@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/chunk-2IR674WX.js

@@ -0,0 +1,44 @@
+import {
+  createBuiltInOAuthProviders
+} from "./chunk-PDP3PHB3.js";
+import {
+  createProxyLogger
+} from "./chunk-U4RK4LKJ.js";
+import {
+  createJoseInstance
+} from "./chunk-UZQJJD6A.js";
+import {
+  createCookieStore
+} from "./chunk-XY5R3EHH.js";
+import {
+  getEnv,
+  getEnvArray,
+  getEnvBoolean
+} from "./chunk-WHNDRO3N.js";
+
+// src/context.ts
+var createContext = (config) => {
+  const trustedProxyHeadersEnv = getEnv("TRUSTED_PROXY_HEADERS");
+  const useProxyHeaders = trustedProxyHeadersEnv === void 0 ? config?.trustedProxyHeaders ?? false : getEnvBoolean("TRUSTED_PROXY_HEADERS");
+  const logger = createProxyLogger(config);
+  const cookiePrefix = config?.cookies?.prefix;
+  const cookieOverrides = config?.cookies?.overrides ?? {};
+  const secureCookieStore = createCookieStore(true, cookiePrefix, cookieOverrides, logger);
+  const standardCookieStore = createCookieStore(false, cookiePrefix, cookieOverrides, logger);
+  return {
+    oauth: createBuiltInOAuthProviders(config?.oauth),
+    cookies: standardCookieStore,
+    jose: createJoseInstance(config?.secret),
+    secret: config?.secret,
+    basePath: config?.basePath ?? "/auth",
+    trustedProxyHeaders: useProxyHeaders,
+    trustedOrigins: getEnvArray("TRUSTED_ORIGINS").length > 0 ? getEnvArray("TRUSTED_ORIGINS") : config?.trustedOrigins,
+    logger,
+    cookieConfig: { secure: secureCookieStore, standard: standardCookieStore },
+    baseURL: config?.baseURL
+  };
+};
+
+export {
+  createContext
+};

package/dist/chunk-3J5TUH2I.js

@@ -0,0 +1,50 @@
+import {
+  createRedirectTo
+} from "./chunk-LATR3NIV.js";
+import {
+  signOut
+} from "./chunk-KBXWTD6E.js";
+import {
+  getBaseURL
+} from "./chunk-LX3TJ2TJ.js";
+
+// src/actions/signOut/signOut.ts
+import { z } from "zod/v4";
+import { createEndpoint, createEndpointConfig } from "@aura-stack/router";
+var config = createEndpointConfig({
+  schemas: {
+    searchParams: z.object({
+      token_type_hint: z.literal("session_token"),
+      redirectTo: z.string().optional()
+    })
+  }
+});
+var signOutAction = createEndpoint(
+  "POST",
+  "/signOut",
+  async (ctx) => {
+    const {
+      request,
+      searchParams: { redirectTo },
+      context
+    } = ctx;
+    const baseURL = getBaseURL(request);
+    const location = await createRedirectTo(
+      new Request(baseURL, {
+        headers: request.headers
+      }),
+      redirectTo,
+      context
+    );
+    return await signOut({
+      ctx: context,
+      headers: request.headers,
+      redirectTo: location
+    });
+  },
+  config
+);
+
+export {
+  signOutAction
+};

package/dist/chunk-4RWSYUKX.js

@@ -0,0 +1,98 @@
+import {
+  AuthClientError,
+  isNativeError
+} from "./chunk-U5663F2U.js";
+
+// src/client/client.ts
+import { createClient as createClientAPI } from "@aura-stack/router";
+var createClient = createClientAPI;
+var createAuthClient = (options) => {
+  if (typeof window === "undefined" && !options.baseURL) {
+    throw new AuthClientError("`baseURL` is required when createAuthClient is used outside the browser.");
+  }
+  const client = createClient({
+    cache: "no-store",
+    credentials: "include",
+    baseURL: options.baseURL ?? window.location.origin,
+    ...options
+  });
+  const getCSRFToken = async () => {
+    try {
+      const response = await client.get("/csrfToken");
+      if (!response.ok) return null;
+      const data = await response.json();
+      return data.csrfToken;
+    } catch (error) {
+      console.error("Error fetching CSRF token:", error);
+      return null;
+    }
+  };
+  const getSession = async () => {
+    try {
+      const response = await client.get("/session");
+      if (!response.ok) return null;
+      const session = await response.json();
+      if (!session?.authenticated) return null;
+      return session.session;
+    } catch (error) {
+      console.error("Error fetching session:", error);
+      return null;
+    }
+  };
+  const signIn = async (oauth, options2) => {
+    try {
+      const response = await client.get("/signIn/:oauth", {
+        params: {
+          oauth
+        },
+        searchParams: {
+          ...options2,
+          redirect: false
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.signInURL) {
+        window.location.assign(json.signInURL);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-in:", error);
+      return { redirect: false, signInURL: "/" };
+    }
+  };
+  const signOut = async (options2) => {
+    try {
+      const csrfToken = await getCSRFToken();
+      if (!csrfToken) {
+        throw new AuthClientError("Failed to fetch CSRF token for sign-out.");
+      }
+      const response = await client.post("/signOut", {
+        searchParams: {
+          redirectTo: options2?.redirectTo ?? "/",
+          token_type_hint: "session_token"
+        },
+        headers: {
+          "X-CSRF-Token": csrfToken
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.url) {
+        window.location.assign(json.url);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-out:", error);
+      throw isNativeError(error) ? error : new AuthClientError("Sign-out failed.", "The sign-out request failed.", { cause: error });
+    }
+  };
+  return {
+    getSession,
+    signIn,
+    signOut
+  };
+};
+
+export {
+  createClient,
+  createAuthClient
+};

package/dist/chunk-4YHJ4IEQ.js

@@ -0,0 +1,25 @@
+// src/oauth/bitbucket.ts
+var bitbucket = (options) => {
+  return {
+    id: "bitbucket",
+    name: "Bitbucket",
+    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
+    accessToken: "https://bitbucket.org/site/oauth2/access_token",
+    userInfo: "https://api.bitbucket.org/2.0/user",
+    scope: "account email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.uuid ?? profile.account_id,
+        name: profile.display_name ?? profile.nickname,
+        image: profile.links.avatar?.href,
+        email: void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  bitbucket
+};

package/dist/chunk-54CZPKR4.js

@@ -0,0 +1,25 @@
+// src/oauth/strava.ts
+var strava = (options) => {
+  return {
+    id: "strava",
+    name: "Strava",
+    authorizeURL: "https://www.strava.com/oauth/authorize",
+    accessToken: "https://www.strava.com/oauth/token",
+    userInfo: "https://www.strava.com/api/v3/athlete",
+    scope: "read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: `${profile.firstname} ${profile.lastname}`,
+        image: profile.profile,
+        email: void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  strava
+};

package/dist/chunk-5LZ7TOM3.js

@@ -0,0 +1,25 @@
+// src/oauth/gitlab.ts
+var gitlab = (options) => {
+  return {
+    id: "gitlab",
+    name: "GitLab",
+    authorizeURL: "https://gitlab.com/oauth/authorize",
+    accessToken: "https://gitlab.com/oauth/token",
+    userInfo: "https://gitlab.com/api/v4/user",
+    scope: "read_user",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.username,
+        email: profile.email,
+        image: profile.avatar_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  gitlab
+};

package/dist/chunk-7BE46WWS.js

@@ -0,0 +1,88 @@
+import {
+  fetchAsync
+} from "./chunk-ZNCZVF6U.js";
+import {
+  OAuthAccessTokenErrorResponse,
+  OAuthAccessTokenResponse
+} from "./chunk-2A5B7GWR.js";
+import {
+  AuthInternalError,
+  OAuthProtocolError
+} from "./chunk-U5663F2U.js";
+
+// src/actions/callback/access-token.ts
+var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
+  const { accessToken, clientId, clientSecret } = oauthConfig;
+  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
+    logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        has_client_id: Boolean(clientId),
+        has_client_secret: Boolean(clientSecret),
+        has_access_token: Boolean(accessToken),
+        has_redirect_uri: Boolean(redirectURI),
+        has_code: Boolean(code),
+        has_code_verifier: Boolean(codeVerifier)
+      }
+    });
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
+  }
+  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
+  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
+  try {
+    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
+      structuredData: {
+        has_client_id: Boolean(clientId),
+        redirect_uri: redirectURI,
+        grant_type: "authorization_code"
+      }
+    });
+    const response = await fetchAsync(tokenURL, {
+      method: "POST",
+      headers: {
+        ...extraHeaders ?? {},
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({
+        client_id: clientId,
+        client_secret: clientSecret,
+        code,
+        redirect_uri: redirectURI,
+        grant_type: "authorization_code",
+        code_verifier: codeVerifier
+      }).toString()
+    });
+    if (!response.ok) {
+      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
+      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
+    }
+    const json = await response.json();
+    const token = OAuthAccessTokenResponse.safeParse(json);
+    if (!token.success) {
+      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
+      if (!success) {
+        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
+        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
+      }
+      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
+        structuredData: {
+          error: data.error,
+          error_description: data.error_description ?? ""
+        }
+      });
+      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
+    }
+    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
+    return token.data;
+  } catch (error) {
+    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
+    if (error instanceof Error) {
+      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
+    }
+    throw error;
+  }
+};
+
+export {
+  createAccessToken
+};

package/dist/chunk-7YYXFKLR.js

@@ -0,0 +1,35 @@
+import {
+  getSession
+} from "./chunk-CITNGXDA.js";
+import {
+  expiredCookieAttributes
+} from "./chunk-XY5R3EHH.js";
+import {
+  AuthInternalError
+} from "./chunk-U5663F2U.js";
+import {
+  secureApiHeaders
+} from "./chunk-EBAMFRB7.js";
+
+// src/actions/session/session.ts
+import { createEndpoint, HeadersBuilder } from "@aura-stack/router";
+var sessionAction = createEndpoint("GET", "/session", async (ctx) => {
+  const {
+    request,
+    context: { cookies }
+  } = ctx;
+  try {
+    const session = await getSession({ ctx: ctx.context, headers: request.headers });
+    if (!session.authenticated) {
+      throw new AuthInternalError("INVALID_JWT_TOKEN", "Session not authenticated");
+    }
+    return Response.json(session, { headers: secureApiHeaders });
+  } catch (error) {
+    const headers = new HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+    return Response.json({ session: null, authenticated: false }, { status: 401, headers });
+  }
+});
+
+export {
+  sessionAction
+};

package/dist/chunk-C3A37LQC.js

@@ -0,0 +1,33 @@
+// src/oauth/atlassian.ts
+var atlassian = (options) => {
+  return {
+    id: "atlassian",
+    name: "Atlassian",
+    authorize: {
+      url: "https://auth.atlassian.com/authorize",
+      params: {
+        audience: "api.atlassian.com",
+        scope: "read:me read:account",
+        prompt: "consent"
+      }
+    },
+    authorizeURL: "https://auth.atlassian.com/authorize",
+    accessToken: "https://auth.atlassian.com/oauth/token",
+    userInfo: "https://api.atlassian.com/me",
+    scope: "read:me read:account",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name,
+        email: profile.email,
+        image: profile.picture
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  atlassian
+};

package/dist/chunk-CITNGXDA.js

@@ -0,0 +1,31 @@
+import {
+  getErrorName,
+  toISOString
+} from "./chunk-LX3TJ2TJ.js";
+import {
+  getCookie
+} from "./chunk-XY5R3EHH.js";
+
+// src/api/getSession.ts
+var getSession = async ({ ctx, headers }) => {
+  try {
+    const session = getCookie(new Headers(headers), ctx.cookies.sessionToken.name);
+    const decoded = await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("AUTH_SESSION_VALID");
+    const { exp, iat, jti, nbf, aud, iss, ...user } = decoded;
+    return {
+      session: {
+        user,
+        expires: toISOString(exp * 1e3)
+      },
+      authenticated: true
+    };
+  } catch (error) {
+    ctx?.logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
+    return { session: null, authenticated: false };
+  }
+};
+
+export {
+  getSession
+};

package/dist/chunk-CWX724AG.js

@@ -0,0 +1,78 @@
+import {
+  callbackAction
+} from "./chunk-NHZBQNRR.js";
+import {
+  csrfTokenAction
+} from "./chunk-FPCVZUVG.js";
+import {
+  signInAction
+} from "./chunk-UN7X6SU5.js";
+import {
+  sessionAction
+} from "./chunk-7YYXFKLR.js";
+import {
+  signOutAction
+} from "./chunk-3J5TUH2I.js";
+import {
+  createAuthAPI
+} from "./chunk-LAYPUDQF.js";
+import {
+  createContext
+} from "./chunk-2IR674WX.js";
+import {
+  createErrorHandler,
+  useSecureCookies
+} from "./chunk-LX3TJ2TJ.js";
+
+// src/createAuth.ts
+import { createRouter } from "@aura-stack/router";
+var createInternalConfig = (authConfig) => {
+  const context = createContext(authConfig);
+  return {
+    basePath: authConfig?.basePath ?? "/auth",
+    onError: createErrorHandler(context.logger),
+    context,
+    use: [
+      (ctx) => {
+        const useSecure = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
+        ctx.context.cookies = useSecure ? context.cookieConfig.secure : context.cookieConfig.standard;
+        return ctx;
+      }
+    ]
+  };
+};
+var createAuthInstance = (authConfig) => {
+  const config = createInternalConfig(authConfig);
+  const router = createRouter(
+    [signInAction(config.context.oauth), callbackAction(config.context.oauth), sessionAction, signOutAction, csrfTokenAction],
+    config
+  );
+  return {
+    handlers: router,
+    jose: config.context.jose,
+    api: createAuthAPI(config.context)
+  };
+};
+var createAuth = (config) => {
+  const authInstance = createAuthInstance(config);
+  authInstance.handlers.ALL = async (request) => {
+    const method = request.method.toUpperCase();
+    const methodHandlers = {
+      GET: authInstance.handlers.GET,
+      POST: authInstance.handlers.POST
+    };
+    if (method in methodHandlers) {
+      return await methodHandlers[method](request);
+    }
+    return new Response("Method Not Allowed", {
+      status: 405,
+      headers: { Allow: Object.keys(methodHandlers).join(", ") }
+    });
+  };
+  return authInstance;
+};
+
+export {
+  createAuthInstance,
+  createAuth
+};

package/dist/chunk-D2CSIUKP.js

@@ -0,0 +1,74 @@
+import {
+  createPKCE,
+  createSecretValue
+} from "./chunk-V6LLEAR4.js";
+import {
+  OAuthAuthorization
+} from "./chunk-2A5B7GWR.js";
+import {
+  AuthInternalError
+} from "./chunk-U5663F2U.js";
+
+// src/actions/signIn/authorization-url.ts
+var setSearchParams = (url, params) => {
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== "") {
+      url.searchParams.set(key, value);
+    }
+  }
+};
+var buildAuthorizationURL = (oauth, redirect_uri, state, code_challenge, code_challenge_method) => {
+  const authorizeConfig = oauth.authorize;
+  const baseURL = typeof authorizeConfig === "string" ? authorizeConfig : authorizeConfig?.url ?? oauth.authorizeURL;
+  if (!baseURL) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing authorization URL in OAuth provider configuration.");
+  }
+  const url = new URL(baseURL);
+  const authorizeParams = typeof authorizeConfig === "string" ? void 0 : authorizeConfig?.params;
+  setSearchParams(url, {
+    response_type: authorizeParams?.responseType ?? oauth.responseType ?? "code",
+    client_id: oauth.clientId,
+    redirect_uri,
+    state,
+    code_challenge,
+    code_challenge_method,
+    scope: authorizeParams?.scope ?? oauth.scope,
+    prompt: authorizeParams?.prompt,
+    response_mode: authorizeParams?.responseMode,
+    login_hint: authorizeParams?.loginHint,
+    nonce: authorizeParams?.nonce,
+    display: authorizeParams?.display,
+    audience: authorizeParams?.audience
+  });
+  return url.toString();
+};
+var createAuthorizationURL = async (oauth, redirectURI, ctx) => {
+  const state = createSecretValue();
+  const { codeVerifier, codeChallenge, method } = await createPKCE();
+  const authorization = buildAuthorizationURL(oauth, redirectURI, state, codeChallenge, method);
+  const parsed = OAuthAuthorization.safeParse({ ...oauth, redirectURI, state, codeChallenge, codeChallengeMethod: method });
+  if (!parsed.success) {
+    ctx?.logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        scope: oauth?.scope ?? "",
+        redirect_uri: redirectURI,
+        has_state: Boolean(state),
+        has_code_challenge: Boolean(codeChallenge),
+        code_challenge_method: method
+      }
+    });
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
+  }
+  return {
+    authorization,
+    state,
+    codeVerifier,
+    method
+  };
+};
+
+export {
+  setSearchParams,
+  buildAuthorizationURL,
+  createAuthorizationURL
+};

package/dist/chunk-E6G5YCI6.js

@@ -0,0 +1,25 @@
+// src/oauth/pinterest.ts
+var pinterest = (options) => {
+  return {
+    id: "pinterest",
+    name: "Pinterest",
+    authorizeURL: "https://www.pinterest.com/oauth",
+    accessToken: "https://api.pinterest.com/v5/oauth/token",
+    userInfo: "https://api.pinterest.com/v5/user_account",
+    scope: "user_accounts:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.username,
+        image: profile.profile_image,
+        email: void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  pinterest
+};

package/dist/chunk-EBAMFRB7.js

@@ -0,0 +1,34 @@
+// src/headers.ts
+var cacheControl = {
+  "Cache-Control": "no-store",
+  Pragma: "no-cache",
+  Expires: "0",
+  Vary: "Cookie"
+};
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
+
+export {
+  cacheControl,
+  contentSecurityPolicy,
+  secureHeaders,
+  secureApiHeaders
+};