@aura-stack/auth 0.1.0-rc.8 → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/@types/index.cjs +15 -15
- package/dist/@types/index.d.ts +7 -31
- package/dist/@types/index.js +1 -1
- package/dist/@types/router.d.cjs +1 -1
- package/dist/@types/router.d.d.ts +7 -7
- package/dist/@types/utility.cjs +15 -15
- package/dist/@types/utility.d.ts +6 -6
- package/dist/@types/utility.js +1 -1
- package/dist/actions/callback/access-token.cjs +143 -143
- package/dist/actions/callback/access-token.d.ts +15 -20
- package/dist/actions/callback/access-token.js +8 -4
- package/dist/actions/callback/callback.cjs +437 -455
- package/dist/actions/callback/callback.d.ts +10 -12
- package/dist/actions/callback/callback.js +16 -12
- package/dist/actions/callback/userinfo.cjs +131 -134
- package/dist/actions/callback/userinfo.d.ts +9 -9
- package/dist/actions/callback/userinfo.js +10 -6
- package/dist/actions/csrfToken/csrfToken.cjs +162 -171
- package/dist/actions/csrfToken/csrfToken.d.ts +3 -3
- package/dist/actions/csrfToken/csrfToken.js +12 -8
- package/dist/actions/index.cjs +746 -773
- package/dist/actions/index.d.ts +13 -13
- package/dist/actions/index.js +34 -18
- package/dist/actions/session/session.cjs +149 -155
- package/dist/actions/session/session.d.ts +3 -3
- package/dist/actions/session/session.js +11 -7
- package/dist/actions/signIn/authorization.cjs +231 -249
- package/dist/actions/signIn/authorization.d.ts +12 -18
- package/dist/actions/signIn/authorization.js +16 -6
- package/dist/actions/signIn/signIn.cjs +396 -423
- package/dist/actions/signIn/signIn.d.ts +10 -10
- package/dist/actions/signIn/signIn.js +14 -10
- package/dist/actions/signOut/signOut.cjs +417 -440
- package/dist/actions/signOut/signOut.d.ts +3 -3
- package/dist/actions/signOut/signOut.js +15 -11
- package/dist/assert.cjs +35 -36
- package/dist/assert.d.ts +4 -4
- package/dist/assert.js +10 -2
- package/dist/chunk-256KIVJL.js +85 -96
- package/dist/chunk-42XB3YCW.js +19 -17
- package/dist/chunk-6SM22VVJ.js +13 -10
- package/dist/chunk-CAKJT3KS.js +84 -69
- package/dist/chunk-E3OXBRYF.js +19 -17
- package/dist/chunk-EBPE35JT.js +28 -26
- package/dist/chunk-FIPU4MLT.js +18 -16
- package/dist/chunk-FJUDBLCP.js +50 -43
- package/dist/chunk-FKRDCWBF.js +19 -17
- package/dist/chunk-GZU3RBTB.js +51 -40
- package/dist/chunk-HGJ4TXY4.js +132 -100
- package/dist/chunk-HMRKN75I.js +63 -63
- package/dist/chunk-IKHPGFCW.js +11 -9
- package/dist/chunk-JAPMIE6S.js +7 -5
- package/dist/chunk-KRNOMBXQ.js +19 -17
- package/dist/chunk-LLR722CL.js +91 -70
- package/dist/chunk-RLT4RFKV.js +39 -30
- package/dist/chunk-SJPDVKUS.js +107 -88
- package/dist/chunk-SMQO5WD7.js +26 -16
- package/dist/chunk-STHEPPUZ.js +8 -6
- package/dist/chunk-UJJ7R56J.js +47 -37
- package/dist/chunk-UTDLUEEG.js +27 -21
- package/dist/chunk-VFTYH33W.js +54 -37
- package/dist/chunk-XXJKNKGQ.js +33 -23
- package/dist/chunk-ZV4BH47P.js +132 -134
- package/dist/cookie.cjs +169 -175
- package/dist/cookie.d.ts +23 -51
- package/dist/cookie.js +34 -34
- package/dist/error.cjs +75 -75
- package/dist/error.d.ts +30 -30
- package/dist/error.js +15 -8
- package/dist/headers.cjs +28 -28
- package/dist/headers.d.ts +2 -2
- package/dist/headers.js +6 -2
- package/dist/index-DpfbvTZ_.d.ts +249 -298
- package/dist/index.cjs +936 -969
- package/dist/index.d.ts +10 -31
- package/dist/index.js +70 -50
- package/dist/jose.cjs +61 -64
- package/dist/jose.d.ts +8 -8
- package/dist/jose.js +9 -5
- package/dist/oauth/bitbucket.cjs +38 -38
- package/dist/oauth/bitbucket.d.ts +7 -7
- package/dist/oauth/bitbucket.js +6 -2
- package/dist/oauth/discord.cjs +48 -48
- package/dist/oauth/discord.d.ts +7 -7
- package/dist/oauth/discord.js +6 -2
- package/dist/oauth/figma.cjs +39 -39
- package/dist/oauth/figma.d.ts +7 -7
- package/dist/oauth/figma.js +6 -2
- package/dist/oauth/github.cjs +31 -31
- package/dist/oauth/github.d.ts +7 -7
- package/dist/oauth/github.js +6 -2
- package/dist/oauth/gitlab.cjs +39 -39
- package/dist/oauth/gitlab.d.ts +7 -7
- package/dist/oauth/gitlab.js +6 -2
- package/dist/oauth/index.cjs +180 -180
- package/dist/oauth/index.d.ts +7 -26
- package/dist/oauth/index.js +36 -9
- package/dist/oauth/spotify.cjs +39 -39
- package/dist/oauth/spotify.d.ts +7 -7
- package/dist/oauth/spotify.js +6 -2
- package/dist/oauth/x.cjs +39 -39
- package/dist/oauth/x.d.ts +7 -7
- package/dist/oauth/x.js +6 -2
- package/dist/response.cjs +27 -27
- package/dist/response.d.ts +2 -2
- package/dist/response.js +6 -2
- package/dist/schemas.cjs +91 -91
- package/dist/schemas.d.ts +93 -126
- package/dist/schemas.js +18 -18
- package/dist/secure.cjs +95 -98
- package/dist/secure.d.ts +17 -17
- package/dist/secure.js +18 -4
- package/dist/utils.cjs +119 -132
- package/dist/utils.d.ts +11 -26
- package/dist/utils.js +21 -21
- package/package.json +2 -2
|
@@ -1,292 +1,274 @@
|
|
|
1
|
-
"use strict"
|
|
2
|
-
var __defProp = Object.defineProperty
|
|
3
|
-
var __getOwnPropDesc = Object.getOwnPropertyDescriptor
|
|
4
|
-
var __getOwnPropNames = Object.getOwnPropertyNames
|
|
5
|
-
var __hasOwnProp = Object.prototype.hasOwnProperty
|
|
1
|
+
"use strict";
|
|
2
|
+
var __defProp = Object.defineProperty;
|
|
3
|
+
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
|
|
4
|
+
var __getOwnPropNames = Object.getOwnPropertyNames;
|
|
5
|
+
var __hasOwnProp = Object.prototype.hasOwnProperty;
|
|
6
6
|
var __export = (target, all) => {
|
|
7
|
-
|
|
8
|
-
}
|
|
7
|
+
for (var name in all)
|
|
8
|
+
__defProp(target, name, { get: all[name], enumerable: true });
|
|
9
|
+
};
|
|
9
10
|
var __copyProps = (to, from, except, desc) => {
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
}
|
|
17
|
-
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod)
|
|
11
|
+
if (from && typeof from === "object" || typeof from === "function") {
|
|
12
|
+
for (let key of __getOwnPropNames(from))
|
|
13
|
+
if (!__hasOwnProp.call(to, key) && key !== except)
|
|
14
|
+
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
|
|
15
|
+
}
|
|
16
|
+
return to;
|
|
17
|
+
};
|
|
18
|
+
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
|
|
18
19
|
|
|
19
20
|
// src/actions/signIn/authorization.ts
|
|
20
|
-
var authorization_exports = {}
|
|
21
|
+
var authorization_exports = {};
|
|
21
22
|
__export(authorization_exports, {
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
})
|
|
27
|
-
module.exports = __toCommonJS(authorization_exports)
|
|
23
|
+
createAuthorizationURL: () => createAuthorizationURL,
|
|
24
|
+
createRedirectTo: () => createRedirectTo,
|
|
25
|
+
createRedirectURI: () => createRedirectURI,
|
|
26
|
+
getOriginURL: () => getOriginURL
|
|
27
|
+
});
|
|
28
|
+
module.exports = __toCommonJS(authorization_exports);
|
|
28
29
|
|
|
29
30
|
// src/assert.ts
|
|
30
31
|
var isValidURL = (value) => {
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
}
|
|
32
|
+
if (value.includes("\r\n") || value.includes("\n") || value.includes("\r")) return false;
|
|
33
|
+
const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()*+,;=:@-]*)*\/?$/;
|
|
34
|
+
return regex.test(value);
|
|
35
|
+
};
|
|
36
36
|
|
|
37
37
|
// src/schemas.ts
|
|
38
|
-
var import_v4 = require("zod/v4")
|
|
38
|
+
var import_v4 = require("zod/v4");
|
|
39
39
|
var OAuthProviderConfigSchema = (0, import_v4.object)({
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
})
|
|
40
|
+
authorizeURL: (0, import_v4.url)(),
|
|
41
|
+
accessToken: (0, import_v4.url)(),
|
|
42
|
+
scope: (0, import_v4.string)().optional(),
|
|
43
|
+
userInfo: (0, import_v4.url)(),
|
|
44
|
+
responseType: (0, import_v4.enum)(["code", "token", "id_token"]),
|
|
45
|
+
clientId: (0, import_v4.string)(),
|
|
46
|
+
clientSecret: (0, import_v4.string)()
|
|
47
|
+
});
|
|
48
48
|
var OAuthAuthorization = OAuthProviderConfigSchema.extend({
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
})
|
|
49
|
+
redirectURI: (0, import_v4.string)(),
|
|
50
|
+
state: (0, import_v4.string)(),
|
|
51
|
+
codeChallenge: (0, import_v4.string)(),
|
|
52
|
+
codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
|
|
53
|
+
});
|
|
54
54
|
var OAuthAuthorizationResponse = (0, import_v4.object)({
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
})
|
|
55
|
+
state: (0, import_v4.string)(),
|
|
56
|
+
code: (0, import_v4.string)()
|
|
57
|
+
});
|
|
58
58
|
var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
})
|
|
59
|
+
error: (0, import_v4.enum)([
|
|
60
|
+
"invalid_request",
|
|
61
|
+
"unauthorized_client",
|
|
62
|
+
"access_denied",
|
|
63
|
+
"unsupported_response_type",
|
|
64
|
+
"invalid_scope",
|
|
65
|
+
"server_error",
|
|
66
|
+
"temporarily_unavailable"
|
|
67
|
+
]),
|
|
68
|
+
error_description: (0, import_v4.string)().optional(),
|
|
69
|
+
error_uri: (0, import_v4.string)().optional(),
|
|
70
|
+
state: (0, import_v4.string)()
|
|
71
|
+
});
|
|
72
72
|
var OAuthAccessToken = OAuthProviderConfigSchema.extend({
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
})
|
|
73
|
+
redirectURI: (0, import_v4.string)(),
|
|
74
|
+
code: (0, import_v4.string)(),
|
|
75
|
+
codeVerifier: (0, import_v4.string)().min(43).max(128)
|
|
76
|
+
});
|
|
77
77
|
var OAuthAccessTokenResponse = (0, import_v4.object)({
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
})
|
|
78
|
+
access_token: (0, import_v4.string)(),
|
|
79
|
+
token_type: (0, import_v4.string)(),
|
|
80
|
+
expires_in: (0, import_v4.number)().optional(),
|
|
81
|
+
refresh_token: (0, import_v4.string)().optional(),
|
|
82
|
+
scope: (0, import_v4.string)().optional()
|
|
83
|
+
});
|
|
84
84
|
var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
})
|
|
85
|
+
error: (0, import_v4.enum)([
|
|
86
|
+
"invalid_request",
|
|
87
|
+
"invalid_client",
|
|
88
|
+
"invalid_grant",
|
|
89
|
+
"unauthorized_client",
|
|
90
|
+
"unsupported_grant_type",
|
|
91
|
+
"invalid_scope"
|
|
92
|
+
]),
|
|
93
|
+
error_description: (0, import_v4.string)().optional(),
|
|
94
|
+
error_uri: (0, import_v4.string)().optional()
|
|
95
|
+
});
|
|
96
96
|
var OAuthErrorResponse = (0, import_v4.object)({
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
})
|
|
97
|
+
error: (0, import_v4.string)(),
|
|
98
|
+
error_description: (0, import_v4.string)().optional()
|
|
99
|
+
});
|
|
100
100
|
|
|
101
101
|
// src/utils.ts
|
|
102
|
-
var import_router = require("@aura-stack/router")
|
|
102
|
+
var import_router = require("@aura-stack/router");
|
|
103
103
|
|
|
104
104
|
// src/error.ts
|
|
105
105
|
var AuthError = class extends Error {
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
}
|
|
106
|
+
constructor(type, message) {
|
|
107
|
+
super(message);
|
|
108
|
+
this.type = type;
|
|
109
|
+
this.name = "AuthError";
|
|
110
|
+
}
|
|
111
|
+
};
|
|
112
112
|
var InvalidRedirectToError = class extends AuthError {
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
}
|
|
113
|
+
constructor(message = "The redirectTo parameter does not match the hosted origin.") {
|
|
114
|
+
super("invalid_redirect_to", message);
|
|
115
|
+
this.name = "InvalidRedirectToError";
|
|
116
|
+
}
|
|
117
|
+
};
|
|
118
118
|
var isAuthError = (error) => {
|
|
119
|
-
|
|
120
|
-
}
|
|
119
|
+
return error instanceof AuthError;
|
|
120
|
+
};
|
|
121
121
|
var ERROR_RESPONSE = {
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
}
|
|
122
|
+
AUTHORIZATION: {
|
|
123
|
+
INVALID_REQUEST: "invalid_request",
|
|
124
|
+
UNAUTHORIZED_CLIENT: "unauthorized_client",
|
|
125
|
+
ACCESS_DENIED: "access_denied",
|
|
126
|
+
UNSUPPORTED_RESPONSE_TYPE: "unsupported_response_type",
|
|
127
|
+
INVALID_SCOPE: "invalid_scope",
|
|
128
|
+
SERVER_ERROR: "server_error",
|
|
129
|
+
TEMPORARILY_UNAVAILABLE: "temporarily_unavailable"
|
|
130
|
+
},
|
|
131
|
+
ACCESS_TOKEN: {
|
|
132
|
+
INVALID_REQUEST: "invalid_request",
|
|
133
|
+
INVALID_CLIENT: "invalid_client",
|
|
134
|
+
INVALID_GRANT: "invalid_grant",
|
|
135
|
+
UNAUTHORIZED_CLIENT: "unauthorized_client",
|
|
136
|
+
UNSUPPORTED_GRANT_TYPE: "unsupported_grant_type",
|
|
137
|
+
INVALID_SCOPE: "invalid_scope"
|
|
138
|
+
}
|
|
139
|
+
};
|
|
140
140
|
|
|
141
141
|
// src/utils.ts
|
|
142
142
|
var toSnakeCase = (str) => {
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
.replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2")
|
|
146
|
-
.toLowerCase()
|
|
147
|
-
.replace(/^_+/, "")
|
|
148
|
-
}
|
|
143
|
+
return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
|
|
144
|
+
};
|
|
149
145
|
var toUpperCase = (str) => {
|
|
150
|
-
|
|
151
|
-
}
|
|
146
|
+
return str.toUpperCase();
|
|
147
|
+
};
|
|
152
148
|
var toCastCase = (obj, type = "snake") => {
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
}
|
|
149
|
+
return Object.entries(obj).reduce((previous, [key, value]) => {
|
|
150
|
+
const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
|
|
151
|
+
return { ...previous, [newKey]: value };
|
|
152
|
+
}, {});
|
|
153
|
+
};
|
|
158
154
|
var equals = (a, b) => {
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
}
|
|
155
|
+
if (a === null || b === null || a === void 0 || b === void 0) return false;
|
|
156
|
+
return a === b;
|
|
157
|
+
};
|
|
162
158
|
var sanitizeURL = (url2) => {
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
path = path.replace(/\/+$/, "/")
|
|
184
|
-
} else if (path !== "/") {
|
|
185
|
-
path = path.replace(/\/+$/, "")
|
|
186
|
-
}
|
|
187
|
-
return protocol + domain + path
|
|
188
|
-
}
|
|
189
|
-
let sanitized = decodedURL
|
|
190
|
-
.replace(/\/\.\.\//g, "/")
|
|
191
|
-
.replace(/\/\.\.$/, "")
|
|
192
|
-
.replace(/\.{2,}/g, "")
|
|
193
|
-
.replace(/\/{2,}/g, "/")
|
|
194
|
-
if (sanitized !== "/" && sanitized.endsWith("/")) {
|
|
195
|
-
sanitized = sanitized.replace(/\/+$/, "/")
|
|
196
|
-
} else if (sanitized !== "/") {
|
|
197
|
-
sanitized = sanitized.replace(/\/+$/, "")
|
|
198
|
-
}
|
|
199
|
-
return sanitized
|
|
200
|
-
} catch {
|
|
201
|
-
return url2.trim()
|
|
159
|
+
try {
|
|
160
|
+
let decodedURL = decodeURIComponent(url2).trim();
|
|
161
|
+
const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/);
|
|
162
|
+
let protocol = "";
|
|
163
|
+
let rest = decodedURL;
|
|
164
|
+
if (protocolMatch) {
|
|
165
|
+
protocol = protocolMatch[1];
|
|
166
|
+
rest = decodedURL.slice(protocol.length);
|
|
167
|
+
const slashIndex = rest.indexOf("/");
|
|
168
|
+
if (slashIndex === -1) {
|
|
169
|
+
return protocol + rest;
|
|
170
|
+
}
|
|
171
|
+
const domain = rest.slice(0, slashIndex);
|
|
172
|
+
let path = rest.slice(slashIndex).replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
|
|
173
|
+
if (path !== "/" && path.endsWith("/")) {
|
|
174
|
+
path = path.replace(/\/+$/, "/");
|
|
175
|
+
} else if (path !== "/") {
|
|
176
|
+
path = path.replace(/\/+$/, "");
|
|
177
|
+
}
|
|
178
|
+
return protocol + domain + path;
|
|
202
179
|
}
|
|
203
|
-
}
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
url2.search = ""
|
|
209
|
-
return `${url2.origin}${url2.pathname}`
|
|
210
|
-
} catch {
|
|
211
|
-
return sanitizeURL(path)
|
|
180
|
+
let sanitized = decodedURL.replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
|
|
181
|
+
if (sanitized !== "/" && sanitized.endsWith("/")) {
|
|
182
|
+
sanitized = sanitized.replace(/\/+$/, "/");
|
|
183
|
+
} else if (sanitized !== "/") {
|
|
184
|
+
sanitized = sanitized.replace(/\/+$/, "");
|
|
212
185
|
}
|
|
213
|
-
|
|
186
|
+
return sanitized;
|
|
187
|
+
} catch {
|
|
188
|
+
return url2.trim();
|
|
189
|
+
}
|
|
190
|
+
};
|
|
191
|
+
var getNormalizedOriginPath = (path) => {
|
|
192
|
+
try {
|
|
193
|
+
const url2 = new URL(path);
|
|
194
|
+
url2.hash = "";
|
|
195
|
+
url2.search = "";
|
|
196
|
+
return `${url2.origin}${url2.pathname}`;
|
|
197
|
+
} catch {
|
|
198
|
+
return sanitizeURL(path);
|
|
199
|
+
}
|
|
200
|
+
};
|
|
214
201
|
|
|
215
202
|
// src/actions/signIn/authorization.ts
|
|
216
203
|
var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod) => {
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
}
|
|
204
|
+
const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod });
|
|
205
|
+
if (!parsed.success) {
|
|
206
|
+
throw new AuthError(ERROR_RESPONSE.AUTHORIZATION.SERVER_ERROR, "Invalid OAuth configuration");
|
|
207
|
+
}
|
|
208
|
+
const { authorizeURL, ...options2 } = parsed.data;
|
|
209
|
+
const { userInfo, accessToken, clientSecret, ...required } = options2;
|
|
210
|
+
const searchParams = new URLSearchParams(toCastCase(required));
|
|
211
|
+
return `${authorizeURL}?${searchParams}`;
|
|
212
|
+
};
|
|
226
213
|
var getOriginURL = (request, trustedProxyHeaders) => {
|
|
227
|
-
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
|
|
233
|
-
|
|
234
|
-
|
|
235
|
-
|
|
236
|
-
} else {
|
|
237
|
-
return new URL(getNormalizedOriginPath(request.url))
|
|
238
|
-
}
|
|
239
|
-
}
|
|
214
|
+
const headers = request.headers;
|
|
215
|
+
if (trustedProxyHeaders) {
|
|
216
|
+
const protocol = headers.get("X-Forwarded-Proto") ?? headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? "http";
|
|
217
|
+
const host = headers.get("X-Forwarded-Host") ?? headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? null;
|
|
218
|
+
return new URL(`${protocol}://${host}${getNormalizedOriginPath(new URL(request.url).pathname)}`);
|
|
219
|
+
} else {
|
|
220
|
+
return new URL(getNormalizedOriginPath(request.url));
|
|
221
|
+
}
|
|
222
|
+
};
|
|
240
223
|
var createRedirectURI = (request, oauth, basePath, trustedProxyHeaders) => {
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
}
|
|
224
|
+
const url2 = getOriginURL(request, trustedProxyHeaders);
|
|
225
|
+
return `${url2.origin}${basePath}/callback/${oauth}`;
|
|
226
|
+
};
|
|
244
227
|
var createRedirectTo = (request, redirectTo, trustedProxyHeaders) => {
|
|
245
|
-
|
|
246
|
-
|
|
247
|
-
|
|
248
|
-
|
|
249
|
-
|
|
250
|
-
|
|
251
|
-
|
|
252
|
-
|
|
253
|
-
|
|
254
|
-
|
|
255
|
-
|
|
256
|
-
|
|
257
|
-
|
|
258
|
-
|
|
259
|
-
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
|
|
266
|
-
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
273
|
-
|
|
274
|
-
|
|
275
|
-
|
|
276
|
-
|
|
277
|
-
|
|
278
|
-
|
|
279
|
-
|
|
280
|
-
|
|
281
|
-
}
|
|
282
|
-
throw new AuthError(ERROR_RESPONSE.AUTHORIZATION.INVALID_REQUEST, "Invalid origin (potential CSRF).")
|
|
228
|
+
try {
|
|
229
|
+
const headers = request.headers;
|
|
230
|
+
const origin = headers.get("Origin");
|
|
231
|
+
const referer = headers.get("Referer");
|
|
232
|
+
let hostedURL = getOriginURL(request, trustedProxyHeaders);
|
|
233
|
+
if (redirectTo) {
|
|
234
|
+
if (redirectTo.startsWith("/")) {
|
|
235
|
+
return sanitizeURL(redirectTo);
|
|
236
|
+
}
|
|
237
|
+
const redirectToURL = new URL(sanitizeURL(getNormalizedOriginPath(redirectTo)));
|
|
238
|
+
if (!isValidURL(redirectTo) || !equals(redirectToURL.origin, hostedURL.origin)) {
|
|
239
|
+
throw new InvalidRedirectToError();
|
|
240
|
+
}
|
|
241
|
+
return sanitizeURL(redirectToURL.pathname);
|
|
242
|
+
}
|
|
243
|
+
if (referer) {
|
|
244
|
+
const refererURL = new URL(sanitizeURL(referer));
|
|
245
|
+
if (!isValidURL(referer) || !equals(refererURL.origin, hostedURL.origin)) {
|
|
246
|
+
throw new AuthError(
|
|
247
|
+
ERROR_RESPONSE.AUTHORIZATION.INVALID_REQUEST,
|
|
248
|
+
"The referer of the request does not match the hosted origin."
|
|
249
|
+
);
|
|
250
|
+
}
|
|
251
|
+
return sanitizeURL(refererURL.pathname);
|
|
252
|
+
}
|
|
253
|
+
if (origin) {
|
|
254
|
+
const originURL = new URL(sanitizeURL(getNormalizedOriginPath(origin)));
|
|
255
|
+
if (!isValidURL(origin) || !equals(originURL.origin, hostedURL.origin)) {
|
|
256
|
+
throw new AuthError(ERROR_RESPONSE.AUTHORIZATION.INVALID_REQUEST, "Invalid origin (potential CSRF).");
|
|
257
|
+
}
|
|
258
|
+
return sanitizeURL(originURL.pathname);
|
|
259
|
+
}
|
|
260
|
+
return "/";
|
|
261
|
+
} catch (error) {
|
|
262
|
+
if (isAuthError(error)) {
|
|
263
|
+
throw error;
|
|
283
264
|
}
|
|
284
|
-
|
|
265
|
+
throw new AuthError(ERROR_RESPONSE.AUTHORIZATION.INVALID_REQUEST, "Invalid origin (potential CSRF).");
|
|
266
|
+
}
|
|
267
|
+
};
|
|
285
268
|
// Annotate the CommonJS export names for ESM import in node:
|
|
286
|
-
0 &&
|
|
287
|
-
|
|
288
|
-
|
|
289
|
-
|
|
290
|
-
|
|
291
|
-
|
|
292
|
-
})
|
|
269
|
+
0 && (module.exports = {
|
|
270
|
+
createAuthorizationURL,
|
|
271
|
+
createRedirectTo,
|
|
272
|
+
createRedirectURI,
|
|
273
|
+
getOriginURL
|
|
274
|
+
});
|
|
@@ -1,10 +1,10 @@
|
|
|
1
|
-
import { f as OAuthProviderCredentials } from
|
|
2
|
-
import
|
|
3
|
-
import
|
|
4
|
-
import
|
|
5
|
-
import
|
|
6
|
-
import
|
|
7
|
-
import
|
|
1
|
+
import { f as OAuthProviderCredentials } from '../../index-DpfbvTZ_.js';
|
|
2
|
+
import 'zod/v4';
|
|
3
|
+
import '@aura-stack/jose/jose';
|
|
4
|
+
import '../../schemas.js';
|
|
5
|
+
import 'zod/v4/core';
|
|
6
|
+
import 'cookie';
|
|
7
|
+
import '../../@types/utility.js';
|
|
8
8
|
|
|
9
9
|
/**
|
|
10
10
|
* Constructs the request URI for the Authorization Request to the third-party OAuth service. It includes
|
|
@@ -18,14 +18,8 @@ import "../../@types/utility.js"
|
|
|
18
18
|
* @param redirectURI - The redirect URI where the OAuth service will send the user after authorization.
|
|
19
19
|
* @param state - A unique string used to maintain state between the request and callback.
|
|
20
20
|
*/
|
|
21
|
-
declare const createAuthorizationURL: (
|
|
22
|
-
|
|
23
|
-
redirectURI: string,
|
|
24
|
-
state: string,
|
|
25
|
-
codeChallenge: string,
|
|
26
|
-
codeChallengeMethod: string
|
|
27
|
-
) => string
|
|
28
|
-
declare const getOriginURL: (request: Request, trustedProxyHeaders?: boolean) => URL
|
|
21
|
+
declare const createAuthorizationURL: (oauthConfig: OAuthProviderCredentials, redirectURI: string, state: string, codeChallenge: string, codeChallengeMethod: string) => string;
|
|
22
|
+
declare const getOriginURL: (request: Request, trustedProxyHeaders?: boolean) => URL;
|
|
29
23
|
/**
|
|
30
24
|
* Creates the redirect URI for the OAuth callback based on the original request URL and the OAuth provider.
|
|
31
25
|
*
|
|
@@ -33,7 +27,7 @@ declare const getOriginURL: (request: Request, trustedProxyHeaders?: boolean) =>
|
|
|
33
27
|
* @param oauth - OAuth provider name
|
|
34
28
|
* @returns The redirect URI for the OAuth callback.
|
|
35
29
|
*/
|
|
36
|
-
declare const createRedirectURI: (request: Request, oauth: string, basePath: string, trustedProxyHeaders?: boolean) => string
|
|
30
|
+
declare const createRedirectURI: (request: Request, oauth: string, basePath: string, trustedProxyHeaders?: boolean) => string;
|
|
37
31
|
/**
|
|
38
32
|
* Verifies if the request's origin matches the expected origin. It accepts the redirectTo search
|
|
39
33
|
* parameter for redirection. It checks the 'Referer' header of the request with the origin where
|
|
@@ -44,6 +38,6 @@ declare const createRedirectURI: (request: Request, oauth: string, basePath: str
|
|
|
44
38
|
* @param redirectTo Optional redirectTo parameter to override the referer
|
|
45
39
|
* @returns The pathname of the referer URL if origins match
|
|
46
40
|
*/
|
|
47
|
-
declare const createRedirectTo: (request: Request, redirectTo?: string, trustedProxyHeaders?: boolean) => string
|
|
41
|
+
declare const createRedirectTo: (request: Request, redirectTo?: string, trustedProxyHeaders?: boolean) => string;
|
|
48
42
|
|
|
49
|
-
export { createAuthorizationURL, createRedirectTo, createRedirectURI, getOriginURL }
|
|
43
|
+
export { createAuthorizationURL, createRedirectTo, createRedirectURI, getOriginURL };
|
|
@@ -1,6 +1,16 @@
|
|
|
1
|
-
import {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
1
|
+
import {
|
|
2
|
+
createAuthorizationURL,
|
|
3
|
+
createRedirectTo,
|
|
4
|
+
createRedirectURI,
|
|
5
|
+
getOriginURL
|
|
6
|
+
} from "../../chunk-CAKJT3KS.js";
|
|
7
|
+
import "../../chunk-6SM22VVJ.js";
|
|
8
|
+
import "../../chunk-256KIVJL.js";
|
|
9
|
+
import "../../chunk-FJUDBLCP.js";
|
|
10
|
+
import "../../chunk-HMRKN75I.js";
|
|
11
|
+
export {
|
|
12
|
+
createAuthorizationURL,
|
|
13
|
+
createRedirectTo,
|
|
14
|
+
createRedirectURI,
|
|
15
|
+
getOriginURL
|
|
16
|
+
};
|