@aura-stack/auth 0.4.0 → 0.5.0

package/dist/chunk-4RWSYUKX.js

@@ -0,0 +1,98 @@
+import {
+  AuthClientError,
+  isNativeError
+} from "./chunk-U5663F2U.js";
+
+// src/client/client.ts
+import { createClient as createClientAPI } from "@aura-stack/router";
+var createClient = createClientAPI;
+var createAuthClient = (options) => {
+  if (typeof window === "undefined" && !options.baseURL) {
+    throw new AuthClientError("`baseURL` is required when createAuthClient is used outside the browser.");
+  }
+  const client = createClient({
+    cache: "no-store",
+    credentials: "include",
+    baseURL: options.baseURL ?? window.location.origin,
+    ...options
+  });
+  const getCSRFToken = async () => {
+    try {
+      const response = await client.get("/csrfToken");
+      if (!response.ok) return null;
+      const data = await response.json();
+      return data.csrfToken;
+    } catch (error) {
+      console.error("Error fetching CSRF token:", error);
+      return null;
+    }
+  };
+  const getSession = async () => {
+    try {
+      const response = await client.get("/session");
+      if (!response.ok) return null;
+      const session = await response.json();
+      if (!session?.authenticated) return null;
+      return session.session;
+    } catch (error) {
+      console.error("Error fetching session:", error);
+      return null;
+    }
+  };
+  const signIn = async (oauth, options2) => {
+    try {
+      const response = await client.get("/signIn/:oauth", {
+        params: {
+          oauth
+        },
+        searchParams: {
+          ...options2,
+          redirect: false
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.signInURL) {
+        window.location.assign(json.signInURL);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-in:", error);
+      return { redirect: false, signInURL: "/" };
+    }
+  };
+  const signOut = async (options2) => {
+    try {
+      const csrfToken = await getCSRFToken();
+      if (!csrfToken) {
+        throw new AuthClientError("Failed to fetch CSRF token for sign-out.");
+      }
+      const response = await client.post("/signOut", {
+        searchParams: {
+          redirectTo: options2?.redirectTo ?? "/",
+          token_type_hint: "session_token"
+        },
+        headers: {
+          "X-CSRF-Token": csrfToken
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.url) {
+        window.location.assign(json.url);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-out:", error);
+      throw isNativeError(error) ? error : new AuthClientError("Sign-out failed.", "The sign-out request failed.", { cause: error });
+    }
+  };
+  return {
+    getSession,
+    signIn,
+    signOut
+  };
+};
+
+export {
+  createClient,
+  createAuthClient
+};

package/dist/{chunk-TZB6MUXN.js → chunk-7BE46WWS.js}

@@ -2,42 +2,52 @@ import {
   fetchAsync
 } from "./chunk-ZNCZVF6U.js";
 import {
-  OAuthAccessToken,
   OAuthAccessTokenErrorResponse,
   OAuthAccessTokenResponse
-} from "./chunk-KJBAQZX2.js";
+} from "./chunk-2A5B7GWR.js";
 import {
   AuthInternalError,
   OAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
+} from "./chunk-U5663F2U.js";
 
 // src/actions/callback/access-token.ts
 var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
-  const parsed = OAuthAccessToken.safeParse({ ...oauthConfig, redirectURI, code, codeVerifier });
-  if (!parsed.success) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION");
+  const { accessToken, clientId, clientSecret } = oauthConfig;
+  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
+    logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        has_client_id: Boolean(clientId),
+        has_client_secret: Boolean(clientSecret),
+        has_access_token: Boolean(accessToken),
+        has_redirect_uri: Boolean(redirectURI),
+        has_code: Boolean(code),
+        has_code_verifier: Boolean(codeVerifier)
+      }
+    });
     throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
   }
-  const { accessToken, clientId, clientSecret, code: codeParsed, redirectURI: redirectParsed } = parsed.data;
+  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
+  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
   try {
     logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
       structuredData: {
         has_client_id: Boolean(clientId),
-        redirect_uri: redirectParsed,
+        redirect_uri: redirectURI,
         grant_type: "authorization_code"
       }
     });
-    const response = await fetchAsync(accessToken, {
+    const response = await fetchAsync(tokenURL, {
       method: "POST",
       headers: {
+        ...extraHeaders ?? {},
         Accept: "application/json",
         "Content-Type": "application/x-www-form-urlencoded"
       },
       body: new URLSearchParams({
         client_id: clientId,
         client_secret: clientSecret,
-        code: codeParsed,
-        redirect_uri: redirectParsed,
+        code,
+        redirect_uri: redirectURI,
         grant_type: "authorization_code",
         code_verifier: codeVerifier
       }).toString()

package/dist/chunk-7YYXFKLR.js

@@ -0,0 +1,35 @@
+import {
+  getSession
+} from "./chunk-CITNGXDA.js";
+import {
+  expiredCookieAttributes
+} from "./chunk-XY5R3EHH.js";
+import {
+  AuthInternalError
+} from "./chunk-U5663F2U.js";
+import {
+  secureApiHeaders
+} from "./chunk-EBAMFRB7.js";
+
+// src/actions/session/session.ts
+import { createEndpoint, HeadersBuilder } from "@aura-stack/router";
+var sessionAction = createEndpoint("GET", "/session", async (ctx) => {
+  const {
+    request,
+    context: { cookies }
+  } = ctx;
+  try {
+    const session = await getSession({ ctx: ctx.context, headers: request.headers });
+    if (!session.authenticated) {
+      throw new AuthInternalError("INVALID_JWT_TOKEN", "Session not authenticated");
+    }
+    return Response.json(session, { headers: secureApiHeaders });
+  } catch (error) {
+    const headers = new HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+    return Response.json({ session: null, authenticated: false }, { status: 401, headers });
+  }
+});
+
+export {
+  sessionAction
+};

package/dist/chunk-C3A37LQC.js

@@ -0,0 +1,33 @@
+// src/oauth/atlassian.ts
+var atlassian = (options) => {
+  return {
+    id: "atlassian",
+    name: "Atlassian",
+    authorize: {
+      url: "https://auth.atlassian.com/authorize",
+      params: {
+        audience: "api.atlassian.com",
+        scope: "read:me read:account",
+        prompt: "consent"
+      }
+    },
+    authorizeURL: "https://auth.atlassian.com/authorize",
+    accessToken: "https://auth.atlassian.com/oauth/token",
+    userInfo: "https://api.atlassian.com/me",
+    scope: "read:me read:account",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name,
+        email: profile.email,
+        image: profile.picture
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  atlassian
+};

package/dist/chunk-CITNGXDA.js

@@ -0,0 +1,31 @@
+import {
+  getErrorName,
+  toISOString
+} from "./chunk-LX3TJ2TJ.js";
+import {
+  getCookie
+} from "./chunk-XY5R3EHH.js";
+
+// src/api/getSession.ts
+var getSession = async ({ ctx, headers }) => {
+  try {
+    const session = getCookie(new Headers(headers), ctx.cookies.sessionToken.name);
+    const decoded = await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("AUTH_SESSION_VALID");
+    const { exp, iat, jti, nbf, aud, iss, ...user } = decoded;
+    return {
+      session: {
+        user,
+        expires: toISOString(exp * 1e3)
+      },
+      authenticated: true
+    };
+  } catch (error) {
+    ctx?.logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
+    return { session: null, authenticated: false };
+  }
+};
+
+export {
+  getSession
+};

package/dist/chunk-CWX724AG.js

@@ -0,0 +1,78 @@
+import {
+  callbackAction
+} from "./chunk-NHZBQNRR.js";
+import {
+  csrfTokenAction
+} from "./chunk-FPCVZUVG.js";
+import {
+  signInAction
+} from "./chunk-UN7X6SU5.js";
+import {
+  sessionAction
+} from "./chunk-7YYXFKLR.js";
+import {
+  signOutAction
+} from "./chunk-3J5TUH2I.js";
+import {
+  createAuthAPI
+} from "./chunk-LAYPUDQF.js";
+import {
+  createContext
+} from "./chunk-2IR674WX.js";
+import {
+  createErrorHandler,
+  useSecureCookies
+} from "./chunk-LX3TJ2TJ.js";
+
+// src/createAuth.ts
+import { createRouter } from "@aura-stack/router";
+var createInternalConfig = (authConfig) => {
+  const context = createContext(authConfig);
+  return {
+    basePath: authConfig?.basePath ?? "/auth",
+    onError: createErrorHandler(context.logger),
+    context,
+    use: [
+      (ctx) => {
+        const useSecure = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
+        ctx.context.cookies = useSecure ? context.cookieConfig.secure : context.cookieConfig.standard;
+        return ctx;
+      }
+    ]
+  };
+};
+var createAuthInstance = (authConfig) => {
+  const config = createInternalConfig(authConfig);
+  const router = createRouter(
+    [signInAction(config.context.oauth), callbackAction(config.context.oauth), sessionAction, signOutAction, csrfTokenAction],
+    config
+  );
+  return {
+    handlers: router,
+    jose: config.context.jose,
+    api: createAuthAPI(config.context)
+  };
+};
+var createAuth = (config) => {
+  const authInstance = createAuthInstance(config);
+  authInstance.handlers.ALL = async (request) => {
+    const method = request.method.toUpperCase();
+    const methodHandlers = {
+      GET: authInstance.handlers.GET,
+      POST: authInstance.handlers.POST
+    };
+    if (method in methodHandlers) {
+      return await methodHandlers[method](request);
+    }
+    return new Response("Method Not Allowed", {
+      status: 405,
+      headers: { Allow: Object.keys(methodHandlers).join(", ") }
+    });
+  };
+  return authInstance;
+};
+
+export {
+  createAuthInstance,
+  createAuth
+};

package/dist/chunk-D2CSIUKP.js

@@ -0,0 +1,74 @@
+import {
+  createPKCE,
+  createSecretValue
+} from "./chunk-V6LLEAR4.js";
+import {
+  OAuthAuthorization
+} from "./chunk-2A5B7GWR.js";
+import {
+  AuthInternalError
+} from "./chunk-U5663F2U.js";
+
+// src/actions/signIn/authorization-url.ts
+var setSearchParams = (url, params) => {
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== "") {
+      url.searchParams.set(key, value);
+    }
+  }
+};
+var buildAuthorizationURL = (oauth, redirect_uri, state, code_challenge, code_challenge_method) => {
+  const authorizeConfig = oauth.authorize;
+  const baseURL = typeof authorizeConfig === "string" ? authorizeConfig : authorizeConfig?.url ?? oauth.authorizeURL;
+  if (!baseURL) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing authorization URL in OAuth provider configuration.");
+  }
+  const url = new URL(baseURL);
+  const authorizeParams = typeof authorizeConfig === "string" ? void 0 : authorizeConfig?.params;
+  setSearchParams(url, {
+    response_type: authorizeParams?.responseType ?? oauth.responseType ?? "code",
+    client_id: oauth.clientId,
+    redirect_uri,
+    state,
+    code_challenge,
+    code_challenge_method,
+    scope: authorizeParams?.scope ?? oauth.scope,
+    prompt: authorizeParams?.prompt,
+    response_mode: authorizeParams?.responseMode,
+    login_hint: authorizeParams?.loginHint,
+    nonce: authorizeParams?.nonce,
+    display: authorizeParams?.display,
+    audience: authorizeParams?.audience
+  });
+  return url.toString();
+};
+var createAuthorizationURL = async (oauth, redirectURI, ctx) => {
+  const state = createSecretValue();
+  const { codeVerifier, codeChallenge, method } = await createPKCE();
+  const authorization = buildAuthorizationURL(oauth, redirectURI, state, codeChallenge, method);
+  const parsed = OAuthAuthorization.safeParse({ ...oauth, redirectURI, state, codeChallenge, codeChallengeMethod: method });
+  if (!parsed.success) {
+    ctx?.logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        scope: oauth?.scope ?? "",
+        redirect_uri: redirectURI,
+        has_state: Boolean(state),
+        has_code_challenge: Boolean(codeChallenge),
+        code_challenge_method: method
+      }
+    });
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
+  }
+  return {
+    authorization,
+    state,
+    codeVerifier,
+    method
+  };
+};
+
+export {
+  setSearchParams,
+  buildAuthorizationURL,
+  createAuthorizationURL
+};

package/dist/{chunk-ICAZ4OVS.js → chunk-FPCVZUVG.js}

@@ -1,10 +1,10 @@
 import {
   createCSRF
-} from "./chunk-NUDITUKX.js";
+} from "./chunk-V6LLEAR4.js";
 import {
   getCookie,
   setCookie
-} from "./chunk-5W4BRQYG.js";
+} from "./chunk-XY5R3EHH.js";
 import {
   secureApiHeaders
 } from "./chunk-EBAMFRB7.js";

package/dist/{chunk-XGLBNXL4.js → chunk-GNNBM2WJ.js}

@@ -1,17 +1,20 @@
 import {
   fetchAsync
 } from "./chunk-ZNCZVF6U.js";
+import {
+  generateSecure
+} from "./chunk-V6LLEAR4.js";
 import {
   OAuthErrorResponse
-} from "./chunk-KJBAQZX2.js";
+} from "./chunk-2A5B7GWR.js";
 import {
-  generateSecure
-} from "./chunk-NUDITUKX.js";
+  AURA_AUTH_VERSION
+} from "./chunk-LX3TJ2TJ.js";
 import {
   OAuthProtocolError,
   isNativeError,
   isOAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
+} from "./chunk-U5663F2U.js";
 
 // src/actions/callback/userinfo.ts
 var getDefaultUserInfo = (profile) => {
@@ -24,18 +27,23 @@ var getDefaultUserInfo = (profile) => {
   };
 };
 var getUserInfo = async (oauthConfig, accessToken, logger) => {
-  const userinfoEndpoint = oauthConfig.userInfo;
+  const userInfoConfig = oauthConfig.userInfo;
+  const userinfoURL = typeof userInfoConfig === "string" ? userInfoConfig : userInfoConfig.url;
+  const extraHeaders = typeof userInfoConfig === "string" ? void 0 : userInfoConfig.headers;
+  const method = typeof userInfoConfig === "string" ? "GET" : (userInfoConfig.method ?? "GET").toUpperCase();
   try {
     logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
       structuredData: {
-        endpoint: userinfoEndpoint
+        endpoint: userinfoURL
       }
     });
-    const response = await fetchAsync(userinfoEndpoint, {
-      method: "GET",
+    const response = await fetchAsync(userinfoURL, {
+      method,
       headers: {
+        "User-Agent": `Aura Auth/${AURA_AUTH_VERSION}`,
         Accept: "application/json",
-        Authorization: `Bearer ${accessToken}`
+        Authorization: `Bearer ${accessToken}`,
+        ...extraHeaders ?? {}
       }
     });
     if (!response.ok) {

package/dist/chunk-JOCGX3RP.js

@@ -0,0 +1,59 @@
+import {
+  createAuthorizationURL
+} from "./chunk-D2CSIUKP.js";
+import {
+  createRedirectTo,
+  createRedirectURI,
+  createSignInURL,
+  getBaseURL
+} from "./chunk-LATR3NIV.js";
+import {
+  AuthInternalError
+} from "./chunk-U5663F2U.js";
+import {
+  cacheControl
+} from "./chunk-EBAMFRB7.js";
+
+// src/api/signIn.ts
+import { HeadersBuilder } from "@aura-stack/router";
+var signIn = async (oauth, {
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  redirect,
+  request: requestInit
+}) => {
+  const headers = new Headers(headersInit);
+  const provider = ctx.oauth[oauth];
+  if (!provider) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", `The OAuth provider "${oauth}" is not configured.`);
+  }
+  let request = requestInit;
+  if (!request) {
+    const origin = await getBaseURL({ ctx, headers });
+    const url = `${origin}${ctx.basePath}/signIn/${oauth}`;
+    request = new Request(url, { headers });
+  }
+  if (redirect === false) {
+    const signInURL = await createSignInURL({ request, oauth, ctx, redirectTo });
+    return { redirect: false, signInURL };
+  }
+  const redirectURI = await createRedirectURI(request, oauth, ctx);
+  const redirectToValue = await createRedirectTo(request, redirectTo, ctx);
+  const { authorization, state, codeVerifier } = await createAuthorizationURL(provider, redirectURI, ctx);
+  ctx?.logger?.log("SIGN_IN_INITIATED", {
+    structuredData: { oauth_provider: oauth }
+  });
+  const headersList = new HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(ctx.cookies.state.name, state, ctx.cookies.state.attributes).setCookie(ctx.cookies.redirectURI.name, redirectURI, ctx.cookies.redirectURI.attributes).setCookie(ctx.cookies.redirectTo.name, redirectToValue, ctx.cookies.redirectTo.attributes).setCookie(ctx.cookies.codeVerifier.name, codeVerifier, ctx.cookies.codeVerifier.attributes).toHeaders();
+  return Response.json(
+    { redirect: redirect ?? true, signInURL: authorization },
+    {
+      status: redirect ?? true ? 302 : 200,
+      headers: headersList
+    }
+  );
+};
+
+export {
+  signIn
+};

package/dist/chunk-KBXWTD6E.js

@@ -0,0 +1,94 @@
+import {
+  verifyCSRF
+} from "./chunk-V6LLEAR4.js";
+import {
+  getErrorName
+} from "./chunk-LX3TJ2TJ.js";
+import {
+  expiredCookieAttributes,
+  getCookie
+} from "./chunk-XY5R3EHH.js";
+import {
+  AuthSecurityError
+} from "./chunk-U5663F2U.js";
+import {
+  secureApiHeaders
+} from "./chunk-EBAMFRB7.js";
+
+// src/api/signOut.ts
+import { HeadersBuilder } from "@aura-stack/router";
+var signOut = async ({
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  skipCSRFCheck = false
+}) => {
+  const headers = new Headers(headersInit);
+  const header = headers.get("X-CSRF-Token");
+  let session = null;
+  let csrfToken = null;
+  try {
+    session = getCookie(headers, ctx.cookies.sessionToken.name);
+  } catch {
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  try {
+    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+  }
+  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
+    structuredData: {
+      has_session: Boolean(session),
+      has_csrf_token: Boolean(csrfToken),
+      has_csrf_header: Boolean(header),
+      skip_csrf_check: skipCSRFCheck
+    }
+  });
+  if (!session) {
+    ctx?.logger?.log("SESSION_TOKEN_MISSING");
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  if (!skipCSRFCheck) {
+    if (!csrfToken) {
+      ctx?.logger?.log("CSRF_TOKEN_MISSING");
+      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+    }
+    if (!header) {
+      ctx?.logger?.log("CSRF_HEADER_MISSING");
+      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
+    }
+    try {
+      await verifyCSRF(ctx.jose, csrfToken, header);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
+  } else {
+    try {
+      await ctx.jose.verifyJWS(csrfToken);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+  }
+  try {
+    await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("SIGN_OUT_SUCCESS");
+  } catch (error) {
+    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
+  }
+  const headersList = new HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+  return Response.json(
+    { redirect: Boolean(redirectTo), url: redirectTo },
+    {
+      status: 202,
+      headers: headersList
+    }
+  );
+};
+
+export {
+  signOut
+};