@absolutejs/auth 0.50.0 → 0.52.0

package/dist/index.d.ts

@@ -12,7 +12,7 @@ import { AuthConfig } from './types';
  *  `UserType`); the routes are reached by path at runtime / direct fetch. */
 type MergeAuthContext<Base, Extra> = Base extends Elysia<infer Path, infer Singleton, infer Definitions, infer Metadata, infer Routes, infer Ephemeral, infer Volatile> ? Extra extends Elysia<infer ExtraPath, infer ExtraSingleton, infer ExtraDefinitions, infer ExtraMetadata, infer ExtraRoutes, infer ExtraEphemeral, infer ExtraVolatile> ? Elysia<Path & ExtraPath, Singleton & ExtraSingleton, Definitions & ExtraDefinitions, Metadata & ExtraMetadata, Routes & ExtraRoutes, Ephemeral & ExtraEphemeral, Volatile & ExtraVolatile> : never : never;
 export type AuthInstance<UserType> = MergeAuthContext<ReturnType<typeof protectRoutePlugin<UserType>>, ReturnType<typeof stepUpPlugin<UserType>>>;
-export declare const auth: <UserType>({ providersConfiguration, authorizeRoute, cookieSecure, callbackRoute, profileRoute, signoutRoute, statusRoute, refreshRoute, revokeRoute, cleanupIntervalMs, maxSessions, sessionDurationMs, authSessionStore, audit, credentials, mfa, passwordless, lockout, sessions, sso, scim, apikeys, oidc, organizations, roles, portal, authorization, compliance, webauthn, webhooks, htmx, tracing, resolveAuthIntent, onAuthorizeSuccess, onAuthorizeError, onProfileSuccess, onProfileError, onCallbackSuccess, onLinkIdentity, onLinkIdentityConflict, onLinkConnector, onCallbackError, onStatus, onRefreshSuccess, onRefreshError, onSignOut, onRevocationSuccess, onRevocationError, onSessionCleanup }: AuthConfig<UserType>) => Promise<Elysia<"", {
+export declare const auth: <UserType>({ providersConfiguration, authorizeRoute, cookieSecure, callbackRoute, profileRoute, signoutRoute, statusRoute, refreshRoute, revokeRoute, cleanupIntervalMs, maxSessions, sessionDurationMs, authSessionStore, audit, credentials, customProviders, mfa, passwordless, lockout, sessions, sso, scim, apikeys, oidc, organizations, roles, portal, authorization, compliance, webauthn, webhooks, htmx, tracing, resolveAuthIntent, onAuthorizeSuccess, onAuthorizeError, onProfileSuccess, onProfileError, onCallbackSuccess, onLinkIdentity, onLinkIdentityConflict, onLinkConnector, onCallbackError, onStatus, onRefreshSuccess, onRefreshError, onSignOut, onRevocationSuccess, onRevocationError, onSessionCleanup }: AuthConfig<UserType>) => Promise<Elysia<"", {
     decorator: {};
     store: {
         session: import("./types").SessionRecord<UserType>;
@@ -127,8 +127,8 @@ export { resolveAuthHtmxRenderers } from './htmx/renderers';
 export type { AuthHtmxConfig, AuthHtmxConnectorTarget, AuthHtmxProviderData, AuthHtmxProviderInfo, AuthHtmxRenderOverrides, AuthHtmxRenderersConfig, AuthHtmxUser, AuthIdentityPayload, LinkedProviderPayload } from './htmx/types';
 export * from './utils';
 export { buildClientProviders, resolveClientProviderEntry, resolveProviderClientConfiguration } from './providers/clients';
-export type { OAuth2TokenResponse, OAuth2Client, ProviderOption, PKCEProvider, OIDCProvider, RefreshableProvider, RevocableProvider, ScopeRequiredProvider, ProvidersMap, ProviderConfiguration, CredentialsFor } from 'citra';
-export { providers, providerOptions, refreshableProviderOptions, revocableProviderOptions, oidcProviderOptions, pkceProviderOptions, scopeRequiredProviderOptions, decodeJWT, extractPropFromIdentity, isValidProviderOption, isRefreshableOAuth2Client, isRefreshableProviderOption, isOIDCProviderOption, isPKCEProviderOption, isRevocableProviderOption, isRevocableOAuth2Client } from 'citra';
+export type { OAuth2TokenResponse, OAuth2Client, OAuth2ClientForConfig, CustomProviderCredentials, ProviderConfig, ProviderOption, PKCEProvider, OIDCProvider, RefreshableProvider, RevocableProvider, ScopeRequiredProvider, ProvidersMap, ProviderConfiguration, CredentialsFor } from 'citra';
+export { providers, providerOptions, createCustomOAuth2Client, defineProvider, refreshableProviderOptions, revocableProviderOptions, oidcProviderOptions, pkceProviderOptions, scopeRequiredProviderOptions, decodeJWT, extractPropFromIdentity, isValidProviderOption, isRefreshableOAuth2Client, isRefreshableProviderOption, isOIDCProviderOption, isPKCEProviderOption, isRevocableProviderOption, isRevocableOAuth2Client } from 'citra';
 export * from './crypto';
 export * from './tenancy';
 export * from './credentials/config';

package/dist/index.js

@@ -262,6 +262,7 @@ var anilistProfileQuery = `query {
   }
 }`;
 var defineProviders = (providers) => providers;
+var defineProvider = (config) => config;
 var providers = defineProviders({
   "42": {
     authorizationUrl: "https://api.intra.42.fr/oauth/authorize",
@@ -1347,6 +1348,37 @@ var providers = defineProviders({
       url: (config) => `https://${config.domain}/oauth2/default/v1/token`
     }
   },
+  onspark: {
+    authorizationUrl: "https://app.onspark.com/oauth2/authorize",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://app.onspark.com/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://app.onspark.com/oauth2/revoke"
+    },
+    scopeRequired: true,
+    subject: ["sub"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://app.onspark.com/oauth2/token"
+    }
+  },
   osu: {
     authorizationUrl: "https://osu.ppy.sh/oauth/authorize",
     isOIDC: false,
@@ -1898,6 +1930,7 @@ var providers = defineProviders({
       method: "POST",
       url: "https://wbsapi.withings.net/v2/oauth2"
     },
+    scopeDelimiter: ",",
     scopeRequired: true,
     subject: ["userid"],
     subjectType: "string",
@@ -2529,8 +2562,7 @@ var refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProv
 var revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);
 var scopeRequiredProviderOptions = Object.keys(providers).filter(isScopeRequiredProviderOption);
 var readPath = (value, path) => path.reduce((cursor, key) => cursor && typeof cursor === "object" ? Reflect.get(cursor, key) : undefined, value);
-var createOAuth2Client = async (providerName, config) => {
-  const meta = providers[providerName];
+var buildOAuth2Client = async (meta, config) => {
   const isConfigPropertyFunction = (cfgProp) => typeof cfgProp === "function";
   const resolveConfigProp = async (cfgProp) => {
     const result = isConfigPropertyFunction(cfgProp) ? cfgProp(config) : cfgProp;
@@ -2549,8 +2581,7 @@ var createOAuth2Client = async (providerName, config) => {
       if (state)
         url.searchParams.set("state", state);
       if (scope.length !== 0) {
-        const delimeter = providerName === "withings" ? "," : " ";
-        url.searchParams.set(meta.scopeParamName ?? "scope", scope.join(delimeter));
+        url.searchParams.set(meta.scopeParamName ?? "scope", scope.join(meta.scopeDelimiter ?? " "));
       }
       if (meta.PKCEMethod !== undefined) {
         if (!codeVerifier) {
@@ -2732,6 +2763,8 @@ var createOAuth2Client = async (providerName, config) => {
     }
   };
 };
+var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Client(providerConfig, credentials);
+var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
 
 // src/index.ts
 import { Elysia as Elysia40 } from "elysia";
@@ -3201,7 +3234,7 @@ var authIntentOption = t2.Optional(t2.Union([
   t2.Literal("link_identity"),
   t2.Literal("link_connector")
 ]));
-var authProviderOption = t2.Enum(Object.fromEntries(Object.keys(providers).filter(isValidProviderOption).map((key) => [key, key])));
+var authProviderOption = t2.String({ minLength: 1 });
 var userSessionIdTypebox = t2.Optional(t2.TemplateLiteral("${string}-${string}-${string}-${string}-${string}"));
 
 // src/authorization/protectPermission.ts
@@ -3273,6 +3306,7 @@ var getStatus = async (session, user_session_id) => {
 };
 var instantiateUserSession = async ({
   authProvider,
+  providerConfiguration,
   cookieSecure,
   session,
   user_session_id,
@@ -3287,6 +3321,7 @@ var instantiateUserSession = async ({
 }) => {
   const authorization = resolvedAuthorization ?? await resolveOAuthAuthorization({
     authProvider,
+    providerConfiguration,
     providerInstance,
     tokenResponse
   });
@@ -3331,23 +3366,28 @@ var instantiateUserSession = async ({
 var resolveCookieSecure = (override) => override ?? false;
 var resolveOAuthAuthorization = async ({
   authProvider,
+  providerConfiguration,
   providerInstance,
   tokenResponse,
   now = Date.now()
 }) => {
+  const meta = providerConfiguration ?? (isValidProviderOption(authProvider) ? providers[authProvider] : undefined);
+  if (!meta) {
+    throw new Error(`No provider configuration for "${authProvider}" \u2014 pass providerConfiguration (custom provider) or resolvedAuthorization`);
+  }
   let userIdentity;
   let accessToken = tokenResponse.access_token;
   let refreshToken = tokenResponse.refresh_token;
   if (tokenResponse.id_token) {
     userIdentity = normalizeProviderIdentity({
       identity: decodeJWT(tokenResponse.id_token),
-      providerConfiguration: providers[authProvider],
+      providerConfiguration: meta,
       source: "idToken"
     });
-  } else if (providers[authProvider].subjectBySource?.tokenResponse) {
+  } else if (meta.subjectBySource?.tokenResponse) {
     userIdentity = normalizeProviderIdentity({
       identity: tokenResponse,
-      providerConfiguration: providers[authProvider],
+      providerConfiguration: meta,
       source: "tokenResponse"
     });
   } else if (authProvider === "withings") {
@@ -3357,7 +3397,7 @@ var resolveOAuthAuthorization = async ({
   } else {
     userIdentity = normalizeProviderIdentity({
       identity: await providerInstance.fetchUserProfile(tokenResponse.access_token),
-      providerConfiguration: providers[authProvider],
+      providerConfiguration: meta,
       source: "profile"
     });
   }
@@ -6911,6 +6951,21 @@ var oidcProviderRoutes = (config) => {
       return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
+    if (config.consentUrl !== undefined && await config.needsConsent?.({
+      client: {
+        clientId: client.clientId,
+        name: client.name
+      },
+      requestedScopes: requested,
+      user: userSession.user
+    }) === true) {
+      const consentTarget = new URL(config.consentUrl, issuer);
+      consentTarget.searchParams.set("return_to", request.url);
+      consentTarget.searchParams.set("client_id", client.clientId);
+      consentTarget.searchParams.set("client_name", client.name);
+      consentTarget.searchParams.set("scope", requested.join(" "));
+      return redirectTo(consentTarget.toString());
+    }
     const granted = getGrantedScopes === undefined ? requested : await getGrantedScopes({
       client: {
         clientId: client.clientId,
@@ -7409,7 +7464,7 @@ var oidcProviderRoutes = (config) => {
     headers: t13.Object({
       authorization: t13.Optional(t13.String())
     })
-  }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery);
+  }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
 };
 
 // src/organizations/routes.ts
@@ -8267,7 +8322,52 @@ var roleRoutes = ({
 // src/providers/clients.ts
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isProviderClientConfig = (value) => isRecord(value) && ("credentials" in value);
-var buildClientProviders = async (providersConfiguration, createOAuth2ClientFn) => {
+var isCustomClientConfig = (value) => isRecord(value) && ("credentials" in value) && ("providerConfig" in value);
+var normalizeCustomClients = (providerName, providerConfig) => {
+  if (isCustomClientConfig(providerConfig))
+    return { "": providerConfig };
+  if (!isRecord(providerConfig) || Object.keys(providerConfig).length === 0) {
+    throw new Error(`Invalid custom provider configuration for ${providerName}`);
+  }
+  Object.entries(providerConfig).forEach(([clientName, clientConfig]) => {
+    if (!isCustomClientConfig(clientConfig)) {
+      throw new Error(`Invalid custom client configuration for ${providerName}.${clientName}`);
+    }
+  });
+  return providerConfig;
+};
+var buildCustomProviderGroups = async (customProviders) => {
+  const groups = await Promise.all(Object.entries(customProviders).map(async ([providerName, config]) => {
+    if (isValidProviderOption(providerName)) {
+      throw new Error(`Custom provider "${providerName}" collides with a built-in provider \u2014 configure it under providersConfiguration instead`);
+    }
+    const clients = normalizeCustomClients(providerName, config);
+    const entries = await Promise.all(Object.entries(clients).map(async ([clientName, clientConfig]) => {
+      const providerInstance = await createCustomOAuth2Client(clientConfig.providerConfig, clientConfig.credentials);
+      return [
+        clientName,
+        {
+          clientName: clientName.length > 0 ? clientName : undefined,
+          providerConfiguration: clientConfig.providerConfig,
+          providerInstance,
+          requiresPKCE: clientConfig.providerConfig.PKCEMethod !== undefined,
+          scope: clientConfig.scope,
+          searchParams: clientConfig.searchParams
+        }
+      ];
+    }));
+    return [
+      providerName,
+      {
+        entries: Object.fromEntries(entries),
+        isSingleClient: entries.length === 1 && entries[0]?.[0] === ""
+      }
+    ];
+  }));
+  return Object.fromEntries(groups);
+};
+var buildClientProviders = async (providersConfiguration, createOAuth2ClientFn, customProviders) => {
+  const customGroups = customProviders ? await buildCustomProviderGroups(customProviders) : {};
   const normalized = normalizeProvidersConfiguration(providersConfiguration);
   const groups = await Promise.all(Object.entries(normalized).map(async ([providerName, clients]) => {
     if (!isValidProviderOption(providerName)) {
@@ -8279,7 +8379,9 @@ var buildClientProviders = async (providersConfiguration, createOAuth2ClientFn)
         clientName,
         {
           clientName: clientName.length > 0 ? clientName : undefined,
+          providerConfiguration: providers[providerName],
           providerInstance,
+          requiresPKCE: providers[providerName].PKCEMethod !== undefined,
           scope: providerConfig.scope,
           searchParams: providerConfig.searchParams
         }
@@ -8293,7 +8395,7 @@ var buildClientProviders = async (providersConfiguration, createOAuth2ClientFn)
       }
     ];
   }));
-  return Object.fromEntries(groups);
+  return { ...customGroups, ...Object.fromEntries(groups) };
 };
 var normalizeClientConfig = (providerName, clientName, clientConfig) => {
   if (!isProviderClientConfig(clientConfig)) {
@@ -8429,7 +8531,13 @@ var authorize = ({
     if ("error" in resolvedProvider) {
       return status("Unauthorized", resolvedProvider.error);
     }
-    const { clientName, providerInstance, scope, searchParams } = resolvedProvider.entry;
+    const {
+      clientName,
+      providerInstance,
+      requiresPKCE,
+      scope,
+      searchParams
+    } = resolvedProvider.entry;
     const referer = parseReferer(headers["referer"]);
     const authIntent = isAuthIntent(intent) ? intent : undefined;
     origin_url.set({
@@ -8477,7 +8585,7 @@ var authorize = ({
       secure,
       value: currentState
     });
-    const codeVerifier = isPKCEProviderOption(provider) ? generateCodeVerifier() : undefined;
+    const codeVerifier = requiresPKCE ? generateCodeVerifier() : undefined;
     if (codeVerifier) {
       code_verifier.set({
         httpOnly: true,
@@ -8589,9 +8697,13 @@ var callback = ({
   if ("error" in resolvedProvider) {
     return status("Unauthorized", resolvedProvider.error);
   }
-  const { clientName, providerInstance } = resolvedProvider.entry;
+  const {
+    clientName,
+    providerConfiguration,
+    providerInstance,
+    requiresPKCE
+  } = resolvedProvider.entry;
   stored_state.remove();
-  const requiresPKCE = isPKCEProviderOption(authProvider);
   const verifier = requiresPKCE ? code_verifier.value : undefined;
   if (requiresPKCE && verifier === undefined) {
     return status("Bad Request", "Code verifier not found and is required");
@@ -8639,6 +8751,7 @@ var callback = ({
     cookie,
     currentUser,
     originUrl,
+    providerConfiguration,
     providerInstance,
     redirect,
     session: callbackSession,
@@ -27333,6 +27446,7 @@ var auth = async ({
   authSessionStore,
   audit,
   credentials,
+  customProviders,
   mfa,
   passwordless,
   lockout,
@@ -27370,7 +27484,7 @@ var auth = async ({
 }) => {
   if (tracing !== undefined)
     await initTracing(tracing);
-  const clientProviders = await buildClientProviders(providersConfiguration, createOAuth2Client);
+  const clientProviders = await buildClientProviders(providersConfiguration, createOAuth2Client, customProviders);
   const resolvedCookieSecure = resolveCookieSecure(cookieSecure);
   const webhookDispatch = webhooks ? createWebhookDispatcher(webhooks) : undefined;
   const auditEmit = audit || webhookDispatch ? createAuditEmitter({
@@ -27700,6 +27814,7 @@ export {
   deleteRegisteredClient,
   defineScimAttributeMap,
   defineProvidersConfiguration,
+  defineProvider,
   defineAuthSettings,
   defineAuthHtmxConfig,
   defineAuthConfig,
@@ -27845,6 +27960,7 @@ export {
   createInMemoryAccessTokenStore,
   createFgaEngine,
   createFederatedTokenStore,
+  createCustomOAuth2Client,
   createCredentialOffer,
   createAuthHtmxRoutes,
   createAuditRedactor,
@@ -27927,5 +28043,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=47718768D4F1D77064756E2164756E21
+//# debugId=1C44E17EB1F4FC5164756E2164756E21
 //# sourceMappingURL=index.js.map