@aura-stack/auth 0.4.0 → 0.5.0

package/dist/{chunk-XUP6KKNG.js → chunk-LATR3NIV.js}

@@ -1,57 +1,56 @@
 import {
-  OAuthAuthorization
-} from "./chunk-KJBAQZX2.js";
-import {
+  equals,
+  extractPath,
   isRelativeURL,
   isSameOrigin,
   isTrustedOrigin,
   isValidURL,
   patternToRegex
-} from "./chunk-4EKY7655.js";
+} from "./chunk-LX3TJ2TJ.js";
 import {
-  equals,
-  extractPath,
-  toCastCase
-} from "./chunk-QQVSRXGX.js";
+  getEnv
+} from "./chunk-WHNDRO3N.js";
 import {
   AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
+} from "./chunk-U5663F2U.js";
 
 // src/actions/signIn/authorization.ts
-var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod, logger) => {
-  const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod });
-  if (!parsed.success) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        scope: oauthConfig.scope,
-        redirect_uri: redirectURI,
-        has_state: Boolean(state),
-        has_code_challenge: Boolean(codeChallenge),
-        code_challenge_method: codeChallengeMethod
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const { authorizeURL, ...options } = parsed.data;
-  const { userInfo, accessToken, clientSecret, ...required } = options;
-  const searchParams = new URLSearchParams(toCastCase(required));
-  return `${authorizeURL}?${searchParams}`;
-};
 var getTrustedOrigins = async (request, trustedOrigins) => {
   if (!trustedOrigins) return [];
   const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
   return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
 };
+var getBaseURL = async ({
+  ctx,
+  request,
+  headers: headersInit
+}) => {
+  const origin = getEnv("BASE_URL") || ctx?.baseURL;
+  if (origin && origin !== "/") return origin;
+  if (ctx?.trustedProxyHeaders) {
+    const headers = headersInit && new Headers(headersInit) || request?.headers;
+    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
+    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
+    if (host) return `${protocol}://${host}`;
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
+    );
+  }
+  try {
+    return new URL(request?.url ?? "not-found").origin;
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
+      { cause: error }
+    );
+  }
+};
 var getOriginURL = async (request, context) => {
-  const headers = request.headers;
-  let origin = new URL(request.url).origin;
   const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
-  trustedOrigins.push(origin);
-  if (context?.trustedProxyHeaders) {
-    const protocol = headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Proto") ?? "http";
-    const host = headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Host") ?? null;
-    origin = `${protocol}://${host}`;
-  }
+  trustedOrigins.push(new URL(request.url).origin);
+  const origin = await getBaseURL({ request, ctx: context });
   if (!isTrustedOrigin(origin, trustedOrigins)) {
     context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
     throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
@@ -62,6 +61,17 @@ var createRedirectURI = async (request, oauth, context) => {
   const origin = await getOriginURL(request, context);
   return `${origin}${context.basePath}/callback/${oauth}`;
 };
+var createSignInURL = async ({
+  request,
+  oauth,
+  ctx,
+  redirectTo
+}) => {
+  const origin = await getOriginURL(request, ctx);
+  const searchParams = new URLSearchParams();
+  if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
+  return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
+};
 var createRedirectTo = async (request, redirectTo, context) => {
   try {
     const headers = request.headers;
@@ -98,9 +108,10 @@ var createRedirectTo = async (request, redirectTo, context) => {
 };
 
 export {
-  createAuthorizationURL,
   getTrustedOrigins,
+  getBaseURL,
   getOriginURL,
   createRedirectURI,
+  createSignInURL,
   createRedirectTo
 };

package/dist/chunk-LAYPUDQF.js

@@ -0,0 +1,39 @@
+import {
+  getSession
+} from "./chunk-CITNGXDA.js";
+import {
+  signIn
+} from "./chunk-JOCGX3RP.js";
+import {
+  signOut
+} from "./chunk-KBXWTD6E.js";
+import {
+  validateRedirectTo
+} from "./chunk-LX3TJ2TJ.js";
+
+// src/api/createApi.ts
+var createAuthAPI = (ctx) => {
+  return {
+    getSession: async (options) => {
+      const session = await getSession({ ctx, headers: options.headers });
+      return session;
+    },
+    signIn: async (oauth, options) => {
+      return signIn(oauth, {
+        ctx,
+        headers: options?.headers,
+        request: options?.request,
+        redirect: options?.redirect,
+        redirectTo: options?.redirectTo
+      });
+    },
+    signOut: async (options) => {
+      const redirectTo = validateRedirectTo(options?.redirectTo ?? "/");
+      return signOut({ ctx, headers: options.headers, redirectTo, skipCSRFCheck: true });
+    }
+  };
+};
+
+export {
+  createAuthAPI
+};

package/dist/chunk-LX3TJ2TJ.js

@@ -0,0 +1,294 @@
+import {
+  getEnv
+} from "./chunk-WHNDRO3N.js";
+import {
+  AuthInternalError,
+  isAuthInternalError,
+  isAuthSecurityError,
+  isOAuthProtocolError
+} from "./chunk-U5663F2U.js";
+
+// src/utils.ts
+import { isInvalidZodSchemaError, isRouterError } from "@aura-stack/router";
+
+// src/assert.ts
+import { encoder } from "@aura-stack/jose/crypto";
+var isFalsy = (value) => {
+  return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
+};
+var isRequest = (value) => {
+  return typeof Request !== "undefined" && value instanceof Request;
+};
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
+var isValidURL = (value) => {
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
+};
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+};
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+var isSameOrigin = (origin, expected) => {
+  const originURL = new URL(origin);
+  const expectedURL = new URL(expected);
+  return equals(originURL.origin, expectedURL.origin);
+};
+var patternToRegex = (pattern) => {
+  try {
+    if (pattern.length > 2048) return null;
+    pattern = pattern.replace(/\\/g, "");
+    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
+    if (!match) return null;
+    const [, protocol, host, port] = match;
+    const hasWildcard = host.includes("*");
+    if (hasWildcard && !host.startsWith("*.")) return null;
+    if (hasWildcard && host.slice(2).includes("*")) return null;
+    const domain = hasWildcard ? host.slice(2) : host;
+    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
+    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
+    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
+  } catch {
+    return null;
+  }
+};
+var isTrustedOrigin = (url, trustedOrigins) => {
+  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
+  try {
+    const urlOrigin = new URL(url).origin;
+    for (const pattern of trustedOrigins) {
+      const regex = patternToRegex(pattern);
+      if (regex?.test(urlOrigin)) return true;
+      try {
+        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return false;
+};
+var timingSafeEqual = (a, b) => {
+  const bufferA = encoder.encode(a);
+  const bufferB = encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
+  }
+  return diff === 0 && bufferA.length === bufferB.length;
+};
+
+// src/utils.ts
+var AURA_AUTH_VERSION = "0.4.0";
+var toSnakeCase = (str) => {
+  return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
+};
+var toUpperCase = (str) => {
+  return str.toUpperCase();
+};
+var toCastCase = (obj, type = "snake") => {
+  return Object.entries(obj).reduce((previous, [key, value]) => {
+    const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
+    return { ...previous, [newKey]: value };
+  }, {});
+};
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+var createErrorHandler = (logger) => {
+  return (error) => {
+    if (isRouterError(error)) {
+      const { message, status, statusText } = error;
+      logger?.log("ROUTER_INTERNAL_ERROR");
+      return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
+    }
+    if (isInvalidZodSchemaError(error)) {
+      logger?.log("INVALID_REQUEST");
+      return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
+    }
+    if (isOAuthProtocolError(error)) {
+      const { error: errorCode, message, type, errorURI } = error;
+      logger?.log("OAUTH_PROTOCOL_ERROR", {
+        structuredData: {
+          error: errorCode,
+          error_description: message,
+          error_uri: errorURI ?? ""
+        }
+      });
+      return Response.json(
+        {
+          type,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    if (isAuthInternalError(error)) {
+      const { type, code, message } = error;
+      logger?.log("INVALID_OAUTH_CONFIGURATION", {
+        structuredData: {
+          error: code,
+          error_description: message
+        }
+      });
+      return Response.json(
+        {
+          type,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    if (isAuthSecurityError(error)) {
+      const { type, code, message } = error;
+      logger?.log("INVALID_OAUTH_CONFIGURATION", {
+        structuredData: {
+          error: code,
+          error_description: message
+        }
+      });
+      return Response.json(
+        {
+          type,
+          code,
+          message
+        },
+        { status: 400 }
+      );
+    }
+    logger?.log("SERVER_ERROR");
+    return Response.json(
+      { type: "SERVER_ERROR", code: "SERVER_ERROR", message: "An unexpected error occurred" },
+      { status: 500 }
+    );
+  };
+};
+var getBaseURL = (request) => {
+  const url = new URL(request.url);
+  return `${url.origin}${url.pathname}`;
+};
+var toISOString = (date) => {
+  return new Date(date).toISOString();
+};
+var useSecureCookies = (request, trustedProxyHeaders) => {
+  const headers = request instanceof Headers ? request : request.headers;
+  const url = request instanceof Headers ? null : request.url;
+  return trustedProxyHeaders ? url?.startsWith("https://") || headers.get("X-Forwarded-Proto") === "https" || (headers.get("Forwarded")?.includes("proto=https") ?? false) : url?.startsWith("https://") ?? false;
+};
+var formatZodError = (error) => {
+  if (!error.issues || error.issues.length === 0) {
+    return {};
+  }
+  return error.issues.reduce((previous, issue) => {
+    const key = issue.path.join(".");
+    return {
+      ...previous,
+      [key]: {
+        code: issue.code,
+        message: issue.message
+      }
+    };
+  }, {});
+};
+var extractPath = (url) => {
+  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
+  const match = url.match(pathRegex);
+  return match && match[2] ? match[2] : "/";
+};
+var createStructuredData = (data, sdID = "metadata") => {
+  const entries = Object.entries(data);
+  if (entries.length === 0) return `[${sdID}]`;
+  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
+  return `[${sdID} ${values}]`;
+};
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
+  }
+  return typeof error === "string" ? error : "UnknownError";
+};
+var createBasicAuthHeader = (username, password) => {
+  const getUsername = getEnv(username.toUpperCase()) ?? username;
+  const getPassword = getEnv(password.toUpperCase()) ?? password;
+  if (!getUsername || !getPassword) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
+  }
+  const credentials = `${getUsername}:${getPassword}`;
+  return `Basic ${btoa(credentials)}`;
+};
+var validateRedirectTo = (url) => {
+  if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+  if (isRelativeURL(url)) return url;
+  return "/";
+};
+
+export {
+  AURA_AUTH_VERSION,
+  toSnakeCase,
+  toUpperCase,
+  toCastCase,
+  equals,
+  createErrorHandler,
+  getBaseURL,
+  toISOString,
+  useSecureCookies,
+  formatZodError,
+  extractPath,
+  createStructuredData,
+  getErrorName,
+  createBasicAuthHeader,
+  validateRedirectTo,
+  isFalsy,
+  isRequest,
+  unsafeChars,
+  isValidURL,
+  isJWTPayloadWithToken,
+  isRelativeURL,
+  isSameOrigin,
+  patternToRegex,
+  isTrustedOrigin,
+  timingSafeEqual
+};

package/dist/{chunk-6MXFPFR3.js → chunk-NHZBQNRR.js}

@@ -1,40 +1,40 @@
-import {
-  createAccessToken
-} from "./chunk-TZB6MUXN.js";
 import {
   getUserInfo
-} from "./chunk-XGLBNXL4.js";
+} from "./chunk-GNNBM2WJ.js";
+import {
+  createAccessToken
+} from "./chunk-7BE46WWS.js";
 import {
   getOriginURL,
   getTrustedOrigins
-} from "./chunk-XUP6KKNG.js";
-import {
-  OAuthAuthorizationErrorResponse
-} from "./chunk-KJBAQZX2.js";
+} from "./chunk-LATR3NIV.js";
 import {
   createCSRF
-} from "./chunk-NUDITUKX.js";
+} from "./chunk-V6LLEAR4.js";
+import {
+  OAuthAuthorizationErrorResponse
+} from "./chunk-2A5B7GWR.js";
 import {
   isRelativeURL,
   isSameOrigin,
   isTrustedOrigin,
-  safeEquals
-} from "./chunk-4EKY7655.js";
+  timingSafeEqual
+} from "./chunk-LX3TJ2TJ.js";
 import {
   createSessionCookie,
   expiredCookieAttributes,
   getCookie
-} from "./chunk-5W4BRQYG.js";
-import {
-  cacheControl
-} from "./chunk-EBAMFRB7.js";
+} from "./chunk-XY5R3EHH.js";
 import {
   AuthSecurityError,
   OAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
+} from "./chunk-U5663F2U.js";
+import {
+  cacheControl
+} from "./chunk-EBAMFRB7.js";
 
 // src/actions/callback/callback.ts
-import { z } from "zod";
+import { z } from "zod/v4";
 import { createEndpoint, createEndpointConfig, HeadersBuilder } from "@aura-stack/router";
 var callbackConfig = (oauth) => {
   return createEndpointConfig("/callback/:oauth", {
@@ -50,7 +50,7 @@ var callbackConfig = (oauth) => {
         state: z.string("Missing state parameter in the OAuth authorization response.")
       })
     },
-    middlewares: [
+    use: [
       (ctx) => {
         const {
           searchParams,
@@ -92,7 +92,7 @@ var callbackAction = (oauth) => {
       const codeVerifier = getCookie(request, cookies.codeVerifier.name);
       const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
       const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
-      if (!safeEquals(cookieState, state)) {
+      if (!timingSafeEqual(cookieState, state)) {
         logger?.log("MISMATCHING_STATE", {
           structuredData: {
             oauth_provider: oauth2

package/dist/{chunk-TM5IPSNF.js → chunk-PDP3PHB3.js}

@@ -1,18 +1,36 @@
+import {
+  mailchimp
+} from "./chunk-LDU7A2JE.js";
+import {
+  notion
+} from "./chunk-PHYNROD4.js";
+import {
+  pinterest
+} from "./chunk-E6G5YCI6.js";
 import {
   spotify
 } from "./chunk-IPKO6UQN.js";
 import {
   strava
 } from "./chunk-54CZPKR4.js";
+import {
+  twitch
+} from "./chunk-2GQLSIJ2.js";
 import {
   x
 } from "./chunk-EEE7UM5T.js";
+import {
+  atlassian
+} from "./chunk-C3A37LQC.js";
 import {
   bitbucket
 } from "./chunk-4YHJ4IEQ.js";
 import {
   discord
 } from "./chunk-OVHNRULD.js";
+import {
+  dropbox
+} from "./chunk-QQEKY4XP.js";
 import {
   figma
 } from "./chunk-KMMAZFSJ.js";
@@ -22,25 +40,19 @@ import {
 import {
   gitlab
 } from "./chunk-5LZ7TOM3.js";
-import {
-  mailchimp
-} from "./chunk-LDU7A2JE.js";
-import {
-  pinterest
-} from "./chunk-E6G5YCI6.js";
 import {
   OAuthEnvSchema,
   OAuthProviderCredentialsSchema
-} from "./chunk-KJBAQZX2.js";
+} from "./chunk-2A5B7GWR.js";
 import {
   formatZodError
-} from "./chunk-QQVSRXGX.js";
+} from "./chunk-LX3TJ2TJ.js";
 import {
-  env
-} from "./chunk-4MYWAOLG.js";
+  getEnv
+} from "./chunk-WHNDRO3N.js";
 import {
   AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
+} from "./chunk-U5663F2U.js";
 
 // src/oauth/index.ts
 var builtInOAuthProviders = {
@@ -53,17 +65,19 @@ var builtInOAuthProviders = {
   x,
   strava,
   mailchimp,
-  pinterest
+  pinterest,
+  twitch,
+  notion,
+  dropbox,
+  atlassian
 };
 var defineOAuthEnvironment = (oauth) => {
-  const clientIdSuffix = `${oauth.toUpperCase()}_CLIENT_ID`;
-  const clientSecretSuffix = `${oauth.toUpperCase()}_CLIENT_SECRET`;
   const loadEnvs = OAuthEnvSchema.safeParse({
-    clientId: env[`AURA_AUTH_${clientIdSuffix}`] ?? env[`AUTH_${clientIdSuffix}`] ?? env[`${clientIdSuffix}`],
-    clientSecret: env[`AURA_AUTH_${clientSecretSuffix}`] ?? env[`AUTH_${clientSecretSuffix}`] ?? env[`${clientSecretSuffix}`]
+    clientId: getEnv(`${oauth.toUpperCase()}_CLIENT_ID`),
+    clientSecret: getEnv(`${oauth.toUpperCase()}_CLIENT_SECRET`)
   });
   if (!loadEnvs.success) {
-    const msg = JSON.stringify(formatZodError(loadEnvs.error), null, 2);
+    const msg = JSON.stringify({ [oauth]: formatZodError(loadEnvs.error) }, null, 2);
     throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
   }
   return loadEnvs.data;
@@ -74,7 +88,7 @@ var defineOAuthProviderConfig = (config) => {
     const oauthConfig = builtInOAuthProviders[config]();
     const parsed2 = OAuthProviderCredentialsSchema.safeParse({ ...oauthConfig, ...definition });
     if (!parsed2.success) {
-      const details = JSON.stringify(formatZodError(parsed2.error), null, 2);
+      const details = JSON.stringify({ [config]: formatZodError(parsed2.error) }, null, 2);
       throw new AuthInternalError(
         "INVALID_OAUTH_PROVIDER_CONFIGURATION",
         `Invalid configuration for OAuth provider "${config}": ${details}`
@@ -86,7 +100,7 @@ var defineOAuthProviderConfig = (config) => {
   const envConfig = hasCredentials ? {} : defineOAuthEnvironment(config.id);
   const parsed = OAuthProviderCredentialsSchema.safeParse({ ...envConfig, ...config });
   if (!parsed.success) {
-    const details = JSON.stringify(formatZodError(parsed.error), null, 2);
+    const details = JSON.stringify({ [config.id]: formatZodError(parsed.error) }, null, 2);
     throw new AuthInternalError(
       "INVALID_OAUTH_PROVIDER_CONFIGURATION",
       `Invalid configuration for OAuth provider "${config.id}": ${details}`

package/dist/chunk-PHYNROD4.js

@@ -0,0 +1,47 @@
+import {
+  createBasicAuthHeader
+} from "./chunk-LX3TJ2TJ.js";
+
+// src/oauth/notion.ts
+var notion = (options) => {
+  return {
+    id: "notion",
+    name: "Notion",
+    authorize: {
+      url: "https://api.notion.com/v1/oauth/authorize",
+      params: {
+        owner: "user",
+        scope: "user:read",
+        responseType: "code"
+      }
+    },
+    accessToken: {
+      url: "https://api.notion.com/v1/oauth/token",
+      headers: {
+        Authorization: createBasicAuthHeader(
+          options?.clientId ?? "NOTION_CLIENT_ID",
+          options?.clientSecret ?? "NOTION_CLIENT_SECRET"
+        )
+      }
+    },
+    userInfo: {
+      url: "https://api.notion.com/v1/users/me",
+      headers: {
+        "Notion-Version": "2022-06-28"
+      }
+    },
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.name,
+        image: profile.avatar_url ?? "",
+        email: profile?.bot?.owner?.user?.person?.email
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  notion
+};