@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/methods/providers/facebook.js

@@ -0,0 +1,42 @@
+// src/methods/providers/facebook.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional(),
+  useOidc: z.boolean().optional()
+});
+var facebookFactory = {
+  kind: "facebook",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => {
+    if (config.useOidc) {
+      return buildOidcMethod({
+        id,
+        kind,
+        issuer: "https://graph.facebook.com",
+        clientId: config.clientId,
+        clientSecret: config.clientSecret,
+        scopes: config.scopes ?? ["openid", "email", "public_profile"]
+      });
+    }
+    return buildOauth2Method({
+      id,
+      kind,
+      authorizationUrl: "https://www.facebook.com/v12.0/dialog/oauth",
+      tokenUrl: "https://graph.facebook.com/v12.0/oauth/access_token",
+      clientId: config.clientId,
+      clientSecret: config.clientSecret,
+      scopes: config.scopes ?? ["email", "public_profile"]
+    });
+  }
+};
+export {
+  facebookFactory
+};

package/dist/esm/methods/providers/github.js

@@ -0,0 +1,29 @@
+// src/methods/providers/github.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var githubFactory = {
+  kind: "github",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["read:user", "user:email"],
+    pkce: "none"
+  })
+};
+export {
+  githubFactory
+};

package/dist/esm/methods/providers/google.js

@@ -0,0 +1,29 @@
+// src/methods/providers/google.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional(),
+  hostedDomain: z.string().optional()
+});
+var googleFactory = {
+  kind: "google",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: "https://accounts.google.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"],
+    ...config.hostedDomain ? { extraAuthorizeParams: { hd: config.hostedDomain } } : {}
+  })
+};
+export {
+  googleFactory
+};

package/dist/esm/methods/providers/index.js

@@ -0,0 +1,17 @@
+export {
+  yahooFactory,
+  xFactory,
+  twitchFactory,
+  spotifyFactory,
+  slackFactory,
+  microsoftFactory,
+  linkedinFactory,
+  keycloakFactory,
+  jumpcloudFactory,
+  googleFactory,
+  githubFactory,
+  facebookFactory,
+  discordFactory,
+  cognitoFactory,
+  appleFactory
+};

package/dist/esm/methods/providers/jumpcloud.js

@@ -0,0 +1,27 @@
+// src/methods/providers/jumpcloud.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var jumpcloudFactory = {
+  kind: "jumpcloud",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: "https://oauth.id.jumpcloud.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"]
+  })
+};
+export {
+  jumpcloudFactory
+};

package/dist/esm/methods/providers/keycloak.js

@@ -0,0 +1,32 @@
+// src/methods/providers/keycloak.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  baseUrl: z.string(),
+  realm: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var keycloakFactory = {
+  kind: "keycloak",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => {
+    const base = config.baseUrl.replace(/\/+$/, "");
+    return buildOidcMethod({
+      id,
+      kind,
+      issuer: `${base}/realms/${config.realm}`,
+      clientId: config.clientId,
+      clientSecret: config.clientSecret,
+      scopes: config.scopes ?? ["openid", "email", "profile"]
+    });
+  }
+};
+export {
+  keycloakFactory
+};

package/dist/esm/methods/providers/linkedin.js

@@ -0,0 +1,28 @@
+// src/methods/providers/linkedin.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var linkedinFactory = {
+  kind: "linkedin",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://www.linkedin.com/oauth/v2/authorization",
+    tokenUrl: "https://www.linkedin.com/oauth/v2/accessToken",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["r_liteprofile", "r_emailaddress"]
+  })
+};
+export {
+  linkedinFactory
+};

package/dist/esm/methods/providers/microsoft.js

@@ -0,0 +1,28 @@
+// src/methods/providers/microsoft.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  tenant: z.string().optional(),
+  scopes: z.array(z.string()).optional()
+});
+var microsoftFactory = {
+  kind: "microsoft",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: `https://login.microsoftonline.com/${config.tenant ?? "common"}/v2.0`,
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"]
+  })
+};
+export {
+  microsoftFactory
+};

package/dist/esm/methods/providers/slack.js

@@ -0,0 +1,30 @@
+// src/methods/providers/slack.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var slackFactory = {
+  kind: "slack",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://slack.com/openid/connect/authorize",
+    tokenUrl: "https://slack.com/api/openid.connect.token",
+    jwksUri: "https://slack.com/openid/connect/keys",
+    expectedIssuer: "https://slack.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"]
+  })
+};
+export {
+  slackFactory
+};

package/dist/esm/methods/providers/spotify.js

@@ -0,0 +1,28 @@
+// src/methods/providers/spotify.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var spotifyFactory = {
+  kind: "spotify",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://accounts.spotify.com/authorize",
+    tokenUrl: "https://accounts.spotify.com/api/token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["user-read-email", "user-read-private"]
+  })
+};
+export {
+  spotifyFactory
+};

package/dist/esm/methods/providers/twitch.js

@@ -0,0 +1,28 @@
+// src/methods/providers/twitch.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var twitchFactory = {
+  kind: "twitch",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://id.twitch.tv/oauth2/authorize",
+    tokenUrl: "https://id.twitch.tv/oauth2/token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["user:read:email"]
+  })
+};
+export {
+  twitchFactory
+};

package/dist/esm/methods/providers/x.js

@@ -0,0 +1,28 @@
+// src/methods/providers/x.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var xFactory = {
+  kind: "x",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://twitter.com/i/oauth2/authorize",
+    tokenUrl: "https://api.x.com/2/oauth2/token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["tweet.read", "users.read"]
+  })
+};
+export {
+  xFactory
+};

package/dist/esm/methods/providers/yahoo.js

@@ -0,0 +1,27 @@
+// src/methods/providers/yahoo.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var yahooFactory = {
+  kind: "yahoo",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: "https://api.login.yahoo.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"]
+  })
+};
+export {
+  yahooFactory
+};

package/dist/esm/pkce.js

@@ -5,11 +5,8 @@ function generateVerifier(length) {
   crypto.getRandomValues(buffer);
   return base64url.encode(buffer);
 }
-async function generateChallenge(verifier, method) {
-  if (method === "plain")
-    return verifier;
-  const encoder = new TextEncoder;
-  const data = encoder.encode(verifier);
+async function s256Challenge(verifier) {
+  const data = new TextEncoder().encode(verifier);
   const hash = await crypto.subtle.digest("SHA-256", data);
   return base64url.encode(new Uint8Array(hash));
 }
@@ -18,18 +15,9 @@ async function generatePKCE(length = 64) {
     throw new Error("Code verifier length must be between 43 and 128 characters");
   }
   const verifier = generateVerifier(length);
-  const challenge = await generateChallenge(verifier, "S256");
-  return {
-    verifier,
-    challenge,
-    method: "S256"
-  };
-}
-async function validatePKCE(verifier, challenge, method = "S256") {
-  const generatedChallenge = await generateChallenge(verifier, method);
-  return generatedChallenge === challenge;
+  const challenge = await s256Challenge(verifier);
+  return { verifier, challenge, method: "S256" };
 }
 export {
-  validatePKCE,
   generatePKCE
 };

package/dist/esm/types/error.js

@@ -0,0 +1,70 @@
+// src/types/error.ts
+var authError = {
+  invalidRequest: (description, field) => ({
+    code: "invalid_request",
+    description,
+    ...field !== undefined ? { field } : {}
+  }),
+  invalidClient: (description) => ({
+    code: "invalid_client",
+    description
+  }),
+  invalidGrant: (description, reuseSignal) => ({
+    code: "invalid_grant",
+    description,
+    ...reuseSignal !== undefined ? { reuseSignal } : {}
+  }),
+  unauthorizedClient: (description) => ({
+    code: "unauthorized_client",
+    description
+  }),
+  unsupportedGrantType: (description) => ({
+    code: "unsupported_grant_type",
+    description
+  }),
+  invalidScope: (description) => ({
+    code: "invalid_scope",
+    description
+  }),
+  accessDenied: (description) => ({
+    code: "access_denied",
+    description
+  }),
+  unknownState: (description) => ({
+    code: "unknown_state",
+    description
+  }),
+  serverError: (description, cause) => ({
+    code: "server_error",
+    description,
+    ...cause !== undefined ? { cause } : {}
+  }),
+  tenantNotFound: (description, tenantId) => ({
+    code: "tenant_not_found",
+    description,
+    tenantId
+  }),
+  methodNotFound: (description, refs) => ({
+    code: "method_not_found",
+    description,
+    ...refs.methodId !== undefined ? { methodId: refs.methodId } : {},
+    ...refs.methodKind !== undefined ? { methodKind: refs.methodKind } : {}
+  }),
+  invalidTarget: (description) => ({
+    code: "invalid_target",
+    description
+  }),
+  internalError: (description, cause) => ({
+    code: "internal_error",
+    description,
+    ...cause !== undefined ? { cause } : {}
+  }),
+  invalidDpopProof: (description, replaySignal) => ({
+    code: "invalid_dpop_proof",
+    description,
+    ...replaySignal !== undefined ? { replaySignal } : {}
+  })
+};
+export {
+  authError
+};

package/dist/esm/types/result.js

@@ -0,0 +1,11 @@
+// src/types/result.ts
+var ok = (value) => ({ ok: true, value });
+var err = (error) => ({ ok: false, error });
+var isOk = (r) => r.ok === true;
+var isErr = (r) => r.ok === false;
+export {
+  ok,
+  isOk,
+  isErr,
+  err
+};

package/dist/esm/types/tenant.js

@@ -0,0 +1,5 @@
+// src/types/tenant.ts
+var asTenantId = (value) => value;
+export {
+  asTenantId
+};