@aura-stack/auth 0.4.0-rc.5 → 0.4.0

package/dist/actions/callback/callback.cjs

@@ -37,7 +37,7 @@ var import_zod2 = require("zod");
 var import_router2 = require("@aura-stack/router");
 
 // src/secure.ts
-var import_crypto = __toESM(require("crypto"), 1);
+var import_crypto2 = __toESM(require("crypto"), 1);
 
 // src/utils.ts
 var import_router = require("@aura-stack/router");
@@ -87,72 +87,150 @@ var equals = (a, b) => {
   if (a === null || b === null || a === void 0 || b === void 0) return false;
   return a === b;
 };
-var sanitizeURL = (url) => {
+
+// src/assert.ts
+var import_crypto = require("crypto");
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
+var isValidURL = (value) => {
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
+};
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+var isSameOrigin = (origin, expected) => {
+  const originURL = new URL(origin);
+  const expectedURL = new URL(expected);
+  return equals(originURL.origin, expectedURL.origin);
+};
+var patternToRegex = (pattern) => {
   try {
-    let decodedURL = decodeURIComponent(url).trim();
-    const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/);
-    let protocol = "";
-    let rest = decodedURL;
-    if (protocolMatch) {
-      protocol = protocolMatch[1];
-      rest = decodedURL.slice(protocol.length);
-      const slashIndex = rest.indexOf("/");
-      if (slashIndex === -1) {
-        return protocol + rest;
-      }
-      const domain = rest.slice(0, slashIndex);
-      let path = rest.slice(slashIndex).replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-      if (path !== "/" && path.endsWith("/")) {
-        path = path.replace(/\/+$/, "/");
-      } else if (path !== "/") {
-        path = path.replace(/\/+$/, "");
+    if (pattern.length > 2048) return null;
+    pattern = pattern.replace(/\\/g, "");
+    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
+    if (!match) return null;
+    const [, protocol, host, port] = match;
+    const hasWildcard = host.includes("*");
+    if (hasWildcard && !host.startsWith("*.")) return null;
+    if (hasWildcard && host.slice(2).includes("*")) return null;
+    const domain = hasWildcard ? host.slice(2) : host;
+    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
+    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
+    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
+  } catch {
+    return null;
+  }
+};
+var isTrustedOrigin = (url, trustedOrigins) => {
+  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
+  try {
+    const urlOrigin = new URL(url).origin;
+    for (const pattern of trustedOrigins) {
+      const regex = patternToRegex(pattern);
+      if (regex?.test(urlOrigin)) return true;
+      try {
+        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
+      } catch {
       }
-      return protocol + domain + path;
-    }
-    let sanitized = decodedURL.replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-    if (sanitized !== "/" && sanitized.endsWith("/")) {
-      sanitized = sanitized.replace(/\/+$/, "/");
-    } else if (sanitized !== "/") {
-      sanitized = sanitized.replace(/\/+$/, "");
     }
-    return sanitized;
   } catch {
-    return url.trim();
   }
+  return false;
 };
-var isValidRelativePath = (path) => {
-  if (!path || typeof path !== "string") return false;
-  if (!path.startsWith("/") || path.includes("://") || path.includes("\r") || path.includes("\n")) return false;
-  if (/[\x00-\x1F\x7F]/.test(path) || path.includes("\0")) return false;
-  const sanitized = sanitizeURL(path);
-  if (sanitized.includes("..")) return false;
-  return true;
-};
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
+var safeEquals = (a, b) => {
+  const bufferA = Buffer.from(a);
+  const bufferB = Buffer.from(b);
+  if (bufferA.length !== bufferB.length) {
+    return false;
   }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
-      }
+  return (0, import_crypto.timingSafeEqual)(bufferA, bufferB);
+};
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
     };
-  }, {});
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
 };
 
 // src/secure.ts
 var generateSecure = (length = 32) => {
-  return import_crypto.default.randomBytes(length).toString("base64url");
+  return import_crypto2.default.randomBytes(length).toString("base64url");
 };
 var createCSRF = async (jose, csrfCookie) => {
   try {
     const token = generateSecure(32);
     if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie);
+      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
       return csrfCookie;
     }
     return jose.signJWS({ token });
@@ -169,6 +247,26 @@ var cacheControl = {
   Expires: "0",
   Vary: "Cookie"
 };
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
 
 // src/request.ts
 var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
@@ -183,6 +281,18 @@ var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
 
 // src/schemas.ts
 var import_zod = require("zod");
+var OAuthProviderCredentialsSchema = (0, import_zod.object)({
+  id: (0, import_zod.string)(),
+  name: (0, import_zod.string)(),
+  authorizeURL: (0, import_zod.string)().url(),
+  accessToken: (0, import_zod.string)().url(),
+  scope: (0, import_zod.string)(),
+  userInfo: (0, import_zod.string)().url(),
+  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
+  clientId: (0, import_zod.string)(),
+  clientSecret: (0, import_zod.string)(),
+  profile: import_zod.z.function().optional()
+});
 var OAuthProviderConfigSchema = (0, import_zod.object)({
   authorizeURL: (0, import_zod.string)().url(),
   accessToken: (0, import_zod.string)().url(),
@@ -259,9 +369,14 @@ var getDefaultUserInfo = (profile) => {
     image: profile?.image ?? profile?.picture
   };
 };
-var getUserInfo = async (oauthConfig, accessToken) => {
+var getUserInfo = async (oauthConfig, accessToken, logger) => {
   const userinfoEndpoint = oauthConfig.userInfo;
   try {
+    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
+      structuredData: {
+        endpoint: userinfoEndpoint
+      }
+    });
     const response = await fetchAsync(userinfoEndpoint, {
       method: "GET",
       headers: {
@@ -269,35 +384,77 @@ var getUserInfo = async (oauthConfig, accessToken) => {
         Authorization: `Bearer ${accessToken}`
       }
     });
+    if (!response.ok) {
+      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
+      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
+    }
     const json = await response.json();
     const { success, data } = OAuthErrorResponse.safeParse(json);
     if (success) {
-      throw new OAuthProtocolError(
-        data.error,
-        data?.error_description ?? "An error occurred while fetching user information."
-      );
+      logger?.log("OAUTH_USERINFO_ERROR", {
+        message: "Error response received from OAuth userinfo endpoint",
+        structuredData: {
+          error: data.error,
+          error_description: data.error_description ?? ""
+        }
+      });
+      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
     }
+    logger?.log("OAUTH_USERINFO_SUCCESS");
     return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
   } catch (error) {
     if (isOAuthProtocolError(error)) {
       throw error;
     }
+    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
     if (isNativeError(error)) {
-      throw new OAuthProtocolError("invalid_request", error.message, "", { cause: error });
+      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
+        cause: error
+      });
     }
-    throw new OAuthProtocolError("invalid_request", "Failed to fetch user information.", "", { cause: error });
+    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
   }
 };
 
+// src/actions/signIn/authorization.ts
+var getTrustedOrigins = async (request, trustedOrigins) => {
+  if (!trustedOrigins) return [];
+  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
+  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
+};
+var getOriginURL = async (request, context) => {
+  const headers = request.headers;
+  let origin = new URL(request.url).origin;
+  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
+  trustedOrigins.push(origin);
+  if (context?.trustedProxyHeaders) {
+    const protocol = headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Proto") ?? "http";
+    const host = headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Host") ?? null;
+    origin = `${protocol}://${host}`;
+  }
+  if (!isTrustedOrigin(origin, trustedOrigins)) {
+    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
+    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
+  }
+  return origin;
+};
+
 // src/actions/callback/access-token.ts
-var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier) => {
+var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
   const parsed = OAuthAccessToken.safeParse({ ...oauthConfig, redirectURI, code, codeVerifier });
   if (!parsed.success) {
-    const msg = JSON.stringify(formatZodError(parsed.error), null, 2);
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", msg);
+    logger?.log("INVALID_OAUTH_CONFIGURATION");
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
   }
   const { accessToken, clientId, clientSecret, code: codeParsed, redirectURI: redirectParsed } = parsed.data;
   try {
+    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
+      structuredData: {
+        has_client_id: Boolean(clientId),
+        redirect_uri: redirectParsed,
+        grant_type: "authorization_code"
+      }
+    });
     const response = await fetchAsync(accessToken, {
       method: "POST",
       headers: {
@@ -313,17 +470,33 @@ var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier) =>
         code_verifier: codeVerifier
       }).toString()
     });
+    if (!response.ok) {
+      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
+      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
+    }
     const json = await response.json();
     const token = OAuthAccessTokenResponse.safeParse(json);
     if (!token.success) {
       const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
       if (!success) {
-        throw new OAuthProtocolError("INVALID_REQUEST", "Invalid access token response format");
+        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
+        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
       }
-      throw new OAuthProtocolError(data.error, data?.error_description ?? "Failed to retrieve access token");
+      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
+        structuredData: {
+          error: data.error,
+          error_description: data.error_description ?? ""
+        }
+      });
+      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
     }
+    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
     return token.data;
   } catch (error) {
+    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
+    if (error instanceof Error) {
+      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
+    }
     throw error;
   }
 };
@@ -345,7 +518,8 @@ var oauthCookieOptions = {
 var expiredCookieAttributes = {
   ...defaultCookieOptions,
   expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0
+  maxAge: 0,
+  secure: true
 };
 var getCookie = (request, cookieName) => {
   const cookies = request.headers.get("Cookie");
@@ -384,10 +558,23 @@ var callbackConfig = (oauth) => {
     },
     middlewares: [
       (ctx) => {
-        const response = OAuthAuthorizationErrorResponse.safeParse(ctx.searchParams);
+        const {
+          searchParams,
+          context: { logger }
+        } = ctx;
+        const response = OAuthAuthorizationErrorResponse.safeParse(searchParams);
         if (response.success) {
           const { error, error_description } = response.data;
-          throw new OAuthProtocolError(error, error_description ?? "OAuth Authorization Error");
+          const criticalAuthErrors = ["access_denied", "server_error"];
+          const severity = criticalAuthErrors.includes(error.toLowerCase()) ? "critical" : "warning";
+          logger?.log("OAUTH_AUTHORIZATION_ERROR", {
+            severity,
+            structuredData: {
+              error,
+              error_description: error_description ?? ""
+            }
+          });
+          throw new OAuthProtocolError(error, error_description || "OAuth Authorization Error");
         }
         return ctx;
       }
@@ -403,31 +590,54 @@ var callbackAction = (oauth) => {
         request,
         params: { oauth: oauth2 },
         searchParams: { code, state },
-        context: { oauth: providers, cookies, jose }
+        context
       } = ctx;
+      const { oauth: providers, cookies, jose, logger, trustedOrigins } = context;
       const oauthConfig = providers[oauth2];
       const cookieState = getCookie(request, cookies.state.name);
+      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
       const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
       const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
-      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
-      if (!equals(cookieState, state)) {
+      if (!safeEquals(cookieState, state)) {
+        logger?.log("MISMATCHING_STATE", {
+          structuredData: {
+            oauth_provider: oauth2
+          }
+        });
         throw new AuthSecurityError(
           "MISMATCHING_STATE",
           "The provided state passed in the OAuth response does not match the stored state."
         );
       }
-      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier);
-      const sanitized = sanitizeURL(cookieRedirectTo);
-      if (!isValidRelativePath(sanitized)) {
-        throw new AuthSecurityError(
-          "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-          "Invalid redirect path. Potential open redirect attack detected."
-        );
+      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier, logger);
+      const origins = await getTrustedOrigins(request, trustedOrigins);
+      const requestOrigin = await getOriginURL(request, context);
+      if (!isRelativeURL(cookieRedirectTo)) {
+        const isValid = origins.length > 0 ? isTrustedOrigin(cookieRedirectTo, origins) : isSameOrigin(cookieRedirectTo, requestOrigin);
+        if (!isValid) {
+          logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", {
+            structuredData: {
+              redirect_path: cookieRedirectTo,
+              provider: oauth2,
+              has_trusted_origins: origins.length > 0,
+              request_origin: requestOrigin
+            }
+          });
+          throw new AuthSecurityError(
+            "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
+            "Invalid redirect path. Potential open redirect attack detected."
+          );
+        }
       }
-      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token);
+      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token, logger);
       const sessionCookie = await createSessionCookie(jose, userInfo);
       const csrfToken = await createCSRF(jose);
-      const headers = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", sanitized).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
+      logger?.log("OAUTH_CALLBACK_SUCCESS", {
+        structuredData: {
+          provider: oauth2
+        }
+      });
+      const headers = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
       return Response.json({ oauth: oauth2 }, { status: 302, headers });
     },
     callbackConfig(oauth)

package/dist/actions/callback/callback.d.ts

@@ -1,34 +1,13 @@
 import * as _aura_stack_router from '@aura-stack/router';
-import { z } from 'zod';
-import { j as OAuthProviderRecord } from '../../index-B8jeIElf.js';
+import { k as OAuthProviderRecord } from '../../index-CSyIJmCM.js';
+import 'zod';
 import '../../schemas.js';
-import '@aura-stack/router/cookie';
+import '../../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../../@types/utility.js';
 
-declare const callbackAction: (oauth: OAuthProviderRecord) => _aura_stack_router.RouteEndpoint<"GET", "/callback/:oauth", {
-    schemas?: {
-        params: z.ZodObject<{
-            oauth: z.ZodEnum<{
-                [x: string & Record<never, never>]: string & Record<never, never>;
-                github: "github";
-                bitbucket: "bitbucket";
-                figma: "figma";
-                discord: "discord";
-                gitlab: "gitlab";
-                spotify: "spotify";
-                x: "x";
-                strava: "strava";
-                mailchimp: "mailchimp";
-                pinterest: "pinterest";
-            }>;
-        }, z.core.$strip>;
-        searchParams: z.ZodObject<{
-            code: z.ZodString;
-            state: z.ZodString;
-        }, z.core.$strip>;
-    } | undefined;
-}>;
+declare const callbackAction: (oauth: OAuthProviderRecord) => _aura_stack_router.RouteEndpoint<"GET", "/callback/:oauth", {}>;
 
 export { callbackAction };

package/dist/actions/callback/callback.js

@@ -1,16 +1,19 @@
 import {
   callbackAction
-} from "../../chunk-KSWLO5ZU.js";
-import "../../chunk-GA2SMTJO.js";
-import "../../chunk-IVET23KF.js";
-import "../../chunk-W6LG7BFW.js";
-import "../../chunk-STHEPPUZ.js";
-import "../../chunk-N2APGLXA.js";
-import "../../chunk-CXLATHS5.js";
-import "../../chunk-EIL2FPSS.js";
-import "../../chunk-RRLIF4PQ.js";
+} from "../../chunk-6MXFPFR3.js";
+import "../../chunk-TZB6MUXN.js";
+import "../../chunk-XGLBNXL4.js";
+import "../../chunk-XUP6KKNG.js";
 import "../../chunk-ZNCZVF6U.js";
-import "../../chunk-YRCB5FLE.js";
+import "../../chunk-KJBAQZX2.js";
+import "../../chunk-NUDITUKX.js";
+import "../../chunk-4EKY7655.js";
+import "../../chunk-QQVSRXGX.js";
+import "../../chunk-5W4BRQYG.js";
+import "../../chunk-EBAMFRB7.js";
+import "../../chunk-FRJFWTOY.js";
+import "../../chunk-4MYWAOLG.js";
+import "../../chunk-RRLIF4PQ.js";
 export {
   callbackAction
 };