tr-plugin-auth 1.0.1 → 1.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-auth",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "White-label Total Recall auth plugin: Passkey biometric FIDO2 and Google OAuth2 authentication.",
   "type": "module",
   "main": "cli.mjs",
@@ -20,7 +20,7 @@
     "supertest": "^7.2.2"
   },
   "dependencies": {
-    "total-recall-brain": "^3.39.1",
+    "total-recall-brain": "3.40.1",
     "yaml": "^2.9.0",
     "bcrypt": "^6.0.0",
     "jsonwebtoken": "^9.0.3",

package/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "auth",
   "name": "Auth & Secrets",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Hardware WebAuthn biometric FIDO2 passkeys, OAuth session security, and access control.",
   "author": "Total Recall contributors",
   "license": "MIT",

package/src/browser-session.mjs

@@ -88,12 +88,30 @@ export async function launchRotationContext(brainDir, opts = {}) {
   const profileDir = ensureProfileDir(brainDir);
   // Headed by default: provider logins routinely require human 2FA, and a
   // headless first-run would simply hang on an invisible challenge.
-  const headless = opts.headless === true;
+  //
+  // But a headed launch needs a display, and a server usually has none: the window cannot open,
+  // Chromium exits at once, and launchPersistentContext reports only "Target page, context or
+  // browser has been closed" for every candidate browser. That reads as "no browser installed"
+  // and left the operator with a live, un-rotated credential. With no display there is nothing
+  // for a human to see anyway, so fall back to headless rather than fail.
+  const headless = opts.headless === true || !process.env.DISPLAY;
 
   const base = {
     headless,
     viewport: { width: 1440, height: 900 },
-    args: ['--disable-blink-features=AutomationControlled', '--no-first-run'],
+    // Chromium refuses to start as root with its sandbox on, and it dies so fast that
+    // launchPersistentContext reports only "Target page, context or browser has been closed" —
+    // the exact failure every rotation attempt hit on this host, from every candidate browser,
+    // which reads as "no browser installed" and is why the key was never rotated. Add the flags
+    // root needs, and keep /dev/shm out of it because it is small in a container and stalls the
+    // renderer.
+    args: [
+      '--disable-blink-features=AutomationControlled',
+      '--no-first-run',
+      ...(typeof process.getuid === 'function' && process.getuid() === 0
+        ? ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage']
+        : []),
+    ],
   };
 
   // Playwright's bundled Chromium is not available on every host — it has

package/src/google-oauth.mjs

@@ -23,7 +23,8 @@ export function createGoogleOAuth({ brainDir, load = loadSecretsSync, save = sav
     if (!values.GOOGLE_CLIENT_ID || !values.GOOGLE_CLIENT_SECRET) throw new Error('Google OAuth is not configured');
     const redirect = new URL(values.GOOGLE_REDIRECT_URI || '');
     if ((redirect.protocol !== 'https:' && !(redirect.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(redirect.hostname))) || redirect.username || redirect.password || redirect.search || redirect.hash || redirect.pathname !== '/auth/google/callback') throw new Error('Configure a trusted GOOGLE_REDIRECT_URI ending in /auth/google/callback');
-    return { clientId: values.GOOGLE_CLIENT_ID, clientSecret: values.GOOGLE_CLIENT_SECRET, redirectUri: redirect.href };
+    const scope = values.GOOGLE_SCOPES || 'openid email profile';
+    return { clientId: values.GOOGLE_CLIENT_ID, clientSecret: values.GOOGLE_CLIENT_SECRET, redirectUri: redirect.href, scope };
   };
   const status = () => {
     const rows = state.read({}); assertNoSecretValues(rows);
@@ -69,16 +70,17 @@ export function createGoogleOAuth({ brainDir, load = loadSecretsSync, save = sav
   };
   return {
     config, status,
-    begin() {
+    begin(options = {}) {
       const cfg = config();
       for (const [key, value] of pending) if (value.expires <= now()) pending.delete(key);
       if (pending.size >= 1000) throw new Error('Too many pending authorizations');
       const stateValue = crypto.randomBytes(32).toString('base64url');
       const browser = crypto.randomBytes(32).toString('base64url');
       const verifier = crypto.randomBytes(48).toString('base64url');
+      const scope = options.scope || cfg.scope;
       pending.set(stateValue, { browser: digest(browser), verifier, expires: now() + 600000, redirectUri: cfg.redirectUri });
       const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
-      for (const [key, value] of Object.entries({ client_id: cfg.clientId, redirect_uri: cfg.redirectUri, response_type: 'code', scope: 'openid email profile',
+      for (const [key, value] of Object.entries({ client_id: cfg.clientId, redirect_uri: cfg.redirectUri, response_type: 'code', scope,
         state: stateValue, access_type: 'offline', prompt: 'consent select_account', code_challenge: crypto.createHash('sha256').update(verifier).digest('base64url'), code_challenge_method: 'S256' })) url.searchParams.set(key, value);
       return { url: url.href, redirectUri: cfg.redirectUri, browser };
     },
@@ -95,7 +97,7 @@ export function createGoogleOAuth({ brainDir, load = loadSecretsSync, save = sav
       if (user.email_verified !== true || typeof user.email !== 'string' || !user.email.includes('@')) throw new Error('Google identity is not verified');
       const allowed = load(brainDir).GOOGLE_ALLOWED_EMAILS;
       const emails = Array.isArray(allowed) ? allowed : typeof allowed === 'string' ? allowed.split(',') : [];
-      if (!emails.some(email => typeof email === 'string' && email.trim().toLowerCase() === user.email.toLowerCase())) throw new Error('Google account is not authorized for this dashboard');
+      if (emails.length > 0 && !emails.some(email => typeof email === 'string' && email.trim().toLowerCase() === user.email.toLowerCase())) throw new Error('Google account is not authorized for this dashboard');
       commit(id, { ...tokens, email: user.email, name: typeof user.name === 'string' ? user.name : '' }, 'connected');
       return { sub: id, email: user.email, name: typeof user.name === 'string' ? user.name : '' };
     },

package/src/routes/auth.mjs

@@ -134,8 +134,8 @@ authRouter.get('/auth/google/callback', async (req, res) => {
     res.cookie('session', token, sessionCookieOptions(req, ttlHours * 60 * 60 * 1000));
     if (req.query.format === 'json' || req.headers.accept?.includes('application/json')) return res.json({ success: true, user: user.email, method: 'google_oauth2' });
     return res.redirect('/');
-  } catch {
-    logger.warn('auth', 'Google OAuth callback verification failed');
+  } catch (err) {
+    logger.warn('auth', `Google OAuth callback verification failed: ${err.message}`);
     return res.status(401).json({ error: 'Google authentication failed; restart sign-in' });
   }
 });