@aura-stack/auth 0.4.0 → 0.5.0

package/dist/chunk-QQEKY4XP.js

@@ -0,0 +1,29 @@
+// src/oauth/dropbox.ts
+var dropbox = (options) => {
+  return {
+    id: "dropbox",
+    name: "Dropbox",
+    authorize: {
+      url: "https://www.dropbox.com/oauth2/authorize",
+      params: { scope: "account_info.read" }
+    },
+    accessToken: "https://api.dropboxapi.com/oauth2/token",
+    userInfo: {
+      method: "POST",
+      url: "https://api.dropboxapi.com/2/users/get_current_account"
+    },
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name.display_name,
+        email: profile.email,
+        image: profile.profile_photo_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  dropbox
+};

package/dist/{chunk-VNCNJKS2.js → chunk-U4RK4LKJ.js}

@@ -1,3 +1,11 @@
+import {
+  createStructuredData
+} from "./chunk-LX3TJ2TJ.js";
+import {
+  getEnv,
+  getEnvBoolean
+} from "./chunk-WHNDRO3N.js";
+
 // src/logger.ts
 var logMessages = {
   ROUTER_INTERNAL_ERROR: {
@@ -257,11 +265,84 @@ var createLogEntry = (key, overrides) => {
   const message = logMessages[key];
   return {
     ...message,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    hostname: "aura-auth",
+    procId: typeof process !== "undefined" && process.pid ? process.pid.toString() : "-",
     ...overrides
   };
 };
+var logLevelToSeverity = {
+  debug: ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  info: ["info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  warn: ["warning", "error", "critical", "alert", "emergency"],
+  error: ["error", "critical", "alert", "emergency"]
+};
+var isValidLogLevel = (value) => {
+  return value === "debug" || value === "info" || value === "warn" || value === "error";
+};
+var getSeverityLevel = (severity) => {
+  const severities = {
+    emergency: 0,
+    alert: 1,
+    critical: 2,
+    error: 3,
+    warning: 4,
+    notice: 5,
+    info: 6,
+    debug: 7
+  };
+  return severities[severity] ?? 6;
+};
+var createSyslogMessage = (options) => {
+  const { timestamp, hostname, appName = "aura-auth", procId = "-", msgId, structuredData, message } = options;
+  const pri = (options.facility ?? 16) * 8 + getSeverityLevel(options.severity);
+  const structuredDataStr = createStructuredData(structuredData ?? {});
+  return `<${pri}>1 ${timestamp} ${hostname} ${appName} ${procId} ${msgId} ${structuredDataStr} ${message}`;
+};
+var createLogger = (logger) => {
+  if (!logger) return void 0;
+  const level = logger.level;
+  const allowedSeverities = logLevelToSeverity[level] ?? [];
+  return {
+    level,
+    log(key, overrides) {
+      const entry = createLogEntry(key, overrides);
+      if (!allowedSeverities.includes(entry.severity)) return entry;
+      logger.log({
+        timestamp: entry.timestamp,
+        appName: entry.appName ?? "aura-auth",
+        hostname: entry.hostname ?? "aura-auth",
+        ...entry
+      });
+      return entry;
+    }
+  };
+};
+var createProxyLogger = (config) => {
+  const level = getEnv("LOG_LEVEL");
+  const debug = getEnvBoolean("DEBUG");
+  if (typeof config?.logger === "object") {
+    return createLogger({
+      log: config.logger?.log || createSyslogMessage,
+      level: isValidLogLevel(config.logger?.level) ? config.logger?.level : isValidLogLevel(level) ? level : "error"
+    });
+  }
+  if (debug || config?.logger === true || level) {
+    return createLogger({
+      level: isValidLogLevel(level) ? level : "debug",
+      log: (options) => {
+        const message = createSyslogMessage(options);
+        console.log(message);
+      }
+    });
+  }
+  return void 0;
+};
 
 export {
   logMessages,
-  createLogEntry
+  createLogEntry,
+  createSyslogMessage,
+  createLogger,
+  createProxyLogger
 };

package/dist/{chunk-RRLIF4PQ.js → chunk-U5663F2U.js}

@@ -31,6 +31,16 @@ var AuthSecurityError = class extends Error {
     Error.captureStackTrace(this, new.target);
   }
 };
+var AuthClientError = class extends Error {
+  type = "AUTH_CLIENT_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
 var isNativeError = (error) => {
   return error instanceof Error;
 };
@@ -43,13 +53,18 @@ var isAuthInternalError = (error) => {
 var isAuthSecurityError = (error) => {
   return error instanceof AuthSecurityError;
 };
+var isAuthClientError = (error) => {
+  return error instanceof AuthClientError;
+};
 
 export {
   OAuthProtocolError,
   AuthInternalError,
   AuthSecurityError,
+  AuthClientError,
   isNativeError,
   isOAuthProtocolError,
   isAuthInternalError,
-  isAuthSecurityError
+  isAuthSecurityError,
+  isAuthClientError
 };

package/dist/chunk-UN7X6SU5.js

@@ -0,0 +1,53 @@
+import {
+  signIn
+} from "./chunk-JOCGX3RP.js";
+
+// src/actions/signIn/signIn.ts
+import { z } from "zod/v4";
+import { createEndpoint, createEndpointConfig } from "@aura-stack/router";
+var signInConfig = (oauth) => {
+  return createEndpointConfig("/signIn/:oauth", {
+    schemas: {
+      params: z.object({
+        oauth: z.enum(
+          Object.keys(oauth),
+          "The OAuth provider is not supported or invalid."
+        )
+      }),
+      searchParams: z.object({
+        redirect: z.stringbool().optional().default(true),
+        redirectTo: z.string().optional()
+      })
+    }
+  });
+};
+var signInAction = (oauth) => {
+  return createEndpoint(
+    "GET",
+    "/signIn/:oauth",
+    async (ctx) => {
+      const {
+        request,
+        params: { oauth: oauth2 },
+        searchParams: { redirectTo, redirect },
+        context
+      } = ctx;
+      const signInResult = await signIn(oauth2, {
+        ctx: context,
+        headers: request.headers,
+        redirect,
+        redirectTo,
+        request
+      });
+      if (!redirect) {
+        return Response.json(signInResult, { status: 200 });
+      }
+      return signInResult;
+    },
+    signInConfig(oauth)
+  );
+};
+
+export {
+  signInAction
+};

package/dist/chunk-UZQJJD6A.js

@@ -0,0 +1,100 @@
+import {
+  getEnv
+} from "./chunk-WHNDRO3N.js";
+import {
+  AuthInternalError
+} from "./chunk-U5663F2U.js";
+
+// src/jose.ts
+import {
+  createJWT,
+  createJWS,
+  createJWE,
+  createDeriveKey,
+  createSecret
+} from "@aura-stack/jose";
+import { base64url } from "@aura-stack/jose/jose";
+import { encoder, getRandomBytes, getSubtleCrypto } from "@aura-stack/jose/crypto";
+var createJoseInstance = (secret) => {
+  secret ??= getEnv("SECRET");
+  if (!secret) {
+    throw new AuthInternalError(
+      "JOSE_INITIALIZATION_FAILED",
+      "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
+    );
+  }
+  const salt = getEnv("SALT");
+  if (!salt) {
+    throw new AuthInternalError(
+      "JOSE_INITIALIZATION_FAILED",
+      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
+    );
+  }
+  try {
+    createSecret(salt);
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_SALT_SECRET_VALUE",
+      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
+      { cause: error }
+    );
+  }
+  const jose = (async () => {
+    const derivedSigningKey = await createDeriveKey(secret, salt, "signing");
+    const derivedEncryptionKey = await createDeriveKey(secret, salt, "encryption");
+    const derivedCsrfTokenKey = await createDeriveKey(secret, salt, "csrfToken");
+    return {
+      jwt: createJWT({ jws: derivedSigningKey, jwe: derivedEncryptionKey }),
+      jws: createJWS(derivedCsrfTokenKey),
+      jwe: createJWE(derivedEncryptionKey)
+    };
+  })();
+  jose.catch(() => {
+  });
+  return {
+    decodeJWT: async (token, options) => {
+      const { jwt } = await jose;
+      return jwt.decodeJWT(token, options);
+    },
+    encodeJWT: async (payload) => {
+      const { jwt } = await jose;
+      return jwt.encodeJWT(payload);
+    },
+    signJWS: async (...args) => {
+      const { jws } = await jose;
+      return jws.signJWS(...args);
+    },
+    verifyJWS: async (...args) => {
+      const { jws } = await jose;
+      return jws.verifyJWS(...args);
+    },
+    encryptJWE: async (...args) => {
+      const { jwe } = await jose;
+      return jwe.encryptJWE(...args);
+    },
+    decryptJWE: async (...args) => {
+      const { jwe } = await jose;
+      return jwe.decryptJWE(...args);
+    }
+  };
+};
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
+};
+var decodeJWTOptions = {
+  jws: jwtVerificationOptions,
+  jwt: {
+    typ: "JWT"
+  }
+};
+
+export {
+  createJoseInstance,
+  jwtVerificationOptions,
+  decodeJWTOptions,
+  base64url,
+  encoder,
+  getRandomBytes,
+  getSubtleCrypto
+};

package/dist/{chunk-NUDITUKX.js → chunk-V6LLEAR4.js}

@@ -1,24 +1,30 @@
 import {
-  isJWTPayloadWithToken,
-  safeEquals
-} from "./chunk-4EKY7655.js";
-import {
-  equals
-} from "./chunk-QQVSRXGX.js";
-import {
+  base64url,
+  encoder,
+  getRandomBytes,
+  getSubtleCrypto,
   jwtVerificationOptions
-} from "./chunk-FRJFWTOY.js";
+} from "./chunk-UZQJJD6A.js";
+import {
+  equals,
+  isJWTPayloadWithToken,
+  timingSafeEqual
+} from "./chunk-LX3TJ2TJ.js";
 import {
   AuthSecurityError
-} from "./chunk-RRLIF4PQ.js";
+} from "./chunk-U5663F2U.js";
 
 // src/secure.ts
-import crypto from "crypto";
 var generateSecure = (length = 32) => {
-  return crypto.randomBytes(length).toString("base64url");
+  return base64url.encode(getRandomBytes(length));
+};
+var createSecretValue = (length = 32) => {
+  return base64url.encode(getRandomBytes(length));
 };
-var createHash = (data, base = "hex") => {
-  return crypto.createHash("sha256").update(data).digest().toString(base);
+var createHash = async (data) => {
+  const subtle = getSubtleCrypto();
+  const digest = await subtle.digest("SHA-256", encoder.encode(data));
+  return base64url.encode(new Uint8Array(digest));
 };
 var createPKCE = async (verifier) => {
   const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
@@ -26,7 +32,7 @@ var createPKCE = async (verifier) => {
   if (codeVerifier.length < 43 || codeVerifier.length > 128) {
     throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
   }
-  const codeChallenge = createHash(codeVerifier, "base64url");
+  const codeChallenge = await createHash(codeVerifier);
   return { codeVerifier, codeChallenge, method: "S256" };
 };
 var createCSRF = async (jose, csrfCookie) => {
@@ -55,7 +61,7 @@ var verifyCSRF = async (jose, cookie, header) => {
     if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
-    if (!safeEquals(cookiePayload.token, headerPayload.token)) {
+    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
     return true;
@@ -66,6 +72,7 @@ var verifyCSRF = async (jose, cookie, header) => {
 
 export {
   generateSecure,
+  createSecretValue,
   createHash,
   createPKCE,
   createCSRF,

package/dist/{chunk-4MYWAOLG.js → chunk-WHNDRO3N.js}

@@ -25,7 +25,26 @@ var env = new Proxy({}, {
     }
   }
 });
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
+var getEnvBoolean = (key) => {
+  const value = getEnv(key);
+  if (value === void 0) return false;
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on", "debug"].includes(normalized)) return true;
+  return false;
+};
+var getEnvArray = (key, defaultValue = []) => {
+  const value = getEnv(key);
+  if (!value) return defaultValue;
+  return value.split(/[,;\n]+/).map((v) => v.trim()).filter(Boolean);
+};
 
 export {
-  env
+  env,
+  getEnv,
+  getEnvBoolean,
+  getEnvArray
 };

package/dist/{chunk-5W4BRQYG.js → chunk-XY5R3EHH.js}

@@ -1,6 +1,9 @@
+import {
+  env
+} from "./chunk-WHNDRO3N.js";
 import {
   AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
+} from "./chunk-U5663F2U.js";
 
 // src/cookie.ts
 import { parse, parseSetCookie, serialize } from "@aura-stack/router/cookie";
@@ -41,7 +44,7 @@ var expiredCookieAttributes = {
   secure: true
 };
 var getCookie = (request, cookieName) => {
-  const cookies = request.headers.get("Cookie");
+  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
   if (!cookies) {
     throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
   }
@@ -86,7 +89,7 @@ var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
       attributes.sameSite = "lax";
       logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
     }
-    if (process.env.NODE_ENV === "production") {
+    if (env.NODE_ENV === "production") {
       logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
     }
     if (strategy === "host") {

package/dist/client/client.cjs

@@ -0,0 +1,135 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/client.ts
+var client_exports = {};
+__export(client_exports, {
+  createAuthClient: () => createAuthClient,
+  createClient: () => createClient
+});
+module.exports = __toCommonJS(client_exports);
+
+// src/errors.ts
+var AuthClientError = class extends Error {
+  type = "AUTH_CLIENT_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+var isNativeError = (error) => {
+  return error instanceof Error;
+};
+
+// src/client/client.ts
+var import_router = require("@aura-stack/router");
+var createClient = import_router.createClient;
+var createAuthClient = (options) => {
+  if (typeof window === "undefined" && !options.baseURL) {
+    throw new AuthClientError("`baseURL` is required when createAuthClient is used outside the browser.");
+  }
+  const client = createClient({
+    cache: "no-store",
+    credentials: "include",
+    baseURL: options.baseURL ?? window.location.origin,
+    ...options
+  });
+  const getCSRFToken = async () => {
+    try {
+      const response = await client.get("/csrfToken");
+      if (!response.ok) return null;
+      const data = await response.json();
+      return data.csrfToken;
+    } catch (error) {
+      console.error("Error fetching CSRF token:", error);
+      return null;
+    }
+  };
+  const getSession = async () => {
+    try {
+      const response = await client.get("/session");
+      if (!response.ok) return null;
+      const session = await response.json();
+      if (!session?.authenticated) return null;
+      return session.session;
+    } catch (error) {
+      console.error("Error fetching session:", error);
+      return null;
+    }
+  };
+  const signIn = async (oauth, options2) => {
+    try {
+      const response = await client.get("/signIn/:oauth", {
+        params: {
+          oauth
+        },
+        searchParams: {
+          ...options2,
+          redirect: false
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.signInURL) {
+        window.location.assign(json.signInURL);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-in:", error);
+      return { redirect: false, signInURL: "/" };
+    }
+  };
+  const signOut = async (options2) => {
+    try {
+      const csrfToken = await getCSRFToken();
+      if (!csrfToken) {
+        throw new AuthClientError("Failed to fetch CSRF token for sign-out.");
+      }
+      const response = await client.post("/signOut", {
+        searchParams: {
+          redirectTo: options2?.redirectTo ?? "/",
+          token_type_hint: "session_token"
+        },
+        headers: {
+          "X-CSRF-Token": csrfToken
+        }
+      });
+      const json = await response.json();
+      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.url) {
+        window.location.assign(json.url);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-out:", error);
+      throw isNativeError(error) ? error : new AuthClientError("Sign-out failed.", "The sign-out request failed.", { cause: error });
+    }
+  };
+  return {
+    getSession,
+    signIn,
+    signOut
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createAuthClient,
+  createClient
+});

package/dist/client/client.d.ts

@@ -0,0 +1,85 @@
+import { l as AuthClientOptions, m as Session, B as BuiltInOAuthProvider, n as SignInOptions, o as SignOutOptions } from '../index-_aXtxb_s.js';
+import '@aura-stack/router/types';
+import * as zod_v4_core from 'zod/v4/core';
+import * as zod from 'zod';
+import * as _aura_stack_router from '@aura-stack/router';
+import { LiteralUnion } from '../@types/utility.js';
+import '../schemas.js';
+import 'zod/v4';
+import '@aura-stack/jose';
+import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
+import 'jose';
+
+declare const createClient: (options: _aura_stack_router.ClientOptions) => _aura_stack_router.Client<[_aura_stack_router.RouteEndpoint<"GET", "/signIn/:oauth", {
+    schemas?: {
+        params: zod.ZodObject<{
+            oauth: zod.ZodEnum<{
+                [x: string & Record<never, never>]: string & Record<never, never>;
+                github: "github";
+                bitbucket: "bitbucket";
+                figma: "figma";
+                discord: "discord";
+                gitlab: "gitlab";
+                spotify: "spotify";
+                x: "x";
+                strava: "strava";
+                mailchimp: "mailchimp";
+                pinterest: "pinterest";
+                twitch: "twitch";
+                notion: "notion";
+                dropbox: "dropbox";
+                atlassian: "atlassian";
+            }>;
+        }, zod_v4_core.$strip>;
+        searchParams: zod.ZodObject<{
+            redirect: zod.ZodDefault<zod.ZodOptional<zod.ZodCodec<zod.ZodString, zod.ZodBoolean>>>;
+            redirectTo: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strip>;
+    } | undefined;
+}>, _aura_stack_router.RouteEndpoint<"GET", "/callback/:oauth", {
+    schemas?: {
+        params: zod.ZodObject<{
+            oauth: zod.ZodEnum<{
+                [x: string & Record<never, never>]: string & Record<never, never>;
+                github: "github";
+                bitbucket: "bitbucket";
+                figma: "figma";
+                discord: "discord";
+                gitlab: "gitlab";
+                spotify: "spotify";
+                x: "x";
+                strava: "strava";
+                mailchimp: "mailchimp";
+                pinterest: "pinterest";
+                twitch: "twitch";
+                notion: "notion";
+                dropbox: "dropbox";
+                atlassian: "atlassian";
+            }>;
+        }, zod_v4_core.$strip>;
+        searchParams: zod.ZodObject<{
+            code: zod.ZodString;
+            state: zod.ZodString;
+        }, zod_v4_core.$strip>;
+    } | undefined;
+}>, _aura_stack_router.RouteEndpoint<"GET", "/session", {
+    schemas?: _aura_stack_router.EndpointSchemas | undefined;
+}>, _aura_stack_router.RouteEndpoint<"POST", "/signOut", {
+    schemas?: {
+        searchParams: zod.ZodObject<{
+            token_type_hint: zod.ZodLiteral<"session_token">;
+            redirectTo: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strip>;
+    } | undefined;
+}>, _aura_stack_router.RouteEndpoint<"GET", "/csrfToken", {
+    schemas?: _aura_stack_router.EndpointSchemas | undefined;
+}>]>;
+declare const createAuthClient: (options: AuthClientOptions) => {
+    getSession: () => Promise<Session | null>;
+    signIn: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: SignInOptions) => Promise<any>;
+    signOut: (options?: SignOutOptions) => Promise<any>;
+};
+
+export { createAuthClient, createClient };

package/dist/client/client.js

@@ -0,0 +1,9 @@
+import {
+  createAuthClient,
+  createClient
+} from "../chunk-4RWSYUKX.js";
+import "../chunk-U5663F2U.js";
+export {
+  createAuthClient,
+  createClient
+};