@aura-stack/auth 0.4.0-rc.4 → 0.4.0

package/dist/oauth/pinterest.cjs

@@ -23,22 +23,25 @@ __export(pinterest_exports, {
   pinterest: () => pinterest
 });
 module.exports = __toCommonJS(pinterest_exports);
-var pinterest = {
-  id: "pinterest",
-  name: "Pinterest",
-  authorizeURL: "https://api.pinterest.com/oauth/",
-  accessToken: "https://api.pinterest.com/v5/oauth/token",
-  userInfo: "https://api.pinterest.com/v5/user_account",
-  scope: "user_accounts:read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.username,
-      email: null,
-      image: profile.profile_image
-    };
-  }
+var pinterest = (options) => {
+  return {
+    id: "pinterest",
+    name: "Pinterest",
+    authorizeURL: "https://www.pinterest.com/oauth",
+    accessToken: "https://api.pinterest.com/v5/oauth/token",
+    userInfo: "https://api.pinterest.com/v5/user_account",
+    scope: "user_accounts:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.username,
+        image: profile.profile_image,
+        email: void 0
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/pinterest.d.ts

@@ -1,7 +1,8 @@
-export { P as PinterestProfile, p as pinterest } from '../index-DkaLJFn8.js';
+export { P as PinterestProfile, p as pinterest } from '../index-CSyIJmCM.js';
 import '../@types/utility.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';

package/dist/oauth/pinterest.js

@@ -1,6 +1,6 @@
 import {
   pinterest
-} from "../chunk-HP34YGGJ.js";
+} from "../chunk-E6G5YCI6.js";
 export {
   pinterest
 };

package/dist/oauth/spotify.cjs

@@ -23,22 +23,25 @@ __export(spotify_exports, {
   spotify: () => spotify
 });
 module.exports = __toCommonJS(spotify_exports);
-var spotify = {
-  id: "spotify",
-  name: "Spotify",
-  authorizeURL: "https://accounts.spotify.com/authorize",
-  accessToken: "https://accounts.spotify.com/api/token",
-  userInfo: "https://api.spotify.com/v1/me",
-  scope: "user-read-email user-read-private",
-  responseType: "token",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.display_name,
-      email: profile.email,
-      image: profile.images?.[0]?.url
-    };
-  }
+var spotify = (options) => {
+  return {
+    id: "spotify",
+    name: "Spotify",
+    authorizeURL: "https://accounts.spotify.com/authorize",
+    accessToken: "https://accounts.spotify.com/api/token",
+    userInfo: "https://api.spotify.com/v1/me",
+    scope: "user-read-private user-read-email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.display_name,
+        email: profile.email,
+        image: profile.images[0]?.url ?? void 0
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/spotify.d.ts

@@ -1,7 +1,8 @@
-export { I as Image, o as SpotifyProfile, q as spotify } from '../index-DkaLJFn8.js';
+export { u as SpotifyImage, v as SpotifyProfile, w as spotify } from '../index-CSyIJmCM.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';

package/dist/oauth/spotify.js

@@ -1,6 +1,6 @@
 import {
   spotify
-} from "../chunk-E3OXBRYF.js";
+} from "../chunk-IPKO6UQN.js";
 export {
   spotify
 };

package/dist/oauth/strava.cjs

@@ -23,22 +23,25 @@ __export(strava_exports, {
   strava: () => strava
 });
 module.exports = __toCommonJS(strava_exports);
-var strava = {
-  id: "strava",
-  name: "Strava",
-  authorizeURL: "https://www.strava.com/oauth/authorize",
-  accessToken: "https://www.strava.com/oauth/token",
-  userInfo: "https://www.strava.com/api/v3/athlete",
-  scope: "read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id.toString(),
-      name: `${profile.firstname} ${profile.lastname}`,
-      image: profile.profile,
-      email: ""
-    };
-  }
+var strava = (options) => {
+  return {
+    id: "strava",
+    name: "Strava",
+    authorizeURL: "https://www.strava.com/oauth/authorize",
+    accessToken: "https://www.strava.com/oauth/token",
+    userInfo: "https://www.strava.com/api/v3/athlete",
+    scope: "read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: `${profile.firstname} ${profile.lastname}`,
+        image: profile.profile,
+        email: void 0
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/strava.d.ts

@@ -1,7 +1,8 @@
-export { n as StravaProfile, k as SummaryClub, l as SummaryGear, s as strava } from '../index-DkaLJFn8.js';
+export { s as StravaProfile, q as SummaryClub, r as SummaryGear, t as strava } from '../index-CSyIJmCM.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';

package/dist/oauth/strava.js

@@ -1,6 +1,6 @@
 import {
   strava
-} from "../chunk-6R2YZ4AC.js";
+} from "../chunk-54CZPKR4.js";
 export {
   strava
 };

package/dist/oauth/x.cjs

@@ -23,22 +23,25 @@ __export(x_exports, {
   x: () => x
 });
 module.exports = __toCommonJS(x_exports);
-var x = {
-  id: "x",
-  name: "X",
-  authorizeURL: "https://x.com/i/oauth2/authorize",
-  accessToken: "https://api.x.com/2/oauth2/token",
-  userInfo: "https://api.x.com/2/users/me?user.fields=profile_image_url",
-  scope: "users.read users.email tweet.read offline.access",
-  responseType: "code",
-  profile({ data }) {
-    return {
-      sub: data.id,
-      name: data.name,
-      image: data.profile_image_url,
-      email: ""
-    };
-  }
+var x = (options) => {
+  return {
+    id: "x",
+    name: "X",
+    authorizeURL: "https://twitter.com/i/oauth2/authorize",
+    accessToken: "https://api.twitter.com/2/oauth2/token",
+    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
+    scope: "tweet.read users.read offline.access",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.data.id,
+        name: profile.data.name,
+        image: profile.data.profile_image_url,
+        email: void 0
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/x.d.ts

@@ -1,7 +1,8 @@
-export { X as XProfile, x } from '../index-DkaLJFn8.js';
+export { X as XProfile, x } from '../index-CSyIJmCM.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';

package/dist/oauth/x.js

@@ -1,6 +1,6 @@
 import {
   x
-} from "../chunk-42XB3YCW.js";
+} from "../chunk-EEE7UM5T.js";
 export {
   x
 };

package/dist/schemas.cjs

@@ -28,10 +28,23 @@ __export(schemas_exports, {
   OAuthAuthorizationResponse: () => OAuthAuthorizationResponse,
   OAuthEnvSchema: () => OAuthEnvSchema,
   OAuthErrorResponse: () => OAuthErrorResponse,
-  OAuthProviderConfigSchema: () => OAuthProviderConfigSchema
+  OAuthProviderConfigSchema: () => OAuthProviderConfigSchema,
+  OAuthProviderCredentialsSchema: () => OAuthProviderCredentialsSchema
 });
 module.exports = __toCommonJS(schemas_exports);
 var import_zod = require("zod");
+var OAuthProviderCredentialsSchema = (0, import_zod.object)({
+  id: (0, import_zod.string)(),
+  name: (0, import_zod.string)(),
+  authorizeURL: (0, import_zod.string)().url(),
+  accessToken: (0, import_zod.string)().url(),
+  scope: (0, import_zod.string)(),
+  userInfo: (0, import_zod.string)().url(),
+  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
+  clientId: (0, import_zod.string)(),
+  clientSecret: (0, import_zod.string)(),
+  profile: import_zod.z.function().optional()
+});
 var OAuthProviderConfigSchema = (0, import_zod.object)({
   authorizeURL: (0, import_zod.string)().url(),
   accessToken: (0, import_zod.string)().url(),
@@ -107,5 +120,6 @@ var OAuthEnvSchema = (0, import_zod.object)({
   OAuthAuthorizationResponse,
   OAuthEnvSchema,
   OAuthErrorResponse,
-  OAuthProviderConfigSchema
+  OAuthProviderConfigSchema,
+  OAuthProviderCredentialsSchema
 });

package/dist/schemas.d.ts

@@ -1,5 +1,21 @@
 import { z } from 'zod';
 
+declare const OAuthProviderCredentialsSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    authorizeURL: z.ZodString;
+    accessToken: z.ZodString;
+    scope: z.ZodString;
+    userInfo: z.ZodString;
+    responseType: z.ZodEnum<{
+        token: "token";
+        code: "code";
+        id_token: "id_token";
+    }>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    profile: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+}, z.core.$strip>;
 /**
  * Schema for OAuth Provider Configuration
  */
@@ -130,4 +146,4 @@ declare const OAuthEnvSchema: z.ZodObject<{
     clientSecret: z.ZodString;
 }, z.core.$strip>;
 
-export { OAuthAccessToken, OAuthAccessTokenErrorResponse, OAuthAccessTokenResponse, OAuthAuthorization, OAuthAuthorizationErrorResponse, OAuthAuthorizationResponse, OAuthEnvSchema, OAuthErrorResponse, OAuthProviderConfigSchema };
+export { OAuthAccessToken, OAuthAccessTokenErrorResponse, OAuthAccessTokenResponse, OAuthAuthorization, OAuthAuthorizationErrorResponse, OAuthAuthorizationResponse, OAuthEnvSchema, OAuthErrorResponse, OAuthProviderConfigSchema, OAuthProviderCredentialsSchema };

package/dist/schemas.js

@@ -7,8 +7,9 @@ import {
   OAuthAuthorizationResponse,
   OAuthEnvSchema,
   OAuthErrorResponse,
-  OAuthProviderConfigSchema
-} from "./chunk-YRCB5FLE.js";
+  OAuthProviderConfigSchema,
+  OAuthProviderCredentialsSchema
+} from "./chunk-KJBAQZX2.js";
 export {
   OAuthAccessToken,
   OAuthAccessTokenErrorResponse,
@@ -18,5 +19,6 @@ export {
   OAuthAuthorizationResponse,
   OAuthEnvSchema,
   OAuthErrorResponse,
-  OAuthProviderConfigSchema
+  OAuthProviderConfigSchema,
+  OAuthProviderCredentialsSchema
 };

package/dist/secure.cjs

@@ -31,14 +31,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var secure_exports = {};
 __export(secure_exports, {
   createCSRF: () => createCSRF,
-  createDerivedSalt: () => createDerivedSalt,
   createHash: () => createHash,
   createPKCE: () => createPKCE,
   generateSecure: () => generateSecure,
   verifyCSRF: () => verifyCSRF
 });
 module.exports = __toCommonJS(secure_exports);
-var import_crypto = __toESM(require("crypto"), 1);
+var import_crypto2 = __toESM(require("crypto"), 1);
 
 // src/utils.ts
 var import_router = require("@aura-stack/router");
@@ -62,19 +61,68 @@ var equals = (a, b) => {
 };
 
 // src/assert.ts
+var import_crypto = require("crypto");
 var isJWTPayloadWithToken = (payload) => {
   return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
 };
+var safeEquals = (a, b) => {
+  const bufferA = Buffer.from(a);
+  const bufferB = Buffer.from(b);
+  if (bufferA.length !== bufferB.length) {
+    return false;
+  }
+  return (0, import_crypto.timingSafeEqual)(bufferA, bufferB);
+};
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
+};
 
 // src/secure.ts
 var generateSecure = (length = 32) => {
-  return import_crypto.default.randomBytes(length).toString("base64url");
+  return import_crypto2.default.randomBytes(length).toString("base64url");
 };
 var createHash = (data, base = "hex") => {
-  return import_crypto.default.createHash("sha256").update(data).digest().toString(base);
+  return import_crypto2.default.createHash("sha256").update(data).digest().toString(base);
 };
 var createPKCE = async (verifier) => {
-  const codeVerifier = verifier ?? generateSecure(86);
+  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
+  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
+  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
+    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
+  }
   const codeChallenge = createHash(codeVerifier, "base64url");
   return { codeVerifier, codeChallenge, method: "S256" };
 };
@@ -82,7 +130,7 @@ var createCSRF = async (jose, csrfCookie) => {
   try {
     const token = generateSecure(32);
     if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie);
+      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
       return csrfCookie;
     }
     return jose.signJWS({ token });
@@ -93,20 +141,18 @@ var createCSRF = async (jose, csrfCookie) => {
 };
 var verifyCSRF = async (jose, cookie, header) => {
   try {
-    const cookiePayload = await jose.verifyJWS(cookie);
-    const headerPayload = await jose.verifyJWS(header);
+    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
+    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
     if (!isJWTPayloadWithToken(cookiePayload)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
     }
     if (!isJWTPayloadWithToken(headerPayload)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
     }
-    const cookieBuffer = Buffer.from(cookiePayload.token);
-    const headerBuffer = Buffer.from(headerPayload.token);
-    if (!equals(headerBuffer.length, cookieBuffer.length)) {
+    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
-    if (!import_crypto.default.timingSafeEqual(cookieBuffer, headerBuffer)) {
+    if (!safeEquals(cookiePayload.token, headerPayload.token)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
     return true;
@@ -114,13 +160,9 @@ var verifyCSRF = async (jose, cookie, header) => {
     throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
   }
 };
-var createDerivedSalt = (secret) => {
-  return import_crypto.default.createHash("sha256").update(secret).update("aura-auth-salt").digest("hex");
-};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createCSRF,
-  createDerivedSalt,
   createHash,
   createPKCE,
   generateSecure,

package/dist/secure.d.ts

@@ -1,9 +1,10 @@
-import { A as AuthRuntimeConfig } from './index-DkaLJFn8.js';
+import { A as AuthRuntimeConfig } from './index-CSyIJmCM.js';
 import 'zod';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import './jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import './@types/utility.js';
 
 declare const generateSecure: (length?: number) => string;
@@ -30,12 +31,5 @@ declare const createPKCE: (verifier?: string) => Promise<{
  */
 declare const createCSRF: (jose: AuthRuntimeConfig["jose"], csrfCookie?: string) => Promise<string>;
 declare const verifyCSRF: (jose: AuthRuntimeConfig["jose"], cookie: string, header: string) => Promise<boolean>;
-/**
- * Creates a deterministic derived salt from the provided secret.
- *
- * @param secret the base secret to derive the salt from
- * @returns the derived salt as a hexadecimal string
- */
-declare const createDerivedSalt: (secret: string) => string;
 
-export { createCSRF, createDerivedSalt, createHash, createPKCE, generateSecure, verifyCSRF };
+export { createCSRF, createHash, createPKCE, generateSecure, verifyCSRF };

package/dist/secure.js

@@ -1,17 +1,17 @@
 import {
   createCSRF,
-  createDerivedSalt,
   createHash,
   createPKCE,
   generateSecure,
   verifyCSRF
-} from "./chunk-N2APGLXA.js";
-import "./chunk-CXLATHS5.js";
-import "./chunk-EIL2FPSS.js";
+} from "./chunk-NUDITUKX.js";
+import "./chunk-4EKY7655.js";
+import "./chunk-QQVSRXGX.js";
+import "./chunk-FRJFWTOY.js";
+import "./chunk-4MYWAOLG.js";
 import "./chunk-RRLIF4PQ.js";
 export {
   createCSRF,
-  createDerivedSalt,
   createHash,
   createPKCE,
   generateSecure,