@aura-stack/auth 0.4.0-rc.4 → 0.4.0

package/dist/chunk-EMKJA2GJ.js

@@ -1,89 +0,0 @@
-import {
-  x
-} from "./chunk-42XB3YCW.js";
-import {
-  figma
-} from "./chunk-FKRDCWBF.js";
-import {
-  github
-} from "./chunk-IKHPGFCW.js";
-import {
-  gitlab
-} from "./chunk-KRNOMBXQ.js";
-import {
-  mailchimp
-} from "./chunk-B737EUJV.js";
-import {
-  pinterest
-} from "./chunk-HP34YGGJ.js";
-import {
-  spotify
-} from "./chunk-E3OXBRYF.js";
-import {
-  strava
-} from "./chunk-6R2YZ4AC.js";
-import {
-  bitbucket
-} from "./chunk-FIPU4MLT.js";
-import {
-  discord
-} from "./chunk-IUYZQTJV.js";
-import {
-  formatZodError
-} from "./chunk-CXLATHS5.js";
-import {
-  AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
-import {
-  OAuthEnvSchema
-} from "./chunk-YRCB5FLE.js";
-
-// src/oauth/index.ts
-var builtInOAuthProviders = {
-  github,
-  bitbucket,
-  figma,
-  discord,
-  gitlab,
-  spotify,
-  x,
-  strava,
-  mailchimp,
-  pinterest
-};
-var defineOAuthEnvironment = (oauth) => {
-  const env = process.env;
-  const clientIdSuffix = `${oauth.toUpperCase()}_CLIENT_ID`;
-  const clientSecretSuffix = `${oauth.toUpperCase()}_CLIENT_SECRET`;
-  const loadEnvs = OAuthEnvSchema.safeParse({
-    clientId: env[`AURA_AUTH_${clientIdSuffix}`] ?? env[`AUTH_${clientIdSuffix}`] ?? env[`${clientIdSuffix}`],
-    clientSecret: env[`AURA_AUTH_${clientSecretSuffix}`] ?? env[`AUTH_${clientSecretSuffix}`] ?? env[`${clientSecretSuffix}`]
-  });
-  if (!loadEnvs.success) {
-    const msg = JSON.stringify(formatZodError(loadEnvs.error), null, 2);
-    throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
-  }
-  return loadEnvs.data;
-};
-var defineOAuthProviderConfig = (config) => {
-  if (typeof config === "string") {
-    const definition = defineOAuthEnvironment(config);
-    const oauthConfig = builtInOAuthProviders[config];
-    return {
-      ...oauthConfig,
-      ...definition
-    };
-  }
-  return config;
-};
-var createBuiltInOAuthProviders = (oauth = []) => {
-  return oauth.reduce((previous, config) => {
-    const oauthConfig = defineOAuthProviderConfig(config);
-    return { ...previous, [oauthConfig.id]: oauthConfig };
-  }, {});
-};
-
-export {
-  builtInOAuthProviders,
-  createBuiltInOAuthProviders
-};

package/dist/chunk-FIPU4MLT.js

@@ -1,21 +0,0 @@
-// src/oauth/bitbucket.ts
-var bitbucket = {
-  id: "bitbucket",
-  name: "Bitbucket",
-  authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-  accessToken: "https://bitbucket.org/site/oauth2/access_token",
-  userInfo: "https://api.bitbucket.org/2.0/user",
-  scope: "account email",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.uuid ?? profile.account_id,
-      name: profile.display_name ?? profile.nickname,
-      image: profile.links.avatar.href
-    };
-  }
-};
-
-export {
-  bitbucket
-};

package/dist/chunk-FKRDCWBF.js

@@ -1,22 +0,0 @@
-// src/oauth/figma.ts
-var figma = {
-  id: "figma",
-  name: "Figma",
-  authorizeURL: "https://www.figma.com/oauth",
-  accessToken: "https://api.figma.com/v1/oauth/token",
-  userInfo: "https://api.figma.com/v1/me",
-  scope: "current_user:read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.handle,
-      email: profile.email,
-      image: profile.img_url
-    };
-  }
-};
-
-export {
-  figma
-};

package/dist/chunk-HP34YGGJ.js

@@ -1,22 +0,0 @@
-// src/oauth/pinterest.ts
-var pinterest = {
-  id: "pinterest",
-  name: "Pinterest",
-  authorizeURL: "https://api.pinterest.com/oauth/",
-  accessToken: "https://api.pinterest.com/v5/oauth/token",
-  userInfo: "https://api.pinterest.com/v5/user_account",
-  scope: "user_accounts:read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.username,
-      email: null,
-      image: profile.profile_image
-    };
-  }
-};
-
-export {
-  pinterest
-};

package/dist/chunk-IKHPGFCW.js

@@ -1,14 +0,0 @@
-// src/oauth/github.ts
-var github = {
-  id: "github",
-  name: "GitHub",
-  authorizeURL: "https://github.com/login/oauth/authorize",
-  accessToken: "https://github.com/login/oauth/access_token",
-  userInfo: "https://api.github.com/user",
-  scope: "read:user user:email",
-  responseType: "code"
-};
-
-export {
-  github
-};

package/dist/chunk-IUYZQTJV.js

@@ -1,30 +0,0 @@
-// src/oauth/discord.ts
-var discord = {
-  id: "discord",
-  name: "Discord",
-  authorizeURL: "https://discord.com/oauth2/authorize",
-  accessToken: "https://discord.com/api/oauth2/token",
-  userInfo: "https://discord.com/api/users/@me",
-  scope: "identify email",
-  responseType: "code",
-  profile(profile) {
-    let image = "";
-    if (profile.avatar === null) {
-      const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-      image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-    } else {
-      const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-      image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-    }
-    return {
-      sub: profile.id,
-      name: profile.global_name ?? profile.username,
-      email: profile.email ?? "",
-      image
-    };
-  }
-};
-
-export {
-  discord
-};

package/dist/chunk-KRNOMBXQ.js

@@ -1,22 +0,0 @@
-// src/oauth/gitlab.ts
-var gitlab = {
-  id: "gitlab",
-  name: "GitLab",
-  authorizeURL: "https://gitlab.com/oauth/authorize",
-  accessToken: "https://gitlab.com/oauth/token",
-  userInfo: "https://gitlab.com/api/v4/user",
-  scope: "read_user",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id.toString(),
-      name: profile.name ?? profile.username,
-      email: profile.email,
-      avatar: profile.avatar_url
-    };
-  }
-};
-
-export {
-  gitlab
-};

package/dist/chunk-KSWLO5ZU.js

@@ -1,102 +0,0 @@
-import {
-  createAccessToken
-} from "./chunk-GA2SMTJO.js";
-import {
-  getUserInfo
-} from "./chunk-IVET23KF.js";
-import {
-  createSessionCookie,
-  expiredCookieAttributes,
-  getCookie
-} from "./chunk-W6LG7BFW.js";
-import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
-import {
-  createCSRF
-} from "./chunk-N2APGLXA.js";
-import {
-  equals,
-  isValidRelativePath,
-  sanitizeURL
-} from "./chunk-CXLATHS5.js";
-import {
-  AuthSecurityError,
-  OAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
-import {
-  OAuthAuthorizationErrorResponse
-} from "./chunk-YRCB5FLE.js";
-
-// src/actions/callback/callback.ts
-import { z } from "zod";
-import { createEndpoint, createEndpointConfig, HeadersBuilder } from "@aura-stack/router";
-var callbackConfig = (oauth) => {
-  return createEndpointConfig("/callback/:oauth", {
-    schemas: {
-      params: z.object({
-        oauth: z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: z.object({
-        code: z.string("Missing code parameter in the OAuth authorization response."),
-        state: z.string("Missing state parameter in the OAuth authorization response.")
-      })
-    },
-    middlewares: [
-      (ctx) => {
-        const response = OAuthAuthorizationErrorResponse.safeParse(ctx.searchParams);
-        if (response.success) {
-          const { error, error_description } = response.data;
-          throw new OAuthProtocolError(error, error_description ?? "OAuth Authorization Error");
-        }
-        return ctx;
-      }
-    ]
-  });
-};
-var callbackAction = (oauth) => {
-  return createEndpoint(
-    "GET",
-    "/callback/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { code, state },
-        context: { oauth: providers, cookies, jose }
-      } = ctx;
-      const oauthConfig = providers[oauth2];
-      const cookieState = getCookie(request, cookies.state.name);
-      const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
-      const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
-      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
-      if (!equals(cookieState, state)) {
-        throw new AuthSecurityError(
-          "MISMATCHING_STATE",
-          "The provided state passed in the OAuth response does not match the stored state."
-        );
-      }
-      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier);
-      const sanitized = sanitizeURL(cookieRedirectTo);
-      if (!isValidRelativePath(sanitized)) {
-        throw new AuthSecurityError(
-          "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-          "Invalid redirect path. Potential open redirect attack detected."
-        );
-      }
-      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token);
-      const sessionCookie = await createSessionCookie(jose, userInfo);
-      const csrfToken = await createCSRF(jose);
-      const headers = new HeadersBuilder(cacheControl).setHeader("Location", sanitized).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
-      return Response.json({ oauth: oauth2 }, { status: 302, headers });
-    },
-    callbackConfig(oauth)
-  );
-};
-
-export {
-  callbackAction
-};

package/dist/chunk-N4SX7TZT.js

@@ -1,96 +0,0 @@
-import {
-  equals,
-  formatZodError,
-  getNormalizedOriginPath,
-  sanitizeURL,
-  toCastCase
-} from "./chunk-CXLATHS5.js";
-import {
-  isValidURL
-} from "./chunk-EIL2FPSS.js";
-import {
-  AuthInternalError,
-  AuthSecurityError,
-  isAuthSecurityError
-} from "./chunk-RRLIF4PQ.js";
-import {
-  OAuthAuthorization
-} from "./chunk-YRCB5FLE.js";
-
-// src/actions/signIn/authorization.ts
-var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod) => {
-  const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod });
-  if (!parsed.success) {
-    const msg = JSON.stringify(formatZodError(parsed.error), null, 2);
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", msg);
-  }
-  const { authorizeURL, ...options } = parsed.data;
-  const { userInfo, accessToken, clientSecret, ...required } = options;
-  const searchParams = new URLSearchParams(toCastCase(required));
-  return `${authorizeURL}?${searchParams}`;
-};
-var getOriginURL = (request, trustedProxyHeaders) => {
-  const headers = request.headers;
-  if (trustedProxyHeaders) {
-    const protocol = headers.get("X-Forwarded-Proto") ?? headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? "http";
-    const host = headers.get("X-Forwarded-Host") ?? headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? null;
-    return new URL(`${protocol}://${host}${getNormalizedOriginPath(new URL(request.url).pathname)}`);
-  } else {
-    return new URL(getNormalizedOriginPath(request.url));
-  }
-};
-var createRedirectURI = (request, oauth, basePath, trustedProxyHeaders) => {
-  const url = getOriginURL(request, trustedProxyHeaders);
-  return `${url.origin}${basePath}/callback/${oauth}`;
-};
-var createRedirectTo = (request, redirectTo, trustedProxyHeaders) => {
-  try {
-    const headers = request.headers;
-    const origin = headers.get("Origin");
-    const referer = headers.get("Referer");
-    let hostedURL = getOriginURL(request, trustedProxyHeaders);
-    if (redirectTo) {
-      if (redirectTo.startsWith("/")) {
-        return sanitizeURL(redirectTo);
-      }
-      const redirectToURL = new URL(sanitizeURL(getNormalizedOriginPath(redirectTo)));
-      if (!isValidURL(redirectTo) || !equals(redirectToURL.origin, hostedURL.origin)) {
-        throw new AuthSecurityError(
-          "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-          "The redirectTo parameter does not match the hosted origin."
-        );
-      }
-      return sanitizeURL(redirectToURL.pathname);
-    }
-    if (referer) {
-      const refererURL = new URL(sanitizeURL(referer));
-      if (!isValidURL(referer) || !equals(refererURL.origin, hostedURL.origin)) {
-        throw new AuthSecurityError(
-          "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-          "The referer of the request does not match the hosted origin."
-        );
-      }
-      return sanitizeURL(refererURL.pathname);
-    }
-    if (origin) {
-      const originURL = new URL(sanitizeURL(getNormalizedOriginPath(origin)));
-      if (!isValidURL(origin) || !equals(originURL.origin, hostedURL.origin)) {
-        throw new AuthSecurityError("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", "Invalid origin (potential CSRF).");
-      }
-      return sanitizeURL(originURL.pathname);
-    }
-    return "/";
-  } catch (error) {
-    if (isAuthSecurityError(error)) {
-      throw error;
-    }
-    throw new AuthSecurityError("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", "Invalid origin (potential CSRF).");
-  }
-};
-
-export {
-  createAuthorizationURL,
-  getOriginURL,
-  createRedirectURI,
-  createRedirectTo
-};

package/dist/chunk-STHEPPUZ.js

@@ -1,11 +0,0 @@
-// src/headers.ts
-var cacheControl = {
-  "Cache-Control": "no-store",
-  Pragma: "no-cache",
-  Expires: "0",
-  Vary: "Cookie"
-};
-
-export {
-  cacheControl
-};