@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/chunk-LX3TJ2TJ.js

@@ -0,0 +1,294 @@
+import {
+  getEnv
+} from "./chunk-WHNDRO3N.js";
+import {
+  AuthInternalError,
+  isAuthInternalError,
+  isAuthSecurityError,
+  isOAuthProtocolError
+} from "./chunk-U5663F2U.js";
+
+// src/utils.ts
+import { isInvalidZodSchemaError, isRouterError } from "@aura-stack/router";
+
+// src/assert.ts
+import { encoder } from "@aura-stack/jose/crypto";
+var isFalsy = (value) => {
+  return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
+};
+var isRequest = (value) => {
+  return typeof Request !== "undefined" && value instanceof Request;
+};
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
+var isValidURL = (value) => {
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
+};
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+};
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+var isSameOrigin = (origin, expected) => {
+  const originURL = new URL(origin);
+  const expectedURL = new URL(expected);
+  return equals(originURL.origin, expectedURL.origin);
+};
+var patternToRegex = (pattern) => {
+  try {
+    if (pattern.length > 2048) return null;
+    pattern = pattern.replace(/\\/g, "");
+    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
+    if (!match) return null;
+    const [, protocol, host, port] = match;
+    const hasWildcard = host.includes("*");
+    if (hasWildcard && !host.startsWith("*.")) return null;
+    if (hasWildcard && host.slice(2).includes("*")) return null;
+    const domain = hasWildcard ? host.slice(2) : host;
+    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
+    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
+    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
+  } catch {
+    return null;
+  }
+};
+var isTrustedOrigin = (url, trustedOrigins) => {
+  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
+  try {
+    const urlOrigin = new URL(url).origin;
+    for (const pattern of trustedOrigins) {
+      const regex = patternToRegex(pattern);
+      if (regex?.test(urlOrigin)) return true;
+      try {
+        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return false;
+};
+var timingSafeEqual = (a, b) => {
+  const bufferA = encoder.encode(a);
+  const bufferB = encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
+  }
+  return diff === 0 && bufferA.length === bufferB.length;
+};
+
+// src/utils.ts
+var AURA_AUTH_VERSION = "0.4.0";
+var toSnakeCase = (str) => {
+  return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
+};
+var toUpperCase = (str) => {
+  return str.toUpperCase();
+};
+var toCastCase = (obj, type = "snake") => {
+  return Object.entries(obj).reduce((previous, [key, value]) => {
+    const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
+    return { ...previous, [newKey]: value };
+  }, {});
+};
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+var createErrorHandler = (logger) => {
+  return (error) => {
+    if (isRouterError(error)) {
+      const { message, status, statusText } = error;
+      logger?.log("ROUTER_INTERNAL_ERROR");
+      return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
+    }
+    if (isInvalidZodSchemaError(error)) {
+      logger?.log("INVALID_REQUEST");
+      return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
+    }
+    if (isOAuthProtocolError(error)) {
+      const { error: errorCode, message, type, errorURI } = error;
+      logger?.log("OAUTH_PROTOCOL_ERROR", {
+        structuredData: {
+          error: errorCode,
+          error_description: message,
+          error_uri: errorURI ?? ""
+        }
+      });
+      return Response.json(
+        {
+          type,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    if (isAuthInternalError(error)) {
+      const { type, code, message } = error;
+      logger?.log("INVALID_OAUTH_CONFIGURATION", {
+        structuredData: {
+          error: code,
+          error_description: message
+        }
+      });
+      return Response.json(
+        {
+          type,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    if (isAuthSecurityError(error)) {
+      const { type, code, message } = error;
+      logger?.log("INVALID_OAUTH_CONFIGURATION", {
+        structuredData: {
+          error: code,
+          error_description: message
+        }
+      });
+      return Response.json(
+        {
+          type,
+          code,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    logger?.log("SERVER_ERROR");
+    return Response.json(
+      { type: "SERVER_ERROR", code: "SERVER_ERROR", message: "An unexpected error occurred" },
+      { status: 500 }
+    );
+  };
+};
+var getBaseURL = (request) => {
+  const url = new URL(request.url);
+  return `${url.origin}${url.pathname}`;
+};
+var toISOString = (date) => {
+  return new Date(date).toISOString();
+};
+var useSecureCookies = (request, trustedProxyHeaders) => {
+  const headers = request instanceof Headers ? request : request.headers;
+  const url = request instanceof Headers ? null : request.url;
+  return trustedProxyHeaders ? url?.startsWith("https://") || headers.get("X-Forwarded-Proto") === "https" || (headers.get("Forwarded")?.includes("proto=https") ?? false) : url?.startsWith("https://") ?? false;
+};
+var formatZodError = (error) => {
+  if (!error.issues || error.issues.length === 0) {
+    return {};
+  }
+  return error.issues.reduce((previous, issue) => {
+    const key = issue.path.join(".");
+    return {
+      ...previous,
+      [key]: {
+        code: issue.code,
+        message: issue.message
+      }
+    };
+  }, {});
+};
+var extractPath = (url) => {
+  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
+  const match = url.match(pathRegex);
+  return match && match[2] ? match[2] : "/";
+};
+var createStructuredData = (data, sdID = "metadata") => {
+  const entries = Object.entries(data);
+  if (entries.length === 0) return `[${sdID}]`;
+  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
+  return `[${sdID} ${values}]`;
+};
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
+  }
+  return typeof error === "string" ? error : "UnknownError";
+};
+var createBasicAuthHeader = (username, password) => {
+  const getUsername = getEnv(username.toUpperCase()) ?? username;
+  const getPassword = getEnv(password.toUpperCase()) ?? password;
+  if (!getUsername || !getPassword) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
+  }
+  const credentials = `${getUsername}:${getPassword}`;
+  return `Basic ${btoa(credentials)}`;
+};
+var validateRedirectTo = (url) => {
+  if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+  if (isRelativeURL(url)) return url;
+  return "/";
+};
+
+export {
+  AURA_AUTH_VERSION,
+  toSnakeCase,
+  toUpperCase,
+  toCastCase,
+  equals,
+  createErrorHandler,
+  getBaseURL,
+  toISOString,
+  useSecureCookies,
+  formatZodError,
+  extractPath,
+  createStructuredData,
+  getErrorName,
+  createBasicAuthHeader,
+  validateRedirectTo,
+  isFalsy,
+  isRequest,
+  unsafeChars,
+  isValidURL,
+  isJWTPayloadWithToken,
+  isRelativeURL,
+  isSameOrigin,
+  patternToRegex,
+  isTrustedOrigin,
+  timingSafeEqual
+};

package/dist/chunk-NHZBQNRR.js

@@ -0,0 +1,143 @@
+import {
+  getUserInfo
+} from "./chunk-GNNBM2WJ.js";
+import {
+  createAccessToken
+} from "./chunk-7BE46WWS.js";
+import {
+  getOriginURL,
+  getTrustedOrigins
+} from "./chunk-LATR3NIV.js";
+import {
+  createCSRF
+} from "./chunk-V6LLEAR4.js";
+import {
+  OAuthAuthorizationErrorResponse
+} from "./chunk-2A5B7GWR.js";
+import {
+  isRelativeURL,
+  isSameOrigin,
+  isTrustedOrigin,
+  timingSafeEqual
+} from "./chunk-LX3TJ2TJ.js";
+import {
+  createSessionCookie,
+  expiredCookieAttributes,
+  getCookie
+} from "./chunk-XY5R3EHH.js";
+import {
+  AuthSecurityError,
+  OAuthProtocolError
+} from "./chunk-U5663F2U.js";
+import {
+  cacheControl
+} from "./chunk-EBAMFRB7.js";
+
+// src/actions/callback/callback.ts
+import { z } from "zod/v4";
+import { createEndpoint, createEndpointConfig, HeadersBuilder } from "@aura-stack/router";
+var callbackConfig = (oauth) => {
+  return createEndpointConfig("/callback/:oauth", {
+    schemas: {
+      params: z.object({
+        oauth: z.enum(
+          Object.keys(oauth),
+          "The OAuth provider is not supported or invalid."
+        )
+      }),
+      searchParams: z.object({
+        code: z.string("Missing code parameter in the OAuth authorization response."),
+        state: z.string("Missing state parameter in the OAuth authorization response.")
+      })
+    },
+    use: [
+      (ctx) => {
+        const {
+          searchParams,
+          context: { logger }
+        } = ctx;
+        const response = OAuthAuthorizationErrorResponse.safeParse(searchParams);
+        if (response.success) {
+          const { error, error_description } = response.data;
+          const criticalAuthErrors = ["access_denied", "server_error"];
+          const severity = criticalAuthErrors.includes(error.toLowerCase()) ? "critical" : "warning";
+          logger?.log("OAUTH_AUTHORIZATION_ERROR", {
+            severity,
+            structuredData: {
+              error,
+              error_description: error_description ?? ""
+            }
+          });
+          throw new OAuthProtocolError(error, error_description || "OAuth Authorization Error");
+        }
+        return ctx;
+      }
+    ]
+  });
+};
+var callbackAction = (oauth) => {
+  return createEndpoint(
+    "GET",
+    "/callback/:oauth",
+    async (ctx) => {
+      const {
+        request,
+        params: { oauth: oauth2 },
+        searchParams: { code, state },
+        context
+      } = ctx;
+      const { oauth: providers, cookies, jose, logger, trustedOrigins } = context;
+      const oauthConfig = providers[oauth2];
+      const cookieState = getCookie(request, cookies.state.name);
+      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
+      const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
+      const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
+      if (!timingSafeEqual(cookieState, state)) {
+        logger?.log("MISMATCHING_STATE", {
+          structuredData: {
+            oauth_provider: oauth2
+          }
+        });
+        throw new AuthSecurityError(
+          "MISMATCHING_STATE",
+          "The provided state passed in the OAuth response does not match the stored state."
+        );
+      }
+      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier, logger);
+      const origins = await getTrustedOrigins(request, trustedOrigins);
+      const requestOrigin = await getOriginURL(request, context);
+      if (!isRelativeURL(cookieRedirectTo)) {
+        const isValid = origins.length > 0 ? isTrustedOrigin(cookieRedirectTo, origins) : isSameOrigin(cookieRedirectTo, requestOrigin);
+        if (!isValid) {
+          logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", {
+            structuredData: {
+              redirect_path: cookieRedirectTo,
+              provider: oauth2,
+              has_trusted_origins: origins.length > 0,
+              request_origin: requestOrigin
+            }
+          });
+          throw new AuthSecurityError(
+            "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
+            "Invalid redirect path. Potential open redirect attack detected."
+          );
+        }
+      }
+      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token, logger);
+      const sessionCookie = await createSessionCookie(jose, userInfo);
+      const csrfToken = await createCSRF(jose);
+      logger?.log("OAUTH_CALLBACK_SUCCESS", {
+        structuredData: {
+          provider: oauth2
+        }
+      });
+      const headers = new HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
+      return Response.json({ oauth: oauth2 }, { status: 302, headers });
+    },
+    callbackConfig(oauth)
+  );
+};
+
+export {
+  callbackAction
+};

package/dist/chunk-OVHNRULD.js

@@ -0,0 +1,33 @@
+// src/oauth/discord.ts
+var discord = (options) => {
+  return {
+    id: "discord",
+    name: "Discord",
+    authorizeURL: "https://discord.com/oauth2/authorize",
+    accessToken: "https://discord.com/api/oauth2/token",
+    userInfo: "https://discord.com/api/users/@me",
+    scope: "identify email",
+    responseType: "code",
+    profile(profile) {
+      let image = "";
+      if (profile.avatar === null) {
+        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
+        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
+      } else {
+        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
+        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
+      }
+      return {
+        sub: profile.id,
+        name: profile.global_name ?? profile.username,
+        email: profile.email ?? "",
+        image
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  discord
+};

package/dist/chunk-PDP3PHB3.js

@@ -0,0 +1,127 @@
+import {
+  mailchimp
+} from "./chunk-LDU7A2JE.js";
+import {
+  notion
+} from "./chunk-PHYNROD4.js";
+import {
+  pinterest
+} from "./chunk-E6G5YCI6.js";
+import {
+  spotify
+} from "./chunk-IPKO6UQN.js";
+import {
+  strava
+} from "./chunk-54CZPKR4.js";
+import {
+  twitch
+} from "./chunk-2GQLSIJ2.js";
+import {
+  x
+} from "./chunk-EEE7UM5T.js";
+import {
+  atlassian
+} from "./chunk-C3A37LQC.js";
+import {
+  bitbucket
+} from "./chunk-4YHJ4IEQ.js";
+import {
+  discord
+} from "./chunk-OVHNRULD.js";
+import {
+  dropbox
+} from "./chunk-QQEKY4XP.js";
+import {
+  figma
+} from "./chunk-KMMAZFSJ.js";
+import {
+  github
+} from "./chunk-FW4W3REU.js";
+import {
+  gitlab
+} from "./chunk-5LZ7TOM3.js";
+import {
+  OAuthEnvSchema,
+  OAuthProviderCredentialsSchema
+} from "./chunk-2A5B7GWR.js";
+import {
+  formatZodError
+} from "./chunk-LX3TJ2TJ.js";
+import {
+  getEnv
+} from "./chunk-WHNDRO3N.js";
+import {
+  AuthInternalError
+} from "./chunk-U5663F2U.js";
+
+// src/oauth/index.ts
+var builtInOAuthProviders = {
+  github,
+  bitbucket,
+  figma,
+  discord,
+  gitlab,
+  spotify,
+  x,
+  strava,
+  mailchimp,
+  pinterest,
+  twitch,
+  notion,
+  dropbox,
+  atlassian
+};
+var defineOAuthEnvironment = (oauth) => {
+  const loadEnvs = OAuthEnvSchema.safeParse({
+    clientId: getEnv(`${oauth.toUpperCase()}_CLIENT_ID`),
+    clientSecret: getEnv(`${oauth.toUpperCase()}_CLIENT_SECRET`)
+  });
+  if (!loadEnvs.success) {
+    const msg = JSON.stringify({ [oauth]: formatZodError(loadEnvs.error) }, null, 2);
+    throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
+  }
+  return loadEnvs.data;
+};
+var defineOAuthProviderConfig = (config) => {
+  if (typeof config === "string") {
+    const definition = defineOAuthEnvironment(config);
+    const oauthConfig = builtInOAuthProviders[config]();
+    const parsed2 = OAuthProviderCredentialsSchema.safeParse({ ...oauthConfig, ...definition });
+    if (!parsed2.success) {
+      const details = JSON.stringify({ [config]: formatZodError(parsed2.error) }, null, 2);
+      throw new AuthInternalError(
+        "INVALID_OAUTH_PROVIDER_CONFIGURATION",
+        `Invalid configuration for OAuth provider "${config}": ${details}`
+      );
+    }
+    return parsed2.data;
+  }
+  const hasCredentials = config.clientId && config.clientSecret;
+  const envConfig = hasCredentials ? {} : defineOAuthEnvironment(config.id);
+  const parsed = OAuthProviderCredentialsSchema.safeParse({ ...envConfig, ...config });
+  if (!parsed.success) {
+    const details = JSON.stringify({ [config.id]: formatZodError(parsed.error) }, null, 2);
+    throw new AuthInternalError(
+      "INVALID_OAUTH_PROVIDER_CONFIGURATION",
+      `Invalid configuration for OAuth provider "${config.id}": ${details}`
+    );
+  }
+  return parsed.data;
+};
+var createBuiltInOAuthProviders = (oauth = []) => {
+  return oauth.reduce((previous, config) => {
+    const oauthConfig = defineOAuthProviderConfig(config);
+    if (oauthConfig.id in previous) {
+      throw new AuthInternalError(
+        "DUPLICATED_OAUTH_PROVIDER_ID",
+        `Duplicate OAuth provider id "${oauthConfig.id}" found. Each provider must have a unique id.`
+      );
+    }
+    return { ...previous, [oauthConfig.id]: oauthConfig };
+  }, {});
+};
+
+export {
+  builtInOAuthProviders,
+  createBuiltInOAuthProviders
+};

package/dist/chunk-PHYNROD4.js

@@ -0,0 +1,47 @@
+import {
+  createBasicAuthHeader
+} from "./chunk-LX3TJ2TJ.js";
+
+// src/oauth/notion.ts
+var notion = (options) => {
+  return {
+    id: "notion",
+    name: "Notion",
+    authorize: {
+      url: "https://api.notion.com/v1/oauth/authorize",
+      params: {
+        owner: "user",
+        scope: "user:read",
+        responseType: "code"
+      }
+    },
+    accessToken: {
+      url: "https://api.notion.com/v1/oauth/token",
+      headers: {
+        Authorization: createBasicAuthHeader(
+          options?.clientId ?? "NOTION_CLIENT_ID",
+          options?.clientSecret ?? "NOTION_CLIENT_SECRET"
+        )
+      }
+    },
+    userInfo: {
+      url: "https://api.notion.com/v1/users/me",
+      headers: {
+        "Notion-Version": "2022-06-28"
+      }
+    },
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.name,
+        image: profile.avatar_url ?? "",
+        email: profile?.bot?.owner?.user?.person?.email
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  notion
+};

package/dist/chunk-QQEKY4XP.js

@@ -0,0 +1,29 @@
+// src/oauth/dropbox.ts
+var dropbox = (options) => {
+  return {
+    id: "dropbox",
+    name: "Dropbox",
+    authorize: {
+      url: "https://www.dropbox.com/oauth2/authorize",
+      params: { scope: "account_info.read" }
+    },
+    accessToken: "https://api.dropboxapi.com/oauth2/token",
+    userInfo: {
+      method: "POST",
+      url: "https://api.dropboxapi.com/2/users/get_current_account"
+    },
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name.display_name,
+        email: profile.email,
+        image: profile.profile_photo_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  dropbox
+};