mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
304bb1f2ef
The cap on how many codes a sign-in could ask for was held per attempt, keyed by a value in the caller's own cookie. That bounds nothing. The caller decides how many attempts to start, and starting a fresh one costs them a discarded cookie — so either replaying an older cookie or simply beginning again walked straight around it, and the only thing left spacing the mail out was the interval between sends. The count now sits against the claim, over a window. That is the thing being protected: the mailbox belongs to somebody who did not ask to hear from us, and whoever is pointing at it is not the party to trust with the tally. A resend also left the previous code live, with a budget of guesses of its own. Several resends therefore meant several working codes and several times the chances at them, which made asking for a new code the cheapest way to buy more tries at the old one. A new code now retires the one before it. Reported against the replay path. The replay was real and the same hole was wider than that: starting a new attempt needed no replay at all.
packages/auth (@nestri/auth)
Framework-agnostic OpenAuth implementation for Nestri — the OAuth/OIDC issuer, client, subjects, and the login UI. A vendored/forked build of OpenAuth.
What it does
Everything needed to run your own authentication provider:
issuer.ts— the authorization server: routes for/authorize,/callback,/token,/userinfo,.well-known/*, plus the login UI (React renderer).client.ts—createClientto verify JWTs against the issuer ("who is this token?").subject.ts— typed JWT subjects (zodschemas for the token payload).provider/*— drop-in OAuth/OIDC providers (steam, discord, github, google, apple, microsoft, slack, spotify, twitch, x, yahoo, facebook, linkedin, cognito, keycloak, jumpcloud, oauth2, oidc, password, ssh, code, arctic).storage/*— persistence adapters for keys/sessions/codes:memory,cloudflare(KV),aws,dynamo.ui/*— the login page components (forms, password, code, theme, CSS).jwt.ts,keys.ts,pkce.ts,random.ts— signing, keypair management, PKCE, randomness.
Usage
Consumed by the apps/auth worker, e.g.:
import { issuer } from '@nestri/auth/index';
import { CloudflareStorage } from '@nestri/auth/storage/cloudflare';
import { SteamProvider } from '@nestri/auth/provider/steam';
The API uses createClient (from @openauth/openauth/client) or the bundled client.ts to verify
tokens against the issuer URL.
Scripts
bun test # run tests
bun run build # build (see script/build.ts)
Note
@openauthjs is the upstream project; this package's exports are meant to be API-compatible with a
pinned preference toward tree-shaking-friendly imports. Prefer importing subpaths over the barrel
(@nestri/auth/index).