import { deleteCookie, getCookies, setCookie } from "https://deno.land/std/http/cookie.ts"; import type { JWTPayload } from "https://deno.land/x/jose@v5.2.2/index.ts"; import { rootValRef } from "https://esm.town/v/andreterron/rootValRef"; import { extractValInfo } from "https://esm.town/v/pomdtr/extractValInfo"; import { authDescribeScopes } from "https://esm.town/v/postpostscript/authDescribeScopes"; import { html, htmlResponse, Layout } from "https://esm.town/v/postpostscript/htmlComponentLibrary"; import { generate, type JWTVerifyOptions, verify, verifyThirdParty } from "https://esm.town/v/postpostscript/jwks"; import { getValEndpointFromName, getValEndpointFromUrl, getValUrlFromName, } from "https://esm.town/v/postpostscript/meta"; import { format } from "https://esm.town/v/postpostscript/multiFormat"; import type { MaybePromise } from "https://esm.town/v/postpostscript/typeUtils"; import { email } from "https://esm.town/v/std/email"; const COOKIE_NAME = "AUTH_ID_TOKEN"; export function authId(url: string) { const SCOPES = { id: "provides proof that you are you", }; const { author: AUTHOR, slug, httpEndpoint: ENDPOINT } = extractValInfo(url); const NAME = "@" + slug; async function emailSignInLink(clientToken: string) { const minutes = 15; const token = await generate({ scope: `${NAME}/signin`, aud: NAME, iss: NAME, }, `${minutes}m`); const qs = new URLSearchParams(); qs.set("clientToken", clientToken); qs.set("token", token); return email({ subject: "Sign In Request", ...format.Trim` ${format.Link(`${ENDPOINT}/?${qs.toString()}`, format.Plain`Sign In`)} ${format.Small`This link will expire in ${minutes.toString()} minutes.`} `, }); } async function handler(req: Request) { const { searchParams: qs } = new URL(req.url); const header = html`

Sign In as ${NAME.split("/")[0]}

`; const clientToken = qs.get("clientToken"); let clientPayload; try { clientPayload = clientToken && await verifyThirdParty(clientToken, { audience: NAME, custom(payload) { const author = payload.iss?.match(/^@(\w+)\/\w+$/)?.[1]; const returnTo = payload.returnTo?.match(/^@\w+\/\w+/)?.[0]; return { scope: `${returnTo}/requestAuth`, }; }, }); } catch (e) { console.log("error verifying clientPayload", e); } if (qs.get("logout")) { const res = htmlResponse` ${Layout` ${header} Successfully signed out! You may close this tab `} `; setAuthCookie(res, undefined); return res; } if (!clientPayload) { return htmlResponse` ${Layout` ${header} Invalid request. Maybe it expired?
Go Back `} `; } const { returnTo } = clientPayload; if (qs.get("token")) { try { await verify(qs.get("token"), { issuer: NAME, audience: NAME, custom: { scope: `${NAME}/signin`, }, }); const cookie = await generate({ scope: `${NAME}/auth`, aud: NAME, iss: NAME, sub: NAME, }, "1h"); const redirectQS = new URLSearchParams(); redirectQS.set("clientToken", clientToken); const res = new Response(undefined, { status: 302, headers: { Location: "/?" + redirectQS.toString(), }, }); setAuthCookie(res, cookie); return res; } catch (e) { console.log("signin token validation failed", e); } } const cookie = getAuthCookie(req); let payload; try { payload = cookie && await verify(cookie, { issuer: NAME, audience: NAME, custom: { scope: `${NAME}/auth`, }, }); } catch (e) { console.log("cookie token validation failed", e); } if (!payload) { if (req.method === "POST") { emailSignInLink(clientToken); return htmlResponse` ${Layout` ${header} Please check your email to find the sign in link. You may close this tab `} `; } return htmlResponse` ${Layout` ${header} `} `; } const requiredScopes = [ `${NAME}/id`, ]; if (req.method !== "POST") { const scopeDescriptions = await authDescribeScopes([ ...requiredScopes, ...clientPayload.requestScope, ]); const res = htmlResponse` ${Layout` ${header}

${ clientPayload.requestScope?.length ? html` ${returnTo} has requested the following scopes. Check any you would like them to have access to:

${scope}${scopeDescriptions[scope] && html`: ${scopeDescriptions[scope]}`} ${getScopeLink(scope)}

` : undefined } The following scopes are required:

${scope}${scopeDescriptions[scope] && html`: ${scopeDescriptions[scope]}`} ${getScopeLink(scope)}

Log Out

`} `; setAuthCookie(res, cookie); return res; } const formData = await req.formData(); const grantScope = new Set(formData.getAll("grantScope[]")); const scopes = [ ...requiredScopes, ...(clientPayload.requestScope?.filter(scope => grantScope.has(scope)) || []), ]; const [author, name, ...redirectPath] = returnTo.slice(1).split("/"); const url = getValUrlFromName(returnTo); const { origin, pathname, searchParams: redirectQS } = new URL( getValEndpointFromUrl(url) + "/" + redirectPath.join("/"), ); const aud = new Set([ `@${author}/${name}`, ...scopes.map(scope => { const [author, name] = scope.slice(1).split("/"); return `@${author}/${name}`; }), ]); redirectQS.set( "token", await generate({ aud: [...aud], scope: scopes.join(" "), iss: NAME, sub: NAME, clientTokenId: clientPayload.jti, }, "4h"), ); redirectQS.set("clientToken", clientToken); return Response.redirect(`${origin}${pathname || "/"}?${redirectQS}`); } return { SCOPES, handler, }; } export function getAuthCookie(req: Request) { return getCookies(req.headers)[COOKIE_NAME]; } export function setAuthCookie(res: Response, token: string | undefined) { if (token === undefined) { setCookie(res.headers, { name: COOKIE_NAME, value: "", httpOnly: true, secure: true, sameSite: "Lax", path: "/", }); return; } setCookie(res.headers, { name: COOKIE_NAME, value: token, httpOnly: true, secure: true, sameSite: "Lax", path: "/", }); } export function getScopeUrl(scope: string) { return getValUrlFromName(scope.split("/").slice(0, 2).join("/"), "val.town"); } export function getScopeLink(scope: string) { const name = scope.split("/").slice(0, 2).join("/"); return html` View Val `; }