@aura-stack/auth 0.1.0-rc.9 → 0.2.0

package/dist/schemas.d.ts

@@ -1,163 +1,133 @@
-import * as zod_v4_core from "zod/v4/core"
-import * as zod_v4 from "zod/v4"
+import { z } from 'zod/v4';
 
 /**
  * Schema for OAuth Provider Configuration
  */
-declare const OAuthProviderConfigSchema: zod_v4.ZodObject<
-    {
-        authorizeURL: zod_v4.ZodURL
-        accessToken: zod_v4.ZodURL
-        scope: zod_v4.ZodOptional<zod_v4.ZodString>
-        userInfo: zod_v4.ZodURL
-        responseType: zod_v4.ZodEnum<{
-            token: "token"
-            code: "code"
-            id_token: "id_token"
-        }>
-        clientId: zod_v4.ZodString
-        clientSecret: zod_v4.ZodString
-    },
-    zod_v4_core.$strip
->
+declare const OAuthProviderConfigSchema: z.ZodObject<{
+    authorizeURL: z.ZodURL;
+    accessToken: z.ZodURL;
+    scope: z.ZodOptional<z.ZodString>;
+    userInfo: z.ZodURL;
+    responseType: z.ZodEnum<{
+        code: "code";
+        token: "token";
+        id_token: "id_token";
+    }>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+}, z.core.$strip>;
 /**
  * Schema used to create the authorization URL for the OAuth flow and verify the
  * OAuth configuration.
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1
  */
-declare const OAuthAuthorization: zod_v4.ZodObject<
-    {
-        authorizeURL: zod_v4.ZodURL
-        accessToken: zod_v4.ZodURL
-        scope: zod_v4.ZodOptional<zod_v4.ZodString>
-        userInfo: zod_v4.ZodURL
-        responseType: zod_v4.ZodEnum<{
-            token: "token"
-            code: "code"
-            id_token: "id_token"
-        }>
-        clientId: zod_v4.ZodString
-        clientSecret: zod_v4.ZodString
-        redirectURI: zod_v4.ZodString
-        state: zod_v4.ZodString
-        codeChallenge: zod_v4.ZodString
-        codeChallengeMethod: zod_v4.ZodEnum<{
-            S256: "S256"
-            plain: "plain"
-        }>
-    },
-    zod_v4_core.$strip
->
+declare const OAuthAuthorization: z.ZodObject<{
+    authorizeURL: z.ZodURL;
+    accessToken: z.ZodURL;
+    scope: z.ZodOptional<z.ZodString>;
+    userInfo: z.ZodURL;
+    responseType: z.ZodEnum<{
+        code: "code";
+        token: "token";
+        id_token: "id_token";
+    }>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    redirectURI: z.ZodString;
+    state: z.ZodString;
+    codeChallenge: z.ZodString;
+    codeChallengeMethod: z.ZodEnum<{
+        plain: "plain";
+        S256: "S256";
+    }>;
+}, z.core.$strip>;
 /**
  * Schema used in the callback action to validate the authorization response when the resource owner
  * has granted.
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2
  */
-declare const OAuthAuthorizationResponse: zod_v4.ZodObject<
-    {
-        state: zod_v4.ZodString
-        code: zod_v4.ZodString
-    },
-    zod_v4_core.$strip
->
+declare const OAuthAuthorizationResponse: z.ZodObject<{
+    state: z.ZodString;
+    code: z.ZodString;
+}, z.core.$strip>;
 /**
  * Schema used in the callback action to validate the authorization error response when the resource owner
  * has denied the authorization request.
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
  */
-declare const OAuthAuthorizationErrorResponse: zod_v4.ZodObject<
-    {
-        error: zod_v4.ZodEnum<{
-            invalid_request: "invalid_request"
-            unauthorized_client: "unauthorized_client"
-            access_denied: "access_denied"
-            unsupported_response_type: "unsupported_response_type"
-            invalid_scope: "invalid_scope"
-            server_error: "server_error"
-            temporarily_unavailable: "temporarily_unavailable"
-        }>
-        error_description: zod_v4.ZodOptional<zod_v4.ZodString>
-        error_uri: zod_v4.ZodOptional<zod_v4.ZodString>
-        state: zod_v4.ZodString
-    },
-    zod_v4_core.$strip
->
+declare const OAuthAuthorizationErrorResponse: z.ZodObject<{
+    error: z.ZodEnum<{
+        invalid_request: "invalid_request";
+        unauthorized_client: "unauthorized_client";
+        access_denied: "access_denied";
+        unsupported_response_type: "unsupported_response_type";
+        invalid_scope: "invalid_scope";
+        server_error: "server_error";
+        temporarily_unavailable: "temporarily_unavailable";
+    }>;
+    error_description: z.ZodOptional<z.ZodString>;
+    error_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodString;
+}, z.core.$strip>;
 /**
  * Schema for OAuth Access Token Request and OAuth Configuration
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  */
-declare const OAuthAccessToken: zod_v4.ZodObject<
-    {
-        authorizeURL: zod_v4.ZodURL
-        accessToken: zod_v4.ZodURL
-        scope: zod_v4.ZodOptional<zod_v4.ZodString>
-        userInfo: zod_v4.ZodURL
-        responseType: zod_v4.ZodEnum<{
-            token: "token"
-            code: "code"
-            id_token: "id_token"
-        }>
-        clientId: zod_v4.ZodString
-        clientSecret: zod_v4.ZodString
-        redirectURI: zod_v4.ZodString
-        code: zod_v4.ZodString
-        codeVerifier: zod_v4.ZodString
-    },
-    zod_v4_core.$strip
->
+declare const OAuthAccessToken: z.ZodObject<{
+    authorizeURL: z.ZodURL;
+    accessToken: z.ZodURL;
+    scope: z.ZodOptional<z.ZodString>;
+    userInfo: z.ZodURL;
+    responseType: z.ZodEnum<{
+        code: "code";
+        token: "token";
+        id_token: "id_token";
+    }>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    redirectURI: z.ZodString;
+    code: z.ZodString;
+    codeVerifier: z.ZodString;
+}, z.core.$strip>;
 /**
  * Schema for OAuth Access Token Response
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
  * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4
  */
-declare const OAuthAccessTokenResponse: zod_v4.ZodObject<
-    {
-        access_token: zod_v4.ZodString
-        token_type: zod_v4.ZodString
-        expires_in: zod_v4.ZodOptional<zod_v4.ZodNumber>
-        refresh_token: zod_v4.ZodOptional<zod_v4.ZodString>
-        scope: zod_v4.ZodOptional<zod_v4.ZodString>
-    },
-    zod_v4_core.$strip
->
+declare const OAuthAccessTokenResponse: z.ZodObject<{
+    access_token: z.ZodString;
+    token_type: z.ZodString;
+    expires_in: z.ZodOptional<z.ZodNumber>;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 /**
  * Schema for OAuth Access Token Error Response
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
  */
-declare const OAuthAccessTokenErrorResponse: zod_v4.ZodObject<
-    {
-        error: zod_v4.ZodEnum<{
-            invalid_request: "invalid_request"
-            unauthorized_client: "unauthorized_client"
-            invalid_scope: "invalid_scope"
-            invalid_client: "invalid_client"
-            invalid_grant: "invalid_grant"
-            unsupported_grant_type: "unsupported_grant_type"
-        }>
-        error_description: zod_v4.ZodOptional<zod_v4.ZodString>
-        error_uri: zod_v4.ZodOptional<zod_v4.ZodString>
-    },
-    zod_v4_core.$strip
->
+declare const OAuthAccessTokenErrorResponse: z.ZodObject<{
+    error: z.ZodEnum<{
+        invalid_request: "invalid_request";
+        unauthorized_client: "unauthorized_client";
+        invalid_scope: "invalid_scope";
+        invalid_client: "invalid_client";
+        invalid_grant: "invalid_grant";
+        unsupported_grant_type: "unsupported_grant_type";
+    }>;
+    error_description: z.ZodOptional<z.ZodString>;
+    error_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 /**
  * @todo: verify if this schema is still needed
  * @deprecated
  */
-declare const OAuthErrorResponse: zod_v4.ZodObject<
-    {
-        error: zod_v4.ZodString
-        error_description: zod_v4.ZodOptional<zod_v4.ZodString>
-    },
-    zod_v4_core.$strip
->
+declare const OAuthErrorResponse: z.ZodObject<{
+    error: z.ZodString;
+    error_description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const OAuthEnvSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+}, z.core.$strip>;
 
-export {
-    OAuthAccessToken,
-    OAuthAccessTokenErrorResponse,
-    OAuthAccessTokenResponse,
-    OAuthAuthorization,
-    OAuthAuthorizationErrorResponse,
-    OAuthAuthorizationResponse,
-    OAuthErrorResponse,
-    OAuthProviderConfigSchema,
-}
+export { OAuthAccessToken, OAuthAccessTokenErrorResponse, OAuthAccessTokenResponse, OAuthAuthorization, OAuthAuthorizationErrorResponse, OAuthAuthorizationResponse, OAuthEnvSchema, OAuthErrorResponse, OAuthProviderConfigSchema };

package/dist/schemas.js

@@ -1,20 +1,22 @@
 import {
-    OAuthAccessToken,
-    OAuthAccessTokenErrorResponse,
-    OAuthAccessTokenResponse,
-    OAuthAuthorization,
-    OAuthAuthorizationErrorResponse,
-    OAuthAuthorizationResponse,
-    OAuthErrorResponse,
-    OAuthProviderConfigSchema,
-} from "./chunk-HMRKN75I.js"
+  OAuthAccessToken,
+  OAuthAccessTokenErrorResponse,
+  OAuthAccessTokenResponse,
+  OAuthAuthorization,
+  OAuthAuthorizationErrorResponse,
+  OAuthAuthorizationResponse,
+  OAuthEnvSchema,
+  OAuthErrorResponse,
+  OAuthProviderConfigSchema
+} from "./chunk-WD7AUHQ5.js";
 export {
-    OAuthAccessToken,
-    OAuthAccessTokenErrorResponse,
-    OAuthAccessTokenResponse,
-    OAuthAuthorization,
-    OAuthAuthorizationErrorResponse,
-    OAuthAuthorizationResponse,
-    OAuthErrorResponse,
-    OAuthProviderConfigSchema,
-}
+  OAuthAccessToken,
+  OAuthAccessTokenErrorResponse,
+  OAuthAccessTokenResponse,
+  OAuthAuthorization,
+  OAuthAuthorizationErrorResponse,
+  OAuthAuthorizationResponse,
+  OAuthEnvSchema,
+  OAuthErrorResponse,
+  OAuthProviderConfigSchema
+};

package/dist/secure.cjs

@@ -1,123 +1,128 @@
-"use strict"
-var __create = Object.create
-var __defProp = Object.defineProperty
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor
-var __getOwnPropNames = Object.getOwnPropertyNames
-var __getProtoOf = Object.getPrototypeOf
-var __hasOwnProp = Object.prototype.hasOwnProperty
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
-    for (var name in all) __defProp(target, name, { get: all[name], enumerable: true })
-}
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
-    if ((from && typeof from === "object") || typeof from === "function") {
-        for (let key of __getOwnPropNames(from))
-            if (!__hasOwnProp.call(to, key) && key !== except)
-                __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable })
-    }
-    return to
-}
-var __toESM = (mod, isNodeMode, target) => (
-    (target = mod != null ? __create(__getProtoOf(mod)) : {}),
-    __copyProps(
-        // If the importer is in node compatibility mode or this is not an ESM
-        // file that has been converted to a CommonJS file using a Babel-
-        // compatible transform (i.e. "__esModule" has not been set), then set
-        // "default" to the CommonJS "module.exports" for node compatibility.
-        isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-        mod
-    )
-)
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod)
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/secure.ts
-var secure_exports = {}
+var secure_exports = {};
 __export(secure_exports, {
-    createCSRF: () => createCSRF,
-    createDerivedSalt: () => createDerivedSalt,
-    createHash: () => createHash,
-    createPKCE: () => createPKCE,
-    generateSecure: () => generateSecure,
-    verifyCSRF: () => verifyCSRF,
-})
-module.exports = __toCommonJS(secure_exports)
-var import_node_crypto = __toESM(require("crypto"), 1)
+  createCSRF: () => createCSRF,
+  createDerivedSalt: () => createDerivedSalt,
+  createHash: () => createHash,
+  createPKCE: () => createPKCE,
+  generateSecure: () => generateSecure,
+  verifyCSRF: () => verifyCSRF
+});
+module.exports = __toCommonJS(secure_exports);
+var import_node_crypto = __toESM(require("crypto"), 1);
 
 // src/utils.ts
-var import_router = require("@aura-stack/router")
+var import_router = require("@aura-stack/router");
 
-// src/error.ts
-var AuthError = class extends Error {
-    constructor(type, message) {
-        super(message)
-        this.type = type
-        this.name = "AuthError"
-    }
-}
-var InvalidCsrfTokenError = class extends AuthError {
-    constructor(message = "The provided CSRF token is invalid or has expired") {
-        super("invalid_csrf_token", message)
-        this.name = "InvalidCsrfTokenError"
-    }
-}
+// src/errors.ts
+var AuthSecurityError = class extends Error {
+  type = "AUTH_SECURITY_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
 
 // src/utils.ts
 var equals = (a, b) => {
-    if (a === null || b === null || a === void 0 || b === void 0) return false
-    return a === b
-}
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+
+// src/assert.ts
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+};
 
 // src/secure.ts
 var generateSecure = (length = 32) => {
-    return import_node_crypto.default.randomBytes(length).toString("base64url")
-}
+  return import_node_crypto.default.randomBytes(length).toString("base64url");
+};
 var createHash = (data, base = "hex") => {
-    return import_node_crypto.default.createHash("sha256").update(data).digest().toString(base)
-}
+  return import_node_crypto.default.createHash("sha256").update(data).digest().toString(base);
+};
 var createPKCE = async (verifier) => {
-    const codeVerifier = verifier ?? generateSecure(86)
-    const codeChallenge = createHash(codeVerifier, "base64url")
-    return { codeVerifier, codeChallenge, method: "S256" }
-}
+  const codeVerifier = verifier ?? generateSecure(86);
+  const codeChallenge = createHash(codeVerifier, "base64url");
+  return { codeVerifier, codeChallenge, method: "S256" };
+};
 var createCSRF = async (jose, csrfCookie) => {
-    try {
-        const token = generateSecure(32)
-        if (csrfCookie) {
-            await jose.verifyJWS(csrfCookie)
-            return csrfCookie
-        }
-        return jose.signJWS({ token })
-    } catch {
-        const token = generateSecure(32)
-        return jose.signJWS({ token })
+  try {
+    const token = generateSecure(32);
+    if (csrfCookie) {
+      await jose.verifyJWS(csrfCookie);
+      return csrfCookie;
     }
-}
+    return jose.signJWS({ token });
+  } catch {
+    const token = generateSecure(32);
+    return jose.signJWS({ token });
+  }
+};
 var verifyCSRF = async (jose, cookie, header) => {
-    try {
-        const { token: cookieToken } = await jose.verifyJWS(cookie)
-        const { token: headerToken } = await jose.verifyJWS(header)
-        const cookieBuffer = Buffer.from(cookieToken)
-        const headerBuffer = Buffer.from(headerToken)
-        if (!equals(headerBuffer.length, cookieBuffer.length)) {
-            throw new InvalidCsrfTokenError()
-        }
-        if (!import_node_crypto.default.timingSafeEqual(cookieBuffer, headerBuffer)) {
-            throw new InvalidCsrfTokenError()
-        }
-        return true
-    } catch {
-        throw new InvalidCsrfTokenError()
+  try {
+    const cookiePayload = await jose.verifyJWS(cookie);
+    const headerPayload = await jose.verifyJWS(header);
+    if (!isJWTPayloadWithToken(cookiePayload)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
+    }
+    if (!isJWTPayloadWithToken(headerPayload)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
+    }
+    const cookieBuffer = Buffer.from(cookiePayload.token);
+    const headerBuffer = Buffer.from(headerPayload.token);
+    if (!equals(headerBuffer.length, cookieBuffer.length)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+    }
+    if (!import_node_crypto.default.timingSafeEqual(cookieBuffer, headerBuffer)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
-}
+    return true;
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+  }
+};
 var createDerivedSalt = (secret) => {
-    return import_node_crypto.default.createHash("sha256").update(secret).update("aura-auth-salt").digest("hex")
-}
+  return import_node_crypto.default.createHash("sha256").update(secret).update("aura-auth-salt").digest("hex");
+};
 // Annotate the CommonJS export names for ESM import in node:
-0 &&
-    (module.exports = {
-        createCSRF,
-        createDerivedSalt,
-        createHash,
-        createPKCE,
-        generateSecure,
-        verifyCSRF,
-    })
+0 && (module.exports = {
+  createCSRF,
+  createDerivedSalt,
+  createHash,
+  createPKCE,
+  generateSecure,
+  verifyCSRF
+});

package/dist/secure.d.ts

@@ -1,13 +1,12 @@
-import { A as AuthRuntimeConfig } from "./index-DpfbvTZ_.js"
-import "zod/v4"
-import "@aura-stack/jose/jose"
-import "./schemas.js"
-import "zod/v4/core"
-import "cookie"
-import "./@types/utility.js"
+import { A as AuthRuntimeConfig } from './index-EqsoyjrF.js';
+import 'zod/v4';
+import './schemas.js';
+import '@aura-stack/router/cookie';
+import '@aura-stack/jose/jose';
+import './@types/utility.js';
 
-declare const generateSecure: (length?: number) => string
-declare const createHash: (data: string, base?: "hex" | "base64" | "base64url") => string
+declare const generateSecure: (length?: number) => string;
+declare const createHash: (data: string, base?: "hex" | "base64" | "base64url") => string;
 /**
  * Creates the code challenge flow for PKCE OAuth flow. It generates a code verifier and its corresponding
  * code challenge using SHA-256 hashing.
@@ -18,24 +17,24 @@ declare const createHash: (data: string, base?: "hex" | "base64" | "base64url")
  * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4.1
  */
 declare const createPKCE: (verifier?: string) => Promise<{
-    codeVerifier: string
-    codeChallenge: string
-    method: string
-}>
+    codeVerifier: string;
+    codeChallenge: string;
+    method: string;
+}>;
 /**
  * Creates a CSRF token to be used in OAuth flows to prevent cross-site request forgery attacks.
  *
  * @param csrfCookie - Optional existing CSRF cookie to verify and reuse
  * @returns Signed CSRF token
  */
-declare const createCSRF: (jose: AuthRuntimeConfig["jose"], csrfCookie?: string) => Promise<string>
-declare const verifyCSRF: (jose: AuthRuntimeConfig["jose"], cookie: string, header: string) => Promise<boolean>
+declare const createCSRF: (jose: AuthRuntimeConfig["jose"], csrfCookie?: string) => Promise<string>;
+declare const verifyCSRF: (jose: AuthRuntimeConfig["jose"], cookie: string, header: string) => Promise<boolean>;
 /**
  * Creates a deterministic derived salt from the provided secret.
  *
  * @param secret the base secret to derive the salt from
  * @returns the derived salt as a hexadecimal string
  */
-declare const createDerivedSalt: (secret: string) => string
+declare const createDerivedSalt: (secret: string) => string;
 
-export { createCSRF, createDerivedSalt, createHash, createPKCE, generateSecure, verifyCSRF }
+export { createCSRF, createDerivedSalt, createHash, createPKCE, generateSecure, verifyCSRF };

package/dist/secure.js

@@ -1,4 +1,19 @@
-import { createCSRF, createDerivedSalt, createHash, createPKCE, generateSecure, verifyCSRF } from "./chunk-GZU3RBTB.js"
-import "./chunk-256KIVJL.js"
-import "./chunk-FJUDBLCP.js"
-export { createCSRF, createDerivedSalt, createHash, createPKCE, generateSecure, verifyCSRF }
+import {
+  createCSRF,
+  createDerivedSalt,
+  createHash,
+  createPKCE,
+  generateSecure,
+  verifyCSRF
+} from "./chunk-N2APGLXA.js";
+import "./chunk-CXLATHS5.js";
+import "./chunk-EIL2FPSS.js";
+import "./chunk-RRLIF4PQ.js";
+export {
+  createCSRF,
+  createDerivedSalt,
+  createHash,
+  createPKCE,
+  generateSecure,
+  verifyCSRF
+};