import { deleteCookie, getCookies, setCookie } from "https://deno.land/std/http/cookie.ts"; import type { JWTPayload, JWTVerifyOptions } from "https://deno.land/x/jose@v5.2.2/index.ts"; import { rootValRef } from "https://esm.town/v/andreterron/rootValRef"; import { extractValInfo } from "https://esm.town/v/pomdtr/extractValInfo"; import { authDescribeScopes } from "https://esm.town/v/postpostscript/authDescribeScopes"; import { html, htmlResponse, Layout } from "https://esm.town/v/postpostscript/htmlComponentLibrary"; import { generate, verify, verifyThirdParty } from "https://esm.town/v/postpostscript/jwks"; import { getValEndpointFromName, getValEndpointFromUrl, getValUrlFromName, } from "https://esm.town/v/postpostscript/meta"; import { format } from "https://esm.town/v/postpostscript/multiFormat"; import type { MaybePromise } from "https://esm.town/v/postpostscript/typeUtils"; import { email } from "https://esm.town/v/std/email"; const { author: AUTHOR, slug, httpEndpoint: ENDPOINT } = extractValInfo(import.meta.url); export const NAME = "@" + slug; export const COOKIE_NAME = "AUTH_ID_TOKEN"; export const SCOPES = { "id": "allows a token to prove that you are you", }; export function setAuthCookie(res: Response, token: string | undefined) { if (token === undefined) { deleteCookie(res.headers, COOKIE_NAME); return; } setCookie(res.headers, { name: COOKIE_NAME, value: token, httpOnly: true, secure: true, sameSite: "Lax", }); } export function getAuthCookie(req: Request) { return getCookies(req.headers)[COOKIE_NAME]; } export function createToken( payload: { sub?: string; scope: string; aud?: string | string[]; nbf?: number; iat?: number; jti?: string; }, exp: string | number | Date = "1h", ) { return generate({ jti: crypto.randomUUID(), ...payload, }, exp); } export async function verifyToken(token: string, scope: string, options: JWTVerifyOptions = {}) { const payload = await verify(token, { audience: NAME, ...options, issuer: NAME, }); console.log("got payload", payload); if (!payload.scope.split(" ").includes(scope)) { throw new Error(`token scope doesn't allow for "${scope}"`); } return payload; } export async function emailSignInLink(clientToken: string) { const minutes = 15; const token = await createToken({ scope: `${NAME}/signin`, aud: NAME, iss: NAME, }, `${minutes}m`); const qs = new URLSearchParams(); qs.set("clientToken", clientToken); qs.set("token", token); return email({ subject: "Sign In Request", ...format.Trim` ${format.Link(`${ENDPOINT}/?${qs.toString()}`, format.Plain`Sign In`)} ${format.Small`This link will expire in ${minutes.toString()} minutes.`} `, }); } export function getScopeUrl(scope: string) { return getValUrlFromName(scope.split("/").slice(0, 2).join("/")) } export function getScopeLink(scope: string) { const name = scope.split("/").slice(0, 2).join("/") return html` View Val ` } export default async function(req: Request) { const qs = new URLSearchParams(req.url.split("?")[1]); const header = html`

${NAME.split("/")[0]} Authentication - Sign In

`; const clientToken = qs.get("clientToken"); let clientPayload; try { clientPayload = clientToken && await verifyThirdParty(clientToken, { audience: NAME, }, (payload) => { console.log(payload); const author = payload.iss?.match(/^@(\w+)\/\w+$/)?.[1]; const returnTo = payload.returnTo?.match(/^@\w+\/\w+$/)?.[0]; return `${returnTo}/requestAuth`; }); } catch (e) { console.log("error verifying clientPayload", e); } if (!clientPayload) { return htmlResponse` ${Layout` ${header} Invalid request. Maybe it expired?
Go Back `} `; } const { returnTo } = clientPayload; if (qs.get("token")) { try { await verifyToken(qs.get("token"), `${NAME}/signin`); const cookie = await createToken({ scope: `${NAME}/auth`, aud: NAME, iss: NAME, sub: NAME, }); const redirectQS = new URLSearchParams(); redirectQS.set("clientToken", clientToken); const res = new Response(undefined, { status: 302, headers: { Location: "/?" + redirectQS.toString(), }, }); setAuthCookie(res, cookie); return res; } catch (e) { console.log("signin token validation failed", e); } } const cookie = getAuthCookie(req); let payload; try { payload = cookie && await verifyToken(cookie, `${NAME}/auth`); } catch (e) { console.log(cookie); console.log("cookie token validation failed", e); } if (!payload) { if (req.method === "POST") { emailSignInLink(clientToken); return htmlResponse` ${Layout` ${header} Please check your email to find the sign in link. `} `; } return htmlResponse` ${Layout` ${header} `} `; } const requiredScopes = [ `${NAME}/id`, ]; if (req.method !== "POST") { const scopeDescriptions = await authDescribeScopes([ ...requiredScopes, ...clientPayload.requestScope, ]); const res = htmlResponse` ${Layout` ${header}

${returnTo} has requested the following scopes. Check any you would like them to have access to:

${scope}${scopeDescriptions[scope] && html`: ${scopeDescriptions[scope]}`} ${getScopeLink(scope)}

The following scopes are required:

${scope}${scopeDescriptions[scope] && html`: ${scopeDescriptions[scope]}`} ${getScopeLink(scope)}

Go Back

`} `; setAuthCookie(res, cookie); return res; } const formData = await req.formData(); const grantScope = new Set(formData.getAll("grantScope[]")); const scopes = [ ...requiredScopes, ...(clientPayload.requestScope?.filter(scope => grantScope.has(scope)) || []), ]; const [author, name, ..._redirectPath] = returnTo.slice(1).split("/"); const url = getValUrlFromName(returnTo); const redirectPath = _redirectPath.join("/") || "/"; const { origin, pathname, searchParams: redirectQS } = new URL(getValEndpointFromUrl(url) + redirectPath); const aud = new Set([ `@${author}/${name}`, ...scopes.map(scope => { const [author, name] = returnTo.slice(1).split("/"); return `@${author}/${name}`; }), ]); redirectQS.set( "token", await createToken({ aud: [...aud], scope: scopes.join(" "), iss: NAME, sub: NAME, clientTokenId: clientPayload.jti, }), ); return Response.redirect(`${origin}${pathname}?${redirectQS}`); }

authId

Version 148