From 44061918ac2515e27f8efdc7987ede621b42272c Mon Sep 17 00:00:00 2001 From: Michal Date: Sun, 16 Aug 2026 17:20:57 +0100 Subject: [PATCH] authentik-qr-login: cross-device QR sign-in for authentik Scan a QR on your authentik login page with your phone, approve it with a passkey and a fingerprint, and the laptop signs itself in. The service holds NO authentik credential. A flow policy calls it with a session id and gets back the username that approved it, or nothing -- so there is no standing credential to steal. The obvious alternative, authentik's recovery-link API, effectively requires a superuser and was rejected for that reason. See README.md for the traps this had to work around, including the two flow-binding settings that are counter-intuitive and load-bearing, and an honest account of what QR sign-in cannot defend against. --- .gitignore | 3 + Dockerfile | 38 + LICENSE | 21 + README.md | 173 +++++ package-lock.json | 1545 +++++++++++++++++++++++++++++++++++++++++ package.json | 29 + src/approve.ts | 151 ++++ src/config.ts | 116 ++++ src/index.ts | 284 ++++++++ src/numbers.ts | 44 ++ src/oidc.ts | 112 +++ src/panel.ts | 125 ++++ src/sessions.ts | 191 +++++ test/sessions.test.ts | 94 +++ tsconfig.json | 26 + tsconfig.test.json | 13 + 16 files changed, 2965 insertions(+) create mode 100644 .gitignore create mode 100644 Dockerfile create mode 100644 LICENSE create mode 100644 README.md create mode 100644 package-lock.json create mode 100644 package.json create mode 100644 src/approve.ts create mode 100644 src/config.ts create mode 100644 src/index.ts create mode 100644 src/numbers.ts create mode 100644 src/oidc.ts create mode 100644 src/panel.ts create mode 100644 src/sessions.ts create mode 100644 test/sessions.test.ts create mode 100644 tsconfig.json create mode 100644 tsconfig.test.json diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3c25e1e --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +node_modules/ +dist/ +*.log diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..8ad03f7 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,38 @@ +# authentik-qr-login. Build context is services/authentik-qr-login. +# +# Registries are fully qualified: podman enforces short-name resolution and +# fails a non-interactive build with "cannot prompt without a TTY" rather than +# choosing one. +FROM docker.io/library/node:22-alpine AS build +WORKDIR /src + +COPY package.json package-lock.json ./ +RUN npm ci + +COPY tsconfig.json tsconfig.test.json ./ +COPY src ./src +COPY test ./test + +# Typecheck and test INSIDE the image build. The service is outside the root +# tsconfig's include, so nothing else would check it — and an image that +# compiles but fails its own tests should not reach a registry. +RUN npm run typecheck +RUN npm test + +RUN npm run build +# Drop devDependencies from what gets copied forward. +RUN npm prune --omit=dev + +FROM docker.io/library/node:22-alpine AS runtime +WORKDIR /app +ENV NODE_ENV=production + +COPY --from=build /src/node_modules ./node_modules +COPY --from=build /src/dist ./dist +COPY --from=build /src/package.json ./package.json + +# The node image ships a `node` user at uid 1000; the Deployment pins the same +# uid with a read-only root filesystem. +USER node +EXPOSE 8080 +CMD ["node", "dist/index.js"] diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..82455b9 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Michal + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md new file mode 100644 index 0000000..84501ee --- /dev/null +++ b/README.md @@ -0,0 +1,173 @@ +# authentik-qr-login + +Scan a QR code on your laptop's login page with your phone, approve it with a +passkey and a fingerprint, and the laptop signs itself in. No typing on the +laptop, no password anywhere. + +authentik has no such feature — there is no QR login and no push/number-match +stage — and this adds one **without forking authentik and without holding any +authentik credential**. + +``` +LAPTOP THIS SERVICE PHONE +sso.example.com/if/flow/… sso.example.com/qr-login/ +┌──────────────────────┐ +│ authentik login page │ POST /api/session +│ ┌────────────────┐ │──────────────► id + approval token + number +│ │ ▄▄▄▄▄ ▄ ▄▄ │ │ +│ │ █ ▄ █ ▀█▄ ▀█ │ │ GET /a/:token ◄──── scan +│ │ █▄▄▄█ █ ▄▀▄█ │ │ │ +│ │ 27 │ │ passkey + fingerprint +│ └────────────────┘ │ │ +│ [ Continue ] │ "Approve sign-in? +│ │ from 192.168.8.51 +│ │ Firefox on Fedora" +│ │ → type 27 +│ ◄────────── approved ──────────────────────┘ +│ signs itself in │ +└──────────────────────┘ +``` + +## Why it is safe + +**authentik asks the service; the service never tells authentik anything.** + +An authentik flow policy calls `POST /api/assert` with a session id and gets +back the username that approved it, or nothing. The service holds no API token, +so there is no standing credential to steal, and the most it can ever say is +*"whoever holds this id approved as \"*. + +The tempting alternative — having the service call authentik's recovery-link API +to mint a one-time login URL — was tried and rejected. That endpoint effectively +requires a **superuser**: `reset_user_password` (global *and* object-level), +`view_user`, `change_user`, `impersonate`, `add_flowtoken` and `view_flow` all +return 403, while `is_superuser` succeeds immediately. A leak of that token mints +a session for any account in the directory. + +The passkey is the **only** authentication in the whole chain, so the phone-side +OIDC client pins its `authentication_flow` to a passwordless/passkey flow and +every authorize request carries `prompt=login&max_age=0`. Without both, an +existing session or a password login would satisfy the client and the guarantee +disappears silently. + +## Honest limitations + +**QR sign-in is phishable and this cannot fix it.** An attacker can render this +service's QR on their own page. The victim scans it and authenticates *for real* +against the *real* identity provider — so passkey origin binding does not help — +sees a number the attacker's page displays, and approves. The attacker's browser +gets the session. + +WebAuthn's own hybrid transport avoids this with a Bluetooth proximity check. +There is no equivalent here. What is offered instead: + +| Mitigation | What it actually buys | +|---|---| +| Keep the IdP off the public internet | By far the strongest control. The attacker must already be inside. | +| Laptop IP + reverse DNS shown **above** the number entry | The only thing standing between a phished QR and a stolen session is the user noticing the device is not theirs. | +| Number matching | Defeats blind approval-bombing. Nothing else — it does not authenticate the requester. | +| Same-subnet check | A warning by default; a hard block on request. | +| 90-second TTL, single use | The attacker must be live and synchronous. | + +**Number matching defaults to typing, not tapping.** Three buttons is +log₂(3) = 1.6 bits: with one attempt and a session cap an attacker still wins +about 70% of the time, which is not a control. Two typed digits is 6.5 bits and +about 3.3%. Set `QR_NUMBER_MODE=choice` for the friendlier version, with eyes +open. A wrong answer denies outright — a retry loop would undo the arithmetic. + +**Sessions live in memory.** They are 90-second capabilities to become a user; +one that outlives the process is a liability. Run a single replica with +`strategy: Recreate`. A restart drops in-flight sign-ins, which costs a retry. + +## Requirements, and they are not negotiable + +**1. It must be served on the same origin as authentik**, e.g. +`https://sso.example.com/qr-login`. Not a subdomain — the same origin. + +The panel is an iframe on authentik's login page, and when the phone approves it +navigates the *top-level* window. A cross-origin frame cannot do that without a +user gesture (Chrome's framebusting intervention; Chrome, Firefox and Safari all +differ on the specifics). A same-origin frame is explicitly exempt. The service +refuses to start if `QR_OIDC_ISSUER` is not on `QR_PUBLIC_ORIGIN`. + +**2. If your ingress merges Ingresses per host, the second one still needs its +own `tls:` block.** On Cilium's shared-mode ingress controller, an Ingress +sharing a host but omitting `tls` has its route silently dropped from the secure +listener, and the path falls through to authentik with no error anywhere. Since +cross-namespace TLS secret references are disallowed, the simplest answer is to +deploy into authentik's own namespace and reuse its certificate. + +## authentik configuration + +Four objects. A Pulumi example is in `deploy/`. + +1. **An OIDC provider + application** for the phone, with + `authentication_flow` pinned to your passkey flow, and redirect URI + `https:///qr-login/oidc/callback`. +2. **A completion flow** (`qr-login-complete`, designation `authentication`, + authentication `none`) containing a **user-login stage**. +3. **An expression policy** bound to that stage's binding — see below. +4. **A prompt stage** with one `static` field whose value is an iframe pointing + at `/qr-login/panel`, bound to your login flow. It has no inputs and no + policies, so if this service is down the browser renders an empty box and + authentik's own Continue button still works. + +### The two settings everyone gets wrong + +On the **login stage's flow-stage binding**: + +``` +evaluate_on_plan = false # NOT true +re_evaluate_policies = true +``` + +- With `evaluate_on_plan: true` the policy runs **twice**, and since the assert + *consumes* the session id, the second pass finds it spent and drops the stage. + A flow whose plan ends up empty redirects to `/` — so the phone approves, the + laptop navigates, and lands back on the login page. +- You cannot tell the two passes apart: `request.context["flow_plan"]` exists at + plan time too, contrary to what you might assume. +- And authentik **caches flow plans** (`cache.timeout_flows`, 300s by default) + under a key that is identical for every anonymous user — so a plan-time + evaluation is served from cache and the policy never runs at all. + `ReevaluateMarker` sets `engine.use_cache = False`, which makes the stage-time + run the only evaluation guaranteed to happen. + +In the policy itself, assigning to `request.context["pending_user"]` is +**silently discarded**. It must be: + +```python +request.context["flow_plan"].context["pending_user"] = user +``` + +## Configuration + +| Variable | Default | | +|---|---|---| +| `QR_PUBLIC_ORIGIN` | — | e.g. `https://sso.example.com` | +| `QR_BASE_PATH` | `/qr-login` | path prefix | +| `QR_OIDC_ISSUER` | — | must be on `QR_PUBLIC_ORIGIN` | +| `QR_OIDC_CLIENT_ID` / `QR_OIDC_CLIENT_SECRET` | — | the phone-side client | +| `QR_REQUIRED_GROUP` | — | group the ID token must list; empty is rejected, never "allow all" | +| `QR_ASSERT_SECRET` | — | proves an `/api/assert` caller is authentik's policy | +| `QR_COOKIE_SECRET` | — | signs the phone's short-lived cookie | +| `QR_SESSION_TTL_SECONDS` | `90` | | +| `QR_NUMBER_MODE` | `type` | or `choice` | +| `QR_REQUIRE_SAME_SUBNET` | `false` | hard-block instead of warn | +| `QR_MAX_SESSIONS` | `10000` | bound, so a flood is bounded memory | + +## Development + +```bash +npm install +npm run typecheck +npm test # 9 tests, no network +npm run build +``` + +The Dockerfile runs the typecheck and the tests, so a service that does not +compile or does not pass cannot produce an image. + +## Licence + +MIT. See `LICENSE`. diff --git a/package-lock.json b/package-lock.json new file mode 100644 index 0000000..abfc259 --- /dev/null +++ b/package-lock.json @@ -0,0 +1,1545 @@ +{ + "name": "authentik-qr-login", + "version": "1.0.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "authentik-qr-login", + "version": "1.0.0", + "dependencies": { + "cookie-session": "^2.1.0", + "express": "^5.1.0", + "openid-client": "^5.6.5", + "qrcode": "^1.5.4" + }, + "devDependencies": { + "@types/cookie-session": "^2.0.49", + "@types/express": "^5.0.6", + "@types/node": "^22.10.0", + "@types/qrcode": "^1.5.5", + "typescript": "^5.9.3" + }, + "engines": { + "node": "22.x" + } + }, + "node_modules/@types/body-parser": { + "version": "1.19.6", + "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz", + "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/connect": "*", + "@types/node": "*" + } + }, + "node_modules/@types/connect": { + "version": "3.4.38", + "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz", + "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/@types/cookie-session": { + "version": "2.0.49", + "resolved": "https://registry.npmjs.org/@types/cookie-session/-/cookie-session-2.0.49.tgz", + "integrity": "sha512-4E/bBjlqLhU5l4iGPR+NkVJH593hpNsT4dC3DJDr+ODm6Qpe13kZQVkezRIb+TYDXaBMemS3yLQ+0leba3jlkQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/express": "*", + "@types/keygrip": "*" + } + }, + "node_modules/@types/express": { + "version": "5.0.6", + "resolved": "https://registry.npmjs.org/@types/express/-/express-5.0.6.tgz", + "integrity": "sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/body-parser": "*", + "@types/express-serve-static-core": "^5.0.0", + "@types/serve-static": "^2" + } + }, + "node_modules/@types/express-serve-static-core": { + "version": "5.1.3", + "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.1.3.tgz", + "integrity": "sha512-dPfW8NFiOF4wOHc7+N/QSxlY9cfSsenewGbAz8C8U/MULPd/YZ27LvJUIlzaXie7e6Ove9YunJGgC9tbHD2cKw==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/node": "*", + "@types/qs": "*", + "@types/range-parser": "*", + "@types/send": "*" + } + }, + "node_modules/@types/http-errors": { + "version": "2.0.5", + "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.5.tgz", + "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==", + "dev": true, + "license": "MIT" + }, + "node_modules/@types/keygrip": { + "version": "1.0.6", + "resolved": "https://registry.npmjs.org/@types/keygrip/-/keygrip-1.0.6.tgz", + "integrity": "sha512-lZuNAY9xeJt7Bx4t4dx0rYCDqGPW8RXhQZK1td7d4H6E9zYbLoOtjBvfwdTKpsyxQI/2jv+armjX/RW+ZNpXOQ==", + "dev": true, + "license": "MIT" + }, + "node_modules/@types/node": { + "version": "22.20.1", + "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.1.tgz", + "integrity": "sha512-EANqOCF9QFyra+4pfxUcX9STKJpCLjMbObVzljIJomAWSnuSIEAvyzEU53GaajbXJEgdh0iEcPL+DGvpUd4k1Q==", + "dev": true, + "license": "MIT", + "dependencies": { + "undici-types": "~6.21.0" + } + }, + "node_modules/@types/qrcode": { + "version": "1.5.6", + "resolved": "https://registry.npmjs.org/@types/qrcode/-/qrcode-1.5.6.tgz", + "integrity": "sha512-te7NQcV2BOvdj2b1hCAHzAoMNuj65kNBMz0KBaxM6c3VGBOhU0dURQKOtH8CFNI/dsKkwlv32p26qYQTWoB5bw==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/@types/qs": { + "version": "6.15.1", + "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.15.1.tgz", + "integrity": "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==", + "dev": true, + "license": "MIT" + }, + "node_modules/@types/range-parser": { + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz", + "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==", + "dev": true, + "license": "MIT" + }, + "node_modules/@types/send": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/@types/send/-/send-1.2.1.tgz", + "integrity": "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/@types/serve-static": { + "version": "2.2.0", + "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-2.2.0.tgz", + "integrity": "sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/http-errors": "*", + "@types/node": "*" + } + }, + "node_modules/accepts": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz", + "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==", + "license": "MIT", + "dependencies": { + "mime-types": "^3.0.0", + "negotiator": "^1.0.0" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/ansi-regex": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz", + "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/ansi-styles": { + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz", + "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==", + "license": "MIT", + "dependencies": { + "color-convert": "^2.0.1" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/chalk/ansi-styles?sponsor=1" + } + }, + "node_modules/body-parser": { + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", + "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", + "license": "MIT", + "dependencies": { + "bytes": "^3.1.2", + "content-type": "^2.0.0", + "debug": "^4.4.3", + "http-errors": "^2.0.1", + "iconv-lite": "^0.7.2", + "on-finished": "^2.4.1", + "qs": "^6.15.2", + "raw-body": "^3.0.2", + "type-is": "^2.1.0" + }, + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/body-parser/node_modules/content-type": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz", + "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/body-parser/node_modules/debug": { + "version": "4.4.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", + "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", + "license": "MIT", + "dependencies": { + "ms": "^2.1.3" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/bytes": { + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", + "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/call-bind-apply-helpers": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz", + "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/call-bound": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz", + "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "get-intrinsic": "^1.3.0" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/camelcase": { + "version": "5.3.1", + "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz", + "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/cliui": { + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz", + "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==", + "license": "ISC", + "dependencies": { + "string-width": "^4.2.0", + "strip-ansi": "^6.0.0", + "wrap-ansi": "^6.2.0" + } + }, + "node_modules/color-convert": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", + "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==", + "license": "MIT", + "dependencies": { + "color-name": "~1.1.4" + }, + "engines": { + "node": ">=7.0.0" + } + }, + "node_modules/color-name": { + "version": "1.1.4", + "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz", + "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==", + "license": "MIT" + }, + "node_modules/content-disposition": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz", + "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/content-type": { + "version": "1.0.5", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz", + "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/cookie": { + "version": "0.7.2", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz", + "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/cookie-session": { + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/cookie-session/-/cookie-session-2.1.1.tgz", + "integrity": "sha512-ji3kym/XZaFVew1+tIZk5ZLp9Z/fLv9rK1aZmpug0FsgE7Cu3ZDrUdRo7FT9vFjMYfNimrrUHJzywDwT7XEFlg==", + "license": "MIT", + "dependencies": { + "cookies": "0.9.1", + "debug": "3.2.7", + "on-headers": "~1.1.0", + "safe-buffer": "5.2.1" + }, + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/cookie-signature": { + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz", + "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==", + "license": "MIT", + "engines": { + "node": ">=6.6.0" + } + }, + "node_modules/cookies": { + "version": "0.9.1", + "resolved": "https://registry.npmjs.org/cookies/-/cookies-0.9.1.tgz", + "integrity": "sha512-TG2hpqe4ELx54QER/S3HQ9SRVnQnGBtKUz5bLQWtYAQ+o6GpgMs6sYUvaiJjVxb+UXwhRhAEP3m7LbsIZ77Hmw==", + "license": "MIT", + "dependencies": { + "depd": "~2.0.0", + "keygrip": "~1.1.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/debug": { + "version": "3.2.7", + "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz", + "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==", + "license": "MIT", + "dependencies": { + "ms": "^2.1.1" + } + }, + "node_modules/decamelize": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz", + "integrity": "sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/depd": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", + "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/dijkstrajs": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/dijkstrajs/-/dijkstrajs-1.0.3.tgz", + "integrity": "sha512-qiSlmBq9+BCdCA/L46dw8Uy93mloxsPSbwnm5yrKn2vMPiy8KyAskTF6zuV/j5BMsmOGZDPs7KjU+mjb670kfA==", + "license": "MIT" + }, + "node_modules/dunder-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", + "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.1", + "es-errors": "^1.3.0", + "gopd": "^1.2.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/ee-first": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", + "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==", + "license": "MIT" + }, + "node_modules/emoji-regex": { + "version": "8.0.0", + "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz", + "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==", + "license": "MIT" + }, + "node_modules/encodeurl": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz", + "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/es-define-property": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz", + "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-errors": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", + "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-object-atoms": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz", + "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/escape-html": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz", + "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==", + "license": "MIT" + }, + "node_modules/etag": { + "version": "1.8.1", + "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz", + "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/express": { + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz", + "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==", + "license": "MIT", + "dependencies": { + "accepts": "^2.0.0", + "body-parser": "^2.2.1", + "content-disposition": "^1.0.0", + "content-type": "^1.0.5", + "cookie": "^0.7.1", + "cookie-signature": "^1.2.1", + "debug": "^4.4.0", + "depd": "^2.0.0", + "encodeurl": "^2.0.0", + "escape-html": "^1.0.3", + "etag": "^1.8.1", + "finalhandler": "^2.1.0", + "fresh": "^2.0.0", + "http-errors": "^2.0.0", + "merge-descriptors": "^2.0.0", + "mime-types": "^3.0.0", + "on-finished": "^2.4.1", + "once": "^1.4.0", + "parseurl": "^1.3.3", + "proxy-addr": "^2.0.7", + "qs": "^6.14.0", + "range-parser": "^1.2.1", + "router": "^2.2.0", + "send": "^1.1.0", + "serve-static": "^2.2.0", + "statuses": "^2.0.1", + "type-is": "^2.0.1", + "vary": "^1.1.2" + }, + "engines": { + "node": ">= 18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/express/node_modules/debug": { + "version": "4.4.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", + "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", + "license": "MIT", + "dependencies": { + "ms": "^2.1.3" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/finalhandler": { + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz", + "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==", + "license": "MIT", + "dependencies": { + "debug": "^4.4.0", + "encodeurl": "^2.0.0", + "escape-html": "^1.0.3", + "on-finished": "^2.4.1", + "parseurl": "^1.3.3", + "statuses": "^2.0.1" + }, + "engines": { + "node": ">= 18.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/finalhandler/node_modules/debug": { + "version": "4.4.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", + "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", + "license": "MIT", + "dependencies": { + "ms": "^2.1.3" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/find-up": { + "version": "4.1.0", + "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz", + "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==", + "license": "MIT", + "dependencies": { + "locate-path": "^5.0.0", + "path-exists": "^4.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/forwarded": { + "version": "0.2.0", + "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz", + "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/fresh": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz", + "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/function-bind": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", + "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-caller-file": { + "version": "2.0.5", + "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz", + "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==", + "license": "ISC", + "engines": { + "node": "6.* || 8.* || >= 10.*" + } + }, + "node_modules/get-intrinsic": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz", + "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "es-define-property": "^1.0.1", + "es-errors": "^1.3.0", + "es-object-atoms": "^1.1.1", + "function-bind": "^1.1.2", + "get-proto": "^1.0.1", + "gopd": "^1.2.0", + "has-symbols": "^1.1.0", + "hasown": "^2.0.2", + "math-intrinsics": "^1.1.0" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz", + "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==", + "license": "MIT", + "dependencies": { + "dunder-proto": "^1.0.1", + "es-object-atoms": "^1.0.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/gopd": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz", + "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-symbols": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz", + "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/hasown": { + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz", + "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==", + "license": "MIT", + "dependencies": { + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/http-errors": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", + "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==", + "license": "MIT", + "dependencies": { + "depd": "~2.0.0", + "inherits": "~2.0.4", + "setprototypeof": "~1.2.0", + "statuses": "~2.0.2", + "toidentifier": "~1.0.1" + }, + "engines": { + "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/iconv-lite": { + "version": "0.7.3", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz", + "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==", + "license": "MIT", + "dependencies": { + "safer-buffer": ">= 2.1.2 < 3.0.0" + }, + "engines": { + "node": ">=0.10.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/inherits": { + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==", + "license": "ISC" + }, + "node_modules/ipaddr.js": { + "version": "1.9.1", + "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz", + "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==", + "license": "MIT", + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/is-fullwidth-code-point": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz", + "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/is-promise": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz", + "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==", + "license": "MIT" + }, + "node_modules/jose": { + "version": "4.15.9", + "resolved": "https://registry.npmjs.org/jose/-/jose-4.15.9.tgz", + "integrity": "sha512-1vUQX+IdDMVPj4k8kOxgUqlcK518yluMuGZwqlr44FS1ppZB/5GWh4rZG89erpOBOJjU/OBsnCVFfapsRz6nEA==", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/panva" + } + }, + "node_modules/keygrip": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/keygrip/-/keygrip-1.1.0.tgz", + "integrity": "sha512-iYSchDJ+liQ8iwbSI2QqsQOvqv58eJCEanyJPJi+Khyu8smkcKSFUCbPwzFcL7YVtZ6eONjqRX/38caJ7QjRAQ==", + "license": "MIT", + "dependencies": { + "tsscmp": "1.0.6" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/locate-path": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz", + "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==", + "license": "MIT", + "dependencies": { + "p-locate": "^4.1.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/lru-cache": { + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", + "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", + "license": "ISC", + "dependencies": { + "yallist": "^4.0.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/math-intrinsics": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", + "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/media-typer": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz", + "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/merge-descriptors": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz", + "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/mime-db": { + "version": "1.54.0", + "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz", + "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mime-types": { + "version": "3.0.2", + "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz", + "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==", + "license": "MIT", + "dependencies": { + "mime-db": "^1.54.0" + }, + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/ms": { + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", + "license": "MIT" + }, + "node_modules/negotiator": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz", + "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/object-hash": { + "version": "2.2.0", + "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-2.2.0.tgz", + "integrity": "sha512-gScRMn0bS5fH+IuwyIFgnh9zBdo4DV+6GhygmWM9HyNJSgS0hScp1f5vjtm7oIIOiT9trXrShAkLFSc2IqKNgw==", + "license": "MIT", + "engines": { + "node": ">= 6" + } + }, + "node_modules/object-inspect": { + "version": "1.13.4", + "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz", + "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/oidc-token-hash": { + "version": "5.2.0", + "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.2.0.tgz", + "integrity": "sha512-6gj2m8cJZ+iSW8bm0FXdGF0YhIQbKrfP4yWTNzxc31U6MOjfEmB1rHvlYvxI1B7t7BCi1F2vYTT6YhtQRG4hxw==", + "license": "MIT", + "engines": { + "node": "^10.13.0 || >=12.0.0" + } + }, + "node_modules/on-finished": { + "version": "2.4.1", + "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz", + "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==", + "license": "MIT", + "dependencies": { + "ee-first": "1.1.1" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/on-headers": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz", + "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/once": { + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz", + "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==", + "license": "ISC", + "dependencies": { + "wrappy": "1" + } + }, + "node_modules/openid-client": { + "version": "5.7.1", + "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-5.7.1.tgz", + "integrity": "sha512-jDBPgSVfTnkIh71Hg9pRvtJc6wTwqjRkN88+gCFtYWrlP4Yx2Dsrow8uPi3qLr/aeymPF3o2+dS+wOpglK04ew==", + "license": "MIT", + "dependencies": { + "jose": "^4.15.9", + "lru-cache": "^6.0.0", + "object-hash": "^2.2.0", + "oidc-token-hash": "^5.0.3" + }, + "funding": { + "url": "https://github.com/sponsors/panva" + } + }, + "node_modules/p-limit": { + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz", + "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==", + "license": "MIT", + "dependencies": { + "p-try": "^2.0.0" + }, + "engines": { + "node": ">=6" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/p-locate": { + "version": "4.1.0", + "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz", + "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==", + "license": "MIT", + "dependencies": { + "p-limit": "^2.2.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/p-try": { + "version": "2.2.0", + "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz", + "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/parseurl": { + "version": "1.3.3", + "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz", + "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/path-exists": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz", + "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/path-to-regexp": { + "version": "8.4.2", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz", + "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==", + "license": "MIT", + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/pngjs": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-5.0.0.tgz", + "integrity": "sha512-40QW5YalBNfQo5yRYmiw7Yz6TKKVr3h6970B2YE+3fQpsWcrbj1PzJgxeJ19DRQjhMbKPIuMY8rFaXc8moolVw==", + "license": "MIT", + "engines": { + "node": ">=10.13.0" + } + }, + "node_modules/proxy-addr": { + "version": "2.0.7", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", + "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "license": "MIT", + "dependencies": { + "forwarded": "0.2.0", + "ipaddr.js": "1.9.1" + }, + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/qrcode": { + "version": "1.5.4", + "resolved": "https://registry.npmjs.org/qrcode/-/qrcode-1.5.4.tgz", + "integrity": "sha512-1ca71Zgiu6ORjHqFBDpnSMTR2ReToX4l1Au1VFLyVeBTFavzQnv5JxMFr3ukHVKpSrSA2MCk0lNJSykjUfz7Zg==", + "license": "MIT", + "dependencies": { + "dijkstrajs": "^1.0.1", + "pngjs": "^5.0.0", + "yargs": "^15.3.1" + }, + "bin": { + "qrcode": "bin/qrcode" + }, + "engines": { + "node": ">=10.13.0" + } + }, + "node_modules/qs": { + "version": "6.15.3", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", + "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", + "license": "BSD-3-Clause", + "dependencies": { + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" + }, + "engines": { + "node": ">=0.6" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/range-parser": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz", + "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/raw-body": { + "version": "3.0.2", + "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz", + "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==", + "license": "MIT", + "dependencies": { + "bytes": "~3.1.2", + "http-errors": "~2.0.1", + "iconv-lite": "~0.7.0", + "unpipe": "~1.0.0" + }, + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/require-directory": { + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz", + "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/require-main-filename": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz", + "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==", + "license": "ISC" + }, + "node_modules/router": { + "version": "2.2.0", + "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz", + "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==", + "license": "MIT", + "dependencies": { + "debug": "^4.4.0", + "depd": "^2.0.0", + "is-promise": "^4.0.0", + "parseurl": "^1.3.3", + "path-to-regexp": "^8.0.0" + }, + "engines": { + "node": ">= 18" + } + }, + "node_modules/router/node_modules/debug": { + "version": "4.4.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", + "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", + "license": "MIT", + "dependencies": { + "ms": "^2.1.3" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/safe-buffer": { + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", + "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ], + "license": "MIT" + }, + "node_modules/safer-buffer": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", + "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", + "license": "MIT" + }, + "node_modules/send": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz", + "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==", + "license": "MIT", + "dependencies": { + "debug": "^4.4.3", + "encodeurl": "^2.0.0", + "escape-html": "^1.0.3", + "etag": "^1.8.1", + "fresh": "^2.0.0", + "http-errors": "^2.0.1", + "mime-types": "^3.0.2", + "ms": "^2.1.3", + "on-finished": "^2.4.1", + "range-parser": "^1.2.1", + "statuses": "^2.0.2" + }, + "engines": { + "node": ">= 18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/send/node_modules/debug": { + "version": "4.4.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", + "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", + "license": "MIT", + "dependencies": { + "ms": "^2.1.3" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/serve-static": { + "version": "2.2.1", + "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz", + "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==", + "license": "MIT", + "dependencies": { + "encodeurl": "^2.0.0", + "escape-html": "^1.0.3", + "parseurl": "^1.3.3", + "send": "^1.2.0" + }, + "engines": { + "node": ">= 18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/set-blocking": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz", + "integrity": "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==", + "license": "ISC" + }, + "node_modules/setprototypeof": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz", + "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==", + "license": "ISC" + }, + "node_modules/side-channel": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", + "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "object-inspect": "^1.13.4", + "side-channel-list": "^1.0.1", + "side-channel-map": "^1.0.1", + "side-channel-weakmap": "^1.0.2" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-list": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz", + "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "object-inspect": "^1.13.4" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-map": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz", + "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==", + "license": "MIT", + "dependencies": { + "call-bound": "^1.0.2", + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.5", + "object-inspect": "^1.13.3" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-weakmap": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz", + "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==", + "license": "MIT", + "dependencies": { + "call-bound": "^1.0.2", + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.5", + "object-inspect": "^1.13.3", + "side-channel-map": "^1.0.1" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/statuses": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz", + "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/string-width": { + "version": "4.2.3", + "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", + "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", + "license": "MIT", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/strip-ansi": { + "version": "6.0.1", + "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz", + "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==", + "license": "MIT", + "dependencies": { + "ansi-regex": "^5.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/toidentifier": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz", + "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==", + "license": "MIT", + "engines": { + "node": ">=0.6" + } + }, + "node_modules/tsscmp": { + "version": "1.0.6", + "resolved": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.6.tgz", + "integrity": "sha512-LxhtAkPDTkVCMQjt2h6eBVY28KCjikZqZfMcC15YBeNjkgUpdCfBu5HoiOTDu86v6smE8yOjyEktJ8hlbANHQA==", + "license": "MIT", + "engines": { + "node": ">=0.6.x" + } + }, + "node_modules/type-is": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz", + "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==", + "license": "MIT", + "dependencies": { + "content-type": "^2.0.0", + "media-typer": "^1.1.0", + "mime-types": "^3.0.0" + }, + "engines": { + "node": ">= 18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/type-is/node_modules/content-type": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz", + "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/typescript": { + "version": "5.9.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", + "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", + "dev": true, + "license": "Apache-2.0", + "bin": { + "tsc": "bin/tsc", + "tsserver": "bin/tsserver" + }, + "engines": { + "node": ">=14.17" + } + }, + "node_modules/undici-types": { + "version": "6.21.0", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz", + "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==", + "dev": true, + "license": "MIT" + }, + "node_modules/unpipe": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz", + "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/vary": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz", + "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/which-module": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/which-module/-/which-module-2.0.1.tgz", + "integrity": "sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==", + "license": "ISC" + }, + "node_modules/wrap-ansi": { + "version": "6.2.0", + "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz", + "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==", + "license": "MIT", + "dependencies": { + "ansi-styles": "^4.0.0", + "string-width": "^4.1.0", + "strip-ansi": "^6.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/wrappy": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz", + "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==", + "license": "ISC" + }, + "node_modules/y18n": { + "version": "4.0.3", + "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz", + "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==", + "license": "ISC" + }, + "node_modules/yallist": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==", + "license": "ISC" + }, + "node_modules/yargs": { + "version": "15.4.1", + "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.1.tgz", + "integrity": "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==", + "license": "MIT", + "dependencies": { + "cliui": "^6.0.0", + "decamelize": "^1.2.0", + "find-up": "^4.1.0", + "get-caller-file": "^2.0.1", + "require-directory": "^2.1.1", + "require-main-filename": "^2.0.0", + "set-blocking": "^2.0.0", + "string-width": "^4.2.0", + "which-module": "^2.0.0", + "y18n": "^4.0.0", + "yargs-parser": "^18.1.2" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/yargs-parser": { + "version": "18.1.3", + "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-18.1.3.tgz", + "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==", + "license": "ISC", + "dependencies": { + "camelcase": "^5.0.0", + "decamelize": "^1.2.0" + }, + "engines": { + "node": ">=6" + } + } + } +} diff --git a/package.json b/package.json new file mode 100644 index 0000000..1cba7c0 --- /dev/null +++ b/package.json @@ -0,0 +1,29 @@ +{ + "name": "authentik-qr-login", + "version": "1.0.0", + "private": true, + "description": "Cross-device QR sign-in for authentik: scan on your phone, approve with a passkey, and the laptop signs itself in. Holds no authentik credential.", + "main": "dist/index.js", + "scripts": { + "build": "tsc", + "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json", + "test": "node --test --experimental-strip-types test/*.test.ts", + "start": "node dist/index.js" + }, + "engines": { + "node": "22.x" + }, + "dependencies": { + "cookie-session": "^2.1.0", + "express": "^5.1.0", + "openid-client": "^5.6.5", + "qrcode": "^1.5.4" + }, + "devDependencies": { + "@types/cookie-session": "^2.0.49", + "@types/express": "^5.0.6", + "@types/node": "^22.10.0", + "@types/qrcode": "^1.5.5", + "typescript": "^5.9.3" + } +} diff --git a/src/approve.ts b/src/approve.ts new file mode 100644 index 0000000..43fe811 --- /dev/null +++ b/src/approve.ts @@ -0,0 +1,151 @@ +import type { NumberMode } from "./numbers.ts"; + +const escapeHtml = (s: string): string => + s.replace(/[&<>"']/g, (c) => + ({ "&": "&", "<": "<", ">": ">", '"': """, "'": "'" })[c] as string, + ); + +export interface ApprovePageData { + basePath: string; + /** The IdP host the user is signing in to, e.g. "sso.ad.itaz.eu". */ + host: string; + approvalToken: string; + username: string; + laptopIp: string; + laptopUa: string; + requestedSecondsAgo: number; + expiresInSeconds: number; + numberMode: NumberMode; + choices: number[]; + differentNetwork: boolean; +} + +/** + * The phone page, shown only after a passkey login against authentik. + * + * The device detail sits ABOVE the number entry on purpose. The one attack this + * design cannot prevent is a phished QR: the victim scans an attacker's code + * and authenticates for real against the real IdP, so passkey origin binding + * does not help. All that stands between that and a stolen session is the user + * noticing that the device asking to be signed in is not theirs. Putting the + * address under the keypad, where it is read after the decision, would waste + * the only defence there is. + */ +export function approveHtml(d: ApprovePageData): string { + const keypad = + d.numberMode === "choice" + ? `
${d.choices + .map((n) => ``) + .join("")}
` + : ` + `; + + return ` + + +Approve sign-in + +

Approve sign-in

+
to ${escapeHtml(d.host)} — as ${escapeHtml(d.username)}
+ +
+
From
${escapeHtml(d.laptopIp)}
+
Browser
${escapeHtml(d.laptopUa)}
+
Requested
${d.requestedSecondsAgo}s ago · expires in ${d.expiresInSeconds}s
+
+ + ${d.differentNetwork ? '
This request is from a different network than your phone. If you did not start it, deny.
' : ""} + + + ${keypad} + +
+ +`; +} diff --git a/src/config.ts b/src/config.ts new file mode 100644 index 0000000..be1a186 --- /dev/null +++ b/src/config.ts @@ -0,0 +1,116 @@ +import type { NumberMode } from "./numbers.ts"; + +/** + * Configuration. + * + * The service holds NO authentik API credential. That is the whole point of the + * architecture: authentik asks us who approved a session, we answer, and it + * issues the session itself. There is therefore no standing credential here + * that could mint a login for an arbitrary user — the earlier design, which + * used authentik's recovery-link API, required a superuser token to do exactly + * that. `assertSecret` below is a shared secret proving a caller IS authentik, + * not a credential granting us any power over it. + */ +export interface Config { + port: number; + /** Public origin. MUST be authentik's own origin — see basePath. */ + publicOrigin: string; + /** + * Path prefix this service is mounted under, e.g. "/qr-login". + * + * Same-origin with authentik is load-bearing, not cosmetic. A cross-origin + * iframe cannot navigate the top-level window without a user gesture (and + * Chrome, Firefox and Safari disagree about the details); a same-origin one + * is explicitly exempt. Mounting under authentik's own host is what makes + * "the laptop logs itself in" possible with no click. + */ + basePath: string; + oidc: { + issuer: string; + clientId: string; + clientSecret: string; + /** Group the ID token must list. Empty is REJECTED, never "allow all". */ + requiredGroup: string; + }; + /** + * Proves an /api/assert caller is authentik's expression policy. + * + * Without it, anyone who learned a session id could ask us to name its user. + * That alone would not log them in — they would still have to be inside the + * flow — but there is no reason to answer the question for strangers. + */ + assertSecret: string; + cookieSecret: string; + sessionTtlSeconds: number; + numberMode: NumberMode; + /** + * Warn (never block) when the phone and laptop are on different /24s. + * + * Not a hard block by default: the phone is frequently on cellular while the + * laptop is on wifi, and a control that fires on the honest path constantly + * gets switched off. Deployments where the IdP is internal-only may set it. + */ + requireSameSubnet: boolean; + maxSessions: number; +} + +function required(name: string): string { + const value = process.env[name]; + if (!value) throw new Error(`missing required environment variable ${name}`); + return value; +} + +function optionalInt(name: string, fallback: number): number { + const raw = process.env[name]; + if (!raw) return fallback; + const parsed = Number.parseInt(raw, 10); + if (!Number.isFinite(parsed) || parsed <= 0) { + throw new Error(`${name} must be a positive integer, got ${raw}`); + } + return parsed; +} + +export function loadConfig(): Config { + const numberModeRaw = process.env.QR_NUMBER_MODE ?? "type"; + if (numberModeRaw !== "type" && numberModeRaw !== "choice") { + throw new Error(`QR_NUMBER_MODE must be "type" or "choice", got ${numberModeRaw}`); + } + + const requiredGroup = required("QR_REQUIRED_GROUP"); + + const basePath = (process.env.QR_BASE_PATH ?? "/qr-login").replace(/\/$/, ""); + if (!basePath.startsWith("/")) { + throw new Error(`QR_BASE_PATH must start with "/", got ${basePath}`); + } + + const publicOrigin = required("QR_PUBLIC_ORIGIN").replace(/\/$/, ""); + const issuer = required("QR_OIDC_ISSUER"); + + // Same-origin is a correctness requirement, so assert it at boot rather than + // discovering it as a browser silently refusing to navigate. + if (!issuer.startsWith(publicOrigin)) { + throw new Error( + `QR_OIDC_ISSUER (${issuer}) must be on the same origin as QR_PUBLIC_ORIGIN ` + + `(${publicOrigin}) — the panel iframe can only navigate the login page ` + + `when it is same-origin with it`, + ); + } + + return { + port: optionalInt("PORT", 8080), + publicOrigin, + basePath, + oidc: { + issuer, + clientId: required("QR_OIDC_CLIENT_ID"), + clientSecret: required("QR_OIDC_CLIENT_SECRET"), + requiredGroup, + }, + assertSecret: required("QR_ASSERT_SECRET"), + cookieSecret: required("QR_COOKIE_SECRET"), + sessionTtlSeconds: optionalInt("QR_SESSION_TTL_SECONDS", 90), + numberMode: numberModeRaw as NumberMode, + requireSameSubnet: process.env.QR_REQUIRE_SAME_SUBNET === "true", + maxSessions: optionalInt("QR_MAX_SESSIONS", 10_000), + }; +} diff --git a/src/index.ts b/src/index.ts new file mode 100644 index 0000000..f5ce0fd --- /dev/null +++ b/src/index.ts @@ -0,0 +1,284 @@ +import express, { type Request, type Response } from "express"; +import cookieSession from "cookie-session"; +import QRCode from "qrcode"; + +import { approveHtml } from "./approve.ts"; +import { loadConfig, type Config } from "./config.ts"; +import { beginAuth, completeAuth, isAuthorised } from "./oidc.ts"; +import { panelHtml } from "./panel.ts"; +import { SessionStore, secretEquals } from "./sessions.ts"; + +const config = loadConfig(); +const store = new SessionStore({ + ttlSeconds: config.sessionTtlSeconds, + numberMode: config.numberMode, + maxSessions: config.maxSessions, +}); + +const app = express(); +// Cilium's Envoy sets X-Forwarded-For with the real client address; without +// this express reports the ingress pod's IP and every binding check is a lie. +app.set("trust proxy", true); +app.disable("x-powered-by"); + +const router = express.Router(); +router.use(express.json({ limit: "8kb" })); + +/** + * Our own cookie, scoped to our own path. + * + * `path` matters: we are same-origin with authentik, so a cookie without it + * would be sent to the IdP on every request. It carries only the OIDC state + * and the approval token for the phone leg. + */ +router.use( + cookieSession({ + name: "qrlogin_phone", + keys: [config.cookieSecret], + path: config.basePath, + httpOnly: true, + secure: true, + sameSite: "lax", + maxAge: 10 * 60 * 1000, + }), +); + +const clientIp = (req: Request): string => req.ip ?? "unknown"; +const shortUa = (req: Request): string => (req.get("user-agent") ?? "unknown").slice(0, 180); + +/** + * Express 5 types a route param as `string | string[]` — a repeated `:id` in + * the path yields an array. Neither of ours repeats, so collapse to the first + * value rather than sprinkling casts at the call sites. + */ +const param = (req: Request, name: string): string => { + const value = (req.params as Record)[name]; + return Array.isArray(value) ? (value[0] ?? "") : (value ?? ""); +}; + +/** Same /24. Deliberately crude: a hint for the human, never an authorisation. */ +function sameSubnet(a: string, b: string): boolean { + const norm = (s: string) => s.replace(/^::ffff:/, ""); + const left = norm(a).split("."); + const right = norm(b).split("."); + if (left.length !== 4 || right.length !== 4) return false; + return left[0] === right[0] && left[1] === right[1] && left[2] === right[2]; +} + +// ── Laptop ──────────────────────────────────────────────────────────────────── + +router.get("/panel", (req: Request, res: Response) => { + // Where to send the top window once approved. Supplied by the flow's static + // HTML so the completion flow's slug is declared in exactly one place — + // Pulumi — rather than duplicated here where it could drift. + const raw = typeof req.query.complete === "string" ? req.query.complete : ""; + // Only a same-origin absolute path is acceptable: this value ends up in + // top.location, so accepting "https://evil/" or "//evil" would turn the login + // page into an open redirect driven by a query parameter. + const completePath = /^\/[^/\\]/.test(raw) ? raw : "/if/flow/qr-login-complete/"; + + // Our own CSP. authentik sends none, and being same-origin means an XSS here + // would be an XSS on the IdP origin — so this page locks itself down. + res.set( + "content-security-policy", + "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; " + + "script-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'self'", + ); + res.type("html").send(panelHtml(config.basePath, completePath)); +}); + +router.post("/api/session", async (req: Request, res: Response) => { + try { + const session = store.create(Date.now(), clientIp(req), shortUa(req)); + const approveUrl = `${config.publicOrigin}${config.basePath}/a/${session.approvalToken}`; + + // Rendered server-side so the approval token never travels in a URL we + // fetch — it exists only in the QR pixels and, later, the phone's address bar. + const qrSvg = await QRCode.toString(approveUrl, { + type: "svg", + margin: 0, + errorCorrectionLevel: "M", + }); + + res.json({ + id: session.id, + number: session.number, + numberMode: config.numberMode, + expiresAt: session.expiresAt, + qrSvg, + }); + } catch (error) { + res.status(503).json({ error: (error as Error).message }); + } +}); + +/** + * Long-poll. Returns as soon as the state changes, so it is no slower than SSE + * while being one code path with no reconnect logic and no exposure to proxy + * buffering. Capped well under any sane idle timeout; the panel re-polls. + */ +router.get("/api/session/:id/wait", async (req: Request, res: Response) => { + const deadline = Date.now() + 25_000; + for (;;) { + const session = store.get(param(req, "id"), Date.now()); + if (!session) return res.json({ status: "expired" }); + if (session.status !== "pending" && session.status !== "scanned") { + return res.json({ status: session.status }); + } + if (Date.now() >= deadline) return res.json({ status: session.status }); + await new Promise((r) => setTimeout(r, 400)); + } +}); + +// ── Phone ───────────────────────────────────────────────────────────────────── + +router.get("/a/:token", async (req: Request, res: Response) => { + const session = store.byToken(param(req, "token"), Date.now()); + if (!session) return res.status(410).type("html").send(page("This code has expired.")); + + store.markScanned(session); + try { + const auth = await beginAuth(config); + req.session = { state: auth.state, codeVerifier: auth.codeVerifier, token: param(req, "token") }; + res.redirect(auth.url); + } catch (error) { + res.status(502).type("html").send(page(`Cannot reach the identity provider: ${(error as Error).message}`)); + } +}); + +router.get("/oidc/callback", async (req: Request, res: Response) => { + const held = req.session as { state?: string; codeVerifier?: string; token?: string } | undefined; + if (!held?.state || !held.codeVerifier || !held.token) { + return res.status(400).type("html").send(page("Sign-in did not start here. Scan the code again.")); + } + + try { + const identity = await completeAuth(config, req, { + state: held.state, + codeVerifier: held.codeVerifier, + }); + if (!isAuthorised(config, identity)) { + return res.status(403).type("html").send(page("Your account is not permitted to use phone sign-in.")); + } + + const session = store.byToken(held.token, Date.now()); + if (!session) return res.status(410).type("html").send(page("This code has expired.")); + + req.session = { ...held, username: identity.username }; + res.redirect(`${config.basePath}/approve`); + } catch (error) { + res.status(400).type("html").send(page(`Sign-in failed: ${(error as Error).message}`)); + } +}); + +router.get("/approve", (req: Request, res: Response) => { + const held = req.session as { token?: string; username?: string } | undefined; + if (!held?.token || !held.username) return res.redirect(config.basePath + "/panel"); + + const now = Date.now(); + const session = store.byToken(held.token, now); + if (!session) return res.status(410).type("html").send(page("This code has expired.")); + + const phoneIp = clientIp(req); + res.type("html").send( + approveHtml({ + basePath: config.basePath, + host: new URL(config.publicOrigin).host, + approvalToken: session.approvalToken, + username: held.username, + laptopIp: session.laptopIp, + laptopUa: session.laptopUa, + requestedSecondsAgo: Math.round((now - session.createdAt) / 1000), + expiresInSeconds: Math.max(0, Math.round((session.expiresAt - now) / 1000)), + numberMode: config.numberMode, + choices: session.decoys, + differentNetwork: !sameSubnet(session.laptopIp, phoneIp), + }), + ); +}); + +router.post("/api/approve", (req: Request, res: Response) => { + const held = req.session as { username?: string } | undefined; + if (!held?.username) return res.status(401).json({ error: "not signed in" }); + + const body = req.body as { approvalToken?: string; number?: number | null }; + if (typeof body?.approvalToken !== "string") { + return res.status(400).json({ error: "approvalToken required" }); + } + + const now = Date.now(); + const session = store.byToken(body.approvalToken, now); + if (!session) return res.json({ status: "expired" }); + + const phoneIp = clientIp(req); + if (config.requireSameSubnet && !sameSubnet(session.laptopIp, phoneIp)) { + return res.json({ status: "denied" }); + } + + const answer = typeof body.number === "number" ? body.number : null; + res.json({ status: store.decide(session, held.username, phoneIp, answer) }); +}); + +// ── authentik ───────────────────────────────────────────────────────────────── + +/** + * Called by authentik's expression policy — never by a browser. + * + * This is the inversion that makes the whole design safe. Earlier revisions had + * this service hold an authentik API token and mint a login link; that endpoint + * requires a superuser, so a leak would have meant a session for any account. + * Now authentik asks US, and the most we can ever say is "the holder of this + * session id approved as ". We are told, we do not tell. + * + * `peek` is the plan-time call, which decides whether the login stage applies + * at all; the consuming call happens once, at stage time, when authentik is + * ready to act on the answer. + */ +router.post("/api/assert", (req: Request, res: Response) => { + const presented = req.get("x-qr-assert-secret") ?? ""; + if (!secretEquals(presented, config.assertSecret)) { + return res.status(403).json({ error: "forbidden" }); + } + + const body = req.body as { sessionId?: string; peek?: boolean }; + if (typeof body?.sessionId !== "string") { + return res.status(400).json({ error: "sessionId required" }); + } + + const now = Date.now(); + if (body.peek) { + const session = store.get(body.sessionId, now); + const ok = session?.status === "approved" && Boolean(session.username); + return res.json({ ok, username: ok ? session?.username : undefined }); + } + + const username = store.consume(body.sessionId, now); + return res.json({ ok: Boolean(username), username }); +}); + +router.get("/healthz", (_req: Request, res: Response) => { + res.json({ ok: true, sessions: store.size, numberMode: config.numberMode }); +}); + +function page(message: string): string { + return ` +Phone sign-in + +

${message.replace(/[&<>]/g, (c) => ({ "&": "&", "<": "<", ">": ">" })[c] as string)}

`; +} + +app.use(config.basePath, router); + +app.listen(config.port, () => { + // eslint-disable-next-line no-console + console.log( + JSON.stringify({ + event: "listening", + port: config.port, + basePath: config.basePath, + numberMode: config.numberMode, + ttlSeconds: config.sessionTtlSeconds, + }), + ); +}); diff --git a/src/numbers.ts b/src/numbers.ts new file mode 100644 index 0000000..7201487 --- /dev/null +++ b/src/numbers.ts @@ -0,0 +1,44 @@ +import { randomInt } from "node:crypto"; + +/** + * The number-matching challenge. + * + * The laptop shows ONE number; the phone asks for it. This defeats blind + * approval — an attacker who can trigger a prompt but cannot see the victim's + * screen has to guess. + * + * How much it buys is arithmetic, and worth stating because "number matching" + * sounds stronger than the weak variant is: + * + * mode "type" two digits, entered on a keypad log2(90) = 6.5 bits + * mode "choice" one of three buttons log2(3) = 1.6 bits + * + * With a single attempt and a cap of 3 sessions per source, "choice" leaves an + * attacker at 1 - (2/3)^3 = 70%, which is not a control. "type" leaves them at + * 1 - (89/90)^3 = 3.3%. Hence `type` is the default; `choice` exists because it + * is the friendlier UX and some deployments will want it with eyes open. + */ +export type NumberMode = "type" | "choice"; + +/** Two digits. Never 0-9: a leading zero reads ambiguously across fonts. */ +export function pickNumber(): number { + return randomInt(10, 100); +} + +/** + * Two decoys for `choice` mode, distinct from each other and from the answer. + * Returned already shuffled, so the correct one is not positionally biased. + */ +export function pickDecoys(answer: number): number[] { + const chosen = new Set([answer]); + while (chosen.size < 3) chosen.add(pickNumber()); + + const all = [...chosen]; + // Fisher-Yates with a CSPRNG. Math.random would be fine for display order, + // but using it here invites someone to reuse it where it is not. + for (let i = all.length - 1; i > 0; i--) { + const j = randomInt(0, i + 1); + [all[i], all[j]] = [all[j], all[i]]; + } + return all; +} diff --git a/src/oidc.ts b/src/oidc.ts new file mode 100644 index 0000000..24e4af8 --- /dev/null +++ b/src/oidc.ts @@ -0,0 +1,112 @@ +import type { IncomingMessage } from "node:http"; + +import { Issuer, generators, type Client } from "openid-client"; + +import type { Config } from "./config.ts"; + +let issuerPromise: Promise> | undefined; + +/** Discovery, memoised — but NOT on failure, or one early miss poisons the pod. */ +export async function getIssuer(config: Config): Promise> { + if (!issuerPromise) { + issuerPromise = Issuer.discover(config.oidc.issuer).catch((error: unknown) => { + issuerPromise = undefined; + throw error; + }); + } + return issuerPromise; +} + +export function redirectUri(config: Config): string { + return `${config.publicOrigin}${config.basePath}/oidc/callback`; +} + +async function clientFor(config: Config): Promise { + const issuer = await getIssuer(config); + return new issuer.Client({ + client_id: config.oidc.clientId, + client_secret: config.oidc.clientSecret, + redirect_uris: [redirectUri(config)], + response_types: ["code"], + }); +} + +export interface AuthRequest { + url: string; + state: string; + codeVerifier: string; +} + +export async function beginAuth(config: Config): Promise { + const client = await clientFor(config); + const state = generators.state(); + const codeVerifier = generators.codeVerifier(); + + return { + url: client.authorizationUrl({ + scope: "openid email profile", + state, + code_challenge: generators.codeChallenge(codeVerifier), + code_challenge_method: "S256", + /** + * FORCE RE-AUTHENTICATION. This is the load-bearing pair, and omitting it + * silently guts the design: if the phone already holds an authentik + * session, the authorize request would merely *authorize* and the passkey + * + biometric step — the only real authentication in the whole chain — + * would never happen. Approving a sign-in must always cost a fingerprint. + */ + prompt: "login", + max_age: 0, + }), + state, + codeVerifier, + }; +} + +export interface Identity { + username: string; + groups: string[]; +} + +export async function completeAuth( + config: Config, + request: IncomingMessage, + expected: { state: string; codeVerifier: string }, +): Promise { + const client = await clientFor(config); + const uri = redirectUri(config); + const tokenSet = await client.callback(uri, client.callbackParams(request), { + state: expected.state, + code_verifier: expected.codeVerifier, + }); + + const claims = tokenSet.claims(); + const groups = Array.isArray(claims.groups) + ? claims.groups.filter((g): g is string => typeof g === "string") + : undefined; + + // Fail closed, and say which failure it is. An absent claim means the + // provider is missing its scope mapping; treating that as "no groups" would + // lock everyone out silently, and as "allow" would let everyone in silently. + if (groups === undefined) { + throw new Error( + "ID token carries no `groups` claim — the authentik provider is missing " + + "the profile scope mapping, so membership cannot be checked", + ); + } + + const username = + typeof claims.preferred_username === "string" ? claims.preferred_username : undefined; + if (!username) { + throw new Error( + "ID token carries no `preferred_username` claim — it is what authentik's " + + "policy resolves back to a user, so approval cannot be attributed", + ); + } + + return { username, groups }; +} + +export function isAuthorised(config: Config, identity: Identity): boolean { + return identity.groups.includes(config.oidc.requiredGroup); +} diff --git a/src/panel.ts b/src/panel.ts new file mode 100644 index 0000000..c71317c --- /dev/null +++ b/src/panel.ts @@ -0,0 +1,125 @@ +/** + * The panel: the document that renders inside authentik's login page. + * + * It is an iframe rather than script injected into authentik's own DOM. A + * `static` prompt field renders through lit's `unsafeHTML`, so markup we supply + * lands unescaped on the login page — but ``; +} diff --git a/src/sessions.ts b/src/sessions.ts new file mode 100644 index 0000000..2b8da56 --- /dev/null +++ b/src/sessions.ts @@ -0,0 +1,191 @@ +import { randomBytes, timingSafeEqual } from "node:crypto"; + +import { pickDecoys, pickNumber, type NumberMode } from "./numbers.ts"; + +/** + * The sign-in session store. + * + * IN MEMORY, DELIBERATELY — and this is the one place the house "always + * Postgres" rule is knowingly not followed. The rule exists to stop durable + * state living somewhere it can be lost. Here there is no durable state to + * lose: a record is a 90-second capability to become a user, and a capability + * that survives the process is a liability rather than an asset. Putting a + * database, its operator and WAL archiving *in front of the login page* also + * points the dependency arrow the wrong way — the thing that gates every other + * app should depend on as little as possible. + * + * The cost is honest: one replica, `strategy: Recreate`, and a deploy drops + * in-flight sessions. That failure is fail-open (the login page's Continue + * button is authentik's own DOM and keeps working), and it costs a retry. + */ + +export type Status = "pending" | "scanned" | "approved" | "denied" | "expired" | "consumed"; + +export interface Session { + /** Poll key. Lives in the laptop's DOM and in the flow's hidden field. */ + id: string; + /** + * A SECOND, independent secret, carried only in the QR pixels. + * + * Two secrets rather than one because they have different exposure: `id` is + * visible to anyone who can see the laptop's screen or DOM, while + * `approvalToken` only ever reaches the phone. Someone who observes one + * cannot act with the other. + */ + approvalToken: string; + number: number; + /** Only populated in `choice` mode. */ + decoys: number[]; + status: Status; + createdAt: number; + expiresAt: number; + laptopIp: string; + laptopUa: string; + phoneIp?: string; + /** authentik username, set once the phone has authenticated AND approved. */ + username?: string; + /** One wrong number denies outright; a retry loop would undo the arithmetic. */ + attempted: boolean; +} + +export interface StoreOptions { + ttlSeconds: number; + numberMode: NumberMode; + /** Bound on live sessions, so a creation flood is bounded memory not an OOM. */ + maxSessions: number; +} + +function token(): string { + return randomBytes(16).toString("base64url"); +} + +/** Constant-time compare for the secrets that arrive from the network. */ +export function secretEquals(a: string, b: string): boolean { + const left = Buffer.from(a); + const right = Buffer.from(b); + if (left.length !== right.length) return false; + return timingSafeEqual(left, right); +} + +export class SessionStore { + private readonly sessions = new Map(); + private readonly byApprovalToken = new Map(); + private readonly options: StoreOptions; + + // Written out rather than declared as a constructor parameter property: + // the tests run under Node's strip-only type stripping, which rejects + // parameter properties outright (ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX). + constructor(options: StoreOptions) { + this.options = options; + } + + /** Called on every mutation; cheap because the map is small and short-lived. */ + private sweep(now: number): void { + for (const [id, session] of this.sessions) { + if (session.expiresAt <= now) this.drop(id); + } + } + + private drop(id: string): void { + const session = this.sessions.get(id); + if (!session) return; + this.byApprovalToken.delete(session.approvalToken); + this.sessions.delete(id); + } + + create(now: number, laptopIp: string, laptopUa: string): Session { + this.sweep(now); + if (this.sessions.size >= this.options.maxSessions) { + throw new Error("too many concurrent sign-in sessions"); + } + + const answer = pickNumber(); + const session: Session = { + id: token(), + approvalToken: token(), + number: answer, + decoys: this.options.numberMode === "choice" ? pickDecoys(answer) : [], + status: "pending", + createdAt: now, + expiresAt: now + this.options.ttlSeconds * 1000, + laptopIp, + laptopUa, + attempted: false, + }; + + this.sessions.set(session.id, session); + this.byApprovalToken.set(session.approvalToken, session.id); + return session; + } + + get(id: string, now: number): Session | undefined { + const session = this.sessions.get(id); + if (!session) return undefined; + if (session.expiresAt <= now) { + this.drop(id); + return undefined; + } + return session; + } + + byToken(approvalToken: string, now: number): Session | undefined { + const id = this.byApprovalToken.get(approvalToken); + return id ? this.get(id, now) : undefined; + } + + markScanned(session: Session): void { + if (session.status === "pending") session.status = "scanned"; + } + + /** + * Resolve the challenge. Returns the new status. + * + * A wrong number DENIES rather than re-prompting: three guesses against a + * two-digit number is a 3.3% attack, an unbounded retry loop is a 100% one. + */ + decide(session: Session, username: string, phoneIp: string, answer: number | null): Status { + if (session.status !== "pending" && session.status !== "scanned") return session.status; + + if (answer === null) { + session.status = "denied"; + return session.status; + } + if (session.attempted) { + session.status = "denied"; + return session.status; + } + session.attempted = true; + + if (answer !== session.number) { + session.status = "denied"; + return session.status; + } + + session.username = username; + session.phoneIp = phoneIp; + session.status = "approved"; + return session.status; + } + + /** + * Consume an approved session and hand back the username. + * + * Called ONCE, by authentik's expression policy, at the moment it needs a + * `pending_user`. Single-use by construction: the record moves to `consumed` + * and the username is cleared, so a replay of the same id asserts nobody. + */ + consume(id: string, now: number): string | undefined { + const session = this.get(id, now); + if (!session || session.status !== "approved" || !session.username) return undefined; + + const username = session.username; + session.status = "consumed"; + session.username = undefined; + this.byApprovalToken.delete(session.approvalToken); + return username; + } + + get size(): number { + return this.sessions.size; + } +} diff --git a/test/sessions.test.ts b/test/sessions.test.ts new file mode 100644 index 0000000..f965487 --- /dev/null +++ b/test/sessions.test.ts @@ -0,0 +1,94 @@ +import assert from "node:assert/strict"; +import { test } from "node:test"; + +import { pickDecoys, pickNumber } from "../src/numbers.ts"; +import { SessionStore, secretEquals } from "../src/sessions.ts"; + +const opts = { ttlSeconds: 90, numberMode: "type" as const, maxSessions: 10 }; +const newStore = (o = {}) => new SessionStore({ ...opts, ...o }); + +test("a fresh session carries two DIFFERENT secrets", () => { + const s = newStore().create(0, "10.0.0.1", "ua"); + // The poll id is visible on the laptop's screen; the approval token is only + // in the QR. Reusing one value for both would collapse that separation. + assert.notEqual(s.id, s.approvalToken); + assert.equal(s.status, "pending"); +}); + +test("the happy path approves and yields the username exactly once", () => { + const store = newStore(); + const s = store.create(0, "10.0.0.1", "ua"); + + assert.equal(store.decide(s, "michal", "10.0.0.2", s.number), "approved"); + assert.equal(store.consume(s.id, 1000), "michal"); + + // Single-use: a replay of the same id must assert nobody. This is what stops + // a captured session id from being redeemed twice. + assert.equal(store.consume(s.id, 1000), undefined); + assert.equal(store.get(s.id, 1000)?.status, "consumed"); +}); + +test("a wrong number denies outright and never allows a retry", () => { + const store = newStore(); + const s = store.create(0, "10.0.0.1", "ua"); + + const wrong = s.number === 99 ? 98 : s.number + 1; + assert.equal(store.decide(s, "michal", "10.0.0.2", wrong), "denied"); + + // The correct answer afterwards must NOT rescue it: an unbounded retry loop + // would turn 6.5 bits of entropy back into none. + assert.equal(store.decide(s, "michal", "10.0.0.2", s.number), "denied"); + assert.equal(store.consume(s.id, 1000), undefined); +}); + +test("an explicit deny (null) is honoured", () => { + const store = newStore(); + const s = store.create(0, "10.0.0.1", "ua"); + assert.equal(store.decide(s, "michal", "10.0.0.2", null), "denied"); + assert.equal(store.consume(s.id, 1000), undefined); +}); + +test("only approved sessions can be consumed", () => { + const store = newStore(); + const s = store.create(0, "10.0.0.1", "ua"); + assert.equal(store.consume(s.id, 1000), undefined, "pending must not assert a user"); +}); + +test("sessions expire, and expiry frees the approval token", () => { + const store = newStore({ ttlSeconds: 1 }); + const s = store.create(0, "10.0.0.1", "ua"); + + assert.ok(store.get(s.id, 500)); + assert.equal(store.get(s.id, 1_001), undefined); + assert.equal(store.byToken(s.approvalToken, 1_001), undefined); + assert.equal(store.size, 0); +}); + +test("the store is bounded, and sweeping reclaims room", () => { + const store = newStore({ maxSessions: 2, ttlSeconds: 1 }); + store.create(0, "10.0.0.1", "ua"); + store.create(0, "10.0.0.1", "ua"); + assert.throws(() => store.create(0, "10.0.0.1", "ua"), /too many/); + + // Once the first two lapse the sweep on create() reclaims them, so a flood + // is bounded memory rather than a permanent outage. + assert.ok(store.create(2_000, "10.0.0.1", "ua")); +}); + +test("numbers are two digits and decoys are distinct from the answer", () => { + for (let i = 0; i < 200; i++) { + const n = pickNumber(); + assert.ok(n >= 10 && n <= 99, `${n} out of range`); + } + const answer = pickNumber(); + const choices = pickDecoys(answer); + assert.equal(choices.length, 3); + assert.equal(new Set(choices).size, 3, "decoys must not repeat"); + assert.ok(choices.includes(answer), "the answer must be among the choices"); +}); + +test("secretEquals rejects different lengths without throwing", () => { + assert.equal(secretEquals("abc", "abcd"), false); + assert.equal(secretEquals("abc", "abc"), true); + assert.equal(secretEquals("abc", "abd"), false); +}); diff --git a/tsconfig.json b/tsconfig.json new file mode 100644 index 0000000..0119687 --- /dev/null +++ b/tsconfig.json @@ -0,0 +1,26 @@ +{ + "compilerOptions": { + "target": "ES2023", + "module": "commonjs", + "moduleResolution": "node", + "lib": ["ES2023"], + "outDir": "dist", + "rootDir": "src", + "strict": true, + "esModuleInterop": true, + "skipLibCheck": true, + "forceConsistentCasingInFileNames": true, + "declaration": false, + "sourceMap": false, + + // Relative imports carry `.ts` and TypeScript rewrites them to `.js` on + // emit. This is what lets the SAME source run two ways: compiled to + // dist/ for the image, and under Node's strip-only type stripping for + // `node --test`, which resolves imports by their real filename. Without it + // any src module that imports another src module is untestable. + "allowImportingTsExtensions": true, + "rewriteRelativeImportExtensions": true + }, + "include": ["src/**/*.ts"], + "exclude": ["node_modules", "dist", "test"] +} diff --git a/tsconfig.test.json b/tsconfig.test.json new file mode 100644 index 0000000..279b740 --- /dev/null +++ b/tsconfig.test.json @@ -0,0 +1,13 @@ +{ + // The tests run under Node's type stripping, which resolves imports by their + // real filename — hence the `.ts` extensions in the test sources. The build + // tsconfig cannot allow those, so tests get their own noEmit config. + // Without this the test files would be the one surface nothing checks. + "extends": "./tsconfig.json", + "compilerOptions": { + "noEmit": true, + "allowImportingTsExtensions": true, + "rootDir": "." + }, + "include": ["src/**/*.ts", "test/**/*.ts"] +}