@ankhorage/auth-supabase 0.0.0-stage → 2.0.0

package/dist/createSupabaseAuthAdapter.js

@@ -0,0 +1,76 @@
+import { validateSupabaseAuthConfig, } from './authConfiguration.js';
+import { createPasswordResetOperation, createSignInOperation, createSignUpOperation, createVerifyOtpOperation, } from './authPasswordOperations.js';
+import { createAuthOperationContext } from './authSessionContext.js';
+import { createGetSessionOperation, createRefreshSessionOperation, createSignOutOperation, } from './authSessionOperations.js';
+import { createSupabaseOAuthAdapter } from './oauth.js';
+import { oauthCompletionError, oauthStartError } from './oauthErrors.js';
+import { createSupabaseOAuthProfileVerifier } from './profileVerification.js';
+/*** Create a Supabase implementation of the provider-neutral authentication port. */
+export function createSupabaseAuthAdapter(config) {
+    const normalizedConfig = validateSupabaseAuthConfig(config);
+    const context = createAuthOperationContext(normalizedConfig);
+    const oauth = createOAuthOperations(context);
+    return {
+        signIn: createSignInOperation(context),
+        signUp: createSignUpOperation(context),
+        signOut: createSignOutOperation(context),
+        getSession: createGetSessionOperation(context),
+        refreshSession: createRefreshSessionOperation(context),
+        requestPasswordReset: createPasswordResetOperation(context),
+        verifyOtp: createVerifyOtpOperation(context),
+        startAuthorization: oauth.startAuthorization,
+        completeAuthorization: oauth.completeAuthorization,
+    };
+}
+/*** Create OAuth port operations from the configured Supabase provider set. */
+function createOAuthOperations(context) {
+    const { config } = context;
+    if (config.oauthProviders.length === 0)
+        return createDisabledOAuthOperations();
+    const profileVerifier = createProfileVerifier(config);
+    return createSupabaseOAuthAdapter({
+        url: config.url,
+        anonKey: config.anonKey,
+        fetch: config.fetch,
+        storage: requireOAuthStorage(config),
+        storageKey: config.storageKey,
+        providers: config.oauthProviders,
+        randomBytes: config.oauthRandomBytes,
+        persistSession: createOAuthSessionPersistence(context),
+        ...(profileVerifier === undefined ? {} : { verifyProfile: profileVerifier }),
+        ...(config.onOAuthLifecycleEvent === undefined
+            ? {}
+            : { onLifecycleEvent: config.onOAuthLifecycleEvent }),
+    });
+}
+/*** Return explicit unsupported OAuth results when no OAuth provider was configured. */
+function createDisabledOAuthOperations() {
+    return {
+        startAuthorization: (input) => Promise.resolve(oauthStartError('provider_misconfigured', 'No OAuth providers are configured for this Supabase Auth adapter.', input.provider, false)),
+        completeAuthorization: () => Promise.resolve(oauthCompletionError('authorization_attempt_not_found', 'callback', 'No OAuth authorization attempt can exist without a configured OAuth provider.', undefined, false)),
+    };
+}
+function createOAuthSessionPersistence(context) {
+    return async (session) => {
+        const error = await context.persistSessionSafely(session);
+        if (error !== null)
+            throw new Error(error.message);
+    };
+}
+function createProfileVerifier(config) {
+    if (config.profileVerification === undefined)
+        return undefined;
+    return createSupabaseOAuthProfileVerifier({
+        url: config.url,
+        anonKey: config.anonKey,
+        fetch: config.fetch,
+        config: config.profileVerification,
+    });
+}
+function requireOAuthStorage(config) {
+    if (config.storage === undefined) {
+        throw new TypeError('Supabase OAuth PKCE requires persistent auth storage.');
+    }
+    return config.storage;
+}
+//# sourceMappingURL=createSupabaseAuthAdapter.js.map

package/dist/createSupabaseAuthAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSupabaseAuthAdapter.js","sourceRoot":"","sources":["../src/createSupabaseAuthAdapter.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAA6B,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAG9E,qFAAqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,MAA0B;IAClE,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO;QACL,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACtC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACtC,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC;QACxC,UAAU,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC9C,cAAc,EAAE,6BAA6B,CAAC,OAAO,CAAC;QACtD,oBAAoB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,wBAAwB,CAAC,OAAO,CAAC;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;KACnD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,6BAA6B,EAAE,CAAC;IAC/E,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,0BAA0B,CAAC;QAChC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACpC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,cAAc;QAChC,WAAW,EAAE,MAAM,CAAC,gBAAgB;QACpC,cAAc,EAAE,6BAA6B,CAAC,OAAO,CAAC;QACtD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,SAAS,6BAA6B;IAIpC,OAAO;QACL,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,OAAO,CAAC,OAAO,CACb,eAAe,CACb,wBAAwB,EACxB,mEAAmE,EACnE,KAAK,CAAC,QAAQ,EACd,KAAK,CACN,CACF;QACH,qBAAqB,EAAE,GAAG,EAAE,CAC1B,OAAO,CAAC,OAAO,CACb,oBAAoB,CAClB,iCAAiC,EACjC,UAAU,EACV,+EAA+E,EAC/E,SAAS,EACT,KAAK,CACN,CACF;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,OAA6B;IAClE,OAAO,KAAK,EAAE,OAAoB,EAAiB,EAAE;QACnD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAkC;IAElC,IAAI,MAAM,CAAC,mBAAmB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,kCAAkC,CAAC;QACxC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,mBAAmB;KACnC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAkC;IAC7D,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC","sourcesContent":["import type { AuthPort } from '@ankhorage/auth';\nimport type { AuthSession } from '@ankhorage/contracts/auth';\n\nimport {\n  type RequiredSupabaseAuthConfig,\n  validateSupabaseAuthConfig,\n} from './authConfiguration.js';\nimport {\n  createPasswordResetOperation,\n  createSignInOperation,\n  createSignUpOperation,\n  createVerifyOtpOperation,\n} from './authPasswordOperations.js';\nimport { type AuthOperationContext, createAuthOperationContext } from './authSessionContext.js';\nimport {\n  createGetSessionOperation,\n  createRefreshSessionOperation,\n  createSignOutOperation,\n} from './authSessionOperations.js';\nimport { createSupabaseOAuthAdapter } from './oauth.js';\nimport { oauthCompletionError, oauthStartError } from './oauthErrors.js';\nimport { createSupabaseOAuthProfileVerifier } from './profileVerification.js';\nimport type { SupabaseAuthConfig, SupabaseOAuthProfileVerifier } from './types.js';\n\n/*** Create a Supabase implementation of the provider-neutral authentication port. */\nexport function createSupabaseAuthAdapter(config: SupabaseAuthConfig): AuthPort {\n  const normalizedConfig = validateSupabaseAuthConfig(config);\n  const context = createAuthOperationContext(normalizedConfig);\n  const oauth = createOAuthOperations(context);\n  return {\n    signIn: createSignInOperation(context),\n    signUp: createSignUpOperation(context),\n    signOut: createSignOutOperation(context),\n    getSession: createGetSessionOperation(context),\n    refreshSession: createRefreshSessionOperation(context),\n    requestPasswordReset: createPasswordResetOperation(context),\n    verifyOtp: createVerifyOtpOperation(context),\n    startAuthorization: oauth.startAuthorization,\n    completeAuthorization: oauth.completeAuthorization,\n  };\n}\n\n/*** Create OAuth port operations from the configured Supabase provider set. */\nfunction createOAuthOperations(context: AuthOperationContext) {\n  const { config } = context;\n  if (config.oauthProviders.length === 0) return createDisabledOAuthOperations();\n  const profileVerifier = createProfileVerifier(config);\n  return createSupabaseOAuthAdapter({\n    url: config.url,\n    anonKey: config.anonKey,\n    fetch: config.fetch,\n    storage: requireOAuthStorage(config),\n    storageKey: config.storageKey,\n    providers: config.oauthProviders,\n    randomBytes: config.oauthRandomBytes,\n    persistSession: createOAuthSessionPersistence(context),\n    ...(profileVerifier === undefined ? {} : { verifyProfile: profileVerifier }),\n    ...(config.onOAuthLifecycleEvent === undefined\n      ? {}\n      : { onLifecycleEvent: config.onOAuthLifecycleEvent }),\n  });\n}\n\n/*** Return explicit unsupported OAuth results when no OAuth provider was configured. */\nfunction createDisabledOAuthOperations(): Pick<\n  AuthPort,\n  'startAuthorization' | 'completeAuthorization'\n> {\n  return {\n    startAuthorization: (input) =>\n      Promise.resolve(\n        oauthStartError(\n          'provider_misconfigured',\n          'No OAuth providers are configured for this Supabase Auth adapter.',\n          input.provider,\n          false,\n        ),\n      ),\n    completeAuthorization: () =>\n      Promise.resolve(\n        oauthCompletionError(\n          'authorization_attempt_not_found',\n          'callback',\n          'No OAuth authorization attempt can exist without a configured OAuth provider.',\n          undefined,\n          false,\n        ),\n      ),\n  };\n}\n\nfunction createOAuthSessionPersistence(context: AuthOperationContext) {\n  return async (session: AuthSession): Promise<void> => {\n    const error = await context.persistSessionSafely(session);\n    if (error !== null) throw new Error(error.message);\n  };\n}\n\nfunction createProfileVerifier(\n  config: RequiredSupabaseAuthConfig,\n): SupabaseOAuthProfileVerifier | undefined {\n  if (config.profileVerification === undefined) return undefined;\n  return createSupabaseOAuthProfileVerifier({\n    url: config.url,\n    anonKey: config.anonKey,\n    fetch: config.fetch,\n    config: config.profileVerification,\n  });\n}\n\nfunction requireOAuthStorage(config: RequiredSupabaseAuthConfig) {\n  if (config.storage === undefined) {\n    throw new TypeError('Supabase OAuth PKCE requires persistent auth storage.');\n  }\n  return config.storage;\n}\n"]}

package/dist/errors.d.ts

@@ -0,0 +1,7 @@
+import type { AuthAdapterError } from '@ankhorage/contracts/auth';
+import type { SupabaseAuthErrorCode } from './types.js';
+export declare function createAuthError(code: SupabaseAuthErrorCode, message: string, cause?: unknown): AuthAdapterError;
+export declare function mapNetworkError(cause: unknown): AuthAdapterError;
+export declare function mapSupabaseError(response: Response, body: unknown): AuthAdapterError;
+export declare function readResponseBody(response: Response): Promise<unknown>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,KAAK,EAAE,qBAAqB,EAA8B,MAAM,YAAY,CAAC;AAEpF,wBAAgB,eAAe,CAC7B,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,OAAO,GACd,gBAAgB,CAElB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAEhE;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,GAAG,gBAAgB,CA6BpF;AA2BD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB3E"}

package/dist/errors.js

@@ -0,0 +1,89 @@
+export function createAuthError(code, message, cause) {
+    return cause === undefined ? { code, message } : { code, message, cause };
+}
+export function mapNetworkError(cause) {
+    return createAuthError('network_error', 'Unable to reach Supabase Auth.', cause);
+}
+export function mapSupabaseError(response, body) {
+    const message = extractErrorMessage(body) ?? response.statusText;
+    const normalizedMessage = message.toLowerCase();
+    const cause = {
+        status: response.status,
+        body,
+    };
+    if (isExpiredAccessSession(response.status, normalizedMessage)) {
+        return createAuthError('session_expired', 'The auth session expired.', cause);
+    }
+    if (isInvalidCredentialMessage(normalizedMessage)) {
+        return createAuthError('invalid_credentials', 'Invalid credentials.', cause);
+    }
+    if (isExpiredRefreshSession(normalizedMessage)) {
+        return createAuthError('session_expired', 'The auth session expired.', cause);
+    }
+    if (response.status === 400 || response.status === 422) {
+        return createAuthError('validation_error', message || 'Supabase rejected the auth request.', cause);
+    }
+    return createAuthError('provider_error', message || 'Supabase Auth returned an error.', cause);
+}
+function isExpiredAccessSession(status, message) {
+    return status === 401 && includesAny(message, 'jwt', 'session', 'token');
+}
+function isInvalidCredentialMessage(message) {
+    return includesAny(message, 'invalid login credentials', 'invalid credentials', 'invalid_credentials', 'invalid_grant');
+}
+function isExpiredRefreshSession(message) {
+    return (includesAny(message, 'refresh token', 'refresh_token') &&
+        includesAny(message, 'invalid', 'expired', 'not found', 'not_found'));
+}
+function includesAny(value, ...needles) {
+    return needles.some((needle) => value.includes(needle));
+}
+export async function readResponseBody(response) {
+    const contentType = response.headers.get('content-type') ?? '';
+    if (contentType.includes('application/json')) {
+        try {
+            return await response.json();
+        }
+        catch (error) {
+            return {
+                message: 'Unable to parse Supabase Auth JSON response.',
+                cause: error,
+            };
+        }
+    }
+    try {
+        return await response.text();
+    }
+    catch (error) {
+        return {
+            message: 'Unable to read Supabase Auth response.',
+            cause: error,
+        };
+    }
+}
+function extractErrorMessage(body) {
+    if (typeof body === 'string') {
+        return body;
+    }
+    if (!isRecord(body)) {
+        return undefined;
+    }
+    const candidates = [
+        body.message,
+        body.msg,
+        body.error_description,
+        body.error,
+        body.error_code,
+        body.code,
+    ];
+    for (const candidate of candidates) {
+        if (typeof candidate === 'string' && candidate.length > 0) {
+            return candidate;
+        }
+    }
+    return undefined;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,eAAe,CAC7B,IAA2B,EAC3B,OAAe,EACf,KAAe;IAEf,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,eAAe,CAAC,eAAe,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,IAAa;IAChE,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC;IACjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,KAAK,GAA+B;QACxC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI;KACL,CAAC;IAEF,IAAI,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/D,OAAO,eAAe,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAClD,OAAO,eAAe,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,uBAAuB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC/C,OAAO,eAAe,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,OAAO,eAAe,CACpB,kBAAkB,EAClB,OAAO,IAAI,qCAAqC,EAChD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,gBAAgB,EAAE,OAAO,IAAI,kCAAkC,EAAE,KAAK,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc,EAAE,OAAe;IAC7D,OAAO,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IACjD,OAAO,WAAW,CAChB,OAAO,EACP,2BAA2B,EAC3B,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC9C,OAAO,CACL,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,eAAe,CAAC;QACtD,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,GAAG,OAA0B;IAC/D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAkB;IACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAE/D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,8CAA8C;gBACvD,KAAK,EAAE,KAAK;aACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,wCAAwC;YACjD,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,iBAAiB;QACtB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,IAAI;KACV,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC","sourcesContent":["import type { AuthAdapterError } from '@ankhorage/contracts/auth';\n\nimport type { SupabaseAuthErrorCode, SupabaseProviderErrorCause } from './types.js';\n\nexport function createAuthError(\n  code: SupabaseAuthErrorCode,\n  message: string,\n  cause?: unknown,\n): AuthAdapterError {\n  return cause === undefined ? { code, message } : { code, message, cause };\n}\n\nexport function mapNetworkError(cause: unknown): AuthAdapterError {\n  return createAuthError('network_error', 'Unable to reach Supabase Auth.', cause);\n}\n\nexport function mapSupabaseError(response: Response, body: unknown): AuthAdapterError {\n  const message = extractErrorMessage(body) ?? response.statusText;\n  const normalizedMessage = message.toLowerCase();\n  const cause: SupabaseProviderErrorCause = {\n    status: response.status,\n    body,\n  };\n\n  if (isExpiredAccessSession(response.status, normalizedMessage)) {\n    return createAuthError('session_expired', 'The auth session expired.', cause);\n  }\n\n  if (isInvalidCredentialMessage(normalizedMessage)) {\n    return createAuthError('invalid_credentials', 'Invalid credentials.', cause);\n  }\n\n  if (isExpiredRefreshSession(normalizedMessage)) {\n    return createAuthError('session_expired', 'The auth session expired.', cause);\n  }\n\n  if (response.status === 400 || response.status === 422) {\n    return createAuthError(\n      'validation_error',\n      message || 'Supabase rejected the auth request.',\n      cause,\n    );\n  }\n\n  return createAuthError('provider_error', message || 'Supabase Auth returned an error.', cause);\n}\n\nfunction isExpiredAccessSession(status: number, message: string): boolean {\n  return status === 401 && includesAny(message, 'jwt', 'session', 'token');\n}\n\nfunction isInvalidCredentialMessage(message: string): boolean {\n  return includesAny(\n    message,\n    'invalid login credentials',\n    'invalid credentials',\n    'invalid_credentials',\n    'invalid_grant',\n  );\n}\n\nfunction isExpiredRefreshSession(message: string): boolean {\n  return (\n    includesAny(message, 'refresh token', 'refresh_token') &&\n    includesAny(message, 'invalid', 'expired', 'not found', 'not_found')\n  );\n}\n\nfunction includesAny(value: string, ...needles: readonly string[]): boolean {\n  return needles.some((needle) => value.includes(needle));\n}\n\nexport async function readResponseBody(response: Response): Promise<unknown> {\n  const contentType = response.headers.get('content-type') ?? '';\n\n  if (contentType.includes('application/json')) {\n    try {\n      return await response.json();\n    } catch (error) {\n      return {\n        message: 'Unable to parse Supabase Auth JSON response.',\n        cause: error,\n      };\n    }\n  }\n\n  try {\n    return await response.text();\n  } catch (error) {\n    return {\n      message: 'Unable to read Supabase Auth response.',\n      cause: error,\n    };\n  }\n}\n\nfunction extractErrorMessage(body: unknown): string | undefined {\n  if (typeof body === 'string') {\n    return body;\n  }\n\n  if (!isRecord(body)) {\n    return undefined;\n  }\n\n  const candidates = [\n    body.message,\n    body.msg,\n    body.error_description,\n    body.error,\n    body.error_code,\n    body.code,\n  ];\n\n  for (const candidate of candidates) {\n    if (typeof candidate === 'string' && candidate.length > 0) {\n      return candidate;\n    }\n  }\n\n  return undefined;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n"]}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { createSupabaseAuthAdapter } from './createSupabaseAuthAdapter.js';
+export type { SupabaseOAuthProviderDefinition, SupabaseOAuthProviderId, SupabaseOAuthRuntimeEnvironmentDefinition, SupabaseOAuthSecretFieldDefinition, SupabaseOAuthSecretPayload, } from './oauthProviderDefinitions.js';
+export { getSupabaseOAuthProviderDefinition, isSupabaseOAuthProviderId, materializeSupabaseOAuthEnvironment, SUPABASE_OAUTH_PROVIDER_DEFINITIONS, SUPABASE_OAUTH_PROVIDER_IDS, validateSupabaseOAuthSecretPayload, } from './oauthProviderDefinitions.js';
+export { resolveSupabaseOAuthSetupPlan, SUPABASE_OAUTH_SETUP_CAPABILITIES, } from './oauthSetupRequirements.js';
+export { createSupabaseOAuthProfileVerifier, normalizeSupabaseAuthProfileVerificationConfig, verifySupabaseOAuthProfile, } from './profileVerification.js';
+export type { SupabaseAuthConfig, SupabaseAuthErrorCode, SupabaseAuthProfileField, SupabaseAuthProfileVerificationConfig, SupabaseAuthRandomBytes, SupabaseAuthStorage, SupabaseOAuthLifecycleEvent, SupabaseOAuthLifecycleObserver, SupabaseOAuthLifecycleStatus, SupabaseOAuthProfileVerificationInput, SupabaseOAuthProfileVerificationResult, SupabaseOAuthProfileVerifier, SupabaseProviderErrorCause, } from './types.js';
+export { SUPABASE_AUTH_PROFILE_FIELDS } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,YAAY,EACV,+BAA+B,EAC/B,uBAAuB,EACvB,yCAAyC,EACzC,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kCAAkC,EAClC,yBAAyB,EACzB,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,GAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,8CAA8C,EAC9C,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,EACxB,qCAAqC,EACrC,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,8BAA8B,EAC9B,4BAA4B,EAC5B,qCAAqC,EACrC,sCAAsC,EACtC,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { createSupabaseAuthAdapter } from './createSupabaseAuthAdapter.js';
+export { getSupabaseOAuthProviderDefinition, isSupabaseOAuthProviderId, materializeSupabaseOAuthEnvironment, SUPABASE_OAUTH_PROVIDER_DEFINITIONS, SUPABASE_OAUTH_PROVIDER_IDS, validateSupabaseOAuthSecretPayload, } from './oauthProviderDefinitions.js';
+export { resolveSupabaseOAuthSetupPlan, SUPABASE_OAUTH_SETUP_CAPABILITIES, } from './oauthSetupRequirements.js';
+export { createSupabaseOAuthProfileVerifier, normalizeSupabaseAuthProfileVerificationConfig, verifySupabaseOAuthProfile, } from './profileVerification.js';
+export { SUPABASE_AUTH_PROFILE_FIELDS } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAQ3E,OAAO,EACL,kCAAkC,EAClC,yBAAyB,EACzB,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,GAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,8CAA8C,EAC9C,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAgBlC,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC","sourcesContent":["export { createSupabaseAuthAdapter } from './createSupabaseAuthAdapter.js';\nexport type {\n  SupabaseOAuthProviderDefinition,\n  SupabaseOAuthProviderId,\n  SupabaseOAuthRuntimeEnvironmentDefinition,\n  SupabaseOAuthSecretFieldDefinition,\n  SupabaseOAuthSecretPayload,\n} from './oauthProviderDefinitions.js';\nexport {\n  getSupabaseOAuthProviderDefinition,\n  isSupabaseOAuthProviderId,\n  materializeSupabaseOAuthEnvironment,\n  SUPABASE_OAUTH_PROVIDER_DEFINITIONS,\n  SUPABASE_OAUTH_PROVIDER_IDS,\n  validateSupabaseOAuthSecretPayload,\n} from './oauthProviderDefinitions.js';\nexport {\n  resolveSupabaseOAuthSetupPlan,\n  SUPABASE_OAUTH_SETUP_CAPABILITIES,\n} from './oauthSetupRequirements.js';\nexport {\n  createSupabaseOAuthProfileVerifier,\n  normalizeSupabaseAuthProfileVerificationConfig,\n  verifySupabaseOAuthProfile,\n} from './profileVerification.js';\nexport type {\n  SupabaseAuthConfig,\n  SupabaseAuthErrorCode,\n  SupabaseAuthProfileField,\n  SupabaseAuthProfileVerificationConfig,\n  SupabaseAuthRandomBytes,\n  SupabaseAuthStorage,\n  SupabaseOAuthLifecycleEvent,\n  SupabaseOAuthLifecycleObserver,\n  SupabaseOAuthLifecycleStatus,\n  SupabaseOAuthProfileVerificationInput,\n  SupabaseOAuthProfileVerificationResult,\n  SupabaseOAuthProfileVerifier,\n  SupabaseProviderErrorCause,\n} from './types.js';\nexport { SUPABASE_AUTH_PROFILE_FIELDS } from './types.js';\n"]}

package/dist/oauth.d.ts

@@ -0,0 +1,5 @@
+import type { AuthPort } from '@ankhorage/auth';
+import type { CreateSupabaseOAuthAdapterInput } from './oauthTypes.js';
+/*** Create the Supabase implementations of the neutral OAuth port operations. */
+export declare function createSupabaseOAuthAdapter(input: CreateSupabaseOAuthAdapterInput): Pick<AuthPort, 'startAuthorization' | 'completeAuthorization'>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAShD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAEvE,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,+BAA+B,GACrC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,GAAG,uBAAuB,CAAC,CAQhE"}

package/dist/oauth.js

@@ -0,0 +1,34 @@
+import { completeSupabaseOAuthAuthorization } from './oauthComplete.js';
+import { createOAuthRuntimeContext } from './oauthRuntime.js';
+import { startSupabaseOAuthAuthorization } from './oauthStart.js';
+/*** Create the Supabase implementations of the neutral OAuth port operations. */
+export function createSupabaseOAuthAdapter(input) {
+    const context = createOAuthRuntimeContext(input);
+    const completeAuthorization = createCompletionRunner(context);
+    return {
+        startAuthorization: (authorizationInput) => startSupabaseOAuthAuthorization(context, authorizationInput),
+        completeAuthorization,
+    };
+}
+/*** Serializes completion attempts so the same callback cannot be consumed concurrently. */
+function createCompletionRunner(context) {
+    let activeCompletion = null;
+    return async (input) => {
+        while (activeCompletion !== null)
+            await activeCompletion;
+        let releaseCompletion;
+        const completionLock = new Promise((resolve) => {
+            releaseCompletion = resolve;
+        });
+        activeCompletion = completionLock;
+        try {
+            return await completeSupabaseOAuthAuthorization(context, input);
+        }
+        finally {
+            if (activeCompletion === completionLock)
+                activeCompletion = null;
+            releaseCompletion?.();
+        }
+    };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAGlE,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CACxC,KAAsC;IAEtC,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC9D,OAAO;QACL,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,EAAE,CACzC,+BAA+B,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC9D,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,sBAAsB,CAC7B,OAAqD;IAErD,IAAI,gBAAgB,GAAyB,IAAI,CAAC;IAClD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,OAAO,gBAAgB,KAAK,IAAI;YAAE,MAAM,gBAAgB,CAAC;QACzD,IAAI,iBAA2C,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,iBAAiB,GAAG,OAAO,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,gBAAgB,GAAG,cAAc,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;gBAAS,CAAC;YACT,IAAI,gBAAgB,KAAK,cAAc;gBAAE,gBAAgB,GAAG,IAAI,CAAC;YACjE,iBAAiB,EAAE,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { AuthPort } from '@ankhorage/auth';\nimport type {\n  AuthOAuthCompletionResult,\n  CompleteOAuthAuthorizationInput,\n} from '@ankhorage/contracts/auth';\n\nimport { completeSupabaseOAuthAuthorization } from './oauthComplete.js';\nimport { createOAuthRuntimeContext } from './oauthRuntime.js';\nimport { startSupabaseOAuthAuthorization } from './oauthStart.js';\nimport type { CreateSupabaseOAuthAdapterInput } from './oauthTypes.js';\n\n/*** Create the Supabase implementations of the neutral OAuth port operations. */\nexport function createSupabaseOAuthAdapter(\n  input: CreateSupabaseOAuthAdapterInput,\n): Pick<AuthPort, 'startAuthorization' | 'completeAuthorization'> {\n  const context = createOAuthRuntimeContext(input);\n  const completeAuthorization = createCompletionRunner(context);\n  return {\n    startAuthorization: (authorizationInput) =>\n      startSupabaseOAuthAuthorization(context, authorizationInput),\n    completeAuthorization,\n  };\n}\n\n/*** Serializes completion attempts so the same callback cannot be consumed concurrently. */\nfunction createCompletionRunner(\n  context: ReturnType<typeof createOAuthRuntimeContext>,\n): (input: CompleteOAuthAuthorizationInput) => Promise<AuthOAuthCompletionResult> {\n  let activeCompletion: Promise<void> | null = null;\n  return async (input) => {\n    while (activeCompletion !== null) await activeCompletion;\n    let releaseCompletion: (() => void) | undefined;\n    const completionLock = new Promise<void>((resolve) => {\n      releaseCompletion = resolve;\n    });\n    activeCompletion = completionLock;\n    try {\n      return await completeSupabaseOAuthAuthorization(context, input);\n    } finally {\n      if (activeCompletion === completionLock) activeCompletion = null;\n      releaseCompletion?.();\n    }\n  };\n}\n"]}

package/dist/oauthAttemptId.d.ts

@@ -0,0 +1,9 @@
+interface OAuthAttemptIdRuntime {
+    readonly randomUuid?: () => string;
+    readonly fillRandomBytes?: (bytes: Uint8Array) => void;
+    readonly now: () => number;
+    readonly random: () => number;
+}
+export declare function createOAuthAttemptId(runtime?: OAuthAttemptIdRuntime): string;
+export {};
+//# sourceMappingURL=oauthAttemptId.d.ts.map

package/dist/oauthAttemptId.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthAttemptId.d.ts","sourceRoot":"","sources":["../src/oauthAttemptId.ts"],"names":[],"mappings":"AAMA,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACvD,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,qBAAsD,GAC9D,MAAM,CAeR"}

package/dist/oauthAttemptId.js

@@ -0,0 +1,51 @@
+const SECURE_RANDOM_BYTE_COUNT = 16;
+const FALLBACK_RANDOM_CHUNK_COUNT = 4;
+const RANDOM_CHUNK_RANGE = 0x1_0000_0000;
+let fallbackSequence = 0;
+export function createOAuthAttemptId(runtime = resolveOAuthAttemptIdRuntime()) {
+    if (runtime.randomUuid !== undefined)
+        return runtime.randomUuid();
+    if (runtime.fillRandomBytes !== undefined) {
+        const bytes = new Uint8Array(SECURE_RANDOM_BYTE_COUNT);
+        runtime.fillRandomBytes(bytes);
+        const value = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
+        return `oauth-${value}`;
+    }
+    fallbackSequence = (fallbackSequence + 1) % Number.MAX_SAFE_INTEGER;
+    const randomPart = Array.from({ length: FALLBACK_RANDOM_CHUNK_COUNT }, () => createFallbackRandomChunk(runtime.random)).join('');
+    return `oauth-${runtime.now().toString(36)}-${fallbackSequence.toString(36)}-${randomPart}`;
+}
+function resolveOAuthAttemptIdRuntime() {
+    const cryptoValue = Reflect.get(globalThis, 'crypto');
+    if (typeof cryptoValue !== 'object' || cryptoValue === null) {
+        return { now: Date.now, random: Math.random };
+    }
+    const randomUuidValue = Reflect.get(cryptoValue, 'randomUUID');
+    const randomValuesValue = Reflect.get(cryptoValue, 'getRandomValues');
+    const randomUuid = typeof randomUuidValue === 'function'
+        ? () => {
+            const value = Reflect.apply(randomUuidValue, cryptoValue, []);
+            if (typeof value !== 'string') {
+                throw new TypeError('crypto.randomUUID() must return a string.');
+            }
+            return value;
+        }
+        : undefined;
+    const fillRandomBytes = typeof randomValuesValue === 'function'
+        ? (bytes) => {
+            Reflect.apply(randomValuesValue, cryptoValue, [bytes]);
+        }
+        : undefined;
+    return {
+        ...(randomUuid === undefined ? {} : { randomUuid }),
+        ...(fillRandomBytes === undefined ? {} : { fillRandomBytes }),
+        now: Date.now,
+        random: Math.random,
+    };
+}
+function createFallbackRandomChunk(random) {
+    return Math.floor(random() * RANDOM_CHUNK_RANGE)
+        .toString(36)
+        .padStart(7, '0');
+}
+//# sourceMappingURL=oauthAttemptId.js.map

package/dist/oauthAttemptId.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthAttemptId.js","sourceRoot":"","sources":["../src/oauthAttemptId.ts"],"names":[],"mappings":"AAAA,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEzC,IAAI,gBAAgB,GAAG,CAAC,CAAC;AASzB,MAAM,UAAU,oBAAoB,CAClC,UAAiC,4BAA4B,EAAE;IAE/D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAElE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,CAAC;QACvD,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,SAAS,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,gBAAgB,GAAG,CAAC,gBAAgB,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACpE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,GAAG,EAAE,CAC1E,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,CAC1C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,SAAS,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,WAAW,GAAY,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,eAAe,GAAY,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAY,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAC/E,MAAM,UAAU,GACd,OAAO,eAAe,KAAK,UAAU;QACnC,CAAC,CAAC,GAAG,EAAE;YACH,MAAM,KAAK,GAAY,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,eAAe,GACnB,OAAO,iBAAiB,KAAK,UAAU;QACrC,CAAC,CAAC,CAAC,KAAiB,EAAE,EAAE;YACpB,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;QAC7D,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAoB;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,kBAAkB,CAAC;SAC7C,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtB,CAAC","sourcesContent":["const SECURE_RANDOM_BYTE_COUNT = 16;\nconst FALLBACK_RANDOM_CHUNK_COUNT = 4;\nconst RANDOM_CHUNK_RANGE = 0x1_0000_0000;\n\nlet fallbackSequence = 0;\n\ninterface OAuthAttemptIdRuntime {\n  readonly randomUuid?: () => string;\n  readonly fillRandomBytes?: (bytes: Uint8Array) => void;\n  readonly now: () => number;\n  readonly random: () => number;\n}\n\nexport function createOAuthAttemptId(\n  runtime: OAuthAttemptIdRuntime = resolveOAuthAttemptIdRuntime(),\n): string {\n  if (runtime.randomUuid !== undefined) return runtime.randomUuid();\n\n  if (runtime.fillRandomBytes !== undefined) {\n    const bytes = new Uint8Array(SECURE_RANDOM_BYTE_COUNT);\n    runtime.fillRandomBytes(bytes);\n    const value = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');\n    return `oauth-${value}`;\n  }\n\n  fallbackSequence = (fallbackSequence + 1) % Number.MAX_SAFE_INTEGER;\n  const randomPart = Array.from({ length: FALLBACK_RANDOM_CHUNK_COUNT }, () =>\n    createFallbackRandomChunk(runtime.random),\n  ).join('');\n  return `oauth-${runtime.now().toString(36)}-${fallbackSequence.toString(36)}-${randomPart}`;\n}\n\nfunction resolveOAuthAttemptIdRuntime(): OAuthAttemptIdRuntime {\n  const cryptoValue: unknown = Reflect.get(globalThis, 'crypto');\n  if (typeof cryptoValue !== 'object' || cryptoValue === null) {\n    return { now: Date.now, random: Math.random };\n  }\n\n  const randomUuidValue: unknown = Reflect.get(cryptoValue, 'randomUUID');\n  const randomValuesValue: unknown = Reflect.get(cryptoValue, 'getRandomValues');\n  const randomUuid =\n    typeof randomUuidValue === 'function'\n      ? () => {\n          const value: unknown = Reflect.apply(randomUuidValue, cryptoValue, []);\n          if (typeof value !== 'string') {\n            throw new TypeError('crypto.randomUUID() must return a string.');\n          }\n          return value;\n        }\n      : undefined;\n  const fillRandomBytes =\n    typeof randomValuesValue === 'function'\n      ? (bytes: Uint8Array) => {\n          Reflect.apply(randomValuesValue, cryptoValue, [bytes]);\n        }\n      : undefined;\n\n  return {\n    ...(randomUuid === undefined ? {} : { randomUuid }),\n    ...(fillRandomBytes === undefined ? {} : { fillRandomBytes }),\n    now: Date.now,\n    random: Math.random,\n  };\n}\n\nfunction createFallbackRandomChunk(random: () => number): string {\n  return Math.floor(random() * RANDOM_CHUNK_RANGE)\n    .toString(36)\n    .padStart(7, '0');\n}\n"]}

package/dist/oauthCallback.d.ts

@@ -0,0 +1,23 @@
+import type { AuthOAuthCompletionResult, CompleteOAuthAuthorizationInput } from '@ankhorage/contracts/auth';
+import type { SupabaseOAuthProviderId } from './oauthProviderDefinitions.js';
+import type { StoredOAuthAttempt } from './oauthTypes.js';
+type ParsedCallback = {
+    type: 'code';
+    code: string;
+} | {
+    type: 'cancelled';
+} | {
+    type: 'error';
+    result: AuthOAuthCompletionResult;
+};
+/*** Validates an OAuth replay against the callback fingerprint stored for its attempt. */
+export declare function completeOAuthReplay(input: CompleteOAuthAuthorizationInput, attempt: StoredOAuthAttempt): AuthOAuthCompletionResult;
+/*** Parses and validates the provider callback against the stored redirect URI. */
+export declare function parseCallback(rawCallbackUrl: string, attempt: StoredOAuthAttempt): ParsedCallback;
+/*** Creates a safe invalid-callback completion result. */
+export declare function invalidCallback(provider: SupabaseOAuthProviderId, message: string): {
+    type: 'error';
+    result: AuthOAuthCompletionResult;
+};
+export {};
+//# sourceMappingURL=oauthCallback.d.ts.map

package/dist/oauthCallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCallback.d.ts","sourceRoot":"","sources":["../src/oauthCallback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAI1D,KAAK,cAAc,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAEzD,0FAA0F;AAC1F,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,+BAA+B,EACtC,OAAO,EAAE,kBAAkB,GAC1B,yBAAyB,CAkB3B;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,cAAc,CAmBjG;AAED,0DAA0D;AAC1D,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,uBAAuB,EACjC,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAKtD"}

package/dist/oauthCallback.js

@@ -0,0 +1,81 @@
+import { oauthCompletionError } from './oauthErrors.js';
+import { constantTimeEqual, fingerprintOAuthCallback } from './oauthStorage.js';
+const CALLBACK_PARAMS = new Set(['code', 'error', 'error_code', 'error_description']);
+/*** Validates an OAuth replay against the callback fingerprint stored for its attempt. */
+export function completeOAuthReplay(input, attempt) {
+    if (input.response.type !== 'callback')
+        return replayMismatch(attempt.provider, 'response');
+    const callback = parseCallback(input.response.url, attempt);
+    if (callback.type !== 'code')
+        return replayMismatch(attempt.provider, 'callback');
+    const fingerprint = fingerprintOAuthCallback(attempt.id, callback.code);
+    if (attempt.callbackFingerprint === undefined ||
+        !constantTimeEqual(fingerprint, attempt.callbackFingerprint)) {
+        return replayMismatch(attempt.provider, 'callback');
+    }
+    return oauthCompletionError('callback_already_completed', 'callback', 'The OAuth authorization callback was already handled.', attempt.provider, false);
+}
+/*** Parses and validates the provider callback against the stored redirect URI. */
+export function parseCallback(rawCallbackUrl, attempt) {
+    const locations = parseCallbackLocations(rawCallbackUrl, attempt.redirectUri);
+    if (locations === null)
+        return invalidCallback(attempt.provider, 'The OAuth callback URL is invalid.');
+    if (!sameCallbackLocation(locations.callback, locations.redirect) ||
+        locations.callback.hash.length > 0) {
+        return invalidCallback(attempt.provider, 'The OAuth callback does not match the expected redirect URI.');
+    }
+    const unexpected = [...locations.callback.searchParams.keys()].find((key) => !CALLBACK_PARAMS.has(key));
+    if (unexpected !== undefined)
+        return invalidCallback(attempt.provider, 'The OAuth callback contains unexpected parameters.');
+    return classifyCallback(locations.callback.searchParams, attempt.provider);
+}
+/*** Creates a safe invalid-callback completion result. */
+export function invalidCallback(provider, message) {
+    return {
+        type: 'error',
+        result: oauthCompletionError('invalid_callback', 'callback', message, provider, true),
+    };
+}
+function classifyCallback(parameters, provider) {
+    const codes = parameters.getAll('code');
+    const errors = [...parameters.getAll('error'), ...parameters.getAll('error_code')].filter((value) => value.length > 0);
+    if (parameters.getAll('error_description').length > 0 && errors.length === 0) {
+        return invalidCallback(provider, 'The OAuth callback contains an error description without an error.');
+    }
+    if (codes.length > 0 && errors.length > 0) {
+        return invalidCallback(provider, 'The OAuth callback contains both a code and an error.');
+    }
+    if (errors.length > 0)
+        return classifyProviderError(errors, provider);
+    const code = codes.at(0);
+    return codes.length === 1 && code !== undefined && code.trim().length > 0
+        ? { type: 'code', code }
+        : invalidCallback(provider, 'The OAuth callback does not contain one authorization code.');
+}
+function classifyProviderError(errors, provider) {
+    if (errors.length === 1 && errors.at(0) === 'access_denied')
+        return { type: 'cancelled' };
+    return {
+        type: 'error',
+        result: oauthCompletionError('authorization_failed', 'callback', 'The OAuth provider rejected the authorization request.', provider, true),
+    };
+}
+function parseCallbackLocations(rawCallbackUrl, rawRedirectUri) {
+    try {
+        return { callback: new URL(rawCallbackUrl), redirect: new URL(rawRedirectUri) };
+    }
+    catch {
+        return null;
+    }
+}
+function sameCallbackLocation(callback, redirect) {
+    return (callback.protocol === redirect.protocol &&
+        callback.username === redirect.username &&
+        callback.password === redirect.password &&
+        callback.host === redirect.host &&
+        callback.pathname === redirect.pathname);
+}
+function replayMismatch(provider, subject) {
+    return invalidCallback(provider, `The OAuth ${subject} does not match the completed authorization callback.`).result;
+}
+//# sourceMappingURL=oauthCallback.js.map

package/dist/oauthCallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCallback.js","sourceRoot":"","sources":["../src/oauthCallback.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAGhF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAOtF,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CACjC,KAAsC,EACtC,OAA2B;IAE3B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxE,IACE,OAAO,CAAC,mBAAmB,KAAK,SAAS;QACzC,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAC5D,CAAC;QACD,OAAO,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,oBAAoB,CACzB,4BAA4B,EAC5B,UAAU,EACV,uDAAuD,EACvD,OAAO,CAAC,QAAQ,EAChB,KAAK,CACN,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,cAAsB,EAAE,OAA2B;IAC/E,MAAM,SAAS,GAAG,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9E,IAAI,SAAS,KAAK,IAAI;QACpB,OAAO,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,oCAAoC,CAAC,CAAC;IACjF,IACE,CAAC,oBAAoB,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC7D,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAClC,CAAC;QACD,OAAO,eAAe,CACpB,OAAO,CAAC,QAAQ,EAChB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CACnC,CAAC;IACF,IAAI,UAAU,KAAK,SAAS;QAC1B,OAAO,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;IACjG,OAAO,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAC7B,QAAiC,EACjC,OAAe;IAEf,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC;KACtF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAA2B,EAC3B,QAAiC;IAEjC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CACvF,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAC5B,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,eAAe,CACpB,QAAQ,EACR,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,eAAe,CAAC,QAAQ,EAAE,uDAAuD,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QACxB,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,6DAA6D,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAyB,EACzB,QAAiC;IAEjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1F,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,oBAAoB,CAC1B,sBAAsB,EACtB,UAAU,EACV,wDAAwD,EACxD,QAAQ,EACR,IAAI,CACL;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,cAAsB,EACtB,cAAsB;IAEtB,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAa,EAAE,QAAa;IACxD,OAAO,CACL,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACvC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACvC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACvC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAC/B,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,QAAiC,EACjC,OAAgC;IAEhC,OAAO,eAAe,CACpB,QAAQ,EACR,aAAa,OAAO,uDAAuD,CAC5E,CAAC,MAAM,CAAC;AACX,CAAC","sourcesContent":["import type {\n  AuthOAuthCompletionResult,\n  CompleteOAuthAuthorizationInput,\n} from '@ankhorage/contracts/auth';\n\nimport { oauthCompletionError } from './oauthErrors.js';\nimport type { SupabaseOAuthProviderId } from './oauthProviderDefinitions.js';\nimport { constantTimeEqual, fingerprintOAuthCallback } from './oauthStorage.js';\nimport type { StoredOAuthAttempt } from './oauthTypes.js';\n\nconst CALLBACK_PARAMS = new Set(['code', 'error', 'error_code', 'error_description']);\n\ntype ParsedCallback =\n  | { type: 'code'; code: string }\n  | { type: 'cancelled' }\n  | { type: 'error'; result: AuthOAuthCompletionResult };\n\n/*** Validates an OAuth replay against the callback fingerprint stored for its attempt. */\nexport function completeOAuthReplay(\n  input: CompleteOAuthAuthorizationInput,\n  attempt: StoredOAuthAttempt,\n): AuthOAuthCompletionResult {\n  if (input.response.type !== 'callback') return replayMismatch(attempt.provider, 'response');\n  const callback = parseCallback(input.response.url, attempt);\n  if (callback.type !== 'code') return replayMismatch(attempt.provider, 'callback');\n  const fingerprint = fingerprintOAuthCallback(attempt.id, callback.code);\n  if (\n    attempt.callbackFingerprint === undefined ||\n    !constantTimeEqual(fingerprint, attempt.callbackFingerprint)\n  ) {\n    return replayMismatch(attempt.provider, 'callback');\n  }\n  return oauthCompletionError(\n    'callback_already_completed',\n    'callback',\n    'The OAuth authorization callback was already handled.',\n    attempt.provider,\n    false,\n  );\n}\n\n/*** Parses and validates the provider callback against the stored redirect URI. */\nexport function parseCallback(rawCallbackUrl: string, attempt: StoredOAuthAttempt): ParsedCallback {\n  const locations = parseCallbackLocations(rawCallbackUrl, attempt.redirectUri);\n  if (locations === null)\n    return invalidCallback(attempt.provider, 'The OAuth callback URL is invalid.');\n  if (\n    !sameCallbackLocation(locations.callback, locations.redirect) ||\n    locations.callback.hash.length > 0\n  ) {\n    return invalidCallback(\n      attempt.provider,\n      'The OAuth callback does not match the expected redirect URI.',\n    );\n  }\n  const unexpected = [...locations.callback.searchParams.keys()].find(\n    (key) => !CALLBACK_PARAMS.has(key),\n  );\n  if (unexpected !== undefined)\n    return invalidCallback(attempt.provider, 'The OAuth callback contains unexpected parameters.');\n  return classifyCallback(locations.callback.searchParams, attempt.provider);\n}\n\n/*** Creates a safe invalid-callback completion result. */\nexport function invalidCallback(\n  provider: SupabaseOAuthProviderId,\n  message: string,\n): { type: 'error'; result: AuthOAuthCompletionResult } {\n  return {\n    type: 'error',\n    result: oauthCompletionError('invalid_callback', 'callback', message, provider, true),\n  };\n}\n\nfunction classifyCallback(\n  parameters: URLSearchParams,\n  provider: SupabaseOAuthProviderId,\n): ParsedCallback {\n  const codes = parameters.getAll('code');\n  const errors = [...parameters.getAll('error'), ...parameters.getAll('error_code')].filter(\n    (value) => value.length > 0,\n  );\n  if (parameters.getAll('error_description').length > 0 && errors.length === 0) {\n    return invalidCallback(\n      provider,\n      'The OAuth callback contains an error description without an error.',\n    );\n  }\n  if (codes.length > 0 && errors.length > 0) {\n    return invalidCallback(provider, 'The OAuth callback contains both a code and an error.');\n  }\n  if (errors.length > 0) return classifyProviderError(errors, provider);\n  const code = codes.at(0);\n  return codes.length === 1 && code !== undefined && code.trim().length > 0\n    ? { type: 'code', code }\n    : invalidCallback(provider, 'The OAuth callback does not contain one authorization code.');\n}\n\nfunction classifyProviderError(\n  errors: readonly string[],\n  provider: SupabaseOAuthProviderId,\n): ParsedCallback {\n  if (errors.length === 1 && errors.at(0) === 'access_denied') return { type: 'cancelled' };\n  return {\n    type: 'error',\n    result: oauthCompletionError(\n      'authorization_failed',\n      'callback',\n      'The OAuth provider rejected the authorization request.',\n      provider,\n      true,\n    ),\n  };\n}\n\nfunction parseCallbackLocations(\n  rawCallbackUrl: string,\n  rawRedirectUri: string,\n): { callback: URL; redirect: URL } | null {\n  try {\n    return { callback: new URL(rawCallbackUrl), redirect: new URL(rawRedirectUri) };\n  } catch {\n    return null;\n  }\n}\n\nfunction sameCallbackLocation(callback: URL, redirect: URL): boolean {\n  return (\n    callback.protocol === redirect.protocol &&\n    callback.username === redirect.username &&\n    callback.password === redirect.password &&\n    callback.host === redirect.host &&\n    callback.pathname === redirect.pathname\n  );\n}\n\nfunction replayMismatch(\n  provider: SupabaseOAuthProviderId,\n  subject: 'response' | 'callback',\n): AuthOAuthCompletionResult {\n  return invalidCallback(\n    provider,\n    `The OAuth ${subject} does not match the completed authorization callback.`,\n  ).result;\n}\n"]}

package/dist/oauthComplete.d.ts

@@ -0,0 +1,5 @@
+import type { AuthOAuthCompletionResult, CompleteOAuthAuthorizationInput } from '@ankhorage/contracts/auth';
+import type { OAuthRuntimeContext } from './oauthRuntime.js';
+/*** Completes one Supabase OAuth authorization attempt. */
+export declare function completeSupabaseOAuthAuthorization(context: OAuthRuntimeContext, input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;
+//# sourceMappingURL=oauthComplete.d.ts.map

package/dist/oauthComplete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthComplete.d.ts","sourceRoot":"","sources":["../src/oauthComplete.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,2BAA2B,CAAC;AAWnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AA2B7D,2DAA2D;AAC3D,wBAAsB,kCAAkC,CACtD,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,yBAAyB,CAAC,CAapC"}