@aura-stack/auth 0.4.0 → 0.5.0

package/dist/chunk-4EKY7655.js

@@ -1,123 +0,0 @@
-import {
-  equals
-} from "./chunk-QQVSRXGX.js";
-
-// src/assert.ts
-import { timingSafeEqual } from "crypto";
-var isFalsy = (value) => {
-  return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
-};
-var isRequest = (value) => {
-  return typeof Request !== "undefined" && value instanceof Request;
-};
-var unsafeChars = [
-  "<",
-  ">",
-  '"',
-  "`",
-  " ",
-  "\r",
-  "\n",
-  "	",
-  "\\",
-  "%2F",
-  "%5C",
-  "%2f",
-  "%5c",
-  "\r\n",
-  "%0A",
-  "%0D",
-  "%0a",
-  "%0d",
-  "..",
-  "//",
-  "///",
-  "...",
-  "%20",
-  "\0"
-];
-var isValidURL = (value) => {
-  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
-    return false;
-  }
-  const match = value.match(/^(https?:\/\/)(.*)$/);
-  if (!match) return false;
-  const rest = match[2];
-  for (const char of unsafeChars) {
-    if (rest.includes(char)) return false;
-  }
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
-  return regex.test(match[0]);
-};
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-var isRelativeURL = (value) => {
-  if (value.length > 100) return false;
-  for (const char of unsafeChars) {
-    if (value.includes(char)) return false;
-  }
-  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
-  return regex.test(value);
-};
-var isSameOrigin = (origin, expected) => {
-  const originURL = new URL(origin);
-  const expectedURL = new URL(expected);
-  return equals(originURL.origin, expectedURL.origin);
-};
-var patternToRegex = (pattern) => {
-  try {
-    if (pattern.length > 2048) return null;
-    pattern = pattern.replace(/\\/g, "");
-    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
-    if (!match) return null;
-    const [, protocol, host, port] = match;
-    const hasWildcard = host.includes("*");
-    if (hasWildcard && !host.startsWith("*.")) return null;
-    if (hasWildcard && host.slice(2).includes("*")) return null;
-    const domain = hasWildcard ? host.slice(2) : host;
-    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
-    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
-    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
-  } catch {
-    return null;
-  }
-};
-var isTrustedOrigin = (url, trustedOrigins) => {
-  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
-  try {
-    const urlOrigin = new URL(url).origin;
-    for (const pattern of trustedOrigins) {
-      const regex = patternToRegex(pattern);
-      if (regex?.test(urlOrigin)) return true;
-      try {
-        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return false;
-};
-var safeEquals = (a, b) => {
-  const bufferA = Buffer.from(a);
-  const bufferB = Buffer.from(b);
-  if (bufferA.length !== bufferB.length) {
-    return false;
-  }
-  return timingSafeEqual(bufferA, bufferB);
-};
-
-export {
-  isFalsy,
-  isRequest,
-  unsafeChars,
-  isValidURL,
-  isJWTPayloadWithToken,
-  isRelativeURL,
-  isSameOrigin,
-  patternToRegex,
-  isTrustedOrigin,
-  safeEquals
-};

package/dist/chunk-7QF22LHP.js

@@ -1,67 +0,0 @@
-import {
-  createAuthorizationURL,
-  createRedirectTo,
-  createRedirectURI
-} from "./chunk-XUP6KKNG.js";
-import {
-  createPKCE,
-  generateSecure
-} from "./chunk-NUDITUKX.js";
-import {
-  cacheControl
-} from "./chunk-EBAMFRB7.js";
-
-// src/actions/signIn/signIn.ts
-import { z } from "zod";
-import { createEndpoint, createEndpointConfig, HeadersBuilder } from "@aura-stack/router";
-var signInConfig = (oauth) => {
-  return createEndpointConfig("/signIn/:oauth", {
-    schemas: {
-      params: z.object({
-        oauth: z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: z.object({
-        redirectTo: z.string().optional()
-      })
-    }
-  });
-};
-var signInAction = (oauth) => {
-  return createEndpoint(
-    "GET",
-    "/signIn/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { redirectTo },
-        context
-      } = ctx;
-      const { oauth: providers, cookies, logger } = context;
-      const state = generateSecure();
-      const redirectURI = await createRedirectURI(request, oauth2, context);
-      const redirectToValue = await createRedirectTo(request, redirectTo, context);
-      const { codeVerifier, codeChallenge, method } = await createPKCE();
-      const authorization = createAuthorizationURL(providers[oauth2], redirectURI, state, codeChallenge, method, logger);
-      logger?.log("SIGN_IN_INITIATED", {
-        structuredData: { oauth_provider: oauth2, code_challenge_method: method }
-      });
-      const headers = new HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(cookies.state.name, state, cookies.state.attributes).setCookie(cookies.redirectURI.name, redirectURI, cookies.redirectURI.attributes).setCookie(cookies.redirectTo.name, redirectToValue, cookies.redirectTo.attributes).setCookie(cookies.codeVerifier.name, codeVerifier, cookies.codeVerifier.attributes).toHeaders();
-      return Response.json(
-        { oauth: oauth2 },
-        {
-          status: 302,
-          headers
-        }
-      );
-    },
-    signInConfig(oauth)
-  );
-};
-
-export {
-  signInAction
-};

package/dist/chunk-ALG3GIV4.js

@@ -1,95 +0,0 @@
-import {
-  createRedirectTo
-} from "./chunk-XUP6KKNG.js";
-import {
-  verifyCSRF
-} from "./chunk-NUDITUKX.js";
-import {
-  getBaseURL,
-  getErrorName
-} from "./chunk-QQVSRXGX.js";
-import {
-  expiredCookieAttributes
-} from "./chunk-5W4BRQYG.js";
-import {
-  secureApiHeaders
-} from "./chunk-EBAMFRB7.js";
-import {
-  AuthSecurityError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/actions/signOut/signOut.ts
-import { z } from "zod";
-import { createEndpoint, createEndpointConfig, HeadersBuilder, statusCode } from "@aura-stack/router";
-var config = createEndpointConfig({
-  schemas: {
-    searchParams: z.object({
-      token_type_hint: z.literal("session_token"),
-      redirectTo: z.string().optional()
-    })
-  }
-});
-var signOutAction = createEndpoint(
-  "POST",
-  "/signOut",
-  async (ctx) => {
-    const {
-      request,
-      headers,
-      searchParams: { redirectTo },
-      context
-    } = ctx;
-    const { jose, cookies, logger } = context;
-    const session = headers.getCookie(cookies.sessionToken.name);
-    const csrfToken = headers.getCookie(cookies.csrfToken.name);
-    const header = headers.getHeader("X-CSRF-Token");
-    logger?.log("SIGN_OUT_ATTEMPT", {
-      structuredData: {
-        has_session: Boolean(session),
-        has_csrf_token: Boolean(csrfToken),
-        has_csrf_header: Boolean(header)
-      }
-    });
-    if (!session) {
-      logger?.log("SESSION_TOKEN_MISSING");
-      throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-    }
-    if (!csrfToken) {
-      logger?.log("CSRF_TOKEN_MISSING");
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-    }
-    if (!header) {
-      logger?.log("CSRF_HEADER_MISSING");
-      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
-    }
-    try {
-      await verifyCSRF(jose, csrfToken, header);
-    } catch (error) {
-      logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
-    }
-    logger?.log("SIGN_OUT_CSRF_VERIFIED");
-    try {
-      await jose.decodeJWT(session);
-      logger?.log("SIGN_OUT_SUCCESS");
-    } catch (error) {
-      logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
-    }
-    const baseURL = getBaseURL(request);
-    const location = await createRedirectTo(
-      new Request(baseURL, {
-        headers: headers.toHeaders()
-      }),
-      redirectTo,
-      context
-    );
-    logger?.log("SIGN_OUT_REDIRECT", { structuredData: { location } });
-    const headersList = new HeadersBuilder(secureApiHeaders).setHeader("Location", location).setCookie(cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ message: "Signed out successfully" }, { status: statusCode.ACCEPTED, headers: headersList });
-  },
-  config
-);
-
-export {
-  signOutAction
-};

package/dist/chunk-FRJFWTOY.js

@@ -1,70 +0,0 @@
-import {
-  env
-} from "./chunk-4MYWAOLG.js";
-import {
-  AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/jose.ts
-import {
-  createJWT,
-  createJWS,
-  createJWE,
-  createDeriveKey,
-  createSecret
-} from "@aura-stack/jose";
-var createJoseInstance = (secret) => {
-  secret ??= env.AURA_AUTH_SECRET ?? env.AUTH_SECRET;
-  if (!secret) {
-    throw new AuthInternalError(
-      "JOSE_INITIALIZATION_FAILED",
-      "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
-    );
-  }
-  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT;
-  if (!salt) {
-    throw new AuthInternalError(
-      "JOSE_INITIALIZATION_FAILED",
-      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
-    );
-  }
-  try {
-    createSecret(salt);
-  } catch (error) {
-    throw new AuthInternalError(
-      "INVALID_SALT_SECRET_VALUE",
-      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
-      { cause: error }
-    );
-  }
-  const { derivedKey: derivedSigningKey } = createDeriveKey(secret, salt, "signing");
-  const { derivedKey: derivedEncryptionKey } = createDeriveKey(secret, salt, "encryption");
-  const { derivedKey: derivedCsrfTokenKey } = createDeriveKey(secret, salt, "csrfToken");
-  const { decodeJWT, encodeJWT } = createJWT({ jws: derivedSigningKey, jwe: derivedEncryptionKey });
-  const { signJWS, verifyJWS } = createJWS(derivedCsrfTokenKey);
-  const { encryptJWE, decryptJWE } = createJWE(derivedEncryptionKey);
-  return {
-    decodeJWT,
-    encodeJWT,
-    signJWS,
-    verifyJWS,
-    encryptJWE,
-    decryptJWE
-  };
-};
-var jwtVerificationOptions = {
-  algorithms: ["HS256"],
-  typ: "JWT"
-};
-var decodeJWTOptions = {
-  jws: jwtVerificationOptions,
-  jwt: {
-    typ: "JWT"
-  }
-};
-
-export {
-  createJoseInstance,
-  jwtVerificationOptions,
-  decodeJWTOptions
-};

package/dist/chunk-PHFH2MGS.js

@@ -1,36 +0,0 @@
-import {
-  getErrorName,
-  toISOString
-} from "./chunk-QQVSRXGX.js";
-import {
-  expiredCookieAttributes,
-  getCookie
-} from "./chunk-5W4BRQYG.js";
-import {
-  secureApiHeaders
-} from "./chunk-EBAMFRB7.js";
-
-// src/actions/session/session.ts
-import { createEndpoint, HeadersBuilder } from "@aura-stack/router";
-var sessionAction = createEndpoint("GET", "/session", async (ctx) => {
-  const {
-    request,
-    context: { jose, cookies, logger }
-  } = ctx;
-  try {
-    const session = getCookie(request, cookies.sessionToken.name);
-    const decoded = await jose.decodeJWT(session);
-    logger?.log("AUTH_SESSION_VALID");
-    const { exp, iat, jti, nbf, ...user } = decoded;
-    const headers = new Headers(secureApiHeaders);
-    return Response.json({ user, expires: toISOString(exp * 1e3) }, { headers });
-  } catch (error) {
-    logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
-    const headers = new HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ authenticated: false, message: "Unauthorized" }, { status: 401, headers });
-  }
-});
-
-export {
-  sessionAction
-};

package/dist/chunk-QQVSRXGX.js

@@ -1,149 +0,0 @@
-import {
-  isAuthInternalError,
-  isAuthSecurityError,
-  isOAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/utils.ts
-import { isInvalidZodSchemaError, isRouterError } from "@aura-stack/router";
-var toSnakeCase = (str) => {
-  return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
-};
-var toUpperCase = (str) => {
-  return str.toUpperCase();
-};
-var toCastCase = (obj, type = "snake") => {
-  return Object.entries(obj).reduce((previous, [key, value]) => {
-    const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
-    return { ...previous, [newKey]: value };
-  }, {});
-};
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var createErrorHandler = (logger) => {
-  return (error) => {
-    if (isRouterError(error)) {
-      const { message, status, statusText } = error;
-      logger?.log("ROUTER_INTERNAL_ERROR");
-      return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
-    }
-    if (isInvalidZodSchemaError(error)) {
-      logger?.log("INVALID_REQUEST");
-      return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
-    }
-    if (isOAuthProtocolError(error)) {
-      const { error: errorCode, message, type, errorURI } = error;
-      logger?.log("OAUTH_PROTOCOL_ERROR", {
-        structuredData: {
-          error: errorCode,
-          error_description: message,
-          error_uri: errorURI ?? ""
-        }
-      });
-      return Response.json(
-        {
-          type,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    if (isAuthInternalError(error)) {
-      const { type, code, message } = error;
-      logger?.log("INVALID_OAUTH_CONFIGURATION", {
-        structuredData: {
-          error: code,
-          error_description: message
-        }
-      });
-      return Response.json(
-        {
-          type,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    if (isAuthSecurityError(error)) {
-      const { type, code, message } = error;
-      logger?.log("INVALID_OAUTH_CONFIGURATION", {
-        structuredData: {
-          error: code,
-          error_description: message
-        }
-      });
-      return Response.json(
-        {
-          type,
-          code,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    logger?.log("SERVER_ERROR");
-    return Response.json(
-      { type: "SERVER_ERROR", code: "SERVER_ERROR", message: "An unexpected error occurred" },
-      { status: 500 }
-    );
-  };
-};
-var getBaseURL = (request) => {
-  const url = new URL(request.url);
-  return `${url.origin}${url.pathname}`;
-};
-var toISOString = (date) => {
-  return new Date(date).toISOString();
-};
-var useSecureCookies = (request, trustedProxyHeaders) => {
-  return trustedProxyHeaders ? request.url.startsWith("https://") || request.headers.get("X-Forwarded-Proto") === "https" || (request.headers.get("Forwarded")?.includes("proto=https") ?? false) : request.url.startsWith("https://");
-};
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
-  }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
-      }
-    };
-  }, {});
-};
-var extractPath = (url) => {
-  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
-  const match = url.match(pathRegex);
-  return match && match[2] ? match[2] : "/";
-};
-var createStructuredData = (data, sdID = "metadata") => {
-  const entries = Object.entries(data);
-  if (entries.length === 0) return `[${sdID}]`;
-  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
-  return `[${sdID} ${values}]`;
-};
-var getErrorName = (error) => {
-  if (error instanceof Error) {
-    return error.name;
-  }
-  return typeof error === "string" ? error : "UnknownError";
-};
-
-export {
-  toSnakeCase,
-  toUpperCase,
-  toCastCase,
-  equals,
-  createErrorHandler,
-  getBaseURL,
-  toISOString,
-  useSecureCookies,
-  formatZodError,
-  extractPath,
-  createStructuredData,
-  getErrorName
-};