sst 2.13.1 → 2.13.3

package/node/future/auth/adapter/code.js

@@ -0,0 +1,67 @@
+import { useCookie, usePathParam, useQueryParam, useQueryParams, useResponse, } from "../../../api/index.js";
+import { randomBytes } from "crypto";
+import { decrypt, encrypt } from "../encryption.js";
+export function CodeAdapter(config) {
+    const length = config.length || 6;
+    function generate() {
+        const buffer = randomBytes(length);
+        const otp = Array.from(buffer)
+            .map((byte) => byte % 10)
+            .join("");
+        return otp;
+    }
+    return async function () {
+        const step = usePathParam("step");
+        if (step === "authorize") {
+            const code = generate();
+            const claims = useQueryParams();
+            delete claims["client_id"];
+            delete claims["redirect_uri"];
+            delete claims["response_type"];
+            delete claims["provider"];
+            useResponse().cookies({
+                sst_code: encrypt(code),
+                sst_claims: encrypt(JSON.stringify(claims)),
+            }, {
+                maxAge: 3600,
+                secure: true,
+                sameSite: "None",
+                httpOnly: true,
+            });
+            return {
+                type: "step",
+                properties: await config.onCode(code, claims),
+            };
+        }
+        if (step === "callback") {
+            const code = decrypt(useCookie("sst_code"));
+            const claims = decrypt(useCookie("sst_claims"));
+            if (!code || !claims) {
+                return {
+                    type: "error",
+                };
+            }
+            const compare = useQueryParam("code");
+            if (code !== compare) {
+                return {
+                    type: "error",
+                };
+            }
+            useResponse().cookies({
+                sst_code: "",
+                sst_claims: "",
+            }, {
+                expires: new Date(1),
+            });
+            return {
+                type: "success",
+                properties: {
+                    claims: JSON.parse(claims),
+                },
+            };
+        }
+        return {
+            type: "error",
+        };
+    };
+}

package/node/future/auth/encryption.d.ts

@@ -0,0 +1,2 @@
+export declare function encrypt(data: string): string;
+export declare function decrypt(data: string): string | undefined;

package/node/future/auth/encryption.js

@@ -0,0 +1,30 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, } from "crypto";
+import { Config } from "../../config/index.js";
+export function encrypt(data) {
+    // @ts-expect-error
+    const key = Config[process.env.AUTH_ID + "PrivateKey"];
+    const hashed = createHash("sha256").update(key).digest();
+    const iv = randomBytes(16); // Generate a random IV (Initialization Vector)
+    const cipher = createCipheriv("aes-256-cbc", hashed, iv);
+    let encrypted = cipher.update(data, "utf8", "hex");
+    encrypted += cipher.final("hex");
+    return JSON.stringify({
+        i: iv.toString("hex"),
+        d: encrypted,
+    });
+}
+export function decrypt(data) {
+    // @ts-expect-error
+    const key = Config[process.env.AUTH_ID + "PrivateKey"];
+    const hashed = createHash("sha256").update(key).digest();
+    try {
+        const parsed = JSON.parse(data);
+        const decipher = createDecipheriv("aes-256-cbc", hashed, Buffer.from(parsed.i, "hex"));
+        let decrypted = decipher.update(parsed.d, "hex", "utf8");
+        decrypted += decipher.final("utf8");
+        return decrypted;
+    }
+    catch {
+        return;
+    }
+}

package/node/future/auth/handler.d.ts

@@ -32,7 +32,8 @@ export declare function AuthHandler<Providers extends Record<string, Adapter<any
     clients: () => Promise<Record<string, string>>;
     onAuthorize?: (event: APIGatewayProxyEventV2) => Promise<void | keyof Providers>;
     onSuccess: (input: Result, response: typeof onSuccessResponse) => Promise<ReturnType<(typeof onSuccessResponse)[keyof typeof onSuccessResponse]>>;
-    onError: () => Promise<APIGatewayProxyStructuredResultV2>;
+    onIndex?: (event: APIGatewayProxyEventV2) => Promise<APIGatewayProxyStructuredResultV2>;
+    onError?: () => Promise<APIGatewayProxyStructuredResultV2>;
 }): (event: APIGatewayProxyEventV2, context: import("aws-lambda").Context) => Promise<APIGatewayProxyStructuredResultV2>;
 export type SessionCreateInput = SessionValue & Partial<SignerOptions>;
 export {};

package/node/future/auth/handler.js

@@ -23,9 +23,6 @@ const onSuccessResponse = {
                     Location: "/authorize?" +
                         new URLSearchParams({
                             provider,
-                            response_type: useCookie("response_type"),
-                            client_id: useCookie("client_id"),
-                            redirect_uri: useCookie("redirect_uri"),
                         }).toString(),
                 },
             },
@@ -36,6 +33,9 @@ export function AuthHandler(input) {
     return ApiHandler(async (evt) => {
         const step = usePathParam("step");
         if (!step) {
+            if (input.onIndex) {
+                return input.onIndex(evt);
+            }
             const clients = await input.clients();
             return {
                 statusCode: 200,
@@ -125,7 +125,10 @@ export function AuthHandler(input) {
                     body: "Missing provider",
                 };
             }
-            const { response_type, client_id, redirect_uri, state } = useQueryParams();
+            const { response_type, client_id, redirect_uri, state } = {
+                ...useCookies(),
+                ...useQueryParams(),
+            };
             if (!provider) {
                 return {
                     statusCode: 400,
@@ -196,13 +199,20 @@ export function AuthHandler(input) {
                     type,
                     properties,
                 });
-                useResponse().cookie({
+                useResponse()
+                    .cookie({
                     key: "sst_auth_token",
                     value: token,
                     maxAge: 10 * 365 * 24 * 60 * 60,
-                    secure: true,
-                    sameSite: "None",
-                    httpOnly: true,
+                })
+                    .cookies({
+                    provider: "",
+                    response_type: "",
+                    client_id: "",
+                    redirect_uri: "",
+                    state: "",
+                }, {
+                    expires: new Date(1),
                 });
                 const { client_id, response_type, redirect_uri, state } = {
                     ...useCookies(),
@@ -251,7 +261,12 @@ export function AuthHandler(input) {
             }
         }
         if (result.type === "error") {
-            return input.onError();
+            if (input.onError)
+                return input.onError();
+            return {
+                statusCode: 400,
+                body: "an error has occured",
+            };
         }
     });
 }

package/node/future/auth/index.d.ts

@@ -9,7 +9,9 @@ export * from "./adapter/facebook.js";
 export * from "./adapter/microsoft.js";
 export * from "./adapter/oauth.js";
 export * from "./adapter/spotify.js";
+export * from "./adapter/code.js";
 export type { Adapter } from "./adapter/adapter.js";
 export * from "./session.js";
 export * from "./handler.js";
+export * from "./encryption.js";
 export { Issuer } from "openid-client";

package/node/future/auth/index.js

@@ -8,6 +8,8 @@ export * from "./adapter/facebook.js";
 export * from "./adapter/microsoft.js";
 export * from "./adapter/oauth.js";
 export * from "./adapter/spotify.js";
+export * from "./adapter/code.js";
 export * from "./session.js";
 export * from "./handler.js";
+export * from "./encryption.js";
 export { Issuer } from "openid-client";

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.13.1",
+  "version": "2.13.3",
   "bin": {
     "sst": "cli/sst.js"
   },

package/support/custom-resources/index.mjs

@@ -178694,6 +178694,7 @@ async function AuthKeys(cfnRequest) {
           new import_client_ssm.PutParameterCommand({
             Name: privatePath,
             Value: privateKey,
+            Overwrite: true,
             Type: "SecureString"
           })
         ),
@@ -178701,6 +178702,7 @@ async function AuthKeys(cfnRequest) {
           new import_client_ssm.PutParameterCommand({
             Name: publicPath,
             Value: publicKey,
+            Overwrite: true,
             Type: "SecureString"
           })
         )