@aura-stack/auth 0.4.0-rc.5 → 0.4.0

package/dist/index.d.ts

@@ -1,14 +1,11 @@
-import { d as AuthConfig, e as JoseInstance } from './index-B8jeIElf.js';
-export { f as AuthInstance, C as CookieConfig, E as ErrorType, O as OAuthProvider, g as OAuthProviderConfig, h as OAuthProviderCredentials, S as Session, U as User } from './index-B8jeIElf.js';
-import * as _aura_stack_router from '@aura-stack/router';
-export { createClient } from '@aura-stack/router';
-import * as zod_v4_core from 'zod/v4/core';
-import * as zod from 'zod';
-import './@types/router.d.js';
+import { d as AuthConfig, e as AuthInstance } from './index-CSyIJmCM.js';
+export { C as CookieConfig, E as ErrorType, f as JoseInstance, i as LogLevel, L as Logger, O as OAuthProvider, g as OAuthProviderConfig, h as OAuthProviderCredentials, S as Session, T as TrustedOrigin, U as User } from './index-CSyIJmCM.js';
+import 'zod';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import './jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import './@types/utility.js';
 
 /**
@@ -33,63 +30,6 @@ import './@types/utility.js';
  *   }]
  * })
  */
-declare const createAuth: (authConfig: AuthConfig) => {
-    handlers: _aura_stack_router.Router<[_aura_stack_router.RouteEndpoint<"GET", "/signIn/:oauth", {
-        schemas?: {
-            params: zod.ZodObject<{
-                oauth: zod.ZodEnum<{
-                    [x: string & Record<never, never>]: string & Record<never, never>;
-                    github: "github";
-                    bitbucket: "bitbucket";
-                    figma: "figma";
-                    discord: "discord";
-                    gitlab: "gitlab";
-                    spotify: "spotify";
-                    x: "x";
-                    strava: "strava";
-                    mailchimp: "mailchimp";
-                    pinterest: "pinterest";
-                }>;
-            }, zod_v4_core.$strip>;
-            searchParams: zod.ZodObject<{
-                redirectTo: zod.ZodOptional<zod.ZodString>;
-            }, zod_v4_core.$strip>;
-        } | undefined;
-    }>, _aura_stack_router.RouteEndpoint<"GET", "/callback/:oauth", {
-        schemas?: {
-            params: zod.ZodObject<{
-                oauth: zod.ZodEnum<{
-                    [x: string & Record<never, never>]: string & Record<never, never>;
-                    github: "github";
-                    bitbucket: "bitbucket";
-                    figma: "figma";
-                    discord: "discord";
-                    gitlab: "gitlab";
-                    spotify: "spotify";
-                    x: "x";
-                    strava: "strava";
-                    mailchimp: "mailchimp";
-                    pinterest: "pinterest";
-                }>;
-            }, zod_v4_core.$strip>;
-            searchParams: zod.ZodObject<{
-                code: zod.ZodString;
-                state: zod.ZodString;
-            }, zod_v4_core.$strip>;
-        } | undefined;
-    }>, _aura_stack_router.RouteEndpoint<"GET", "/session", {
-        schemas?: _aura_stack_router.EndpointSchemas | undefined;
-    }>, _aura_stack_router.RouteEndpoint<"POST", "/signOut", {
-        schemas?: {
-            searchParams: zod.ZodObject<{
-                token_type_hint: zod.ZodLiteral<"session_token">;
-                redirectTo: zod.ZodOptional<zod.ZodString>;
-            }, zod_v4_core.$strip>;
-        } | undefined;
-    }>, _aura_stack_router.RouteEndpoint<"GET", "/csrfToken", {
-        schemas?: _aura_stack_router.EndpointSchemas | undefined;
-    }>]>;
-    jose: JoseInstance;
-};
+declare const createAuth: (authConfig: AuthConfig) => AuthInstance;
 
-export { AuthConfig, JoseInstance, createAuth };
+export { AuthConfig, AuthInstance, createAuth };

package/dist/index.js

@@ -1,73 +1,115 @@
 import {
   createBuiltInOAuthProviders
-} from "./chunk-EMKJA2GJ.js";
-import "./chunk-42XB3YCW.js";
-import "./chunk-FKRDCWBF.js";
-import "./chunk-IKHPGFCW.js";
-import "./chunk-KRNOMBXQ.js";
-import "./chunk-B737EUJV.js";
-import "./chunk-HP34YGGJ.js";
-import "./chunk-E3OXBRYF.js";
-import "./chunk-6R2YZ4AC.js";
-import "./chunk-DIVDFNAP.js";
+} from "./chunk-TM5IPSNF.js";
+import "./chunk-IPKO6UQN.js";
+import "./chunk-54CZPKR4.js";
+import "./chunk-EEE7UM5T.js";
+import "./chunk-4YHJ4IEQ.js";
+import "./chunk-OVHNRULD.js";
+import "./chunk-KMMAZFSJ.js";
+import "./chunk-FW4W3REU.js";
+import "./chunk-5LZ7TOM3.js";
+import "./chunk-LDU7A2JE.js";
+import "./chunk-E6G5YCI6.js";
 import "./chunk-ITQ7352M.js";
+import {
+  signInAction
+} from "./chunk-7QF22LHP.js";
+import {
+  csrfTokenAction
+} from "./chunk-ICAZ4OVS.js";
 import {
   signOutAction
-} from "./chunk-A3N4PVAT.js";
+} from "./chunk-ALG3GIV4.js";
 import {
   callbackAction
-} from "./chunk-KSWLO5ZU.js";
-import "./chunk-GA2SMTJO.js";
-import "./chunk-IVET23KF.js";
-import {
-  csrfTokenAction
-} from "./chunk-HT4YLL7N.js";
+} from "./chunk-6MXFPFR3.js";
+import "./chunk-TZB6MUXN.js";
+import "./chunk-XGLBNXL4.js";
 import {
   sessionAction
-} from "./chunk-JVFTCTTE.js";
+} from "./chunk-PHFH2MGS.js";
+import "./chunk-XUP6KKNG.js";
+import "./chunk-ZNCZVF6U.js";
+import "./chunk-KJBAQZX2.js";
+import "./chunk-NUDITUKX.js";
+import "./chunk-4EKY7655.js";
 import {
-  signInAction
-} from "./chunk-3EUWD5BB.js";
-import "./chunk-N4SX7TZT.js";
-import "./chunk-FIPU4MLT.js";
-import "./chunk-IUYZQTJV.js";
+  createErrorHandler,
+  useSecureCookies
+} from "./chunk-QQVSRXGX.js";
 import {
   createCookieStore
-} from "./chunk-W6LG7BFW.js";
-import "./chunk-STHEPPUZ.js";
+} from "./chunk-5W4BRQYG.js";
+import "./chunk-EBAMFRB7.js";
 import {
   createJoseInstance
-} from "./chunk-TLE4PXY3.js";
-import "./chunk-N2APGLXA.js";
-import {
-  onErrorHandler,
-  useSecureCookies
-} from "./chunk-CXLATHS5.js";
-import "./chunk-EIL2FPSS.js";
+} from "./chunk-FRJFWTOY.js";
+import "./chunk-4MYWAOLG.js";
 import "./chunk-RRLIF4PQ.js";
-import "./chunk-ZNCZVF6U.js";
-import "./chunk-YRCB5FLE.js";
+import {
+  createLogEntry
+} from "./chunk-VNCNJKS2.js";
 
 // src/index.ts
-import "dotenv/config";
-import { createRouter, createClient } from "@aura-stack/router";
+import { createRouter } from "@aura-stack/router";
+var logLevelToSeverity = {
+  debug: ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  info: ["info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  warn: ["warning", "error", "critical", "alert", "emergency"],
+  error: ["error", "critical", "alert", "emergency"]
+};
+var createLoggerProxy = (logger) => {
+  if (!logger) return void 0;
+  const level = logger.level;
+  const allowedSeverities = logLevelToSeverity[level] ?? [];
+  const internalLogger = {
+    level,
+    log(key, overrides) {
+      const entry = createLogEntry(key, overrides);
+      if (!allowedSeverities.includes(entry.severity)) return entry;
+      logger.log({
+        timestamp: entry.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+        appName: entry.appName ?? "aura-auth",
+        hostname: entry.hostname ?? "aura-auth",
+        ...entry
+      });
+      return entry;
+    }
+  };
+  return internalLogger;
+};
 var createInternalConfig = (authConfig) => {
   const useSecure = authConfig?.trustedProxyHeaders ?? false;
+  const logger = authConfig?.logger;
+  const internalLogger = createLoggerProxy(logger);
   return {
     basePath: authConfig?.basePath ?? "/auth",
-    onError: onErrorHandler,
+    onError: createErrorHandler(internalLogger),
     context: {
       oauth: createBuiltInOAuthProviders(authConfig?.oauth),
-      cookies: createCookieStore(useSecure, authConfig?.cookies?.prefix, authConfig?.cookies?.overrides ?? {}),
+      cookies: createCookieStore(
+        useSecure,
+        authConfig?.cookies?.prefix,
+        authConfig?.cookies?.overrides ?? {},
+        internalLogger
+      ),
       jose: createJoseInstance(authConfig?.secret),
       secret: authConfig?.secret,
       basePath: authConfig?.basePath ?? "/auth",
-      trustedProxyHeaders: useSecure
+      trustedProxyHeaders: useSecure,
+      trustedOrigins: authConfig?.trustedOrigins,
+      logger: internalLogger
     },
     middlewares: [
       (ctx) => {
         const useSecure2 = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
-        const cookies = createCookieStore(useSecure2, authConfig?.cookies?.prefix, authConfig?.cookies?.overrides ?? {});
+        const cookies = createCookieStore(
+          useSecure2,
+          authConfig?.cookies?.prefix,
+          authConfig?.cookies?.overrides ?? {},
+          internalLogger
+        );
         ctx.context.cookies = cookies;
         return ctx;
       }
@@ -86,6 +128,5 @@ var createAuth = (authConfig) => {
   };
 };
 export {
-  createAuth,
-  createClient
+  createAuth
 };

package/dist/jose.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,30 +15,48 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/jose.ts
 var jose_exports = {};
 __export(jose_exports, {
-  createJoseInstance: () => createJoseInstance
+  createJoseInstance: () => createJoseInstance,
+  decodeJWTOptions: () => decodeJWTOptions,
+  jwtVerificationOptions: () => jwtVerificationOptions
 });
 module.exports = __toCommonJS(jose_exports);
-var import_config = require("dotenv/config");
-var import_jose = require("@aura-stack/jose");
 
-// src/secure.ts
-var import_crypto = __toESM(require("crypto"), 1);
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
 
-// src/utils.ts
-var import_router = require("@aura-stack/router");
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
 
 // src/errors.ts
 var AuthInternalError = class extends Error {
@@ -54,14 +70,8 @@ var AuthInternalError = class extends Error {
   }
 };
 
-// src/secure.ts
-var createDerivedSalt = (secret) => {
-  return import_crypto.default.createHash("sha256").update(secret).update("aura-auth-salt").digest("hex");
-};
-
 // src/jose.ts
 var createJoseInstance = (secret) => {
-  const env = process.env;
   secret ??= env.AURA_AUTH_SECRET ?? env.AUTH_SECRET;
   if (!secret) {
     throw new AuthInternalError(
@@ -69,7 +79,22 @@ var createJoseInstance = (secret) => {
       "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
     );
   }
-  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT ?? createDerivedSalt(secret);
+  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT;
+  if (!salt) {
+    throw new AuthInternalError(
+      "JOSE_INITIALIZATION_FAILED",
+      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
+    );
+  }
+  try {
+    (0, import_jose.createSecret)(salt);
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_SALT_SECRET_VALUE",
+      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
+      { cause: error }
+    );
+  }
   const { derivedKey: derivedSigningKey } = (0, import_jose.createDeriveKey)(secret, salt, "signing");
   const { derivedKey: derivedEncryptionKey } = (0, import_jose.createDeriveKey)(secret, salt, "encryption");
   const { derivedKey: derivedCsrfTokenKey } = (0, import_jose.createDeriveKey)(secret, salt, "csrfToken");
@@ -85,7 +110,19 @@ var createJoseInstance = (secret) => {
     decryptJWE
   };
 };
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
+};
+var decodeJWTOptions = {
+  jws: jwtVerificationOptions,
+  jwt: {
+    typ: "JWT"
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createJoseInstance
+  createJoseInstance,
+  decodeJWTOptions,
+  jwtVerificationOptions
 });

package/dist/jose.d.ts

@@ -1,12 +1,12 @@
 import * as _aura_stack_jose from '@aura-stack/jose';
+import { JWTVerifyOptions, DecodedJWTPayloadOptions } from '@aura-stack/jose';
 import * as _aura_stack_jose_jose from '@aura-stack/jose/jose';
 export { JWTPayload } from '@aura-stack/jose/jose';
 
 /**
  * Creates the JOSE instance used for signing and verifying tokens. It derives keys
- * for session tokens and CSRF tokens. For security and determinism, it uses the
- * `AURA_AUTH_SALT` environment variable if available; otherwise,it uses a derived
- * salt based on the provided secret.
+ * for session tokens and CSRF tokens. For security and determinism, it's required
+ * to set a salt value in `AURA_AUTH_SALT` or `AUTH_SALT` env.
  *
  * @param secret the base secret for key derivation
  * @returns jose instance with methods for encoding/decoding JWTs and signing/verifying JWSs
@@ -15,9 +15,11 @@ declare const createJoseInstance: (secret?: string) => {
     decodeJWT: (token: string) => Promise<_aura_stack_jose_jose.JWTPayload>;
     encodeJWT: (payload: _aura_stack_jose_jose.JWTPayload) => Promise<string>;
     signJWS: (payload: _aura_stack_jose_jose.JWTPayload) => Promise<string>;
-    verifyJWS: (payload: string, options?: _aura_stack_jose.JWTVerifyOptions) => Promise<_aura_stack_jose_jose.JWTPayload>;
+    verifyJWS: (payload: string, options?: JWTVerifyOptions) => Promise<_aura_stack_jose_jose.JWTPayload>;
     encryptJWE: (payload: string, options?: _aura_stack_jose.EncryptOptions) => Promise<string>;
     decryptJWE: (payload: string, options?: _aura_stack_jose.JWTDecryptOptions) => Promise<string>;
 };
+declare const jwtVerificationOptions: JWTVerifyOptions;
+declare const decodeJWTOptions: DecodedJWTPayloadOptions;
 
-export { createJoseInstance };
+export { createJoseInstance, decodeJWTOptions, jwtVerificationOptions };

package/dist/jose.js

@@ -1,10 +1,12 @@
 import {
-  createJoseInstance
-} from "./chunk-TLE4PXY3.js";
-import "./chunk-N2APGLXA.js";
-import "./chunk-CXLATHS5.js";
-import "./chunk-EIL2FPSS.js";
+  createJoseInstance,
+  decodeJWTOptions,
+  jwtVerificationOptions
+} from "./chunk-FRJFWTOY.js";
+import "./chunk-4MYWAOLG.js";
 import "./chunk-RRLIF4PQ.js";
 export {
-  createJoseInstance
+  createJoseInstance,
+  decodeJWTOptions,
+  jwtVerificationOptions
 };