@aura-stack/auth 0.4.0 → 0.6.0

package/dist/assert.d.ts

@@ -1,33 +0,0 @@
-import { J as JWTPayloadWithToken } from './index-CSyIJmCM.js';
-import 'zod';
-import './schemas.js';
-import './jose.js';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/router/cookie';
-import './@types/utility.js';
-
-declare const isFalsy: (value: unknown) => boolean;
-declare const isRequest: (value: unknown) => value is Request;
-declare const unsafeChars: string[];
-declare const isValidURL: (value: string) => boolean;
-declare const isJWTPayloadWithToken: (payload: unknown) => payload is JWTPayloadWithToken;
-declare const isRelativeURL: (value: string) => boolean;
-declare const isSameOrigin: (origin: string, expected: string) => boolean;
-/**
- * Converts a trusted origin pattern to a regex for matching.
- * Supports `*` as subdomain wildcard: `https://*.example.com` matches `https://app.example.com`
- * @todo: add support to Custom URI Schemes (e.g. `myapp://*`).
- */
-declare const patternToRegex: (pattern: string) => RegExp | null;
-/**
- * Checks if a URL matches any of the trusted origin patterns.
- * A URL is trusted if its origin matches any pattern (exact or wildcard).
- *
- * @param url - The URL to validate (e.g. from Referer, Origin, redirectTo)
- * @param trustedOrigins - Array of exact URLs or patterns (e.g. `https://*.example.com`)
- */
-declare const isTrustedOrigin: (url: string, trustedOrigins: string[]) => boolean;
-declare const safeEquals: (a: string, b: string) => boolean;
-
-export { isFalsy, isJWTPayloadWithToken, isRelativeURL, isRequest, isSameOrigin, isTrustedOrigin, isValidURL, patternToRegex, safeEquals, unsafeChars };

package/dist/assert.js

@@ -1,26 +0,0 @@
-import {
-  isFalsy,
-  isJWTPayloadWithToken,
-  isRelativeURL,
-  isRequest,
-  isSameOrigin,
-  isTrustedOrigin,
-  isValidURL,
-  patternToRegex,
-  safeEquals,
-  unsafeChars
-} from "./chunk-4EKY7655.js";
-import "./chunk-QQVSRXGX.js";
-import "./chunk-RRLIF4PQ.js";
-export {
-  isFalsy,
-  isJWTPayloadWithToken,
-  isRelativeURL,
-  isRequest,
-  isSameOrigin,
-  isTrustedOrigin,
-  isValidURL,
-  patternToRegex,
-  safeEquals,
-  unsafeChars
-};

package/dist/chunk-4EKY7655.js

@@ -1,123 +0,0 @@
-import {
-  equals
-} from "./chunk-QQVSRXGX.js";
-
-// src/assert.ts
-import { timingSafeEqual } from "crypto";
-var isFalsy = (value) => {
-  return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
-};
-var isRequest = (value) => {
-  return typeof Request !== "undefined" && value instanceof Request;
-};
-var unsafeChars = [
-  "<",
-  ">",
-  '"',
-  "`",
-  " ",
-  "\r",
-  "\n",
-  "	",
-  "\\",
-  "%2F",
-  "%5C",
-  "%2f",
-  "%5c",
-  "\r\n",
-  "%0A",
-  "%0D",
-  "%0a",
-  "%0d",
-  "..",
-  "//",
-  "///",
-  "...",
-  "%20",
-  "\0"
-];
-var isValidURL = (value) => {
-  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
-    return false;
-  }
-  const match = value.match(/^(https?:\/\/)(.*)$/);
-  if (!match) return false;
-  const rest = match[2];
-  for (const char of unsafeChars) {
-    if (rest.includes(char)) return false;
-  }
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
-  return regex.test(match[0]);
-};
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-var isRelativeURL = (value) => {
-  if (value.length > 100) return false;
-  for (const char of unsafeChars) {
-    if (value.includes(char)) return false;
-  }
-  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
-  return regex.test(value);
-};
-var isSameOrigin = (origin, expected) => {
-  const originURL = new URL(origin);
-  const expectedURL = new URL(expected);
-  return equals(originURL.origin, expectedURL.origin);
-};
-var patternToRegex = (pattern) => {
-  try {
-    if (pattern.length > 2048) return null;
-    pattern = pattern.replace(/\\/g, "");
-    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
-    if (!match) return null;
-    const [, protocol, host, port] = match;
-    const hasWildcard = host.includes("*");
-    if (hasWildcard && !host.startsWith("*.")) return null;
-    if (hasWildcard && host.slice(2).includes("*")) return null;
-    const domain = hasWildcard ? host.slice(2) : host;
-    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
-    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
-    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
-  } catch {
-    return null;
-  }
-};
-var isTrustedOrigin = (url, trustedOrigins) => {
-  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
-  try {
-    const urlOrigin = new URL(url).origin;
-    for (const pattern of trustedOrigins) {
-      const regex = patternToRegex(pattern);
-      if (regex?.test(urlOrigin)) return true;
-      try {
-        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return false;
-};
-var safeEquals = (a, b) => {
-  const bufferA = Buffer.from(a);
-  const bufferB = Buffer.from(b);
-  if (bufferA.length !== bufferB.length) {
-    return false;
-  }
-  return timingSafeEqual(bufferA, bufferB);
-};
-
-export {
-  isFalsy,
-  isRequest,
-  unsafeChars,
-  isValidURL,
-  isJWTPayloadWithToken,
-  isRelativeURL,
-  isSameOrigin,
-  patternToRegex,
-  isTrustedOrigin,
-  safeEquals
-};

package/dist/chunk-4MYWAOLG.js

@@ -1,31 +0,0 @@
-// src/env.ts
-var env = new Proxy({}, {
-  get(_, prop) {
-    if (typeof prop !== "string") return void 0;
-    const hasProperty = (process2) => {
-      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
-    };
-    try {
-      if (typeof process !== "undefined" && hasProperty(process.env)) {
-        return process.env[prop];
-      }
-      if (typeof import.meta !== "undefined" && hasProperty(import.meta.env)) {
-        return import.meta.env[prop];
-      }
-      if (typeof Deno !== "undefined" && Deno.env?.get) {
-        return Deno.env.get(prop);
-      }
-      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
-        return Bun.env[prop];
-      }
-      const globalValue = globalThis[prop];
-      return typeof globalValue === "string" ? globalValue : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-});
-
-export {
-  env
-};

package/dist/chunk-4YHJ4IEQ.js

@@ -1,25 +0,0 @@
-// src/oauth/bitbucket.ts
-var bitbucket = (options) => {
-  return {
-    id: "bitbucket",
-    name: "Bitbucket",
-    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-    accessToken: "https://bitbucket.org/site/oauth2/access_token",
-    userInfo: "https://api.bitbucket.org/2.0/user",
-    scope: "account email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.uuid ?? profile.account_id,
-        name: profile.display_name ?? profile.nickname,
-        image: profile.links.avatar?.href,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  bitbucket
-};

package/dist/chunk-54CZPKR4.js

@@ -1,25 +0,0 @@
-// src/oauth/strava.ts
-var strava = (options) => {
-  return {
-    id: "strava",
-    name: "Strava",
-    authorizeURL: "https://www.strava.com/oauth/authorize",
-    accessToken: "https://www.strava.com/oauth/token",
-    userInfo: "https://www.strava.com/api/v3/athlete",
-    scope: "read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: `${profile.firstname} ${profile.lastname}`,
-        image: profile.profile,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  strava
-};

package/dist/chunk-5LZ7TOM3.js

@@ -1,25 +0,0 @@
-// src/oauth/gitlab.ts
-var gitlab = (options) => {
-  return {
-    id: "gitlab",
-    name: "GitLab",
-    authorizeURL: "https://gitlab.com/oauth/authorize",
-    accessToken: "https://gitlab.com/oauth/token",
-    userInfo: "https://gitlab.com/api/v4/user",
-    scope: "read_user",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.username,
-        email: profile.email,
-        image: profile.avatar_url
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  gitlab
-};

package/dist/chunk-5W4BRQYG.js

@@ -1,201 +0,0 @@
-import {
-  AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/cookie.ts
-import { parse, parseSetCookie, serialize } from "@aura-stack/router/cookie";
-var COOKIE_NAME = "aura-auth";
-var defaultCookieOptions = {
-  httpOnly: true,
-  sameSite: "lax",
-  path: "/",
-  maxAge: 60 * 60 * 24 * 15
-};
-var defaultStandardCookieConfig = {
-  secure: false,
-  httpOnly: true
-};
-var defaultSecureCookieConfig = {
-  secure: true,
-  httpOnly: true
-};
-var defaultHostCookieConfig = {
-  secure: true,
-  httpOnly: true,
-  path: "/",
-  domain: void 0
-};
-var oauthCookieOptions = {
-  httpOnly: true,
-  maxAge: 5 * 60,
-  sameSite: "lax",
-  expires: new Date(Date.now() + 5 * 60 * 1e3)
-};
-var setCookie = (cookieName, value, options) => {
-  return serialize(cookieName, value, options);
-};
-var expiredCookieAttributes = {
-  ...defaultCookieOptions,
-  expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0,
-  secure: true
-};
-var getCookie = (request, cookieName) => {
-  const cookies = request.headers.get("Cookie");
-  if (!cookies) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
-  }
-  const value = parse(cookies)[cookieName];
-  if (!value) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found. There is no active session`);
-  }
-  return value;
-};
-var getSetCookie = (response, cookieName) => {
-  const cookies = response.headers.getSetCookie();
-  if (!cookies) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found in response.");
-  }
-  const strCookie = cookies.find((cookie) => cookie.startsWith(`${cookieName}=`));
-  if (!strCookie) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found in response.`);
-  }
-  return parseSetCookie(strCookie).value;
-};
-var createSessionCookie = async (jose, session) => {
-  try {
-    const encoded = await jose.encodeJWT(session);
-    return encoded;
-  } catch (error) {
-    throw new AuthInternalError("INVALID_JWT_TOKEN", "Failed to create session cookie", { cause: error });
-  }
-};
-var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
-  if (!attributes.httpOnly) {
-    logger?.log("COOKIE_HTTPONLY_DISABLED");
-  }
-  if (attributes.domain === "*") {
-    attributes.domain = void 0;
-    logger?.log("COOKIE_WILDCARD_DOMAIN");
-  }
-  if (!useSecure) {
-    if (attributes.secure) {
-      logger?.log("COOKIE_SECURE_DISABLED");
-    }
-    if (attributes.sameSite == "none") {
-      attributes.sameSite = "lax";
-      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
-    }
-    if (process.env.NODE_ENV === "production") {
-      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
-    }
-    if (strategy === "host") {
-      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
-    }
-    return {
-      ...defaultCookieOptions,
-      ...attributes,
-      ...defaultStandardCookieConfig
-    };
-  }
-  return strategy === "host" ? {
-    ...defaultCookieOptions,
-    ...attributes,
-    ...defaultHostCookieConfig
-  } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
-};
-var createCookieStore = (useSecure, prefix, overrides, logger) => {
-  prefix ??= COOKIE_NAME;
-  const securePrefix = useSecure ? "__Secure-" : "";
-  const hostPrefix = useSecure ? "__Host-" : "";
-  return {
-    sessionToken: {
-      name: `${securePrefix}${prefix}.${overrides?.sessionToken?.name ?? "session_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...defaultCookieOptions,
-          ...overrides?.sessionToken?.attributes
-        },
-        overrides?.sessionToken?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    state: {
-      name: `${securePrefix}${prefix}.${overrides?.state?.name ?? "state"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.state?.attributes
-        },
-        overrides?.state?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    csrfToken: {
-      name: `${hostPrefix}${prefix}.${overrides?.csrfToken?.name ?? "csrf_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...overrides?.csrfToken?.attributes,
-          ...defaultHostCookieConfig,
-          sameSite: "strict"
-        },
-        overrides?.csrfToken?.attributes?.strategy ?? "host",
-        logger
-      )
-    },
-    redirectTo: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectTo?.name ?? "redirect_to"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectTo?.attributes
-        },
-        overrides?.redirectTo?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    redirectURI: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectURI?.name ?? "redirect_uri"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectURI?.attributes
-        },
-        overrides?.redirectURI?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    codeVerifier: {
-      name: `${securePrefix}${prefix}.${overrides?.codeVerifier?.name ?? "code_verifier"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.codeVerifier?.attributes
-        },
-        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
-        logger
-      )
-    }
-  };
-};
-
-export {
-  COOKIE_NAME,
-  defaultCookieOptions,
-  defaultStandardCookieConfig,
-  defaultSecureCookieConfig,
-  defaultHostCookieConfig,
-  setCookie,
-  expiredCookieAttributes,
-  getCookie,
-  getSetCookie,
-  createSessionCookie,
-  defineSecureCookieOptions,
-  createCookieStore
-};

package/dist/chunk-6MXFPFR3.js

@@ -1,143 +0,0 @@
-import {
-  createAccessToken
-} from "./chunk-TZB6MUXN.js";
-import {
-  getUserInfo
-} from "./chunk-XGLBNXL4.js";
-import {
-  getOriginURL,
-  getTrustedOrigins
-} from "./chunk-XUP6KKNG.js";
-import {
-  OAuthAuthorizationErrorResponse
-} from "./chunk-KJBAQZX2.js";
-import {
-  createCSRF
-} from "./chunk-NUDITUKX.js";
-import {
-  isRelativeURL,
-  isSameOrigin,
-  isTrustedOrigin,
-  safeEquals
-} from "./chunk-4EKY7655.js";
-import {
-  createSessionCookie,
-  expiredCookieAttributes,
-  getCookie
-} from "./chunk-5W4BRQYG.js";
-import {
-  cacheControl
-} from "./chunk-EBAMFRB7.js";
-import {
-  AuthSecurityError,
-  OAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/actions/callback/callback.ts
-import { z } from "zod";
-import { createEndpoint, createEndpointConfig, HeadersBuilder } from "@aura-stack/router";
-var callbackConfig = (oauth) => {
-  return createEndpointConfig("/callback/:oauth", {
-    schemas: {
-      params: z.object({
-        oauth: z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: z.object({
-        code: z.string("Missing code parameter in the OAuth authorization response."),
-        state: z.string("Missing state parameter in the OAuth authorization response.")
-      })
-    },
-    middlewares: [
-      (ctx) => {
-        const {
-          searchParams,
-          context: { logger }
-        } = ctx;
-        const response = OAuthAuthorizationErrorResponse.safeParse(searchParams);
-        if (response.success) {
-          const { error, error_description } = response.data;
-          const criticalAuthErrors = ["access_denied", "server_error"];
-          const severity = criticalAuthErrors.includes(error.toLowerCase()) ? "critical" : "warning";
-          logger?.log("OAUTH_AUTHORIZATION_ERROR", {
-            severity,
-            structuredData: {
-              error,
-              error_description: error_description ?? ""
-            }
-          });
-          throw new OAuthProtocolError(error, error_description || "OAuth Authorization Error");
-        }
-        return ctx;
-      }
-    ]
-  });
-};
-var callbackAction = (oauth) => {
-  return createEndpoint(
-    "GET",
-    "/callback/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { code, state },
-        context
-      } = ctx;
-      const { oauth: providers, cookies, jose, logger, trustedOrigins } = context;
-      const oauthConfig = providers[oauth2];
-      const cookieState = getCookie(request, cookies.state.name);
-      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
-      const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
-      const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
-      if (!safeEquals(cookieState, state)) {
-        logger?.log("MISMATCHING_STATE", {
-          structuredData: {
-            oauth_provider: oauth2
-          }
-        });
-        throw new AuthSecurityError(
-          "MISMATCHING_STATE",
-          "The provided state passed in the OAuth response does not match the stored state."
-        );
-      }
-      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier, logger);
-      const origins = await getTrustedOrigins(request, trustedOrigins);
-      const requestOrigin = await getOriginURL(request, context);
-      if (!isRelativeURL(cookieRedirectTo)) {
-        const isValid = origins.length > 0 ? isTrustedOrigin(cookieRedirectTo, origins) : isSameOrigin(cookieRedirectTo, requestOrigin);
-        if (!isValid) {
-          logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", {
-            structuredData: {
-              redirect_path: cookieRedirectTo,
-              provider: oauth2,
-              has_trusted_origins: origins.length > 0,
-              request_origin: requestOrigin
-            }
-          });
-          throw new AuthSecurityError(
-            "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-            "Invalid redirect path. Potential open redirect attack detected."
-          );
-        }
-      }
-      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token, logger);
-      const sessionCookie = await createSessionCookie(jose, userInfo);
-      const csrfToken = await createCSRF(jose);
-      logger?.log("OAUTH_CALLBACK_SUCCESS", {
-        structuredData: {
-          provider: oauth2
-        }
-      });
-      const headers = new HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
-      return Response.json({ oauth: oauth2 }, { status: 302, headers });
-    },
-    callbackConfig(oauth)
-  );
-};
-
-export {
-  callbackAction
-};