@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/esm/methods/password-hash.js

@@ -0,0 +1,79 @@
+// src/methods/password-hash.ts
+import { argon2idAsync } from "@noble/hashes/argon2.js";
+import {
+  base64url,
+  randomBytes,
+  timingSafeEqualStr,
+  utf8
+} from "../domain/crypto";
+var DEFAULT_ARGON2ID_PARAMS = {
+  t: 3,
+  m: 65536,
+  p: 4,
+  dkLen: 32,
+  saltLen: 16
+};
+function argon2idHasher(params = {}) {
+  const cfg = { ...DEFAULT_ARGON2ID_PARAMS, ...params };
+  return {
+    async hash(plain) {
+      const salt = randomBytes(cfg.saltLen);
+      const out = await argon2idAsync(utf8.encode(plain), salt, {
+        t: cfg.t,
+        m: cfg.m,
+        p: cfg.p,
+        dkLen: cfg.dkLen
+      });
+      return `$argon2id$v=19$m=${cfg.m},t=${cfg.t},p=${cfg.p}$${base64url.encode(salt)}$${base64url.encode(out)}`;
+    },
+    async verify(plain, stored) {
+      const parsed = parsePhc(stored);
+      if (!parsed)
+        return false;
+      if (parsed.algo !== "argon2id")
+        return false;
+      try {
+        const out = await argon2idAsync(utf8.encode(plain), parsed.salt, {
+          t: parsed.t,
+          m: parsed.m,
+          p: parsed.p,
+          dkLen: parsed.hash.length
+        });
+        return timingSafeEqualStr(base64url.encode(out), base64url.encode(parsed.hash));
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function parsePhc(stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 6)
+    return null;
+  const [, algo, _version, params, saltStr, hashStr] = parts;
+  if (!algo || !params || !saltStr || !hashStr)
+    return null;
+  const kv = Object.fromEntries(params.split(",").map((p) => {
+    const [k, v] = p.split("=");
+    return [k ?? "", Number.parseInt(v ?? "0", 10)];
+  }));
+  if (typeof kv.m !== "number" || typeof kv.t !== "number" || typeof kv.p !== "number") {
+    return null;
+  }
+  try {
+    return {
+      algo,
+      t: kv.t,
+      m: kv.m,
+      p: kv.p,
+      salt: base64url.decode(saltStr),
+      hash: base64url.decode(hashStr)
+    };
+  } catch {
+    return null;
+  }
+}
+export {
+  argon2idHasher,
+  DEFAULT_ARGON2ID_PARAMS
+};

package/dist/esm/methods/password.js

@@ -0,0 +1,166 @@
+// src/methods/password.ts
+import { z } from "zod";
+import { argon2idHasher } from "./password-hash";
+import { renderForm } from "../ui/forms";
+var configSchema = z.object({}).strict();
+var loginBodySchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(1)
+});
+var registerBodySchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(8)
+});
+function passwordMethod(opts) {
+  const hasher = opts.hasher ?? argon2idHasher();
+  const title = opts.title ?? "Sign in";
+  return {
+    kind: "password",
+    configSchema,
+    build: async ({
+      id,
+      kind
+    }) => ({
+      id,
+      kind,
+      type: "password",
+      routes: {
+        "GET /authorize": async (ctx) => renderLogin(ctx, id, title),
+        "POST /login": async (ctx) => handleLogin(ctx, id, title, opts.users, hasher),
+        "POST /register": async (ctx) => {
+          if (!opts.enableRegistration || !opts.users.create) {
+            return {
+              kind: "error",
+              error: {
+                code: "invalid_request",
+                description: "registration disabled"
+              }
+            };
+          }
+          return handleRegister(ctx, id, title, opts.users.create, opts.users, hasher);
+        }
+      }
+    })
+  };
+}
+async function renderLogin(ctx, methodId, title) {
+  const body = renderForm({
+    title,
+    action: `/m/${methodId}/login`,
+    fields: [
+      {
+        name: "email",
+        label: "Email",
+        type: "email",
+        required: true,
+        autocomplete: "username"
+      },
+      {
+        name: "password",
+        label: "Password",
+        type: "password",
+        required: true,
+        autocomplete: "current-password"
+      }
+    ],
+    submit: "Sign in",
+    ...ctx.methodState?.error ? { error: ctx.methodState.error } : {}
+  });
+  return {
+    kind: "challenge",
+    response: new Response(body, {
+      status: 200,
+      headers: { "content-type": "text/html; charset=utf-8" }
+    })
+  };
+}
+async function handleLogin(ctx, methodId, title, users, hasher) {
+  const form = await safeForm(ctx.request);
+  const parsed = loginBodySchema.safeParse(form);
+  if (!parsed.success) {
+    return reLoginWithError(methodId, title, "Please enter your email and password.");
+  }
+  const user = await users.findByEmail(parsed.data.email, ctx.tenant.id);
+  if (!user) {
+    return reLoginWithError(methodId, title, "Invalid email or password.");
+  }
+  const verified = await hasher.verify(parsed.data.password, user.passwordHash);
+  if (!verified) {
+    return reLoginWithError(methodId, title, "Invalid email or password.");
+  }
+  return {
+    kind: "success",
+    providerSubject: user.id,
+    properties: {
+      email: parsed.data.email,
+      ...user.claims ? { claims: user.claims } : {}
+    }
+  };
+}
+async function handleRegister(ctx, methodId, title, create, users, hasher) {
+  const form = await safeForm(ctx.request);
+  const parsed = registerBodySchema.safeParse(form);
+  if (!parsed.success) {
+    return reLoginWithError(methodId, title, "Password must be at least 8 characters and email must be valid.");
+  }
+  const existing = await users.findByEmail(parsed.data.email, ctx.tenant.id);
+  if (existing) {
+    return reLoginWithError(methodId, title, "An account with that email already exists.");
+  }
+  const passwordHash = await hasher.hash(parsed.data.password);
+  const user = await create({
+    email: parsed.data.email,
+    passwordHash,
+    tenantId: ctx.tenant.id
+  });
+  return {
+    kind: "success",
+    providerSubject: user.id,
+    properties: {
+      email: parsed.data.email,
+      ...user.claims ? { claims: user.claims } : {}
+    }
+  };
+}
+function reLoginWithError(methodId, title, error) {
+  return {
+    kind: "challenge",
+    response: new Response(renderForm({
+      title,
+      action: `/m/${methodId}/login`,
+      fields: [
+        {
+          name: "email",
+          label: "Email",
+          type: "email",
+          required: true,
+          autocomplete: "username"
+        },
+        {
+          name: "password",
+          label: "Password",
+          type: "password",
+          required: true,
+          autocomplete: "current-password"
+        }
+      ],
+      submit: "Sign in",
+      error
+    }), {
+      status: 400,
+      headers: { "content-type": "text/html; charset=utf-8" }
+    }),
+    saveMethodState: { error }
+  };
+}
+async function safeForm(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return {};
+  }
+  const params = new URLSearchParams(await req.text());
+  return Object.fromEntries(params.entries());
+}
+export {
+  passwordMethod
+};

package/dist/esm/methods/providers/apple.js

@@ -0,0 +1,29 @@
+// src/methods/providers/apple.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional(),
+  responseMode: z.enum(["query", "form_post"]).optional()
+});
+var appleFactory = {
+  kind: "apple",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: "https://appleid.apple.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "name", "email"],
+    ...config.responseMode ? { responseMode: config.responseMode } : {}
+  })
+};
+export {
+  appleFactory
+};

package/dist/esm/methods/providers/cognito.js

@@ -0,0 +1,37 @@
+// src/methods/providers/cognito.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string().optional(),
+  domain: z.string(),
+  issuer: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var cognitoFactory = {
+  kind: "cognito",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => {
+    return buildOidcMethod({
+      id,
+      kind,
+      issuer: config.issuer,
+      endpoints: {
+        authorization_endpoint: `https://${config.domain}/oauth2/authorize`,
+        token_endpoint: `https://${config.domain}/oauth2/token`,
+        jwks_uri: `${config.issuer.replace(/\/+$/, "")}/.well-known/jwks.json`,
+        issuer: config.issuer
+      },
+      clientId: config.clientId,
+      ...config.clientSecret ? { clientSecret: config.clientSecret } : {},
+      scopes: config.scopes ?? ["openid", "email", "profile"]
+    });
+  }
+};
+export {
+  cognitoFactory
+};

package/dist/esm/methods/providers/discord.js

@@ -0,0 +1,28 @@
+// src/methods/providers/discord.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var discordFactory = {
+  kind: "discord",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://discord.com/oauth2/authorize",
+    tokenUrl: "https://discord.com/api/oauth2/token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["identify", "email"]
+  })
+};
+export {
+  discordFactory
+};

package/dist/esm/methods/providers/facebook.js

@@ -0,0 +1,42 @@
+// src/methods/providers/facebook.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional(),
+  useOidc: z.boolean().optional()
+});
+var facebookFactory = {
+  kind: "facebook",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => {
+    if (config.useOidc) {
+      return buildOidcMethod({
+        id,
+        kind,
+        issuer: "https://graph.facebook.com",
+        clientId: config.clientId,
+        clientSecret: config.clientSecret,
+        scopes: config.scopes ?? ["openid", "email", "public_profile"]
+      });
+    }
+    return buildOauth2Method({
+      id,
+      kind,
+      authorizationUrl: "https://www.facebook.com/v12.0/dialog/oauth",
+      tokenUrl: "https://graph.facebook.com/v12.0/oauth/access_token",
+      clientId: config.clientId,
+      clientSecret: config.clientSecret,
+      scopes: config.scopes ?? ["email", "public_profile"]
+    });
+  }
+};
+export {
+  facebookFactory
+};

package/dist/esm/methods/providers/github.js

@@ -0,0 +1,29 @@
+// src/methods/providers/github.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var githubFactory = {
+  kind: "github",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["read:user", "user:email"],
+    pkce: "none"
+  })
+};
+export {
+  githubFactory
+};

package/dist/esm/methods/providers/google.js

@@ -0,0 +1,29 @@
+// src/methods/providers/google.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional(),
+  hostedDomain: z.string().optional()
+});
+var googleFactory = {
+  kind: "google",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: "https://accounts.google.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"],
+    ...config.hostedDomain ? { extraAuthorizeParams: { hd: config.hostedDomain } } : {}
+  })
+};
+export {
+  googleFactory
+};

package/dist/esm/methods/providers/index.js

@@ -0,0 +1,17 @@
+export {
+  yahooFactory,
+  xFactory,
+  twitchFactory,
+  spotifyFactory,
+  slackFactory,
+  microsoftFactory,
+  linkedinFactory,
+  keycloakFactory,
+  jumpcloudFactory,
+  googleFactory,
+  githubFactory,
+  facebookFactory,
+  discordFactory,
+  cognitoFactory,
+  appleFactory
+};

package/dist/esm/methods/providers/jumpcloud.js

@@ -0,0 +1,27 @@
+// src/methods/providers/jumpcloud.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var jumpcloudFactory = {
+  kind: "jumpcloud",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: "https://oauth.id.jumpcloud.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"]
+  })
+};
+export {
+  jumpcloudFactory
+};

package/dist/esm/methods/providers/keycloak.js

@@ -0,0 +1,32 @@
+// src/methods/providers/keycloak.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  baseUrl: z.string(),
+  realm: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var keycloakFactory = {
+  kind: "keycloak",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => {
+    const base = config.baseUrl.replace(/\/+$/, "");
+    return buildOidcMethod({
+      id,
+      kind,
+      issuer: `${base}/realms/${config.realm}`,
+      clientId: config.clientId,
+      clientSecret: config.clientSecret,
+      scopes: config.scopes ?? ["openid", "email", "profile"]
+    });
+  }
+};
+export {
+  keycloakFactory
+};

package/dist/esm/methods/providers/linkedin.js

@@ -0,0 +1,28 @@
+// src/methods/providers/linkedin.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var linkedinFactory = {
+  kind: "linkedin",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://www.linkedin.com/oauth/v2/authorization",
+    tokenUrl: "https://www.linkedin.com/oauth/v2/accessToken",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["r_liteprofile", "r_emailaddress"]
+  })
+};
+export {
+  linkedinFactory
+};

package/dist/esm/methods/providers/microsoft.js

@@ -0,0 +1,28 @@
+// src/methods/providers/microsoft.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  tenant: z.string().optional(),
+  scopes: z.array(z.string()).optional()
+});
+var microsoftFactory = {
+  kind: "microsoft",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: `https://login.microsoftonline.com/${config.tenant ?? "common"}/v2.0`,
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"]
+  })
+};
+export {
+  microsoftFactory
+};

package/dist/esm/methods/providers/slack.js

@@ -0,0 +1,30 @@
+// src/methods/providers/slack.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var slackFactory = {
+  kind: "slack",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://slack.com/openid/connect/authorize",
+    tokenUrl: "https://slack.com/api/openid.connect.token",
+    jwksUri: "https://slack.com/openid/connect/keys",
+    expectedIssuer: "https://slack.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"]
+  })
+};
+export {
+  slackFactory
+};

package/dist/esm/methods/providers/spotify.js

@@ -0,0 +1,28 @@
+// src/methods/providers/spotify.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var spotifyFactory = {
+  kind: "spotify",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://accounts.spotify.com/authorize",
+    tokenUrl: "https://accounts.spotify.com/api/token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["user-read-email", "user-read-private"]
+  })
+};
+export {
+  spotifyFactory
+};

package/dist/esm/methods/providers/twitch.js

@@ -0,0 +1,28 @@
+// src/methods/providers/twitch.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var twitchFactory = {
+  kind: "twitch",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://id.twitch.tv/oauth2/authorize",
+    tokenUrl: "https://id.twitch.tv/oauth2/token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["user:read:email"]
+  })
+};
+export {
+  twitchFactory
+};