@absolutejs/auth 0.2.3 → 0.2.5

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.2.3",
+	"version": "0.2.5",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -10,7 +10,7 @@
 	"license": "CC BY-NC 4.0",
 	"author": "Alex Kahn",
 	"scripts": {
-		"build": "rm -rf dist && bun build src/index.ts --outdir dist --minify --splitting --target=bun && tsc --emitDeclarationOnly --project tsconfig.json",
+		"build": "rm -rf dist && bun build src/index.ts --outdir dist --minify --splitting --target=bun --external arctic --external elysia && tsc --emitDeclarationOnly --project tsconfig.json",
 		"test": "echo \"Error: no test specified\" && exit 1",
 		"format": "prettier --write \"./**/*.{js,jsx,ts,tsx,css,json}\"",
 		"dev": "bun run --watch example/server.ts",
@@ -27,7 +27,6 @@
 		"oauth"
 	],
 	"types": "dist/src/index.d.ts",
-	"dependencies": {},
 	"peerDependencies": {
 		"arctic": ">= 3.6.0",
 		"elysia": ">= 1.2.0"
@@ -47,10 +46,5 @@
 		"elysia": "1.2.25",
 		"typescript": "5.8.3"
 	},
-	"module": "dist/index.js",
-	"files": [
-		"dist/",
-		"README.md",
-		"LICENSE"
-	]
+	"module": "dist/index.js"
 }

package/src/authorize.ts

@@ -0,0 +1,119 @@
+import { generateState, generateCodeVerifier } from 'arctic';
+import { Elysia } from 'elysia';
+import { isValidProviderKey } from './typeGuards';
+import { ClientProviders } from './types';
+import { COOKIE_DURATION } from './constants';
+
+type AuthorizeProps = {
+	clientProviders: ClientProviders;
+	authorizeRoute?: string;
+	onAuthorize?: () => void;
+};
+
+export const authorize = ({
+	clientProviders,
+	authorizeRoute = 'authorize',
+	onAuthorize
+}: AuthorizeProps) =>
+	new Elysia().get(
+		`/${authorizeRoute}/:provider`,
+		({
+			error,
+			redirect,
+			cookie: { state, code_verifier, auth_provider, redirect_url },
+			params: { provider },
+			headers
+		}) => {
+			if (provider === undefined)
+				return error('Bad Request', 'Provider is required');
+
+			if (!isValidProviderKey(provider)) {
+				return error('Bad Request', 'Invalid provider');
+			}
+
+			try {
+				const normalizedProvider = provider.toLowerCase();
+				const { providerInstance, scopes, searchParams } =
+					clientProviders[normalizedProvider];
+
+				const redirectUrl = headers['referer'] ?? '/';
+
+				redirect_url.set({
+					httpOnly: true,
+					maxAge: COOKIE_DURATION,
+					path: '/',
+					sameSite: 'lax',
+					secure: true,
+					value: redirectUrl
+				});
+
+				auth_provider.set({
+					httpOnly: true,
+					maxAge: COOKIE_DURATION,
+					path: '/',
+					sameSite: 'lax',
+					secure: true,
+					value: provider
+				});
+
+				const currentState = generateState();
+
+				state.set({
+					httpOnly: true,
+					maxAge: COOKIE_DURATION,
+					path: '/',
+					sameSite: 'lax',
+					secure: true,
+					value: currentState
+				});
+
+				const usesCodeVerifier = providerInstance.createAuthorizationURL
+					.toString()
+					.includes('codeVerifier');
+				const verifier = usesCodeVerifier
+					? generateCodeVerifier()
+					: undefined;
+				void (
+					usesCodeVerifier &&
+					code_verifier.set({
+						httpOnly: true,
+						maxAge: COOKIE_DURATION,
+						path: '/',
+						sameSite: 'lax',
+						secure: true,
+						value: verifier ?? ''
+					})
+				);
+
+				const authorizationURL = usesCodeVerifier
+					? providerInstance.createAuthorizationURL(
+							currentState,
+							// @ts-expect-error - This is a dynamic check
+							verifier,
+							scopes
+						)
+					: // @ts-expect-error - This is a dynamic check
+						providerInstance.createAuthorizationURL(
+							currentState,
+							scopes
+						);
+
+				searchParams.forEach(([key, value]) => {
+					authorizationURL.searchParams.set(key, value);
+				});
+
+				onAuthorize?.();
+
+				return redirect(authorizationURL.toString());
+			} catch (err) {
+				if (err instanceof Error) {
+					return error(
+						'Internal Server Error',
+						`${err.message} - ${err.stack ?? ''}`
+					);
+				}
+
+				return error('Internal Server Error', `Unknown error: ${err}`);
+			}
+		}
+	);

package/src/callback.ts

@@ -0,0 +1,127 @@
+import { decodeIdToken } from 'arctic';
+import { Elysia } from 'elysia';
+import { sessionStore } from './sessionStore';
+import { isNonEmptyString, isValidProviderKey } from './typeGuards';
+import { ClientProviders, OnCallback } from './types';
+
+type CallbackProps<UserType> = {
+	clientProviders: ClientProviders;
+	callbackRoute?: string;
+	onCallback?: OnCallback<UserType>;
+};
+
+export const callback = <UserType>({
+	clientProviders,
+	callbackRoute = 'authorize/callback',
+	onCallback
+}: CallbackProps<UserType>) =>
+	new Elysia()
+		.use(sessionStore<UserType>())
+		.get(
+			`/${callbackRoute}`,
+			async ({
+				error,
+				redirect,
+				store: { session },
+				cookie: {
+					state: stored_state,
+					code_verifier,
+					redirect_url,
+					user_session_id,
+					auth_provider
+				},
+				query: { code, state: callback_state }
+			}) => {
+				if (
+					!isNonEmptyString(code) ||
+					stored_state.value === undefined
+				) {
+					return error('Bad Request', 'Invalid callback request');
+				}
+
+				if (callback_state !== stored_state.value) {
+					return error('Bad Request', 'Invalid state mismatch');
+				}
+
+				if (auth_provider.value === undefined) {
+					return error('Unauthorized', 'No auth provider found');
+				}
+
+				if (!isValidProviderKey(auth_provider.value)) {
+					return error('Unauthorized', 'Invalid provider');
+				}
+
+				const normalizedProvider = auth_provider.value.toLowerCase();
+				const { providerInstance } =
+					clientProviders[normalizedProvider];
+
+				try {
+					// Clear the stored state so the next request doesn't use it
+					stored_state.remove();
+
+					const hasCodeVerifier =
+						providerInstance.validateAuthorizationCode
+							.toString()
+							.includes('codeVerifier');
+					const verifier = code_verifier.value;
+					if (hasCodeVerifier && verifier === undefined)
+						return error(
+							'Bad Request',
+							'Code verifier not found and is required'
+						);
+
+					const safeVerifier = verifier ?? '';
+					const tokens = await (hasCodeVerifier
+						? providerInstance.validateAuthorizationCode(
+								code,
+								safeVerifier
+							)
+						: // @ts-expect-error - This is a dynamic check
+							providerInstance.validateAuthorizationCode(code));
+					if (hasCodeVerifier) code_verifier.remove();
+
+					const decodedIdToken = Object.fromEntries(
+						Object.entries(decodeIdToken(tokens.idToken())).map(
+							([key, value]) => [
+								key,
+								typeof value === 'string' ? value : undefined
+							]
+						)
+					);
+
+					const authProvider = auth_provider.value;
+
+					console.log(
+						'in route user_session_id before',
+						user_session_id.value
+					);
+
+					await onCallback?.({
+						authProvider,
+						decodedIdToken,
+						session,
+						user_session_id
+					});
+
+					console.log(
+						'in route user_session_id after',
+						user_session_id.value
+					);
+
+					const redirectUrl = redirect_url.value ?? '/';
+
+					return redirect(redirectUrl);
+				} catch (err) {
+					if (err instanceof Error)
+						return error(
+							'Internal Server Error',
+							`${err.message} - ${err.stack ?? ''}`
+						);
+
+					return error(
+						'Internal Server Error',
+						`Failed to validate authorization code: Unknown error: ${err}`
+					);
+				}
+			}
+		);

package/src/constants.ts

@@ -0,0 +1,13 @@
+export const SECONDS_IN_A_MINUTE = 60;
+export const MILLISECONDS_IN_A_SECOND = 1000;
+export const MILLISECONDS_IN_A_MINUTE =
+	MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE;
+export const MINUTES_IN_AN_HOUR = 60;
+export const HOURS_IN_A_DAY = 24;
+export const MILLISECONDS_IN_A_DAY =
+	MILLISECONDS_IN_A_SECOND *
+	SECONDS_IN_A_MINUTE *
+	MINUTES_IN_AN_HOUR *
+	HOURS_IN_A_DAY;
+export const COOKIE_MINUTES = 30; // TODO : See if i can remove
+export const COOKIE_DURATION = SECONDS_IN_A_MINUTE * COOKIE_MINUTES;

package/src/index.ts

@@ -0,0 +1,88 @@
+import { OAuth2RequestError, ArcticFetchError } from 'arctic';
+import { Elysia } from 'elysia';
+import { authorize } from './authorize';
+import { callback } from './callback';
+import { logout } from './logout';
+import { protectRoute } from './protectRoute';
+import { normalizedProviderKeys, providers } from './providers';
+import { refresh } from './refresh';
+import { revoke } from './revoke';
+import { status } from './status';
+import { isValidProviderKey } from './typeGuards';
+import { AbsoluteAuthProps, ClientProviders } from './types';
+
+export const absoluteAuth = <UserType>({
+	config,
+	authorizeRoute,
+	callbackRoute,
+	logoutRoute,
+	statusRoute,
+	refreshRoute,
+	revokeRoute,
+	onAuthorize,
+	onCallback,
+	onStatus,
+	onRefresh,
+	onLogout,
+	onRevoke
+}: AbsoluteAuthProps<UserType>) => {
+	const clientProviders = Object.keys(config).reduce<ClientProviders>(
+		(acc, key) => {
+			if (!Object.prototype.hasOwnProperty.call(config, key)) return acc;
+
+			if (!isValidProviderKey(key)) {
+				console.error(`Provider ${key} is not supported`);
+
+				return acc;
+			}
+
+			const options = config[key];
+			if (!options) return acc;
+
+			const normalizedProvider = key.toLowerCase();
+			const originalProviderKey =
+				normalizedProviderKeys[normalizedProvider];
+
+			if (!isValidProviderKey(originalProviderKey)) {
+				console.error(`Provider ${key} is not supported`);
+
+				return acc;
+			}
+
+			const Provider = providers[originalProviderKey];
+			const { credentials, scopes = [], searchParams = [] } = options;
+
+			// @ts-expect-error: dynamic constructor parameters
+			const providerInstance = new Provider(...credentials);
+
+			acc[normalizedProvider] = {
+				providerInstance,
+				scopes,
+				searchParams
+			};
+
+			return acc;
+		},
+		{}
+	);
+
+	return new Elysia()
+		.error('OAUTH2_REQUEST_ERROR', OAuth2RequestError)
+		.error('ARCTIC_FETCH_ERROR', ArcticFetchError)
+		.use(logout({ logoutRoute, onLogout }))
+		.use(revoke({ clientProviders, onRevoke, revokeRoute }))
+		.use(status<UserType>({ clientProviders, onStatus, statusRoute }))
+		.use(refresh({ clientProviders, onRefresh, refreshRoute }))
+		.use(authorize({ authorizeRoute, clientProviders, onAuthorize }))
+		.use(
+			callback<UserType>({
+				callbackRoute,
+				clientProviders,
+				onCallback
+			})
+		)
+		.use(protectRoute())
+		.as('plugin');
+};
+
+export * from './utils';

package/src/logout.ts

@@ -0,0 +1,39 @@
+import { Elysia } from 'elysia';
+
+type LogoutProps = {
+	logoutRoute?: string;
+	onLogout?: () => void;
+};
+
+export const logout = ({ logoutRoute = 'logout', onLogout }: LogoutProps) =>
+	new Elysia().post(
+		`/${logoutRoute}`,
+		async ({ error, cookie: { user_session_id, auth_provider } }) => {
+			if (auth_provider.value === undefined) {
+				return error('Unauthorized', 'No auth provider found');
+			}
+
+			try {
+				onLogout?.();
+
+				user_session_id.remove();
+				auth_provider.remove();
+
+				return new Response('Succesfuly Logged Out', {
+					status: 204
+				});
+			} catch (err) {
+				if (err instanceof Error) {
+					return error(
+						'Internal Server Error',
+						`Failed to logout: ${err.message}`
+					);
+				}
+
+				return error(
+					'Internal Server Error',
+					`Failed to logout: Unknown error: ${err}`
+				);
+			}
+		}
+	);

package/src/protectRoute.ts

@@ -0,0 +1,33 @@
+import { Elysia } from 'elysia';
+import { sessionStore } from './sessionStore';
+
+export const protectRoute = <UserType>() =>
+	new Elysia()
+		.use(sessionStore<UserType>())
+		.derive(
+			({ store: { session }, cookie: { user_session_id }, error }) => ({
+				protectRoute: async (
+					handleAuth: () => Promise<Response>,
+					handleAuthFail?: () => Promise<Response>
+				) => {
+					if (user_session_id.value === undefined) {
+						return (
+							handleAuthFail?.() ??
+							error('Unauthorized', 'No session ID found')
+						);
+					}
+
+					const userSession = session[user_session_id.value];
+
+					if (userSession === undefined) {
+						return (
+							handleAuthFail?.() ??
+							error('Unauthorized', 'No session found')
+						);
+					}
+
+					return handleAuth();
+				}
+			})
+		)
+		.as('plugin');

package/src/providers.ts

@@ -0,0 +1,109 @@
+import {
+	AmazonCognito,
+	AniList,
+	Apple,
+	Atlassian,
+	Auth0,
+	Authentik,
+	Bitbucket,
+	Box,
+	Coinbase,
+	Discord,
+	Dribbble,
+	Dropbox,
+	Facebook,
+	Figma,
+	Intuit,
+	GitHub,
+	GitLab,
+	Google,
+	Kakao,
+	KeyCloak,
+	Lichess,
+	Line,
+	Linear,
+	LinkedIn,
+	MicrosoftEntraId,
+	MyAnimeList,
+	Notion,
+	Okta,
+	Osu,
+	Patreon,
+	Reddit,
+	Roblox,
+	Salesforce,
+	Shikimori,
+	Slack,
+	Spotify,
+	Strava,
+	Tiltify,
+	Tumblr,
+	Twitch,
+	Twitter,
+	VK,
+	WorkOS,
+	Yahoo,
+	Yandex,
+	Zoom,
+	FortyTwo
+} from 'arctic';
+
+// TODO: When arctic adds better way to get the providers give a type to the object
+// eslint-disable-next-line custom/explicit-object-types
+export const providers = {
+	AmazonCognito,
+	AniList,
+	Apple,
+	Atlassian,
+	Auth0,
+	Authentik,
+	Bitbucket,
+	Box,
+	Coinbase,
+	Discord,
+	Dribbble,
+	Dropbox,
+	Facebook,
+	Figma,
+	FortyTwo,
+	GitHub,
+	GitLab,
+	Google,
+	Intuit,
+	Kakao,
+	KeyCloak,
+	Lichess,
+	Line,
+	Linear,
+	LinkedIn,
+	MicrosoftEntraId,
+	MyAnimeList,
+	Notion,
+	Okta,
+	Osu,
+	Patreon,
+	Reddit,
+	Roblox,
+	Salesforce,
+	Shikimori,
+	Slack,
+	Spotify,
+	Strava,
+	Tiltify,
+	Tumblr,
+	Twitch,
+	Twitter,
+	VK,
+	WorkOS,
+	Yahoo,
+	Yandex,
+	Zoom
+};
+
+export const normalizedProviderKeys = Object.keys(providers).reduce<
+	Record<string, string>
+>((map, key) => {
+	map[key.toLowerCase()] = key;
+
+	return map;
+}, {});

package/src/refresh.ts

@@ -0,0 +1,63 @@
+import { Elysia } from 'elysia';
+import { isRefreshableProvider } from './typeGuards';
+import { ClientProviders } from './types';
+
+type RefreshProps = {
+	clientProviders: ClientProviders;
+	refreshRoute?: string;
+	onRefresh?: () => void;
+};
+
+export const refresh = ({
+	clientProviders,
+	refreshRoute = 'refresh',
+	onRefresh
+}: RefreshProps) =>
+	new Elysia().post(
+		`/${refreshRoute}`,
+		async ({ error, cookie: { user_refresh_token, auth_provider } }) => {
+			if (user_refresh_token.value === undefined) {
+				return error('Unauthorized', 'No refresh token found');
+			}
+
+			if (auth_provider.value === undefined) {
+				return error('Unauthorized', 'No auth provider found');
+			}
+
+			const normalizedProvider = auth_provider.value.toLowerCase();
+			const { providerInstance } = clientProviders[normalizedProvider];
+
+			if (!isRefreshableProvider(providerInstance)) {
+				return error('Not Implemented', 'Provider is not refreshable');
+			}
+
+			try {
+				//consider passing tokens to onRefresh
+				// const tokens = await providerInstance.refreshAccessToken(
+				// 	user_refresh_token.value
+				// );
+
+				await providerInstance.refreshAccessToken(
+					user_refresh_token.value
+				);
+
+				onRefresh?.();
+
+				return new Response('Token refreshed', {
+					status: 204
+				});
+			} catch (err) {
+				if (err instanceof Error) {
+					return error(
+						'Internal Server Error',
+						`Failed to refresh token: ${err.message}`
+					);
+				}
+
+				return error(
+					'Internal Server Error',
+					`Faile to refresh token: Unknown error: ${err}`
+				);
+			}
+		}
+	);

package/src/revoke.ts

@@ -0,0 +1,61 @@
+import { Elysia } from 'elysia';
+import { isRevocableProvider } from './typeGuards';
+import { ClientProviders } from './types';
+
+type RevokeProps = {
+	clientProviders: ClientProviders;
+	revokeRoute?: string;
+	onRevoke?: () => void;
+};
+
+export const revoke = ({
+	clientProviders,
+	revokeRoute = 'revoke',
+	onRevoke
+}: RevokeProps) =>
+	new Elysia().post(
+		`/${revokeRoute}/access-token`,
+		async ({ error, cookie: { user_refresh_token, auth_provider } }) => {
+			if (user_refresh_token.value === undefined) {
+				return error('Unauthorized', 'No refresh token found');
+			}
+
+			if (auth_provider.value === undefined) {
+				return error('Unauthorized', 'No auth provider found');
+			}
+
+			const normalizedProvider = auth_provider.value.toLowerCase();
+			const { providerInstance } = clientProviders[normalizedProvider];
+
+			if (!isRevocableProvider(providerInstance)) {
+				return error(
+					'Not Implemented',
+					'Provider does not support revocation'
+				);
+			}
+
+			try {
+				await providerInstance.revokeAccessToken(
+					user_refresh_token.value
+				);
+
+				onRevoke?.();
+
+				return new Response('Token revoked', {
+					status: 204
+				});
+			} catch (err) {
+				if (err instanceof Error) {
+					return error(
+						'Internal Server Error',
+						`Failed to revoke token: ${err.message}`
+					);
+				}
+
+				return error(
+					'Internal Server Error',
+					`Failed to revoke token: Unknown error: ${err}`
+				);
+			}
+		}
+	);

package/src/sessionStore.ts

@@ -0,0 +1,10 @@
+import { Elysia } from 'elysia';
+import { SessionRecord } from './types';
+
+export const sessionStore = <UserType>() => {
+	const initialSession: SessionRecord<UserType> = {};
+
+	return new Elysia({ name: 'sessionStore' }).state({
+		session: initialSession
+	});
+};