@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/index.d.ts

@@ -1,95 +1,14 @@
-import { d as AuthConfig, e as JoseInstance } from './index-B8jeIElf.js';
-export { f as AuthInstance, C as CookieConfig, E as ErrorType, O as OAuthProvider, g as OAuthProviderConfig, h as OAuthProviderCredentials, S as Session, U as User } from './index-B8jeIElf.js';
-import * as _aura_stack_router from '@aura-stack/router';
-export { createClient } from '@aura-stack/router';
-import * as zod_v4_core from 'zod/v4/core';
-import * as zod from 'zod';
-import './@types/router.d.js';
+export { q as AuthAPI, p as AuthClient, l as AuthClientOptions, A as AuthConfig, r as AuthInstance, B as BuiltInOAuthProvider, C as CookieConfig, E as ErrorType, G as GetSessionAPIOptions, s as JoseInstance, L as LogLevel, t as Logger, k as OAuthProvider, u as OAuthProviderConfig, j as OAuthProviderCredentials, m as Session, g as SignInAPIOptions, n as SignInOptions, i as SignOutAPIOptions, o as SignOutOptions, T as TrustedOrigin, U as User, v as builtInOAuthProviders, w as createAuth, x as createSyslogMessage } from './index-_aXtxb_s.js';
+export { createAuthClient, createClient } from './client/client.js';
+export { Client, ClientOptions } from '@aura-stack/router/types';
+export { LiteralUnion, Prettify } from './@types/utility.js';
+import 'zod';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
-import './@types/utility.js';
-
-/**
- * Creates the authentication instance with the configuration provided for OAuth provider.
- * > NOTE: The handlers returned by this function should be used in the server to handle the authentication routes
- * and within the `/auth` base path
- *
- * @param authConfig - Authentication configuration including OAuth provider
- * @returns Authentication instance with handlers to be used in the server
- * @example
- * const auth = createAuth({
- *   oauth: ["github", {
- *     id: "custom-oauth",
- *     name: "custom-oauth",
- *     authorizationURL: "https://custom-oauth.com/oauth/authorize",
- *     accessToken: "https://custom-oauth.com/oauth/token",
- *     scope: "profile email",
- *     responseType: "code",
- *     userInfo: "https://custom-oauth.com/api/userinfo",
- *     clientId: process.env.AURA_AUTH_CUSTOM_OAUTH_CLIENT_ID!,
- *     clientSecret: process.env.AURA_AUTH_CUSTOM_OAUTH_CLIENT_SECRET!,
- *   }]
- * })
- */
-declare const createAuth: (authConfig: AuthConfig) => {
-    handlers: _aura_stack_router.Router<[_aura_stack_router.RouteEndpoint<"GET", "/signIn/:oauth", {
-        schemas?: {
-            params: zod.ZodObject<{
-                oauth: zod.ZodEnum<{
-                    [x: string & Record<never, never>]: string & Record<never, never>;
-                    github: "github";
-                    bitbucket: "bitbucket";
-                    figma: "figma";
-                    discord: "discord";
-                    gitlab: "gitlab";
-                    spotify: "spotify";
-                    x: "x";
-                    strava: "strava";
-                    mailchimp: "mailchimp";
-                    pinterest: "pinterest";
-                }>;
-            }, zod_v4_core.$strip>;
-            searchParams: zod.ZodObject<{
-                redirectTo: zod.ZodOptional<zod.ZodString>;
-            }, zod_v4_core.$strip>;
-        } | undefined;
-    }>, _aura_stack_router.RouteEndpoint<"GET", "/callback/:oauth", {
-        schemas?: {
-            params: zod.ZodObject<{
-                oauth: zod.ZodEnum<{
-                    [x: string & Record<never, never>]: string & Record<never, never>;
-                    github: "github";
-                    bitbucket: "bitbucket";
-                    figma: "figma";
-                    discord: "discord";
-                    gitlab: "gitlab";
-                    spotify: "spotify";
-                    x: "x";
-                    strava: "strava";
-                    mailchimp: "mailchimp";
-                    pinterest: "pinterest";
-                }>;
-            }, zod_v4_core.$strip>;
-            searchParams: zod.ZodObject<{
-                code: zod.ZodString;
-                state: zod.ZodString;
-            }, zod_v4_core.$strip>;
-        } | undefined;
-    }>, _aura_stack_router.RouteEndpoint<"GET", "/session", {
-        schemas?: _aura_stack_router.EndpointSchemas | undefined;
-    }>, _aura_stack_router.RouteEndpoint<"POST", "/signOut", {
-        schemas?: {
-            searchParams: zod.ZodObject<{
-                token_type_hint: zod.ZodLiteral<"session_token">;
-                redirectTo: zod.ZodOptional<zod.ZodString>;
-            }, zod_v4_core.$strip>;
-        } | undefined;
-    }>, _aura_stack_router.RouteEndpoint<"GET", "/csrfToken", {
-        schemas?: _aura_stack_router.EndpointSchemas | undefined;
-    }>]>;
-    jose: JoseInstance;
-};
-
-export { AuthConfig, JoseInstance, createAuth };
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';

package/dist/index.js

@@ -1,91 +1,59 @@
+import "./chunk-5X7JZMEF.js";
 import {
-  createBuiltInOAuthProviders
-} from "./chunk-EMKJA2GJ.js";
-import "./chunk-42XB3YCW.js";
-import "./chunk-FKRDCWBF.js";
-import "./chunk-IKHPGFCW.js";
-import "./chunk-KRNOMBXQ.js";
-import "./chunk-B737EUJV.js";
-import "./chunk-HP34YGGJ.js";
-import "./chunk-E3OXBRYF.js";
-import "./chunk-6R2YZ4AC.js";
-import "./chunk-DIVDFNAP.js";
-import "./chunk-ITQ7352M.js";
-import {
-  signOutAction
-} from "./chunk-A3N4PVAT.js";
-import {
-  callbackAction
-} from "./chunk-KSWLO5ZU.js";
-import "./chunk-GA2SMTJO.js";
-import "./chunk-IVET23KF.js";
-import {
-  csrfTokenAction
-} from "./chunk-HT4YLL7N.js";
-import {
-  sessionAction
-} from "./chunk-JVFTCTTE.js";
-import {
-  signInAction
-} from "./chunk-3EUWD5BB.js";
-import "./chunk-N4SX7TZT.js";
-import "./chunk-FIPU4MLT.js";
-import "./chunk-IUYZQTJV.js";
-import {
-  createCookieStore
-} from "./chunk-W6LG7BFW.js";
-import "./chunk-STHEPPUZ.js";
-import {
-  createJoseInstance
-} from "./chunk-TLE4PXY3.js";
-import "./chunk-N2APGLXA.js";
+  createAuthClient,
+  createClient
+} from "./chunk-4RWSYUKX.js";
 import {
-  onErrorHandler,
-  useSecureCookies
-} from "./chunk-CXLATHS5.js";
-import "./chunk-EIL2FPSS.js";
-import "./chunk-RRLIF4PQ.js";
+  createAuth
+} from "./chunk-CWX724AG.js";
+import "./chunk-ITQ7352M.js";
+import "./chunk-NHZBQNRR.js";
+import "./chunk-GNNBM2WJ.js";
+import "./chunk-FPCVZUVG.js";
+import "./chunk-UN7X6SU5.js";
+import "./chunk-7YYXFKLR.js";
+import "./chunk-3J5TUH2I.js";
+import "./chunk-7BE46WWS.js";
+import "./chunk-LAYPUDQF.js";
+import "./chunk-CITNGXDA.js";
+import "./chunk-JOCGX3RP.js";
+import "./chunk-D2CSIUKP.js";
+import "./chunk-LATR3NIV.js";
+import "./chunk-KBXWTD6E.js";
 import "./chunk-ZNCZVF6U.js";
-import "./chunk-YRCB5FLE.js";
-
-// src/index.ts
-import "dotenv/config";
-import { createRouter, createClient } from "@aura-stack/router";
-var createInternalConfig = (authConfig) => {
-  const useSecure = authConfig?.trustedProxyHeaders ?? false;
-  return {
-    basePath: authConfig?.basePath ?? "/auth",
-    onError: onErrorHandler,
-    context: {
-      oauth: createBuiltInOAuthProviders(authConfig?.oauth),
-      cookies: createCookieStore(useSecure, authConfig?.cookies?.prefix, authConfig?.cookies?.overrides ?? {}),
-      jose: createJoseInstance(authConfig?.secret),
-      secret: authConfig?.secret,
-      basePath: authConfig?.basePath ?? "/auth",
-      trustedProxyHeaders: useSecure
-    },
-    middlewares: [
-      (ctx) => {
-        const useSecure2 = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
-        const cookies = createCookieStore(useSecure2, authConfig?.cookies?.prefix, authConfig?.cookies?.overrides ?? {});
-        ctx.context.cookies = cookies;
-        return ctx;
-      }
-    ]
-  };
-};
-var createAuth = (authConfig) => {
-  const config = createInternalConfig(authConfig);
-  const router = createRouter(
-    [signInAction(config.context.oauth), callbackAction(config.context.oauth), sessionAction, signOutAction, csrfTokenAction],
-    config
-  );
-  return {
-    handlers: router,
-    jose: config.context.jose
-  };
-};
+import "./chunk-V6LLEAR4.js";
+import "./chunk-2IR674WX.js";
+import {
+  builtInOAuthProviders
+} from "./chunk-PDP3PHB3.js";
+import "./chunk-LDU7A2JE.js";
+import "./chunk-PHYNROD4.js";
+import "./chunk-E6G5YCI6.js";
+import "./chunk-IPKO6UQN.js";
+import "./chunk-54CZPKR4.js";
+import "./chunk-2GQLSIJ2.js";
+import "./chunk-EEE7UM5T.js";
+import "./chunk-C3A37LQC.js";
+import "./chunk-4YHJ4IEQ.js";
+import "./chunk-OVHNRULD.js";
+import "./chunk-QQEKY4XP.js";
+import "./chunk-KMMAZFSJ.js";
+import "./chunk-FW4W3REU.js";
+import "./chunk-5LZ7TOM3.js";
+import {
+  createSyslogMessage
+} from "./chunk-U4RK4LKJ.js";
+import "./chunk-2A5B7GWR.js";
+import "./chunk-UZQJJD6A.js";
+import "./chunk-LX3TJ2TJ.js";
+import "./chunk-XY5R3EHH.js";
+import "./chunk-WHNDRO3N.js";
+import "./chunk-U5663F2U.js";
+import "./chunk-EBAMFRB7.js";
 export {
+  builtInOAuthProviders,
   createAuth,
-  createClient
+  createAuthClient,
+  createClient,
+  createSyslogMessage
 };

package/dist/jose.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,30 +15,56 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/jose.ts
 var jose_exports = {};
 __export(jose_exports, {
-  createJoseInstance: () => createJoseInstance
+  base64url: () => import_jose2.base64url,
+  createJoseInstance: () => createJoseInstance,
+  decodeJWTOptions: () => decodeJWTOptions,
+  encoder: () => import_crypto.encoder,
+  getRandomBytes: () => import_crypto.getRandomBytes,
+  getSubtleCrypto: () => import_crypto.getSubtleCrypto,
+  jwtVerificationOptions: () => jwtVerificationOptions
 });
 module.exports = __toCommonJS(jose_exports);
-var import_config = require("dotenv/config");
-var import_jose = require("@aura-stack/jose");
 
-// src/secure.ts
-var import_crypto = __toESM(require("crypto"), 1);
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
 
-// src/utils.ts
-var import_router = require("@aura-stack/router");
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
 
 // src/errors.ts
 var AuthInternalError = class extends Error {
@@ -54,38 +78,89 @@ var AuthInternalError = class extends Error {
   }
 };
 
-// src/secure.ts
-var createDerivedSalt = (secret) => {
-  return import_crypto.default.createHash("sha256").update(secret).update("aura-auth-salt").digest("hex");
-};
-
 // src/jose.ts
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto = require("@aura-stack/jose/crypto");
 var createJoseInstance = (secret) => {
-  const env = process.env;
-  secret ??= env.AURA_AUTH_SECRET ?? env.AUTH_SECRET;
+  secret ??= getEnv("SECRET");
   if (!secret) {
     throw new AuthInternalError(
       "JOSE_INITIALIZATION_FAILED",
       "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
     );
   }
-  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT ?? createDerivedSalt(secret);
-  const { derivedKey: derivedSigningKey } = (0, import_jose.createDeriveKey)(secret, salt, "signing");
-  const { derivedKey: derivedEncryptionKey } = (0, import_jose.createDeriveKey)(secret, salt, "encryption");
-  const { derivedKey: derivedCsrfTokenKey } = (0, import_jose.createDeriveKey)(secret, salt, "csrfToken");
-  const { decodeJWT, encodeJWT } = (0, import_jose.createJWT)({ jws: derivedSigningKey, jwe: derivedEncryptionKey });
-  const { signJWS, verifyJWS } = (0, import_jose.createJWS)(derivedCsrfTokenKey);
-  const { encryptJWE, decryptJWE } = (0, import_jose.createJWE)(derivedEncryptionKey);
+  const salt = getEnv("SALT");
+  if (!salt) {
+    throw new AuthInternalError(
+      "JOSE_INITIALIZATION_FAILED",
+      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
+    );
+  }
+  try {
+    (0, import_jose.createSecret)(salt);
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_SALT_SECRET_VALUE",
+      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
+      { cause: error }
+    );
+  }
+  const jose = (async () => {
+    const derivedSigningKey = await (0, import_jose.createDeriveKey)(secret, salt, "signing");
+    const derivedEncryptionKey = await (0, import_jose.createDeriveKey)(secret, salt, "encryption");
+    const derivedCsrfTokenKey = await (0, import_jose.createDeriveKey)(secret, salt, "csrfToken");
+    return {
+      jwt: (0, import_jose.createJWT)({ jws: derivedSigningKey, jwe: derivedEncryptionKey }),
+      jws: (0, import_jose.createJWS)(derivedCsrfTokenKey),
+      jwe: (0, import_jose.createJWE)(derivedEncryptionKey)
+    };
+  })();
+  jose.catch(() => {
+  });
   return {
-    decodeJWT,
-    encodeJWT,
-    signJWS,
-    verifyJWS,
-    encryptJWE,
-    decryptJWE
+    decodeJWT: async (token, options) => {
+      const { jwt } = await jose;
+      return jwt.decodeJWT(token, options);
+    },
+    encodeJWT: async (payload) => {
+      const { jwt } = await jose;
+      return jwt.encodeJWT(payload);
+    },
+    signJWS: async (...args) => {
+      const { jws } = await jose;
+      return jws.signJWS(...args);
+    },
+    verifyJWS: async (...args) => {
+      const { jws } = await jose;
+      return jws.verifyJWS(...args);
+    },
+    encryptJWE: async (...args) => {
+      const { jwe } = await jose;
+      return jwe.encryptJWE(...args);
+    },
+    decryptJWE: async (...args) => {
+      const { jwe } = await jose;
+      return jwe.decryptJWE(...args);
+    }
   };
 };
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
+};
+var decodeJWTOptions = {
+  jws: jwtVerificationOptions,
+  jwt: {
+    typ: "JWT"
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createJoseInstance
+  base64url,
+  createJoseInstance,
+  decodeJWTOptions,
+  encoder,
+  getRandomBytes,
+  getSubtleCrypto,
+  jwtVerificationOptions
 });

package/dist/jose.d.ts

@@ -1,23 +1,12 @@
-import * as _aura_stack_jose from '@aura-stack/jose';
-import * as _aura_stack_jose_jose from '@aura-stack/jose/jose';
-export { JWTPayload } from '@aura-stack/jose/jose';
-
-/**
- * Creates the JOSE instance used for signing and verifying tokens. It derives keys
- * for session tokens and CSRF tokens. For security and determinism, it uses the
- * `AURA_AUTH_SALT` environment variable if available; otherwise,it uses a derived
- * salt based on the provided secret.
- *
- * @param secret the base secret for key derivation
- * @returns jose instance with methods for encoding/decoding JWTs and signing/verifying JWSs
- */
-declare const createJoseInstance: (secret?: string) => {
-    decodeJWT: (token: string) => Promise<_aura_stack_jose_jose.JWTPayload>;
-    encodeJWT: (payload: _aura_stack_jose_jose.JWTPayload) => Promise<string>;
-    signJWS: (payload: _aura_stack_jose_jose.JWTPayload) => Promise<string>;
-    verifyJWS: (payload: string, options?: _aura_stack_jose.JWTVerifyOptions) => Promise<_aura_stack_jose_jose.JWTPayload>;
-    encryptJWE: (payload: string, options?: _aura_stack_jose.EncryptOptions) => Promise<string>;
-    decryptJWE: (payload: string, options?: _aura_stack_jose.JWTDecryptOptions) => Promise<string>;
-};
-
-export { createJoseInstance };
+import '@aura-stack/jose';
+export { JWTPayload, base64url } from '@aura-stack/jose/jose';
+export { encoder, getRandomBytes, getSubtleCrypto } from '@aura-stack/jose/crypto';
+export { K as createJoseInstance, M as decodeJWTOptions, N as jwtVerificationOptions } from './index-_aXtxb_s.js';
+import 'zod';
+import './schemas.js';
+import 'zod/v4';
+import '@aura-stack/router/cookie';
+import './@types/utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';

package/dist/jose.js

@@ -1,10 +1,20 @@
 import {
-  createJoseInstance
-} from "./chunk-TLE4PXY3.js";
-import "./chunk-N2APGLXA.js";
-import "./chunk-CXLATHS5.js";
-import "./chunk-EIL2FPSS.js";
-import "./chunk-RRLIF4PQ.js";
+  base64url,
+  createJoseInstance,
+  decodeJWTOptions,
+  encoder,
+  getRandomBytes,
+  getSubtleCrypto,
+  jwtVerificationOptions
+} from "./chunk-UZQJJD6A.js";
+import "./chunk-WHNDRO3N.js";
+import "./chunk-U5663F2U.js";
 export {
-  createJoseInstance
+  base64url,
+  createJoseInstance,
+  decodeJWTOptions,
+  encoder,
+  getRandomBytes,
+  getSubtleCrypto,
+  jwtVerificationOptions
 };