@_mustachio/openauth 0.6.0

package/src/provider/oauth2.ts

@@ -0,0 +1,297 @@
+/**
+ * Use this to connect authentication providers that support OAuth 2.0.
+ *
+ * ```ts {5-12}
+ * import { Oauth2Provider } from "@openauthjs/openauth/provider/oauth2"
+ *
+ * export default issuer({
+ *   providers: {
+ *     oauth2: Oauth2Provider({
+ *       clientID: "1234567890",
+ *       clientSecret: "0987654321",
+ *       endpoint: {
+ *         authorization: "https://auth.myserver.com/authorize",
+ *         token: "https://auth.myserver.com/token"
+ *       }
+ *     })
+ *   }
+ * })
+ * ```
+ *
+ *
+ * @packageDocumentation
+ */
+
+import { createRemoteJWKSet, jwtVerify } from "jose"
+import { OauthError } from "../error.js"
+import { generatePKCE } from "../pkce.js"
+import { getRelativeUrl } from "../util.js"
+import { Provider } from "./provider.js"
+
+export interface Oauth2Config {
+  /**
+   * @internal
+   */
+  type?: string
+  /**
+   * The client ID.
+   *
+   * This is just a string to identify your app.
+   *
+   * @example
+   * ```ts
+   * {
+   *   clientID: "my-client"
+   * }
+   * ```
+   */
+  clientID: string
+  /**
+   * The client secret.
+   *
+   * This is a private key that's used to authenticate your app. It should be kept secret.
+   *
+   * @example
+   * ```ts
+   * {
+   *   clientSecret: "0987654321"
+   * }
+   * ```
+   */
+  clientSecret: string
+  /**
+   * The URLs of the authorization and token endpoints.
+   *
+   * @example
+   * ```ts
+   * {
+   *   endpoint: {
+   *     authorization: "https://auth.myserver.com/authorize",
+   *     token: "https://auth.myserver.com/token",
+   *     jwks: "https://auth.myserver.com/auth/keys"
+   *   }
+   * }
+   * ```
+   */
+  endpoint: {
+    /**
+     * The URL of the authorization endpoint.
+     */
+    authorization: string
+    /**
+     * The URL of the token endpoint.
+     */
+    token: string
+    /**
+     * The URL of the JWKS endpoint.
+     */
+    jwks?: string
+  }
+  /**
+   * A list of OAuth scopes that you want to request.
+   *
+   * @example
+   * ```ts
+   * {
+   *   scopes: ["email", "profile"]
+   * }
+   * ```
+   */
+  scopes: string[]
+  /**
+   * Whether to use PKCE (Proof Key for Code Exchange) for the authorization code flow.
+   * Some providers like x.com require this.
+   * @default false
+   */
+  pkce?: boolean
+  /**
+   * Any additional parameters that you want to pass to the authorization endpoint.
+   * @example
+   * ```ts
+   * {
+   *   query: {
+   *     access_type: "offline",
+   *     prompt: "consent"
+   *   }
+   * }
+   * ```
+   */
+  query?: Record<string, string>
+}
+
+/**
+ * @internal
+ */
+export type Oauth2WrappedConfig = Omit<Oauth2Config, "endpoint" | "name">
+
+/**
+ * @internal
+ */
+export interface Oauth2Token {
+  access: string
+  refresh: string
+  expiry: number
+  id?: Record<string, any>
+  raw: Record<string, any>
+}
+
+interface ProviderState {
+  state: string
+  redirect: string
+  codeVerifier?: string
+}
+
+export function Oauth2Provider(
+  config: Oauth2Config,
+): Provider<{ tokenset: Oauth2Token; clientID: string }> {
+  const query = config.query || {}
+
+  // Helper function to handle token exchange and response building
+  async function handleCallbackLogic(
+    c: any,
+    ctx: any,
+    provider: ProviderState,
+    code: string | undefined,
+  ) {
+    if (!provider || !code) {
+      return c.redirect(getRelativeUrl(c, "./authorize"))
+    }
+
+    const body = new URLSearchParams({
+      client_id: config.clientID,
+      client_secret: config.clientSecret,
+      code,
+      grant_type: "authorization_code",
+      redirect_uri: provider.redirect,
+      ...(provider.codeVerifier
+        ? { code_verifier: provider.codeVerifier }
+        : {}),
+    })
+
+    const json: any = await fetch(config.endpoint.token, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: body.toString(),
+    }).then((r) => r.json())
+
+    if ("error" in json) {
+      throw new OauthError(json.error, json.error_description)
+    }
+
+    let idTokenPayload: Record<string, any> | null = null
+    if (config.endpoint.jwks) {
+      const jwksEndpoint = new URL(config.endpoint.jwks)
+      // @ts-expect-error bun/node mismatch
+      const jwks = createRemoteJWKSet(jwksEndpoint)
+      const { payload } = await jwtVerify(json.id_token, jwks, {
+        audience: config.clientID,
+      })
+      idTokenPayload = payload
+    }
+
+    return ctx.success(c, {
+      clientID: config.clientID,
+      tokenset: {
+        get access() {
+          return json.access_token
+        },
+        get refresh() {
+          return json.refresh_token
+        },
+        get expiry() {
+          return json.expires_in
+        },
+        get id() {
+          if (!idTokenPayload) return null
+          return idTokenPayload
+        },
+        get raw() {
+          return json
+        },
+      },
+    })
+  }
+
+  return {
+    type: config.type || "oauth2",
+    init(routes, ctx) {
+      routes.get("/authorize", async (c) => {
+        const state = crypto.randomUUID()
+        const pkce = config.pkce ? await generatePKCE() : undefined
+        await ctx.set<ProviderState>(c, "provider", 60 * 10, {
+          state,
+          redirect: getRelativeUrl(c, "./callback"),
+          codeVerifier: pkce?.verifier,
+        })
+        const authorization = new URL(config.endpoint.authorization)
+        authorization.searchParams.set("client_id", config.clientID)
+        authorization.searchParams.set(
+          "redirect_uri",
+          getRelativeUrl(c, "./callback"),
+        )
+        authorization.searchParams.set("response_type", "code")
+        authorization.searchParams.set("state", state)
+        authorization.searchParams.set("scope", config.scopes.join(" "))
+        if (pkce) {
+          authorization.searchParams.set("code_challenge", pkce.challenge)
+          authorization.searchParams.set("code_challenge_method", pkce.method)
+        }
+        for (const [key, value] of Object.entries(query)) {
+          authorization.searchParams.set(key, value)
+        }
+        return c.redirect(authorization.toString())
+      })
+
+      routes.get("/callback", async (c) => {
+        const provider = (await ctx.get(c, "provider")) as ProviderState
+        const code = c.req.query("code")
+        const state = c.req.query("state")
+        const error = c.req.query("error")
+
+        if (error)
+          throw new OauthError(
+            error.toString() as any,
+            c.req.query("error_description")?.toString() || "",
+          )
+        if (
+          !provider ||
+          !code ||
+          (provider.state && state !== provider.state)
+        ) {
+          return c.redirect(getRelativeUrl(c, "./authorize"))
+        }
+
+        return handleCallbackLogic(c, ctx, provider, code)
+      })
+
+      routes.post("/callback", async (c) => {
+        const provider = (await ctx.get(c, "provider")) as ProviderState
+
+        // Handle form data from POST request
+        const formData = await c.req.formData()
+        const code = formData.get("code")?.toString()
+        const state = formData.get("state")?.toString()
+        const error = formData.get("error")?.toString()
+
+        if (error)
+          throw new OauthError(
+            error as any,
+            formData.get("error_description")?.toString() || "",
+          )
+
+        if (
+          !provider ||
+          !code ||
+          (provider.state && state !== provider.state)
+        ) {
+          return c.redirect(getRelativeUrl(c, "./authorize"))
+        }
+
+        return handleCallbackLogic(c, ctx, provider, code)
+      })
+    },
+  }
+}

package/src/provider/oidc.ts

@@ -0,0 +1,179 @@
+/**
+ * Use this to connect authentication providers that support OIDC.
+ *
+ * ```ts {5-8}
+ * import { OidcProvider } from "@openauthjs/openauth/provider/oidc"
+ *
+ * export default issuer({
+ *   providers: {
+ *     oauth2: OidcProvider({
+ *       clientId: "1234567890",
+ *       issuer: "https://auth.myserver.com"
+ *     })
+ *   }
+ * })
+ * ```
+ *
+ *
+ * @packageDocumentation
+ */
+
+import { createLocalJWKSet, JSONWebKeySet, jwtVerify } from "jose"
+import { WellKnown } from "../client.js"
+import { OauthError } from "../error.js"
+import { Provider } from "./provider.js"
+import { JWTPayload } from "hono/utils/jwt/types"
+import { getRelativeUrl, lazy } from "../util.js"
+
+export interface OidcConfig {
+  /**
+   * @internal
+   */
+  type?: string
+  /**
+   * The client ID.
+   *
+   * This is just a string to identify your app.
+   *
+   * @example
+   * ```ts
+   * {
+   *   clientID: "my-client"
+   * }
+   * ```
+   */
+  clientID: string
+  /**
+   * The URL of your authorization server.
+   *
+   * @example
+   * ```ts
+   * {
+   *   issuer: "https://auth.myserver.com"
+   * }
+   * ```
+   */
+  issuer: string
+  /**
+   * A list of OIDC scopes that you want to request.
+   *
+   * @example
+   * ```ts
+   * {
+   *   scopes: ["openid", "profile", "email"]
+   * }
+   * ```
+   */
+  scopes?: string[]
+  /**
+   * Any additional parameters that you want to pass to the authorization endpoint.
+   * @example
+   * ```ts
+   * {
+   *   query: {
+   *     prompt: "consent"
+   *   }
+   * }
+   * ```
+   */
+  query?: Record<string, string>
+}
+
+/**
+ * @internal
+ */
+export type OidcWrappedConfig = Omit<OidcConfig, "issuer" | "name">
+
+interface ProviderState {
+  state: string
+  nonce: string
+  redirect: string
+}
+
+/**
+ * @internal
+ */
+export interface IdTokenResponse {
+  idToken: string
+  claims: Record<string, any>
+  raw: Record<string, any>
+}
+
+export function OidcProvider(
+  config: OidcConfig,
+): Provider<{ id: JWTPayload; clientID: string }> {
+  const query = config.query || {}
+  const scopes = config.scopes || []
+
+  const wk = lazy(() =>
+    fetch(config.issuer + "/.well-known/openid-configuration").then(
+      async (r) => {
+        if (!r.ok) throw new Error(await r.text())
+        return r.json() as Promise<WellKnown>
+      },
+    ),
+  )
+
+  const jwks = lazy(() =>
+    wk()
+      .then((r) => r.jwks_uri)
+      .then(async (uri) => {
+        const r = await fetch(uri)
+        if (!r.ok) throw new Error(await r.text())
+        return createLocalJWKSet((await r.json()) as JSONWebKeySet)
+      }),
+  )
+
+  return {
+    type: config.type || "oidc",
+    init(routes, ctx) {
+      routes.get("/authorize", async (c) => {
+        const provider: ProviderState = {
+          state: crypto.randomUUID(),
+          nonce: crypto.randomUUID(),
+          redirect: getRelativeUrl(c, "./callback"),
+        }
+        await ctx.set(c, "provider", 60 * 10, provider)
+        const authorization = new URL(
+          await wk().then((r) => r.authorization_endpoint),
+        )
+        authorization.searchParams.set("client_id", config.clientID)
+        authorization.searchParams.set("response_type", "id_token")
+        authorization.searchParams.set("response_mode", "form_post")
+        authorization.searchParams.set("state", provider.state)
+        authorization.searchParams.set("nonce", provider.nonce)
+        authorization.searchParams.set("redirect_uri", provider.redirect)
+        authorization.searchParams.set("scope", ["openid", ...scopes].join(" "))
+        for (const [key, value] of Object.entries(query)) {
+          authorization.searchParams.set(key, value)
+        }
+        return c.redirect(authorization.toString())
+      })
+
+      routes.post("/callback", async (c) => {
+        const provider = await ctx.get<ProviderState>(c, "provider")
+        if (!provider) return c.redirect(getRelativeUrl(c, "./authorize"))
+        const body = await c.req.formData()
+        const error = body.get("error")
+        if (error)
+          throw new OauthError(
+            error.toString() as any,
+            body.get("error_description")?.toString() || "",
+          )
+        const idToken = body.get("id_token")
+        if (!idToken)
+          throw new OauthError("invalid_request", "Missing id_token")
+        const result = await jwtVerify(idToken.toString(), await jwks(), {
+          audience: config.clientID,
+        })
+        if (result.payload.nonce !== provider.nonce) {
+          throw new OauthError("invalid_request", "Invalid nonce")
+        }
+        return ctx.success(c, {
+          id: result.payload,
+          clientID: config.clientID,
+        })
+      })
+    },
+  }
+}