@aura-stack/auth 0.4.0-rc.4 → 0.4.0

package/dist/utils.cjs

@@ -20,12 +20,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/utils.ts
 var utils_exports = {};
 __export(utils_exports, {
+  createErrorHandler: () => createErrorHandler,
+  createStructuredData: () => createStructuredData,
   equals: () => equals,
+  extractPath: () => extractPath,
   formatZodError: () => formatZodError,
-  getNormalizedOriginPath: () => getNormalizedOriginPath,
-  isValidRelativePath: () => isValidRelativePath,
-  onErrorHandler: () => onErrorHandler,
-  sanitizeURL: () => sanitizeURL,
+  getBaseURL: () => getBaseURL,
+  getErrorName: () => getErrorName,
   toCastCase: () => toCastCase,
   toISOString: () => toISOString,
   toSnakeCase: () => toSnakeCase,
@@ -95,89 +96,77 @@ var equals = (a, b) => {
   if (a === null || b === null || a === void 0 || b === void 0) return false;
   return a === b;
 };
-var sanitizeURL = (url) => {
-  try {
-    let decodedURL = decodeURIComponent(url).trim();
-    const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/);
-    let protocol = "";
-    let rest = decodedURL;
-    if (protocolMatch) {
-      protocol = protocolMatch[1];
-      rest = decodedURL.slice(protocol.length);
-      const slashIndex = rest.indexOf("/");
-      if (slashIndex === -1) {
-        return protocol + rest;
-      }
-      const domain = rest.slice(0, slashIndex);
-      let path = rest.slice(slashIndex).replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-      if (path !== "/" && path.endsWith("/")) {
-        path = path.replace(/\/+$/, "/");
-      } else if (path !== "/") {
-        path = path.replace(/\/+$/, "");
-      }
-      return protocol + domain + path;
+var createErrorHandler = (logger) => {
+  return (error) => {
+    if ((0, import_router.isRouterError)(error)) {
+      const { message, status, statusText } = error;
+      logger?.log("ROUTER_INTERNAL_ERROR");
+      return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
     }
-    let sanitized = decodedURL.replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-    if (sanitized !== "/" && sanitized.endsWith("/")) {
-      sanitized = sanitized.replace(/\/+$/, "/");
-    } else if (sanitized !== "/") {
-      sanitized = sanitized.replace(/\/+$/, "");
+    if ((0, import_router.isInvalidZodSchemaError)(error)) {
+      logger?.log("INVALID_REQUEST");
+      return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
     }
-    return sanitized;
-  } catch {
-    return url.trim();
-  }
-};
-var isValidRelativePath = (path) => {
-  if (!path || typeof path !== "string") return false;
-  if (!path.startsWith("/") || path.includes("://") || path.includes("\r") || path.includes("\n")) return false;
-  if (/[\x00-\x1F\x7F]/.test(path) || path.includes("\0")) return false;
-  const sanitized = sanitizeURL(path);
-  if (sanitized.includes("..")) return false;
-  return true;
-};
-var onErrorHandler = (error) => {
-  if ((0, import_router.isRouterError)(error)) {
-    const { message, status, statusText } = error;
-    return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
-  }
-  if ((0, import_router.isInvalidZodSchemaError)(error)) {
-    return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
-  }
-  if (isOAuthProtocolError(error)) {
-    const { error: errorCode, message, type, errorURI } = error;
-    return Response.json(
-      {
-        type,
-        error: errorCode,
-        error_description: message,
-        error_uri: errorURI
-      },
-      { status: 400 }
-    );
-  }
-  if (isAuthInternalError(error) || isAuthSecurityError(error)) {
-    const { type, code, message } = error;
+    if (isOAuthProtocolError(error)) {
+      const { error: errorCode, message, type, errorURI } = error;
+      logger?.log("OAUTH_PROTOCOL_ERROR", {
+        structuredData: {
+          error: errorCode,
+          error_description: message,
+          error_uri: errorURI ?? ""
+        }
+      });
+      return Response.json(
+        {
+          type,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    if (isAuthInternalError(error)) {
+      const { type, code, message } = error;
+      logger?.log("INVALID_OAUTH_CONFIGURATION", {
+        structuredData: {
+          error: code,
+          error_description: message
+        }
+      });
+      return Response.json(
+        {
+          type,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    if (isAuthSecurityError(error)) {
+      const { type, code, message } = error;
+      logger?.log("INVALID_OAUTH_CONFIGURATION", {
+        structuredData: {
+          error: code,
+          error_description: message
+        }
+      });
+      return Response.json(
+        {
+          type,
+          code,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    logger?.log("SERVER_ERROR");
     return Response.json(
-      {
-        type,
-        code,
-        message
-      },
-      { status: 400 }
+      { type: "SERVER_ERROR", code: "SERVER_ERROR", message: "An unexpected error occurred" },
+      { status: 500 }
     );
-  }
-  return Response.json({ type: "SERVER_ERROR", code: "server_error", message: "An unexpected error occurred" }, { status: 500 });
-};
-var getNormalizedOriginPath = (path) => {
-  try {
-    const url = new URL(path);
-    url.hash = "";
-    url.search = "";
-    return `${url.origin}${url.pathname}`;
-  } catch {
-    return sanitizeURL(path);
-  }
+  };
+};
+var getBaseURL = (request) => {
+  const url = new URL(request.url);
+  return `${url.origin}${url.pathname}`;
 };
 var toISOString = (date) => {
   return new Date(date).toISOString();
@@ -200,14 +189,32 @@ var formatZodError = (error) => {
     };
   }, {});
 };
+var extractPath = (url) => {
+  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
+  const match = url.match(pathRegex);
+  return match && match[2] ? match[2] : "/";
+};
+var createStructuredData = (data, sdID = "metadata") => {
+  const entries = Object.entries(data);
+  if (entries.length === 0) return `[${sdID}]`;
+  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
+  return `[${sdID} ${values}]`;
+};
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
+  }
+  return typeof error === "string" ? error : "UnknownError";
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  createErrorHandler,
+  createStructuredData,
   equals,
+  extractPath,
   formatZodError,
-  getNormalizedOriginPath,
-  isValidRelativePath,
-  onErrorHandler,
-  sanitizeURL,
+  getBaseURL,
+  getErrorName,
   toCastCase,
   toISOString,
   toSnakeCase,

package/dist/utils.d.ts

@@ -1,54 +1,24 @@
 import { RouterConfig } from '@aura-stack/router';
-import { i as APIErrorMap } from './index-DkaLJFn8.js';
 import { ZodError } from 'zod';
+import { I as InternalLogger, j as APIErrorMap } from './index-CSyIJmCM.js';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import './jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import './@types/utility.js';
 
 declare const toSnakeCase: (str: string) => string;
 declare const toUpperCase: (str: string) => string;
 declare const toCastCase: <Obj extends Record<string, string>, Type extends "snake" | "upper">(obj: Obj, type?: Type) => Type extends "snake" ? { [K in keyof Obj as `${string & K}`]: Obj[K]; } : { [K in keyof Obj as Uppercase<string & K>]: Obj[K]; };
 declare const equals: (a: string | number | undefined | null, b: string | number | undefined | null) => boolean;
-/**
- * Sanitizes a URL by removing dangerous patterns that could be used for path traversal
- * or other attacks. This function:
- * - Decodes URL-encoded characters
- * - Removes multiple consecutive slashes (preserving protocol slashes)
- * - Removes path traversal patterns (..)
- * - Removes trailing slashes (except root)
- * - Trims whitespace
- *
- * @param url - The URL or path to sanitize
- * @returns The sanitized URL or path
- */
-declare const sanitizeURL: (url: string) => string;
-/**
- * Validates that a path is a safe relative path to prevent open redirect attacks.
- * A safe relative path must:
- * - Start with '/'
- * - Not contain protocol schemes (://)
- * - Not contain newline characters
- * - Not contain null bytes
- * - Not be an absolute URL
- *
- * @param path - The path to validate
- * @returns true if the path is safe, false otherwise
- */
-declare const isValidRelativePath: (path: string | undefined | null) => boolean;
-declare const onErrorHandler: RouterConfig["onError"];
-/**
- * Extracts and normalizes the origin and pathname from a URL string.
- * Removes query parameters and hash fragments for a clean path.
- * Falls back to the original string if URL parsing fails.
- *
- * @param path - The URL or path string to process
- * @returns The normalized URL with origin and pathname, or the original path
- */
-declare const getNormalizedOriginPath: (path: string) => string;
+declare const createErrorHandler: (logger?: InternalLogger) => RouterConfig["onError"];
+declare const getBaseURL: (request: Request) => string;
 declare const toISOString: (date: Date | string | number) => string;
 declare const useSecureCookies: (request: Request, trustedProxyHeaders: boolean) => boolean;
 declare const formatZodError: <T extends Record<string, unknown> = Record<string, unknown>>(error: ZodError<T>) => APIErrorMap;
+declare const extractPath: (url: string) => string;
+declare const createStructuredData: (data: Record<string, string | number | boolean>, sdID?: string) => string;
+declare const getErrorName: (error: unknown) => string;
 
-export { equals, formatZodError, getNormalizedOriginPath, isValidRelativePath, onErrorHandler, sanitizeURL, toCastCase, toISOString, toSnakeCase, toUpperCase, useSecureCookies };
+export { createErrorHandler, createStructuredData, equals, extractPath, formatZodError, getBaseURL, getErrorName, toCastCase, toISOString, toSnakeCase, toUpperCase, useSecureCookies };

package/dist/utils.js

@@ -1,24 +1,26 @@
 import {
+  createErrorHandler,
+  createStructuredData,
   equals,
+  extractPath,
   formatZodError,
-  getNormalizedOriginPath,
-  isValidRelativePath,
-  onErrorHandler,
-  sanitizeURL,
+  getBaseURL,
+  getErrorName,
   toCastCase,
   toISOString,
   toSnakeCase,
   toUpperCase,
   useSecureCookies
-} from "./chunk-CXLATHS5.js";
+} from "./chunk-QQVSRXGX.js";
 import "./chunk-RRLIF4PQ.js";
 export {
+  createErrorHandler,
+  createStructuredData,
   equals,
+  extractPath,
   formatZodError,
-  getNormalizedOriginPath,
-  isValidRelativePath,
-  onErrorHandler,
-  sanitizeURL,
+  getBaseURL,
+  getErrorName,
   toCastCase,
   toISOString,
   toSnakeCase,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aura-stack/auth",
-  "version": "0.4.0-rc.4",
+  "version": "0.4.0",
   "private": false,
   "type": "module",
   "description": "Core auth for @aura-stack/auth",
@@ -44,10 +44,9 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@aura-stack/router": "0.6.0-rc.1",
-    "dotenv": "^17.2.3",
+    "@aura-stack/router": "^0.5.0",
     "zod": "^4.3.5",
-    "@aura-stack/jose": "0.2.0"
+    "@aura-stack/jose": "0.3.0"
   },
   "devDependencies": {
     "@types/node": "^24.9.2",

package/dist/chunk-42XB3YCW.js

@@ -1,22 +0,0 @@
-// src/oauth/x.ts
-var x = {
-  id: "x",
-  name: "X",
-  authorizeURL: "https://x.com/i/oauth2/authorize",
-  accessToken: "https://api.x.com/2/oauth2/token",
-  userInfo: "https://api.x.com/2/users/me?user.fields=profile_image_url",
-  scope: "users.read users.email tweet.read offline.access",
-  responseType: "code",
-  profile({ data }) {
-    return {
-      sub: data.id,
-      name: data.name,
-      image: data.profile_image_url,
-      email: ""
-    };
-  }
-};
-
-export {
-  x
-};

package/dist/chunk-6R2YZ4AC.js

@@ -1,22 +0,0 @@
-// src/oauth/strava.ts
-var strava = {
-  id: "strava",
-  name: "Strava",
-  authorizeURL: "https://www.strava.com/oauth/authorize",
-  accessToken: "https://www.strava.com/oauth/token",
-  userInfo: "https://www.strava.com/api/v3/athlete",
-  scope: "read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id.toString(),
-      name: `${profile.firstname} ${profile.lastname}`,
-      image: profile.profile,
-      email: ""
-    };
-  }
-};
-
-export {
-  strava
-};

package/dist/chunk-A3N4PVAT.js

@@ -1,70 +0,0 @@
-import {
-  createRedirectTo
-} from "./chunk-N4SX7TZT.js";
-import {
-  expiredCookieAttributes
-} from "./chunk-W6LG7BFW.js";
-import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
-import {
-  verifyCSRF
-} from "./chunk-N2APGLXA.js";
-import {
-  getNormalizedOriginPath
-} from "./chunk-CXLATHS5.js";
-import {
-  AuthSecurityError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/actions/signOut/signOut.ts
-import { z } from "zod";
-import { createEndpoint, createEndpointConfig, HeadersBuilder, statusCode } from "@aura-stack/router";
-var config = createEndpointConfig({
-  schemas: {
-    searchParams: z.object({
-      token_type_hint: z.literal("session_token"),
-      redirectTo: z.string().optional()
-    })
-  }
-});
-var signOutAction = createEndpoint(
-  "POST",
-  "/signOut",
-  async (ctx) => {
-    const {
-      request,
-      headers,
-      searchParams: { redirectTo },
-      context: { jose, cookies }
-    } = ctx;
-    const session = headers.getCookie(cookies.sessionToken.name);
-    const csrfToken = headers.getCookie(cookies.csrfToken.name);
-    const header = headers.getHeader("X-CSRF-Token");
-    if (!session) {
-      throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-    }
-    if (!csrfToken) {
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-    }
-    if (!header) {
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF header is missing.");
-    }
-    await verifyCSRF(jose, csrfToken, header);
-    await jose.decodeJWT(session);
-    const normalizedOriginPath = getNormalizedOriginPath(request.url);
-    const location = createRedirectTo(
-      new Request(normalizedOriginPath, {
-        headers: headers.toHeaders()
-      }),
-      redirectTo
-    );
-    const headersList = new HeadersBuilder(cacheControl).setHeader("Location", location).setCookie(cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ message: "Signed out successfully" }, { status: statusCode.ACCEPTED, headers: headersList });
-  },
-  config
-);
-
-export {
-  signOutAction
-};

package/dist/chunk-B737EUJV.js

@@ -1,22 +0,0 @@
-// src/oauth/mailchimp.ts
-var mailchimp = {
-  id: "mailchimp",
-  name: "Mailchimp",
-  authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
-  accessToken: "https://login.mailchimp.com/oauth2/token",
-  userInfo: "https://login.mailchimp.com/oauth2/metadata",
-  scope: "",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.user_id,
-      name: profile.accountname,
-      email: profile.login.login_email,
-      image: null
-    };
-  }
-};
-
-export {
-  mailchimp
-};

package/dist/chunk-CXLATHS5.js

@@ -1,143 +0,0 @@
-import {
-  isAuthInternalError,
-  isAuthSecurityError,
-  isOAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/utils.ts
-import { isInvalidZodSchemaError, isRouterError } from "@aura-stack/router";
-var toSnakeCase = (str) => {
-  return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
-};
-var toUpperCase = (str) => {
-  return str.toUpperCase();
-};
-var toCastCase = (obj, type = "snake") => {
-  return Object.entries(obj).reduce((previous, [key, value]) => {
-    const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
-    return { ...previous, [newKey]: value };
-  }, {});
-};
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var sanitizeURL = (url) => {
-  try {
-    let decodedURL = decodeURIComponent(url).trim();
-    const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/);
-    let protocol = "";
-    let rest = decodedURL;
-    if (protocolMatch) {
-      protocol = protocolMatch[1];
-      rest = decodedURL.slice(protocol.length);
-      const slashIndex = rest.indexOf("/");
-      if (slashIndex === -1) {
-        return protocol + rest;
-      }
-      const domain = rest.slice(0, slashIndex);
-      let path = rest.slice(slashIndex).replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-      if (path !== "/" && path.endsWith("/")) {
-        path = path.replace(/\/+$/, "/");
-      } else if (path !== "/") {
-        path = path.replace(/\/+$/, "");
-      }
-      return protocol + domain + path;
-    }
-    let sanitized = decodedURL.replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-    if (sanitized !== "/" && sanitized.endsWith("/")) {
-      sanitized = sanitized.replace(/\/+$/, "/");
-    } else if (sanitized !== "/") {
-      sanitized = sanitized.replace(/\/+$/, "");
-    }
-    return sanitized;
-  } catch {
-    return url.trim();
-  }
-};
-var isValidRelativePath = (path) => {
-  if (!path || typeof path !== "string") return false;
-  if (!path.startsWith("/") || path.includes("://") || path.includes("\r") || path.includes("\n")) return false;
-  if (/[\x00-\x1F\x7F]/.test(path) || path.includes("\0")) return false;
-  const sanitized = sanitizeURL(path);
-  if (sanitized.includes("..")) return false;
-  return true;
-};
-var onErrorHandler = (error) => {
-  if (isRouterError(error)) {
-    const { message, status, statusText } = error;
-    return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
-  }
-  if (isInvalidZodSchemaError(error)) {
-    return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
-  }
-  if (isOAuthProtocolError(error)) {
-    const { error: errorCode, message, type, errorURI } = error;
-    return Response.json(
-      {
-        type,
-        error: errorCode,
-        error_description: message,
-        error_uri: errorURI
-      },
-      { status: 400 }
-    );
-  }
-  if (isAuthInternalError(error) || isAuthSecurityError(error)) {
-    const { type, code, message } = error;
-    return Response.json(
-      {
-        type,
-        code,
-        message
-      },
-      { status: 400 }
-    );
-  }
-  return Response.json({ type: "SERVER_ERROR", code: "server_error", message: "An unexpected error occurred" }, { status: 500 });
-};
-var getNormalizedOriginPath = (path) => {
-  try {
-    const url = new URL(path);
-    url.hash = "";
-    url.search = "";
-    return `${url.origin}${url.pathname}`;
-  } catch {
-    return sanitizeURL(path);
-  }
-};
-var toISOString = (date) => {
-  return new Date(date).toISOString();
-};
-var useSecureCookies = (request, trustedProxyHeaders) => {
-  return trustedProxyHeaders ? request.url.startsWith("https://") || request.headers.get("X-Forwarded-Proto") === "https" || (request.headers.get("Forwarded")?.includes("proto=https") ?? false) : request.url.startsWith("https://");
-};
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
-  }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
-      }
-    };
-  }, {});
-};
-
-export {
-  toSnakeCase,
-  toUpperCase,
-  toCastCase,
-  equals,
-  sanitizeURL,
-  isValidRelativePath,
-  onErrorHandler,
-  getNormalizedOriginPath,
-  toISOString,
-  useSecureCookies,
-  formatZodError
-};

package/dist/chunk-E3OXBRYF.js

@@ -1,22 +0,0 @@
-// src/oauth/spotify.ts
-var spotify = {
-  id: "spotify",
-  name: "Spotify",
-  authorizeURL: "https://accounts.spotify.com/authorize",
-  accessToken: "https://accounts.spotify.com/api/token",
-  userInfo: "https://api.spotify.com/v1/me",
-  scope: "user-read-email user-read-private",
-  responseType: "token",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.display_name,
-      email: profile.email,
-      image: profile.images?.[0]?.url
-    };
-  }
-};
-
-export {
-  spotify
-};

package/dist/chunk-EIL2FPSS.js

@@ -1,22 +0,0 @@
-// src/assert.ts
-var isFalsy = (value) => {
-  return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
-};
-var isRequest = (value) => {
-  return typeof Request !== "undefined" && value instanceof Request;
-};
-var isValidURL = (value) => {
-  if (value.includes("\r\n") || value.includes("\n") || value.includes("\r")) return false;
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()*+,;=:@-]*)*\/?$/;
-  return regex.test(value);
-};
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-
-export {
-  isFalsy,
-  isRequest,
-  isValidURL,
-  isJWTPayloadWithToken
-};