@aura-stack/auth 0.4.0-rc.5 → 0.4.0

package/dist/assert.cjs

@@ -22,28 +22,140 @@ var assert_exports = {};
 __export(assert_exports, {
   isFalsy: () => isFalsy,
   isJWTPayloadWithToken: () => isJWTPayloadWithToken,
+  isRelativeURL: () => isRelativeURL,
   isRequest: () => isRequest,
-  isValidURL: () => isValidURL
+  isSameOrigin: () => isSameOrigin,
+  isTrustedOrigin: () => isTrustedOrigin,
+  isValidURL: () => isValidURL,
+  patternToRegex: () => patternToRegex,
+  safeEquals: () => safeEquals,
+  unsafeChars: () => unsafeChars
 });
 module.exports = __toCommonJS(assert_exports);
+
+// src/utils.ts
+var import_router = require("@aura-stack/router");
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+
+// src/assert.ts
+var import_crypto = require("crypto");
 var isFalsy = (value) => {
   return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
 };
 var isRequest = (value) => {
   return typeof Request !== "undefined" && value instanceof Request;
 };
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
 var isValidURL = (value) => {
-  if (value.includes("\r\n") || value.includes("\n") || value.includes("\r")) return false;
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()*+,;=:@-]*)*\/?$/;
-  return regex.test(value);
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
 };
 var isJWTPayloadWithToken = (payload) => {
   return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
 };
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+var isSameOrigin = (origin, expected) => {
+  const originURL = new URL(origin);
+  const expectedURL = new URL(expected);
+  return equals(originURL.origin, expectedURL.origin);
+};
+var patternToRegex = (pattern) => {
+  try {
+    if (pattern.length > 2048) return null;
+    pattern = pattern.replace(/\\/g, "");
+    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
+    if (!match) return null;
+    const [, protocol, host, port] = match;
+    const hasWildcard = host.includes("*");
+    if (hasWildcard && !host.startsWith("*.")) return null;
+    if (hasWildcard && host.slice(2).includes("*")) return null;
+    const domain = hasWildcard ? host.slice(2) : host;
+    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
+    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
+    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
+  } catch {
+    return null;
+  }
+};
+var isTrustedOrigin = (url, trustedOrigins) => {
+  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
+  try {
+    const urlOrigin = new URL(url).origin;
+    for (const pattern of trustedOrigins) {
+      const regex = patternToRegex(pattern);
+      if (regex?.test(urlOrigin)) return true;
+      try {
+        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return false;
+};
+var safeEquals = (a, b) => {
+  const bufferA = Buffer.from(a);
+  const bufferB = Buffer.from(b);
+  if (bufferA.length !== bufferB.length) {
+    return false;
+  }
+  return (0, import_crypto.timingSafeEqual)(bufferA, bufferB);
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   isFalsy,
   isJWTPayloadWithToken,
+  isRelativeURL,
   isRequest,
-  isValidURL
+  isSameOrigin,
+  isTrustedOrigin,
+  isValidURL,
+  patternToRegex,
+  safeEquals,
+  unsafeChars
 });

package/dist/assert.d.ts

@@ -1,14 +1,33 @@
-import { J as JWTPayloadWithToken } from './index-B8jeIElf.js';
+import { J as JWTPayloadWithToken } from './index-CSyIJmCM.js';
 import 'zod';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import './jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import './@types/utility.js';
 
 declare const isFalsy: (value: unknown) => boolean;
 declare const isRequest: (value: unknown) => value is Request;
+declare const unsafeChars: string[];
 declare const isValidURL: (value: string) => boolean;
 declare const isJWTPayloadWithToken: (payload: unknown) => payload is JWTPayloadWithToken;
+declare const isRelativeURL: (value: string) => boolean;
+declare const isSameOrigin: (origin: string, expected: string) => boolean;
+/**
+ * Converts a trusted origin pattern to a regex for matching.
+ * Supports `*` as subdomain wildcard: `https://*.example.com` matches `https://app.example.com`
+ * @todo: add support to Custom URI Schemes (e.g. `myapp://*`).
+ */
+declare const patternToRegex: (pattern: string) => RegExp | null;
+/**
+ * Checks if a URL matches any of the trusted origin patterns.
+ * A URL is trusted if its origin matches any pattern (exact or wildcard).
+ *
+ * @param url - The URL to validate (e.g. from Referer, Origin, redirectTo)
+ * @param trustedOrigins - Array of exact URLs or patterns (e.g. `https://*.example.com`)
+ */
+declare const isTrustedOrigin: (url: string, trustedOrigins: string[]) => boolean;
+declare const safeEquals: (a: string, b: string) => boolean;
 
-export { isFalsy, isJWTPayloadWithToken, isRequest, isValidURL };
+export { isFalsy, isJWTPayloadWithToken, isRelativeURL, isRequest, isSameOrigin, isTrustedOrigin, isValidURL, patternToRegex, safeEquals, unsafeChars };

package/dist/assert.js

@@ -1,12 +1,26 @@
 import {
   isFalsy,
   isJWTPayloadWithToken,
+  isRelativeURL,
   isRequest,
-  isValidURL
-} from "./chunk-EIL2FPSS.js";
+  isSameOrigin,
+  isTrustedOrigin,
+  isValidURL,
+  patternToRegex,
+  safeEquals,
+  unsafeChars
+} from "./chunk-4EKY7655.js";
+import "./chunk-QQVSRXGX.js";
+import "./chunk-RRLIF4PQ.js";
 export {
   isFalsy,
   isJWTPayloadWithToken,
+  isRelativeURL,
   isRequest,
-  isValidURL
+  isSameOrigin,
+  isTrustedOrigin,
+  isValidURL,
+  patternToRegex,
+  safeEquals,
+  unsafeChars
 };

package/dist/chunk-4EKY7655.js

@@ -0,0 +1,123 @@
+import {
+  equals
+} from "./chunk-QQVSRXGX.js";
+
+// src/assert.ts
+import { timingSafeEqual } from "crypto";
+var isFalsy = (value) => {
+  return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
+};
+var isRequest = (value) => {
+  return typeof Request !== "undefined" && value instanceof Request;
+};
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
+var isValidURL = (value) => {
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
+};
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+};
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+var isSameOrigin = (origin, expected) => {
+  const originURL = new URL(origin);
+  const expectedURL = new URL(expected);
+  return equals(originURL.origin, expectedURL.origin);
+};
+var patternToRegex = (pattern) => {
+  try {
+    if (pattern.length > 2048) return null;
+    pattern = pattern.replace(/\\/g, "");
+    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
+    if (!match) return null;
+    const [, protocol, host, port] = match;
+    const hasWildcard = host.includes("*");
+    if (hasWildcard && !host.startsWith("*.")) return null;
+    if (hasWildcard && host.slice(2).includes("*")) return null;
+    const domain = hasWildcard ? host.slice(2) : host;
+    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
+    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
+    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
+  } catch {
+    return null;
+  }
+};
+var isTrustedOrigin = (url, trustedOrigins) => {
+  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
+  try {
+    const urlOrigin = new URL(url).origin;
+    for (const pattern of trustedOrigins) {
+      const regex = patternToRegex(pattern);
+      if (regex?.test(urlOrigin)) return true;
+      try {
+        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return false;
+};
+var safeEquals = (a, b) => {
+  const bufferA = Buffer.from(a);
+  const bufferB = Buffer.from(b);
+  if (bufferA.length !== bufferB.length) {
+    return false;
+  }
+  return timingSafeEqual(bufferA, bufferB);
+};
+
+export {
+  isFalsy,
+  isRequest,
+  unsafeChars,
+  isValidURL,
+  isJWTPayloadWithToken,
+  isRelativeURL,
+  isSameOrigin,
+  patternToRegex,
+  isTrustedOrigin,
+  safeEquals
+};

package/dist/chunk-4MYWAOLG.js

@@ -0,0 +1,31 @@
+// src/env.ts
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import.meta !== "undefined" && hasProperty(import.meta.env)) {
+        return import.meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+export {
+  env
+};

package/dist/chunk-4YHJ4IEQ.js

@@ -0,0 +1,25 @@
+// src/oauth/bitbucket.ts
+var bitbucket = (options) => {
+  return {
+    id: "bitbucket",
+    name: "Bitbucket",
+    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
+    accessToken: "https://bitbucket.org/site/oauth2/access_token",
+    userInfo: "https://api.bitbucket.org/2.0/user",
+    scope: "account email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.uuid ?? profile.account_id,
+        name: profile.display_name ?? profile.nickname,
+        image: profile.links.avatar?.href,
+        email: void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  bitbucket
+};

package/dist/chunk-54CZPKR4.js

@@ -0,0 +1,25 @@
+// src/oauth/strava.ts
+var strava = (options) => {
+  return {
+    id: "strava",
+    name: "Strava",
+    authorizeURL: "https://www.strava.com/oauth/authorize",
+    accessToken: "https://www.strava.com/oauth/token",
+    userInfo: "https://www.strava.com/api/v3/athlete",
+    scope: "read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: `${profile.firstname} ${profile.lastname}`,
+        image: profile.profile,
+        email: void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  strava
+};

package/dist/chunk-5LZ7TOM3.js

@@ -0,0 +1,25 @@
+// src/oauth/gitlab.ts
+var gitlab = (options) => {
+  return {
+    id: "gitlab",
+    name: "GitLab",
+    authorizeURL: "https://gitlab.com/oauth/authorize",
+    accessToken: "https://gitlab.com/oauth/token",
+    userInfo: "https://gitlab.com/api/v4/user",
+    scope: "read_user",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.username,
+        email: profile.email,
+        image: profile.avatar_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  gitlab
+};

package/dist/{chunk-W6LG7BFW.js → chunk-5W4BRQYG.js}

@@ -37,7 +37,8 @@ var setCookie = (cookieName, value, options) => {
 var expiredCookieAttributes = {
   ...defaultCookieOptions,
   expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0
+  maxAge: 0,
+  secure: true
 };
 var getCookie = (request, cookieName) => {
   const cookies = request.headers.get("Cookie");
@@ -69,31 +70,27 @@ var createSessionCookie = async (jose, session) => {
     throw new AuthInternalError("INVALID_JWT_TOKEN", "Failed to create session cookie", { cause: error });
   }
 };
-var defineSecureCookieOptions = (useSecure, attributes, strategy) => {
+var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
   if (!attributes.httpOnly) {
-    console.warn(
-      "[WARNING]: Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS risk."
-    );
+    logger?.log("COOKIE_HTTPONLY_DISABLED");
   }
   if (attributes.domain === "*") {
     attributes.domain = void 0;
-    console.warn("[WARNING]: Cookie 'Domain' is set to '*', which is insecure. Avoid wildcard domains.");
+    logger?.log("COOKIE_WILDCARD_DOMAIN");
   }
   if (!useSecure) {
     if (attributes.secure) {
-      console.warn(
-        "[WARNING]: The 'Secure' attribute will be disabled for this cookie. Serve over HTTPS to enforce Secure cookies."
-      );
+      logger?.log("COOKIE_SECURE_DISABLED");
     }
     if (attributes.sameSite == "none") {
       attributes.sameSite = "lax";
-      console.warn("[WARNING]: SameSite=None requires Secure attribute. Changing SameSite to 'Lax'.");
+      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
     }
     if (process.env.NODE_ENV === "production") {
-      console.warn("[WARNING]: In production, ensure cookies are served over HTTPS to maintain security.");
+      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
     }
     if (strategy === "host") {
-      console.warn("[WARNING]: __Host- cookies require a secure context. Falling back to standard cookie settings.");
+      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
     }
     return {
       ...defaultCookieOptions,
@@ -107,7 +104,7 @@ var defineSecureCookieOptions = (useSecure, attributes, strategy) => {
     ...defaultHostCookieConfig
   } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
 };
-var createCookieStore = (useSecure, prefix, overrides) => {
+var createCookieStore = (useSecure, prefix, overrides, logger) => {
   prefix ??= COOKIE_NAME;
   const securePrefix = useSecure ? "__Secure-" : "";
   const hostPrefix = useSecure ? "__Host-" : "";
@@ -120,7 +117,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...defaultCookieOptions,
           ...overrides?.sessionToken?.attributes
         },
-        overrides?.sessionToken?.attributes?.strategy ?? "secure"
+        overrides?.sessionToken?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     state: {
@@ -131,7 +129,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.state?.attributes
         },
-        overrides?.state?.attributes?.strategy ?? "secure"
+        overrides?.state?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     csrfToken: {
@@ -140,9 +139,11 @@ var createCookieStore = (useSecure, prefix, overrides) => {
         useSecure,
         {
           ...overrides?.csrfToken?.attributes,
-          ...defaultHostCookieConfig
+          ...defaultHostCookieConfig,
+          sameSite: "strict"
         },
-        overrides?.csrfToken?.attributes?.strategy ?? "host"
+        overrides?.csrfToken?.attributes?.strategy ?? "host",
+        logger
       )
     },
     redirectTo: {
@@ -153,7 +154,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.redirectTo?.attributes
         },
-        overrides?.redirectTo?.attributes?.strategy ?? "secure"
+        overrides?.redirectTo?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     redirectURI: {
@@ -164,7 +166,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.redirectURI?.attributes
         },
-        overrides?.redirectURI?.attributes?.strategy ?? "secure"
+        overrides?.redirectURI?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     codeVerifier: {
@@ -175,7 +178,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.codeVerifier?.attributes
         },
-        overrides?.codeVerifier?.attributes?.strategy ?? "secure"
+        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
+        logger
       )
     }
   };