@aura-stack/auth 0.1.0-rc.7 → 0.1.0-rc.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/@types/index.cjs +15 -15
- package/dist/@types/index.d.ts +31 -7
- package/dist/@types/index.js +1 -1
- package/dist/@types/router.d.cjs +1 -1
- package/dist/@types/router.d.d.ts +7 -7
- package/dist/@types/utility.cjs +15 -15
- package/dist/@types/utility.d.ts +6 -6
- package/dist/@types/utility.js +1 -1
- package/dist/actions/callback/access-token.cjs +143 -143
- package/dist/actions/callback/access-token.d.ts +20 -15
- package/dist/actions/callback/access-token.js +4 -8
- package/dist/actions/callback/callback.cjs +455 -437
- package/dist/actions/callback/callback.d.ts +12 -10
- package/dist/actions/callback/callback.js +12 -16
- package/dist/actions/callback/userinfo.cjs +134 -131
- package/dist/actions/callback/userinfo.d.ts +9 -9
- package/dist/actions/callback/userinfo.js +6 -10
- package/dist/actions/csrfToken/csrfToken.cjs +171 -162
- package/dist/actions/csrfToken/csrfToken.d.ts +3 -3
- package/dist/actions/csrfToken/csrfToken.js +8 -12
- package/dist/actions/index.cjs +773 -746
- package/dist/actions/index.d.ts +13 -13
- package/dist/actions/index.js +18 -34
- package/dist/actions/session/session.cjs +155 -149
- package/dist/actions/session/session.d.ts +3 -3
- package/dist/actions/session/session.js +7 -11
- package/dist/actions/signIn/authorization.cjs +249 -231
- package/dist/actions/signIn/authorization.d.ts +18 -12
- package/dist/actions/signIn/authorization.js +6 -16
- package/dist/actions/signIn/signIn.cjs +423 -396
- package/dist/actions/signIn/signIn.d.ts +10 -10
- package/dist/actions/signIn/signIn.js +10 -14
- package/dist/actions/signOut/signOut.cjs +440 -417
- package/dist/actions/signOut/signOut.d.ts +3 -3
- package/dist/actions/signOut/signOut.js +11 -15
- package/dist/assert.cjs +36 -35
- package/dist/assert.d.ts +4 -4
- package/dist/assert.js +2 -10
- package/dist/chunk-256KIVJL.js +96 -85
- package/dist/chunk-42XB3YCW.js +17 -19
- package/dist/chunk-6SM22VVJ.js +10 -13
- package/dist/chunk-CAKJT3KS.js +69 -84
- package/dist/chunk-E3OXBRYF.js +17 -19
- package/dist/chunk-EBPE35JT.js +26 -28
- package/dist/chunk-FIPU4MLT.js +16 -18
- package/dist/chunk-FJUDBLCP.js +43 -50
- package/dist/chunk-FKRDCWBF.js +17 -19
- package/dist/chunk-GZU3RBTB.js +40 -51
- package/dist/chunk-HGJ4TXY4.js +100 -132
- package/dist/chunk-HMRKN75I.js +63 -63
- package/dist/chunk-IKHPGFCW.js +9 -11
- package/dist/chunk-JAPMIE6S.js +5 -7
- package/dist/chunk-KRNOMBXQ.js +17 -19
- package/dist/chunk-LLR722CL.js +70 -91
- package/dist/chunk-RLT4RFKV.js +30 -39
- package/dist/chunk-SJPDVKUS.js +88 -107
- package/dist/chunk-SMQO5WD7.js +16 -26
- package/dist/chunk-STHEPPUZ.js +6 -8
- package/dist/chunk-UJJ7R56J.js +37 -47
- package/dist/chunk-UTDLUEEG.js +25 -0
- package/dist/chunk-VFTYH33W.js +37 -54
- package/dist/chunk-XXJKNKGQ.js +23 -33
- package/dist/chunk-ZV4BH47P.js +134 -132
- package/dist/cookie.cjs +175 -169
- package/dist/cookie.d.ts +51 -23
- package/dist/cookie.js +34 -34
- package/dist/error.cjs +75 -75
- package/dist/error.d.ts +30 -30
- package/dist/error.js +8 -15
- package/dist/headers.cjs +28 -28
- package/dist/headers.d.ts +2 -2
- package/dist/headers.js +2 -6
- package/dist/index-DpfbvTZ_.d.ts +298 -249
- package/dist/index.cjs +969 -933
- package/dist/index.d.ts +31 -10
- package/dist/index.js +50 -70
- package/dist/jose.cjs +67 -52
- package/dist/jose.d.ts +8 -8
- package/dist/jose.js +5 -9
- package/dist/oauth/bitbucket.cjs +38 -38
- package/dist/oauth/bitbucket.d.ts +7 -7
- package/dist/oauth/bitbucket.js +2 -6
- package/dist/oauth/discord.cjs +48 -48
- package/dist/oauth/discord.d.ts +7 -7
- package/dist/oauth/discord.js +2 -6
- package/dist/oauth/figma.cjs +39 -39
- package/dist/oauth/figma.d.ts +7 -7
- package/dist/oauth/figma.js +2 -6
- package/dist/oauth/github.cjs +31 -31
- package/dist/oauth/github.d.ts +7 -7
- package/dist/oauth/github.js +2 -6
- package/dist/oauth/gitlab.cjs +39 -39
- package/dist/oauth/gitlab.d.ts +7 -7
- package/dist/oauth/gitlab.js +2 -6
- package/dist/oauth/index.cjs +180 -180
- package/dist/oauth/index.d.ts +26 -7
- package/dist/oauth/index.js +9 -36
- package/dist/oauth/spotify.cjs +39 -39
- package/dist/oauth/spotify.d.ts +7 -7
- package/dist/oauth/spotify.js +2 -6
- package/dist/oauth/x.cjs +39 -39
- package/dist/oauth/x.d.ts +7 -7
- package/dist/oauth/x.js +2 -6
- package/dist/response.cjs +27 -27
- package/dist/response.d.ts +2 -2
- package/dist/response.js +2 -6
- package/dist/schemas.cjs +91 -91
- package/dist/schemas.d.ts +126 -93
- package/dist/schemas.js +18 -18
- package/dist/secure.cjs +98 -95
- package/dist/secure.d.ts +17 -17
- package/dist/secure.js +4 -18
- package/dist/utils.cjs +132 -119
- package/dist/utils.d.ts +26 -11
- package/dist/utils.js +21 -21
- package/package.json +1 -1
- package/dist/chunk-X7M4CQTN.js +0 -25
|
@@ -1,274 +1,292 @@
|
|
|
1
|
-
"use strict"
|
|
2
|
-
var __defProp = Object.defineProperty
|
|
3
|
-
var __getOwnPropDesc = Object.getOwnPropertyDescriptor
|
|
4
|
-
var __getOwnPropNames = Object.getOwnPropertyNames
|
|
5
|
-
var __hasOwnProp = Object.prototype.hasOwnProperty
|
|
1
|
+
"use strict"
|
|
2
|
+
var __defProp = Object.defineProperty
|
|
3
|
+
var __getOwnPropDesc = Object.getOwnPropertyDescriptor
|
|
4
|
+
var __getOwnPropNames = Object.getOwnPropertyNames
|
|
5
|
+
var __hasOwnProp = Object.prototype.hasOwnProperty
|
|
6
6
|
var __export = (target, all) => {
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
};
|
|
7
|
+
for (var name in all) __defProp(target, name, { get: all[name], enumerable: true })
|
|
8
|
+
}
|
|
10
9
|
var __copyProps = (to, from, except, desc) => {
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
}
|
|
18
|
-
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod)
|
|
10
|
+
if ((from && typeof from === "object") || typeof from === "function") {
|
|
11
|
+
for (let key of __getOwnPropNames(from))
|
|
12
|
+
if (!__hasOwnProp.call(to, key) && key !== except)
|
|
13
|
+
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable })
|
|
14
|
+
}
|
|
15
|
+
return to
|
|
16
|
+
}
|
|
17
|
+
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod)
|
|
19
18
|
|
|
20
19
|
// src/actions/signIn/authorization.ts
|
|
21
|
-
var authorization_exports = {}
|
|
20
|
+
var authorization_exports = {}
|
|
22
21
|
__export(authorization_exports, {
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
})
|
|
28
|
-
module.exports = __toCommonJS(authorization_exports)
|
|
22
|
+
createAuthorizationURL: () => createAuthorizationURL,
|
|
23
|
+
createRedirectTo: () => createRedirectTo,
|
|
24
|
+
createRedirectURI: () => createRedirectURI,
|
|
25
|
+
getOriginURL: () => getOriginURL,
|
|
26
|
+
})
|
|
27
|
+
module.exports = __toCommonJS(authorization_exports)
|
|
29
28
|
|
|
30
29
|
// src/assert.ts
|
|
31
30
|
var isValidURL = (value) => {
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
31
|
+
if (value.includes("\r\n") || value.includes("\n") || value.includes("\r")) return false
|
|
32
|
+
const regex =
|
|
33
|
+
/^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()*+,;=:@-]*)*\/?$/
|
|
34
|
+
return regex.test(value)
|
|
35
|
+
}
|
|
36
36
|
|
|
37
37
|
// src/schemas.ts
|
|
38
|
-
var import_v4 = require("zod/v4")
|
|
38
|
+
var import_v4 = require("zod/v4")
|
|
39
39
|
var OAuthProviderConfigSchema = (0, import_v4.object)({
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
})
|
|
40
|
+
authorizeURL: (0, import_v4.url)(),
|
|
41
|
+
accessToken: (0, import_v4.url)(),
|
|
42
|
+
scope: (0, import_v4.string)().optional(),
|
|
43
|
+
userInfo: (0, import_v4.url)(),
|
|
44
|
+
responseType: (0, import_v4.enum)(["code", "token", "id_token"]),
|
|
45
|
+
clientId: (0, import_v4.string)(),
|
|
46
|
+
clientSecret: (0, import_v4.string)(),
|
|
47
|
+
})
|
|
48
48
|
var OAuthAuthorization = OAuthProviderConfigSchema.extend({
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
})
|
|
49
|
+
redirectURI: (0, import_v4.string)(),
|
|
50
|
+
state: (0, import_v4.string)(),
|
|
51
|
+
codeChallenge: (0, import_v4.string)(),
|
|
52
|
+
codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"]),
|
|
53
|
+
})
|
|
54
54
|
var OAuthAuthorizationResponse = (0, import_v4.object)({
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
})
|
|
55
|
+
state: (0, import_v4.string)(),
|
|
56
|
+
code: (0, import_v4.string)(),
|
|
57
|
+
})
|
|
58
58
|
var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
})
|
|
59
|
+
error: (0, import_v4.enum)([
|
|
60
|
+
"invalid_request",
|
|
61
|
+
"unauthorized_client",
|
|
62
|
+
"access_denied",
|
|
63
|
+
"unsupported_response_type",
|
|
64
|
+
"invalid_scope",
|
|
65
|
+
"server_error",
|
|
66
|
+
"temporarily_unavailable",
|
|
67
|
+
]),
|
|
68
|
+
error_description: (0, import_v4.string)().optional(),
|
|
69
|
+
error_uri: (0, import_v4.string)().optional(),
|
|
70
|
+
state: (0, import_v4.string)(),
|
|
71
|
+
})
|
|
72
72
|
var OAuthAccessToken = OAuthProviderConfigSchema.extend({
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
})
|
|
73
|
+
redirectURI: (0, import_v4.string)(),
|
|
74
|
+
code: (0, import_v4.string)(),
|
|
75
|
+
codeVerifier: (0, import_v4.string)().min(43).max(128),
|
|
76
|
+
})
|
|
77
77
|
var OAuthAccessTokenResponse = (0, import_v4.object)({
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
})
|
|
78
|
+
access_token: (0, import_v4.string)(),
|
|
79
|
+
token_type: (0, import_v4.string)(),
|
|
80
|
+
expires_in: (0, import_v4.number)().optional(),
|
|
81
|
+
refresh_token: (0, import_v4.string)().optional(),
|
|
82
|
+
scope: (0, import_v4.string)().optional(),
|
|
83
|
+
})
|
|
84
84
|
var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
})
|
|
85
|
+
error: (0, import_v4.enum)([
|
|
86
|
+
"invalid_request",
|
|
87
|
+
"invalid_client",
|
|
88
|
+
"invalid_grant",
|
|
89
|
+
"unauthorized_client",
|
|
90
|
+
"unsupported_grant_type",
|
|
91
|
+
"invalid_scope",
|
|
92
|
+
]),
|
|
93
|
+
error_description: (0, import_v4.string)().optional(),
|
|
94
|
+
error_uri: (0, import_v4.string)().optional(),
|
|
95
|
+
})
|
|
96
96
|
var OAuthErrorResponse = (0, import_v4.object)({
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
})
|
|
97
|
+
error: (0, import_v4.string)(),
|
|
98
|
+
error_description: (0, import_v4.string)().optional(),
|
|
99
|
+
})
|
|
100
100
|
|
|
101
101
|
// src/utils.ts
|
|
102
|
-
var import_router = require("@aura-stack/router")
|
|
102
|
+
var import_router = require("@aura-stack/router")
|
|
103
103
|
|
|
104
104
|
// src/error.ts
|
|
105
105
|
var AuthError = class extends Error {
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
}
|
|
106
|
+
constructor(type, message) {
|
|
107
|
+
super(message)
|
|
108
|
+
this.type = type
|
|
109
|
+
this.name = "AuthError"
|
|
110
|
+
}
|
|
111
|
+
}
|
|
112
112
|
var InvalidRedirectToError = class extends AuthError {
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
}
|
|
113
|
+
constructor(message = "The redirectTo parameter does not match the hosted origin.") {
|
|
114
|
+
super("invalid_redirect_to", message)
|
|
115
|
+
this.name = "InvalidRedirectToError"
|
|
116
|
+
}
|
|
117
|
+
}
|
|
118
118
|
var isAuthError = (error) => {
|
|
119
|
-
|
|
120
|
-
}
|
|
119
|
+
return error instanceof AuthError
|
|
120
|
+
}
|
|
121
121
|
var ERROR_RESPONSE = {
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
}
|
|
122
|
+
AUTHORIZATION: {
|
|
123
|
+
INVALID_REQUEST: "invalid_request",
|
|
124
|
+
UNAUTHORIZED_CLIENT: "unauthorized_client",
|
|
125
|
+
ACCESS_DENIED: "access_denied",
|
|
126
|
+
UNSUPPORTED_RESPONSE_TYPE: "unsupported_response_type",
|
|
127
|
+
INVALID_SCOPE: "invalid_scope",
|
|
128
|
+
SERVER_ERROR: "server_error",
|
|
129
|
+
TEMPORARILY_UNAVAILABLE: "temporarily_unavailable",
|
|
130
|
+
},
|
|
131
|
+
ACCESS_TOKEN: {
|
|
132
|
+
INVALID_REQUEST: "invalid_request",
|
|
133
|
+
INVALID_CLIENT: "invalid_client",
|
|
134
|
+
INVALID_GRANT: "invalid_grant",
|
|
135
|
+
UNAUTHORIZED_CLIENT: "unauthorized_client",
|
|
136
|
+
UNSUPPORTED_GRANT_TYPE: "unsupported_grant_type",
|
|
137
|
+
INVALID_SCOPE: "invalid_scope",
|
|
138
|
+
},
|
|
139
|
+
}
|
|
140
140
|
|
|
141
141
|
// src/utils.ts
|
|
142
142
|
var toSnakeCase = (str) => {
|
|
143
|
-
|
|
144
|
-
|
|
143
|
+
return str
|
|
144
|
+
.replace(/([a-z0-9])([A-Z])/g, "$1_$2")
|
|
145
|
+
.replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2")
|
|
146
|
+
.toLowerCase()
|
|
147
|
+
.replace(/^_+/, "")
|
|
148
|
+
}
|
|
145
149
|
var toUpperCase = (str) => {
|
|
146
|
-
|
|
147
|
-
}
|
|
150
|
+
return str.toUpperCase()
|
|
151
|
+
}
|
|
148
152
|
var toCastCase = (obj, type = "snake") => {
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
}
|
|
153
|
+
return Object.entries(obj).reduce((previous, [key, value]) => {
|
|
154
|
+
const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key)
|
|
155
|
+
return { ...previous, [newKey]: value }
|
|
156
|
+
}, {})
|
|
157
|
+
}
|
|
154
158
|
var equals = (a, b) => {
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
}
|
|
159
|
+
if (a === null || b === null || a === void 0 || b === void 0) return false
|
|
160
|
+
return a === b
|
|
161
|
+
}
|
|
158
162
|
var sanitizeURL = (url2) => {
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
163
|
+
try {
|
|
164
|
+
let decodedURL = decodeURIComponent(url2).trim()
|
|
165
|
+
const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/)
|
|
166
|
+
let protocol = ""
|
|
167
|
+
let rest = decodedURL
|
|
168
|
+
if (protocolMatch) {
|
|
169
|
+
protocol = protocolMatch[1]
|
|
170
|
+
rest = decodedURL.slice(protocol.length)
|
|
171
|
+
const slashIndex = rest.indexOf("/")
|
|
172
|
+
if (slashIndex === -1) {
|
|
173
|
+
return protocol + rest
|
|
174
|
+
}
|
|
175
|
+
const domain = rest.slice(0, slashIndex)
|
|
176
|
+
let path = rest
|
|
177
|
+
.slice(slashIndex)
|
|
178
|
+
.replace(/\/\.\.\//g, "/")
|
|
179
|
+
.replace(/\/\.\.$/, "")
|
|
180
|
+
.replace(/\.{2,}/g, "")
|
|
181
|
+
.replace(/\/{2,}/g, "/")
|
|
182
|
+
if (path !== "/" && path.endsWith("/")) {
|
|
183
|
+
path = path.replace(/\/+$/, "/")
|
|
184
|
+
} else if (path !== "/") {
|
|
185
|
+
path = path.replace(/\/+$/, "")
|
|
186
|
+
}
|
|
187
|
+
return protocol + domain + path
|
|
188
|
+
}
|
|
189
|
+
let sanitized = decodedURL
|
|
190
|
+
.replace(/\/\.\.\//g, "/")
|
|
191
|
+
.replace(/\/\.\.$/, "")
|
|
192
|
+
.replace(/\.{2,}/g, "")
|
|
193
|
+
.replace(/\/{2,}/g, "/")
|
|
194
|
+
if (sanitized !== "/" && sanitized.endsWith("/")) {
|
|
195
|
+
sanitized = sanitized.replace(/\/+$/, "/")
|
|
196
|
+
} else if (sanitized !== "/") {
|
|
197
|
+
sanitized = sanitized.replace(/\/+$/, "")
|
|
198
|
+
}
|
|
199
|
+
return sanitized
|
|
200
|
+
} catch {
|
|
201
|
+
return url2.trim()
|
|
179
202
|
}
|
|
180
|
-
|
|
181
|
-
if (sanitized !== "/" && sanitized.endsWith("/")) {
|
|
182
|
-
sanitized = sanitized.replace(/\/+$/, "/");
|
|
183
|
-
} else if (sanitized !== "/") {
|
|
184
|
-
sanitized = sanitized.replace(/\/+$/, "");
|
|
185
|
-
}
|
|
186
|
-
return sanitized;
|
|
187
|
-
} catch {
|
|
188
|
-
return url2.trim();
|
|
189
|
-
}
|
|
190
|
-
};
|
|
203
|
+
}
|
|
191
204
|
var getNormalizedOriginPath = (path) => {
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
}
|
|
205
|
+
try {
|
|
206
|
+
const url2 = new URL(path)
|
|
207
|
+
url2.hash = ""
|
|
208
|
+
url2.search = ""
|
|
209
|
+
return `${url2.origin}${url2.pathname}`
|
|
210
|
+
} catch {
|
|
211
|
+
return sanitizeURL(path)
|
|
212
|
+
}
|
|
213
|
+
}
|
|
201
214
|
|
|
202
215
|
// src/actions/signIn/authorization.ts
|
|
203
216
|
var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod) => {
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
}
|
|
217
|
+
const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod })
|
|
218
|
+
if (!parsed.success) {
|
|
219
|
+
throw new AuthError(ERROR_RESPONSE.AUTHORIZATION.SERVER_ERROR, "Invalid OAuth configuration")
|
|
220
|
+
}
|
|
221
|
+
const { authorizeURL, ...options2 } = parsed.data
|
|
222
|
+
const { userInfo, accessToken, clientSecret, ...required } = options2
|
|
223
|
+
const searchParams = new URLSearchParams(toCastCase(required))
|
|
224
|
+
return `${authorizeURL}?${searchParams}`
|
|
225
|
+
}
|
|
213
226
|
var getOriginURL = (request, trustedProxyHeaders) => {
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
}
|
|
227
|
+
const headers = request.headers
|
|
228
|
+
if (trustedProxyHeaders) {
|
|
229
|
+
const protocol = headers.get("X-Forwarded-Proto") ?? headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? "http"
|
|
230
|
+
const host =
|
|
231
|
+
headers.get("X-Forwarded-Host") ??
|
|
232
|
+
headers.get("Host") ??
|
|
233
|
+
headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ??
|
|
234
|
+
null
|
|
235
|
+
return new URL(`${protocol}://${host}${getNormalizedOriginPath(new URL(request.url).pathname)}`)
|
|
236
|
+
} else {
|
|
237
|
+
return new URL(getNormalizedOriginPath(request.url))
|
|
238
|
+
}
|
|
239
|
+
}
|
|
223
240
|
var createRedirectURI = (request, oauth, basePath, trustedProxyHeaders) => {
|
|
224
|
-
|
|
225
|
-
|
|
226
|
-
}
|
|
241
|
+
const url2 = getOriginURL(request, trustedProxyHeaders)
|
|
242
|
+
return `${url2.origin}${basePath}/callback/${oauth}`
|
|
243
|
+
}
|
|
227
244
|
var createRedirectTo = (request, redirectTo, trustedProxyHeaders) => {
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
|
|
233
|
-
|
|
234
|
-
|
|
235
|
-
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
|
|
240
|
-
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
|
|
244
|
-
|
|
245
|
-
|
|
246
|
-
|
|
247
|
-
|
|
248
|
-
|
|
249
|
-
|
|
250
|
-
|
|
251
|
-
|
|
252
|
-
|
|
253
|
-
|
|
254
|
-
|
|
255
|
-
|
|
256
|
-
|
|
257
|
-
|
|
258
|
-
|
|
259
|
-
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
245
|
+
try {
|
|
246
|
+
const headers = request.headers
|
|
247
|
+
const origin = headers.get("Origin")
|
|
248
|
+
const referer = headers.get("Referer")
|
|
249
|
+
let hostedURL = getOriginURL(request, trustedProxyHeaders)
|
|
250
|
+
if (redirectTo) {
|
|
251
|
+
if (redirectTo.startsWith("/")) {
|
|
252
|
+
return sanitizeURL(redirectTo)
|
|
253
|
+
}
|
|
254
|
+
const redirectToURL = new URL(sanitizeURL(getNormalizedOriginPath(redirectTo)))
|
|
255
|
+
if (!isValidURL(redirectTo) || !equals(redirectToURL.origin, hostedURL.origin)) {
|
|
256
|
+
throw new InvalidRedirectToError()
|
|
257
|
+
}
|
|
258
|
+
return sanitizeURL(redirectToURL.pathname)
|
|
259
|
+
}
|
|
260
|
+
if (referer) {
|
|
261
|
+
const refererURL = new URL(sanitizeURL(referer))
|
|
262
|
+
if (!isValidURL(referer) || !equals(refererURL.origin, hostedURL.origin)) {
|
|
263
|
+
throw new AuthError(
|
|
264
|
+
ERROR_RESPONSE.AUTHORIZATION.INVALID_REQUEST,
|
|
265
|
+
"The referer of the request does not match the hosted origin."
|
|
266
|
+
)
|
|
267
|
+
}
|
|
268
|
+
return sanitizeURL(refererURL.pathname)
|
|
269
|
+
}
|
|
270
|
+
if (origin) {
|
|
271
|
+
const originURL = new URL(sanitizeURL(getNormalizedOriginPath(origin)))
|
|
272
|
+
if (!isValidURL(origin) || !equals(originURL.origin, hostedURL.origin)) {
|
|
273
|
+
throw new AuthError(ERROR_RESPONSE.AUTHORIZATION.INVALID_REQUEST, "Invalid origin (potential CSRF).")
|
|
274
|
+
}
|
|
275
|
+
return sanitizeURL(originURL.pathname)
|
|
276
|
+
}
|
|
277
|
+
return "/"
|
|
278
|
+
} catch (error) {
|
|
279
|
+
if (isAuthError(error)) {
|
|
280
|
+
throw error
|
|
281
|
+
}
|
|
282
|
+
throw new AuthError(ERROR_RESPONSE.AUTHORIZATION.INVALID_REQUEST, "Invalid origin (potential CSRF).")
|
|
264
283
|
}
|
|
265
|
-
|
|
266
|
-
}
|
|
267
|
-
};
|
|
284
|
+
}
|
|
268
285
|
// Annotate the CommonJS export names for ESM import in node:
|
|
269
|
-
0 &&
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
273
|
-
|
|
274
|
-
|
|
286
|
+
0 &&
|
|
287
|
+
(module.exports = {
|
|
288
|
+
createAuthorizationURL,
|
|
289
|
+
createRedirectTo,
|
|
290
|
+
createRedirectURI,
|
|
291
|
+
getOriginURL,
|
|
292
|
+
})
|
|
@@ -1,10 +1,10 @@
|
|
|
1
|
-
import { f as OAuthProviderCredentials } from
|
|
2
|
-
import
|
|
3
|
-
import
|
|
4
|
-
import
|
|
5
|
-
import
|
|
6
|
-
import
|
|
7
|
-
import
|
|
1
|
+
import { f as OAuthProviderCredentials } from "../../index-DpfbvTZ_.js"
|
|
2
|
+
import "zod/v4"
|
|
3
|
+
import "@aura-stack/jose/jose"
|
|
4
|
+
import "../../schemas.js"
|
|
5
|
+
import "zod/v4/core"
|
|
6
|
+
import "cookie"
|
|
7
|
+
import "../../@types/utility.js"
|
|
8
8
|
|
|
9
9
|
/**
|
|
10
10
|
* Constructs the request URI for the Authorization Request to the third-party OAuth service. It includes
|
|
@@ -18,8 +18,14 @@ import '../../@types/utility.js';
|
|
|
18
18
|
* @param redirectURI - The redirect URI where the OAuth service will send the user after authorization.
|
|
19
19
|
* @param state - A unique string used to maintain state between the request and callback.
|
|
20
20
|
*/
|
|
21
|
-
declare const createAuthorizationURL: (
|
|
22
|
-
|
|
21
|
+
declare const createAuthorizationURL: (
|
|
22
|
+
oauthConfig: OAuthProviderCredentials,
|
|
23
|
+
redirectURI: string,
|
|
24
|
+
state: string,
|
|
25
|
+
codeChallenge: string,
|
|
26
|
+
codeChallengeMethod: string
|
|
27
|
+
) => string
|
|
28
|
+
declare const getOriginURL: (request: Request, trustedProxyHeaders?: boolean) => URL
|
|
23
29
|
/**
|
|
24
30
|
* Creates the redirect URI for the OAuth callback based on the original request URL and the OAuth provider.
|
|
25
31
|
*
|
|
@@ -27,7 +33,7 @@ declare const getOriginURL: (request: Request, trustedProxyHeaders?: boolean) =>
|
|
|
27
33
|
* @param oauth - OAuth provider name
|
|
28
34
|
* @returns The redirect URI for the OAuth callback.
|
|
29
35
|
*/
|
|
30
|
-
declare const createRedirectURI: (request: Request, oauth: string, basePath: string, trustedProxyHeaders?: boolean) => string
|
|
36
|
+
declare const createRedirectURI: (request: Request, oauth: string, basePath: string, trustedProxyHeaders?: boolean) => string
|
|
31
37
|
/**
|
|
32
38
|
* Verifies if the request's origin matches the expected origin. It accepts the redirectTo search
|
|
33
39
|
* parameter for redirection. It checks the 'Referer' header of the request with the origin where
|
|
@@ -38,6 +44,6 @@ declare const createRedirectURI: (request: Request, oauth: string, basePath: str
|
|
|
38
44
|
* @param redirectTo Optional redirectTo parameter to override the referer
|
|
39
45
|
* @returns The pathname of the referer URL if origins match
|
|
40
46
|
*/
|
|
41
|
-
declare const createRedirectTo: (request: Request, redirectTo?: string, trustedProxyHeaders?: boolean) => string
|
|
47
|
+
declare const createRedirectTo: (request: Request, redirectTo?: string, trustedProxyHeaders?: boolean) => string
|
|
42
48
|
|
|
43
|
-
export { createAuthorizationURL, createRedirectTo, createRedirectURI, getOriginURL }
|
|
49
|
+
export { createAuthorizationURL, createRedirectTo, createRedirectURI, getOriginURL }
|
|
@@ -1,16 +1,6 @@
|
|
|
1
|
-
import {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
import "../../chunk-6SM22VVJ.js";
|
|
8
|
-
import "../../chunk-256KIVJL.js";
|
|
9
|
-
import "../../chunk-FJUDBLCP.js";
|
|
10
|
-
import "../../chunk-HMRKN75I.js";
|
|
11
|
-
export {
|
|
12
|
-
createAuthorizationURL,
|
|
13
|
-
createRedirectTo,
|
|
14
|
-
createRedirectURI,
|
|
15
|
-
getOriginURL
|
|
16
|
-
};
|
|
1
|
+
import { createAuthorizationURL, createRedirectTo, createRedirectURI, getOriginURL } from "../../chunk-CAKJT3KS.js"
|
|
2
|
+
import "../../chunk-6SM22VVJ.js"
|
|
3
|
+
import "../../chunk-256KIVJL.js"
|
|
4
|
+
import "../../chunk-FJUDBLCP.js"
|
|
5
|
+
import "../../chunk-HMRKN75I.js"
|
|
6
|
+
export { createAuthorizationURL, createRedirectTo, createRedirectURI, getOriginURL }
|