@aura-stack/auth 0.4.0-rc.5 → 0.4.0

package/dist/logger.cjs

@@ -0,0 +1,292 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/logger.ts
+var logger_exports = {};
+__export(logger_exports, {
+  createLogEntry: () => createLogEntry,
+  logMessages: () => logMessages
+});
+module.exports = __toCommonJS(logger_exports);
+var logMessages = {
+  ROUTER_INTERNAL_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "ROUTER_INTERNAL_ERROR",
+    message: "Unhandled router error while processing the request"
+  },
+  INVALID_REQUEST: {
+    facility: 10,
+    severity: "warning",
+    msgId: "INVALID_REQUEST",
+    message: "Request validation failed against the expected schema"
+  },
+  SERVER_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "SERVER_ERROR",
+    message: "Unexpected internal server error during authentication"
+  },
+  OAUTH_PROTOCOL_ERROR: {
+    facility: 10,
+    severity: "warning",
+    msgId: "OAUTH_PROTOCOL_ERROR",
+    message: "OAuth provider returned an invalid or unexpected protocol response"
+  },
+  OAUTH_AUTHORIZATION_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_AUTHORIZATION_ERROR",
+    message: "OAuth authorization request was rejected or failed"
+  },
+  INVALID_OAUTH_CONFIGURATION: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_OAUTH_CONFIGURATION",
+    message: "The OAuth provider configuration is invalid or incomplete"
+  },
+  OAUTH_ACCESS_TOKEN_REQUEST_INITIATED: {
+    facility: 10,
+    severity: "debug",
+    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_INITIATED",
+    message: "Starting OAuth access token request to the provider"
+  },
+  INVALID_OAUTH_ACCESS_TOKEN_RESPONSE: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_OAUTH_ACCESS_TOKEN_RESPONSE",
+    message: "OAuth access token endpoint returned an invalid or malformed response"
+  },
+  OAUTH_ACCESS_TOKEN_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_ACCESS_TOKEN_ERROR",
+    message: "OAuth access token endpoint returned an error response"
+  },
+  OAUTH_ACCESS_TOKEN_SUCCESS: {
+    facility: 10,
+    severity: "info",
+    msgId: "OAUTH_ACCESS_TOKEN_SUCCESS",
+    message: "Successfully retrieved OAuth access token from the provider"
+  },
+  OAUTH_ACCESS_TOKEN_REQUEST_FAILED: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_FAILED",
+    message: "Network or server error while requesting OAuth access token"
+  },
+  OAUTH_USERINFO_REQUEST_INITIATED: {
+    facility: 10,
+    severity: "debug",
+    msgId: "OAUTH_USERINFO_REQUEST_INITIATED",
+    message: "Starting OAuth userinfo request to the provider"
+  },
+  OAUTH_USERINFO_INVALID_RESPONSE: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_INVALID_RESPONSE",
+    message: "OAuth userinfo endpoint returned an invalid or malformed response"
+  },
+  OAUTH_USERINFO_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_ERROR",
+    message: "OAuth userinfo endpoint returned an error response"
+  },
+  OAUTH_USERINFO_SUCCESS: {
+    facility: 10,
+    severity: "info",
+    msgId: "OAUTH_USERINFO_SUCCESS",
+    message: "Successfully retrieved user information from the OAuth provider"
+  },
+  OAUTH_USERINFO_REQUEST_FAILED: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_REQUEST_FAILED",
+    message: "Network or server error while requesting user information from the OAuth provider"
+  },
+  OAUTH_CALLBACK_SUCCESS: {
+    facility: 4,
+    severity: "info",
+    msgId: "OAUTH_CALLBACK_SUCCESS",
+    message: "OAuth callback completed successfully and session was created"
+  },
+  MISMATCHING_STATE: {
+    facility: 4,
+    severity: "critical",
+    msgId: "MISMATCHING_STATE",
+    message: "OAuth response state parameter does not match the stored state value"
+  },
+  POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED: {
+    facility: 4,
+    severity: "critical",
+    msgId: "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
+    message: "Blocked redirect to untrusted or external URL (potential open redirect attack)"
+  },
+  OPEN_REDIRECT_ATTACK: {
+    facility: 4,
+    severity: "warning",
+    msgId: "OPEN_REDIRECT_ATTACK",
+    message: "Detected redirect target that does not match the trusted origin"
+  },
+  SESSION_TOKEN_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "SESSION_TOKEN_MISSING",
+    message: "Session cookie is missing from the request"
+  },
+  CSRF_TOKEN_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "CSRF_TOKEN_MISSING",
+    message: "CSRF token cookie is missing from the request"
+  },
+  CSRF_HEADER_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "CSRF_HEADER_MISSING",
+    message: "CSRF header is missing from the request"
+  },
+  CSRF_TOKEN_INVALID: {
+    facility: 4,
+    severity: "error",
+    msgId: "CSRF_TOKEN_INVALID",
+    message: "CSRF token verification failed or token is invalid"
+  },
+  SIGN_IN_INITIATED: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_IN_INITIATED",
+    message: "Starting OAuth sign-in flow for the selected provider"
+  },
+  SIGN_OUT_ATTEMPT: {
+    facility: 4,
+    severity: "debug",
+    msgId: "SIGN_OUT_ATTEMPT",
+    message: "Received sign-out request from client"
+  },
+  SIGN_OUT_CSRF_VERIFIED: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_OUT_CSRF_VERIFIED",
+    message: "CSRF token was successfully verified during sign-out"
+  },
+  SIGN_OUT_SUCCESS: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_OUT_SUCCESS",
+    message: "User session was cleared and sign-out completed successfully"
+  },
+  SIGN_OUT_REDIRECT: {
+    facility: 4,
+    severity: "debug",
+    msgId: "SIGN_OUT_REDIRECT",
+    message: "Redirecting client after successful sign-out"
+  },
+  AUTH_SESSION_VALID: {
+    facility: 4,
+    severity: "info",
+    msgId: "AUTH_SESSION_VALID",
+    message: "Session token is valid and user session was returned"
+  },
+  AUTH_SESSION_INVALID: {
+    facility: 4,
+    severity: "notice",
+    msgId: "AUTH_SESSION_INVALID",
+    message: "Session token is missing, expired, or invalid"
+  },
+  INVALID_JWT_TOKEN: {
+    facility: 4,
+    severity: "warning",
+    msgId: "INVALID_JWT_TOKEN",
+    message: "JWT session token failed validation during sign-out"
+  },
+  CSRF_TOKEN_REQUESTED: {
+    facility: 4,
+    severity: "debug",
+    msgId: "CSRF_TOKEN_REQUESTED",
+    message: "Client requested a CSRF token"
+  },
+  CSRF_TOKEN_ISSUED: {
+    facility: 4,
+    severity: "debug",
+    msgId: "CSRF_TOKEN_ISSUED",
+    message: "Issued a new CSRF token to the client"
+  },
+  INVALID_URL: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_URL",
+    message: "Derived origin URL is invalid or malformed"
+  },
+  COOKIE_HTTPONLY_DISABLED: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_HTTPONLY_DISABLED",
+    message: "Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure."
+  },
+  COOKIE_WILDCARD_DOMAIN: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_WILDCARD_DOMAIN",
+    message: "Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided."
+  },
+  COOKIE_SECURE_DISABLED: {
+    facility: 10,
+    severity: "warning",
+    msgId: "COOKIE_SECURE_DISABLED",
+    message: "Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser."
+  },
+  COOKIE_SAMESITE_NONE_WITHOUT_SECURE: {
+    facility: 10,
+    severity: "warning",
+    msgId: "COOKIE_SAMESITE_NONE_WITHOUT_SECURE",
+    message: "Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults."
+  },
+  COOKIE_INSECURE_IN_PRODUCTION: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_INSECURE_IN_PRODUCTION",
+    message: "Cookies are being served over an insecure connection in production, which is a serious security risk."
+  },
+  COOKIE_HOST_STRATEGY_INSECURE: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_HOST_STRATEGY_INSECURE",
+    message: "__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings."
+  },
+  UNTRUSTED_ORIGIN: {
+    facility: 10,
+    severity: "error",
+    msgId: "UNTRUSTED_ORIGIN",
+    message: "The constructed origin URL is not trusted."
+  }
+};
+var createLogEntry = (key, overrides) => {
+  const message = logMessages[key];
+  return {
+    ...message,
+    ...overrides
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createLogEntry,
+  logMessages
+});

package/dist/logger.d.ts

@@ -0,0 +1,8 @@
+export { m as createLogEntry, l as logMessages } from './index-CSyIJmCM.js';
+import 'zod';
+import './schemas.js';
+import './jose.js';
+import '@aura-stack/jose';
+import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
+import './@types/utility.js';

package/dist/logger.js

@@ -0,0 +1,8 @@
+import {
+  createLogEntry,
+  logMessages
+} from "./chunk-VNCNJKS2.js";
+export {
+  createLogEntry,
+  logMessages
+};

package/dist/oauth/bitbucket.cjs

@@ -23,21 +23,25 @@ __export(bitbucket_exports, {
   bitbucket: () => bitbucket
 });
 module.exports = __toCommonJS(bitbucket_exports);
-var bitbucket = {
-  id: "bitbucket",
-  name: "Bitbucket",
-  authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-  accessToken: "https://bitbucket.org/site/oauth2/access_token",
-  userInfo: "https://api.bitbucket.org/2.0/user",
-  scope: "account email",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.uuid ?? profile.account_id,
-      name: profile.display_name ?? profile.nickname,
-      image: profile.links.avatar.href
-    };
-  }
+var bitbucket = (options) => {
+  return {
+    id: "bitbucket",
+    name: "Bitbucket",
+    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
+    accessToken: "https://bitbucket.org/site/oauth2/access_token",
+    userInfo: "https://api.bitbucket.org/2.0/user",
+    scope: "account email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.uuid ?? profile.account_id,
+        name: profile.display_name ?? profile.nickname,
+        image: profile.links.avatar?.href,
+        email: void 0
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/bitbucket.d.ts

@@ -1,7 +1,8 @@
-export { B as BitbucketProfile, v as bitbucket } from '../index-B8jeIElf.js';
+export { H as BitbucketProfile, K as bitbucket } from '../index-CSyIJmCM.js';
 import '../@types/utility.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';

package/dist/oauth/bitbucket.js

@@ -1,6 +1,6 @@
 import {
   bitbucket
-} from "../chunk-FIPU4MLT.js";
+} from "../chunk-4YHJ4IEQ.js";
 export {
   bitbucket
 };

package/dist/oauth/discord.cjs

@@ -23,30 +23,33 @@ __export(discord_exports, {
   discord: () => discord
 });
 module.exports = __toCommonJS(discord_exports);
-var discord = {
-  id: "discord",
-  name: "Discord",
-  authorizeURL: "https://discord.com/oauth2/authorize",
-  accessToken: "https://discord.com/api/oauth2/token",
-  userInfo: "https://discord.com/api/users/@me",
-  scope: "identify email",
-  responseType: "code",
-  profile(profile) {
-    let image = "";
-    if (profile.avatar === null) {
-      const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-      image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-    } else {
-      const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-      image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-    }
-    return {
-      sub: profile.id,
-      name: profile.global_name ?? profile.username,
-      email: profile.email ?? "",
-      image
-    };
-  }
+var discord = (options) => {
+  return {
+    id: "discord",
+    name: "Discord",
+    authorizeURL: "https://discord.com/oauth2/authorize",
+    accessToken: "https://discord.com/api/oauth2/token",
+    userInfo: "https://discord.com/api/users/@me",
+    scope: "identify email",
+    responseType: "code",
+    profile(profile) {
+      let image = "";
+      if (profile.avatar === null) {
+        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
+        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
+      } else {
+        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
+        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
+      }
+      return {
+        sub: profile.id,
+        name: profile.global_name ?? profile.username,
+        email: profile.email ?? "",
+        image
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/discord.d.ts

@@ -1,7 +1,8 @@
-export { D as DiscordProfile, N as Nameplate, t as discord } from '../index-B8jeIElf.js';
+export { D as DiscordProfile, N as Nameplate, z as discord } from '../index-CSyIJmCM.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';

package/dist/oauth/discord.js

@@ -1,6 +1,6 @@
 import {
   discord
-} from "../chunk-IUYZQTJV.js";
+} from "../chunk-OVHNRULD.js";
 export {
   discord
 };

package/dist/oauth/figma.cjs

@@ -23,22 +23,25 @@ __export(figma_exports, {
   figma: () => figma
 });
 module.exports = __toCommonJS(figma_exports);
-var figma = {
-  id: "figma",
-  name: "Figma",
-  authorizeURL: "https://www.figma.com/oauth",
-  accessToken: "https://api.figma.com/v1/oauth/token",
-  userInfo: "https://api.figma.com/v1/me",
-  scope: "current_user:read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.handle,
-      email: profile.email,
-      image: profile.img_url
-    };
-  }
+var figma = (options) => {
+  return {
+    id: "figma",
+    name: "Figma",
+    authorizeURL: "https://www.figma.com/oauth",
+    accessToken: "https://api.figma.com/v1/oauth/token",
+    userInfo: "https://api.figma.com/v1/me",
+    scope: "current_user:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.handle,
+        email: profile.email,
+        image: profile.img_url
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/figma.d.ts

@@ -1,7 +1,8 @@
-export { F as FigmaProfile, u as figma } from '../index-B8jeIElf.js';
+export { F as FigmaProfile, B as figma } from '../index-CSyIJmCM.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';

package/dist/oauth/figma.js

@@ -1,6 +1,6 @@
 import {
   figma
-} from "../chunk-FKRDCWBF.js";
+} from "../chunk-KMMAZFSJ.js";
 export {
   figma
 };

package/dist/oauth/github.cjs

@@ -23,14 +23,25 @@ __export(github_exports, {
   github: () => github
 });
 module.exports = __toCommonJS(github_exports);
-var github = {
-  id: "github",
-  name: "GitHub",
-  authorizeURL: "https://github.com/login/oauth/authorize",
-  accessToken: "https://github.com/login/oauth/access_token",
-  userInfo: "https://api.github.com/user",
-  scope: "read:user user:email",
-  responseType: "code"
+var github = (options) => {
+  return {
+    id: "github",
+    name: "GitHub",
+    authorizeURL: "https://github.com/login/oauth/authorize",
+    accessToken: "https://github.com/login/oauth/access_token",
+    userInfo: "https://api.github.com/user",
+    scope: "read:user user:email",
+    responseType: "code",
+    profile: (profile) => {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.login,
+        email: profile.email ?? void 0,
+        image: profile.avatar_url
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/github.d.ts

@@ -1,7 +1,8 @@
-export { w as GitHubProfile, y as github } from '../index-B8jeIElf.js';
+export { Q as GitHubProfile, V as github } from '../index-CSyIJmCM.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';

package/dist/oauth/github.js

@@ -1,6 +1,6 @@
 import {
   github
-} from "../chunk-IKHPGFCW.js";
+} from "../chunk-FW4W3REU.js";
 export {
   github
 };

package/dist/oauth/gitlab.cjs

@@ -23,22 +23,25 @@ __export(gitlab_exports, {
   gitlab: () => gitlab
 });
 module.exports = __toCommonJS(gitlab_exports);
-var gitlab = {
-  id: "gitlab",
-  name: "GitLab",
-  authorizeURL: "https://gitlab.com/oauth/authorize",
-  accessToken: "https://gitlab.com/oauth/token",
-  userInfo: "https://gitlab.com/api/v4/user",
-  scope: "read_user",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id.toString(),
-      name: profile.name ?? profile.username,
-      email: profile.email,
-      avatar: profile.avatar_url
-    };
-  }
+var gitlab = (options) => {
+  return {
+    id: "gitlab",
+    name: "GitLab",
+    authorizeURL: "https://gitlab.com/oauth/authorize",
+    accessToken: "https://gitlab.com/oauth/token",
+    userInfo: "https://gitlab.com/api/v4/user",
+    scope: "read_user",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.username,
+        email: profile.email,
+        image: profile.avatar_url
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/gitlab.d.ts

@@ -1,7 +1,8 @@
-export { G as GitLabProfile, r as gitlab } from '../index-B8jeIElf.js';
+export { G as GitLabProfile, y as gitlab } from '../index-CSyIJmCM.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';

package/dist/oauth/gitlab.js

@@ -1,6 +1,6 @@
 import {
   gitlab
-} from "../chunk-KRNOMBXQ.js";
+} from "../chunk-5LZ7TOM3.js";
 export {
   gitlab
 };