@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/actions/index.d.ts

@@ -4,10 +4,14 @@ export { sessionAction } from './session/session.js';
 export { signOutAction } from './signOut/signOut.js';
 export { csrfTokenAction } from './csrfToken/csrfToken.js';
 import '@aura-stack/router';
+import 'zod/v4';
+import '../index-_aXtxb_s.js';
 import 'zod';
-import '../index-B8jeIElf.js';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';
+import 'jose';
+import 'zod/v4/core';

package/dist/actions/index.js

@@ -1,30 +1,35 @@
 import "../chunk-ITQ7352M.js";
-import {
-  signOutAction
-} from "../chunk-A3N4PVAT.js";
 import {
   callbackAction
-} from "../chunk-KSWLO5ZU.js";
-import "../chunk-GA2SMTJO.js";
-import "../chunk-IVET23KF.js";
+} from "../chunk-NHZBQNRR.js";
+import "../chunk-GNNBM2WJ.js";
 import {
   csrfTokenAction
-} from "../chunk-HT4YLL7N.js";
+} from "../chunk-FPCVZUVG.js";
+import {
+  signInAction
+} from "../chunk-UN7X6SU5.js";
 import {
   sessionAction
-} from "../chunk-JVFTCTTE.js";
+} from "../chunk-7YYXFKLR.js";
 import {
-  signInAction
-} from "../chunk-3EUWD5BB.js";
-import "../chunk-N4SX7TZT.js";
-import "../chunk-W6LG7BFW.js";
-import "../chunk-STHEPPUZ.js";
-import "../chunk-N2APGLXA.js";
-import "../chunk-CXLATHS5.js";
-import "../chunk-EIL2FPSS.js";
-import "../chunk-RRLIF4PQ.js";
+  signOutAction
+} from "../chunk-3J5TUH2I.js";
+import "../chunk-7BE46WWS.js";
+import "../chunk-CITNGXDA.js";
+import "../chunk-JOCGX3RP.js";
+import "../chunk-D2CSIUKP.js";
+import "../chunk-LATR3NIV.js";
+import "../chunk-KBXWTD6E.js";
 import "../chunk-ZNCZVF6U.js";
-import "../chunk-YRCB5FLE.js";
+import "../chunk-V6LLEAR4.js";
+import "../chunk-2A5B7GWR.js";
+import "../chunk-UZQJJD6A.js";
+import "../chunk-LX3TJ2TJ.js";
+import "../chunk-XY5R3EHH.js";
+import "../chunk-WHNDRO3N.js";
+import "../chunk-U5663F2U.js";
+import "../chunk-EBAMFRB7.js";
 export {
   callbackAction,
   csrfTokenAction,

package/dist/actions/session/session.cjs

@@ -25,8 +25,65 @@ __export(session_exports, {
 module.exports = __toCommonJS(session_exports);
 var import_router2 = require("@aura-stack/router");
 
-// src/utils.ts
-var import_router = require("@aura-stack/router");
+// src/headers.ts
+var cacheControl = {
+  "Cache-Control": "no-store",
+  Pragma: "no-cache",
+  Expires: "0",
+  Vary: "Cookie"
+};
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/cookie.ts
+var import_cookie = require("@aura-stack/router/cookie");
 
 // src/errors.ts
 var AuthInternalError = class extends Error {
@@ -40,21 +97,7 @@ var AuthInternalError = class extends Error {
   }
 };
 
-// src/utils.ts
-var toISOString = (date) => {
-  return new Date(date).toISOString();
-};
-
-// src/headers.ts
-var cacheControl = {
-  "Cache-Control": "no-store",
-  Pragma: "no-cache",
-  Expires: "0",
-  Vary: "Cookie"
-};
-
 // src/cookie.ts
-var import_cookie = require("@aura-stack/router/cookie");
 var defaultCookieOptions = {
   httpOnly: true,
   sameSite: "lax",
@@ -70,10 +113,11 @@ var oauthCookieOptions = {
 var expiredCookieAttributes = {
   ...defaultCookieOptions,
   expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0
+  maxAge: 0,
+  secure: true
 };
 var getCookie = (request, cookieName) => {
-  const cookies = request.headers.get("Cookie");
+  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
   if (!cookies) {
     throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
   }
@@ -84,21 +128,58 @@ var getCookie = (request, cookieName) => {
   return value;
 };
 
+// src/utils.ts
+var import_router = require("@aura-stack/router");
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+
+// src/utils.ts
+var toISOString = (date) => {
+  return new Date(date).toISOString();
+};
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
+  }
+  return typeof error === "string" ? error : "UnknownError";
+};
+
+// src/api/getSession.ts
+var getSession = async ({ ctx, headers }) => {
+  try {
+    const session = getCookie(new Headers(headers), ctx.cookies.sessionToken.name);
+    const decoded = await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("AUTH_SESSION_VALID");
+    const { exp, iat, jti, nbf, aud, iss, ...user } = decoded;
+    return {
+      session: {
+        user,
+        expires: toISOString(exp * 1e3)
+      },
+      authenticated: true
+    };
+  } catch (error) {
+    ctx?.logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
+    return { session: null, authenticated: false };
+  }
+};
+
 // src/actions/session/session.ts
 var sessionAction = (0, import_router2.createEndpoint)("GET", "/session", async (ctx) => {
   const {
     request,
-    context: { jose, cookies }
+    context: { cookies }
   } = ctx;
   try {
-    const session = getCookie(request, cookies.sessionToken.name);
-    const decoded = await jose.decodeJWT(session);
-    const { exp, iat, jti, nbf, ...user } = decoded;
-    const headers = new Headers(cacheControl);
-    return Response.json({ user, expires: toISOString(exp * 1e3) }, { headers });
+    const session = await getSession({ ctx: ctx.context, headers: request.headers });
+    if (!session.authenticated) {
+      throw new AuthInternalError("INVALID_JWT_TOKEN", "Session not authenticated");
+    }
+    return Response.json(session, { headers: secureApiHeaders });
   } catch (error) {
-    const headers = new import_router2.HeadersBuilder(cacheControl).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ authenticated: false, message: "Unauthorized" }, { status: 401, headers });
+    const headers = new import_router2.HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+    return Response.json({ session: null, authenticated: false }, { status: 401, headers });
   }
 });
 // Annotate the CommonJS export names for ESM import in node:

package/dist/actions/session/session.js

@@ -1,10 +1,12 @@
 import {
   sessionAction
-} from "../../chunk-JVFTCTTE.js";
-import "../../chunk-W6LG7BFW.js";
-import "../../chunk-STHEPPUZ.js";
-import "../../chunk-CXLATHS5.js";
-import "../../chunk-RRLIF4PQ.js";
+} from "../../chunk-7YYXFKLR.js";
+import "../../chunk-CITNGXDA.js";
+import "../../chunk-LX3TJ2TJ.js";
+import "../../chunk-XY5R3EHH.js";
+import "../../chunk-WHNDRO3N.js";
+import "../../chunk-U5663F2U.js";
+import "../../chunk-EBAMFRB7.js";
 export {
   sessionAction
 };

package/dist/actions/signIn/authorization-url.cjs

@@ -0,0 +1,288 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/actions/signIn/authorization-url.ts
+var authorization_url_exports = {};
+__export(authorization_url_exports, {
+  buildAuthorizationURL: () => buildAuthorizationURL,
+  createAuthorizationURL: () => createAuthorizationURL,
+  setSearchParams: () => setSearchParams
+});
+module.exports = __toCommonJS(authorization_url_exports);
+
+// src/errors.ts
+var AuthInternalError = class extends Error {
+  type = "AUTH_INTERNAL_ERROR";
+  code;
+  constructor(code, message, options2) {
+    super(message, options2);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+var AuthSecurityError = class extends Error {
+  type = "AUTH_SECURITY_ERROR";
+  code;
+  constructor(code, message, options2) {
+    super(message, options2);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+
+// src/schemas.ts
+var import_v4 = require("zod/v4");
+var AuthorizeConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    params: (0, import_v4.object)({
+      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+      scope: (0, import_v4.string)().optional()
+    })
+  })
+]);
+var AccessTokenConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
+  })
+]);
+var UserInfoConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
+    method: (0, import_v4.string)().optional()
+  })
+]);
+var OAuthProviderCredentialsSchema = (0, import_v4.object)({
+  id: (0, import_v4.string)(),
+  name: (0, import_v4.string)(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)(),
+  profile: import_v4.z.function().optional()
+});
+var OAuthProviderConfigSchema = (0, import_v4.object)({
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)()
+});
+var OAuthAuthorization = OAuthProviderConfigSchema.extend({
+  redirectURI: (0, import_v4.string)(),
+  state: (0, import_v4.string)(),
+  codeChallenge: (0, import_v4.string)(),
+  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
+});
+var OAuthAuthorizationResponse = (0, import_v4.object)({
+  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
+  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
+});
+var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "unauthorized_client",
+    "access_denied",
+    "unsupported_response_type",
+    "invalid_scope",
+    "server_error",
+    "temporarily_unavailable"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional(),
+  state: (0, import_v4.string)()
+});
+var OAuthAccessToken = OAuthProviderConfigSchema.extend({
+  redirectURI: (0, import_v4.string)(),
+  code: (0, import_v4.string)(),
+  codeVerifier: (0, import_v4.string)().min(43).max(128)
+});
+var OAuthAccessTokenResponse = (0, import_v4.object)({
+  access_token: (0, import_v4.string)(),
+  token_type: (0, import_v4.string)().optional(),
+  expires_in: (0, import_v4.number)().optional(),
+  refresh_token: (0, import_v4.string)().optional(),
+  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
+});
+var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "unauthorized_client",
+    "unsupported_grant_type",
+    "invalid_scope"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional()
+});
+var OAuthErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.string)(),
+  error_description: (0, import_v4.string)().optional()
+});
+var OAuthEnvSchema = (0, import_v4.object)({
+  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
+  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
+});
+
+// src/utils.ts
+var import_router = require("@aura-stack/router");
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto2 = require("@aura-stack/jose/crypto");
+
+// src/secure.ts
+var generateSecure = (length = 32) => {
+  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
+};
+var createSecretValue = (length = 32) => {
+  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
+};
+var createHash = async (data) => {
+  const subtle = (0, import_crypto2.getSubtleCrypto)();
+  const digest = await subtle.digest("SHA-256", import_crypto2.encoder.encode(data));
+  return import_jose2.base64url.encode(new Uint8Array(digest));
+};
+var createPKCE = async (verifier) => {
+  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
+  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
+  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
+    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
+  }
+  const codeChallenge = await createHash(codeVerifier);
+  return { codeVerifier, codeChallenge, method: "S256" };
+};
+
+// src/actions/signIn/authorization-url.ts
+var setSearchParams = (url, params) => {
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== "") {
+      url.searchParams.set(key, value);
+    }
+  }
+};
+var buildAuthorizationURL = (oauth, redirect_uri, state, code_challenge, code_challenge_method) => {
+  const authorizeConfig = oauth.authorize;
+  const baseURL = typeof authorizeConfig === "string" ? authorizeConfig : authorizeConfig?.url ?? oauth.authorizeURL;
+  if (!baseURL) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing authorization URL in OAuth provider configuration.");
+  }
+  const url = new URL(baseURL);
+  const authorizeParams = typeof authorizeConfig === "string" ? void 0 : authorizeConfig?.params;
+  setSearchParams(url, {
+    response_type: authorizeParams?.responseType ?? oauth.responseType ?? "code",
+    client_id: oauth.clientId,
+    redirect_uri,
+    state,
+    code_challenge,
+    code_challenge_method,
+    scope: authorizeParams?.scope ?? oauth.scope,
+    prompt: authorizeParams?.prompt,
+    response_mode: authorizeParams?.responseMode,
+    login_hint: authorizeParams?.loginHint,
+    nonce: authorizeParams?.nonce,
+    display: authorizeParams?.display,
+    audience: authorizeParams?.audience
+  });
+  return url.toString();
+};
+var createAuthorizationURL = async (oauth, redirectURI, ctx) => {
+  const state = createSecretValue();
+  const { codeVerifier, codeChallenge, method } = await createPKCE();
+  const authorization = buildAuthorizationURL(oauth, redirectURI, state, codeChallenge, method);
+  const parsed = OAuthAuthorization.safeParse({ ...oauth, redirectURI, state, codeChallenge, codeChallengeMethod: method });
+  if (!parsed.success) {
+    ctx?.logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        scope: oauth?.scope ?? "",
+        redirect_uri: redirectURI,
+        has_state: Boolean(state),
+        has_code_challenge: Boolean(codeChallenge),
+        code_challenge_method: method
+      }
+    });
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
+  }
+  return {
+    authorization,
+    state,
+    codeVerifier,
+    method
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildAuthorizationURL,
+  createAuthorizationURL,
+  setSearchParams
+});

package/dist/actions/signIn/authorization-url.d.ts

@@ -0,0 +1,31 @@
+import { k as OAuthProvider } from '../../index-_aXtxb_s.js';
+import { GlobalContext } from '@aura-stack/router';
+import 'zod';
+import '../../schemas.js';
+import 'zod/v4';
+import '@aura-stack/jose';
+import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
+import '../../@types/utility.js';
+import 'jose';
+import 'zod/v4/core';
+
+declare const setSearchParams: (url: URL, params: Record<string, string | undefined>) => void;
+declare const buildAuthorizationURL: (oauth: OAuthProvider, redirect_uri: string, state: string, code_challenge: string, code_challenge_method: string) => string;
+/**
+ * Constructs the request URI for the Authorization Request to the third-party OAuth service. It includes
+ * the necessary query parameters such as `client_id`, `redirect_uri`, `response_type`, `scope`, `state`,
+ * `code_challenge`, and `code_challenge_method`.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1
+ * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4
+ */
+declare const createAuthorizationURL: (oauth: OAuthProvider, redirectURI: string, ctx?: GlobalContext) => Promise<{
+    authorization: string;
+    state: string;
+    codeVerifier: string;
+    method: string;
+}>;
+
+export { buildAuthorizationURL, createAuthorizationURL, setSearchParams };

package/dist/actions/signIn/authorization-url.js

@@ -0,0 +1,16 @@
+import {
+  buildAuthorizationURL,
+  createAuthorizationURL,
+  setSearchParams
+} from "../../chunk-D2CSIUKP.js";
+import "../../chunk-V6LLEAR4.js";
+import "../../chunk-2A5B7GWR.js";
+import "../../chunk-UZQJJD6A.js";
+import "../../chunk-LX3TJ2TJ.js";
+import "../../chunk-WHNDRO3N.js";
+import "../../chunk-U5663F2U.js";
+export {
+  buildAuthorizationURL,
+  createAuthorizationURL,
+  setSearchParams
+};