@absolutejs/auth 0.84.0 → 0.86.0

package/dist/providers/neon.d.ts

@@ -1,31 +1,31 @@
-import type { CustomProviderClientConfiguration } from '../types';
-/** Neon requires a registered partner OAuth application. */
-export declare const neonProviderConfiguration: import("citra").CustomProviderDefinition<{
-    readonly authorizationUrl: "https://oauth2.neon.tech/oauth2/auth";
-    readonly isOIDC: true;
-    readonly isRefreshable: true;
-    readonly PKCEMethod: "S256";
-    readonly profileRequest: {
-        readonly authIn: "header";
-        readonly encoding: "application/json";
-        readonly method: "GET";
-        readonly url: "https://oauth2.neon.tech/userinfo";
+import type { OAuth2ProviderClientConfiguration } from '../types';
+/** Canonical Citra definition for the registered Neon partner application. */
+export declare const neonProviderConfiguration: {
+    authorizationUrl: string;
+    isOIDC: true;
+    isRefreshable: true;
+    PKCEMethod: "S256";
+    profileRequest: {
+        authIn: "header";
+        encoding: "application/json";
+        method: "GET";
+        url: string;
     };
-    readonly revocationRequest: {
-        readonly authIn: "body";
-        readonly encoding: "application/x-www-form-urlencoded";
-        readonly tokenParamName: "token";
-        readonly url: "https://oauth2.neon.tech/oauth2/revoke";
+    revocationRequest: {
+        authIn: "body";
+        encoding: "application/x-www-form-urlencoded";
+        tokenParamName: "token";
+        url: string;
     };
-    readonly scopeRequired: true;
-    readonly subject: ["sub"];
-    readonly subjectType: "string";
-    readonly tokenRequest: {
-        readonly authIn: "body";
-        readonly encoding: "application/x-www-form-urlencoded";
-        readonly url: "https://oauth2.neon.tech/oauth2/token";
+    scopeRequired: true;
+    subject: string[];
+    subjectType: "string";
+    tokenRequest: {
+        authIn: "body";
+        encoding: "application/x-www-form-urlencoded";
+        url: string;
     };
-}, import("citra").CustomProviderCredentials>;
+} & import("citra").ProviderConfig<any>;
 export type NeonManagementScope = `urn:neoncloud:${'projects' | 'orgs'}:${'create' | 'read' | 'update' | 'delete' | 'permission'}`;
 export type NeonProviderOptions = {
     credentials: {
@@ -38,5 +38,5 @@ export type NeonProviderOptions = {
     /** Request both scopes required by Neon to issue a refresh token. */
     offlineAccess?: boolean;
 };
-/** Configure `customProviders.neon` without granting management permissions implicitly. */
-export declare const createNeonProviderConfiguration: ({ credentials, offlineAccess, scopes }: NeonProviderOptions) => CustomProviderClientConfiguration;
+/** Configure `providersConfiguration.neon` without granting management permissions implicitly. */
+export declare const createNeonProviderConfiguration: ({ credentials, offlineAccess, scopes }: NeonProviderOptions) => OAuth2ProviderClientConfiguration<"neon">;

package/dist/server.js

@@ -2393,6 +2393,32 @@ var providers = defineProviders({
       url: "https://nid.naver.com/oauth2.0/token"
     }
   },
+  neon: {
+    authorizationUrl: "https://oauth2.neon.tech/oauth2/auth",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://oauth2.neon.tech/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://oauth2.neon.tech/oauth2/revoke"
+    },
+    scopeRequired: true,
+    subject: ["sub"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth2.neon.tech/oauth2/token"
+    }
+  },
   notion: {
     authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
     email: ["bot", "owner", "user", "person", "email"],
@@ -11213,29 +11239,17 @@ init_crypto();
 var acceptInvitation = async ({
   organizationStore,
   token,
-  userId
+  userId,
+  verifiedEmail
 }) => {
-  const invitation = await organizationStore.getInvitationByTokenHash(await hashToken(token));
-  if (!invitation || invitation.state !== "pending")
+  if (!verifiedEmail?.trim() || !organizationStore.acceptInvitation)
     return;
-  if (invitation.expiresAt < Date.now())
-    return;
-  const now = Date.now();
-  await organizationStore.saveInvitation({
-    ...invitation,
-    acceptedAt: now,
-    state: "accepted"
+  return organizationStore.acceptInvitation({
+    now: Date.now(),
+    tokenHash: await hashToken(token),
+    userId,
+    verifiedEmail: verifiedEmail.trim().toLowerCase()
   });
-  const membership = {
-    createdAt: now,
-    organizationId: invitation.organizationId,
-    roles: invitation.roles,
-    status: "active",
-    updatedAt: now,
-    userId
-  };
-  await organizationStore.saveMembership(membership);
-  return membership;
 };
 var createOrganization = async ({
   metadata,
@@ -11306,6 +11320,7 @@ var organizationRoutes = ({
   canManageMembers,
   emit,
   getUserId,
+  getVerifiedEmail,
   invitationDurationMs,
   onMembershipAdded,
   onMembershipRemoved,
@@ -11494,7 +11509,8 @@ var organizationRoutes = ({
     const membership = await acceptInvitation({
       organizationStore,
       token,
-      userId: getUserId(user)
+      userId: getUserId(user),
+      verifiedEmail: await getVerifiedEmail?.(user)
     });
     if (!membership) {
       return status("Bad Request", "Invalid or expired invitation");
@@ -40391,6 +40407,27 @@ var toInvitation = (row) => ({
 });
 var createNeonOrganizationStore = (databaseUrl) => createPostgresOrganizationStore(createNeonDatabase(databaseUrl));
 var createPostgresOrganizationStore = (db) => ({
+  acceptInvitation: async ({ now, tokenHash, userId, verifiedEmail }) => {
+    const claimed = db.$with("claimed").as(db.update(organizationInvitationsTable).set({ accepted_at_ms: now, state: "accepted" }).where(and(eq(organizationInvitationsTable.token_hash, tokenHash), eq(organizationInvitationsTable.state, "pending"), gt(organizationInvitationsTable.expires_at_ms, now), sql`lower(trim(${organizationInvitationsTable.email})) = ${verifiedEmail}`, exists(db.select().from(organizationsTable).where(eq(organizationsTable.organization_id, organizationInvitationsTable.organization_id))), notExists(db.select().from(organizationMembershipsTable).where(and(eq(organizationMembershipsTable.organization_id, organizationInvitationsTable.organization_id), eq(organizationMembershipsTable.user_id, userId), eq(organizationMembershipsTable.status, "suspended")))))).returning({
+      organizationId: organizationInvitationsTable.organization_id,
+      roles: organizationInvitationsTable.roles
+    }));
+    const [row] = await db.with(claimed).insert(organizationMembershipsTable).select(db.select({
+      created_at_ms: sql`${now}`.as("created_at_ms"),
+      organization_id: claimed.organizationId,
+      roles: claimed.roles,
+      status: sql`'active'`.as("status"),
+      updated_at_ms: sql`${now}`.as("updated_at_ms"),
+      user_id: sql`${userId}`.as("user_id")
+    }).from(claimed)).onConflictDoUpdate({
+      set: { user_id: userId },
+      target: [
+        organizationMembershipsTable.organization_id,
+        organizationMembershipsTable.user_id
+      ]
+    }).returning();
+    return row && row.status === "active" ? toMembership(row) : undefined;
+  },
   deleteOrganization: async (organizationId) => {
     await db.delete(organizationsTable).where(eq(organizationsTable.organization_id, organizationId));
   },
@@ -41441,6 +41478,30 @@ var createInMemoryOrganizationStore = () => {
   const memberships = new Map;
   const invitations = new Map;
   return {
+    acceptInvitation: async ({ tokenHash, userId, verifiedEmail, now }) => {
+      const invitation = [...invitations.values()].find((value) => value.tokenHash === tokenHash);
+      if (!invitation || invitation.state !== "pending" || invitation.expiresAt <= now || invitation.email.trim().toLowerCase() !== verifiedEmail || !organizations.has(invitation.organizationId))
+        return;
+      const key = membershipKey(invitation.organizationId, userId);
+      const existing = memberships.get(key);
+      if (existing?.status === "suspended")
+        return;
+      const membership = existing ?? {
+        createdAt: now,
+        organizationId: invitation.organizationId,
+        roles: [...invitation.roles],
+        status: "active",
+        updatedAt: now,
+        userId
+      };
+      invitations.set(invitation.invitationId, {
+        ...invitation,
+        acceptedAt: now,
+        state: "accepted"
+      });
+      memberships.set(key, membership);
+      return cloneMembership(membership);
+    },
     deleteOrganization: async (organizationId) => {
       organizations.delete(organizationId);
     },
@@ -42186,5 +42247,5 @@ export {
   userSessionIdTypebox
 };
 
-//# debugId=B801BF9A602847F164756E2164756E21
+//# debugId=0AD53C59A773867564756E2164756E21
 //# sourceMappingURL=server.js.map