trinhhaox/ag-kit/authentication

// Sign with RS256 for asymmetric verification
const token = await new SignJWT({ sub: userId, role })
  .setProtectedHeader({ alg: 'RS256' })
  .setIssuedAt()
  .setExpirationTime('15m')
  .setJti(crypto.randomUUID()) // Unique token ID for revocation
  .sign(privateKey);

async function refreshTokens(refreshToken: string) {
  const payload = await verify(refreshToken);
  // Revoke old refresh token (one-time use)
  await revokeToken(payload.jti);
  // Issue new pair
  const newAccess = await signAccessToken(payload.sub);
  const newRefresh = await signRefreshToken(payload.sub);
  return { accessToken: newAccess, refreshToken: newRefresh };
}

// httpOnly cookie - not accessible via JavaScript
Set-Cookie: session_id=abc123;
  HttpOnly;
  Secure;
  SameSite=Lax;
  Path=/;
  Max-Age=86400

1. Generate code_verifier (random 43-128 chars)
2. Derive code_challenge = BASE64URL(SHA256(code_verifier))
3. Redirect to /authorize?response_type=code&code_challenge=...&state=RANDOM
4. User authenticates at provider
5. Provider redirects back with ?code=AUTH_CODE&state=RANDOM
6. Verify state matches (CSRF prevention)
7. Exchange code + code_verifier for tokens at /token endpoint

// Generic OAuth callback handler
async function handleCallback(code: string, state: string) {
  verifyState(state, session.oauthState);
  const tokens = await exchangeCode(code, codeVerifier);
  const userInfo = await fetchUserInfo(tokens.access_token);
  const user = await findOrCreateUser(userInfo);
  await createSession(user.id);
}

type Permission = 'read' | 'write' | 'delete' | 'admin';
type Role = {
  name: string;
  permissions: Permission[];
  inherits?: string[]; // Role inheritance
};
// Check authorization
function authorize(user: User, required: Permission): boolean {
  const userPerms = resolvePermissions(user.roles);
  return userPerms.includes(required) || userPerms.includes('admin');
}

function requirePermission(...perms: Permission[]) {
  return async (req, res, next) => {
    const user = req.user;
    if (!user || !perms.every(p => authorize(user, p))) {
      return res.status(403).json({ error: 'Forbidden' });
    }
    next();
  };
}
// Usage
app.delete('/api/users/:id', requirePermission('admin', 'delete'), handler);

// Setup: generate secret, show QR code
const secret = generateTOTPSecret();
const qrUrl = `otpauth://totp/App:${email}?secret=${secret}&issuer=App`;
// Verify: check 6-digit code with 30s window
function verifyTOTP(secret: string, code: string): boolean {
  const expected = generateTOTP(secret, Math.floor(Date.now() / 30000));
  return timingSafeEqual(code, expected);
}

// Token bucket with Redis
async function rateLimit(key: string, limit: number, windowSec: number) {
  const current = await redis.incr(key);
  if (current === 1) await redis.expire(key, windowSec);
  if (current > limit) throw new TooManyRequestsError();
}