@agilesyndrome/cf-genai-base 5.0.2 → 6.0.0

package/dist/auth/oauth-single/index.js

@@ -0,0 +1,215 @@
+import { sameOrigin, secureJson, secureText } from "../../core/security/index.js";
+import { OAuthSingleDomain } from "./domain.js";
+import { OAUTH_SINGLE, PACKAGE_NAME, VERSION } from "./constants.js";
+import { base64url, clearCookie, constantTimeEqual, cookie, cookies, decodeReturn, redirect, safeReturnTo, } from "./cookies.js";
+import { callbackUrl, configuration, random, required, sign, verifyIdToken, } from "./protocol.js";
+import { getSessionUser, hydrateUser, normalizeUser, publicUser, sessionIdentity, } from "./session.js";
+const encoder = new TextEncoder();
+export { OAUTH_SINGLE, PACKAGE_NAME, VERSION } from "./constants.js";
+/**
+ * Generic OIDC auth for Workers using Authorization Code + PKCE and a signed,
+ * host-only cookie. Application-specific authorization remains in the hooks.
+ */
+export function createAuth(options = {}) {
+    const prefix = options.cookiePrefix || "__Host-cfgenai";
+    if (!/^(?:__Host-)?[A-Za-z0-9_-]+$/.test(prefix)) {
+        throw new Error("cookiePrefix contains invalid characters");
+    }
+    const names = {
+        state: options.stateCookieName || `${prefix}_state`,
+        session: options.sessionCookieName || `${prefix}_session`,
+    };
+    const publicPaths = options.publicPaths || ["/auth/", "/favicon.svg", "/robots.txt", "/health"];
+    const protectedPath = options.protectedPath || (() => true);
+    const envName = (key, fallback) => options.env?.[key] || fallback;
+    async function resolveUser(request, env) {
+        const user = await hydrateUser(await getSessionUser(request, env, envName("sessionSecret", "AUTH_SESSION_SECRET"), names.session, options), env);
+        if (user && options.sessionAuthorize && !(await options.sessionAuthorize({ user, request, env }))) {
+            return null;
+        }
+        return user;
+    }
+    function resolveRequestUser(request, env, state) {
+        return state && Object.hasOwn(state, "user") ? state.user || null : resolveUser(request, env);
+    }
+    async function resolveLoginUser(user, env, request) {
+        const hydrated = await hydrateUser(user, env);
+        if (!hydrated)
+            throw new Error("Unable to hydrate the authenticated user");
+        if (options.loginAuthorize && !(await options.loginAuthorize({ user: hydrated, request, env }))) {
+            throw authError("Authentication is not currently permitted.", 403);
+        }
+        return hydrated;
+    }
+    async function login(request, env) {
+        if (options.getSession && await resolveUser(request, env)) {
+            const target = safeReturnTo(new URL(request.url).searchParams.get("return_to") || "/");
+            return redirect(new URL(request.url).origin + target, [clearCookie(names.state)]);
+        }
+        const config = await configuration(env, options);
+        const state = random();
+        const verifier = random();
+        const nonce = random();
+        const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
+        const challenge = base64url(new Uint8Array(digest));
+        const returnTo = safeReturnTo(new URL(request.url).searchParams.get("return_to") || "/");
+        const stateValue = `${state}.${verifier}.${nonce}.${base64url(encoder.encode(returnTo))}`;
+        const authorize = new URL(config.authorization_endpoint);
+        authorize.search = new URLSearchParams({
+            client_id: required(env, envName("clientId", "OIDC_CLIENT_ID")),
+            response_type: "code",
+            redirect_uri: callbackUrl(request, env, options),
+            scope: options.scope || "openid profile email",
+            state,
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            nonce,
+        }).toString();
+        return redirect(authorize, [cookie(names.state, stateValue, 600)]);
+    }
+    async function callback(request, env) {
+        const url = new URL(request.url);
+        const value = cookies(request)[names.state] || "";
+        const [state, verifier, nonce, encodedReturn] = value.split(".");
+        if (!state || !constantTimeEqual(state, url.searchParams.get("state") || "") || !verifier) {
+            if (options.getSession && await resolveUser(request, env)) {
+                return redirect(url.origin, [clearCookie(names.state)]);
+            }
+            return authError("The sign-in state was invalid or expired.", 400);
+        }
+        const config = await configuration(env, options);
+        const clientId = required(env, envName("clientId", "OIDC_CLIENT_ID"));
+        const tokenResponse = await fetch(config.token_endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                client_id: clientId,
+                client_secret: required(env, envName("clientSecret", "OIDC_CLIENT_SECRET")),
+                grant_type: "authorization_code",
+                code: url.searchParams.get("code") || "",
+                redirect_uri: callbackUrl(request, env, options),
+                code_verifier: verifier,
+            }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!tokenResponse.ok)
+            throw new Error("OIDC token exchange failed");
+        const token = await tokenResponse.json();
+        const idToken = token && typeof token === "object" && !Array.isArray(token)
+            ? Reflect.get(token, "id_token")
+            : undefined;
+        const claims = await verifyIdToken(idToken, config, clientId, nonce);
+        if (!claims.sub)
+            return authError("The identity provider returned no subject.", 502);
+        const candidate = options.onLogin
+            ? await options.onLogin(claims, env)
+            : normalizeUser(claims);
+        const user = await resolveLoginUser({
+            ...candidate,
+            email_verified: claims.email_verified === true,
+        }, env, request);
+        const identity = sessionIdentity(user);
+        const sessionSeconds = options.sessionSeconds || 28_800;
+        const signed = options.createSession
+            ? await options.createSession(identity, env, request)
+            : await sign(JSON.stringify({ ...identity, exp: Math.floor(Date.now() / 1000) + sessionSeconds }), env, envName("sessionSecret", "AUTH_SESSION_SECRET"));
+        await env.event?.("auth.login.succeeded", "auth", { userId: user.authUser?.id });
+        return redirect(`${url.origin}${decodeReturn(encodedReturn)}`, [
+            cookie(names.session, signed, sessionSeconds),
+            clearCookie(names.state),
+        ]);
+    }
+    const domain = new OAuthSingleDomain({
+        login: ({ request, env }) => login(request, env),
+        callback: ({ request, env }) => callback(request, env),
+        logout: async ({ request, env }) => {
+            const originResponse = checkOrigin(request, options.allowedOrigins);
+            return originResponse || logout(request, env, names.session, options);
+        },
+        me: async ({ request, env, state }) => secureJson({ user: publicUser(await resolveRequestUser(request, env, state)) }),
+    });
+    return {
+        name: "auth",
+        displayName: options.displayName || "Authentication",
+        packageName: PACKAGE_NAME,
+        version: VERSION,
+        strategy: OAUTH_SINGLE,
+        requiredEnvironment: ({ request }) => {
+            const path = new URL(request.url).pathname;
+            const protectedRequest = protectedPath(path)
+                && !publicPaths.some((publicPath) => publicPath === "/" ? path === "/" : path.startsWith(publicPath));
+            return protectedRequest
+                ? ["OIDC_DISCOVERY_URL", "OIDC_ISSUER", "OIDC_CLIENT_ID", "OIDC_CLIENT_SECRET", "AUTH_SESSION_SECRET"]
+                : [];
+        },
+        domains: [domain, ...(options.domains || [])],
+        healthchecks: options.healthchecks || [],
+        circuitBreakers: options.circuitBreakers || [],
+        async handle(request, env, _ctx, state) {
+            const url = new URL(request.url);
+            if (!protectedPath(url.pathname)
+                || publicPaths.some((path) => path === "/" ? url.pathname === "/" : url.pathname.startsWith(path)))
+                return null;
+            if (isMutation(request)) {
+                const originResponse = checkOrigin(request, options.allowedOrigins);
+                if (originResponse)
+                    return originResponse;
+            }
+            const user = await resolveRequestUser(request, env, state);
+            if (user && options.authorize && !(await options.authorize({ request, url, user, env }))) {
+                return url.pathname.startsWith("/api/")
+                    ? Response.json({ error: "Administrator access is required." }, { status: 403, headers: { "Cache-Control": "no-store" } })
+                    : authError("Administrator access is required.", 403);
+            }
+            if (user)
+                return null;
+            if (url.pathname.startsWith("/api/")) {
+                return Response.json({ error: "Authentication is required." }, { status: 401, headers: { "Cache-Control": "no-store" } });
+            }
+            return Response.redirect(`${url.origin}/auth/login?return_to=${encodeURIComponent(safeReturnTo(url.pathname + url.search))}`, 302);
+        },
+        getUser: (request, env) => resolveUser(request, env),
+        healthcheck: async (env) => ({
+            feature: "auth",
+            component: "configuration",
+            displayName: "Authentication configuration",
+            state: Boolean(env.DB) && [
+                envName("discoveryUrl", "OIDC_DISCOVERY_URL"),
+                envName("issuer", "OIDC_ISSUER"),
+                envName("clientId", "OIDC_CLIENT_ID"),
+                envName("clientSecret", "OIDC_CLIENT_SECRET"),
+                envName("sessionSecret", "AUTH_SESSION_SECRET"),
+            ].every((key) => env[key] && !String(env[key]).startsWith("replace-with-")) ? "green" : "red",
+        }),
+        middleware(request, env, ctx, next, state) {
+            return this.handle(request, env, ctx, state)
+                .then((response) => response || next(request, env, ctx, state));
+        },
+    };
+}
+function isMutation(request) {
+    return ["POST", "PUT", "PATCH", "DELETE"].includes(request.method);
+}
+function checkOrigin(request, allowedOrigins = []) {
+    let requestOrigin;
+    try {
+        requestOrigin = new URL(request.url).origin;
+    }
+    catch {
+        return authError("This request did not pass the same-origin check.", 403);
+    }
+    return sameOrigin(request, [requestOrigin, ...allowedOrigins])
+        ? null
+        : authError("A same-origin request is required.", 403);
+}
+async function logout(request, env, name, options) {
+    const token = cookies(request)[name];
+    if (token && options.revokeSession)
+        await options.revokeSession(token, env, request);
+    await env.event?.("auth.logout", "auth");
+    return redirect(new URL(request.url).origin + "/", [clearCookie(name)]);
+}
+function authError(message, status) {
+    return secureText(message, status);
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/oauth-single/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/oauth-single/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,YAAY,GACb,MAAM,cAAc,CAAC;AAOtB,OAAO,EACL,WAAW,EACX,aAAa,EAEb,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,UAAU,EACV,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGrE;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,OAAO,GAAiB,EAAE;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACxD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,OAAO,CAAC,eAAe,IAAI,GAAG,MAAM,QAAQ;QACnD,OAAO,EAAE,OAAO,CAAC,iBAAiB,IAAI,GAAG,MAAM,UAAU;KAC1D,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;IAElF,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,GAAqB;QAChE,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,EAAE,qBAAqB,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAC3G,GAAG,CACJ,CAAC;QACF,IAAI,IAAI,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,kBAAkB,CACzB,OAAgB,EAChB,GAAqB,EACrB,KAAwB;QAExB,OAAO,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,IAAmB,EACnB,GAAqB,EACrB,OAAgB;QAEhB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YAChG,MAAM,SAAS,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,GAAqB;QAC1D,IAAI,OAAO,CAAC,UAAU,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;YACvF,OAAO,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,GAAG,KAAK,IAAI,QAAQ,IAAI,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACzD,SAAS,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;YACrC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAC/D,aAAa,EAAE,MAAM;YACrB,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;YAChD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,sBAAsB;YAC9C,KAAK;YACL,cAAc,EAAE,SAAS;YACzB,qBAAqB,EAAE,MAAM;YAC7B,KAAK;SACN,CAAC,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,GAAqB;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1F,IAAI,OAAO,CAAC,UAAU,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,SAAS,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;gBAC3E,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;gBACxC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;gBAChD,aAAa,EAAE,QAAQ;aACxB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC;YAChC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;QAErF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO;YAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;YACpC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,GAAG,SAAS;YACZ,cAAc,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI;SAC/C,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa;YAClC,CAAC,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC;YACrD,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC3J,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACjF,OAAO,QAAQ,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,EAAE,EAAE;YAC7D,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC;YAC7C,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;QACnC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC;QAChD,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;QACtD,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;YACjC,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YACpE,OAAO,cAAc,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;QACD,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CACpC,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,gBAAgB;QACpD,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,YAAY;QACtB,mBAAmB,EAAE,CAAC,EAAE,OAAO,EAAkC,EAAE,EAAE;YACnE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAC3C,MAAM,gBAAgB,GAAG,aAAa,CAAC,IAAI,CAAC;mBACvC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;YACxG,OAAO,gBAAgB;gBACrB,CAAC,CAAC,CAAC,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;gBACtG,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;QACxC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE;QAC9C,KAAK,CAAC,MAAM,CACV,OAAgB,EAChB,GAAqB,EACrB,IAAuB,EACvB,KAAwB;YAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IACE,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;mBACzB,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAClG,OAAO,IAAI,CAAC;YAEd,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;gBACpE,IAAI,cAAc;oBAAE,OAAO,cAAc,CAAC;YAC5C,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3D,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;oBACrC,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAC9C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAC1D;oBACD,CAAC,CAAC,SAAS,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,6BAA6B,EAAE,EACxC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,QAAQ,CACtB,GAAG,GAAG,CAAC,MAAM,yBAAyB,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EACnG,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC,OAAgB,EAAE,GAAqB,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;QAC/E,WAAW,EAAE,KAAK,EAAE,GAAqB,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,eAAe;YAC1B,WAAW,EAAE,8BAA8B;YAC3C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI;gBACxB,OAAO,CAAC,cAAc,EAAE,oBAAoB,CAAC;gBAC7C,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC;gBAChC,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC;gBACrC,OAAO,CAAC,cAAc,EAAE,oBAAoB,CAAC;gBAC7C,OAAO,CAAC,eAAe,EAAE,qBAAqB,CAAC;aAChD,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;SAC9F,CAAC;QACF,UAAU,CACR,OAAgB,EAChB,GAAqB,EACrB,GAAqB,EACrB,IAAkI,EAClI,KAAwB;YAExB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC;iBACzC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB;IAClC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB,EAAE,cAAc,GAAsB,EAAE;IAC3E,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC;QAC5D,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,SAAS,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,OAAgB,EAChB,GAAqB,EACrB,IAAY,EACZ,OAAqB;IAErB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,IAAI,OAAO,CAAC,aAAa;QAAE,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACrF,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,MAAc;IAChD,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC"}

package/dist/auth/oauth-single/model.d.ts

@@ -0,0 +1,75 @@
+import type { AnyAppDomain } from "../../app.js";
+import type { AuthUser } from "../users/model.js";
+export interface OAuthEnvironment {
+    DB?: D1Database;
+    event?: (what: string, where: string, details?: Record<string, unknown>) => unknown;
+    [key: string]: unknown;
+}
+export interface OAuthClaims {
+    sub?: string;
+    email?: string;
+    name?: string;
+    email_verified?: boolean;
+    iss?: string;
+    aud?: string | string[];
+    azp?: string;
+    exp?: number;
+    nonce?: string;
+    [key: string]: unknown;
+}
+export interface OAuthIdentity {
+    sub: string;
+    email?: string;
+    name?: string;
+    email_verified?: boolean;
+    auth_strategy?: string;
+    exp?: number;
+    authUser?: AuthUser | null;
+    [key: string]: unknown;
+}
+export interface OAuthOptions {
+    cookiePrefix?: string;
+    stateCookieName?: string;
+    sessionCookieName?: string;
+    publicPaths?: readonly string[];
+    protectedPath?: (pathname: string) => boolean;
+    allowedOrigins?: readonly string[];
+    displayName?: string;
+    env?: Record<string, string>;
+    scope?: string;
+    sessionSeconds?: number;
+    domains?: readonly AnyAppDomain[];
+    healthchecks?: readonly unknown[];
+    circuitBreakers?: readonly unknown[];
+    authorize?: (context: {
+        request: Request;
+        url: URL;
+        user: OAuthIdentity;
+        env: OAuthEnvironment;
+    }) => boolean | Promise<boolean>;
+    sessionAuthorize?: (context: {
+        user: OAuthIdentity;
+        request: Request;
+        env: OAuthEnvironment;
+    }) => boolean | Promise<boolean>;
+    loginAuthorize?: (context: {
+        user: OAuthIdentity;
+        request: Request;
+        env: OAuthEnvironment;
+    }) => boolean | Promise<boolean>;
+    onLogin?: (claims: OAuthClaims, env: OAuthEnvironment) => OAuthIdentity | Promise<OAuthIdentity>;
+    createSession?: (identity: OAuthIdentity, env: OAuthEnvironment, request: Request) => string | Promise<string>;
+    getSession?: (token: string, env: OAuthEnvironment, request: Request) => OAuthIdentity | null | Promise<OAuthIdentity | null>;
+    revokeSession?: (token: string, env: OAuthEnvironment, request: Request) => unknown;
+}
+export interface OidcConfiguration {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+}
+export interface AuthRequestState {
+    user?: OAuthIdentity | null;
+    [key: string]: unknown;
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/auth/oauth-single/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-single/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IACpF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAClC,eAAe,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,GAAG,CAAC;QAAC,IAAI,EAAE,aAAa,CAAC;QAAC,GAAG,EAAE,gBAAgB,CAAA;KAAE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChI,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,gBAAgB,CAAA;KAAE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7H,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,gBAAgB,CAAA;KAAE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3H,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,gBAAgB,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjG,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/G,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC9H,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;CACrF;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/auth/oauth-single/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/auth/oauth-single/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/oauth-single/model.ts"],"names":[],"mappings":""}

package/dist/auth/oauth-single/protocol.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthClaims, OAuthEnvironment, OAuthOptions, OidcConfiguration } from "./model.js";
+export declare function configuration(env: OAuthEnvironment, options?: OAuthOptions): Promise<OidcConfiguration>;
+export declare function verifyIdToken(token: unknown, config: OidcConfiguration, clientId: string, expectedNonce: string | undefined): Promise<OAuthClaims>;
+export declare function sign(value: string, env: OAuthEnvironment, name: string, encoded?: boolean): Promise<string>;
+export declare function required(env: OAuthEnvironment, key: string): string;
+export declare function envNameFor(options: OAuthOptions, key: string, fallback: string): string;
+export declare function random(): string;
+export declare function callbackUrl(request: Request, env: OAuthEnvironment, options: OAuthOptions): string;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/auth/oauth-single/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-single/protocol.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAcpB,wBAAsB,aAAa,CACjC,GAAG,EAAE,gBAAgB,EACrB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAyB5B;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,iBAAiB,EACzB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAAC,WAAW,CAAC,CA0CtB;AAED,wBAAsB,IAAI,CACxB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,EACZ,OAAO,UAAO,GACb,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAKnE;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED,wBAAgB,MAAM,IAAI,MAAM,CAI/B;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,CAIlG"}

package/dist/auth/oauth-single/protocol.js

@@ -0,0 +1,190 @@
+import { base64url, decodeBase64Url } from "./cookies.js";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const configurationCache = new Map();
+const configurationRequests = new Map();
+const jwksCache = new Map();
+const jwksRequests = new Map();
+const OIDC_CACHE_MS = 15 * 60 * 1000;
+const OIDC_TIMEOUT_MS = 10_000;
+export async function configuration(env, options = {}) {
+    const discoveryUrl = required(env, envNameFor(options, "discoveryUrl", "OIDC_DISCOVERY_URL"));
+    if (new URL(discoveryUrl).protocol !== "https:")
+        throw new Error("OIDC discovery URL must use HTTPS");
+    const expectedIssuer = normalizeIssuer(required(env, envNameFor(options, "issuer", "OIDC_ISSUER")));
+    const cacheKey = `${discoveryUrl}\0${expectedIssuer}`;
+    const cached = configurationCache.get(cacheKey);
+    if (cached && cached.exp > Date.now())
+        return cached.value;
+    const existing = configurationRequests.get(cacheKey);
+    if (existing)
+        return existing;
+    const pending = fetchWithTimeout(discoveryUrl).then(async (response) => {
+        if (!response.ok)
+            throw new Error("Unable to load OIDC configuration");
+        const value = readOidcConfiguration(await response.json());
+        if (!value.issuer || new URL(value.issuer).protocol !== "https:" || normalizeIssuer(value.issuer) !== expectedIssuer) {
+            throw new Error("OIDC configuration returned an unexpected issuer");
+        }
+        requireHttpsEndpoint(value.authorization_endpoint, "authorization");
+        requireHttpsEndpoint(value.token_endpoint, "token");
+        requireHttpsEndpoint(value.jwks_uri, "JWKS");
+        configurationCache.set(cacheKey, { value, exp: Date.now() + OIDC_CACHE_MS });
+        return value;
+    }).finally(() => configurationRequests.delete(cacheKey));
+    configurationRequests.set(cacheKey, pending);
+    return pending;
+}
+export async function verifyIdToken(token, config, clientId, expectedNonce) {
+    const [head, body, signature] = String(token || "").split(".");
+    if (!head || !body || !signature)
+        throw new Error("Malformed ID token");
+    const header = readObject(JSON.parse(decoder.decode(decodeBase64Url(head))));
+    if (header.alg !== "RS256" || !header.kid)
+        throw new Error("Unsupported ID token signature");
+    const keys = await getJwks(config.jwks_uri);
+    const jwk = keys.keys.find((candidate) => candidate.kid === header.kid);
+    if (!jwk)
+        throw new Error("ID token signing key was not found");
+    const key = await crypto.subtle.importKey("jwk", jwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+    const validSignature = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, decodeBase64Url(signature), encoder.encode(`${head}.${body}`));
+    if (!validSignature)
+        throw new Error("Invalid ID token");
+    const claims = readOAuthClaims(JSON.parse(decoder.decode(decodeBase64Url(body))));
+    const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+    const validAuthorizedParty = !Array.isArray(claims.aud)
+        || claims.aud.length < 2
+        || claims.azp === clientId;
+    if (normalizeIssuer(claims.iss || "") !== normalizeIssuer(config.issuer)
+        || !audience.includes(clientId)
+        || !validAuthorizedParty
+        || typeof claims.exp !== "number"
+        || claims.exp <= Date.now() / 1000
+        || claims.nonce !== expectedNonce
+        || !claims.sub) {
+        throw new Error("Invalid ID token claims");
+    }
+    return claims;
+}
+export async function sign(value, env, name, encoded = true) {
+    const secret = required(env, name);
+    if (name === "AUTH_SESSION_SECRET" && secret.length < 32) {
+        throw new Error("AUTH_SESSION_SECRET must be at least 32 characters");
+    }
+    const data = encoded ? base64url(encoder.encode(value)) : value;
+    const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = base64url(new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(data))));
+    return encoded ? `${data}.${signature}` : signature;
+}
+export function required(env, key) {
+    if (!env[key] || String(env[key]).startsWith("replace-with-")) {
+        throw new Error(`${key} is not configured`);
+    }
+    return String(env[key]);
+}
+export function envNameFor(options, key, fallback) {
+    return options.env?.[key] || fallback;
+}
+export function random() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return base64url(bytes);
+}
+export function callbackUrl(request, env, options) {
+    const configuredOrigin = env[envNameFor(options, "publicOrigin", "PUBLIC_ORIGIN")];
+    const origin = configuredOrigin ? new URL(String(configuredOrigin)).origin : new URL(request.url).origin;
+    return `${origin}/auth/callback`;
+}
+async function getJwks(uri) {
+    const cached = jwksCache.get(uri);
+    if (cached && cached.exp > Date.now())
+        return cached.value;
+    const existing = jwksRequests.get(uri);
+    if (existing)
+        return existing;
+    const pending = fetchWithTimeout(uri).then(async (response) => {
+        if (!response.ok)
+            throw new Error("Unable to load OIDC signing keys");
+        const value = readJsonWebKeySet(await response.json());
+        jwksCache.set(uri, { value, exp: Date.now() + OIDC_CACHE_MS });
+        return value;
+    }).finally(() => jwksRequests.delete(uri));
+    jwksRequests.set(uri, pending);
+    return pending;
+}
+function fetchWithTimeout(input, init = {}) {
+    return fetch(input, { ...init, signal: AbortSignal.timeout(OIDC_TIMEOUT_MS) });
+}
+function normalizeIssuer(value) {
+    return String(value).replace(/\/+$/, "") + "/";
+}
+function requireHttpsEndpoint(value, label) {
+    if (!value || new URL(value).protocol !== "https:") {
+        throw new Error(`OIDC configuration returned an invalid ${label} endpoint`);
+    }
+}
+function readObject(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("OIDC response must be a JSON object");
+    }
+    return Object.fromEntries(Object.entries(value));
+}
+function requiredString(input, key) {
+    const value = input[key];
+    if (typeof value !== "string" || !value)
+        throw new Error(`OIDC response is missing ${key}`);
+    return value;
+}
+function readOidcConfiguration(value) {
+    const input = readObject(value);
+    return {
+        issuer: requiredString(input, "issuer"),
+        authorization_endpoint: requiredString(input, "authorization_endpoint"),
+        token_endpoint: requiredString(input, "token_endpoint"),
+        jwks_uri: requiredString(input, "jwks_uri"),
+    };
+}
+function readOAuthClaims(value) {
+    const input = readObject(value);
+    const audience = input.aud;
+    if (audience !== undefined && typeof audience !== "string"
+        && !(Array.isArray(audience) && audience.every((item) => typeof item === "string"))) {
+        throw new Error("Invalid ID token audience");
+    }
+    for (const key of ["sub", "email", "name", "iss", "azp", "nonce"]) {
+        if (input[key] !== undefined && typeof input[key] !== "string")
+            throw new Error(`Invalid ID token ${key}`);
+    }
+    if (input.exp !== undefined && typeof input.exp !== "number")
+        throw new Error("Invalid ID token exp");
+    if (input.email_verified !== undefined && typeof input.email_verified !== "boolean") {
+        throw new Error("Invalid ID token email_verified");
+    }
+    return {
+        ...input,
+        sub: typeof input.sub === "string" ? input.sub : undefined,
+        email: typeof input.email === "string" ? input.email : undefined,
+        name: typeof input.name === "string" ? input.name : undefined,
+        email_verified: typeof input.email_verified === "boolean" ? input.email_verified : undefined,
+        iss: typeof input.iss === "string" ? input.iss : undefined,
+        aud: typeof audience === "string" || Array.isArray(audience) ? audience : undefined,
+        azp: typeof input.azp === "string" ? input.azp : undefined,
+        exp: typeof input.exp === "number" ? input.exp : undefined,
+        nonce: typeof input.nonce === "string" ? input.nonce : undefined,
+    };
+}
+function isSigningJsonWebKey(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const kty = Reflect.get(value, "kty");
+    const kid = Reflect.get(value, "kid");
+    return typeof kty === "string" && (kid === undefined || typeof kid === "string");
+}
+function readJsonWebKeySet(value) {
+    const input = readObject(value);
+    if (!Array.isArray(input.keys) || !input.keys.every(isSigningJsonWebKey)) {
+        throw new Error("OIDC signing keys response is invalid");
+    }
+    return { keys: input.keys };
+}
+//# sourceMappingURL=protocol.js.map

package/dist/auth/oauth-single/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../../src/auth/oauth-single/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAQ1D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAqD,CAAC;AACxF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAsC,CAAC;AAC5E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAC3E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkC,CAAC;AAC/D,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,eAAe,GAAG,MAAM,CAAC;AAK/B,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAqB,EACrB,OAAO,GAAiB,EAAE;IAE1B,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC9F,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAEtG,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IACpG,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,cAAc,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAC3D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACrE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,cAAc,EAAE,CAAC;YACrH,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,oBAAoB,CAAC,KAAK,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;QACpE,oBAAoB,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACpD,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAc,EACd,MAAyB,EACzB,QAAgB,EAChB,aAAiC;IAEjC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAExE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAEhE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/C,mBAAmB,EACnB,GAAG,EACH,eAAe,CAAC,SAAS,CAAC,EAC1B,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAClC,CAAC;IACF,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEzD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;WAClD,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;WACrB,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;IAC7B,IACE,eAAe,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;WACjE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;WAC5B,CAAC,oBAAoB;WACrB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;WAC9B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;WAC/B,MAAM,CAAC,KAAK,KAAK,aAAa;WAC9B,CAAC,MAAM,CAAC,GAAG,EACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,KAAa,EACb,GAAqB,EACrB,IAAY,EACZ,OAAO,GAAG,IAAI;IAEd,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,qBAAqB,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAqB,EAAE,GAAW;IACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAqB,EAAE,GAAW,EAAE,QAAgB;IAC7E,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,GAAqB,EAAE,OAAqB;IACxF,MAAM,gBAAgB,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzG,OAAO,GAAG,MAAM,gBAAgB,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAC3D,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,IAAI,GAAgB,EAAE;IAC7D,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa;IACxD,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,WAAW,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,KAA8B,EAAE,GAAW;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;QACvC,sBAAsB,EAAE,cAAc,CAAC,KAAK,EAAE,wBAAwB,CAAC;QACvE,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC;QACvD,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC;IAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ;WACrD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAU,EAAE,CAAC;QAC3E,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtG,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACL,GAAG,KAAK;QACR,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC1D,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAChE,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7D,cAAc,EAAE,OAAO,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QAC5F,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC1D,GAAG,EAAE,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACnF,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC1D,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC1D,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/auth/oauth-single/session.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthClaims, OAuthEnvironment, OAuthIdentity, OAuthOptions } from "./model.js";
+export declare function hydrateUser(user: OAuthIdentity | null, env: OAuthEnvironment): Promise<OAuthIdentity | null>;
+export declare function getSessionUser(request: Request, env: OAuthEnvironment, secretName?: string, sessionName?: string, options?: OAuthOptions): Promise<OAuthIdentity | null>;
+export declare function normalizeUser(claims: OAuthClaims): OAuthIdentity;
+export declare function sessionIdentity(user: OAuthIdentity | null): OAuthIdentity;
+export declare function publicUser(user: OAuthIdentity | null): Record<string, unknown> | null;
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/oauth-single/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-single/session.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK7F,wBAAsB,WAAW,CAC/B,IAAI,EAAE,aAAa,GAAG,IAAI,EAC1B,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,gBAAgB,EACrB,UAAU,SAAwB,EAClC,WAAW,SAA2B,EACtC,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAe/B;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAQhE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,GAAG,aAAa,CAGzE;AAsBD,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQrF"}

package/dist/auth/oauth-single/session.js

@@ -0,0 +1,78 @@
+import { ensureUser } from "../users/index.js";
+import { OAUTH_SINGLE } from "./constants.js";
+import { constantTimeEqual, cookies, decodeBase64Url } from "./cookies.js";
+import { sign } from "./protocol.js";
+const decoder = new TextDecoder();
+export async function hydrateUser(user, env) {
+    if (!user)
+        return user;
+    if (!env.DB)
+        throw new Error("OAUTH_SINGLE requires the base DB binding for canonical users");
+    const authUser = await ensureUser(env, user, {
+        who: `user:${user.sub || "unknown"}`,
+    });
+    return { ...user, authUser };
+}
+export async function getSessionUser(request, env, secretName = "AUTH_SESSION_SECRET", sessionName = "__Host-cfgenai_session", options = {}) {
+    const token = cookies(request)[sessionName];
+    if (!token)
+        return null;
+    if (options.getSession)
+        return (await options.getSession(token, env, request)) || null;
+    const [payload, signature] = token.split(".");
+    if (!payload || !signature || !constantTimeEqual(signature, await sign(payload, env, secretName, false))) {
+        return null;
+    }
+    try {
+        const user = readOAuthIdentity(JSON.parse(decoder.decode(decodeBase64Url(payload))));
+        return user && typeof user.exp === "number" && user.exp > Date.now() / 1000 ? user : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function normalizeUser(claims) {
+    return {
+        sub: String(claims.sub || ""),
+        email: String(claims.email || "").toLowerCase(),
+        name: String(claims.name || claims.email || claims.sub || ""),
+        email_verified: claims.email_verified === true,
+        auth_strategy: OAUTH_SINGLE,
+    };
+}
+export function sessionIdentity(user) {
+    const { authUser: _authUser, exp: _exp, ...identity } = user || { sub: "" };
+    return { ...identity, sub: identity.sub };
+}
+function readOAuthIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const sub = Reflect.get(value, "sub");
+    if (typeof sub !== "string" || !sub)
+        return null;
+    const input = Object.fromEntries(Object.entries(value));
+    const stringField = (key) => typeof input[key] === "string" ? input[key] : undefined;
+    const exp = input.exp;
+    if (exp !== undefined && typeof exp !== "number")
+        return null;
+    return {
+        ...input,
+        sub,
+        email: stringField("email"),
+        name: stringField("name"),
+        auth_strategy: stringField("auth_strategy"),
+        email_verified: typeof input.email_verified === "boolean" ? input.email_verified : undefined,
+        exp,
+    };
+}
+export function publicUser(user) {
+    if (!user?.authUser)
+        return null;
+    return {
+        id: user.authUser.id,
+        email: user.email || user.authUser.email,
+        name: user.name || user.authUser.display_name,
+        isAdmin: Boolean(user.authUser.is_admin),
+    };
+}
+//# sourceMappingURL=session.js.map