@aura-stack/auth 0.4.0-rc.5 → 0.4.0

package/dist/{chunk-IVET23KF.js → chunk-XGLBNXL4.js}

@@ -1,17 +1,17 @@
+import {
+  fetchAsync
+} from "./chunk-ZNCZVF6U.js";
+import {
+  OAuthErrorResponse
+} from "./chunk-KJBAQZX2.js";
 import {
   generateSecure
-} from "./chunk-N2APGLXA.js";
+} from "./chunk-NUDITUKX.js";
 import {
   OAuthProtocolError,
   isNativeError,
   isOAuthProtocolError
 } from "./chunk-RRLIF4PQ.js";
-import {
-  fetchAsync
-} from "./chunk-ZNCZVF6U.js";
-import {
-  OAuthErrorResponse
-} from "./chunk-YRCB5FLE.js";
 
 // src/actions/callback/userinfo.ts
 var getDefaultUserInfo = (profile) => {
@@ -23,9 +23,14 @@ var getDefaultUserInfo = (profile) => {
     image: profile?.image ?? profile?.picture
   };
 };
-var getUserInfo = async (oauthConfig, accessToken) => {
+var getUserInfo = async (oauthConfig, accessToken, logger) => {
   const userinfoEndpoint = oauthConfig.userInfo;
   try {
+    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
+      structuredData: {
+        endpoint: userinfoEndpoint
+      }
+    });
     const response = await fetchAsync(userinfoEndpoint, {
       method: "GET",
       headers: {
@@ -33,23 +38,35 @@ var getUserInfo = async (oauthConfig, accessToken) => {
         Authorization: `Bearer ${accessToken}`
       }
     });
+    if (!response.ok) {
+      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
+      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
+    }
     const json = await response.json();
     const { success, data } = OAuthErrorResponse.safeParse(json);
     if (success) {
-      throw new OAuthProtocolError(
-        data.error,
-        data?.error_description ?? "An error occurred while fetching user information."
-      );
+      logger?.log("OAUTH_USERINFO_ERROR", {
+        message: "Error response received from OAuth userinfo endpoint",
+        structuredData: {
+          error: data.error,
+          error_description: data.error_description ?? ""
+        }
+      });
+      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
     }
+    logger?.log("OAUTH_USERINFO_SUCCESS");
     return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
   } catch (error) {
     if (isOAuthProtocolError(error)) {
       throw error;
     }
+    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
     if (isNativeError(error)) {
-      throw new OAuthProtocolError("invalid_request", error.message, "", { cause: error });
+      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
+        cause: error
+      });
     }
-    throw new OAuthProtocolError("invalid_request", "Failed to fetch user information.", "", { cause: error });
+    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
   }
 };
 

package/dist/chunk-XUP6KKNG.js

@@ -0,0 +1,106 @@
+import {
+  OAuthAuthorization
+} from "./chunk-KJBAQZX2.js";
+import {
+  isRelativeURL,
+  isSameOrigin,
+  isTrustedOrigin,
+  isValidURL,
+  patternToRegex
+} from "./chunk-4EKY7655.js";
+import {
+  equals,
+  extractPath,
+  toCastCase
+} from "./chunk-QQVSRXGX.js";
+import {
+  AuthInternalError
+} from "./chunk-RRLIF4PQ.js";
+
+// src/actions/signIn/authorization.ts
+var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod, logger) => {
+  const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod });
+  if (!parsed.success) {
+    logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        scope: oauthConfig.scope,
+        redirect_uri: redirectURI,
+        has_state: Boolean(state),
+        has_code_challenge: Boolean(codeChallenge),
+        code_challenge_method: codeChallengeMethod
+      }
+    });
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
+  }
+  const { authorizeURL, ...options } = parsed.data;
+  const { userInfo, accessToken, clientSecret, ...required } = options;
+  const searchParams = new URLSearchParams(toCastCase(required));
+  return `${authorizeURL}?${searchParams}`;
+};
+var getTrustedOrigins = async (request, trustedOrigins) => {
+  if (!trustedOrigins) return [];
+  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
+  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
+};
+var getOriginURL = async (request, context) => {
+  const headers = request.headers;
+  let origin = new URL(request.url).origin;
+  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
+  trustedOrigins.push(origin);
+  if (context?.trustedProxyHeaders) {
+    const protocol = headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Proto") ?? "http";
+    const host = headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Host") ?? null;
+    origin = `${protocol}://${host}`;
+  }
+  if (!isTrustedOrigin(origin, trustedOrigins)) {
+    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
+    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
+  }
+  return origin;
+};
+var createRedirectURI = async (request, oauth, context) => {
+  const origin = await getOriginURL(request, context);
+  return `${origin}${context.basePath}/callback/${oauth}`;
+};
+var createRedirectTo = async (request, redirectTo, context) => {
+  try {
+    const headers = request.headers;
+    const requestOrigin = await getOriginURL(request, context);
+    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
+    const validateURL = (url) => {
+      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+      if (isRelativeURL(url)) return url;
+      if (origins.length > 0) {
+        if (isTrustedOrigin(url, origins)) {
+          const urlOrigin = new URL(url).origin;
+          for (const pattern of origins) {
+            const regex = patternToRegex(pattern);
+            if (regex?.test(urlOrigin)) {
+              return isSameOrigin(url, request.url) ? extractPath(url) : url;
+            }
+            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
+          }
+        }
+        context?.logger?.log("OPEN_REDIRECT_ATTACK");
+        return "/";
+      }
+      if (isSameOrigin(url, requestOrigin)) {
+        return extractPath(url);
+      }
+      context?.logger?.log("OPEN_REDIRECT_ATTACK");
+      return "/";
+    };
+    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
+  } catch (error) {
+    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
+    return "/";
+  }
+};
+
+export {
+  createAuthorizationURL,
+  getTrustedOrigins,
+  getOriginURL,
+  createRedirectURI,
+  createRedirectTo
+};

package/dist/cookie.cjs

@@ -82,7 +82,8 @@ var setCookie = (cookieName, value, options) => {
 var expiredCookieAttributes = {
   ...defaultCookieOptions,
   expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0
+  maxAge: 0,
+  secure: true
 };
 var getCookie = (request, cookieName) => {
   const cookies = request.headers.get("Cookie");
@@ -114,31 +115,27 @@ var createSessionCookie = async (jose, session) => {
     throw new AuthInternalError("INVALID_JWT_TOKEN", "Failed to create session cookie", { cause: error });
   }
 };
-var defineSecureCookieOptions = (useSecure, attributes, strategy) => {
+var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
   if (!attributes.httpOnly) {
-    console.warn(
-      "[WARNING]: Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS risk."
-    );
+    logger?.log("COOKIE_HTTPONLY_DISABLED");
   }
   if (attributes.domain === "*") {
     attributes.domain = void 0;
-    console.warn("[WARNING]: Cookie 'Domain' is set to '*', which is insecure. Avoid wildcard domains.");
+    logger?.log("COOKIE_WILDCARD_DOMAIN");
   }
   if (!useSecure) {
     if (attributes.secure) {
-      console.warn(
-        "[WARNING]: The 'Secure' attribute will be disabled for this cookie. Serve over HTTPS to enforce Secure cookies."
-      );
+      logger?.log("COOKIE_SECURE_DISABLED");
     }
     if (attributes.sameSite == "none") {
       attributes.sameSite = "lax";
-      console.warn("[WARNING]: SameSite=None requires Secure attribute. Changing SameSite to 'Lax'.");
+      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
     }
     if (process.env.NODE_ENV === "production") {
-      console.warn("[WARNING]: In production, ensure cookies are served over HTTPS to maintain security.");
+      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
     }
     if (strategy === "host") {
-      console.warn("[WARNING]: __Host- cookies require a secure context. Falling back to standard cookie settings.");
+      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
     }
     return {
       ...defaultCookieOptions,
@@ -152,7 +149,7 @@ var defineSecureCookieOptions = (useSecure, attributes, strategy) => {
     ...defaultHostCookieConfig
   } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
 };
-var createCookieStore = (useSecure, prefix, overrides) => {
+var createCookieStore = (useSecure, prefix, overrides, logger) => {
   prefix ??= COOKIE_NAME;
   const securePrefix = useSecure ? "__Secure-" : "";
   const hostPrefix = useSecure ? "__Host-" : "";
@@ -165,7 +162,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...defaultCookieOptions,
           ...overrides?.sessionToken?.attributes
         },
-        overrides?.sessionToken?.attributes?.strategy ?? "secure"
+        overrides?.sessionToken?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     state: {
@@ -176,7 +174,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.state?.attributes
         },
-        overrides?.state?.attributes?.strategy ?? "secure"
+        overrides?.state?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     csrfToken: {
@@ -185,9 +184,11 @@ var createCookieStore = (useSecure, prefix, overrides) => {
         useSecure,
         {
           ...overrides?.csrfToken?.attributes,
-          ...defaultHostCookieConfig
+          ...defaultHostCookieConfig,
+          sameSite: "strict"
         },
-        overrides?.csrfToken?.attributes?.strategy ?? "host"
+        overrides?.csrfToken?.attributes?.strategy ?? "host",
+        logger
       )
     },
     redirectTo: {
@@ -198,7 +199,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.redirectTo?.attributes
         },
-        overrides?.redirectTo?.attributes?.strategy ?? "secure"
+        overrides?.redirectTo?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     redirectURI: {
@@ -209,7 +211,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.redirectURI?.attributes
         },
-        overrides?.redirectURI?.attributes?.strategy ?? "secure"
+        overrides?.redirectURI?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     codeVerifier: {
@@ -220,7 +223,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.codeVerifier?.attributes
         },
-        overrides?.codeVerifier?.attributes?.strategy ?? "secure"
+        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
+        logger
       )
     }
   };

package/dist/cookie.d.ts

@@ -1,8 +1,9 @@
 import { SerializeOptions } from '@aura-stack/router/cookie';
 import { JWTPayload } from '@aura-stack/jose/jose';
-import { A as AuthRuntimeConfig, C as CookieConfig, a as CookieStoreConfig } from './index-B8jeIElf.js';
+import { A as AuthRuntimeConfig, I as InternalLogger, C as CookieConfig, a as CookieStoreConfig } from './index-CSyIJmCM.js';
 import 'zod';
 import './schemas.js';
+import './jose.js';
 import '@aura-stack/jose';
 import './@types/utility.js';
 
@@ -72,13 +73,13 @@ declare const createSessionCookie: (jose: AuthRuntimeConfig["jose"], session: JW
  * @param strategy The cookie strategy: "host", "secure", or "standard"
  * @returns The finalized cookie options to be used for setting cookies
  */
-declare const defineSecureCookieOptions: (useSecure: boolean, attributes: SerializeOptions, strategy: "host" | "secure" | "standard") => SerializeOptions;
+declare const defineSecureCookieOptions: (useSecure: boolean, attributes: SerializeOptions, strategy: "host" | "secure" | "standard", logger?: InternalLogger) => SerializeOptions;
 /**
  * @param useSecure Whether the request is secure (HTTPS)
  * @param prefix Optional prefix added to all cookie names
  * @param overrides Optional overrides for individual cookie configurations
  * @returns The complete cookie store configuration
  */
-declare const createCookieStore: (useSecure: boolean, prefix?: string, overrides?: CookieConfig["overrides"]) => CookieStoreConfig;
+declare const createCookieStore: (useSecure: boolean, prefix?: string, overrides?: CookieConfig["overrides"], logger?: InternalLogger) => CookieStoreConfig;
 
 export { COOKIE_NAME, createCookieStore, createSessionCookie, defaultCookieOptions, defaultHostCookieConfig, defaultSecureCookieConfig, defaultStandardCookieConfig, defineSecureCookieOptions, expiredCookieAttributes, getCookie, getSetCookie, setCookie };

package/dist/cookie.js

@@ -11,7 +11,7 @@ import {
   getCookie,
   getSetCookie,
   setCookie
-} from "./chunk-W6LG7BFW.js";
+} from "./chunk-5W4BRQYG.js";
 import "./chunk-RRLIF4PQ.js";
 export {
   COOKIE_NAME,

package/dist/env.cjs

@@ -0,0 +1,56 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/env.ts
+var env_exports = {};
+__export(env_exports, {
+  env: () => env
+});
+module.exports = __toCommonJS(env_exports);
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  env
+});

package/dist/env.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A runtime-agnostic environment variable proxy.
+ * Checks multiple sources to ensure compatibility with Node, Bun, Deno, Vite, and Edge platforms.
+ */
+declare const env: Record<string, string | undefined>;
+
+export { env };

package/dist/env.js

@@ -0,0 +1,6 @@
+import {
+  env
+} from "./chunk-4MYWAOLG.js";
+export {
+  env
+};

package/dist/errors.d.ts

@@ -1,10 +1,11 @@
-import { E as ErrorType, b as AuthInternalErrorCode, c as AuthSecurityErrorCode } from './index-B8jeIElf.js';
+import { E as ErrorType, b as AuthInternalErrorCode, c as AuthSecurityErrorCode } from './index-CSyIJmCM.js';
 import { LiteralUnion } from './@types/utility.js';
 import 'zod';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import './jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 
 /**
  * The object returned by the class to users its:
@@ -39,7 +40,7 @@ declare class AuthInternalError extends Error {
 declare class AuthSecurityError extends Error {
     readonly type = "AUTH_SECURITY_ERROR";
     readonly code: string;
-    constructor(code: AuthSecurityErrorCode, message?: string, options?: ErrorOptions);
+    constructor(code: LiteralUnion<AuthSecurityErrorCode>, message?: string, options?: ErrorOptions);
 }
 declare const isNativeError: (error: unknown) => error is Error;
 declare const isOAuthProtocolError: (error: unknown) => error is OAuthProtocolError;

package/dist/headers.cjs

@@ -20,7 +20,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/headers.ts
 var headers_exports = {};
 __export(headers_exports, {
-  cacheControl: () => cacheControl
+  cacheControl: () => cacheControl,
+  contentSecurityPolicy: () => contentSecurityPolicy,
+  secureApiHeaders: () => secureApiHeaders,
+  secureHeaders: () => secureHeaders
 });
 module.exports = __toCommonJS(headers_exports);
 var cacheControl = {
@@ -29,7 +32,30 @@ var cacheControl = {
   Expires: "0",
   Vary: "Cookie"
 };
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  cacheControl
+  cacheControl,
+  contentSecurityPolicy,
+  secureApiHeaders,
+  secureHeaders
 });

package/dist/headers.d.ts

@@ -5,5 +5,29 @@
  * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Vary
  */
 declare const cacheControl: HeadersInit;
+/**
+ * Content Security Policy headers optimized for JSON API endpoints.
+ * Provides protection against XSS, clickjacking, and code injection attacks.
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy
+ */
+declare const contentSecurityPolicy: HeadersInit;
+/**
+ * X-Frame-Options is overridden by the frame-ancestors directive in CSP.
+ * However, it's included here for compatibility with older browsers that do not support CSP.
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
+ * @see https://developer.mozilla.org/es/docs/Web/HTTP/Reference/Headers/Referrer-Policy
+ */
+declare const secureHeaders: {
+    "X-Content-Type-Options": string;
+    "X-Frame-Options": string;
+    "Referrer-Policy": string;
+};
+/**
+ * Combined security headers for JSON API responses.
+ * Includes cache control, CSP, and other security headers.
+ */
+declare const secureApiHeaders: HeadersInit;
 
-export { cacheControl };
+export { cacheControl, contentSecurityPolicy, secureApiHeaders, secureHeaders };

package/dist/headers.js

@@ -1,6 +1,12 @@
 import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
+  cacheControl,
+  contentSecurityPolicy,
+  secureApiHeaders,
+  secureHeaders
+} from "./chunk-EBAMFRB7.js";
 export {
-  cacheControl
+  cacheControl,
+  contentSecurityPolicy,
+  secureApiHeaders,
+  secureHeaders
 };