@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/@types/index.d.ts

@@ -1,7 +1,12 @@
 import 'zod';
+export { f as APIErrorMap, aA as AccessTokenError, q as AuthAPI, p as AuthClient, l as AuthClientOptions, A as AuthConfig, r as AuthInstance, d as AuthInternalErrorCode, c as AuthRuntimeConfig, e as AuthSecurityErrorCode, aB as AuthorizationError, aC as AuthorizeParams, B as BuiltInOAuthProvider, C as CookieConfig, aD as CookieName, b as CookieStoreConfig, aE as CookieStrategyAttributes, E as ErrorType, F as FunctionAPIContext, aF as GetSessionAPI, G as GetSessionAPIOptions, aG as HostCookie, I as InternalContext, a as InternalLogger, J as JWTPayloadWithToken, aH as JWTStandardClaims, s as JoseInstance, L as LogLevel, t as Logger, aI as OAuthEnv, aJ as OAuthError, k as OAuthProvider, u as OAuthProviderConfig, j as OAuthProviderCredentials, O as OAuthProviderRecord, aK as ResponseType, R as RouterGlobalContext, aL as SecureCookie, m as Session, S as SessionResponse, aM as Severity, g as SignInAPIOptions, n as SignInOptions, h as SignInReturn, i as SignOutAPIOptions, o as SignOutOptions, aN as StandardCookie, aO as SyslogOptions, aP as TokenRevocationError, T as TrustedOrigin, U as User } from '../index-_aXtxb_s.js';
 import '../schemas.js';
 import '@aura-stack/router/cookie';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-export { i as APIErrorMap, a0 as AccessTokenError, d as AuthConfig, f as AuthInstance, b as AuthInternalErrorCode, A as AuthRuntimeConfig, c as AuthSecurityErrorCode, $ as AuthorizationError, C as CookieConfig, Z as CookieName, a as CookieStoreConfig, Y as CookieStrategyAttributes, E as ErrorType, V as HostCookie, J as JWTPayloadWithToken, Q as JWTStandardClaims, e as JoseInstance, a2 as OAuthEnv, _ as OAuthError, O as OAuthProvider, g as OAuthProviderConfig, h as OAuthProviderCredentials, j as OAuthProviderRecord, R as RouterGlobalContext, T as SecureCookie, S as Session, W as StandardCookie, a1 as TokenRevocationError, U as User } from '../index-B8jeIElf.js';
 export { LiteralUnion, Prettify } from './utility.js';
+import '@aura-stack/router';
+import '@aura-stack/jose/jose';
+import '@aura-stack/jose';
+import '@aura-stack/jose/crypto';
+import 'jose';
+import 'zod/v4/core';
+import 'zod/v4';

package/dist/@types/router.d.cjs

@@ -1,18 +1 @@
 "use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/@types/router.d.ts
-var router_d_exports = {};
-module.exports = __toCommonJS(router_d_exports);

package/dist/@types/router.d.d.ts

@@ -1,10 +1,15 @@
-import { R as RouterGlobalContext } from '../index-B8jeIElf.js';
+import { R as RouterGlobalContext } from '../index-_aXtxb_s.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
 import './utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
 
 declare module "@aura-stack/router" {
     interface GlobalContext extends RouterGlobalContext {}

package/dist/@types/router.d.js

@@ -1 +0,0 @@
-import "../chunk-DIVDFNAP.js";

package/dist/actions/callback/access-token.cjs

@@ -35,9 +35,6 @@ var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
   return response;
 };
 
-// src/utils.ts
-var import_router = require("@aura-stack/router");
-
 // src/errors.ts
 var OAuthProtocolError = class extends Error {
   type = "OAUTH_PROTOCOL_ERROR";
@@ -62,46 +59,74 @@ var AuthInternalError = class extends Error {
   }
 };
 
-// src/utils.ts
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
-  }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
-      }
-    };
-  }, {});
-};
-
 // src/schemas.ts
-var import_zod = require("zod");
-var OAuthProviderConfigSchema = (0, import_zod.object)({
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)().optional(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)()
+var import_v4 = require("zod/v4");
+var AuthorizeConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    params: (0, import_v4.object)({
+      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+      scope: (0, import_v4.string)().optional()
+    })
+  })
+]);
+var AccessTokenConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
+  })
+]);
+var UserInfoConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
+    method: (0, import_v4.string)().optional()
+  })
+]);
+var OAuthProviderCredentialsSchema = (0, import_v4.object)({
+  id: (0, import_v4.string)(),
+  name: (0, import_v4.string)(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)(),
+  profile: import_v4.z.function().optional()
+});
+var OAuthProviderConfigSchema = (0, import_v4.object)({
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)()
 });
 var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  state: (0, import_zod.string)(),
-  codeChallenge: (0, import_zod.string)(),
-  codeChallengeMethod: (0, import_zod.enum)(["plain", "S256"])
+  redirectURI: (0, import_v4.string)(),
+  state: (0, import_v4.string)(),
+  codeChallenge: (0, import_v4.string)(),
+  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
 });
-var OAuthAuthorizationResponse = (0, import_zod.object)({
-  state: (0, import_zod.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_zod.string)({ message: "Missing code parameter in the OAuth authorization response." })
+var OAuthAuthorizationResponse = (0, import_v4.object)({
+  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
+  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
 });
-var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
+var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
     "invalid_request",
     "unauthorized_client",
     "access_denied",
@@ -110,24 +135,24 @@ var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
     "server_error",
     "temporarily_unavailable"
   ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional(),
-  state: (0, import_zod.string)()
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional(),
+  state: (0, import_v4.string)()
 });
 var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  code: (0, import_zod.string)(),
-  codeVerifier: (0, import_zod.string)().min(43).max(128)
+  redirectURI: (0, import_v4.string)(),
+  code: (0, import_v4.string)(),
+  codeVerifier: (0, import_v4.string)().min(43).max(128)
 });
-var OAuthAccessTokenResponse = (0, import_zod.object)({
-  access_token: (0, import_zod.string)(),
-  token_type: (0, import_zod.string)().optional(),
-  expires_in: (0, import_zod.number)().optional(),
-  refresh_token: (0, import_zod.string)().optional(),
-  scope: (0, import_zod.string)().optional().or((0, import_zod.null)())
+var OAuthAccessTokenResponse = (0, import_v4.object)({
+  access_token: (0, import_v4.string)(),
+  token_type: (0, import_v4.string)().optional(),
+  expires_in: (0, import_v4.number)().optional(),
+  refresh_token: (0, import_v4.string)().optional(),
+  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
 });
-var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
+var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
     "invalid_request",
     "invalid_client",
     "invalid_grant",
@@ -135,53 +160,87 @@ var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
     "unsupported_grant_type",
     "invalid_scope"
   ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional()
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional()
 });
-var OAuthErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.string)(),
-  error_description: (0, import_zod.string)().optional()
+var OAuthErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.string)(),
+  error_description: (0, import_v4.string)().optional()
 });
-var OAuthEnvSchema = (0, import_zod.object)({
-  clientId: import_zod.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_zod.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
+var OAuthEnvSchema = (0, import_v4.object)({
+  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
+  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
 });
 
 // src/actions/callback/access-token.ts
-var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier) => {
-  const parsed = OAuthAccessToken.safeParse({ ...oauthConfig, redirectURI, code, codeVerifier });
-  if (!parsed.success) {
-    const msg = JSON.stringify(formatZodError(parsed.error), null, 2);
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", msg);
+var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
+  const { accessToken, clientId, clientSecret } = oauthConfig;
+  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
+    logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        has_client_id: Boolean(clientId),
+        has_client_secret: Boolean(clientSecret),
+        has_access_token: Boolean(accessToken),
+        has_redirect_uri: Boolean(redirectURI),
+        has_code: Boolean(code),
+        has_code_verifier: Boolean(codeVerifier)
+      }
+    });
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
   }
-  const { accessToken, clientId, clientSecret, code: codeParsed, redirectURI: redirectParsed } = parsed.data;
+  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
+  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
   try {
-    const response = await fetchAsync(accessToken, {
+    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
+      structuredData: {
+        has_client_id: Boolean(clientId),
+        redirect_uri: redirectURI,
+        grant_type: "authorization_code"
+      }
+    });
+    const response = await fetchAsync(tokenURL, {
       method: "POST",
       headers: {
+        ...extraHeaders ?? {},
         Accept: "application/json",
         "Content-Type": "application/x-www-form-urlencoded"
       },
       body: new URLSearchParams({
         client_id: clientId,
         client_secret: clientSecret,
-        code: codeParsed,
-        redirect_uri: redirectParsed,
+        code,
+        redirect_uri: redirectURI,
         grant_type: "authorization_code",
         code_verifier: codeVerifier
       }).toString()
     });
+    if (!response.ok) {
+      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
+      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
+    }
     const json = await response.json();
     const token = OAuthAccessTokenResponse.safeParse(json);
     if (!token.success) {
       const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
       if (!success) {
-        throw new OAuthProtocolError("INVALID_REQUEST", "Invalid access token response format");
+        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
+        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
       }
-      throw new OAuthProtocolError(data.error, data?.error_description ?? "Failed to retrieve access token");
+      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
+        structuredData: {
+          error: data.error,
+          error_description: data.error_description ?? ""
+        }
+      });
+      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
     }
+    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
     return token.data;
   } catch (error) {
+    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
+    if (error instanceof Error) {
+      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
+    }
     throw error;
   }
 };

package/dist/actions/callback/access-token.d.ts

@@ -1,10 +1,15 @@
-import { h as OAuthProviderCredentials } from '../../index-B8jeIElf.js';
+import { j as OAuthProviderCredentials, a as InternalLogger } from '../../index-_aXtxb_s.js';
 import 'zod';
 import '../../schemas.js';
-import '@aura-stack/router/cookie';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
 import '../../@types/utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
 
 /**
  * Make a request to the OAuth provider to the token endpoint to exchange the authorization code provided
@@ -17,12 +22,12 @@ import '../../@types/utility.js';
  * @param code - The authorization code received from the OAuth server
  * @returns The access token response from the OAuth server
  */
-declare const createAccessToken: (oauthConfig: OAuthProviderCredentials, redirectURI: string, code: string, codeVerifier: string) => Promise<{
+declare const createAccessToken: (oauthConfig: OAuthProviderCredentials, redirectURI: string, code: string, codeVerifier: string, logger?: InternalLogger) => Promise<{
     access_token: string;
     token_type?: string | undefined;
     expires_in?: number | undefined;
     refresh_token?: string | undefined;
-    scope?: string | null | undefined;
+    scope?: string | string[] | null | undefined;
 }>;
 
 export { createAccessToken };

package/dist/actions/callback/access-token.js

@@ -1,10 +1,9 @@
 import {
   createAccessToken
-} from "../../chunk-GA2SMTJO.js";
-import "../../chunk-CXLATHS5.js";
-import "../../chunk-RRLIF4PQ.js";
+} from "../../chunk-7BE46WWS.js";
 import "../../chunk-ZNCZVF6U.js";
-import "../../chunk-YRCB5FLE.js";
+import "../../chunk-2A5B7GWR.js";
+import "../../chunk-U5663F2U.js";
 export {
   createAccessToken
 };