@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/secure.js

@@ -1,19 +1,20 @@
 import {
   createCSRF,
-  createDerivedSalt,
   createHash,
   createPKCE,
+  createSecretValue,
   generateSecure,
   verifyCSRF
-} from "./chunk-N2APGLXA.js";
-import "./chunk-CXLATHS5.js";
-import "./chunk-EIL2FPSS.js";
-import "./chunk-RRLIF4PQ.js";
+} from "./chunk-V6LLEAR4.js";
+import "./chunk-UZQJJD6A.js";
+import "./chunk-LX3TJ2TJ.js";
+import "./chunk-WHNDRO3N.js";
+import "./chunk-U5663F2U.js";
 export {
   createCSRF,
-  createDerivedSalt,
   createHash,
   createPKCE,
+  createSecretValue,
   generateSecure,
   verifyCSRF
 };

package/dist/utils.cjs

@@ -20,17 +20,21 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/utils.ts
 var utils_exports = {};
 __export(utils_exports, {
+  AURA_AUTH_VERSION: () => AURA_AUTH_VERSION,
+  createBasicAuthHeader: () => createBasicAuthHeader,
+  createErrorHandler: () => createErrorHandler,
+  createStructuredData: () => createStructuredData,
   equals: () => equals,
+  extractPath: () => extractPath,
   formatZodError: () => formatZodError,
-  getNormalizedOriginPath: () => getNormalizedOriginPath,
-  isValidRelativePath: () => isValidRelativePath,
-  onErrorHandler: () => onErrorHandler,
-  sanitizeURL: () => sanitizeURL,
+  getBaseURL: () => getBaseURL,
+  getErrorName: () => getErrorName,
   toCastCase: () => toCastCase,
   toISOString: () => toISOString,
   toSnakeCase: () => toSnakeCase,
   toUpperCase: () => toUpperCase,
-  useSecureCookies: () => useSecureCookies
+  useSecureCookies: () => useSecureCookies,
+  validateRedirectTo: () => validateRedirectTo
 });
 module.exports = __toCommonJS(utils_exports);
 var import_router = require("@aura-stack/router");
@@ -78,7 +82,91 @@ var isAuthSecurityError = (error) => {
   return error instanceof AuthSecurityError;
 };
 
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
+var isValidURL = (value) => {
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
+};
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+
 // src/utils.ts
+var AURA_AUTH_VERSION = "0.4.0";
 var toSnakeCase = (str) => {
   return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
 };
@@ -95,95 +183,85 @@ var equals = (a, b) => {
   if (a === null || b === null || a === void 0 || b === void 0) return false;
   return a === b;
 };
-var sanitizeURL = (url) => {
-  try {
-    let decodedURL = decodeURIComponent(url).trim();
-    const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/);
-    let protocol = "";
-    let rest = decodedURL;
-    if (protocolMatch) {
-      protocol = protocolMatch[1];
-      rest = decodedURL.slice(protocol.length);
-      const slashIndex = rest.indexOf("/");
-      if (slashIndex === -1) {
-        return protocol + rest;
-      }
-      const domain = rest.slice(0, slashIndex);
-      let path = rest.slice(slashIndex).replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-      if (path !== "/" && path.endsWith("/")) {
-        path = path.replace(/\/+$/, "/");
-      } else if (path !== "/") {
-        path = path.replace(/\/+$/, "");
-      }
-      return protocol + domain + path;
+var createErrorHandler = (logger) => {
+  return (error) => {
+    if ((0, import_router.isRouterError)(error)) {
+      const { message, status, statusText } = error;
+      logger?.log("ROUTER_INTERNAL_ERROR");
+      return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
     }
-    let sanitized = decodedURL.replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-    if (sanitized !== "/" && sanitized.endsWith("/")) {
-      sanitized = sanitized.replace(/\/+$/, "/");
-    } else if (sanitized !== "/") {
-      sanitized = sanitized.replace(/\/+$/, "");
+    if ((0, import_router.isInvalidZodSchemaError)(error)) {
+      logger?.log("INVALID_REQUEST");
+      return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
     }
-    return sanitized;
-  } catch {
-    return url.trim();
-  }
-};
-var isValidRelativePath = (path) => {
-  if (!path || typeof path !== "string") return false;
-  if (!path.startsWith("/") || path.includes("://") || path.includes("\r") || path.includes("\n")) return false;
-  if (/[\x00-\x1F\x7F]/.test(path) || path.includes("\0")) return false;
-  const sanitized = sanitizeURL(path);
-  if (sanitized.includes("..")) return false;
-  return true;
-};
-var onErrorHandler = (error) => {
-  if ((0, import_router.isRouterError)(error)) {
-    const { message, status, statusText } = error;
-    return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
-  }
-  if ((0, import_router.isInvalidZodSchemaError)(error)) {
-    return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
-  }
-  if (isOAuthProtocolError(error)) {
-    const { error: errorCode, message, type, errorURI } = error;
-    return Response.json(
-      {
-        type,
-        error: errorCode,
-        error_description: message,
-        error_uri: errorURI
-      },
-      { status: 400 }
-    );
-  }
-  if (isAuthInternalError(error) || isAuthSecurityError(error)) {
-    const { type, code, message } = error;
+    if (isOAuthProtocolError(error)) {
+      const { error: errorCode, message, type, errorURI } = error;
+      logger?.log("OAUTH_PROTOCOL_ERROR", {
+        structuredData: {
+          error: errorCode,
+          error_description: message,
+          error_uri: errorURI ?? ""
+        }
+      });
+      return Response.json(
+        {
+          type,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    if (isAuthInternalError(error)) {
+      const { type, code, message } = error;
+      logger?.log("INVALID_OAUTH_CONFIGURATION", {
+        structuredData: {
+          error: code,
+          error_description: message
+        }
+      });
+      return Response.json(
+        {
+          type,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    if (isAuthSecurityError(error)) {
+      const { type, code, message } = error;
+      logger?.log("INVALID_OAUTH_CONFIGURATION", {
+        structuredData: {
+          error: code,
+          error_description: message
+        }
+      });
+      return Response.json(
+        {
+          type,
+          code,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    logger?.log("SERVER_ERROR");
     return Response.json(
-      {
-        type,
-        code,
-        message
-      },
-      { status: 400 }
+      { type: "SERVER_ERROR", code: "SERVER_ERROR", message: "An unexpected error occurred" },
+      { status: 500 }
     );
-  }
-  return Response.json({ type: "SERVER_ERROR", code: "server_error", message: "An unexpected error occurred" }, { status: 500 });
-};
-var getNormalizedOriginPath = (path) => {
-  try {
-    const url = new URL(path);
-    url.hash = "";
-    url.search = "";
-    return `${url.origin}${url.pathname}`;
-  } catch {
-    return sanitizeURL(path);
-  }
+  };
+};
+var getBaseURL = (request) => {
+  const url = new URL(request.url);
+  return `${url.origin}${url.pathname}`;
 };
 var toISOString = (date) => {
   return new Date(date).toISOString();
 };
 var useSecureCookies = (request, trustedProxyHeaders) => {
-  return trustedProxyHeaders ? request.url.startsWith("https://") || request.headers.get("X-Forwarded-Proto") === "https" || (request.headers.get("Forwarded")?.includes("proto=https") ?? false) : request.url.startsWith("https://");
+  const headers = request instanceof Headers ? request : request.headers;
+  const url = request instanceof Headers ? null : request.url;
+  return trustedProxyHeaders ? url?.startsWith("https://") || headers.get("X-Forwarded-Proto") === "https" || (headers.get("Forwarded")?.includes("proto=https") ?? false) : url?.startsWith("https://") ?? false;
 };
 var formatZodError = (error) => {
   if (!error.issues || error.issues.length === 0) {
@@ -200,17 +278,52 @@ var formatZodError = (error) => {
     };
   }, {});
 };
+var extractPath = (url) => {
+  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
+  const match = url.match(pathRegex);
+  return match && match[2] ? match[2] : "/";
+};
+var createStructuredData = (data, sdID = "metadata") => {
+  const entries = Object.entries(data);
+  if (entries.length === 0) return `[${sdID}]`;
+  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
+  return `[${sdID} ${values}]`;
+};
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
+  }
+  return typeof error === "string" ? error : "UnknownError";
+};
+var createBasicAuthHeader = (username, password) => {
+  const getUsername = getEnv(username.toUpperCase()) ?? username;
+  const getPassword = getEnv(password.toUpperCase()) ?? password;
+  if (!getUsername || !getPassword) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
+  }
+  const credentials = `${getUsername}:${getPassword}`;
+  return `Basic ${btoa(credentials)}`;
+};
+var validateRedirectTo = (url) => {
+  if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+  if (isRelativeURL(url)) return url;
+  return "/";
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AURA_AUTH_VERSION,
+  createBasicAuthHeader,
+  createErrorHandler,
+  createStructuredData,
   equals,
+  extractPath,
   formatZodError,
-  getNormalizedOriginPath,
-  isValidRelativePath,
-  onErrorHandler,
-  sanitizeURL,
+  getBaseURL,
+  getErrorName,
   toCastCase,
   toISOString,
   toSnakeCase,
   toUpperCase,
-  useSecureCookies
+  useSecureCookies,
+  validateRedirectTo
 });

package/dist/utils.d.ts

@@ -1,54 +1,35 @@
 import { RouterConfig } from '@aura-stack/router';
-import { i as APIErrorMap } from './index-B8jeIElf.js';
 import { ZodError } from 'zod';
+import { a as InternalLogger, f as APIErrorMap } from './index-_aXtxb_s.js';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
 import './@types/utility.js';
+import 'jose';
+import 'zod/v4/core';
 
+declare const AURA_AUTH_VERSION = "0.4.0";
 declare const toSnakeCase: (str: string) => string;
 declare const toUpperCase: (str: string) => string;
 declare const toCastCase: <Obj extends Record<string, string>, Type extends "snake" | "upper">(obj: Obj, type?: Type) => Type extends "snake" ? { [K in keyof Obj as `${string & K}`]: Obj[K]; } : { [K in keyof Obj as Uppercase<string & K>]: Obj[K]; };
 declare const equals: (a: string | number | undefined | null, b: string | number | undefined | null) => boolean;
-/**
- * Sanitizes a URL by removing dangerous patterns that could be used for path traversal
- * or other attacks. This function:
- * - Decodes URL-encoded characters
- * - Removes multiple consecutive slashes (preserving protocol slashes)
- * - Removes path traversal patterns (..)
- * - Removes trailing slashes (except root)
- * - Trims whitespace
- *
- * @param url - The URL or path to sanitize
- * @returns The sanitized URL or path
- */
-declare const sanitizeURL: (url: string) => string;
-/**
- * Validates that a path is a safe relative path to prevent open redirect attacks.
- * A safe relative path must:
- * - Start with '/'
- * - Not contain protocol schemes (://)
- * - Not contain newline characters
- * - Not contain null bytes
- * - Not be an absolute URL
- *
- * @param path - The path to validate
- * @returns true if the path is safe, false otherwise
- */
-declare const isValidRelativePath: (path: string | undefined | null) => boolean;
-declare const onErrorHandler: RouterConfig["onError"];
-/**
- * Extracts and normalizes the origin and pathname from a URL string.
- * Removes query parameters and hash fragments for a clean path.
- * Falls back to the original string if URL parsing fails.
- *
- * @param path - The URL or path string to process
- * @returns The normalized URL with origin and pathname, or the original path
- */
-declare const getNormalizedOriginPath: (path: string) => string;
+declare const createErrorHandler: (logger?: InternalLogger) => RouterConfig["onError"];
+declare const getBaseURL: (request: Request) => string;
 declare const toISOString: (date: Date | string | number) => string;
-declare const useSecureCookies: (request: Request, trustedProxyHeaders: boolean) => boolean;
+declare const useSecureCookies: (request: Request | Headers, trustedProxyHeaders: boolean) => boolean;
 declare const formatZodError: <T extends Record<string, unknown> = Record<string, unknown>>(error: ZodError<T>) => APIErrorMap;
+declare const extractPath: (url: string) => string;
+declare const createStructuredData: (data: Record<string, string | number | boolean>, sdID?: string) => string;
+declare const getErrorName: (error: unknown) => string;
+declare const createBasicAuthHeader: (username: string, password: string) => string;
+/**
+ * Validates and sanitizes redirect URLs to prevent open redirect attacks.
+ * Only relative URLs (starting with /) are allowed; absolute URLs are
+ * rejected and replaced with "/" to enforce same-origin redirects.
+ */
+declare const validateRedirectTo: (url: string) => string;
 
-export { equals, formatZodError, getNormalizedOriginPath, isValidRelativePath, onErrorHandler, sanitizeURL, toCastCase, toISOString, toSnakeCase, toUpperCase, useSecureCookies };
+export { AURA_AUTH_VERSION, createBasicAuthHeader, createErrorHandler, createStructuredData, equals, extractPath, formatZodError, getBaseURL, getErrorName, toCastCase, toISOString, toSnakeCase, toUpperCase, useSecureCookies, validateRedirectTo };

package/dist/utils.js

@@ -1,27 +1,36 @@
 import {
+  AURA_AUTH_VERSION,
+  createBasicAuthHeader,
+  createErrorHandler,
+  createStructuredData,
   equals,
+  extractPath,
   formatZodError,
-  getNormalizedOriginPath,
-  isValidRelativePath,
-  onErrorHandler,
-  sanitizeURL,
+  getBaseURL,
+  getErrorName,
   toCastCase,
   toISOString,
   toSnakeCase,
   toUpperCase,
-  useSecureCookies
-} from "./chunk-CXLATHS5.js";
-import "./chunk-RRLIF4PQ.js";
+  useSecureCookies,
+  validateRedirectTo
+} from "./chunk-LX3TJ2TJ.js";
+import "./chunk-WHNDRO3N.js";
+import "./chunk-U5663F2U.js";
 export {
+  AURA_AUTH_VERSION,
+  createBasicAuthHeader,
+  createErrorHandler,
+  createStructuredData,
   equals,
+  extractPath,
   formatZodError,
-  getNormalizedOriginPath,
-  isValidRelativePath,
-  onErrorHandler,
-  sanitizeURL,
+  getBaseURL,
+  getErrorName,
   toCastCase,
   toISOString,
   toSnakeCase,
   toUpperCase,
-  useSecureCookies
+  useSecureCookies,
+  validateRedirectTo
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aura-stack/auth",
-  "version": "0.4.0-rc.5",
+  "version": "0.5.0",
   "private": false,
   "type": "module",
   "description": "Core auth for @aura-stack/auth",
@@ -30,6 +30,11 @@
       "types": "./dist/@types/index.d.ts",
       "import": "./dist/@types/index.js",
       "require": "./dist/@types/index.cjs"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.js",
+      "require": "./dist/client/index.cjs"
     }
   },
   "keywords": [
@@ -44,13 +49,11 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@aura-stack/router": "0.6.0-rc.1",
-    "dotenv": "^17.2.3",
-    "zod": "^4.3.5",
-    "@aura-stack/jose": "0.2.0"
+    "@aura-stack/router": "^0.6.0",
+    "zod": "4.3.5",
+    "@aura-stack/jose": "0.4.0"
   },
   "devDependencies": {
-    "@types/node": "^24.9.2",
     "typescript": "^5.9.2",
     "@aura-stack/tsconfig": "0.0.0",
     "@aura-stack/tsup-config": "0.0.0"

package/dist/chunk-3EUWD5BB.js

@@ -1,63 +0,0 @@
-import {
-  createAuthorizationURL,
-  createRedirectTo,
-  createRedirectURI
-} from "./chunk-N4SX7TZT.js";
-import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
-import {
-  createPKCE,
-  generateSecure
-} from "./chunk-N2APGLXA.js";
-
-// src/actions/signIn/signIn.ts
-import { z } from "zod";
-import { createEndpoint, createEndpointConfig, HeadersBuilder } from "@aura-stack/router";
-var signInConfig = (oauth) => {
-  return createEndpointConfig("/signIn/:oauth", {
-    schemas: {
-      params: z.object({
-        oauth: z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: z.object({
-        redirectTo: z.string().optional()
-      })
-    }
-  });
-};
-var signInAction = (oauth) => {
-  return createEndpoint(
-    "GET",
-    "/signIn/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { redirectTo },
-        context: { oauth: providers, cookies, trustedProxyHeaders, basePath }
-      } = ctx;
-      const state = generateSecure();
-      const redirectURI = createRedirectURI(request, oauth2, basePath, trustedProxyHeaders);
-      const redirectToValue = createRedirectTo(request, redirectTo, trustedProxyHeaders);
-      const { codeVerifier, codeChallenge, method } = await createPKCE();
-      const authorization = createAuthorizationURL(providers[oauth2], redirectURI, state, codeChallenge, method);
-      const headers = new HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(cookies.state.name, state, cookies.state.attributes).setCookie(cookies.redirectURI.name, redirectURI, cookies.redirectURI.attributes).setCookie(cookies.redirectTo.name, redirectToValue, cookies.redirectTo.attributes).setCookie(cookies.codeVerifier.name, codeVerifier, cookies.codeVerifier.attributes).toHeaders();
-      return Response.json(
-        { oauth: oauth2 },
-        {
-          status: 302,
-          headers
-        }
-      );
-    },
-    signInConfig(oauth)
-  );
-};
-
-export {
-  signInAction
-};

package/dist/chunk-42XB3YCW.js

@@ -1,22 +0,0 @@
-// src/oauth/x.ts
-var x = {
-  id: "x",
-  name: "X",
-  authorizeURL: "https://x.com/i/oauth2/authorize",
-  accessToken: "https://api.x.com/2/oauth2/token",
-  userInfo: "https://api.x.com/2/users/me?user.fields=profile_image_url",
-  scope: "users.read users.email tweet.read offline.access",
-  responseType: "code",
-  profile({ data }) {
-    return {
-      sub: data.id,
-      name: data.name,
-      image: data.profile_image_url,
-      email: ""
-    };
-  }
-};
-
-export {
-  x
-};

package/dist/chunk-6R2YZ4AC.js

@@ -1,22 +0,0 @@
-// src/oauth/strava.ts
-var strava = {
-  id: "strava",
-  name: "Strava",
-  authorizeURL: "https://www.strava.com/oauth/authorize",
-  accessToken: "https://www.strava.com/oauth/token",
-  userInfo: "https://www.strava.com/api/v3/athlete",
-  scope: "read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id.toString(),
-      name: `${profile.firstname} ${profile.lastname}`,
-      image: profile.profile,
-      email: ""
-    };
-  }
-};
-
-export {
-  strava
-};