@aura-stack/auth 0.4.0-rc.4 → 0.4.0

package/dist/actions/callback/userinfo.cjs

@@ -71,6 +71,38 @@ var isOAuthProtocolError = (error) => {
   return error instanceof OAuthProtocolError;
 };
 
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+
 // src/secure.ts
 var generateSecure = (length = 32) => {
   return import_crypto.default.randomBytes(length).toString("base64url");
@@ -78,6 +110,18 @@ var generateSecure = (length = 32) => {
 
 // src/schemas.ts
 var import_zod = require("zod");
+var OAuthProviderCredentialsSchema = (0, import_zod.object)({
+  id: (0, import_zod.string)(),
+  name: (0, import_zod.string)(),
+  authorizeURL: (0, import_zod.string)().url(),
+  accessToken: (0, import_zod.string)().url(),
+  scope: (0, import_zod.string)(),
+  userInfo: (0, import_zod.string)().url(),
+  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
+  clientId: (0, import_zod.string)(),
+  clientSecret: (0, import_zod.string)(),
+  profile: import_zod.z.function().optional()
+});
 var OAuthProviderConfigSchema = (0, import_zod.object)({
   authorizeURL: (0, import_zod.string)().url(),
   accessToken: (0, import_zod.string)().url(),
@@ -154,9 +198,14 @@ var getDefaultUserInfo = (profile) => {
     image: profile?.image ?? profile?.picture
   };
 };
-var getUserInfo = async (oauthConfig, accessToken) => {
+var getUserInfo = async (oauthConfig, accessToken, logger) => {
   const userinfoEndpoint = oauthConfig.userInfo;
   try {
+    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
+      structuredData: {
+        endpoint: userinfoEndpoint
+      }
+    });
     const response = await fetchAsync(userinfoEndpoint, {
       method: "GET",
       headers: {
@@ -164,23 +213,35 @@ var getUserInfo = async (oauthConfig, accessToken) => {
         Authorization: `Bearer ${accessToken}`
       }
     });
+    if (!response.ok) {
+      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
+      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
+    }
     const json = await response.json();
     const { success, data } = OAuthErrorResponse.safeParse(json);
     if (success) {
-      throw new OAuthProtocolError(
-        data.error,
-        data?.error_description ?? "An error occurred while fetching user information."
-      );
+      logger?.log("OAUTH_USERINFO_ERROR", {
+        message: "Error response received from OAuth userinfo endpoint",
+        structuredData: {
+          error: data.error,
+          error_description: data.error_description ?? ""
+        }
+      });
+      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
     }
+    logger?.log("OAUTH_USERINFO_SUCCESS");
     return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
   } catch (error) {
     if (isOAuthProtocolError(error)) {
       throw error;
     }
+    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
     if (isNativeError(error)) {
-      throw new OAuthProtocolError("invalid_request", error.message, "", { cause: error });
+      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
+        cause: error
+      });
     }
-    throw new OAuthProtocolError("invalid_request", "Failed to fetch user information.", "", { cause: error });
+    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
   }
 };
 // Annotate the CommonJS export names for ESM import in node:

package/dist/actions/callback/userinfo.d.ts

@@ -1,9 +1,10 @@
-import { h as OAuthProviderCredentials, U as User } from '../../index-DkaLJFn8.js';
+import { h as OAuthProviderCredentials, I as InternalLogger, U as User } from '../../index-CSyIJmCM.js';
 import 'zod';
 import '../../schemas.js';
-import '@aura-stack/router/cookie';
+import '../../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../../@types/utility.js';
 
 /**
@@ -15,6 +16,6 @@ import '../../@types/utility.js';
  * @param accessToken - Access Token to access the userinfo endpoint
  * @returns The user information retrieved from the userinfo endpoint
  */
-declare const getUserInfo: (oauthConfig: OAuthProviderCredentials, accessToken: string) => Promise<User>;
+declare const getUserInfo: (oauthConfig: OAuthProviderCredentials, accessToken: string, logger?: InternalLogger) => Promise<User>;
 
 export { getUserInfo };

package/dist/actions/callback/userinfo.js

@@ -1,12 +1,14 @@
 import {
   getUserInfo
-} from "../../chunk-IVET23KF.js";
-import "../../chunk-N2APGLXA.js";
-import "../../chunk-CXLATHS5.js";
-import "../../chunk-EIL2FPSS.js";
-import "../../chunk-RRLIF4PQ.js";
+} from "../../chunk-XGLBNXL4.js";
 import "../../chunk-ZNCZVF6U.js";
-import "../../chunk-YRCB5FLE.js";
+import "../../chunk-KJBAQZX2.js";
+import "../../chunk-NUDITUKX.js";
+import "../../chunk-4EKY7655.js";
+import "../../chunk-QQVSRXGX.js";
+import "../../chunk-FRJFWTOY.js";
+import "../../chunk-4MYWAOLG.js";
+import "../../chunk-RRLIF4PQ.js";
 export {
   getUserInfo
 };

package/dist/actions/csrfToken/csrfToken.cjs

@@ -53,6 +53,42 @@ var AuthInternalError = class extends Error {
   }
 };
 
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
+};
+
 // src/secure.ts
 var generateSecure = (length = 32) => {
   return import_crypto.default.randomBytes(length).toString("base64url");
@@ -61,7 +97,7 @@ var createCSRF = async (jose, csrfCookie) => {
   try {
     const token = generateSecure(32);
     if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie);
+      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
       return csrfCookie;
     }
     return jose.signJWS({ token });
@@ -78,6 +114,26 @@ var cacheControl = {
   Expires: "0",
   Vary: "Cookie"
 };
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
 
 // src/cookie.ts
 var import_cookie = require("@aura-stack/router/cookie");
@@ -99,7 +155,8 @@ var setCookie = (cookieName, value, options) => {
 var expiredCookieAttributes = {
   ...defaultCookieOptions,
   expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0
+  maxAge: 0,
+  secure: true
 };
 var getCookie = (request, cookieName) => {
   const cookies = request.headers.get("Cookie");
@@ -124,11 +181,13 @@ var getCSRFToken = (request, cookieName) => {
 var csrfTokenAction = (0, import_router2.createEndpoint)("GET", "/csrfToken", async (ctx) => {
   const {
     request,
-    context: { jose, cookies }
+    context: { jose, cookies, logger }
   } = ctx;
   const token = getCSRFToken(request, cookies.csrfToken.name);
+  logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } });
   const csrfToken = await createCSRF(jose, token);
-  const headers = new Headers(cacheControl);
+  logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } });
+  const headers = new Headers(secureApiHeaders);
   headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes));
   return Response.json({ csrfToken }, { headers });
 });

package/dist/actions/csrfToken/csrfToken.d.ts

@@ -1,7 +1,5 @@
 import * as _aura_stack_router from '@aura-stack/router';
 
-declare const csrfTokenAction: _aura_stack_router.RouteEndpoint<"GET", "/csrfToken", {
-    schemas?: _aura_stack_router.EndpointSchemas | undefined;
-}>;
+declare const csrfTokenAction: _aura_stack_router.RouteEndpoint<"GET", "/csrfToken", {}>;
 
 export { csrfTokenAction };

package/dist/actions/csrfToken/csrfToken.js

@@ -1,11 +1,13 @@
 import {
   csrfTokenAction
-} from "../../chunk-HT4YLL7N.js";
-import "../../chunk-W6LG7BFW.js";
-import "../../chunk-STHEPPUZ.js";
-import "../../chunk-N2APGLXA.js";
-import "../../chunk-CXLATHS5.js";
-import "../../chunk-EIL2FPSS.js";
+} from "../../chunk-ICAZ4OVS.js";
+import "../../chunk-NUDITUKX.js";
+import "../../chunk-4EKY7655.js";
+import "../../chunk-QQVSRXGX.js";
+import "../../chunk-5W4BRQYG.js";
+import "../../chunk-EBAMFRB7.js";
+import "../../chunk-FRJFWTOY.js";
+import "../../chunk-4MYWAOLG.js";
 import "../../chunk-RRLIF4PQ.js";
 export {
   csrfTokenAction