdError extends Error {
+    readonly code: SteamOpenIdErrorType;
+    constructor(message: string, code: SteamOpenIdErrorType);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../src/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAE9C;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aACI,IAAI,EAAE,oBAAoB;gBAA3D,OAAO,EAAE,MAAM,EAAkB,IAAI,EAAE,oBAAoB;CAGxE"}

package/dist/error.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SteamOpenIdError = void 0;
+/**
+ * Class used to distinguish between errors caused by user and internal ones.
+ *
+ * @class SteamOpenIdError
+ * @param code can be used to see which kind of error occured programmatically.
+ */
+class SteamOpenIdError extends Error {
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+    }
+}
+exports.SteamOpenIdError = SteamOpenIdError;

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './strategy';
+export * from './type';
+export * from './error';
+export * from './constant';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./strategy"), exports);
+tslib_1.__exportStar(require("./type"), exports);
+tslib_1.__exportStar(require("./error"), exports);
+tslib_1.__exportStar(require("./constant"), exports);

package/dist/strategy.d.ts

@@ -0,0 +1,168 @@
+/// <reference types="node" />
+import { ParsedUrlQuery } from 'querystring';
+import { AxiosInstance } from 'axios';
+import { Strategy } from 'passport';
+import { SteamOpenIdUserProfile, SteamOpenIdUser, SteamOpenIdQuery, SteamOpenIdStrategyOptionsWithProfile, SteamOpenIdStrategyOptionsWithoutProfile, VerifyCallback } from './type';
+/**
+ * Strategy that authenticates you via steam openid without the use of any external openid libraries,
+ * which can and are source of many vulnerabilities.
+ *
+ * Functionality should be similar to `passport-steam`.
+ *
+ * @class SteamOpenIdStrategy
+ */
+export declare class SteamOpenIdStrategy<TOptions extends SteamOpenIdStrategyOptionsWithProfile | SteamOpenIdStrategyOptionsWithoutProfile, TUser extends SteamOpenIdUser | SteamOpenIdUserProfile = TOptions extends SteamOpenIdStrategyOptionsWithProfile ? SteamOpenIdUserProfile : SteamOpenIdUser> extends Strategy {
+    /**
+     * Axios instance used for validating the request and fetching profile.
+     */
+    protected readonly axios: AxiosInstance;
+    /**
+     * Where in your app, you want to return to from steam.
+     *
+     * This route has to have passport authentication middleware.
+     */
+    protected readonly returnURL: string;
+    /**
+     * Steam Api key used for fetching profile.
+     */
+    protected readonly apiKey?: string;
+    /**
+     * Signalizes, if profile should be fetched.
+     */
+    protected readonly profile: boolean;
+    /**
+     * optional callback, called when user is successfully authenticated
+     */
+    protected verify?: VerifyCallback<TUser>;
+    /**
+     * @constructor
+     *
+     * @param options.returnURL where steam redirects after parameters are passed
+     * @param options.profile if set, we will fetch user's profile from steam api
+     * @param options.apiKey api key to fetch user profile, not used if profile is false
+     * @param verify optional callback, called when user is successfully authenticated
+     */
+    constructor(options: TOptions, verify?: VerifyCallback<TUser>);
+    /**
+     * Passport handle for authentication. We handle the query, passport does rest.
+     *
+     * @param req Base IncommingMessage request enhanced with parsed querystring.
+     */
+    authenticate(req: any): Promise<void>;
+    /**
+     * Handles validation request.
+     *
+     * Can be used in a middleware, if you don't like passport.
+     *
+     * @param req Base IncommingMessage request enhanced with parsed querystring.
+     * @returns
+     * @throws {SteamOpenIdError} User related problem, such as:
+     *  - open.mode was not correct
+     *  - query did not was pass validation
+     *  - steam rejected this query
+     *  - steamid is invalid
+     * @throws {Error} Non-recoverable errors, such as query object missing.
+     */
+    handleRequest(req: any): Promise<TUser>;
+    /**
+     * Checks if error is retryable,
+     * meaning user gets redirected to steam openid page.
+     *
+     * @param err from catch clause
+     * @returns true, if error should be retried
+     * @returns false, if error is not retriable
+     *  and should be handled by the app.
+     */
+    protected isRetryableError(err: unknown): boolean;
+    /**
+     * Retrieves query parameter from req object and checks if it is an object.
+     *
+     * @param req Base IncommingMessage request enhanced with parsed querystring.
+     * @returns query from said request
+     * @throws Error if query cannot be found, non-recoverable error.
+     */
+    protected getQuery(req: any): ParsedUrlQuery;
+    /**
+     * Checks if `mode` field from query is correct and thus authentication can begin
+     *
+     * @param query original query user submitted
+     * @returns true, if mode is correct, equal to `id_res`
+     * @returns false, if mode is incorrect
+     */
+    protected hasAuthQuery(query: ParsedUrlQuery): boolean;
+    /**
+     * Builds a redirect url for user that is about to authenticate
+     *
+     * @returns redirect url built with proper parameters
+     */
+    buildRedirectUrl(): string;
+    /**
+     * Validates user submitted query, if it contains correct parameters.
+     * No excess parameters can be used.
+     *
+     * @param query original query user submitted
+     * @returns true, query contains correct parameters
+     * @returns false, query contains incorrect parameters
+     */
+    protected isQueryValid(query: ParsedUrlQuery): query is SteamOpenIdQuery;
+    /**
+     * Checks if identity starts with correct link.
+     *
+     * @param identity from querystring
+     * @returns true, if identity is a string and starts with correct endpoint
+     * @return false, if above criteria was violated
+     */
+    protected isValidIdentity(identity: string | unknown): boolean;
+    /**
+     * Query trusted steam endpoint to validate supplied query.
+     *
+     * @param query original query user submitted
+     * @returns true, if positive response was received
+     * @returns false, if request failed, status is incorrect or data signals invalid
+     */
+    protected validateAgainstSteam(query: SteamOpenIdQuery): Promise<boolean>;
+    /**
+     * Clones query from authentication request, changes mode and stringifies to form data.
+     * @param query original query user submitted
+     * @returns stringified form data with changed mode
+     */
+    protected getOpenIdValidationRequestBody(query: SteamOpenIdQuery): string;
+    /**
+     * Validates response from steam to see if query is correct.
+     *
+     * @param response response received from steama
+     * @returns true, if data was in correct format and signals valid query
+     * @return false, if data was corrupted or invalid query was signaled
+     */
+    protected isSteamResponseValid(response: any): boolean;
+    /**
+     * Parses steamId from `claimed_id` field, which is what openid 2.0 uses.
+     *
+     * @param query original query user submitted
+     * @returns parsed steamId
+     */
+    protected getSteamId(query: SteamOpenIdQuery): string;
+    /**
+     * Abstract method for getting user that has been authenticated.
+     * You can implement fetching user from steamid and thus validating even more,
+     * or if you are satisified with just steamId, you can return it as an object
+     * and continue without need of an steam api key.
+     *
+     * @param steamId steamId parsed from `claimed_id`
+     * @return generic that was chosen by child class
+     */
+    protected getUser(steamId: string): Promise<TUser>;
+    /**
+     * Fetches profile data for authenticated user.
+     * Validates the steamId even more.
+     *
+     * @param steamId parsed steamId from `claimed_id`
+     * @returns profile belonging to said steamId
+     *
+     * @throws {Error} if malformed response was received
+     * @throws {AxiosError} if status was not 200
+     * @throws {SteamOpenIdError} if profile was not found
+     */
+    protected fetchPlayerSummary(steamId: string): Promise<SteamOpenIdUserProfile>;
+}
+//# sourceMappingURL=strategy.d.ts.map

package/dist/strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../src/strategy.ts"],"names":[],"mappings":";AAAA,OAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACjD,OAAc,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAUpC,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAGhB,qCAAqC,EACrC,wCAAwC,EACxC,cAAc,EACf,MAAM,QAAQ,CAAC;AAEhB;;;;;;;GAOG;AACH,qBAAa,mBAAmB,CAC9B,QAAQ,SACJ,qCAAqC,GACrC,wCAAwC,EAC5C,KAAK,SACD,eAAe,GACf,sBAAsB,GAAG,QAAQ,SAAS,qCAAqC,GAC/E,sBAAsB,GACtB,eAAe,CACnB,SAAQ,QAAQ;IAChB;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAExC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAErC;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAEpC;;OAEG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAEzC;;;;;;;OAOG;gBACS,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC;IAW7D;;;;OAIG;IACmB,YAAY,CAAC,GAAG,EAAE,GAAG;IA+B3C;;;;;;;;;;;;;OAaG;IACU,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;IA8BpD;;;;;;;;OAQG;IACH,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO;IAOvC;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc;IAQ5C;;;;;;OAMG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc;IAI5C;;;;OAIG;IACI,gBAAgB;IAYvB;;;;;;;OAOG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,KAAK,IAAI,gBAAgB;IAcxE;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IASpD;;;;;;OAMG;IACH,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzE;;;;OAIG;IACH,SAAS,CAAC,8BAA8B,CAAC,KAAK,EAAE,gBAAgB;IAMhE;;;;;;OAMG;IACH,SAAS,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG;IAQ5C;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,gBAAgB;IAM5C;;;;;;;;OAQG;cACa,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IASxD;;;;;;;;;;OAUG;cACa,kBAAkB,CAChC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,CAAC;CA0BnC"}