|
| 1 | +// OAuth callback relay for preview deployments. Ory does not allow wildcard |
| 2 | +// redirect URIs, so previews — whose host is dynamic per branch — cannot |
| 3 | +// register their own callback. Instead we register ONE stable callback on a |
| 4 | +// fixed host (ORY_OAUTH_RELAY_ORIGIN) and point Hydra there for every preview, |
| 5 | +// encoding the originating preview origin in the sealed OAuth `state`. The fixed |
| 6 | +// host bounces the browser (carrying code/state/iss) back to the preview's real |
| 7 | +// callback, which finishes the PKCE exchange using the same registered |
| 8 | +// redirect_uri string — the token request only requires the redirect_uri to |
| 9 | +// match the authorize-time value, not to be where the code was delivered. |
| 10 | +// |
| 11 | +// The PKCE verifier lives in a host-only cookie on the preview and never reaches |
| 12 | +// the relay. `state` is sealed with the shared cookie crypto (E2B_SESSION_SECRET, |
| 13 | +// identical across the fixed host and previews), so the target is tamper-proof. |
| 14 | +// |
| 15 | +// No next/headers import here so this stays importable from edge middleware |
| 16 | +// (signout.ts pulls it in for the post-logout path). |
| 17 | + |
| 18 | +import { EncryptJWT, jwtDecrypt } from 'jose' |
| 19 | +import { isLoopbackUrl } from '@/core/shared/schemas/url' |
| 20 | +import { CONTENT_ENCRYPTION, deriveKey, KEY_ALGORITHM } from './cookie-crypto' |
| 21 | +import { OAUTH_CALLBACK_PATH } from './oauth-flow' |
| 22 | + |
| 23 | +export const OAUTH_RELAY_PATH = '/api/auth/oauth/relay' |
| 24 | +export const OAUTH_LOGOUT_RELAY_PATH = '/api/auth/oauth/logout-relay' |
| 25 | + |
| 26 | +// The fixed host whose relay endpoints are registered in Hydra. Set on preview |
| 27 | +// deployments only; unset on staging/production/local, where the flow stays |
| 28 | +// host-direct and behaves exactly as before. |
| 29 | +export function readRelayOrigin(): string | undefined { |
| 30 | + const value = process.env.ORY_OAUTH_RELAY_ORIGIN |
| 31 | + if (!value) return undefined |
| 32 | + return value.replace(/\/$/, '') |
| 33 | +} |
| 34 | + |
| 35 | +// Relay mode applies only when a fixed origin is configured AND differs from the |
| 36 | +// request origin. On the fixed host itself (and everywhere relay is unset) the |
| 37 | +// request resolves to its own callback, i.e. today's behavior. |
| 38 | +export function resolveOryRedirectUri(requestOrigin: string): { |
| 39 | + redirectUri: string |
| 40 | + relayTarget?: string |
| 41 | +} { |
| 42 | + const relay = readRelayOrigin() |
| 43 | + if (relay && relay !== requestOrigin) { |
| 44 | + return { |
| 45 | + redirectUri: new URL(OAUTH_RELAY_PATH, relay).toString(), |
| 46 | + relayTarget: requestOrigin, |
| 47 | + } |
| 48 | + } |
| 49 | + |
| 50 | + return { redirectUri: new URL(OAUTH_CALLBACK_PATH, requestOrigin).toString() } |
| 51 | +} |
| 52 | + |
| 53 | +// Carries the originating preview origin through Hydra in the OAuth `state` |
| 54 | +// (login) or RP-logout `state`. The random `r` gives the login state CSRF |
| 55 | +// entropy beyond the per-seal random IV. |
| 56 | +export async function sealRelayState(target: string): Promise<string> { |
| 57 | + return new EncryptJWT({ t: target, r: crypto.randomUUID() }) |
| 58 | + .setProtectedHeader({ alg: KEY_ALGORITHM, enc: CONTENT_ENCRYPTION }) |
| 59 | + .setIssuedAt() |
| 60 | + .encrypt(await deriveKey()) |
| 61 | +} |
| 62 | + |
| 63 | +export async function openRelayState( |
| 64 | + value: string | null | undefined |
| 65 | +): Promise<string | null> { |
| 66 | + if (!value) return null |
| 67 | + |
| 68 | + try { |
| 69 | + const { payload } = await jwtDecrypt(value, await deriveKey()) |
| 70 | + return typeof payload.t === 'string' ? payload.t : null |
| 71 | + } catch { |
| 72 | + return null |
| 73 | + } |
| 74 | +} |
| 75 | + |
| 76 | +// Open-redirect guard: a relay target must be a first-party origin. Production |
| 77 | +// requires HTTPS under NEXT_PUBLIC_E2B_DOMAIN (e.g. `*.e2b-staging.dev`); local |
| 78 | +// dev also accepts loopback so the relay path can be exercised across ports. |
| 79 | +export function isAllowedRelayTarget(target: string): boolean { |
| 80 | + let url: URL |
| 81 | + try { |
| 82 | + url = new URL(target) |
| 83 | + } catch { |
| 84 | + return false |
| 85 | + } |
| 86 | + |
| 87 | + if (url.protocol === 'http:' && isLoopbackUrl(target)) { |
| 88 | + return process.env.NODE_ENV !== 'production' |
| 89 | + } |
| 90 | + |
| 91 | + if (url.protocol !== 'https:') return false |
| 92 | + |
| 93 | + const base = process.env.NEXT_PUBLIC_E2B_DOMAIN |
| 94 | + if (!base) return false |
| 95 | + |
| 96 | + return url.hostname === base || url.hostname.endsWith(`.${base}`) |
| 97 | +} |
0 commit comments