@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/{chunk-W6LG7BFW.js → chunk-XY5R3EHH.js}

@@ -1,6 +1,9 @@
+import {
+  env
+} from "./chunk-WHNDRO3N.js";
 import {
   AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
+} from "./chunk-U5663F2U.js";
 
 // src/cookie.ts
 import { parse, parseSetCookie, serialize } from "@aura-stack/router/cookie";
@@ -37,10 +40,11 @@ var setCookie = (cookieName, value, options) => {
 var expiredCookieAttributes = {
   ...defaultCookieOptions,
   expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0
+  maxAge: 0,
+  secure: true
 };
 var getCookie = (request, cookieName) => {
-  const cookies = request.headers.get("Cookie");
+  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
   if (!cookies) {
     throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
   }
@@ -69,31 +73,27 @@ var createSessionCookie = async (jose, session) => {
     throw new AuthInternalError("INVALID_JWT_TOKEN", "Failed to create session cookie", { cause: error });
   }
 };
-var defineSecureCookieOptions = (useSecure, attributes, strategy) => {
+var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
   if (!attributes.httpOnly) {
-    console.warn(
-      "[WARNING]: Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS risk."
-    );
+    logger?.log("COOKIE_HTTPONLY_DISABLED");
   }
   if (attributes.domain === "*") {
     attributes.domain = void 0;
-    console.warn("[WARNING]: Cookie 'Domain' is set to '*', which is insecure. Avoid wildcard domains.");
+    logger?.log("COOKIE_WILDCARD_DOMAIN");
   }
   if (!useSecure) {
     if (attributes.secure) {
-      console.warn(
-        "[WARNING]: The 'Secure' attribute will be disabled for this cookie. Serve over HTTPS to enforce Secure cookies."
-      );
+      logger?.log("COOKIE_SECURE_DISABLED");
     }
     if (attributes.sameSite == "none") {
       attributes.sameSite = "lax";
-      console.warn("[WARNING]: SameSite=None requires Secure attribute. Changing SameSite to 'Lax'.");
+      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
     }
-    if (process.env.NODE_ENV === "production") {
-      console.warn("[WARNING]: In production, ensure cookies are served over HTTPS to maintain security.");
+    if (env.NODE_ENV === "production") {
+      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
     }
     if (strategy === "host") {
-      console.warn("[WARNING]: __Host- cookies require a secure context. Falling back to standard cookie settings.");
+      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
     }
     return {
       ...defaultCookieOptions,
@@ -107,7 +107,7 @@ var defineSecureCookieOptions = (useSecure, attributes, strategy) => {
     ...defaultHostCookieConfig
   } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
 };
-var createCookieStore = (useSecure, prefix, overrides) => {
+var createCookieStore = (useSecure, prefix, overrides, logger) => {
   prefix ??= COOKIE_NAME;
   const securePrefix = useSecure ? "__Secure-" : "";
   const hostPrefix = useSecure ? "__Host-" : "";
@@ -120,7 +120,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...defaultCookieOptions,
           ...overrides?.sessionToken?.attributes
         },
-        overrides?.sessionToken?.attributes?.strategy ?? "secure"
+        overrides?.sessionToken?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     state: {
@@ -131,7 +132,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.state?.attributes
         },
-        overrides?.state?.attributes?.strategy ?? "secure"
+        overrides?.state?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     csrfToken: {
@@ -140,9 +142,11 @@ var createCookieStore = (useSecure, prefix, overrides) => {
         useSecure,
         {
           ...overrides?.csrfToken?.attributes,
-          ...defaultHostCookieConfig
+          ...defaultHostCookieConfig,
+          sameSite: "strict"
         },
-        overrides?.csrfToken?.attributes?.strategy ?? "host"
+        overrides?.csrfToken?.attributes?.strategy ?? "host",
+        logger
       )
     },
     redirectTo: {
@@ -153,7 +157,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.redirectTo?.attributes
         },
-        overrides?.redirectTo?.attributes?.strategy ?? "secure"
+        overrides?.redirectTo?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     redirectURI: {
@@ -164,7 +169,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.redirectURI?.attributes
         },
-        overrides?.redirectURI?.attributes?.strategy ?? "secure"
+        overrides?.redirectURI?.attributes?.strategy ?? "secure",
+        logger
       )
     },
     codeVerifier: {
@@ -175,7 +181,8 @@ var createCookieStore = (useSecure, prefix, overrides) => {
           ...oauthCookieOptions,
           ...overrides?.codeVerifier?.attributes
         },
-        overrides?.codeVerifier?.attributes?.strategy ?? "secure"
+        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
+        logger
       )
     }
   };

package/dist/client/client.cjs

@@ -0,0 +1,135 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/client.ts
+var client_exports = {};
+__export(client_exports, {
+  createAuthClient: () => createAuthClient,
+  createClient: () => createClient
+});
+module.exports = __toCommonJS(client_exports);
+
+// src/errors.ts
+var AuthClientError = class extends Error {
+  type = "AUTH_CLIENT_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+var isNativeError = (error) => {
+  return error instanceof Error;
+};
+
+// src/client/client.ts
+var import_router = require("@aura-stack/router");
+var createClient = import_router.createClient;
+var createAuthClient = (options) => {
+  if (typeof window === "undefined" && !options.baseURL) {
+    throw new AuthClientError("`baseURL` is required when createAuthClient is used outside the browser.");
+  }
+  const client = createClient({
+    cache: "no-store",
+    credentials: "include",
+    baseURL: options.baseURL ?? window.location.origin,
+    ...options
+  });
+  const getCSRFToken = async () => {
+    try {
+      const response = await client.get("/csrfToken");
+      if (!response.ok) return null;
+      const data = await response.json();
+      return data.csrfToken;
+    } catch (error) {
+      console.error("Error fetching CSRF token:", error);
+      return null;
+    }
+  };
+  const getSession = async () => {
+    try {
+      const response = await client.get("/session");
+      if (!response.ok) return null;
+      const session = await response.json();
+      if (!session?.authenticated) return null;
+      return session.session;
+    } catch (error) {
+      console.error("Error fetching session:", error);
+      return null;
+    }
+  };
+  const signIn = async (oauth, options2) => {
+    try {
+      const response = await client.get("/signIn/:oauth", {
+        params: {
+          oauth
+        },
+        searchParams: {
+          ...options2,
+          redirect: false
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.signInURL) {
+        window.location.assign(json.signInURL);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-in:", error);
+      return { redirect: false, signInURL: "/" };
+    }
+  };
+  const signOut = async (options2) => {
+    try {
+      const csrfToken = await getCSRFToken();
+      if (!csrfToken) {
+        throw new AuthClientError("Failed to fetch CSRF token for sign-out.");
+      }
+      const response = await client.post("/signOut", {
+        searchParams: {
+          redirectTo: options2?.redirectTo ?? "/",
+          token_type_hint: "session_token"
+        },
+        headers: {
+          "X-CSRF-Token": csrfToken
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.url) {
+        window.location.assign(json.url);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-out:", error);
+      throw isNativeError(error) ? error : new AuthClientError("Sign-out failed.", "The sign-out request failed.", { cause: error });
+    }
+  };
+  return {
+    getSession,
+    signIn,
+    signOut
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createAuthClient,
+  createClient
+});

package/dist/client/client.d.ts

@@ -0,0 +1,85 @@
+import { l as AuthClientOptions, m as Session, B as BuiltInOAuthProvider, n as SignInOptions, o as SignOutOptions } from '../index-_aXtxb_s.js';
+import '@aura-stack/router/types';
+import * as zod_v4_core from 'zod/v4/core';
+import * as zod from 'zod';
+import * as _aura_stack_router from '@aura-stack/router';
+import { LiteralUnion } from '../@types/utility.js';
+import '../schemas.js';
+import 'zod/v4';
+import '@aura-stack/jose';
+import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
+import 'jose';
+
+declare const createClient: (options: _aura_stack_router.ClientOptions) => _aura_stack_router.Client<[_aura_stack_router.RouteEndpoint<"GET", "/signIn/:oauth", {
+    schemas?: {
+        params: zod.ZodObject<{
+            oauth: zod.ZodEnum<{
+                [x: string & Record<never, never>]: string & Record<never, never>;
+                github: "github";
+                bitbucket: "bitbucket";
+                figma: "figma";
+                discord: "discord";
+                gitlab: "gitlab";
+                spotify: "spotify";
+                x: "x";
+                strava: "strava";
+                mailchimp: "mailchimp";
+                pinterest: "pinterest";
+                twitch: "twitch";
+                notion: "notion";
+                dropbox: "dropbox";
+                atlassian: "atlassian";
+            }>;
+        }, zod_v4_core.$strip>;
+        searchParams: zod.ZodObject<{
+            redirect: zod.ZodDefault<zod.ZodOptional<zod.ZodCodec<zod.ZodString, zod.ZodBoolean>>>;
+            redirectTo: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strip>;
+    } | undefined;
+}>, _aura_stack_router.RouteEndpoint<"GET", "/callback/:oauth", {
+    schemas?: {
+        params: zod.ZodObject<{
+            oauth: zod.ZodEnum<{
+                [x: string & Record<never, never>]: string & Record<never, never>;
+                github: "github";
+                bitbucket: "bitbucket";
+                figma: "figma";
+                discord: "discord";
+                gitlab: "gitlab";
+                spotify: "spotify";
+                x: "x";
+                strava: "strava";
+                mailchimp: "mailchimp";
+                pinterest: "pinterest";
+                twitch: "twitch";
+                notion: "notion";
+                dropbox: "dropbox";
+                atlassian: "atlassian";
+            }>;
+        }, zod_v4_core.$strip>;
+        searchParams: zod.ZodObject<{
+            code: zod.ZodString;
+            state: zod.ZodString;
+        }, zod_v4_core.$strip>;
+    } | undefined;
+}>, _aura_stack_router.RouteEndpoint<"GET", "/session", {
+    schemas?: _aura_stack_router.EndpointSchemas | undefined;
+}>, _aura_stack_router.RouteEndpoint<"POST", "/signOut", {
+    schemas?: {
+        searchParams: zod.ZodObject<{
+            token_type_hint: zod.ZodLiteral<"session_token">;
+            redirectTo: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strip>;
+    } | undefined;
+}>, _aura_stack_router.RouteEndpoint<"GET", "/csrfToken", {
+    schemas?: _aura_stack_router.EndpointSchemas | undefined;
+}>]>;
+declare const createAuthClient: (options: AuthClientOptions) => {
+    getSession: () => Promise<Session | null>;
+    signIn: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: SignInOptions) => Promise<any>;
+    signOut: (options?: SignOutOptions) => Promise<any>;
+};
+
+export { createAuthClient, createClient };

package/dist/client/client.js

@@ -0,0 +1,9 @@
+import {
+  createAuthClient,
+  createClient
+} from "../chunk-4RWSYUKX.js";
+import "../chunk-U5663F2U.js";
+export {
+  createAuthClient,
+  createClient
+};

package/dist/client/index.cjs

@@ -0,0 +1,135 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/index.ts
+var client_exports = {};
+__export(client_exports, {
+  createAuthClient: () => createAuthClient,
+  createClient: () => createClient
+});
+module.exports = __toCommonJS(client_exports);
+
+// src/errors.ts
+var AuthClientError = class extends Error {
+  type = "AUTH_CLIENT_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+var isNativeError = (error) => {
+  return error instanceof Error;
+};
+
+// src/client/client.ts
+var import_router = require("@aura-stack/router");
+var createClient = import_router.createClient;
+var createAuthClient = (options) => {
+  if (typeof window === "undefined" && !options.baseURL) {
+    throw new AuthClientError("`baseURL` is required when createAuthClient is used outside the browser.");
+  }
+  const client = createClient({
+    cache: "no-store",
+    credentials: "include",
+    baseURL: options.baseURL ?? window.location.origin,
+    ...options
+  });
+  const getCSRFToken = async () => {
+    try {
+      const response = await client.get("/csrfToken");
+      if (!response.ok) return null;
+      const data = await response.json();
+      return data.csrfToken;
+    } catch (error) {
+      console.error("Error fetching CSRF token:", error);
+      return null;
+    }
+  };
+  const getSession = async () => {
+    try {
+      const response = await client.get("/session");
+      if (!response.ok) return null;
+      const session = await response.json();
+      if (!session?.authenticated) return null;
+      return session.session;
+    } catch (error) {
+      console.error("Error fetching session:", error);
+      return null;
+    }
+  };
+  const signIn = async (oauth, options2) => {
+    try {
+      const response = await client.get("/signIn/:oauth", {
+        params: {
+          oauth
+        },
+        searchParams: {
+          ...options2,
+          redirect: false
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.signInURL) {
+        window.location.assign(json.signInURL);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-in:", error);
+      return { redirect: false, signInURL: "/" };
+    }
+  };
+  const signOut = async (options2) => {
+    try {
+      const csrfToken = await getCSRFToken();
+      if (!csrfToken) {
+        throw new AuthClientError("Failed to fetch CSRF token for sign-out.");
+      }
+      const response = await client.post("/signOut", {
+        searchParams: {
+          redirectTo: options2?.redirectTo ?? "/",
+          token_type_hint: "session_token"
+        },
+        headers: {
+          "X-CSRF-Token": csrfToken
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.url) {
+        window.location.assign(json.url);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-out:", error);
+      throw isNativeError(error) ? error : new AuthClientError("Sign-out failed.", "The sign-out request failed.", { cause: error });
+    }
+  };
+  return {
+    getSession,
+    signIn,
+    signOut
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createAuthClient,
+  createClient
+});

package/dist/client/index.d.ts

@@ -0,0 +1,14 @@
+export { createAuthClient, createClient } from './client.js';
+export { p as AuthClient, l as AuthClientOptions, n as SignInOptions, o as SignOutOptions } from '../index-_aXtxb_s.js';
+export { Client, ClientOptions } from '@aura-stack/router/types';
+import 'zod/v4/core';
+import 'zod';
+import '@aura-stack/router';
+import '../@types/utility.js';
+import '../schemas.js';
+import 'zod/v4';
+import '@aura-stack/jose';
+import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
+import 'jose';

package/dist/client/index.js

@@ -0,0 +1,10 @@
+import "../chunk-5X7JZMEF.js";
+import {
+  createAuthClient,
+  createClient
+} from "../chunk-4RWSYUKX.js";
+import "../chunk-U5663F2U.js";
+export {
+  createAuthClient,
+  createClient
+};