@atlasauth/backend 0.23.0 → 0.25.0

package/dist/legacy-verify.js

@@ -0,0 +1,244 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleLegacyVerify = handleLegacyVerify;
+exports.oktaPasswordVerifier = oktaPasswordVerifier;
+exports.auth0PasswordVerifier = auth0PasswordVerifier;
+exports.descopePasswordVerifier = descopePasswordVerifier;
+exports.clerkPasswordVerifier = clerkPasswordVerifier;
+const jose_1 = require("jose");
+const webhooks_1 = require("./webhooks");
+const DEFAULT_TIMEOUT_MS = 4000;
+/**
+ * Check Atlas's signature on the request and run `verify`. Returns the status
+ * and JSON body to send: 200 `{ user }` on a valid credential, 401 when the
+ * old system rejected it, 400 on a bad signature or body.
+ */
+async function handleLegacyVerify(input) {
+    const checked = (0, webhooks_1.verifyWebhook)({
+        body: input.body,
+        headers: input.headers,
+        secret: input.secret,
+        now: input.now,
+    });
+    if (!checked.verified)
+        return { status: 400, body: { error: 'invalid_signature' } };
+    const identifier = typeof checked.event?.identifier === 'string' ? checked.event.identifier.trim() : '';
+    const password = typeof checked.event?.password === 'string' ? checked.event.password : '';
+    if (!identifier || !password)
+        return { status: 400, body: { error: 'invalid_body' } };
+    let profile = null;
+    try {
+        profile = await input.verify({ identifier, password });
+    }
+    catch {
+        profile = null;
+    }
+    if (!profile || !profile.email.includes('@'))
+        return { status: 401, body: { error: 'invalid_credentials' } };
+    return { status: 200, body: { user: profile } };
+}
+const str = (v) => (typeof v === 'string' && v.trim() ? v.trim() : undefined);
+const obj = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
+async function call(t, url, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), t.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    try {
+        const res = await (t.fetchImpl ?? fetch)(url, { ...init, signal: controller.signal, redirect: 'manual' });
+        let raw = null;
+        try {
+            raw = (await res.json());
+        }
+        catch {
+            raw = null;
+        }
+        return { status: res.status, json: obj(raw) ?? null, raw };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const origin = (domain) => `https://${domain.replace(/^https?:\/\//, '').replace(/\/+$/, '')}`;
+const joinName = (...parts) => parts.filter(Boolean).join(' ').trim() || undefined;
+/**
+ * Okta (Workforce Identity Cloud / Customer Identity Solution): the Authn API,
+ * `POST /api/v1/authn`, needs no API token. A primary-authentication result of
+ * SUCCESS, or any state that is only reached after a correct password
+ * (MFA_REQUIRED, MFA_ENROLL, PASSWORD_WARN, PASSWORD_EXPIRED), counts as
+ * verified; 401 (E0000004) and LOCKED_OUT do not.
+ *
+ * Orgs where the Authn API is turned off can verify with the resource-owner
+ * password grant of an app that allows it: pass `passwordGrant`.
+ */
+function oktaPasswordVerifier(opts) {
+    const base = origin(opts.domain);
+    const PASSED = new Set(['SUCCESS', 'MFA_REQUIRED', 'MFA_ENROLL', 'MFA_CHALLENGE', 'PASSWORD_WARN', 'PASSWORD_EXPIRED']);
+    return async ({ identifier, password }) => {
+        if (opts.passwordGrant) {
+            const g = opts.passwordGrant;
+            const server = g.authorizationServerId ?? 'default';
+            const form = new URLSearchParams({ grant_type: 'password', username: identifier, password, scope: 'openid email profile', client_id: g.clientId });
+            if (g.clientSecret)
+                form.set('client_secret', g.clientSecret);
+            const res = await call(opts, `${base}/oauth2/${server}/v1/token`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: form.toString(),
+            });
+            if (!res || res.status !== 200)
+                return null;
+            return profileFromIdToken(str(res.json?.id_token), { externalIdClaim: 'sub' });
+        }
+        const res = await call(opts, `${base}/api/v1/authn`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify({ username: identifier, password, options: { warnBeforePasswordExpired: false, multiOptionalFactorEnroll: false } }),
+        });
+        if (!res || res.status !== 200 || !res.json)
+            return null;
+        if (!PASSED.has(String(res.json.status)))
+            return null;
+        const user = obj(obj(res.json._embedded)?.user);
+        const profile = obj(user?.profile);
+        const email = str(profile?.login)?.includes('@') ? str(profile?.login) : undefined;
+        if (!email)
+            return null;
+        return {
+            email: email.toLowerCase(),
+            // Okta proved the user controls the login; it does not say the address was verified.
+            email_verified: false,
+            name: joinName(str(profile?.firstName), str(profile?.lastName)),
+            external_id: str(user?.id),
+        };
+    };
+}
+/**
+ * Auth0 (and Okta Customer Identity Cloud): the resource-owner password grant
+ * against ONE database connection (`realm`), from an application with the
+ * Password grant enabled. `mfa_required` means the password was right (Auth0
+ * only asks for the second factor after it). Use a dedicated application for
+ * this and keep its secret on your server.
+ */
+function auth0PasswordVerifier(opts) {
+    const base = origin(opts.domain);
+    return async ({ identifier, password }) => {
+        const body = {
+            grant_type: 'http://auth0.com/oauth/grant-type/password-realm',
+            realm: opts.realm,
+            username: identifier,
+            password,
+            client_id: opts.clientId,
+            scope: 'openid email profile',
+        };
+        if (opts.clientSecret)
+            body.client_secret = opts.clientSecret;
+        if (opts.audience)
+            body.audience = opts.audience;
+        const res = await call(opts, `${base}/oauth/token`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (!res)
+            return null;
+        if (res.status === 200)
+            return profileFromIdToken(str(res.json?.id_token), { externalIdClaim: 'sub' });
+        if (res.status === 403 && res.json?.error === 'mfa_required') {
+            // No ID token yet: the password is right, the profile comes from the MFA
+            // token's user. Atlas needs at least the email, which is the identifier.
+            return identifier.includes('@') ? { email: identifier.toLowerCase(), email_verified: false } : null;
+        }
+        return null;
+    };
+}
+/**
+ * Descope: `POST /v1/auth/password/signin` with the project id (public — no
+ * management key). A 200 with a `user` means the password is right.
+ */
+function descopePasswordVerifier(opts) {
+    const base = origin(opts.baseUrl ?? 'api.descope.com');
+    return async ({ identifier, password }) => {
+        const res = await call(opts, `${base}/v1/auth/password/signin`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', authorization: `Bearer ${opts.projectId}` },
+            body: JSON.stringify({ loginId: identifier, password }),
+        });
+        if (!res || res.status !== 200 || !res.json)
+            return null;
+        const user = obj(res.json.user);
+        const email = str(user?.email) ?? (identifier.includes('@') ? identifier : undefined);
+        if (!user || !email)
+            return null;
+        return {
+            email: email.toLowerCase(),
+            email_verified: user.verifiedEmail === true,
+            name: str(user.name) ?? joinName(str(user.givenName), str(user.familyName)),
+            external_id: str(user.userId),
+        };
+    };
+}
+/**
+ * Clerk exports bcrypt digests, so most moves need no lazy step. For users
+ * whose digest could not move (a peppered or Cognito-backed hasher), look the
+ * user up by email and call `POST /v1/users/{id}/verify_password` with your
+ * Clerk secret key.
+ */
+function clerkPasswordVerifier(opts) {
+    const base = (opts.apiUrl ?? 'https://api.clerk.com').replace(/\/+$/, '');
+    const headers = { authorization: `Bearer ${opts.secretKey}`, 'content-type': 'application/json', accept: 'application/json' };
+    return async ({ identifier, password }) => {
+        if (!identifier.includes('@'))
+            return null;
+        const found = await call(opts, `${base}/v1/users?email_address=${encodeURIComponent(identifier)}&limit=1`, { headers });
+        if (!found || found.status !== 200)
+            return null;
+        // GET /v1/users answers with a bare array (or `{ data }` from newer API versions).
+        const list = Array.isArray(found.raw) ? found.raw : Array.isArray(found.json?.data) ? found.json.data : [];
+        const user = obj(list[0]);
+        const id = str(user?.id);
+        if (!user || !id)
+            return null;
+        const res = await call(opts, `${base}/v1/users/${encodeURIComponent(id)}/verify_password`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ password }),
+        });
+        if (!res || res.status !== 200 || res.json?.verified !== true)
+            return null;
+        const emails = Array.isArray(user.email_addresses) ? user.email_addresses.map(obj) : [];
+        const primary = emails.find((e) => e && e.id === user.primary_email_address_id) ?? emails[0];
+        return {
+            email: (str(primary?.email_address) ?? identifier).toLowerCase(),
+            email_verified: obj(primary?.verification)?.status === 'verified',
+            name: joinName(str(user.first_name), str(user.last_name)),
+            external_id: id,
+        };
+    };
+}
+/**
+ * The profile in an ID token returned DIRECTLY by the vendor's token endpoint
+ * over TLS (so its signature need not be re-checked here).
+ */
+function profileFromIdToken(idToken, o) {
+    if (!idToken)
+        return null;
+    let claims;
+    try {
+        claims = (0, jose_1.decodeJwt)(idToken);
+    }
+    catch {
+        return null;
+    }
+    const email = str(claims.email);
+    if (!email || !email.includes('@'))
+        return null;
+    return {
+        email: email.toLowerCase(),
+        email_verified: claims.email_verified === true,
+        name: str(claims.name) ?? joinName(str(claims.given_name), str(claims.family_name)),
+        external_id: str(claims[o.externalIdClaim]),
+    };
+}
+//# sourceMappingURL=legacy-verify.js.map

package/dist/legacy-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-verify.js","sourceRoot":"","sources":["../src/legacy-verify.ts"],"names":[],"mappings":";;AAmDA,gDAyBC;AA2CD,oDAyCC;AASD,sDA6BC;AAMD,0DAqBC;AAQD,sDA6BC;AAtQD,+BAAiC;AACjC,yCAA2C;AA2C3C,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CAAC,KAMxC;IACC,MAAM,OAAO,GAAG,IAAA,wBAAa,EAA+C;QAC1E,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;IACpF,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,KAAK,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;IACtF,IAAI,OAAO,GAAiC,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAAC;IAC7G,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC3G,MAAM,GAAG,GAAG,CAAC,CAAU,EAAuC,EAAE,CAC9D,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;AAE/F,KAAK,UAAU,IAAI,CACjB,CAAoB,EACpB,GAAW,EACX,IAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1G,IAAI,GAAG,GAAY,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/G,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAgC,EAAsB,EAAE,CAC3E,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;AAEtD;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,IAGC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACxH,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;QACxC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;YAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,qBAAqB,IAAI,SAAS,CAAC;YACpD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnJ,IAAI,CAAC,CAAC,YAAY;gBAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,WAAW,MAAM,WAAW,EAAE;gBAChE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC5C,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,CAAC;SAC1I,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,qFAAqF;YACrF,cAAc,EAAE,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/D,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;SAC3B,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,IAAuH;IAEvH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;QACxC,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,kDAAkD;YAC9D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,UAAU;YACpB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,KAAK,EAAE,sBAAsB;SAC9B,CAAC;QACF,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QAC9D,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,cAAc,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7D,yEAAyE;YACzE,yEAAyE;YACzE,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,IAAiE;IAEjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,CAAC;IACvD,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,0BAA0B,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,EAAE;YAC1F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,cAAc,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI;YAC3C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3E,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;SAC9B,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,IAAgE;IAEhE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC9H,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;QACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,2BAA2B,kBAAkB,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChD,mFAAmF;QACnF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,IAAK,CAAC,IAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3H,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,aAAa,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,EAAE;YACzF,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO;YACL,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,CAAC,WAAW,EAAE;YAChE,cAAc,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,UAAU;YACjE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzD,WAAW,EAAE,EAAE;SAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAA2B,EAAE,CAA8B;IACrF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,gBAAS,EAAC,OAAO,CAA4B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,cAAc,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI;QAC9C,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnF,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/magic-did.d.ts

@@ -0,0 +1,5 @@
+import type { MigrationTokenExtractor } from './migration-bridge';
+/** Is this a Magic DID token by shape (`[0x…proof, claim JSON with a did:ethr iss]`)? Nothing is verified. */
+export declare function looksLikeMagicDidToken(token: string): boolean;
+/** The bridge token extractor for Magic: the DID token in `Authorization: Bearer`, when there is one. */
+export declare function magicDidTokenExtractor(): MigrationTokenExtractor;

package/dist/magic-did.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.looksLikeMagicDidToken = looksLikeMagicDidToken;
+exports.magicDidTokenExtractor = magicDidTokenExtractor;
+/**
+ * Magic (magic.link) DID tokens for the migration bridge. A Magic app sends
+ * `magic.user.getIdToken()` to its server as `Authorization: Bearer <DID token>`;
+ * a DID token is base64(JSON `[proof, claim]`), not a JWT, so the bridge's
+ * generic Bearer reading (which routes on a JWT's `iss`) does not see it.
+ * This extractor picks it out (by shape only — Atlas verifies the signature,
+ * expiry and audience on exchange). Runs on every runtime (no Buffer).
+ *
+ *   migrationBridge({ source: 'magic', presetVars: { client_id }, extractToken: magicDidTokenExtractor() })
+ */
+const ISSUER = /^did:ethr:0x[0-9a-fA-F]{40}$/;
+function header(headers, name) {
+    if (typeof headers.get === 'function')
+        return headers.get(name) ?? undefined;
+    const record = headers;
+    const value = record[name] ?? record[name.toLowerCase()];
+    return Array.isArray(value) ? value[0] : value;
+}
+/** Is this a Magic DID token by shape (`[0x…proof, claim JSON with a did:ethr iss]`)? Nothing is verified. */
+function looksLikeMagicDidToken(token) {
+    if (!token || token.length > 16_384 || !/^[A-Za-z0-9+/_-]+={0,2}$/.test(token))
+        return false;
+    try {
+        const b64 = token.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(token.length / 4) * 4, '=');
+        const outer = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(b64), (c) => c.charCodeAt(0))));
+        if (!Array.isArray(outer) || outer.length !== 2 || typeof outer[0] !== 'string' || typeof outer[1] !== 'string')
+            return false;
+        if (!/^0x[0-9a-fA-F]{130}$/.test(outer[0]))
+            return false;
+        const claim = JSON.parse(outer[1]);
+        return typeof claim?.iss === 'string' && ISSUER.test(claim.iss);
+    }
+    catch {
+        return false;
+    }
+}
+/** The bridge token extractor for Magic: the DID token in `Authorization: Bearer`, when there is one. */
+function magicDidTokenExtractor() {
+    return ({ headers }) => {
+        const auth = header(headers, 'authorization');
+        const m = auth ? /^Bearer\s+(\S+)$/i.exec(auth.trim()) : null;
+        return m && looksLikeMagicDidToken(m[1]) ? m[1] : undefined;
+    };
+}
+//# sourceMappingURL=magic-did.js.map

package/dist/magic-did.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-did.js","sourceRoot":"","sources":["../src/magic-did.ts"],"names":[],"mappings":";;AAuBA,wDAYC;AAGD,wDAMC;AA1CD;;;;;;;;;GASG;AAEH,MAAM,MAAM,GAAG,8BAA8B,CAAC;AAE9C,SAAS,MAAM,CAAC,OAA0D,EAAE,IAAY;IACtF,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC9I,MAAM,MAAM,GAAG,OAAwD,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,8GAA8G;AAC9G,SAAgB,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAY,CAAC;QAClH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9H,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAsB,CAAC;QACxD,OAAO,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,SAAgB,sBAAsB;IACpC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}

package/dist/migration-bridge.d.ts

@@ -0,0 +1,162 @@
+import type { BridgeCookie } from './better-auth';
+import { type TokenFormat } from './migration-presets';
+/** The Frontend API exchange path for a source. */
+export declare function migrationExchangePath(source: string): string;
+/** The Backend API (secret-key) exchange path for a source. */
+export declare function migrationBapiExchangePath(source: string): string;
+/** Why Atlas refused an exchange (`meta.bridge_outcome`). */
+export type MigrationBridgeRefusal = 'closed' | 'invalid' | 'signature_invalid' | 'expired' | 'reused' | 'user_unavailable' | 'user_unknown' | 'rate_limited' | 'unavailable';
+export type MigrationExchangeResult = {
+    kind: 'session';
+    jwt: string;
+    refreshToken: string;
+    sessionId: string;
+    userId: string;
+    expiresIn: number;
+}
+/** The user still owes a second factor (or MFA enrolment) — the old session is spent. */
+ | {
+    kind: 'needs_mfa';
+    attemptId: string;
+    status: 'needs_second_factor' | 'needs_mfa_enrollment';
+} | {
+    kind: 'refused';
+    outcome: MigrationBridgeRefusal;
+    status: number;
+};
+export interface ExchangeMigrationSessionOptions {
+    /** The migration source (`auth0`, `clerk`, `cognito`, `better_auth` …). */
+    source: string;
+    /** The instance's Frontend API origin. */
+    fapiOrigin: string;
+    publishableKey: string;
+    /**
+     * The instance secret key. When set (recommended on a server) the exchange
+     * goes to the Backend API — limited per instance with a ceiling sized for a
+     * bulk cutover, not per IP — and takes the user's IP / user agent from
+     * `clientIp` / `userAgent`.
+     */
+    secretKey?: string;
+    /** Backend API origin for the secret-key path. Default `https://api.atlasauth.net`. */
+    bapiBaseUrl?: string;
+    clientIp?: string;
+    /** The old session token as read from the cookie / header (after the preset's token format). */
+    token: string;
+    remember?: boolean;
+    fetchImpl?: typeof fetch;
+    userAgent?: string;
+}
+/**
+ * Exchange an old vendor session for an Atlas session, server to server
+ * (`delivery: "body"`). Never throws: a transport failure is
+ * `{ kind: 'refused', outcome: 'unavailable' }`, so the caller keeps the old
+ * cookie and tries again on a later request.
+ */
+export declare function exchangeMigrationSession(options: ExchangeMigrationSessionOptions): Promise<MigrationExchangeResult>;
+type HeaderBag = {
+    get(name: string): string | null;
+} | Record<string, string | string[] | undefined>;
+/** Everything the bridge sees of a request. */
+export interface MigrationBridgeRequest {
+    headers: HeaderBag;
+    /** The end user's IP as your framework resolved it (forwarded on the secret-key path). */
+    ip?: string;
+}
+/**
+ * Pull the old token out of a request yourself — for a vendor whose cookie is
+ * encrypted with a secret only your server has (nextjs-auth0, WorkOS AuthKit,
+ * Auth.js JWT sessions): open it locally and return the JWT inside. Return
+ * undefined when the request carries no old session.
+ */
+export type MigrationTokenExtractor = (input: {
+    cookies: Record<string, string>;
+    headers: HeaderBag;
+}) => string | undefined | Promise<string | undefined>;
+export interface MigrationBridgeOptions {
+    /** The migration source (`auth0`, `clerk`, `cognito`, `supabase`, `better_auth` …). */
+    source: string;
+    fapiOrigin: string;
+    publishableKey: string;
+    /** The instance secret key: exchanges go through the Backend API (recommended). */
+    secretKey?: string;
+    bapiBaseUrl?: string;
+    /** The bridge preset (default: the preset named like the source). */
+    preset?: string;
+    /** Variables the preset's cookie names need (`project_ref`, `client_id`, `cookie_prefix` …). */
+    presetVars?: Record<string, string>;
+    /** Cookie names to read, instead of the preset's (`*` wildcards allowed). */
+    cookieNames?: string[];
+    /** Cookie names to clear after an exchange, instead of the preset's. */
+    clearCookieNames?: string[];
+    /** How the cookie holds the token (`raw`, `supabase`); default the preset's. */
+    tokenFormat?: TokenFormat;
+    /** A custom extractor; replaces cookie reading entirely. */
+    extractToken?: MigrationTokenExtractor;
+    /** Also read `Authorization: Bearer` (default: the preset's choice). */
+    bearer?: boolean;
+    /** The `domain` the old cookies were set on, so they clear. */
+    oldCookieDomain?: string;
+    /** Mark the Atlas cookies `Secure`. Default true; false only for plain-http local development. */
+    secure?: boolean;
+    fetchImpl?: typeof fetch;
+}
+/** What the bridge decided for one request. */
+export type MigrationBridgeDecision = 
+/** No old session, or an Atlas session already present: carry on. */
+{
+    action: 'none';
+}
+/** Exchanged: set these cookies and re-enter (redirect to the same URL) so the new session is read. */
+ | {
+    action: 'signed_in';
+    cookies: BridgeCookie[];
+    session: Extract<MigrationExchangeResult, {
+        kind: 'session';
+    }>;
+}
+/** A second factor is owed: send the browser to your sign-in page carrying the attempt. */
+ | {
+    action: 'needs_mfa';
+    cookies: BridgeCookie[];
+    attemptId: string;
+    status: string;
+    continuationUrl: (url: string) => string;
+}
+/** Refused. `cookies` clears the old cookies when the refusal is final. */
+ | {
+    action: 'refused';
+    cookies: BridgeCookie[];
+    outcome: MigrationBridgeRefusal;
+};
+/** Parse a Cookie header into name → raw value (first occurrence wins). */
+export declare function parseCookieHeader(cookieHeader: string | null | undefined): Record<string, string>;
+/** The token in the PocketBase JS SDK's `authStore.exportToCookie()` cookie (`pb_auth`: JSON `{ token, record }`). */
+export declare function readPocketBaseCookieToken(raw: string | undefined): string | undefined;
+/**
+ * Supabase SSR cookie: `sb-<ref>-auth-token` (or chunks `.0`, `.1`, … joined in
+ * order), the value JSON or `base64-` + base64url(JSON), holding `access_token`.
+ */
+export declare function readSupabaseAccessToken(cookies: Record<string, string>, baseName: string): string | undefined;
+/**
+ * The refresh token in the same cookie (`refresh_token`, or the second entry
+ * of the older auth-helpers array): what the `supabase_refresh_token`
+ * session-table preset looks up among the sessions a dump of
+ * auth.refresh_tokens imported.
+ */
+export declare function readSupabaseRefreshToken(cookies: Record<string, string>, baseName: string): string | undefined;
+/** Resolve the cookie names / format / bearer flag the bridge uses for its source. */
+export declare function bridgeCookieConfig(options: Pick<MigrationBridgeOptions, 'source' | 'preset' | 'presetVars' | 'cookieNames' | 'clearCookieNames' | 'tokenFormat' | 'bearer'>): {
+    cookies: string[];
+    clear: string[];
+    format: TokenFormat;
+    bearer: boolean;
+    sharesAtlasCookie: boolean;
+    issuer: string | null;
+};
+/**
+ * The bridge as a function of a request's headers. Call it from middleware
+ * before your normal auth check; it does nothing (no network) for a request
+ * without an old session, or with an Atlas session already present.
+ */
+export declare function createMigrationBridge(options: MigrationBridgeOptions): (request: MigrationBridgeRequest) => Promise<MigrationBridgeDecision>;
+export {};