@aura-stack/auth 0.4.0 → 0.5.0

package/dist/api/signOut.cjs

@@ -0,0 +1,279 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/api/signOut.ts
+var signOut_exports = {};
+__export(signOut_exports, {
+  signOut: () => signOut
+});
+module.exports = __toCommonJS(signOut_exports);
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/cookie.ts
+var import_cookie = require("@aura-stack/router/cookie");
+
+// src/errors.ts
+var AuthInternalError = class extends Error {
+  type = "AUTH_INTERNAL_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+var AuthSecurityError = class extends Error {
+  type = "AUTH_SECURITY_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+
+// src/cookie.ts
+var defaultCookieOptions = {
+  httpOnly: true,
+  sameSite: "lax",
+  path: "/",
+  maxAge: 60 * 60 * 24 * 15
+};
+var oauthCookieOptions = {
+  httpOnly: true,
+  maxAge: 5 * 60,
+  sameSite: "lax",
+  expires: new Date(Date.now() + 5 * 60 * 1e3)
+};
+var expiredCookieAttributes = {
+  ...defaultCookieOptions,
+  expires: /* @__PURE__ */ new Date(0),
+  maxAge: 0,
+  secure: true
+};
+var getCookie = (request, cookieName) => {
+  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
+  if (!cookies) {
+    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
+  }
+  const value = (0, import_cookie.parse)(cookies)[cookieName];
+  if (!value) {
+    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found. There is no active session`);
+  }
+  return value;
+};
+
+// src/utils.ts
+var import_router = require("@aura-stack/router");
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+};
+var timingSafeEqual = (a, b) => {
+  const bufferA = import_crypto.encoder.encode(a);
+  const bufferB = import_crypto.encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
+  }
+  return diff === 0 && bufferA.length === bufferB.length;
+};
+
+// src/utils.ts
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
+  }
+  return typeof error === "string" ? error : "UnknownError";
+};
+
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto2 = require("@aura-stack/jose/crypto");
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
+};
+
+// src/secure.ts
+var verifyCSRF = async (jose, cookie, header) => {
+  try {
+    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
+    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
+    if (!isJWTPayloadWithToken(cookiePayload)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
+    }
+    if (!isJWTPayloadWithToken(headerPayload)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
+    }
+    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+    }
+    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+    }
+    return true;
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+  }
+};
+
+// src/headers.ts
+var cacheControl = {
+  "Cache-Control": "no-store",
+  Pragma: "no-cache",
+  Expires: "0",
+  Vary: "Cookie"
+};
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
+
+// src/api/signOut.ts
+var import_router2 = require("@aura-stack/router");
+var signOut = async ({
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  skipCSRFCheck = false
+}) => {
+  const headers = new Headers(headersInit);
+  const header = headers.get("X-CSRF-Token");
+  let session = null;
+  let csrfToken = null;
+  try {
+    session = getCookie(headers, ctx.cookies.sessionToken.name);
+  } catch {
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  try {
+    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+  }
+  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
+    structuredData: {
+      has_session: Boolean(session),
+      has_csrf_token: Boolean(csrfToken),
+      has_csrf_header: Boolean(header),
+      skip_csrf_check: skipCSRFCheck
+    }
+  });
+  if (!session) {
+    ctx?.logger?.log("SESSION_TOKEN_MISSING");
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  if (!skipCSRFCheck) {
+    if (!csrfToken) {
+      ctx?.logger?.log("CSRF_TOKEN_MISSING");
+      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+    }
+    if (!header) {
+      ctx?.logger?.log("CSRF_HEADER_MISSING");
+      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
+    }
+    try {
+      await verifyCSRF(ctx.jose, csrfToken, header);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
+  } else {
+    try {
+      await ctx.jose.verifyJWS(csrfToken);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+  }
+  try {
+    await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("SIGN_OUT_SUCCESS");
+  } catch (error) {
+    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
+  }
+  const headersList = new import_router2.HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+  return Response.json(
+    { redirect: Boolean(redirectTo), url: redirectTo },
+    {
+      status: 202,
+      headers: headersList
+    }
+  );
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  signOut
+});

package/dist/api/signOut.d.ts

@@ -0,0 +1,16 @@
+import { F as FunctionAPIContext, i as SignOutAPIOptions } from '../index-_aXtxb_s.js';
+import 'zod';
+import '../schemas.js';
+import 'zod/v4';
+import '@aura-stack/jose';
+import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
+import '../@types/utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
+
+declare const signOut: ({ ctx, headers: headersInit, redirectTo, skipCSRFCheck, }: FunctionAPIContext<SignOutAPIOptions>) => Promise<Response>;
+
+export { signOut };

package/dist/api/signOut.js

@@ -0,0 +1,13 @@
+import {
+  signOut
+} from "../chunk-KBXWTD6E.js";
+import "../chunk-V6LLEAR4.js";
+import "../chunk-UZQJJD6A.js";
+import "../chunk-LX3TJ2TJ.js";
+import "../chunk-XY5R3EHH.js";
+import "../chunk-WHNDRO3N.js";
+import "../chunk-U5663F2U.js";
+import "../chunk-EBAMFRB7.js";
+export {
+  signOut
+};

package/dist/assert.cjs

@@ -28,20 +28,51 @@ __export(assert_exports, {
   isTrustedOrigin: () => isTrustedOrigin,
   isValidURL: () => isValidURL,
   patternToRegex: () => patternToRegex,
-  safeEquals: () => safeEquals,
+  timingSafeEqual: () => timingSafeEqual,
   unsafeChars: () => unsafeChars
 });
 module.exports = __toCommonJS(assert_exports);
 
 // src/utils.ts
 var import_router = require("@aura-stack/router");
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/utils.ts
 var equals = (a, b) => {
   if (a === null || b === null || a === void 0 || b === void 0) return false;
   return a === b;
 };
 
 // src/assert.ts
-var import_crypto = require("crypto");
+var import_crypto = require("@aura-stack/jose/crypto");
 var isFalsy = (value) => {
   return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
 };
@@ -138,13 +169,15 @@ var isTrustedOrigin = (url, trustedOrigins) => {
   }
   return false;
 };
-var safeEquals = (a, b) => {
-  const bufferA = Buffer.from(a);
-  const bufferB = Buffer.from(b);
-  if (bufferA.length !== bufferB.length) {
-    return false;
+var timingSafeEqual = (a, b) => {
+  const bufferA = import_crypto.encoder.encode(a);
+  const bufferB = import_crypto.encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
   }
-  return (0, import_crypto.timingSafeEqual)(bufferA, bufferB);
+  return diff === 0 && bufferA.length === bufferB.length;
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -156,6 +189,6 @@ var safeEquals = (a, b) => {
   isTrustedOrigin,
   isValidURL,
   patternToRegex,
-  safeEquals,
+  timingSafeEqual,
   unsafeChars
 });

package/dist/assert.d.ts

@@ -1,11 +1,15 @@
-import { J as JWTPayloadWithToken } from './index-CSyIJmCM.js';
+import { J as JWTPayloadWithToken } from './index-_aXtxb_s.js';
 import 'zod';
 import './schemas.js';
-import './jose.js';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
 import '@aura-stack/router/cookie';
 import './@types/utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
 
 declare const isFalsy: (value: unknown) => boolean;
 declare const isRequest: (value: unknown) => value is Request;
@@ -28,6 +32,6 @@ declare const patternToRegex: (pattern: string) => RegExp | null;
  * @param trustedOrigins - Array of exact URLs or patterns (e.g. `https://*.example.com`)
  */
 declare const isTrustedOrigin: (url: string, trustedOrigins: string[]) => boolean;
-declare const safeEquals: (a: string, b: string) => boolean;
+declare const timingSafeEqual: (a: string, b: string) => boolean;
 
-export { isFalsy, isJWTPayloadWithToken, isRelativeURL, isRequest, isSameOrigin, isTrustedOrigin, isValidURL, patternToRegex, safeEquals, unsafeChars };
+export { isFalsy, isJWTPayloadWithToken, isRelativeURL, isRequest, isSameOrigin, isTrustedOrigin, isValidURL, patternToRegex, timingSafeEqual, unsafeChars };

package/dist/assert.js

@@ -7,11 +7,11 @@ import {
   isTrustedOrigin,
   isValidURL,
   patternToRegex,
-  safeEquals,
+  timingSafeEqual,
   unsafeChars
-} from "./chunk-4EKY7655.js";
-import "./chunk-QQVSRXGX.js";
-import "./chunk-RRLIF4PQ.js";
+} from "./chunk-LX3TJ2TJ.js";
+import "./chunk-WHNDRO3N.js";
+import "./chunk-U5663F2U.js";
 export {
   isFalsy,
   isJWTPayloadWithToken,
@@ -21,6 +21,6 @@ export {
   isTrustedOrigin,
   isValidURL,
   patternToRegex,
-  safeEquals,
+  timingSafeEqual,
   unsafeChars
 };

package/dist/{chunk-KJBAQZX2.js → chunk-2A5B7GWR.js}

@@ -1,23 +1,56 @@
 // src/schemas.ts
-import { object, string, enum as options, number, z, null as nullable } from "zod";
+import { object, string, enum as options, number, z, null as nullable, union, array } from "zod/v4";
+var AuthorizeConfigSchema = z.union([
+  string().url(),
+  object({
+    url: string().url(),
+    params: object({
+      responseType: options(["code", "token", "id_token", "refresh_token"]).optional(),
+      scope: string().optional()
+    })
+  })
+]);
+var AccessTokenConfigSchema = z.union([
+  string().url(),
+  object({
+    url: string().url(),
+    headers: z.record(string(), string()).optional()
+  })
+]);
+var UserInfoConfigSchema = z.union([
+  string().url(),
+  object({
+    url: string().url(),
+    headers: z.record(string(), string()).optional(),
+    method: string().optional()
+  })
+]);
 var OAuthProviderCredentialsSchema = object({
   id: string(),
   name: string(),
-  authorizeURL: string().url(),
-  accessToken: string().url(),
-  scope: string(),
-  userInfo: string().url(),
-  responseType: options(["code", "token", "id_token"]),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: string().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: string().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: options(["code", "token", "id_token", "refresh_token"]).optional(),
   clientId: string(),
   clientSecret: string(),
   profile: z.function().optional()
 });
 var OAuthProviderConfigSchema = object({
-  authorizeURL: string().url(),
-  accessToken: string().url(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: string().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
   scope: string().optional(),
-  userInfo: string().url(),
-  responseType: options(["code", "token", "id_token"]),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: options(["code", "token", "id_token", "refresh_token"]).optional(),
   clientId: string(),
   clientSecret: string()
 });
@@ -55,7 +88,7 @@ var OAuthAccessTokenResponse = object({
   token_type: string().optional(),
   expires_in: number().optional(),
   refresh_token: string().optional(),
-  scope: string().optional().or(nullable())
+  scope: union([string().optional().or(nullable()), array(string()).optional()])
 });
 var OAuthAccessTokenErrorResponse = object({
   error: options([

package/dist/chunk-2GQLSIJ2.js

@@ -0,0 +1,40 @@
+import {
+  getEnv
+} from "./chunk-WHNDRO3N.js";
+
+// src/oauth/twitch.ts
+var twitch = (options) => {
+  const clientId = options?.clientId ?? getEnv("TWITCH_CLIENT_ID");
+  return {
+    id: "twitch",
+    name: "Twitch",
+    authorize: {
+      url: "https://id.twitch.tv/oauth2/authorize",
+      params: { scope: "user:read:email", responseType: "code" }
+    },
+    accessToken: "https://id.twitch.tv/oauth2/token",
+    userInfo: {
+      url: "https://api.twitch.tv/helix/users",
+      headers: {
+        "Client-ID": clientId
+      }
+    },
+    profile(profile) {
+      const user = profile.data[0];
+      if (!user) {
+        throw new Error("No user data found in Twitch profile response");
+      }
+      return {
+        sub: user.id,
+        name: user.display_name,
+        email: user.email,
+        picture: user.profile_image_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  twitch
+};

package/dist/chunk-2IR674WX.js

@@ -0,0 +1,44 @@
+import {
+  createBuiltInOAuthProviders
+} from "./chunk-PDP3PHB3.js";
+import {
+  createProxyLogger
+} from "./chunk-U4RK4LKJ.js";
+import {
+  createJoseInstance
+} from "./chunk-UZQJJD6A.js";
+import {
+  createCookieStore
+} from "./chunk-XY5R3EHH.js";
+import {
+  getEnv,
+  getEnvArray,
+  getEnvBoolean
+} from "./chunk-WHNDRO3N.js";
+
+// src/context.ts
+var createContext = (config) => {
+  const trustedProxyHeadersEnv = getEnv("TRUSTED_PROXY_HEADERS");
+  const useProxyHeaders = trustedProxyHeadersEnv === void 0 ? config?.trustedProxyHeaders ?? false : getEnvBoolean("TRUSTED_PROXY_HEADERS");
+  const logger = createProxyLogger(config);
+  const cookiePrefix = config?.cookies?.prefix;
+  const cookieOverrides = config?.cookies?.overrides ?? {};
+  const secureCookieStore = createCookieStore(true, cookiePrefix, cookieOverrides, logger);
+  const standardCookieStore = createCookieStore(false, cookiePrefix, cookieOverrides, logger);
+  return {
+    oauth: createBuiltInOAuthProviders(config?.oauth),
+    cookies: standardCookieStore,
+    jose: createJoseInstance(config?.secret),
+    secret: config?.secret,
+    basePath: config?.basePath ?? "/auth",
+    trustedProxyHeaders: useProxyHeaders,
+    trustedOrigins: getEnvArray("TRUSTED_ORIGINS").length > 0 ? getEnvArray("TRUSTED_ORIGINS") : config?.trustedOrigins,
+    logger,
+    cookieConfig: { secure: secureCookieStore, standard: standardCookieStore },
+    baseURL: config?.baseURL
+  };
+};
+
+export {
+  createContext
+};

package/dist/chunk-3J5TUH2I.js

@@ -0,0 +1,50 @@
+import {
+  createRedirectTo
+} from "./chunk-LATR3NIV.js";
+import {
+  signOut
+} from "./chunk-KBXWTD6E.js";
+import {
+  getBaseURL
+} from "./chunk-LX3TJ2TJ.js";
+
+// src/actions/signOut/signOut.ts
+import { z } from "zod/v4";
+import { createEndpoint, createEndpointConfig } from "@aura-stack/router";
+var config = createEndpointConfig({
+  schemas: {
+    searchParams: z.object({
+      token_type_hint: z.literal("session_token"),
+      redirectTo: z.string().optional()
+    })
+  }
+});
+var signOutAction = createEndpoint(
+  "POST",
+  "/signOut",
+  async (ctx) => {
+    const {
+      request,
+      searchParams: { redirectTo },
+      context
+    } = ctx;
+    const baseURL = getBaseURL(request);
+    const location = await createRedirectTo(
+      new Request(baseURL, {
+        headers: request.headers
+      }),
+      redirectTo,
+      context
+    );
+    return await signOut({
+      ctx: context,
+      headers: request.headers,
+      redirectTo: location
+    });
+  },
+  config
+);
+
+export {
+  signOutAction
+};