@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/chunk-A3N4PVAT.js

@@ -1,70 +0,0 @@
-import {
-  createRedirectTo
-} from "./chunk-N4SX7TZT.js";
-import {
-  expiredCookieAttributes
-} from "./chunk-W6LG7BFW.js";
-import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
-import {
-  verifyCSRF
-} from "./chunk-N2APGLXA.js";
-import {
-  getNormalizedOriginPath
-} from "./chunk-CXLATHS5.js";
-import {
-  AuthSecurityError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/actions/signOut/signOut.ts
-import { z } from "zod";
-import { createEndpoint, createEndpointConfig, HeadersBuilder, statusCode } from "@aura-stack/router";
-var config = createEndpointConfig({
-  schemas: {
-    searchParams: z.object({
-      token_type_hint: z.literal("session_token"),
-      redirectTo: z.string().optional()
-    })
-  }
-});
-var signOutAction = createEndpoint(
-  "POST",
-  "/signOut",
-  async (ctx) => {
-    const {
-      request,
-      headers,
-      searchParams: { redirectTo },
-      context: { jose, cookies }
-    } = ctx;
-    const session = headers.getCookie(cookies.sessionToken.name);
-    const csrfToken = headers.getCookie(cookies.csrfToken.name);
-    const header = headers.getHeader("X-CSRF-Token");
-    if (!session) {
-      throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-    }
-    if (!csrfToken) {
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-    }
-    if (!header) {
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF header is missing.");
-    }
-    await verifyCSRF(jose, csrfToken, header);
-    await jose.decodeJWT(session);
-    const normalizedOriginPath = getNormalizedOriginPath(request.url);
-    const location = createRedirectTo(
-      new Request(normalizedOriginPath, {
-        headers: headers.toHeaders()
-      }),
-      redirectTo
-    );
-    const headersList = new HeadersBuilder(cacheControl).setHeader("Location", location).setCookie(cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ message: "Signed out successfully" }, { status: statusCode.ACCEPTED, headers: headersList });
-  },
-  config
-);
-
-export {
-  signOutAction
-};

package/dist/chunk-B737EUJV.js

@@ -1,22 +0,0 @@
-// src/oauth/mailchimp.ts
-var mailchimp = {
-  id: "mailchimp",
-  name: "Mailchimp",
-  authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
-  accessToken: "https://login.mailchimp.com/oauth2/token",
-  userInfo: "https://login.mailchimp.com/oauth2/metadata",
-  scope: "",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.user_id,
-      name: profile.accountname,
-      email: profile.login.login_email,
-      image: null
-    };
-  }
-};
-
-export {
-  mailchimp
-};

package/dist/chunk-CXLATHS5.js

@@ -1,143 +0,0 @@
-import {
-  isAuthInternalError,
-  isAuthSecurityError,
-  isOAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/utils.ts
-import { isInvalidZodSchemaError, isRouterError } from "@aura-stack/router";
-var toSnakeCase = (str) => {
-  return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
-};
-var toUpperCase = (str) => {
-  return str.toUpperCase();
-};
-var toCastCase = (obj, type = "snake") => {
-  return Object.entries(obj).reduce((previous, [key, value]) => {
-    const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
-    return { ...previous, [newKey]: value };
-  }, {});
-};
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var sanitizeURL = (url) => {
-  try {
-    let decodedURL = decodeURIComponent(url).trim();
-    const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/);
-    let protocol = "";
-    let rest = decodedURL;
-    if (protocolMatch) {
-      protocol = protocolMatch[1];
-      rest = decodedURL.slice(protocol.length);
-      const slashIndex = rest.indexOf("/");
-      if (slashIndex === -1) {
-        return protocol + rest;
-      }
-      const domain = rest.slice(0, slashIndex);
-      let path = rest.slice(slashIndex).replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-      if (path !== "/" && path.endsWith("/")) {
-        path = path.replace(/\/+$/, "/");
-      } else if (path !== "/") {
-        path = path.replace(/\/+$/, "");
-      }
-      return protocol + domain + path;
-    }
-    let sanitized = decodedURL.replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-    if (sanitized !== "/" && sanitized.endsWith("/")) {
-      sanitized = sanitized.replace(/\/+$/, "/");
-    } else if (sanitized !== "/") {
-      sanitized = sanitized.replace(/\/+$/, "");
-    }
-    return sanitized;
-  } catch {
-    return url.trim();
-  }
-};
-var isValidRelativePath = (path) => {
-  if (!path || typeof path !== "string") return false;
-  if (!path.startsWith("/") || path.includes("://") || path.includes("\r") || path.includes("\n")) return false;
-  if (/[\x00-\x1F\x7F]/.test(path) || path.includes("\0")) return false;
-  const sanitized = sanitizeURL(path);
-  if (sanitized.includes("..")) return false;
-  return true;
-};
-var onErrorHandler = (error) => {
-  if (isRouterError(error)) {
-    const { message, status, statusText } = error;
-    return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
-  }
-  if (isInvalidZodSchemaError(error)) {
-    return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
-  }
-  if (isOAuthProtocolError(error)) {
-    const { error: errorCode, message, type, errorURI } = error;
-    return Response.json(
-      {
-        type,
-        error: errorCode,
-        error_description: message,
-        error_uri: errorURI
-      },
-      { status: 400 }
-    );
-  }
-  if (isAuthInternalError(error) || isAuthSecurityError(error)) {
-    const { type, code, message } = error;
-    return Response.json(
-      {
-        type,
-        code,
-        message
-      },
-      { status: 400 }
-    );
-  }
-  return Response.json({ type: "SERVER_ERROR", code: "server_error", message: "An unexpected error occurred" }, { status: 500 });
-};
-var getNormalizedOriginPath = (path) => {
-  try {
-    const url = new URL(path);
-    url.hash = "";
-    url.search = "";
-    return `${url.origin}${url.pathname}`;
-  } catch {
-    return sanitizeURL(path);
-  }
-};
-var toISOString = (date) => {
-  return new Date(date).toISOString();
-};
-var useSecureCookies = (request, trustedProxyHeaders) => {
-  return trustedProxyHeaders ? request.url.startsWith("https://") || request.headers.get("X-Forwarded-Proto") === "https" || (request.headers.get("Forwarded")?.includes("proto=https") ?? false) : request.url.startsWith("https://");
-};
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
-  }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
-      }
-    };
-  }, {});
-};
-
-export {
-  toSnakeCase,
-  toUpperCase,
-  toCastCase,
-  equals,
-  sanitizeURL,
-  isValidRelativePath,
-  onErrorHandler,
-  getNormalizedOriginPath,
-  toISOString,
-  useSecureCookies,
-  formatZodError
-};

package/dist/chunk-E3OXBRYF.js

@@ -1,22 +0,0 @@
-// src/oauth/spotify.ts
-var spotify = {
-  id: "spotify",
-  name: "Spotify",
-  authorizeURL: "https://accounts.spotify.com/authorize",
-  accessToken: "https://accounts.spotify.com/api/token",
-  userInfo: "https://api.spotify.com/v1/me",
-  scope: "user-read-email user-read-private",
-  responseType: "token",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.display_name,
-      email: profile.email,
-      image: profile.images?.[0]?.url
-    };
-  }
-};
-
-export {
-  spotify
-};

package/dist/chunk-EIL2FPSS.js

@@ -1,22 +0,0 @@
-// src/assert.ts
-var isFalsy = (value) => {
-  return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
-};
-var isRequest = (value) => {
-  return typeof Request !== "undefined" && value instanceof Request;
-};
-var isValidURL = (value) => {
-  if (value.includes("\r\n") || value.includes("\n") || value.includes("\r")) return false;
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()*+,;=:@-]*)*\/?$/;
-  return regex.test(value);
-};
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-
-export {
-  isFalsy,
-  isRequest,
-  isValidURL,
-  isJWTPayloadWithToken
-};

package/dist/chunk-EMKJA2GJ.js

@@ -1,89 +0,0 @@
-import {
-  x
-} from "./chunk-42XB3YCW.js";
-import {
-  figma
-} from "./chunk-FKRDCWBF.js";
-import {
-  github
-} from "./chunk-IKHPGFCW.js";
-import {
-  gitlab
-} from "./chunk-KRNOMBXQ.js";
-import {
-  mailchimp
-} from "./chunk-B737EUJV.js";
-import {
-  pinterest
-} from "./chunk-HP34YGGJ.js";
-import {
-  spotify
-} from "./chunk-E3OXBRYF.js";
-import {
-  strava
-} from "./chunk-6R2YZ4AC.js";
-import {
-  bitbucket
-} from "./chunk-FIPU4MLT.js";
-import {
-  discord
-} from "./chunk-IUYZQTJV.js";
-import {
-  formatZodError
-} from "./chunk-CXLATHS5.js";
-import {
-  AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
-import {
-  OAuthEnvSchema
-} from "./chunk-YRCB5FLE.js";
-
-// src/oauth/index.ts
-var builtInOAuthProviders = {
-  github,
-  bitbucket,
-  figma,
-  discord,
-  gitlab,
-  spotify,
-  x,
-  strava,
-  mailchimp,
-  pinterest
-};
-var defineOAuthEnvironment = (oauth) => {
-  const env = process.env;
-  const clientIdSuffix = `${oauth.toUpperCase()}_CLIENT_ID`;
-  const clientSecretSuffix = `${oauth.toUpperCase()}_CLIENT_SECRET`;
-  const loadEnvs = OAuthEnvSchema.safeParse({
-    clientId: env[`AURA_AUTH_${clientIdSuffix}`] ?? env[`AUTH_${clientIdSuffix}`] ?? env[`${clientIdSuffix}`],
-    clientSecret: env[`AURA_AUTH_${clientSecretSuffix}`] ?? env[`AUTH_${clientSecretSuffix}`] ?? env[`${clientSecretSuffix}`]
-  });
-  if (!loadEnvs.success) {
-    const msg = JSON.stringify(formatZodError(loadEnvs.error), null, 2);
-    throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
-  }
-  return loadEnvs.data;
-};
-var defineOAuthProviderConfig = (config) => {
-  if (typeof config === "string") {
-    const definition = defineOAuthEnvironment(config);
-    const oauthConfig = builtInOAuthProviders[config];
-    return {
-      ...oauthConfig,
-      ...definition
-    };
-  }
-  return config;
-};
-var createBuiltInOAuthProviders = (oauth = []) => {
-  return oauth.reduce((previous, config) => {
-    const oauthConfig = defineOAuthProviderConfig(config);
-    return { ...previous, [oauthConfig.id]: oauthConfig };
-  }, {});
-};
-
-export {
-  builtInOAuthProviders,
-  createBuiltInOAuthProviders
-};

package/dist/chunk-FIPU4MLT.js

@@ -1,21 +0,0 @@
-// src/oauth/bitbucket.ts
-var bitbucket = {
-  id: "bitbucket",
-  name: "Bitbucket",
-  authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-  accessToken: "https://bitbucket.org/site/oauth2/access_token",
-  userInfo: "https://api.bitbucket.org/2.0/user",
-  scope: "account email",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.uuid ?? profile.account_id,
-      name: profile.display_name ?? profile.nickname,
-      image: profile.links.avatar.href
-    };
-  }
-};
-
-export {
-  bitbucket
-};

package/dist/chunk-FKRDCWBF.js

@@ -1,22 +0,0 @@
-// src/oauth/figma.ts
-var figma = {
-  id: "figma",
-  name: "Figma",
-  authorizeURL: "https://www.figma.com/oauth",
-  accessToken: "https://api.figma.com/v1/oauth/token",
-  userInfo: "https://api.figma.com/v1/me",
-  scope: "current_user:read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.handle,
-      email: profile.email,
-      image: profile.img_url
-    };
-  }
-};
-
-export {
-  figma
-};

package/dist/chunk-GA2SMTJO.js

@@ -1,58 +0,0 @@
-import {
-  formatZodError
-} from "./chunk-CXLATHS5.js";
-import {
-  AuthInternalError,
-  OAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
-import {
-  fetchAsync
-} from "./chunk-ZNCZVF6U.js";
-import {
-  OAuthAccessToken,
-  OAuthAccessTokenErrorResponse,
-  OAuthAccessTokenResponse
-} from "./chunk-YRCB5FLE.js";
-
-// src/actions/callback/access-token.ts
-var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier) => {
-  const parsed = OAuthAccessToken.safeParse({ ...oauthConfig, redirectURI, code, codeVerifier });
-  if (!parsed.success) {
-    const msg = JSON.stringify(formatZodError(parsed.error), null, 2);
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", msg);
-  }
-  const { accessToken, clientId, clientSecret, code: codeParsed, redirectURI: redirectParsed } = parsed.data;
-  try {
-    const response = await fetchAsync(accessToken, {
-      method: "POST",
-      headers: {
-        Accept: "application/json",
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        code: codeParsed,
-        redirect_uri: redirectParsed,
-        grant_type: "authorization_code",
-        code_verifier: codeVerifier
-      }).toString()
-    });
-    const json = await response.json();
-    const token = OAuthAccessTokenResponse.safeParse(json);
-    if (!token.success) {
-      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
-      if (!success) {
-        throw new OAuthProtocolError("INVALID_REQUEST", "Invalid access token response format");
-      }
-      throw new OAuthProtocolError(data.error, data?.error_description ?? "Failed to retrieve access token");
-    }
-    return token.data;
-  } catch (error) {
-    throw error;
-  }
-};
-
-export {
-  createAccessToken
-};

package/dist/chunk-HP34YGGJ.js

@@ -1,22 +0,0 @@
-// src/oauth/pinterest.ts
-var pinterest = {
-  id: "pinterest",
-  name: "Pinterest",
-  authorizeURL: "https://api.pinterest.com/oauth/",
-  accessToken: "https://api.pinterest.com/v5/oauth/token",
-  userInfo: "https://api.pinterest.com/v5/user_account",
-  scope: "user_accounts:read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.username,
-      email: null,
-      image: profile.profile_image
-    };
-  }
-};
-
-export {
-  pinterest
-};

package/dist/chunk-IKHPGFCW.js

@@ -1,14 +0,0 @@
-// src/oauth/github.ts
-var github = {
-  id: "github",
-  name: "GitHub",
-  authorizeURL: "https://github.com/login/oauth/authorize",
-  accessToken: "https://github.com/login/oauth/access_token",
-  userInfo: "https://api.github.com/user",
-  scope: "read:user user:email",
-  responseType: "code"
-};
-
-export {
-  github
-};

package/dist/chunk-IUYZQTJV.js

@@ -1,30 +0,0 @@
-// src/oauth/discord.ts
-var discord = {
-  id: "discord",
-  name: "Discord",
-  authorizeURL: "https://discord.com/oauth2/authorize",
-  accessToken: "https://discord.com/api/oauth2/token",
-  userInfo: "https://discord.com/api/users/@me",
-  scope: "identify email",
-  responseType: "code",
-  profile(profile) {
-    let image = "";
-    if (profile.avatar === null) {
-      const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-      image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-    } else {
-      const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-      image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-    }
-    return {
-      sub: profile.id,
-      name: profile.global_name ?? profile.username,
-      email: profile.email ?? "",
-      image
-    };
-  }
-};
-
-export {
-  discord
-};

package/dist/chunk-IVET23KF.js

@@ -1,58 +0,0 @@
-import {
-  generateSecure
-} from "./chunk-N2APGLXA.js";
-import {
-  OAuthProtocolError,
-  isNativeError,
-  isOAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
-import {
-  fetchAsync
-} from "./chunk-ZNCZVF6U.js";
-import {
-  OAuthErrorResponse
-} from "./chunk-YRCB5FLE.js";
-
-// src/actions/callback/userinfo.ts
-var getDefaultUserInfo = (profile) => {
-  const sub = generateSecure(16);
-  return {
-    sub: profile?.id ?? profile?.sub ?? sub,
-    email: profile?.email,
-    name: profile?.name ?? profile?.username ?? profile?.nickname,
-    image: profile?.image ?? profile?.picture
-  };
-};
-var getUserInfo = async (oauthConfig, accessToken) => {
-  const userinfoEndpoint = oauthConfig.userInfo;
-  try {
-    const response = await fetchAsync(userinfoEndpoint, {
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        Authorization: `Bearer ${accessToken}`
-      }
-    });
-    const json = await response.json();
-    const { success, data } = OAuthErrorResponse.safeParse(json);
-    if (success) {
-      throw new OAuthProtocolError(
-        data.error,
-        data?.error_description ?? "An error occurred while fetching user information."
-      );
-    }
-    return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
-  } catch (error) {
-    if (isOAuthProtocolError(error)) {
-      throw error;
-    }
-    if (isNativeError(error)) {
-      throw new OAuthProtocolError("invalid_request", error.message, "", { cause: error });
-    }
-    throw new OAuthProtocolError("invalid_request", "Failed to fetch user information.", "", { cause: error });
-  }
-};
-
-export {
-  getUserInfo
-};

package/dist/chunk-JVFTCTTE.js

@@ -1,33 +0,0 @@
-import {
-  expiredCookieAttributes,
-  getCookie
-} from "./chunk-W6LG7BFW.js";
-import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
-import {
-  toISOString
-} from "./chunk-CXLATHS5.js";
-
-// src/actions/session/session.ts
-import { createEndpoint, HeadersBuilder } from "@aura-stack/router";
-var sessionAction = createEndpoint("GET", "/session", async (ctx) => {
-  const {
-    request,
-    context: { jose, cookies }
-  } = ctx;
-  try {
-    const session = getCookie(request, cookies.sessionToken.name);
-    const decoded = await jose.decodeJWT(session);
-    const { exp, iat, jti, nbf, ...user } = decoded;
-    const headers = new Headers(cacheControl);
-    return Response.json({ user, expires: toISOString(exp * 1e3) }, { headers });
-  } catch (error) {
-    const headers = new HeadersBuilder(cacheControl).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ authenticated: false, message: "Unauthorized" }, { status: 401, headers });
-  }
-});
-
-export {
-  sessionAction
-};

package/dist/chunk-KRNOMBXQ.js

@@ -1,22 +0,0 @@
-// src/oauth/gitlab.ts
-var gitlab = {
-  id: "gitlab",
-  name: "GitLab",
-  authorizeURL: "https://gitlab.com/oauth/authorize",
-  accessToken: "https://gitlab.com/oauth/token",
-  userInfo: "https://gitlab.com/api/v4/user",
-  scope: "read_user",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id.toString(),
-      name: profile.name ?? profile.username,
-      email: profile.email,
-      avatar: profile.avatar_url
-    };
-  }
-};
-
-export {
-  gitlab
-};