@aura-stack/auth 0.4.0 → 0.6.0

package/dist/chunk-7QF22LHP.js

@@ -1,67 +0,0 @@
-import {
-  createAuthorizationURL,
-  createRedirectTo,
-  createRedirectURI
-} from "./chunk-XUP6KKNG.js";
-import {
-  createPKCE,
-  generateSecure
-} from "./chunk-NUDITUKX.js";
-import {
-  cacheControl
-} from "./chunk-EBAMFRB7.js";
-
-// src/actions/signIn/signIn.ts
-import { z } from "zod";
-import { createEndpoint, createEndpointConfig, HeadersBuilder } from "@aura-stack/router";
-var signInConfig = (oauth) => {
-  return createEndpointConfig("/signIn/:oauth", {
-    schemas: {
-      params: z.object({
-        oauth: z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: z.object({
-        redirectTo: z.string().optional()
-      })
-    }
-  });
-};
-var signInAction = (oauth) => {
-  return createEndpoint(
-    "GET",
-    "/signIn/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { redirectTo },
-        context
-      } = ctx;
-      const { oauth: providers, cookies, logger } = context;
-      const state = generateSecure();
-      const redirectURI = await createRedirectURI(request, oauth2, context);
-      const redirectToValue = await createRedirectTo(request, redirectTo, context);
-      const { codeVerifier, codeChallenge, method } = await createPKCE();
-      const authorization = createAuthorizationURL(providers[oauth2], redirectURI, state, codeChallenge, method, logger);
-      logger?.log("SIGN_IN_INITIATED", {
-        structuredData: { oauth_provider: oauth2, code_challenge_method: method }
-      });
-      const headers = new HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(cookies.state.name, state, cookies.state.attributes).setCookie(cookies.redirectURI.name, redirectURI, cookies.redirectURI.attributes).setCookie(cookies.redirectTo.name, redirectToValue, cookies.redirectTo.attributes).setCookie(cookies.codeVerifier.name, codeVerifier, cookies.codeVerifier.attributes).toHeaders();
-      return Response.json(
-        { oauth: oauth2 },
-        {
-          status: 302,
-          headers
-        }
-      );
-    },
-    signInConfig(oauth)
-  );
-};
-
-export {
-  signInAction
-};

package/dist/chunk-ALG3GIV4.js

@@ -1,95 +0,0 @@
-import {
-  createRedirectTo
-} from "./chunk-XUP6KKNG.js";
-import {
-  verifyCSRF
-} from "./chunk-NUDITUKX.js";
-import {
-  getBaseURL,
-  getErrorName
-} from "./chunk-QQVSRXGX.js";
-import {
-  expiredCookieAttributes
-} from "./chunk-5W4BRQYG.js";
-import {
-  secureApiHeaders
-} from "./chunk-EBAMFRB7.js";
-import {
-  AuthSecurityError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/actions/signOut/signOut.ts
-import { z } from "zod";
-import { createEndpoint, createEndpointConfig, HeadersBuilder, statusCode } from "@aura-stack/router";
-var config = createEndpointConfig({
-  schemas: {
-    searchParams: z.object({
-      token_type_hint: z.literal("session_token"),
-      redirectTo: z.string().optional()
-    })
-  }
-});
-var signOutAction = createEndpoint(
-  "POST",
-  "/signOut",
-  async (ctx) => {
-    const {
-      request,
-      headers,
-      searchParams: { redirectTo },
-      context
-    } = ctx;
-    const { jose, cookies, logger } = context;
-    const session = headers.getCookie(cookies.sessionToken.name);
-    const csrfToken = headers.getCookie(cookies.csrfToken.name);
-    const header = headers.getHeader("X-CSRF-Token");
-    logger?.log("SIGN_OUT_ATTEMPT", {
-      structuredData: {
-        has_session: Boolean(session),
-        has_csrf_token: Boolean(csrfToken),
-        has_csrf_header: Boolean(header)
-      }
-    });
-    if (!session) {
-      logger?.log("SESSION_TOKEN_MISSING");
-      throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-    }
-    if (!csrfToken) {
-      logger?.log("CSRF_TOKEN_MISSING");
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-    }
-    if (!header) {
-      logger?.log("CSRF_HEADER_MISSING");
-      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
-    }
-    try {
-      await verifyCSRF(jose, csrfToken, header);
-    } catch (error) {
-      logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
-    }
-    logger?.log("SIGN_OUT_CSRF_VERIFIED");
-    try {
-      await jose.decodeJWT(session);
-      logger?.log("SIGN_OUT_SUCCESS");
-    } catch (error) {
-      logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
-    }
-    const baseURL = getBaseURL(request);
-    const location = await createRedirectTo(
-      new Request(baseURL, {
-        headers: headers.toHeaders()
-      }),
-      redirectTo,
-      context
-    );
-    logger?.log("SIGN_OUT_REDIRECT", { structuredData: { location } });
-    const headersList = new HeadersBuilder(secureApiHeaders).setHeader("Location", location).setCookie(cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ message: "Signed out successfully" }, { status: statusCode.ACCEPTED, headers: headersList });
-  },
-  config
-);
-
-export {
-  signOutAction
-};

package/dist/chunk-E6G5YCI6.js

@@ -1,25 +0,0 @@
-// src/oauth/pinterest.ts
-var pinterest = (options) => {
-  return {
-    id: "pinterest",
-    name: "Pinterest",
-    authorizeURL: "https://www.pinterest.com/oauth",
-    accessToken: "https://api.pinterest.com/v5/oauth/token",
-    userInfo: "https://api.pinterest.com/v5/user_account",
-    scope: "user_accounts:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.username,
-        image: profile.profile_image,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  pinterest
-};

package/dist/chunk-EBAMFRB7.js

@@ -1,34 +0,0 @@
-// src/headers.ts
-var cacheControl = {
-  "Cache-Control": "no-store",
-  Pragma: "no-cache",
-  Expires: "0",
-  Vary: "Cookie"
-};
-var contentSecurityPolicy = {
-  "Content-Security-Policy": [
-    "default-src 'none'",
-    "script-src 'self'",
-    "frame-src 'none'",
-    "object-src 'none'",
-    "frame-ancestors 'none'",
-    "base-uri 'none'"
-  ].join("; ")
-};
-var secureHeaders = {
-  "X-Content-Type-Options": "nosniff",
-  "X-Frame-Options": "DENY",
-  "Referrer-Policy": "strict-origin-when-cross-origin"
-};
-var secureApiHeaders = {
-  ...cacheControl,
-  ...contentSecurityPolicy,
-  ...secureHeaders
-};
-
-export {
-  cacheControl,
-  contentSecurityPolicy,
-  secureHeaders,
-  secureApiHeaders
-};

package/dist/chunk-EEE7UM5T.js

@@ -1,25 +0,0 @@
-// src/oauth/x.ts
-var x = (options) => {
-  return {
-    id: "x",
-    name: "X",
-    authorizeURL: "https://twitter.com/i/oauth2/authorize",
-    accessToken: "https://api.twitter.com/2/oauth2/token",
-    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
-    scope: "tweet.read users.read offline.access",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.data.id,
-        name: profile.data.name,
-        image: profile.data.profile_image_url,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  x
-};

package/dist/chunk-FRJFWTOY.js

@@ -1,70 +0,0 @@
-import {
-  env
-} from "./chunk-4MYWAOLG.js";
-import {
-  AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/jose.ts
-import {
-  createJWT,
-  createJWS,
-  createJWE,
-  createDeriveKey,
-  createSecret
-} from "@aura-stack/jose";
-var createJoseInstance = (secret) => {
-  secret ??= env.AURA_AUTH_SECRET ?? env.AUTH_SECRET;
-  if (!secret) {
-    throw new AuthInternalError(
-      "JOSE_INITIALIZATION_FAILED",
-      "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
-    );
-  }
-  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT;
-  if (!salt) {
-    throw new AuthInternalError(
-      "JOSE_INITIALIZATION_FAILED",
-      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
-    );
-  }
-  try {
-    createSecret(salt);
-  } catch (error) {
-    throw new AuthInternalError(
-      "INVALID_SALT_SECRET_VALUE",
-      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
-      { cause: error }
-    );
-  }
-  const { derivedKey: derivedSigningKey } = createDeriveKey(secret, salt, "signing");
-  const { derivedKey: derivedEncryptionKey } = createDeriveKey(secret, salt, "encryption");
-  const { derivedKey: derivedCsrfTokenKey } = createDeriveKey(secret, salt, "csrfToken");
-  const { decodeJWT, encodeJWT } = createJWT({ jws: derivedSigningKey, jwe: derivedEncryptionKey });
-  const { signJWS, verifyJWS } = createJWS(derivedCsrfTokenKey);
-  const { encryptJWE, decryptJWE } = createJWE(derivedEncryptionKey);
-  return {
-    decodeJWT,
-    encodeJWT,
-    signJWS,
-    verifyJWS,
-    encryptJWE,
-    decryptJWE
-  };
-};
-var jwtVerificationOptions = {
-  algorithms: ["HS256"],
-  typ: "JWT"
-};
-var decodeJWTOptions = {
-  jws: jwtVerificationOptions,
-  jwt: {
-    typ: "JWT"
-  }
-};
-
-export {
-  createJoseInstance,
-  jwtVerificationOptions,
-  decodeJWTOptions
-};

package/dist/chunk-FW4W3REU.js

@@ -1,25 +0,0 @@
-// src/oauth/github.ts
-var github = (options) => {
-  return {
-    id: "github",
-    name: "GitHub",
-    authorizeURL: "https://github.com/login/oauth/authorize",
-    accessToken: "https://github.com/login/oauth/access_token",
-    userInfo: "https://api.github.com/user",
-    scope: "read:user user:email",
-    responseType: "code",
-    profile: (profile) => {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.login,
-        email: profile.email ?? void 0,
-        image: profile.avatar_url
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  github
-};

package/dist/chunk-ICAZ4OVS.js

@@ -1,37 +0,0 @@
-import {
-  createCSRF
-} from "./chunk-NUDITUKX.js";
-import {
-  getCookie,
-  setCookie
-} from "./chunk-5W4BRQYG.js";
-import {
-  secureApiHeaders
-} from "./chunk-EBAMFRB7.js";
-
-// src/actions/csrfToken/csrfToken.ts
-import { createEndpoint } from "@aura-stack/router";
-var getCSRFToken = (request, cookieName) => {
-  try {
-    return getCookie(request, cookieName);
-  } catch {
-    return void 0;
-  }
-};
-var csrfTokenAction = createEndpoint("GET", "/csrfToken", async (ctx) => {
-  const {
-    request,
-    context: { jose, cookies, logger }
-  } = ctx;
-  const token = getCSRFToken(request, cookies.csrfToken.name);
-  logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } });
-  const csrfToken = await createCSRF(jose, token);
-  logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } });
-  const headers = new Headers(secureApiHeaders);
-  headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes));
-  return Response.json({ csrfToken }, { headers });
-});
-
-export {
-  csrfTokenAction
-};

package/dist/chunk-IPKO6UQN.js

@@ -1,25 +0,0 @@
-// src/oauth/spotify.ts
-var spotify = (options) => {
-  return {
-    id: "spotify",
-    name: "Spotify",
-    authorizeURL: "https://accounts.spotify.com/authorize",
-    accessToken: "https://accounts.spotify.com/api/token",
-    userInfo: "https://api.spotify.com/v1/me",
-    scope: "user-read-private user-read-email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.display_name,
-        email: profile.email,
-        image: profile.images[0]?.url ?? void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  spotify
-};

package/dist/chunk-KJBAQZX2.js

@@ -1,92 +0,0 @@
-// src/schemas.ts
-import { object, string, enum as options, number, z, null as nullable } from "zod";
-var OAuthProviderCredentialsSchema = object({
-  id: string(),
-  name: string(),
-  authorizeURL: string().url(),
-  accessToken: string().url(),
-  scope: string(),
-  userInfo: string().url(),
-  responseType: options(["code", "token", "id_token"]),
-  clientId: string(),
-  clientSecret: string(),
-  profile: z.function().optional()
-});
-var OAuthProviderConfigSchema = object({
-  authorizeURL: string().url(),
-  accessToken: string().url(),
-  scope: string().optional(),
-  userInfo: string().url(),
-  responseType: options(["code", "token", "id_token"]),
-  clientId: string(),
-  clientSecret: string()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: string(),
-  state: string(),
-  codeChallenge: string(),
-  codeChallengeMethod: options(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = object({
-  state: string({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: string({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = object({
-  error: options([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: string().optional(),
-  error_uri: string().optional(),
-  state: string()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: string(),
-  code: string(),
-  codeVerifier: string().min(43).max(128)
-});
-var OAuthAccessTokenResponse = object({
-  access_token: string(),
-  token_type: string().optional(),
-  expires_in: number().optional(),
-  refresh_token: string().optional(),
-  scope: string().optional().or(nullable())
-});
-var OAuthAccessTokenErrorResponse = object({
-  error: options([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: string().optional(),
-  error_uri: string().optional()
-});
-var OAuthErrorResponse = object({
-  error: string(),
-  error_description: string().optional()
-});
-var OAuthEnvSchema = object({
-  clientId: z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-
-export {
-  OAuthProviderCredentialsSchema,
-  OAuthProviderConfigSchema,
-  OAuthAuthorization,
-  OAuthAuthorizationResponse,
-  OAuthAuthorizationErrorResponse,
-  OAuthAccessToken,
-  OAuthAccessTokenResponse,
-  OAuthAccessTokenErrorResponse,
-  OAuthErrorResponse,
-  OAuthEnvSchema
-};

package/dist/chunk-KMMAZFSJ.js

@@ -1,25 +0,0 @@
-// src/oauth/figma.ts
-var figma = (options) => {
-  return {
-    id: "figma",
-    name: "Figma",
-    authorizeURL: "https://www.figma.com/oauth",
-    accessToken: "https://api.figma.com/v1/oauth/token",
-    userInfo: "https://api.figma.com/v1/me",
-    scope: "current_user:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.handle,
-        email: profile.email,
-        image: profile.img_url
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  figma
-};

package/dist/chunk-LDU7A2JE.js

@@ -1,25 +0,0 @@
-// src/oauth/mailchimp.ts
-var mailchimp = (options) => {
-  return {
-    id: "mailchimp",
-    name: "Mailchimp",
-    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
-    accessToken: "https://login.mailchimp.com/oauth2/token",
-    userInfo: "https://login.mailchimp.com/oauth2/metadata",
-    scope: "",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.user_id,
-        name: profile.accountname,
-        email: profile.login.email,
-        image: profile.login.avatar
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  mailchimp
-};

package/dist/chunk-NUDITUKX.js

@@ -1,73 +0,0 @@
-import {
-  isJWTPayloadWithToken,
-  safeEquals
-} from "./chunk-4EKY7655.js";
-import {
-  equals
-} from "./chunk-QQVSRXGX.js";
-import {
-  jwtVerificationOptions
-} from "./chunk-FRJFWTOY.js";
-import {
-  AuthSecurityError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/secure.ts
-import crypto from "crypto";
-var generateSecure = (length = 32) => {
-  return crypto.randomBytes(length).toString("base64url");
-};
-var createHash = (data, base = "hex") => {
-  return crypto.createHash("sha256").update(data).digest().toString(base);
-};
-var createPKCE = async (verifier) => {
-  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
-  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
-  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
-    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
-  }
-  const codeChallenge = createHash(codeVerifier, "base64url");
-  return { codeVerifier, codeChallenge, method: "S256" };
-};
-var createCSRF = async (jose, csrfCookie) => {
-  try {
-    const token = generateSecure(32);
-    if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
-      return csrfCookie;
-    }
-    return jose.signJWS({ token });
-  } catch {
-    const token = generateSecure(32);
-    return jose.signJWS({ token });
-  }
-};
-var verifyCSRF = async (jose, cookie, header) => {
-  try {
-    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
-    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
-    if (!isJWTPayloadWithToken(cookiePayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
-    }
-    if (!isJWTPayloadWithToken(headerPayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
-    }
-    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-    }
-    if (!safeEquals(cookiePayload.token, headerPayload.token)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-    }
-    return true;
-  } catch {
-    throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-  }
-};
-
-export {
-  generateSecure,
-  createHash,
-  createPKCE,
-  createCSRF,
-  verifyCSRF
-};

package/dist/chunk-OVHNRULD.js

@@ -1,33 +0,0 @@
-// src/oauth/discord.ts
-var discord = (options) => {
-  return {
-    id: "discord",
-    name: "Discord",
-    authorizeURL: "https://discord.com/oauth2/authorize",
-    accessToken: "https://discord.com/api/oauth2/token",
-    userInfo: "https://discord.com/api/users/@me",
-    scope: "identify email",
-    responseType: "code",
-    profile(profile) {
-      let image = "";
-      if (profile.avatar === null) {
-        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-      } else {
-        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-      }
-      return {
-        sub: profile.id,
-        name: profile.global_name ?? profile.username,
-        email: profile.email ?? "",
-        image
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  discord
-};