@ankhorage/auth-supabase 0.0.0-stage → 2.0.1

package/dist/oauthProviderDefinitions.js

@@ -0,0 +1,114 @@
+export const SUPABASE_OAUTH_PROVIDER_IDS = ['google', 'apple'];
+const SHARED_SECRET_FIELDS = [
+    { name: 'clientId', label: 'Client ID', secret: false },
+    { name: 'clientSecret', label: 'Client secret', secret: true },
+];
+export const SUPABASE_OAUTH_PROVIDER_DEFINITIONS = {
+    google: {
+        id: 'google',
+        label: 'Google',
+        defaultScopes: ['openid', 'email', 'profile'],
+        secretFields: SHARED_SECRET_FIELDS,
+        runtimeEnvironment: {
+            enabled: 'GOTRUE_EXTERNAL_GOOGLE_ENABLED',
+            clientId: 'GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID',
+            clientSecret: 'GOTRUE_EXTERNAL_GOOGLE_SECRET',
+            redirectUri: 'GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI',
+        },
+    },
+    apple: {
+        id: 'apple',
+        label: 'Apple',
+        defaultScopes: ['name', 'email'],
+        secretFields: SHARED_SECRET_FIELDS,
+        runtimeEnvironment: {
+            enabled: 'GOTRUE_EXTERNAL_APPLE_ENABLED',
+            clientId: 'GOTRUE_EXTERNAL_APPLE_CLIENT_ID',
+            clientSecret: 'GOTRUE_EXTERNAL_APPLE_SECRET',
+            redirectUri: 'GOTRUE_EXTERNAL_APPLE_REDIRECT_URI',
+        },
+    },
+};
+const SUPABASE_OAUTH_PROVIDER_DEFINITION_MAP = new Map(Object.entries(SUPABASE_OAUTH_PROVIDER_DEFINITIONS));
+export function isSupabaseOAuthProviderId(provider) {
+    return SUPABASE_OAUTH_PROVIDER_IDS.includes(provider);
+}
+export function getSupabaseOAuthProviderDefinition(provider) {
+    return isSupabaseOAuthProviderId(provider)
+        ? (SUPABASE_OAUTH_PROVIDER_DEFINITION_MAP.get(provider) ?? null)
+        : null;
+}
+export function validateSupabaseOAuthSecretPayload(provider, payload) {
+    const definition = getSupabaseOAuthProviderDefinition(provider);
+    if (definition === null) {
+        return {
+            ok: false,
+            error: {
+                code: 'invalid_config',
+                message: `Supabase OAuth provider "${provider}" is not supported by the current provider registry.`,
+            },
+        };
+    }
+    const { clientId } = payload;
+    const { clientSecret } = payload;
+    const missingFields = definition.secretFields
+        .map((field) => field.name)
+        .filter((field) => {
+        const value = Reflect.get(payload, field);
+        return typeof value !== 'string' || value.trim().length === 0;
+    });
+    if (missingFields.length > 0 ||
+        typeof clientId !== 'string' ||
+        typeof clientSecret !== 'string') {
+        return {
+            ok: false,
+            error: {
+                code: 'invalid_payload',
+                message: `OAuth credentials for "${provider}" are missing required fields: ${missingFields.join(', ')}.`,
+            },
+        };
+    }
+    return {
+        ok: true,
+        data: {
+            ...payload,
+            clientId,
+            clientSecret,
+        },
+    };
+}
+export function materializeSupabaseOAuthEnvironment(input) {
+    const definition = getSupabaseOAuthProviderDefinition(input.provider);
+    if (definition === null) {
+        return {
+            ok: false,
+            error: {
+                code: 'invalid_config',
+                message: `Supabase OAuth provider "${input.provider}" is not supported by the current provider registry.`,
+            },
+        };
+    }
+    const payloadResult = validateSupabaseOAuthSecretPayload(input.provider, input.payload);
+    if (!payloadResult.ok)
+        return payloadResult;
+    const redirectUri = input.redirectUri.trim();
+    if (redirectUri.length === 0) {
+        return {
+            ok: false,
+            error: {
+                code: 'invalid_config',
+                message: `OAuth provider "${input.provider}" requires a redirect URI.`,
+            },
+        };
+    }
+    return {
+        ok: true,
+        data: {
+            [definition.runtimeEnvironment.enabled]: 'true',
+            [definition.runtimeEnvironment.clientId]: payloadResult.data.clientId,
+            [definition.runtimeEnvironment.clientSecret]: payloadResult.data.clientSecret,
+            [definition.runtimeEnvironment.redirectUri]: redirectUri,
+        },
+    };
+}
+//# sourceMappingURL=oauthProviderDefinitions.js.map

package/dist/oauthProviderDefinitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthProviderDefinitions.js","sourceRoot":"","sources":["../src/oauthProviderDefinitions.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AA6BxE,MAAM,oBAAoB,GAAG;IAC3B,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE;IACvD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE;CACE,CAAC;AAEnE,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAC7C,YAAY,EAAE,oBAAoB;QAClC,kBAAkB,EAAE;YAClB,OAAO,EAAE,gCAAgC;YACzC,QAAQ,EAAE,kCAAkC;YAC5C,YAAY,EAAE,+BAA+B;YAC7C,WAAW,EAAE,qCAAqC;SACnD;KACF;IACD,KAAK,EAAE;QACL,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAChC,YAAY,EAAE,oBAAoB;QAClC,kBAAkB,EAAE;YAClB,OAAO,EAAE,+BAA+B;YACxC,QAAQ,EAAE,iCAAiC;YAC3C,YAAY,EAAE,8BAA8B;YAC5C,WAAW,EAAE,oCAAoC;SAClD;KACF;CACkF,CAAC;AAEtF,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAIpD,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAG/C,CACJ,CAAC;AAEF,MAAM,UAAU,yBAAyB,CACvC,QAA6B;IAE7B,OAAQ,2BAAiD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,QAA6B;IAE7B,OAAO,yBAAyB,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,CAAC,sCAAsC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,QAA6B,EAC7B,OAAsB;IAEtB,MAAM,UAAU,GAAG,kCAAkC,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,4BAA4B,QAAQ,sDAAsD;aACpG;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY;SAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEL,IACE,aAAa,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,YAAY,KAAK,QAAQ,EAChC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B,QAAQ,kCAAkC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aACzG;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,GAAG,OAAO;YACV,QAAQ;YACR,YAAY;SACb;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAInD;IACC,MAAM,UAAU,GAAG,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,4BAA4B,KAAK,CAAC,QAAQ,sDAAsD;aAC1G;SACF,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kCAAkC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAE5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,mBAAmB,KAAK,CAAC,QAAQ,4BAA4B;aACvE;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,CAAC,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM;YAC/C,CAAC,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ;YACrE,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY;YAC7E,CAAC,UAAU,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,WAAW;SACzD;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AuthOAuthProviderId } from '@ankhorage/contracts/auth';\nimport type { SecretPayload, SecretStoreResult } from '@ankhorage/contracts/secrets';\n\nexport const SUPABASE_OAUTH_PROVIDER_IDS = ['google', 'apple'] as const;\nexport type SupabaseOAuthProviderId = (typeof SUPABASE_OAUTH_PROVIDER_IDS)[number];\n\nexport type SupabaseOAuthSecretPayload = SecretPayload & {\n  readonly clientId: string;\n  readonly clientSecret: string;\n};\n\nexport interface SupabaseOAuthSecretFieldDefinition {\n  name: 'clientId' | 'clientSecret';\n  label: string;\n  secret: boolean;\n}\n\nexport interface SupabaseOAuthRuntimeEnvironmentDefinition {\n  enabled: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n}\n\nexport interface SupabaseOAuthProviderDefinition {\n  id: SupabaseOAuthProviderId;\n  label: string;\n  defaultScopes: readonly string[];\n  secretFields: readonly SupabaseOAuthSecretFieldDefinition[];\n  runtimeEnvironment: SupabaseOAuthRuntimeEnvironmentDefinition;\n}\n\nconst SHARED_SECRET_FIELDS = [\n  { name: 'clientId', label: 'Client ID', secret: false },\n  { name: 'clientSecret', label: 'Client secret', secret: true },\n] as const satisfies readonly SupabaseOAuthSecretFieldDefinition[];\n\nexport const SUPABASE_OAUTH_PROVIDER_DEFINITIONS = {\n  google: {\n    id: 'google',\n    label: 'Google',\n    defaultScopes: ['openid', 'email', 'profile'],\n    secretFields: SHARED_SECRET_FIELDS,\n    runtimeEnvironment: {\n      enabled: 'GOTRUE_EXTERNAL_GOOGLE_ENABLED',\n      clientId: 'GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID',\n      clientSecret: 'GOTRUE_EXTERNAL_GOOGLE_SECRET',\n      redirectUri: 'GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI',\n    },\n  },\n  apple: {\n    id: 'apple',\n    label: 'Apple',\n    defaultScopes: ['name', 'email'],\n    secretFields: SHARED_SECRET_FIELDS,\n    runtimeEnvironment: {\n      enabled: 'GOTRUE_EXTERNAL_APPLE_ENABLED',\n      clientId: 'GOTRUE_EXTERNAL_APPLE_CLIENT_ID',\n      clientSecret: 'GOTRUE_EXTERNAL_APPLE_SECRET',\n      redirectUri: 'GOTRUE_EXTERNAL_APPLE_REDIRECT_URI',\n    },\n  },\n} as const satisfies Record<SupabaseOAuthProviderId, SupabaseOAuthProviderDefinition>;\n\nconst SUPABASE_OAUTH_PROVIDER_DEFINITION_MAP = new Map<\n  SupabaseOAuthProviderId,\n  SupabaseOAuthProviderDefinition\n>(\n  Object.entries(SUPABASE_OAUTH_PROVIDER_DEFINITIONS) as [\n    SupabaseOAuthProviderId,\n    SupabaseOAuthProviderDefinition,\n  ][],\n);\n\nexport function isSupabaseOAuthProviderId(\n  provider: AuthOAuthProviderId,\n): provider is SupabaseOAuthProviderId {\n  return (SUPABASE_OAUTH_PROVIDER_IDS as readonly string[]).includes(provider);\n}\n\nexport function getSupabaseOAuthProviderDefinition(\n  provider: AuthOAuthProviderId,\n): SupabaseOAuthProviderDefinition | null {\n  return isSupabaseOAuthProviderId(provider)\n    ? (SUPABASE_OAUTH_PROVIDER_DEFINITION_MAP.get(provider) ?? null)\n    : null;\n}\n\nexport function validateSupabaseOAuthSecretPayload(\n  provider: AuthOAuthProviderId,\n  payload: SecretPayload,\n): SecretStoreResult<SupabaseOAuthSecretPayload> {\n  const definition = getSupabaseOAuthProviderDefinition(provider);\n  if (definition === null) {\n    return {\n      ok: false,\n      error: {\n        code: 'invalid_config',\n        message: `Supabase OAuth provider \"${provider}\" is not supported by the current provider registry.`,\n      },\n    };\n  }\n\n  const { clientId } = payload;\n  const { clientSecret } = payload;\n  const missingFields = definition.secretFields\n    .map((field) => field.name)\n    .filter((field) => {\n      const value: unknown = Reflect.get(payload, field);\n      return typeof value !== 'string' || value.trim().length === 0;\n    });\n\n  if (\n    missingFields.length > 0 ||\n    typeof clientId !== 'string' ||\n    typeof clientSecret !== 'string'\n  ) {\n    return {\n      ok: false,\n      error: {\n        code: 'invalid_payload',\n        message: `OAuth credentials for \"${provider}\" are missing required fields: ${missingFields.join(', ')}.`,\n      },\n    };\n  }\n\n  return {\n    ok: true,\n    data: {\n      ...payload,\n      clientId,\n      clientSecret,\n    },\n  };\n}\n\nexport function materializeSupabaseOAuthEnvironment(input: {\n  provider: AuthOAuthProviderId;\n  payload: SecretPayload;\n  redirectUri: string;\n}): SecretStoreResult<Readonly<Record<string, string>>> {\n  const definition = getSupabaseOAuthProviderDefinition(input.provider);\n  if (definition === null) {\n    return {\n      ok: false,\n      error: {\n        code: 'invalid_config',\n        message: `Supabase OAuth provider \"${input.provider}\" is not supported by the current provider registry.`,\n      },\n    };\n  }\n\n  const payloadResult = validateSupabaseOAuthSecretPayload(input.provider, input.payload);\n  if (!payloadResult.ok) return payloadResult;\n\n  const redirectUri = input.redirectUri.trim();\n  if (redirectUri.length === 0) {\n    return {\n      ok: false,\n      error: {\n        code: 'invalid_config',\n        message: `OAuth provider \"${input.provider}\" requires a redirect URI.`,\n      },\n    };\n  }\n\n  return {\n    ok: true,\n    data: {\n      [definition.runtimeEnvironment.enabled]: 'true',\n      [definition.runtimeEnvironment.clientId]: payloadResult.data.clientId,\n      [definition.runtimeEnvironment.clientSecret]: payloadResult.data.clientSecret,\n      [definition.runtimeEnvironment.redirectUri]: redirectUri,\n    },\n  };\n}\n"]}

package/dist/oauthRuntime.d.ts

@@ -0,0 +1,23 @@
+import type { AuthOAuthStartResult } from '@ankhorage/contracts/auth';
+import type { SupabaseOAuthProviderId } from './oauthProviderDefinitions.js';
+import type { CreateSupabaseOAuthAdapterInput } from './oauthTypes.js';
+export interface OAuthRuntimeContext extends CreateSupabaseOAuthAdapterInput {
+    readonly providers: [SupabaseOAuthProviderId, ...SupabaseOAuthProviderId[]];
+    readonly providerSet: ReadonlySet<SupabaseOAuthProviderId>;
+    readonly attemptStorageKey: string;
+    readonly consumedCallbacksStorageKey: string;
+    readonly codeVerifierStorageKey: string;
+    readonly now: () => number;
+    readonly attemptLifetimeMs: number;
+}
+export declare function createOAuthRuntimeContext(input: CreateSupabaseOAuthAdapterInput): OAuthRuntimeContext;
+export type OAuthStartPreparation = {
+    readonly ok: true;
+    readonly provider: SupabaseOAuthProviderId;
+    readonly redirectUri: string;
+    readonly queryParams: Readonly<Record<string, string>>;
+} | {
+    readonly ok: false;
+    readonly result: AuthOAuthStartResult;
+};
+//# sourceMappingURL=oauthRuntime.d.ts.map

package/dist/oauthRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRuntime.d.ts","sourceRoot":"","sources":["../src/oauthRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE7E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAEvE,MAAM,WAAW,mBAAoB,SAAQ,+BAA+B;IAC1E,QAAQ,CAAC,SAAS,EAAE,CAAC,uBAAuB,EAAE,GAAG,uBAAuB,EAAE,CAAC,CAAC;IAC5E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAC3D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,+BAA+B,GACrC,mBAAmB,CAkBrB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC"}

package/dist/oauthRuntime.js

@@ -0,0 +1,22 @@
+import { normalizeAttemptLifetime } from './oauthStorage.js';
+export function createOAuthRuntimeContext(input) {
+    const providers = [...new Set(input.providers)];
+    if (providers.length === 0) {
+        throw new TypeError('At least one enabled Supabase OAuth provider is required.');
+    }
+    const [firstProvider, ...remainingProviders] = providers;
+    if (firstProvider === undefined)
+        throw new TypeError('An OAuth provider is required.');
+    const oauthStorageKey = `${input.storageKey}.oauth`;
+    return {
+        ...input,
+        providers: [firstProvider, ...remainingProviders],
+        providerSet: new Set(providers),
+        attemptStorageKey: `${oauthStorageKey}.attempt`,
+        consumedCallbacksStorageKey: `${oauthStorageKey}.consumed-callbacks`,
+        codeVerifierStorageKey: `${oauthStorageKey}.pkce-verifier`,
+        now: input.now ?? Date.now,
+        attemptLifetimeMs: normalizeAttemptLifetime(input.attemptLifetimeMs),
+    };
+}
+//# sourceMappingURL=oauthRuntime.js.map

package/dist/oauthRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRuntime.js","sourceRoot":"","sources":["../src/oauthRuntime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAa7D,MAAM,UAAU,yBAAyB,CACvC,KAAsC;IAEtC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,aAAa,EAAE,GAAG,kBAAkB,CAAC,GAAG,SAAS,CAAC;IACzD,IAAI,aAAa,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACvF,MAAM,eAAe,GAAG,GAAG,KAAK,CAAC,UAAU,QAAQ,CAAC;IACpD,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,CAAC,aAAa,EAAE,GAAG,kBAAkB,CAAC;QACjD,WAAW,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC;QAC/B,iBAAiB,EAAE,GAAG,eAAe,UAAU;QAC/C,2BAA2B,EAAE,GAAG,eAAe,qBAAqB;QACpE,sBAAsB,EAAE,GAAG,eAAe,gBAAgB;QAC1D,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QAC1B,iBAAiB,EAAE,wBAAwB,CAAC,KAAK,CAAC,iBAAiB,CAAC;KACrE,CAAC;AACJ,CAAC","sourcesContent":["import type { AuthOAuthStartResult } from '@ankhorage/contracts/auth';\n\nimport type { SupabaseOAuthProviderId } from './oauthProviderDefinitions.js';\nimport { normalizeAttemptLifetime } from './oauthStorage.js';\nimport type { CreateSupabaseOAuthAdapterInput } from './oauthTypes.js';\n\nexport interface OAuthRuntimeContext extends CreateSupabaseOAuthAdapterInput {\n  readonly providers: [SupabaseOAuthProviderId, ...SupabaseOAuthProviderId[]];\n  readonly providerSet: ReadonlySet<SupabaseOAuthProviderId>;\n  readonly attemptStorageKey: string;\n  readonly consumedCallbacksStorageKey: string;\n  readonly codeVerifierStorageKey: string;\n  readonly now: () => number;\n  readonly attemptLifetimeMs: number;\n}\n\nexport function createOAuthRuntimeContext(\n  input: CreateSupabaseOAuthAdapterInput,\n): OAuthRuntimeContext {\n  const providers = [...new Set(input.providers)];\n  if (providers.length === 0) {\n    throw new TypeError('At least one enabled Supabase OAuth provider is required.');\n  }\n  const [firstProvider, ...remainingProviders] = providers;\n  if (firstProvider === undefined) throw new TypeError('An OAuth provider is required.');\n  const oauthStorageKey = `${input.storageKey}.oauth`;\n  return {\n    ...input,\n    providers: [firstProvider, ...remainingProviders],\n    providerSet: new Set(providers),\n    attemptStorageKey: `${oauthStorageKey}.attempt`,\n    consumedCallbacksStorageKey: `${oauthStorageKey}.consumed-callbacks`,\n    codeVerifierStorageKey: `${oauthStorageKey}.pkce-verifier`,\n    now: input.now ?? Date.now,\n    attemptLifetimeMs: normalizeAttemptLifetime(input.attemptLifetimeMs),\n  };\n}\n\nexport type OAuthStartPreparation =\n  | {\n      readonly ok: true;\n      readonly provider: SupabaseOAuthProviderId;\n      readonly redirectUri: string;\n      readonly queryParams: Readonly<Record<string, string>>;\n    }\n  | { readonly ok: false; readonly result: AuthOAuthStartResult };\n"]}

package/dist/oauthSetupRequirements.d.ts

@@ -0,0 +1,12 @@
+import { type AuthOAuthProviderId, type AuthOAuthSetupPlan, type AuthOAuthTransportId } from '@ankhorage/contracts/auth';
+export declare const SUPABASE_OAUTH_SETUP_CAPABILITIES: {
+    readonly providers: readonly ["google", "apple"];
+    readonly transports: readonly ["brokeredRedirect"];
+};
+export declare function resolveSupabaseOAuthSetupPlan(input: {
+    readonly provider: AuthOAuthProviderId;
+    readonly transport: AuthOAuthTransportId;
+    readonly environment: AuthOAuthSetupPlan['environment'];
+    readonly targets: AuthOAuthSetupPlan['targets'];
+}): AuthOAuthSetupPlan | null;
+//# sourceMappingURL=oauthSetupRequirements.d.ts.map

package/dist/oauthSetupRequirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthSetupRequirements.d.ts","sourceRoot":"","sources":["../src/oauthSetupRequirements.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAExB,KAAK,kBAAkB,EAEvB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAOnC,eAAO,MAAM,iCAAiC;;;CAGC,CAAC;AAEhD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACxD,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;CACjD,GAAG,kBAAkB,GAAG,IAAI,CAkC5B"}

package/dist/oauthSetupRequirements.js

@@ -0,0 +1,39 @@
+import { AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS, AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES, } from '@ankhorage/contracts/auth';
+import { getSupabaseOAuthProviderDefinition, SUPABASE_OAUTH_PROVIDER_IDS, } from './oauthProviderDefinitions.js';
+export const SUPABASE_OAUTH_SETUP_CAPABILITIES = {
+    providers: SUPABASE_OAUTH_PROVIDER_IDS,
+    transports: ['brokeredRedirect'],
+};
+export function resolveSupabaseOAuthSetupPlan(input) {
+    if (input.transport !== 'brokeredRedirect')
+        return null;
+    const definition = getSupabaseOAuthProviderDefinition(input.provider);
+    if (definition === null)
+        return null;
+    const targets = [...new Set(input.targets)];
+    const requirements = definition.secretFields.map((field) => ({
+        kind: 'field',
+        key: field.name,
+        label: field.label,
+        required: true,
+        sensitivity: AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES[field.secret ? 1 : 0],
+        persistence: AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS[0],
+    }));
+    requirements.push({
+        kind: 'callback',
+        role: 'provider',
+        label: 'Provider callback URI',
+        required: true,
+    });
+    for (const target of targets) {
+        requirements.push({
+            kind: 'callback',
+            role: 'app',
+            target,
+            label: `${target} app callback`,
+            required: true,
+        });
+    }
+    return { ...input, targets, requirements };
+}
+//# sourceMappingURL=oauthSetupRequirements.js.map

package/dist/oauthSetupRequirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthSetupRequirements.js","sourceRoot":"","sources":["../src/oauthSetupRequirements.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wCAAwC,EACxC,oCAAoC,GAMrC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kCAAkC,EAClC,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,SAAS,EAAE,2BAA2B;IACtC,UAAU,EAAE,CAAC,kBAAkB,CAAC;CACa,CAAC;AAEhD,MAAM,UAAU,6BAA6B,CAAC,KAK7C;IACC,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAExD,MAAM,UAAU,GAAG,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAgC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,KAAK,CAAC,IAAI;QACf,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,oCAAoC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,WAAW,EAAE,wCAAwC,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,CAAC;IAEJ,YAAY,CAAC,IAAI,CAAC;QAChB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,YAAY,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,KAAK;YACX,MAAM;YACN,KAAK,EAAE,GAAG,MAAM,eAAe;YAC/B,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AAC7C,CAAC","sourcesContent":["import {\n  AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS,\n  AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES,\n  type AuthOAuthProviderId,\n  type AuthOAuthSetupCapabilities,\n  type AuthOAuthSetupPlan,\n  type AuthOAuthSetupRequirement,\n  type AuthOAuthTransportId,\n} from '@ankhorage/contracts/auth';\n\nimport {\n  getSupabaseOAuthProviderDefinition,\n  SUPABASE_OAUTH_PROVIDER_IDS,\n} from './oauthProviderDefinitions.js';\n\nexport const SUPABASE_OAUTH_SETUP_CAPABILITIES = {\n  providers: SUPABASE_OAUTH_PROVIDER_IDS,\n  transports: ['brokeredRedirect'],\n} as const satisfies AuthOAuthSetupCapabilities;\n\nexport function resolveSupabaseOAuthSetupPlan(input: {\n  readonly provider: AuthOAuthProviderId;\n  readonly transport: AuthOAuthTransportId;\n  readonly environment: AuthOAuthSetupPlan['environment'];\n  readonly targets: AuthOAuthSetupPlan['targets'];\n}): AuthOAuthSetupPlan | null {\n  if (input.transport !== 'brokeredRedirect') return null;\n\n  const definition = getSupabaseOAuthProviderDefinition(input.provider);\n  if (definition === null) return null;\n\n  const targets = [...new Set(input.targets)];\n  const requirements: AuthOAuthSetupRequirement[] = definition.secretFields.map((field) => ({\n    kind: 'field',\n    key: field.name,\n    label: field.label,\n    required: true,\n    sensitivity: AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES[field.secret ? 1 : 0],\n    persistence: AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS[0],\n  }));\n\n  requirements.push({\n    kind: 'callback',\n    role: 'provider',\n    label: 'Provider callback URI',\n    required: true,\n  });\n\n  for (const target of targets) {\n    requirements.push({\n      kind: 'callback',\n      role: 'app',\n      target,\n      label: `${target} app callback`,\n      required: true,\n    });\n  }\n\n  return { ...input, targets, requirements };\n}\n"]}

package/dist/oauthStart.d.ts

@@ -0,0 +1,4 @@
+import type { AuthOAuthStartResult, StartOAuthAuthorizationInput } from '@ankhorage/contracts/auth';
+import type { OAuthRuntimeContext } from './oauthRuntime.js';
+export declare function startSupabaseOAuthAuthorization(context: OAuthRuntimeContext, input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;
+//# sourceMappingURL=oauthStart.d.ts.map

package/dist/oauthStart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthStart.d.ts","sourceRoot":"","sources":["../src/oauthStart.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAUpG,OAAO,KAAK,EAAE,mBAAmB,EAAyB,MAAM,mBAAmB,CAAC;AAiBpF,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAM/B"}

package/dist/oauthStart.js

@@ -0,0 +1,108 @@
+import { randomBytes } from '@noble/hashes/utils.js';
+import { createOAuthAttemptId } from './oauthAttemptId.js';
+import { oauthStartError } from './oauthErrors.js';
+import { emitLifecycleEvent } from './oauthLifecycle.js';
+import { getSupabaseOAuthProviderDefinition, } from './oauthProviderDefinitions.js';
+import { createAuthorizationUrl, createPkcePair, normalizeQueryParams, normalizeRedirectUri, normalizeScopes, resolveEnabledProvider, } from './oauthStartSupport.js';
+import { clearOAuthAttemptState, isAttemptExpired, readAttempt, writeAttempt, } from './oauthStorage.js';
+import { ATTEMPT_VERSION } from './oauthTypes.js';
+export async function startSupabaseOAuthAuthorization(context, input) {
+    const prepared = prepareStartInput(context, input);
+    if (!prepared.ok)
+        return prepared.result;
+    const previousError = await clearPreviousAttempt(context, prepared.provider);
+    if (previousError !== null)
+        return previousError;
+    return createAuthorizationAttempt(context, input, prepared);
+}
+function prepareStartInput(context, input) {
+    const provider = resolveEnabledProvider(input.provider, context.providerSet);
+    if (!provider.ok)
+        return provider;
+    const redirectUri = normalizeRedirectUri(input.redirectUri, provider.provider);
+    if (!redirectUri.ok)
+        return redirectUri;
+    const queryParams = normalizeQueryParams(input.queryParams, provider.provider);
+    return queryParams.ok
+        ? {
+            ok: true,
+            provider: provider.provider,
+            redirectUri: redirectUri.value,
+            queryParams: queryParams.value,
+        }
+        : queryParams;
+}
+async function clearPreviousAttempt(context, provider) {
+    let previous;
+    try {
+        previous = await readAttempt(context.storage, context.attemptStorageKey);
+    }
+    catch {
+        return oauthStartError('session_persistence_failed', 'Unable to read the persisted OAuth authorization state.', provider, true);
+    }
+    if (previous.type === 'invalid')
+        await clearAttempt(context);
+    if (previous.type !== 'valid')
+        return null;
+    if (previous.attempt.status === 'completed' ||
+        isAttemptExpired(previous.attempt, context.now())) {
+        await clearAttempt(context);
+        return null;
+    }
+    return oauthStartError('authorization_failed', 'An OAuth authorization attempt is already active.', provider, true);
+}
+async function createAuthorizationAttempt(context, input, prepared) {
+    try {
+        const { challenge, verifier } = createPkcePair(context.randomBytes ?? randomBytes);
+        const attempt = createAttempt(context, prepared);
+        await context.storage.setItem(context.codeVerifierStorageKey, verifier);
+        await writeAttempt(context.storage, context.attemptStorageKey, attempt);
+        await emitLifecycleEvent(context.onLifecycleEvent, {
+            correlationId: attempt.id,
+            provider: attempt.provider,
+            stage: 'start',
+            status: 'started',
+        });
+        return createStartResult(context, input, prepared, attempt, challenge);
+    }
+    catch {
+        await clearAttempt(context);
+        return oauthStartError('session_persistence_failed', 'Unable to initialize the OAuth PKCE authorization attempt.', prepared.provider, true);
+    }
+}
+function createAttempt(context, prepared) {
+    const createdAt = context.now();
+    return {
+        version: ATTEMPT_VERSION,
+        id: createOAuthAttemptId(),
+        provider: prepared.provider,
+        redirectUri: prepared.redirectUri,
+        status: 'pending',
+        createdAt,
+        expiresAt: createdAt + context.attemptLifetimeMs,
+    };
+}
+function createStartResult(context, input, prepared, attempt, challenge) {
+    const definition = getSupabaseOAuthProviderDefinition(prepared.provider);
+    const scopes = normalizeScopes(input.scopes, definition?.defaultScopes ?? []);
+    return {
+        ok: true,
+        data: {
+            attemptId: attempt.id,
+            provider: prepared.provider,
+            authorizationUrl: createAuthorizationUrl({
+                baseUrl: context.url,
+                challenge,
+                provider: prepared.provider,
+                queryParams: prepared.queryParams,
+                redirectUri: prepared.redirectUri,
+                scopes,
+            }),
+            redirectUri: prepared.redirectUri,
+        },
+    };
+}
+async function clearAttempt(context) {
+    await clearOAuthAttemptState(context.storage, context.attemptStorageKey, context.codeVerifierStorageKey);
+}
+//# sourceMappingURL=oauthStart.js.map

package/dist/oauthStart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthStart.js","sourceRoot":"","sources":["../src/oauthStart.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,kCAAkC,GAEnC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,WAAW,EACX,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAA2B,MAAM,iBAAiB,CAAC;AAE3E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAA4B,EAC5B,KAAmC;IAEnC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzC,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACjD,OAAO,0BAA0B,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,iBAAiB,CACxB,OAA4B,EAC5B,KAAmC;IAEnC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IACxC,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/E,OAAO,WAAW,CAAC,EAAE;QACnB,CAAC,CAAC;YACE,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,WAAW,EAAE,WAAW,CAAC,KAAK;SAC/B;QACH,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAA4B,EAC5B,QAAiC;IAEjC,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CACpB,4BAA4B,EAC5B,yDAAyD,EACzD,QAAQ,EACR,IAAI,CACL,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3C,IACE,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW;QACvC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EACjD,CAAC;QACD,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,eAAe,CACpB,sBAAsB,EACtB,mDAAmD,EACnD,QAAQ,EACR,IAAI,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,OAA4B,EAC5B,KAAmC,EACnC,QAAsD;IAEtD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACxE,MAAM,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACjD,aAAa,EAAE,OAAO,CAAC,EAAE;YACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,eAAe,CACpB,4BAA4B,EAC5B,4DAA4D,EAC5D,QAAQ,CAAC,QAAQ,EACjB,IAAI,CACL,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,OAA4B,EAC5B,QAAsD;IAEtD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAChC,OAAO;QACL,OAAO,EAAE,eAAe;QACxB,EAAE,EAAE,oBAAoB,EAAE;QAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,iBAAiB;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,OAA4B,EAC5B,KAAmC,EACnC,QAAsD,EACtD,OAA2B,EAC3B,SAAiB;IAEjB,MAAM,UAAU,GAAG,kCAAkC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,sBAAsB,CAAC;gBACvC,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,SAAS;gBACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,MAAM;aACP,CAAC;YACF,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAA4B;IACtD,MAAM,sBAAsB,CAC1B,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,iBAAiB,EACzB,OAAO,CAAC,sBAAsB,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import type { AuthOAuthStartResult, StartOAuthAuthorizationInput } from '@ankhorage/contracts/auth';\nimport { randomBytes } from '@noble/hashes/utils.js';\n\nimport { createOAuthAttemptId } from './oauthAttemptId.js';\nimport { oauthStartError } from './oauthErrors.js';\nimport { emitLifecycleEvent } from './oauthLifecycle.js';\nimport {\n  getSupabaseOAuthProviderDefinition,\n  type SupabaseOAuthProviderId,\n} from './oauthProviderDefinitions.js';\nimport type { OAuthRuntimeContext, OAuthStartPreparation } from './oauthRuntime.js';\nimport {\n  createAuthorizationUrl,\n  createPkcePair,\n  normalizeQueryParams,\n  normalizeRedirectUri,\n  normalizeScopes,\n  resolveEnabledProvider,\n} from './oauthStartSupport.js';\nimport {\n  clearOAuthAttemptState,\n  isAttemptExpired,\n  readAttempt,\n  writeAttempt,\n} from './oauthStorage.js';\nimport { ATTEMPT_VERSION, type StoredOAuthAttempt } from './oauthTypes.js';\n\nexport async function startSupabaseOAuthAuthorization(\n  context: OAuthRuntimeContext,\n  input: StartOAuthAuthorizationInput,\n): Promise<AuthOAuthStartResult> {\n  const prepared = prepareStartInput(context, input);\n  if (!prepared.ok) return prepared.result;\n  const previousError = await clearPreviousAttempt(context, prepared.provider);\n  if (previousError !== null) return previousError;\n  return createAuthorizationAttempt(context, input, prepared);\n}\n\nfunction prepareStartInput(\n  context: OAuthRuntimeContext,\n  input: StartOAuthAuthorizationInput,\n): OAuthStartPreparation {\n  const provider = resolveEnabledProvider(input.provider, context.providerSet);\n  if (!provider.ok) return provider;\n  const redirectUri = normalizeRedirectUri(input.redirectUri, provider.provider);\n  if (!redirectUri.ok) return redirectUri;\n  const queryParams = normalizeQueryParams(input.queryParams, provider.provider);\n  return queryParams.ok\n    ? {\n        ok: true,\n        provider: provider.provider,\n        redirectUri: redirectUri.value,\n        queryParams: queryParams.value,\n      }\n    : queryParams;\n}\n\nasync function clearPreviousAttempt(\n  context: OAuthRuntimeContext,\n  provider: SupabaseOAuthProviderId,\n): Promise<AuthOAuthStartResult | null> {\n  let previous;\n  try {\n    previous = await readAttempt(context.storage, context.attemptStorageKey);\n  } catch {\n    return oauthStartError(\n      'session_persistence_failed',\n      'Unable to read the persisted OAuth authorization state.',\n      provider,\n      true,\n    );\n  }\n  if (previous.type === 'invalid') await clearAttempt(context);\n  if (previous.type !== 'valid') return null;\n  if (\n    previous.attempt.status === 'completed' ||\n    isAttemptExpired(previous.attempt, context.now())\n  ) {\n    await clearAttempt(context);\n    return null;\n  }\n  return oauthStartError(\n    'authorization_failed',\n    'An OAuth authorization attempt is already active.',\n    provider,\n    true,\n  );\n}\n\nasync function createAuthorizationAttempt(\n  context: OAuthRuntimeContext,\n  input: StartOAuthAuthorizationInput,\n  prepared: Extract<OAuthStartPreparation, { ok: true }>,\n): Promise<AuthOAuthStartResult> {\n  try {\n    const { challenge, verifier } = createPkcePair(context.randomBytes ?? randomBytes);\n    const attempt = createAttempt(context, prepared);\n    await context.storage.setItem(context.codeVerifierStorageKey, verifier);\n    await writeAttempt(context.storage, context.attemptStorageKey, attempt);\n    await emitLifecycleEvent(context.onLifecycleEvent, {\n      correlationId: attempt.id,\n      provider: attempt.provider,\n      stage: 'start',\n      status: 'started',\n    });\n    return createStartResult(context, input, prepared, attempt, challenge);\n  } catch {\n    await clearAttempt(context);\n    return oauthStartError(\n      'session_persistence_failed',\n      'Unable to initialize the OAuth PKCE authorization attempt.',\n      prepared.provider,\n      true,\n    );\n  }\n}\n\nfunction createAttempt(\n  context: OAuthRuntimeContext,\n  prepared: Extract<OAuthStartPreparation, { ok: true }>,\n): StoredOAuthAttempt {\n  const createdAt = context.now();\n  return {\n    version: ATTEMPT_VERSION,\n    id: createOAuthAttemptId(),\n    provider: prepared.provider,\n    redirectUri: prepared.redirectUri,\n    status: 'pending',\n    createdAt,\n    expiresAt: createdAt + context.attemptLifetimeMs,\n  };\n}\n\nfunction createStartResult(\n  context: OAuthRuntimeContext,\n  input: StartOAuthAuthorizationInput,\n  prepared: Extract<OAuthStartPreparation, { ok: true }>,\n  attempt: StoredOAuthAttempt,\n  challenge: string,\n): AuthOAuthStartResult {\n  const definition = getSupabaseOAuthProviderDefinition(prepared.provider);\n  const scopes = normalizeScopes(input.scopes, definition?.defaultScopes ?? []);\n  return {\n    ok: true,\n    data: {\n      attemptId: attempt.id,\n      provider: prepared.provider,\n      authorizationUrl: createAuthorizationUrl({\n        baseUrl: context.url,\n        challenge,\n        provider: prepared.provider,\n        queryParams: prepared.queryParams,\n        redirectUri: prepared.redirectUri,\n        scopes,\n      }),\n      redirectUri: prepared.redirectUri,\n    },\n  };\n}\n\nasync function clearAttempt(context: OAuthRuntimeContext): Promise<void> {\n  await clearOAuthAttemptState(\n    context.storage,\n    context.attemptStorageKey,\n    context.codeVerifierStorageKey,\n  );\n}\n"]}

package/dist/oauthStartSupport.d.ts

@@ -0,0 +1,52 @@
+import type { AuthOAuthProviderId, AuthOAuthStartResult } from '@ankhorage/contracts/auth';
+import { type SupabaseOAuthProviderId } from './oauthProviderDefinitions.js';
+import type { SupabaseAuthFetch, SupabaseAuthRandomBytes } from './types.js';
+/*** Resolves an OAuth provider against the adapter's enabled provider set. */
+export declare function resolveEnabledProvider(requestedProvider: AuthOAuthProviderId, providers: ReadonlySet<SupabaseOAuthProviderId>): {
+    ok: true;
+    provider: SupabaseOAuthProviderId;
+} | {
+    ok: false;
+    result: AuthOAuthStartResult;
+};
+/*** Normalizes and validates a canonical OAuth callback URI. */
+export declare function normalizeRedirectUri(rawRedirectUri: string, provider: SupabaseOAuthProviderId): {
+    ok: true;
+    value: string;
+} | {
+    ok: false;
+    result: AuthOAuthStartResult;
+};
+/*** Normalizes provider query parameters while rejecting reserved OAuth fields. */
+export declare function normalizeQueryParams(queryParams: Readonly<Record<string, string>> | undefined, provider: SupabaseOAuthProviderId): {
+    ok: true;
+    value: Record<string, string>;
+} | {
+    ok: false;
+    result: AuthOAuthStartResult;
+};
+/*** Returns unique non-empty OAuth scopes in request order. */
+export declare function normalizeScopes(scopes: readonly string[] | undefined, defaults: readonly string[]): string[];
+/*** Creates a PKCE verifier and its S256 challenge from an injected secure byte source. */
+export declare function createPkcePair(generateRandomBytes: SupabaseAuthRandomBytes): {
+    challenge: string;
+    verifier: string;
+};
+/*** Creates the public Supabase PKCE authorization URL. */
+export declare function createAuthorizationUrl(input: {
+    baseUrl: string;
+    challenge: string;
+    provider: SupabaseOAuthProviderId;
+    queryParams: Readonly<Record<string, string>>;
+    redirectUri: string;
+    scopes: readonly string[];
+}): string;
+/*** Exchanges a Supabase PKCE authorization code through the public HTTP contract. */
+export declare function exchangeAuthorizationCode(input: {
+    anonKey: string;
+    baseUrl: string;
+    code: string;
+    fetch: SupabaseAuthFetch;
+    verifier: string;
+}): Promise<Response>;
+//# sourceMappingURL=oauthStartSupport.d.ts.map

package/dist/oauthStartSupport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthStartSupport.d.ts","sourceRoot":"","sources":["../src/oauthStartSupport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAK3F,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAc7E,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,iBAAiB,EAAE,mBAAmB,EACtC,SAAS,EAAE,WAAW,CAAC,uBAAuB,CAAC,GAC9C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,uBAAuB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAc/F;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,uBAAuB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAe3E;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,EACzD,QAAQ,EAAE,uBAAuB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAiB3F;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,EAAE,CAGV;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,mBAAmB,EAAE,uBAAuB,GAAG;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAOA;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B,GAAG,MAAM,CAYT;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAUpB"}

package/dist/oauthStartSupport.js

@@ -0,0 +1,137 @@
+import { sha256 } from '@noble/hashes/sha2.js';
+import { isBytes, utf8ToBytes } from '@noble/hashes/utils.js';
+import { oauthStartError } from './oauthErrors.js';
+import { isSupabaseOAuthProviderId, } from './oauthProviderDefinitions.js';
+const PKCE_RANDOM_BYTE_COUNT = 32;
+const BASE64_URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+const FORBIDDEN_QUERY_PARAMS = new Set([
+    'code_challenge',
+    'code_challenge_method',
+    'provider',
+    'redirect_to',
+    'scopes',
+    'skip_http_redirect',
+]);
+const DANGEROUS_PROTOCOLS = new Set(['data:', 'file:', 'javascript:']);
+/*** Resolves an OAuth provider against the adapter's enabled provider set. */
+export function resolveEnabledProvider(requestedProvider, providers) {
+    const provider = requestedProvider.trim();
+    if (!isSupabaseOAuthProviderId(provider) || !providers.has(provider)) {
+        return {
+            ok: false,
+            result: oauthStartError('provider_disabled', `OAuth provider "${provider}" is not enabled for this adapter.`, requestedProvider, true),
+        };
+    }
+    return { ok: true, provider };
+}
+/*** Normalizes and validates a canonical OAuth callback URI. */
+export function normalizeRedirectUri(rawRedirectUri, provider) {
+    const url = parseAbsoluteUrl(rawRedirectUri.trim());
+    if (url === null) {
+        return invalidRedirect(provider, 'OAuth redirect URI must be an absolute URL or application deep link.');
+    }
+    if (!isPermittedRedirect(url)) {
+        return invalidRedirect(provider, 'OAuth redirect URI is not a permitted canonical callback URL.');
+    }
+    return { ok: true, value: url.toString() };
+}
+/*** Normalizes provider query parameters while rejecting reserved OAuth fields. */
+export function normalizeQueryParams(queryParams, provider) {
+    const entries = Object.entries(queryParams ?? {}).map(([key, value]) => [key.trim(), value.trim()]);
+    const invalid = entries.find(([key]) => key.length === 0 || FORBIDDEN_QUERY_PARAMS.has(key));
+    if (invalid !== undefined) {
+        return {
+            ok: false,
+            result: oauthStartError('provider_misconfigured', `OAuth query parameter "${invalid[0]}" is reserved or invalid.`, provider, true),
+        };
+    }
+    return { ok: true, value: Object.fromEntries(entries) };
+}
+/*** Returns unique non-empty OAuth scopes in request order. */
+export function normalizeScopes(scopes, defaults) {
+    const requested = scopes === undefined || scopes.length === 0 ? defaults : scopes;
+    return [...new Set(requested.map((scope) => scope.trim()).filter(Boolean))];
+}
+/*** Creates a PKCE verifier and its S256 challenge from an injected secure byte source. */
+export function createPkcePair(generateRandomBytes) {
+    const randomValue = generateRandomBytes(PKCE_RANDOM_BYTE_COUNT);
+    if (!isBytes(randomValue) || randomValue.length !== PKCE_RANDOM_BYTE_COUNT) {
+        throw new TypeError('OAuth random byte source returned an invalid value.');
+    }
+    const verifier = bytesToBase64Url(randomValue);
+    return { challenge: bytesToBase64Url(sha256(utf8ToBytes(verifier))), verifier };
+}
+/*** Creates the public Supabase PKCE authorization URL. */
+export function createAuthorizationUrl(input) {
+    const url = new URL(`${input.baseUrl.replace(/\/+$/u, '')}/auth/v1/authorize`);
+    const parameters = [
+        ['provider', input.provider],
+        ['redirect_to', input.redirectUri],
+        ['code_challenge', input.challenge],
+        ['code_challenge_method', 's256'],
+        ...Object.entries(input.queryParams),
+    ];
+    if (input.scopes.length > 0)
+        url.searchParams.set('scopes', input.scopes.join(' '));
+    for (const [key, value] of parameters)
+        url.searchParams.set(key, value);
+    return url.toString();
+}
+/*** Exchanges a Supabase PKCE authorization code through the public HTTP contract. */
+export function exchangeAuthorizationCode(input) {
+    return input.fetch(`${input.baseUrl.replace(/\/+$/u, '')}/auth/v1/token?grant_type=pkce`, {
+        method: 'POST',
+        headers: {
+            apikey: input.anonKey,
+            Authorization: `Bearer ${input.anonKey}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ auth_code: input.code, code_verifier: input.verifier }),
+    });
+}
+function bytesToBase64Url(bytes) {
+    let encoded = '';
+    for (let index = 0; index < bytes.length; index += 3)
+        encoded += encodeBase64Triplet(bytes, index);
+    return encoded;
+}
+function encodeBase64Triplet(bytes, index) {
+    const first = bytes.at(index) ?? 0;
+    const second = bytes.at(index + 1);
+    const third = bytes.at(index + 2);
+    const encoded = [
+        BASE64_URL_ALPHABET.at(first >> 2) ?? '',
+        BASE64_URL_ALPHABET.at(((first & 0b11) << 4) | ((second ?? 0) >> 4)) ?? '',
+        second === undefined
+            ? ''
+            : (BASE64_URL_ALPHABET.at(((second & 0b1111) << 2) | ((third ?? 0) >> 6)) ?? ''),
+        third === undefined ? '' : (BASE64_URL_ALPHABET.at(third & 0b11_1111) ?? ''),
+    ];
+    return encoded.join('');
+}
+function parseAbsoluteUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+function isPermittedRedirect(url) {
+    return (!DANGEROUS_PROTOCOLS.has(url.protocol) &&
+        url.username.length === 0 &&
+        url.password.length === 0 &&
+        url.search.length === 0 &&
+        url.hash.length === 0 &&
+        (url.protocol !== 'http:' || isLocalhost(url.hostname)));
+}
+function invalidRedirect(provider, message) {
+    return {
+        ok: false,
+        result: oauthStartError('invalid_redirect_uri', message, provider, true),
+    };
+}
+function isLocalhost(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+//# sourceMappingURL=oauthStartSupport.js.map

package/dist/oauthStartSupport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthStartSupport.js","sourceRoot":"","sources":["../src/oauthStartSupport.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACL,yBAAyB,GAE1B,MAAM,+BAA+B,CAAC;AAGvC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,mBAAmB,GAAG,kEAAkE,CAAC;AAC/F,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,gBAAgB;IAChB,uBAAuB;IACvB,UAAU;IACV,aAAa;IACb,QAAQ;IACR,oBAAoB;CACrB,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;AAEvE,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CACpC,iBAAsC,EACtC,SAA+C;IAE/C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe,CACrB,mBAAmB,EACnB,mBAAmB,QAAQ,oCAAoC,EAC/D,iBAAiB,EACjB,IAAI,CACL;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAClC,cAAsB,EACtB,QAAiC;IAEjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,eAAe,CACpB,QAAQ,EACR,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,eAAe,CACpB,QAAQ,EACR,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAClC,WAAyD,EACzD,QAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CACnD,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAU,CACtD,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe,CACrB,wBAAwB,EACxB,0BAA0B,OAAO,CAAC,CAAC,CAAC,2BAA2B,EAC/D,QAAQ,EACR,IAAI,CACL;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAC7B,MAAqC,EACrC,QAA2B;IAE3B,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAClF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,mBAA4C;IAIzE,MAAM,WAAW,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AAClF,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,sBAAsB,CAAC,KAOtC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG;QACjB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC5B,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC;QAClC,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC;QACnC,CAAC,uBAAuB,EAAE,MAAM,CAAC;QACjC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;KAC5B,CAAC;IACX,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,yBAAyB,CAAC,KAMzC;IACC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,gCAAgC,EAAE;QACxF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,aAAa,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE;YACxC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAClD,OAAO,IAAI,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAiB,EAAE,KAAa;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG;QACd,mBAAmB,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE;QACxC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;QAC1E,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;KAC7E,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAQ;IACnC,OAAO,CACL,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QACtC,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAiC,EAAE,OAAe;IACzE,OAAO;QACL,EAAE,EAAE,KAAc;QAClB,MAAM,EAAE,eAAe,CAAC,sBAAsB,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AACtF,CAAC","sourcesContent":["import type { AuthOAuthProviderId, AuthOAuthStartResult } from '@ankhorage/contracts/auth';\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { isBytes, utf8ToBytes } from '@noble/hashes/utils.js';\n\nimport { oauthStartError } from './oauthErrors.js';\nimport {\n  isSupabaseOAuthProviderId,\n  type SupabaseOAuthProviderId,\n} from './oauthProviderDefinitions.js';\nimport type { SupabaseAuthFetch, SupabaseAuthRandomBytes } from './types.js';\n\nconst PKCE_RANDOM_BYTE_COUNT = 32;\nconst BASE64_URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';\nconst FORBIDDEN_QUERY_PARAMS = new Set([\n  'code_challenge',\n  'code_challenge_method',\n  'provider',\n  'redirect_to',\n  'scopes',\n  'skip_http_redirect',\n]);\nconst DANGEROUS_PROTOCOLS = new Set(['data:', 'file:', 'javascript:']);\n\n/*** Resolves an OAuth provider against the adapter's enabled provider set. */\nexport function resolveEnabledProvider(\n  requestedProvider: AuthOAuthProviderId,\n  providers: ReadonlySet<SupabaseOAuthProviderId>,\n): { ok: true; provider: SupabaseOAuthProviderId } | { ok: false; result: AuthOAuthStartResult } {\n  const provider = requestedProvider.trim();\n  if (!isSupabaseOAuthProviderId(provider) || !providers.has(provider)) {\n    return {\n      ok: false,\n      result: oauthStartError(\n        'provider_disabled',\n        `OAuth provider \"${provider}\" is not enabled for this adapter.`,\n        requestedProvider,\n        true,\n      ),\n    };\n  }\n  return { ok: true, provider };\n}\n\n/*** Normalizes and validates a canonical OAuth callback URI. */\nexport function normalizeRedirectUri(\n  rawRedirectUri: string,\n  provider: SupabaseOAuthProviderId,\n): { ok: true; value: string } | { ok: false; result: AuthOAuthStartResult } {\n  const url = parseAbsoluteUrl(rawRedirectUri.trim());\n  if (url === null) {\n    return invalidRedirect(\n      provider,\n      'OAuth redirect URI must be an absolute URL or application deep link.',\n    );\n  }\n  if (!isPermittedRedirect(url)) {\n    return invalidRedirect(\n      provider,\n      'OAuth redirect URI is not a permitted canonical callback URL.',\n    );\n  }\n  return { ok: true, value: url.toString() };\n}\n\n/*** Normalizes provider query parameters while rejecting reserved OAuth fields. */\nexport function normalizeQueryParams(\n  queryParams: Readonly<Record<string, string>> | undefined,\n  provider: SupabaseOAuthProviderId,\n): { ok: true; value: Record<string, string> } | { ok: false; result: AuthOAuthStartResult } {\n  const entries = Object.entries(queryParams ?? {}).map(\n    ([key, value]) => [key.trim(), value.trim()] as const,\n  );\n  const invalid = entries.find(([key]) => key.length === 0 || FORBIDDEN_QUERY_PARAMS.has(key));\n  if (invalid !== undefined) {\n    return {\n      ok: false,\n      result: oauthStartError(\n        'provider_misconfigured',\n        `OAuth query parameter \"${invalid[0]}\" is reserved or invalid.`,\n        provider,\n        true,\n      ),\n    };\n  }\n  return { ok: true, value: Object.fromEntries(entries) };\n}\n\n/*** Returns unique non-empty OAuth scopes in request order. */\nexport function normalizeScopes(\n  scopes: readonly string[] | undefined,\n  defaults: readonly string[],\n): string[] {\n  const requested = scopes === undefined || scopes.length === 0 ? defaults : scopes;\n  return [...new Set(requested.map((scope) => scope.trim()).filter(Boolean))];\n}\n\n/*** Creates a PKCE verifier and its S256 challenge from an injected secure byte source. */\nexport function createPkcePair(generateRandomBytes: SupabaseAuthRandomBytes): {\n  challenge: string;\n  verifier: string;\n} {\n  const randomValue = generateRandomBytes(PKCE_RANDOM_BYTE_COUNT);\n  if (!isBytes(randomValue) || randomValue.length !== PKCE_RANDOM_BYTE_COUNT) {\n    throw new TypeError('OAuth random byte source returned an invalid value.');\n  }\n  const verifier = bytesToBase64Url(randomValue);\n  return { challenge: bytesToBase64Url(sha256(utf8ToBytes(verifier))), verifier };\n}\n\n/*** Creates the public Supabase PKCE authorization URL. */\nexport function createAuthorizationUrl(input: {\n  baseUrl: string;\n  challenge: string;\n  provider: SupabaseOAuthProviderId;\n  queryParams: Readonly<Record<string, string>>;\n  redirectUri: string;\n  scopes: readonly string[];\n}): string {\n  const url = new URL(`${input.baseUrl.replace(/\\/+$/u, '')}/auth/v1/authorize`);\n  const parameters = [\n    ['provider', input.provider],\n    ['redirect_to', input.redirectUri],\n    ['code_challenge', input.challenge],\n    ['code_challenge_method', 's256'],\n    ...Object.entries(input.queryParams),\n  ] as const;\n  if (input.scopes.length > 0) url.searchParams.set('scopes', input.scopes.join(' '));\n  for (const [key, value] of parameters) url.searchParams.set(key, value);\n  return url.toString();\n}\n\n/*** Exchanges a Supabase PKCE authorization code through the public HTTP contract. */\nexport function exchangeAuthorizationCode(input: {\n  anonKey: string;\n  baseUrl: string;\n  code: string;\n  fetch: SupabaseAuthFetch;\n  verifier: string;\n}): Promise<Response> {\n  return input.fetch(`${input.baseUrl.replace(/\\/+$/u, '')}/auth/v1/token?grant_type=pkce`, {\n    method: 'POST',\n    headers: {\n      apikey: input.anonKey,\n      Authorization: `Bearer ${input.anonKey}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({ auth_code: input.code, code_verifier: input.verifier }),\n  });\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n  let encoded = '';\n  for (let index = 0; index < bytes.length; index += 3)\n    encoded += encodeBase64Triplet(bytes, index);\n  return encoded;\n}\n\nfunction encodeBase64Triplet(bytes: Uint8Array, index: number): string {\n  const first = bytes.at(index) ?? 0;\n  const second = bytes.at(index + 1);\n  const third = bytes.at(index + 2);\n  const encoded = [\n    BASE64_URL_ALPHABET.at(first >> 2) ?? '',\n    BASE64_URL_ALPHABET.at(((first & 0b11) << 4) | ((second ?? 0) >> 4)) ?? '',\n    second === undefined\n      ? ''\n      : (BASE64_URL_ALPHABET.at(((second & 0b1111) << 2) | ((third ?? 0) >> 6)) ?? ''),\n    third === undefined ? '' : (BASE64_URL_ALPHABET.at(third & 0b11_1111) ?? ''),\n  ];\n  return encoded.join('');\n}\n\nfunction parseAbsoluteUrl(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isPermittedRedirect(url: URL): boolean {\n  return (\n    !DANGEROUS_PROTOCOLS.has(url.protocol) &&\n    url.username.length === 0 &&\n    url.password.length === 0 &&\n    url.search.length === 0 &&\n    url.hash.length === 0 &&\n    (url.protocol !== 'http:' || isLocalhost(url.hostname))\n  );\n}\n\nfunction invalidRedirect(provider: SupabaseOAuthProviderId, message: string) {\n  return {\n    ok: false as const,\n    result: oauthStartError('invalid_redirect_uri', message, provider, true),\n  };\n}\n\nfunction isLocalhost(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';\n}\n"]}