@aura-stack/auth 0.4.0 → 0.5.0

package/dist/actions/signIn/authorization.cjs

@@ -20,131 +20,65 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/actions/signIn/authorization.ts
 var authorization_exports = {};
 __export(authorization_exports, {
-  createAuthorizationURL: () => createAuthorizationURL,
   createRedirectTo: () => createRedirectTo,
   createRedirectURI: () => createRedirectURI,
+  createSignInURL: () => createSignInURL,
+  getBaseURL: () => getBaseURL,
   getOriginURL: () => getOriginURL,
   getTrustedOrigins: () => getTrustedOrigins
 });
 module.exports = __toCommonJS(authorization_exports);
 
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
+
 // src/errors.ts
 var AuthInternalError = class extends Error {
   type = "AUTH_INTERNAL_ERROR";
   code;
-  constructor(code, message, options2) {
-    super(message, options2);
+  constructor(code, message, options) {
+    super(message, options);
     this.code = code;
     this.name = new.target.name;
     Error.captureStackTrace(this, new.target);
   }
 };
 
-// src/schemas.ts
-var import_zod = require("zod");
-var OAuthProviderCredentialsSchema = (0, import_zod.object)({
-  id: (0, import_zod.string)(),
-  name: (0, import_zod.string)(),
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)(),
-  profile: import_zod.z.function().optional()
-});
-var OAuthProviderConfigSchema = (0, import_zod.object)({
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)().optional(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  state: (0, import_zod.string)(),
-  codeChallenge: (0, import_zod.string)(),
-  codeChallengeMethod: (0, import_zod.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_zod.object)({
-  state: (0, import_zod.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_zod.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional(),
-  state: (0, import_zod.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  code: (0, import_zod.string)(),
-  codeVerifier: (0, import_zod.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_zod.object)({
-  access_token: (0, import_zod.string)(),
-  token_type: (0, import_zod.string)().optional(),
-  expires_in: (0, import_zod.number)().optional(),
-  refresh_token: (0, import_zod.string)().optional(),
-  scope: (0, import_zod.string)().optional().or((0, import_zod.null)())
-});
-var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional()
-});
-var OAuthErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.string)(),
-  error_description: (0, import_zod.string)().optional()
-});
-var OAuthEnvSchema = (0, import_zod.object)({
-  clientId: import_zod.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_zod.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-
 // src/utils.ts
 var import_router = require("@aura-stack/router");
-var toSnakeCase = (str) => {
-  return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
-};
-var toUpperCase = (str) => {
-  return str.toUpperCase();
-};
-var toCastCase = (obj, type = "snake") => {
-  return Object.entries(obj).reduce((previous, [key, value]) => {
-    const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
-    return { ...previous, [newKey]: value };
-  }, {});
-};
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var extractPath = (url) => {
-  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
-  const match = url.match(pathRegex);
-  return match && match[2] ? match[2] : "/";
-};
 
 // src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
 var unsafeChars = [
   "<",
   ">",
@@ -233,41 +167,54 @@ var isTrustedOrigin = (url, trustedOrigins) => {
   return false;
 };
 
-// src/actions/signIn/authorization.ts
-var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod, logger) => {
-  const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod });
-  if (!parsed.success) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        scope: oauthConfig.scope,
-        redirect_uri: redirectURI,
-        has_state: Boolean(state),
-        has_code_challenge: Boolean(codeChallenge),
-        code_challenge_method: codeChallengeMethod
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const { authorizeURL, ...options2 } = parsed.data;
-  const { userInfo, accessToken, clientSecret, ...required } = options2;
-  const searchParams = new URLSearchParams(toCastCase(required));
-  return `${authorizeURL}?${searchParams}`;
+// src/utils.ts
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
 };
+var extractPath = (url) => {
+  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
+  const match = url.match(pathRegex);
+  return match && match[2] ? match[2] : "/";
+};
+
+// src/actions/signIn/authorization.ts
 var getTrustedOrigins = async (request, trustedOrigins) => {
   if (!trustedOrigins) return [];
   const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
   return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
 };
+var getBaseURL = async ({
+  ctx,
+  request,
+  headers: headersInit
+}) => {
+  const origin = getEnv("BASE_URL") || ctx?.baseURL;
+  if (origin && origin !== "/") return origin;
+  if (ctx?.trustedProxyHeaders) {
+    const headers = headersInit && new Headers(headersInit) || request?.headers;
+    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
+    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
+    if (host) return `${protocol}://${host}`;
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
+    );
+  }
+  try {
+    return new URL(request?.url ?? "not-found").origin;
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
+      { cause: error }
+    );
+  }
+};
 var getOriginURL = async (request, context) => {
-  const headers = request.headers;
-  let origin = new URL(request.url).origin;
   const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
-  trustedOrigins.push(origin);
-  if (context?.trustedProxyHeaders) {
-    const protocol = headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Proto") ?? "http";
-    const host = headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Host") ?? null;
-    origin = `${protocol}://${host}`;
-  }
+  trustedOrigins.push(new URL(request.url).origin);
+  const origin = await getBaseURL({ request, ctx: context });
   if (!isTrustedOrigin(origin, trustedOrigins)) {
     context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
     throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
@@ -278,6 +225,17 @@ var createRedirectURI = async (request, oauth, context) => {
   const origin = await getOriginURL(request, context);
   return `${origin}${context.basePath}/callback/${oauth}`;
 };
+var createSignInURL = async ({
+  request,
+  oauth,
+  ctx,
+  redirectTo
+}) => {
+  const origin = await getOriginURL(request, ctx);
+  const searchParams = new URLSearchParams();
+  if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
+  return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
+};
 var createRedirectTo = async (request, redirectTo, context) => {
   try {
     const headers = request.headers;
@@ -314,9 +272,10 @@ var createRedirectTo = async (request, redirectTo, context) => {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createAuthorizationURL,
   createRedirectTo,
   createRedirectURI,
+  createSignInURL,
+  getBaseURL,
   getOriginURL,
   getTrustedOrigins
 });

package/dist/actions/signIn/authorization.d.ts

@@ -1,30 +1,25 @@
+import { A as AuthConfig } from '../../index-_aXtxb_s.js';
 import { GlobalContext } from '@aura-stack/router';
-import { h as OAuthProviderCredentials, I as InternalLogger, d as AuthConfig } from '../../index-CSyIJmCM.js';
 import 'zod';
 import '../../schemas.js';
-import '../../jose.js';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
 import '@aura-stack/router/cookie';
 import '../../@types/utility.js';
+import 'jose';
+import 'zod/v4/core';
 
-/**
- * Constructs the request URI for the Authorization Request to the third-party OAuth service. It includes
- * the necessary query parameters such as `client_id`, `redirect_uri`, `response_type`, `scope`, `state`,
- * `code_challenge`, and `code_challenge_method`.
- *
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1
- * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4
- *
- * @param oauthConfig - The OAuth configuration for the third-party service.
- * @param redirectURI - The redirect URI where the OAuth service will send the user after authorization.
- * @param state - A unique string used to maintain state between the request and callback.
- */
-declare const createAuthorizationURL: (oauthConfig: OAuthProviderCredentials, redirectURI: string, state: string, codeChallenge: string, codeChallengeMethod: string, logger?: InternalLogger) => string;
 /**
  * Resolves trusted origins from config (array or function).
  */
 declare const getTrustedOrigins: (request: Request, trustedOrigins: AuthConfig["trustedOrigins"]) => Promise<string[]>;
+declare const getBaseURL: ({ ctx, request, headers: headersInit, }: {
+    ctx?: GlobalContext;
+    request?: Request;
+    headers?: HeadersInit;
+}) => Promise<string>;
 declare const getOriginURL: (request: Request, context?: GlobalContext) => Promise<string>;
 /**
  * Creates the redirect URI for the OAuth callback based on the original request URL and the OAuth provider.
@@ -35,6 +30,12 @@ declare const getOriginURL: (request: Request, context?: GlobalContext) => Promi
  * @returns The redirect URI for the OAuth callback.
  */
 declare const createRedirectURI: (request: Request, oauth: string, context: GlobalContext) => Promise<string>;
+declare const createSignInURL: ({ request, oauth, ctx, redirectTo, }: {
+    request: Request;
+    oauth: string;
+    ctx: GlobalContext;
+    redirectTo?: string;
+}) => Promise<string>;
 /**
  * Verifies if the request's origin matches the expected origin. It accepts the redirectTo search
  * parameter for redirection. It checks the Referer and Origin headers and the request URL against
@@ -50,4 +51,4 @@ declare const createRedirectURI: (request: Request, oauth: string, context: Glob
  */
 declare const createRedirectTo: (request: Request, redirectTo?: string, context?: GlobalContext) => Promise<string>;
 
-export { createAuthorizationURL, createRedirectTo, createRedirectURI, getOriginURL, getTrustedOrigins };
+export { createRedirectTo, createRedirectURI, createSignInURL, getBaseURL, getOriginURL, getTrustedOrigins };

package/dist/actions/signIn/authorization.js

@@ -1,18 +1,19 @@
 import {
-  createAuthorizationURL,
   createRedirectTo,
   createRedirectURI,
+  createSignInURL,
+  getBaseURL,
   getOriginURL,
   getTrustedOrigins
-} from "../../chunk-XUP6KKNG.js";
-import "../../chunk-KJBAQZX2.js";
-import "../../chunk-4EKY7655.js";
-import "../../chunk-QQVSRXGX.js";
-import "../../chunk-RRLIF4PQ.js";
+} from "../../chunk-LATR3NIV.js";
+import "../../chunk-LX3TJ2TJ.js";
+import "../../chunk-WHNDRO3N.js";
+import "../../chunk-U5663F2U.js";
 export {
-  createAuthorizationURL,
   createRedirectTo,
   createRedirectURI,
+  createSignInURL,
+  getBaseURL,
   getOriginURL,
   getTrustedOrigins
 };