@absolutejs/auth 0.50.0 → 0.52.0

package/dist/routes/authorize.d.ts

@@ -28,7 +28,7 @@ export declare const authorize: ({ clientProviders, authorizeRoute, cookieSecure
             get: {
                 body: unknown;
                 params: {
-                    provider: "42" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "battlenet" | "bitbucket" | "box" | "bungie" | "calendly" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "notion" | "okta" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "slackuser" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom";
+                    provider: string;
                 };
                 query: {
                     client?: string | undefined;
@@ -60,7 +60,7 @@ export declare const authorize: ({ clientProviders, authorizeRoute, cookieSecure
                 get: {
                     body: unknown;
                     params: {
-                        provider: "42" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "battlenet" | "bitbucket" | "box" | "bungie" | "calendly" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "notion" | "okta" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "slackuser" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom";
+                        provider: string;
                     };
                     query: {
                         client?: string | undefined;

package/dist/typebox.d.ts

@@ -1,6 +1,4 @@
 export declare const authClientOption: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 export declare const authIntentOption: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"login">, import("@sinclair/typebox").TLiteral<"link_identity">, import("@sinclair/typebox").TLiteral<"link_connector">]>>;
-export declare const authProviderOption: import("@sinclair/typebox").TEnum<{
-    [k: string]: "42" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "battlenet" | "bitbucket" | "box" | "bungie" | "calendly" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "notion" | "okta" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "slackuser" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom";
-}>;
+export declare const authProviderOption: import("@sinclair/typebox").TString;
 export declare const userSessionIdTypebox: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TTemplateLiteralSyntax<"${string}-${string}-${string}-${string}-${string}">>;

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-import { CredentialsFor, NonEmptyArray, OAuth2Client, OAuth2TokenResponse, ProviderOption, ProvidersMap } from 'citra';
+import { CredentialsFor, CustomProviderCredentials, NonEmptyArray, OAuth2Client, OAuth2TokenResponse, ProviderConfig, ProviderOption, ProvidersMap } from 'citra';
 import { Cookie, status as statusType, redirect as redirectType } from 'elysia';
 import { ElysiaCustomStatusResponse } from 'elysia/error';
 import type { ApiKeysConfig } from './apikeys/config';
@@ -35,6 +35,20 @@ export type OAuth2ProviderConfiguration<Provider extends ProviderOption> = OAuth
 export type OAuth2ConfigurationOptions = {
     [Provider in ProviderOption]?: OAuth2ProviderConfiguration<Provider>;
 };
+/** One client of a caller-defined (custom) OAuth provider: the full citra
+ *  ProviderConfig plus this app's credentials. Same optional scope /
+ *  searchParams knobs as built-in provider clients. */
+export type CustomProviderClientConfiguration = {
+    credentials: CustomProviderCredentials;
+    providerConfig: ProviderConfig;
+    scope?: string[];
+    searchParams?: [string, string][];
+};
+/** Caller-defined providers keyed by YOUR provider name (any key that isn't a
+ *  built-in citra provider). Single client or named client variants — the same
+ *  shape as providersConfiguration. Registered providers get the full route
+ *  set (authorize/callback/refresh/revoke/linked-providers) like built-ins. */
+export type CustomProvidersConfiguration = Record<string, CustomProviderClientConfiguration | Record<string, CustomProviderClientConfiguration>>;
 export type UserSessionId = `${string}-${string}-${string}-${string}-${string}`;
 /** Stamped on a session created via admin impersonation (`startImpersonation`). RFC 8693
  *  actor semantics: `actorId`/`actorEmail` are the admin acting as the user, `reason` is
@@ -117,7 +131,11 @@ export type CallbackCookie = Record<string, Cookie<unknown>> & {
 };
 export type CallbackContext<UserType> = {
     providerInstance: OAuth2Client<ProviderOption>;
-    authProvider: ProviderOption;
+    /** Configured provider name — a built-in citra key or a customProviders key. */
+    authProvider: string;
+    /** The provider's citra config — pass to instantiateUserSession so identity
+     *  extraction works for custom providers too. */
+    providerConfiguration: ProviderConfig;
     authClient?: string;
     authIntent: AuthIntent;
     tokenResponse: OAuth2TokenResponse;
@@ -131,7 +149,7 @@ export type CallbackContext<UserType> = {
     redirect: typeof redirectType;
 };
 export type ResolveAuthIntent<UserType> = (({ authProvider, authClient, originUrl, session, userSessionId, currentUser }: {
-    authProvider: ProviderOption;
+    authProvider: string;
     authClient?: string;
     originUrl: string;
     session: SessionRecord<UserType>;
@@ -220,6 +238,9 @@ export type AuthConfig<UserType> = {
      *  `protectRoute`'s context. */
     getUser: (sub: string) => UserType | null | Promise<UserType | null>;
     providersConfiguration: OAuth2ConfigurationOptions;
+    /** Bring-your-own OAuth providers (citra createCustomOAuth2Client) — keys
+     *  must not collide with built-in provider names. */
+    customProviders?: CustomProvidersConfiguration;
     /** Override the `Secure` attribute on every cookie the package sets (session, OAuth state,
      *  code_verifier, SSO nonce, ring, etc.). When omitted, defaults to
      *  `process.env.NODE_ENV === 'production'` — matching the convention used by
@@ -361,6 +382,8 @@ export type AuthConfig<UserType> = {
  *  `auth({ ...defineAuthSettings({...}), authSessionStore, providersConfiguration })`. */
 export type AuthSettings = Pick<AuthConfig<unknown>, 'authorizeRoute' | 'callbackRoute' | 'cleanupIntervalMs' | 'maxSessions' | 'profileRoute' | 'refreshRoute' | 'revokeRoute' | 'sessionDurationMs' | 'signoutRoute' | 'statusRoute' | 'unregisteredSessionDurationMs'>;
 export type ClientProviderEntry = {
+    providerConfiguration: ProviderConfig;
+    requiresPKCE: boolean;
     clientName?: string;
     providerInstance: OAuth2Client<ProviderOption>;
     scope?: string[];
@@ -372,7 +395,9 @@ export type ClientProviderGroup = {
 };
 export type ClientProviders = Record<string, ClientProviderGroup>;
 export type InsantiateUserSessionProps<UserType> = {
-    authProvider: ProviderOption;
+    authProvider: string;
+    /** Required for custom providers (names outside the citra registry). */
+    providerConfiguration?: ProviderConfig;
     tokenResponse: OAuth2TokenResponse;
     session: SessionRecord<UserType>;
     unregisteredSession: UnregisteredSessionRecord;

package/dist/utils.d.ts

@@ -1,4 +1,4 @@
-import { OAuth2Client, OAuth2TokenResponse, ProviderOption } from 'citra';
+import { OAuth2Client, OAuth2TokenResponse, ProviderConfig, ProviderOption } from 'citra';
 import { Cookie } from 'elysia';
 import { AuthHtmxConfig } from './htmx/types';
 import { AuthConfig, AuthSettings, InsantiateUserSessionProps, OAuth2ConfigurationOptions, ResolvedOAuthAuthorization, SessionRecord, UnregisteredSessionRecord, UserSessionId } from './types';
@@ -16,10 +16,11 @@ export declare const getStatus: <UserType>(session: SessionRecord<UserType>, use
     error: null;
     user: NonNullable<UserType> | null;
 }>;
-export declare const instantiateUserSession: <UserType>({ authProvider, cookieSecure, session, user_session_id, unregisteredSession, tokenResponse, providerInstance, getUser, onNewUser, resolvedAuthorization, sessionDurationMs, unregisteredSessionDurationMs }: InsantiateUserSessionProps<UserType>) => Promise<Response | import("./types").StatusReturn | undefined>;
+export declare const instantiateUserSession: <UserType>({ authProvider, providerConfiguration, cookieSecure, session, user_session_id, unregisteredSession, tokenResponse, providerInstance, getUser, onNewUser, resolvedAuthorization, sessionDurationMs, unregisteredSessionDurationMs }: InsantiateUserSessionProps<UserType>) => Promise<Response | import("./types").StatusReturn | undefined>;
 export declare const resolveCookieSecure: (override?: boolean) => boolean;
-export declare const resolveOAuthAuthorization: ({ authProvider, providerInstance, tokenResponse, now }: {
-    authProvider: ProviderOption;
+export declare const resolveOAuthAuthorization: ({ authProvider, providerConfiguration, providerInstance, tokenResponse, now }: {
+    authProvider: string;
+    providerConfiguration?: ProviderConfig;
     providerInstance: OAuth2Client<ProviderOption>;
     tokenResponse: OAuth2TokenResponse;
     now?: number;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.50.0",
+	"version": "0.52.0",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -75,7 +75,7 @@
 	"dependencies": {
 		"@absolutejs/linked-providers": "0.0.2",
 		"@neondatabase/serverless": "1.0.0",
-		"citra": "0.28.12"
+		"citra": "0.29.1"
 	},
 	"devDependencies": {
 		"@absolutejs/absolute": "^0.19.0-beta.1023",