@aura-stack/auth 0.4.0-rc.4 → 0.4.0

package/dist/chunk-6MXFPFR3.js

@@ -0,0 +1,143 @@
+import {
+  createAccessToken
+} from "./chunk-TZB6MUXN.js";
+import {
+  getUserInfo
+} from "./chunk-XGLBNXL4.js";
+import {
+  getOriginURL,
+  getTrustedOrigins
+} from "./chunk-XUP6KKNG.js";
+import {
+  OAuthAuthorizationErrorResponse
+} from "./chunk-KJBAQZX2.js";
+import {
+  createCSRF
+} from "./chunk-NUDITUKX.js";
+import {
+  isRelativeURL,
+  isSameOrigin,
+  isTrustedOrigin,
+  safeEquals
+} from "./chunk-4EKY7655.js";
+import {
+  createSessionCookie,
+  expiredCookieAttributes,
+  getCookie
+} from "./chunk-5W4BRQYG.js";
+import {
+  cacheControl
+} from "./chunk-EBAMFRB7.js";
+import {
+  AuthSecurityError,
+  OAuthProtocolError
+} from "./chunk-RRLIF4PQ.js";
+
+// src/actions/callback/callback.ts
+import { z } from "zod";
+import { createEndpoint, createEndpointConfig, HeadersBuilder } from "@aura-stack/router";
+var callbackConfig = (oauth) => {
+  return createEndpointConfig("/callback/:oauth", {
+    schemas: {
+      params: z.object({
+        oauth: z.enum(
+          Object.keys(oauth),
+          "The OAuth provider is not supported or invalid."
+        )
+      }),
+      searchParams: z.object({
+        code: z.string("Missing code parameter in the OAuth authorization response."),
+        state: z.string("Missing state parameter in the OAuth authorization response.")
+      })
+    },
+    middlewares: [
+      (ctx) => {
+        const {
+          searchParams,
+          context: { logger }
+        } = ctx;
+        const response = OAuthAuthorizationErrorResponse.safeParse(searchParams);
+        if (response.success) {
+          const { error, error_description } = response.data;
+          const criticalAuthErrors = ["access_denied", "server_error"];
+          const severity = criticalAuthErrors.includes(error.toLowerCase()) ? "critical" : "warning";
+          logger?.log("OAUTH_AUTHORIZATION_ERROR", {
+            severity,
+            structuredData: {
+              error,
+              error_description: error_description ?? ""
+            }
+          });
+          throw new OAuthProtocolError(error, error_description || "OAuth Authorization Error");
+        }
+        return ctx;
+      }
+    ]
+  });
+};
+var callbackAction = (oauth) => {
+  return createEndpoint(
+    "GET",
+    "/callback/:oauth",
+    async (ctx) => {
+      const {
+        request,
+        params: { oauth: oauth2 },
+        searchParams: { code, state },
+        context
+      } = ctx;
+      const { oauth: providers, cookies, jose, logger, trustedOrigins } = context;
+      const oauthConfig = providers[oauth2];
+      const cookieState = getCookie(request, cookies.state.name);
+      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
+      const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
+      const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
+      if (!safeEquals(cookieState, state)) {
+        logger?.log("MISMATCHING_STATE", {
+          structuredData: {
+            oauth_provider: oauth2
+          }
+        });
+        throw new AuthSecurityError(
+          "MISMATCHING_STATE",
+          "The provided state passed in the OAuth response does not match the stored state."
+        );
+      }
+      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier, logger);
+      const origins = await getTrustedOrigins(request, trustedOrigins);
+      const requestOrigin = await getOriginURL(request, context);
+      if (!isRelativeURL(cookieRedirectTo)) {
+        const isValid = origins.length > 0 ? isTrustedOrigin(cookieRedirectTo, origins) : isSameOrigin(cookieRedirectTo, requestOrigin);
+        if (!isValid) {
+          logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", {
+            structuredData: {
+              redirect_path: cookieRedirectTo,
+              provider: oauth2,
+              has_trusted_origins: origins.length > 0,
+              request_origin: requestOrigin
+            }
+          });
+          throw new AuthSecurityError(
+            "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
+            "Invalid redirect path. Potential open redirect attack detected."
+          );
+        }
+      }
+      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token, logger);
+      const sessionCookie = await createSessionCookie(jose, userInfo);
+      const csrfToken = await createCSRF(jose);
+      logger?.log("OAUTH_CALLBACK_SUCCESS", {
+        structuredData: {
+          provider: oauth2
+        }
+      });
+      const headers = new HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
+      return Response.json({ oauth: oauth2 }, { status: 302, headers });
+    },
+    callbackConfig(oauth)
+  );
+};
+
+export {
+  callbackAction
+};

package/dist/{chunk-3EUWD5BB.js → chunk-7QF22LHP.js}

@@ -2,14 +2,14 @@ import {
   createAuthorizationURL,
   createRedirectTo,
   createRedirectURI
-} from "./chunk-N4SX7TZT.js";
-import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
+} from "./chunk-XUP6KKNG.js";
 import {
   createPKCE,
   generateSecure
-} from "./chunk-N2APGLXA.js";
+} from "./chunk-NUDITUKX.js";
+import {
+  cacheControl
+} from "./chunk-EBAMFRB7.js";
 
 // src/actions/signIn/signIn.ts
 import { z } from "zod";
@@ -38,13 +38,17 @@ var signInAction = (oauth) => {
         request,
         params: { oauth: oauth2 },
         searchParams: { redirectTo },
-        context: { oauth: providers, cookies, trustedProxyHeaders, basePath }
+        context
       } = ctx;
+      const { oauth: providers, cookies, logger } = context;
       const state = generateSecure();
-      const redirectURI = createRedirectURI(request, oauth2, basePath, trustedProxyHeaders);
-      const redirectToValue = createRedirectTo(request, redirectTo, trustedProxyHeaders);
+      const redirectURI = await createRedirectURI(request, oauth2, context);
+      const redirectToValue = await createRedirectTo(request, redirectTo, context);
       const { codeVerifier, codeChallenge, method } = await createPKCE();
-      const authorization = createAuthorizationURL(providers[oauth2], redirectURI, state, codeChallenge, method);
+      const authorization = createAuthorizationURL(providers[oauth2], redirectURI, state, codeChallenge, method, logger);
+      logger?.log("SIGN_IN_INITIATED", {
+        structuredData: { oauth_provider: oauth2, code_challenge_method: method }
+      });
       const headers = new HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(cookies.state.name, state, cookies.state.attributes).setCookie(cookies.redirectURI.name, redirectURI, cookies.redirectURI.attributes).setCookie(cookies.redirectTo.name, redirectToValue, cookies.redirectTo.attributes).setCookie(cookies.codeVerifier.name, codeVerifier, cookies.codeVerifier.attributes).toHeaders();
       return Response.json(
         { oauth: oauth2 },

package/dist/chunk-ALG3GIV4.js

@@ -0,0 +1,95 @@
+import {
+  createRedirectTo
+} from "./chunk-XUP6KKNG.js";
+import {
+  verifyCSRF
+} from "./chunk-NUDITUKX.js";
+import {
+  getBaseURL,
+  getErrorName
+} from "./chunk-QQVSRXGX.js";
+import {
+  expiredCookieAttributes
+} from "./chunk-5W4BRQYG.js";
+import {
+  secureApiHeaders
+} from "./chunk-EBAMFRB7.js";
+import {
+  AuthSecurityError
+} from "./chunk-RRLIF4PQ.js";
+
+// src/actions/signOut/signOut.ts
+import { z } from "zod";
+import { createEndpoint, createEndpointConfig, HeadersBuilder, statusCode } from "@aura-stack/router";
+var config = createEndpointConfig({
+  schemas: {
+    searchParams: z.object({
+      token_type_hint: z.literal("session_token"),
+      redirectTo: z.string().optional()
+    })
+  }
+});
+var signOutAction = createEndpoint(
+  "POST",
+  "/signOut",
+  async (ctx) => {
+    const {
+      request,
+      headers,
+      searchParams: { redirectTo },
+      context
+    } = ctx;
+    const { jose, cookies, logger } = context;
+    const session = headers.getCookie(cookies.sessionToken.name);
+    const csrfToken = headers.getCookie(cookies.csrfToken.name);
+    const header = headers.getHeader("X-CSRF-Token");
+    logger?.log("SIGN_OUT_ATTEMPT", {
+      structuredData: {
+        has_session: Boolean(session),
+        has_csrf_token: Boolean(csrfToken),
+        has_csrf_header: Boolean(header)
+      }
+    });
+    if (!session) {
+      logger?.log("SESSION_TOKEN_MISSING");
+      throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+    }
+    if (!csrfToken) {
+      logger?.log("CSRF_TOKEN_MISSING");
+      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+    }
+    if (!header) {
+      logger?.log("CSRF_HEADER_MISSING");
+      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
+    }
+    try {
+      await verifyCSRF(jose, csrfToken, header);
+    } catch (error) {
+      logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+    logger?.log("SIGN_OUT_CSRF_VERIFIED");
+    try {
+      await jose.decodeJWT(session);
+      logger?.log("SIGN_OUT_SUCCESS");
+    } catch (error) {
+      logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
+    }
+    const baseURL = getBaseURL(request);
+    const location = await createRedirectTo(
+      new Request(baseURL, {
+        headers: headers.toHeaders()
+      }),
+      redirectTo,
+      context
+    );
+    logger?.log("SIGN_OUT_REDIRECT", { structuredData: { location } });
+    const headersList = new HeadersBuilder(secureApiHeaders).setHeader("Location", location).setCookie(cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+    return Response.json({ message: "Signed out successfully" }, { status: statusCode.ACCEPTED, headers: headersList });
+  },
+  config
+);
+
+export {
+  signOutAction
+};

package/dist/chunk-E6G5YCI6.js

@@ -0,0 +1,25 @@
+// src/oauth/pinterest.ts
+var pinterest = (options) => {
+  return {
+    id: "pinterest",
+    name: "Pinterest",
+    authorizeURL: "https://www.pinterest.com/oauth",
+    accessToken: "https://api.pinterest.com/v5/oauth/token",
+    userInfo: "https://api.pinterest.com/v5/user_account",
+    scope: "user_accounts:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.username,
+        image: profile.profile_image,
+        email: void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  pinterest
+};

package/dist/chunk-EBAMFRB7.js

@@ -0,0 +1,34 @@
+// src/headers.ts
+var cacheControl = {
+  "Cache-Control": "no-store",
+  Pragma: "no-cache",
+  Expires: "0",
+  Vary: "Cookie"
+};
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
+
+export {
+  cacheControl,
+  contentSecurityPolicy,
+  secureHeaders,
+  secureApiHeaders
+};

package/dist/chunk-EEE7UM5T.js

@@ -0,0 +1,25 @@
+// src/oauth/x.ts
+var x = (options) => {
+  return {
+    id: "x",
+    name: "X",
+    authorizeURL: "https://twitter.com/i/oauth2/authorize",
+    accessToken: "https://api.twitter.com/2/oauth2/token",
+    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
+    scope: "tweet.read users.read offline.access",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.data.id,
+        name: profile.data.name,
+        image: profile.data.profile_image_url,
+        email: void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  x
+};

package/dist/{chunk-TLE4PXY3.js → chunk-FRJFWTOY.js}

@@ -1,15 +1,19 @@
 import {
-  createDerivedSalt
-} from "./chunk-N2APGLXA.js";
+  env
+} from "./chunk-4MYWAOLG.js";
 import {
   AuthInternalError
 } from "./chunk-RRLIF4PQ.js";
 
 // src/jose.ts
-import "dotenv/config";
-import { createJWT, createJWS, createJWE, createDeriveKey } from "@aura-stack/jose";
+import {
+  createJWT,
+  createJWS,
+  createJWE,
+  createDeriveKey,
+  createSecret
+} from "@aura-stack/jose";
 var createJoseInstance = (secret) => {
-  const env = process.env;
   secret ??= env.AURA_AUTH_SECRET ?? env.AUTH_SECRET;
   if (!secret) {
     throw new AuthInternalError(
@@ -17,7 +21,22 @@ var createJoseInstance = (secret) => {
       "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
     );
   }
-  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT ?? createDerivedSalt(secret);
+  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT;
+  if (!salt) {
+    throw new AuthInternalError(
+      "JOSE_INITIALIZATION_FAILED",
+      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
+    );
+  }
+  try {
+    createSecret(salt);
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_SALT_SECRET_VALUE",
+      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
+      { cause: error }
+    );
+  }
   const { derivedKey: derivedSigningKey } = createDeriveKey(secret, salt, "signing");
   const { derivedKey: derivedEncryptionKey } = createDeriveKey(secret, salt, "encryption");
   const { derivedKey: derivedCsrfTokenKey } = createDeriveKey(secret, salt, "csrfToken");
@@ -33,7 +52,19 @@ var createJoseInstance = (secret) => {
     decryptJWE
   };
 };
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
+};
+var decodeJWTOptions = {
+  jws: jwtVerificationOptions,
+  jwt: {
+    typ: "JWT"
+  }
+};
 
 export {
-  createJoseInstance
+  createJoseInstance,
+  jwtVerificationOptions,
+  decodeJWTOptions
 };

package/dist/chunk-FW4W3REU.js

@@ -0,0 +1,25 @@
+// src/oauth/github.ts
+var github = (options) => {
+  return {
+    id: "github",
+    name: "GitHub",
+    authorizeURL: "https://github.com/login/oauth/authorize",
+    accessToken: "https://github.com/login/oauth/access_token",
+    userInfo: "https://api.github.com/user",
+    scope: "read:user user:email",
+    responseType: "code",
+    profile: (profile) => {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.login,
+        email: profile.email ?? void 0,
+        image: profile.avatar_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  github
+};

package/dist/{chunk-HT4YLL7N.js → chunk-ICAZ4OVS.js}

@@ -1,13 +1,13 @@
+import {
+  createCSRF
+} from "./chunk-NUDITUKX.js";
 import {
   getCookie,
   setCookie
-} from "./chunk-W6LG7BFW.js";
+} from "./chunk-5W4BRQYG.js";
 import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
-import {
-  createCSRF
-} from "./chunk-N2APGLXA.js";
+  secureApiHeaders
+} from "./chunk-EBAMFRB7.js";
 
 // src/actions/csrfToken/csrfToken.ts
 import { createEndpoint } from "@aura-stack/router";
@@ -21,11 +21,13 @@ var getCSRFToken = (request, cookieName) => {
 var csrfTokenAction = createEndpoint("GET", "/csrfToken", async (ctx) => {
   const {
     request,
-    context: { jose, cookies }
+    context: { jose, cookies, logger }
   } = ctx;
   const token = getCSRFToken(request, cookies.csrfToken.name);
+  logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } });
   const csrfToken = await createCSRF(jose, token);
-  const headers = new Headers(cacheControl);
+  logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } });
+  const headers = new Headers(secureApiHeaders);
   headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes));
   return Response.json({ csrfToken }, { headers });
 });

package/dist/chunk-IPKO6UQN.js

@@ -0,0 +1,25 @@
+// src/oauth/spotify.ts
+var spotify = (options) => {
+  return {
+    id: "spotify",
+    name: "Spotify",
+    authorizeURL: "https://accounts.spotify.com/authorize",
+    accessToken: "https://accounts.spotify.com/api/token",
+    userInfo: "https://api.spotify.com/v1/me",
+    scope: "user-read-private user-read-email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.display_name,
+        email: profile.email,
+        image: profile.images[0]?.url ?? void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  spotify
+};

package/dist/{chunk-YRCB5FLE.js → chunk-KJBAQZX2.js}

@@ -1,5 +1,17 @@
 // src/schemas.ts
 import { object, string, enum as options, number, z, null as nullable } from "zod";
+var OAuthProviderCredentialsSchema = object({
+  id: string(),
+  name: string(),
+  authorizeURL: string().url(),
+  accessToken: string().url(),
+  scope: string(),
+  userInfo: string().url(),
+  responseType: options(["code", "token", "id_token"]),
+  clientId: string(),
+  clientSecret: string(),
+  profile: z.function().optional()
+});
 var OAuthProviderConfigSchema = object({
   authorizeURL: string().url(),
   accessToken: string().url(),
@@ -67,6 +79,7 @@ var OAuthEnvSchema = object({
 });
 
 export {
+  OAuthProviderCredentialsSchema,
   OAuthProviderConfigSchema,
   OAuthAuthorization,
   OAuthAuthorizationResponse,

package/dist/chunk-KMMAZFSJ.js

@@ -0,0 +1,25 @@
+// src/oauth/figma.ts
+var figma = (options) => {
+  return {
+    id: "figma",
+    name: "Figma",
+    authorizeURL: "https://www.figma.com/oauth",
+    accessToken: "https://api.figma.com/v1/oauth/token",
+    userInfo: "https://api.figma.com/v1/me",
+    scope: "current_user:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.handle,
+        email: profile.email,
+        image: profile.img_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  figma
+};

package/dist/chunk-LDU7A2JE.js

@@ -0,0 +1,25 @@
+// src/oauth/mailchimp.ts
+var mailchimp = (options) => {
+  return {
+    id: "mailchimp",
+    name: "Mailchimp",
+    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
+    accessToken: "https://login.mailchimp.com/oauth2/token",
+    userInfo: "https://login.mailchimp.com/oauth2/metadata",
+    scope: "",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.user_id,
+        name: profile.accountname,
+        email: profile.login.email,
+        image: profile.login.avatar
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  mailchimp
+};

package/dist/{chunk-N2APGLXA.js → chunk-NUDITUKX.js}

@@ -1,9 +1,13 @@
+import {
+  isJWTPayloadWithToken,
+  safeEquals
+} from "./chunk-4EKY7655.js";
 import {
   equals
-} from "./chunk-CXLATHS5.js";
+} from "./chunk-QQVSRXGX.js";
 import {
-  isJWTPayloadWithToken
-} from "./chunk-EIL2FPSS.js";
+  jwtVerificationOptions
+} from "./chunk-FRJFWTOY.js";
 import {
   AuthSecurityError
 } from "./chunk-RRLIF4PQ.js";
@@ -17,7 +21,11 @@ var createHash = (data, base = "hex") => {
   return crypto.createHash("sha256").update(data).digest().toString(base);
 };
 var createPKCE = async (verifier) => {
-  const codeVerifier = verifier ?? generateSecure(86);
+  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
+  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
+  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
+    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
+  }
   const codeChallenge = createHash(codeVerifier, "base64url");
   return { codeVerifier, codeChallenge, method: "S256" };
 };
@@ -25,7 +33,7 @@ var createCSRF = async (jose, csrfCookie) => {
   try {
     const token = generateSecure(32);
     if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie);
+      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
       return csrfCookie;
     }
     return jose.signJWS({ token });
@@ -36,20 +44,18 @@ var createCSRF = async (jose, csrfCookie) => {
 };
 var verifyCSRF = async (jose, cookie, header) => {
   try {
-    const cookiePayload = await jose.verifyJWS(cookie);
-    const headerPayload = await jose.verifyJWS(header);
+    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
+    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
     if (!isJWTPayloadWithToken(cookiePayload)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
     }
     if (!isJWTPayloadWithToken(headerPayload)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
     }
-    const cookieBuffer = Buffer.from(cookiePayload.token);
-    const headerBuffer = Buffer.from(headerPayload.token);
-    if (!equals(headerBuffer.length, cookieBuffer.length)) {
+    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
-    if (!crypto.timingSafeEqual(cookieBuffer, headerBuffer)) {
+    if (!safeEquals(cookiePayload.token, headerPayload.token)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
     return true;
@@ -57,15 +63,11 @@ var verifyCSRF = async (jose, cookie, header) => {
     throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
   }
 };
-var createDerivedSalt = (secret) => {
-  return crypto.createHash("sha256").update(secret).update("aura-auth-salt").digest("hex");
-};
 
 export {
   generateSecure,
   createHash,
   createPKCE,
   createCSRF,
-  verifyCSRF,
-  createDerivedSalt
+  verifyCSRF
 };