@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/chunk-EEE7UM5T.js

@@ -0,0 +1,25 @@
+// src/oauth/x.ts
+var x = (options) => {
+  return {
+    id: "x",
+    name: "X",
+    authorizeURL: "https://twitter.com/i/oauth2/authorize",
+    accessToken: "https://api.twitter.com/2/oauth2/token",
+    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
+    scope: "tweet.read users.read offline.access",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.data.id,
+        name: profile.data.name,
+        image: profile.data.profile_image_url,
+        email: void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  x
+};

package/dist/{chunk-HT4YLL7N.js → chunk-FPCVZUVG.js}

@@ -1,13 +1,13 @@
+import {
+  createCSRF
+} from "./chunk-V6LLEAR4.js";
 import {
   getCookie,
   setCookie
-} from "./chunk-W6LG7BFW.js";
+} from "./chunk-XY5R3EHH.js";
 import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
-import {
-  createCSRF
-} from "./chunk-N2APGLXA.js";
+  secureApiHeaders
+} from "./chunk-EBAMFRB7.js";
 
 // src/actions/csrfToken/csrfToken.ts
 import { createEndpoint } from "@aura-stack/router";
@@ -21,11 +21,13 @@ var getCSRFToken = (request, cookieName) => {
 var csrfTokenAction = createEndpoint("GET", "/csrfToken", async (ctx) => {
   const {
     request,
-    context: { jose, cookies }
+    context: { jose, cookies, logger }
   } = ctx;
   const token = getCSRFToken(request, cookies.csrfToken.name);
+  logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } });
   const csrfToken = await createCSRF(jose, token);
-  const headers = new Headers(cacheControl);
+  logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } });
+  const headers = new Headers(secureApiHeaders);
   headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes));
   return Response.json({ csrfToken }, { headers });
 });

package/dist/chunk-FW4W3REU.js

@@ -0,0 +1,25 @@
+// src/oauth/github.ts
+var github = (options) => {
+  return {
+    id: "github",
+    name: "GitHub",
+    authorizeURL: "https://github.com/login/oauth/authorize",
+    accessToken: "https://github.com/login/oauth/access_token",
+    userInfo: "https://api.github.com/user",
+    scope: "read:user user:email",
+    responseType: "code",
+    profile: (profile) => {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.login,
+        email: profile.email ?? void 0,
+        image: profile.avatar_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  github
+};

package/dist/chunk-GNNBM2WJ.js

@@ -0,0 +1,83 @@
+import {
+  fetchAsync
+} from "./chunk-ZNCZVF6U.js";
+import {
+  generateSecure
+} from "./chunk-V6LLEAR4.js";
+import {
+  OAuthErrorResponse
+} from "./chunk-2A5B7GWR.js";
+import {
+  AURA_AUTH_VERSION
+} from "./chunk-LX3TJ2TJ.js";
+import {
+  OAuthProtocolError,
+  isNativeError,
+  isOAuthProtocolError
+} from "./chunk-U5663F2U.js";
+
+// src/actions/callback/userinfo.ts
+var getDefaultUserInfo = (profile) => {
+  const sub = generateSecure(16);
+  return {
+    sub: profile?.id ?? profile?.sub ?? sub,
+    email: profile?.email,
+    name: profile?.name ?? profile?.username ?? profile?.nickname,
+    image: profile?.image ?? profile?.picture
+  };
+};
+var getUserInfo = async (oauthConfig, accessToken, logger) => {
+  const userInfoConfig = oauthConfig.userInfo;
+  const userinfoURL = typeof userInfoConfig === "string" ? userInfoConfig : userInfoConfig.url;
+  const extraHeaders = typeof userInfoConfig === "string" ? void 0 : userInfoConfig.headers;
+  const method = typeof userInfoConfig === "string" ? "GET" : (userInfoConfig.method ?? "GET").toUpperCase();
+  try {
+    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
+      structuredData: {
+        endpoint: userinfoURL
+      }
+    });
+    const response = await fetchAsync(userinfoURL, {
+      method,
+      headers: {
+        "User-Agent": `Aura Auth/${AURA_AUTH_VERSION}`,
+        Accept: "application/json",
+        Authorization: `Bearer ${accessToken}`,
+        ...extraHeaders ?? {}
+      }
+    });
+    if (!response.ok) {
+      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
+      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
+    }
+    const json = await response.json();
+    const { success, data } = OAuthErrorResponse.safeParse(json);
+    if (success) {
+      logger?.log("OAUTH_USERINFO_ERROR", {
+        message: "Error response received from OAuth userinfo endpoint",
+        structuredData: {
+          error: data.error,
+          error_description: data.error_description ?? ""
+        }
+      });
+      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
+    }
+    logger?.log("OAUTH_USERINFO_SUCCESS");
+    return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
+  } catch (error) {
+    if (isOAuthProtocolError(error)) {
+      throw error;
+    }
+    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
+    if (isNativeError(error)) {
+      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
+        cause: error
+      });
+    }
+    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
+  }
+};
+
+export {
+  getUserInfo
+};

package/dist/chunk-IPKO6UQN.js

@@ -0,0 +1,25 @@
+// src/oauth/spotify.ts
+var spotify = (options) => {
+  return {
+    id: "spotify",
+    name: "Spotify",
+    authorizeURL: "https://accounts.spotify.com/authorize",
+    accessToken: "https://accounts.spotify.com/api/token",
+    userInfo: "https://api.spotify.com/v1/me",
+    scope: "user-read-private user-read-email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.display_name,
+        email: profile.email,
+        image: profile.images[0]?.url ?? void 0
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  spotify
+};

package/dist/chunk-JOCGX3RP.js

@@ -0,0 +1,59 @@
+import {
+  createAuthorizationURL
+} from "./chunk-D2CSIUKP.js";
+import {
+  createRedirectTo,
+  createRedirectURI,
+  createSignInURL,
+  getBaseURL
+} from "./chunk-LATR3NIV.js";
+import {
+  AuthInternalError
+} from "./chunk-U5663F2U.js";
+import {
+  cacheControl
+} from "./chunk-EBAMFRB7.js";
+
+// src/api/signIn.ts
+import { HeadersBuilder } from "@aura-stack/router";
+var signIn = async (oauth, {
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  redirect,
+  request: requestInit
+}) => {
+  const headers = new Headers(headersInit);
+  const provider = ctx.oauth[oauth];
+  if (!provider) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", `The OAuth provider "${oauth}" is not configured.`);
+  }
+  let request = requestInit;
+  if (!request) {
+    const origin = await getBaseURL({ ctx, headers });
+    const url = `${origin}${ctx.basePath}/signIn/${oauth}`;
+    request = new Request(url, { headers });
+  }
+  if (redirect === false) {
+    const signInURL = await createSignInURL({ request, oauth, ctx, redirectTo });
+    return { redirect: false, signInURL };
+  }
+  const redirectURI = await createRedirectURI(request, oauth, ctx);
+  const redirectToValue = await createRedirectTo(request, redirectTo, ctx);
+  const { authorization, state, codeVerifier } = await createAuthorizationURL(provider, redirectURI, ctx);
+  ctx?.logger?.log("SIGN_IN_INITIATED", {
+    structuredData: { oauth_provider: oauth }
+  });
+  const headersList = new HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(ctx.cookies.state.name, state, ctx.cookies.state.attributes).setCookie(ctx.cookies.redirectURI.name, redirectURI, ctx.cookies.redirectURI.attributes).setCookie(ctx.cookies.redirectTo.name, redirectToValue, ctx.cookies.redirectTo.attributes).setCookie(ctx.cookies.codeVerifier.name, codeVerifier, ctx.cookies.codeVerifier.attributes).toHeaders();
+  return Response.json(
+    { redirect: redirect ?? true, signInURL: authorization },
+    {
+      status: redirect ?? true ? 302 : 200,
+      headers: headersList
+    }
+  );
+};
+
+export {
+  signIn
+};

package/dist/chunk-KBXWTD6E.js

@@ -0,0 +1,94 @@
+import {
+  verifyCSRF
+} from "./chunk-V6LLEAR4.js";
+import {
+  getErrorName
+} from "./chunk-LX3TJ2TJ.js";
+import {
+  expiredCookieAttributes,
+  getCookie
+} from "./chunk-XY5R3EHH.js";
+import {
+  AuthSecurityError
+} from "./chunk-U5663F2U.js";
+import {
+  secureApiHeaders
+} from "./chunk-EBAMFRB7.js";
+
+// src/api/signOut.ts
+import { HeadersBuilder } from "@aura-stack/router";
+var signOut = async ({
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  skipCSRFCheck = false
+}) => {
+  const headers = new Headers(headersInit);
+  const header = headers.get("X-CSRF-Token");
+  let session = null;
+  let csrfToken = null;
+  try {
+    session = getCookie(headers, ctx.cookies.sessionToken.name);
+  } catch {
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  try {
+    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+  }
+  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
+    structuredData: {
+      has_session: Boolean(session),
+      has_csrf_token: Boolean(csrfToken),
+      has_csrf_header: Boolean(header),
+      skip_csrf_check: skipCSRFCheck
+    }
+  });
+  if (!session) {
+    ctx?.logger?.log("SESSION_TOKEN_MISSING");
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  if (!skipCSRFCheck) {
+    if (!csrfToken) {
+      ctx?.logger?.log("CSRF_TOKEN_MISSING");
+      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+    }
+    if (!header) {
+      ctx?.logger?.log("CSRF_HEADER_MISSING");
+      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
+    }
+    try {
+      await verifyCSRF(ctx.jose, csrfToken, header);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
+  } else {
+    try {
+      await ctx.jose.verifyJWS(csrfToken);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+  }
+  try {
+    await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("SIGN_OUT_SUCCESS");
+  } catch (error) {
+    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
+  }
+  const headersList = new HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+  return Response.json(
+    { redirect: Boolean(redirectTo), url: redirectTo },
+    {
+      status: 202,
+      headers: headersList
+    }
+  );
+};
+
+export {
+  signOut
+};

package/dist/chunk-KMMAZFSJ.js

@@ -0,0 +1,25 @@
+// src/oauth/figma.ts
+var figma = (options) => {
+  return {
+    id: "figma",
+    name: "Figma",
+    authorizeURL: "https://www.figma.com/oauth",
+    accessToken: "https://api.figma.com/v1/oauth/token",
+    userInfo: "https://api.figma.com/v1/me",
+    scope: "current_user:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.handle,
+        email: profile.email,
+        image: profile.img_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  figma
+};

package/dist/chunk-LATR3NIV.js

@@ -0,0 +1,117 @@
+import {
+  equals,
+  extractPath,
+  isRelativeURL,
+  isSameOrigin,
+  isTrustedOrigin,
+  isValidURL,
+  patternToRegex
+} from "./chunk-LX3TJ2TJ.js";
+import {
+  getEnv
+} from "./chunk-WHNDRO3N.js";
+import {
+  AuthInternalError
+} from "./chunk-U5663F2U.js";
+
+// src/actions/signIn/authorization.ts
+var getTrustedOrigins = async (request, trustedOrigins) => {
+  if (!trustedOrigins) return [];
+  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
+  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
+};
+var getBaseURL = async ({
+  ctx,
+  request,
+  headers: headersInit
+}) => {
+  const origin = getEnv("BASE_URL") || ctx?.baseURL;
+  if (origin && origin !== "/") return origin;
+  if (ctx?.trustedProxyHeaders) {
+    const headers = headersInit && new Headers(headersInit) || request?.headers;
+    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
+    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
+    if (host) return `${protocol}://${host}`;
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
+    );
+  }
+  try {
+    return new URL(request?.url ?? "not-found").origin;
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
+      { cause: error }
+    );
+  }
+};
+var getOriginURL = async (request, context) => {
+  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
+  trustedOrigins.push(new URL(request.url).origin);
+  const origin = await getBaseURL({ request, ctx: context });
+  if (!isTrustedOrigin(origin, trustedOrigins)) {
+    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
+    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
+  }
+  return origin;
+};
+var createRedirectURI = async (request, oauth, context) => {
+  const origin = await getOriginURL(request, context);
+  return `${origin}${context.basePath}/callback/${oauth}`;
+};
+var createSignInURL = async ({
+  request,
+  oauth,
+  ctx,
+  redirectTo
+}) => {
+  const origin = await getOriginURL(request, ctx);
+  const searchParams = new URLSearchParams();
+  if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
+  return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
+};
+var createRedirectTo = async (request, redirectTo, context) => {
+  try {
+    const headers = request.headers;
+    const requestOrigin = await getOriginURL(request, context);
+    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
+    const validateURL = (url) => {
+      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+      if (isRelativeURL(url)) return url;
+      if (origins.length > 0) {
+        if (isTrustedOrigin(url, origins)) {
+          const urlOrigin = new URL(url).origin;
+          for (const pattern of origins) {
+            const regex = patternToRegex(pattern);
+            if (regex?.test(urlOrigin)) {
+              return isSameOrigin(url, request.url) ? extractPath(url) : url;
+            }
+            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
+          }
+        }
+        context?.logger?.log("OPEN_REDIRECT_ATTACK");
+        return "/";
+      }
+      if (isSameOrigin(url, requestOrigin)) {
+        return extractPath(url);
+      }
+      context?.logger?.log("OPEN_REDIRECT_ATTACK");
+      return "/";
+    };
+    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
+  } catch (error) {
+    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
+    return "/";
+  }
+};
+
+export {
+  getTrustedOrigins,
+  getBaseURL,
+  getOriginURL,
+  createRedirectURI,
+  createSignInURL,
+  createRedirectTo
+};

package/dist/chunk-LAYPUDQF.js

@@ -0,0 +1,39 @@
+import {
+  getSession
+} from "./chunk-CITNGXDA.js";
+import {
+  signIn
+} from "./chunk-JOCGX3RP.js";
+import {
+  signOut
+} from "./chunk-KBXWTD6E.js";
+import {
+  validateRedirectTo
+} from "./chunk-LX3TJ2TJ.js";
+
+// src/api/createApi.ts
+var createAuthAPI = (ctx) => {
+  return {
+    getSession: async (options) => {
+      const session = await getSession({ ctx, headers: options.headers });
+      return session;
+    },
+    signIn: async (oauth, options) => {
+      return signIn(oauth, {
+        ctx,
+        headers: options?.headers,
+        request: options?.request,
+        redirect: options?.redirect,
+        redirectTo: options?.redirectTo
+      });
+    },
+    signOut: async (options) => {
+      const redirectTo = validateRedirectTo(options?.redirectTo ?? "/");
+      return signOut({ ctx, headers: options.headers, redirectTo, skipCSRFCheck: true });
+    }
+  };
+};
+
+export {
+  createAuthAPI
+};

package/dist/chunk-LDU7A2JE.js

@@ -0,0 +1,25 @@
+// src/oauth/mailchimp.ts
+var mailchimp = (options) => {
+  return {
+    id: "mailchimp",
+    name: "Mailchimp",
+    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
+    accessToken: "https://login.mailchimp.com/oauth2/token",
+    userInfo: "https://login.mailchimp.com/oauth2/metadata",
+    scope: "",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.user_id,
+        name: profile.accountname,
+        email: profile.login.email,
+        image: profile.login.avatar
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  mailchimp
+};