@aura-stack/auth 0.4.0 → 0.6.0

package/dist/chunk-XGLBNXL4.js

@@ -1,75 +0,0 @@
-import {
-  fetchAsync
-} from "./chunk-ZNCZVF6U.js";
-import {
-  OAuthErrorResponse
-} from "./chunk-KJBAQZX2.js";
-import {
-  generateSecure
-} from "./chunk-NUDITUKX.js";
-import {
-  OAuthProtocolError,
-  isNativeError,
-  isOAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/actions/callback/userinfo.ts
-var getDefaultUserInfo = (profile) => {
-  const sub = generateSecure(16);
-  return {
-    sub: profile?.id ?? profile?.sub ?? sub,
-    email: profile?.email,
-    name: profile?.name ?? profile?.username ?? profile?.nickname,
-    image: profile?.image ?? profile?.picture
-  };
-};
-var getUserInfo = async (oauthConfig, accessToken, logger) => {
-  const userinfoEndpoint = oauthConfig.userInfo;
-  try {
-    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
-      structuredData: {
-        endpoint: userinfoEndpoint
-      }
-    });
-    const response = await fetchAsync(userinfoEndpoint, {
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        Authorization: `Bearer ${accessToken}`
-      }
-    });
-    if (!response.ok) {
-      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
-      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
-    }
-    const json = await response.json();
-    const { success, data } = OAuthErrorResponse.safeParse(json);
-    if (success) {
-      logger?.log("OAUTH_USERINFO_ERROR", {
-        message: "Error response received from OAuth userinfo endpoint",
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
-    }
-    logger?.log("OAUTH_USERINFO_SUCCESS");
-    return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
-  } catch (error) {
-    if (isOAuthProtocolError(error)) {
-      throw error;
-    }
-    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
-    if (isNativeError(error)) {
-      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
-        cause: error
-      });
-    }
-    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
-  }
-};
-
-export {
-  getUserInfo
-};

package/dist/chunk-XUP6KKNG.js

@@ -1,106 +0,0 @@
-import {
-  OAuthAuthorization
-} from "./chunk-KJBAQZX2.js";
-import {
-  isRelativeURL,
-  isSameOrigin,
-  isTrustedOrigin,
-  isValidURL,
-  patternToRegex
-} from "./chunk-4EKY7655.js";
-import {
-  equals,
-  extractPath,
-  toCastCase
-} from "./chunk-QQVSRXGX.js";
-import {
-  AuthInternalError
-} from "./chunk-RRLIF4PQ.js";
-
-// src/actions/signIn/authorization.ts
-var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod, logger) => {
-  const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod });
-  if (!parsed.success) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        scope: oauthConfig.scope,
-        redirect_uri: redirectURI,
-        has_state: Boolean(state),
-        has_code_challenge: Boolean(codeChallenge),
-        code_challenge_method: codeChallengeMethod
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const { authorizeURL, ...options } = parsed.data;
-  const { userInfo, accessToken, clientSecret, ...required } = options;
-  const searchParams = new URLSearchParams(toCastCase(required));
-  return `${authorizeURL}?${searchParams}`;
-};
-var getTrustedOrigins = async (request, trustedOrigins) => {
-  if (!trustedOrigins) return [];
-  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
-  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
-};
-var getOriginURL = async (request, context) => {
-  const headers = request.headers;
-  let origin = new URL(request.url).origin;
-  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
-  trustedOrigins.push(origin);
-  if (context?.trustedProxyHeaders) {
-    const protocol = headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Proto") ?? "http";
-    const host = headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Host") ?? null;
-    origin = `${protocol}://${host}`;
-  }
-  if (!isTrustedOrigin(origin, trustedOrigins)) {
-    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
-    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
-  }
-  return origin;
-};
-var createRedirectURI = async (request, oauth, context) => {
-  const origin = await getOriginURL(request, context);
-  return `${origin}${context.basePath}/callback/${oauth}`;
-};
-var createRedirectTo = async (request, redirectTo, context) => {
-  try {
-    const headers = request.headers;
-    const requestOrigin = await getOriginURL(request, context);
-    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
-    const validateURL = (url) => {
-      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
-      if (isRelativeURL(url)) return url;
-      if (origins.length > 0) {
-        if (isTrustedOrigin(url, origins)) {
-          const urlOrigin = new URL(url).origin;
-          for (const pattern of origins) {
-            const regex = patternToRegex(pattern);
-            if (regex?.test(urlOrigin)) {
-              return isSameOrigin(url, request.url) ? extractPath(url) : url;
-            }
-            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
-          }
-        }
-        context?.logger?.log("OPEN_REDIRECT_ATTACK");
-        return "/";
-      }
-      if (isSameOrigin(url, requestOrigin)) {
-        return extractPath(url);
-      }
-      context?.logger?.log("OPEN_REDIRECT_ATTACK");
-      return "/";
-    };
-    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
-  } catch (error) {
-    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
-    return "/";
-  }
-};
-
-export {
-  createAuthorizationURL,
-  getTrustedOrigins,
-  getOriginURL,
-  createRedirectURI,
-  createRedirectTo
-};

package/dist/chunk-ZNCZVF6U.js

@@ -1,14 +0,0 @@
-// src/request.ts
-var fetchAsync = async (url, options = {}, timeout = 5e3) => {
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), timeout);
-  const response = await fetch(url, {
-    ...options,
-    signal: controller.signal
-  }).finally(() => clearTimeout(timeoutId));
-  return response;
-};
-
-export {
-  fetchAsync
-};

package/dist/cookie.cjs

@@ -1,246 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/cookie.ts
-var cookie_exports = {};
-__export(cookie_exports, {
-  COOKIE_NAME: () => COOKIE_NAME,
-  createCookieStore: () => createCookieStore,
-  createSessionCookie: () => createSessionCookie,
-  defaultCookieOptions: () => defaultCookieOptions,
-  defaultHostCookieConfig: () => defaultHostCookieConfig,
-  defaultSecureCookieConfig: () => defaultSecureCookieConfig,
-  defaultStandardCookieConfig: () => defaultStandardCookieConfig,
-  defineSecureCookieOptions: () => defineSecureCookieOptions,
-  expiredCookieAttributes: () => expiredCookieAttributes,
-  getCookie: () => getCookie,
-  getSetCookie: () => getSetCookie,
-  setCookie: () => setCookie
-});
-module.exports = __toCommonJS(cookie_exports);
-var import_cookie = require("@aura-stack/router/cookie");
-
-// src/errors.ts
-var AuthInternalError = class extends Error {
-  type = "AUTH_INTERNAL_ERROR";
-  code;
-  constructor(code, message, options) {
-    super(message, options);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-
-// src/cookie.ts
-var COOKIE_NAME = "aura-auth";
-var defaultCookieOptions = {
-  httpOnly: true,
-  sameSite: "lax",
-  path: "/",
-  maxAge: 60 * 60 * 24 * 15
-};
-var defaultStandardCookieConfig = {
-  secure: false,
-  httpOnly: true
-};
-var defaultSecureCookieConfig = {
-  secure: true,
-  httpOnly: true
-};
-var defaultHostCookieConfig = {
-  secure: true,
-  httpOnly: true,
-  path: "/",
-  domain: void 0
-};
-var oauthCookieOptions = {
-  httpOnly: true,
-  maxAge: 5 * 60,
-  sameSite: "lax",
-  expires: new Date(Date.now() + 5 * 60 * 1e3)
-};
-var setCookie = (cookieName, value, options) => {
-  return (0, import_cookie.serialize)(cookieName, value, options);
-};
-var expiredCookieAttributes = {
-  ...defaultCookieOptions,
-  expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0,
-  secure: true
-};
-var getCookie = (request, cookieName) => {
-  const cookies = request.headers.get("Cookie");
-  if (!cookies) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
-  }
-  const value = (0, import_cookie.parse)(cookies)[cookieName];
-  if (!value) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found. There is no active session`);
-  }
-  return value;
-};
-var getSetCookie = (response, cookieName) => {
-  const cookies = response.headers.getSetCookie();
-  if (!cookies) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found in response.");
-  }
-  const strCookie = cookies.find((cookie) => cookie.startsWith(`${cookieName}=`));
-  if (!strCookie) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found in response.`);
-  }
-  return (0, import_cookie.parseSetCookie)(strCookie).value;
-};
-var createSessionCookie = async (jose, session) => {
-  try {
-    const encoded = await jose.encodeJWT(session);
-    return encoded;
-  } catch (error) {
-    throw new AuthInternalError("INVALID_JWT_TOKEN", "Failed to create session cookie", { cause: error });
-  }
-};
-var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
-  if (!attributes.httpOnly) {
-    logger?.log("COOKIE_HTTPONLY_DISABLED");
-  }
-  if (attributes.domain === "*") {
-    attributes.domain = void 0;
-    logger?.log("COOKIE_WILDCARD_DOMAIN");
-  }
-  if (!useSecure) {
-    if (attributes.secure) {
-      logger?.log("COOKIE_SECURE_DISABLED");
-    }
-    if (attributes.sameSite == "none") {
-      attributes.sameSite = "lax";
-      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
-    }
-    if (process.env.NODE_ENV === "production") {
-      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
-    }
-    if (strategy === "host") {
-      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
-    }
-    return {
-      ...defaultCookieOptions,
-      ...attributes,
-      ...defaultStandardCookieConfig
-    };
-  }
-  return strategy === "host" ? {
-    ...defaultCookieOptions,
-    ...attributes,
-    ...defaultHostCookieConfig
-  } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
-};
-var createCookieStore = (useSecure, prefix, overrides, logger) => {
-  prefix ??= COOKIE_NAME;
-  const securePrefix = useSecure ? "__Secure-" : "";
-  const hostPrefix = useSecure ? "__Host-" : "";
-  return {
-    sessionToken: {
-      name: `${securePrefix}${prefix}.${overrides?.sessionToken?.name ?? "session_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...defaultCookieOptions,
-          ...overrides?.sessionToken?.attributes
-        },
-        overrides?.sessionToken?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    state: {
-      name: `${securePrefix}${prefix}.${overrides?.state?.name ?? "state"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.state?.attributes
-        },
-        overrides?.state?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    csrfToken: {
-      name: `${hostPrefix}${prefix}.${overrides?.csrfToken?.name ?? "csrf_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...overrides?.csrfToken?.attributes,
-          ...defaultHostCookieConfig,
-          sameSite: "strict"
-        },
-        overrides?.csrfToken?.attributes?.strategy ?? "host",
-        logger
-      )
-    },
-    redirectTo: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectTo?.name ?? "redirect_to"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectTo?.attributes
-        },
-        overrides?.redirectTo?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    redirectURI: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectURI?.name ?? "redirect_uri"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectURI?.attributes
-        },
-        overrides?.redirectURI?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    codeVerifier: {
-      name: `${securePrefix}${prefix}.${overrides?.codeVerifier?.name ?? "code_verifier"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.codeVerifier?.attributes
-        },
-        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
-        logger
-      )
-    }
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  COOKIE_NAME,
-  createCookieStore,
-  createSessionCookie,
-  defaultCookieOptions,
-  defaultHostCookieConfig,
-  defaultSecureCookieConfig,
-  defaultStandardCookieConfig,
-  defineSecureCookieOptions,
-  expiredCookieAttributes,
-  getCookie,
-  getSetCookie,
-  setCookie
-});

package/dist/cookie.d.ts

@@ -1,85 +0,0 @@
-import { SerializeOptions } from '@aura-stack/router/cookie';
-import { JWTPayload } from '@aura-stack/jose/jose';
-import { A as AuthRuntimeConfig, I as InternalLogger, C as CookieConfig, a as CookieStoreConfig } from './index-CSyIJmCM.js';
-import 'zod';
-import './schemas.js';
-import './jose.js';
-import '@aura-stack/jose';
-import './@types/utility.js';
-
-/**
- * Prefix for all cookies set by Aura Auth.
- */
-declare const COOKIE_NAME = "aura-auth";
-/**
- * Default cookie options used by Aura Auth.
- */
-declare const defaultCookieOptions: SerializeOptions;
-declare const defaultStandardCookieConfig: SerializeOptions;
-/**
- * Default cookie options for "__Secure-" cookies.
- * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__secure-prefix
- */
-declare const defaultSecureCookieConfig: SerializeOptions;
-/**
- * Default cookie options for "__Host-" cookies.
- * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__host-prefix
- */
-declare const defaultHostCookieConfig: SerializeOptions;
-/**
- * Set a cookie with the given name, value and `SerializeOptions`; supports secure
- * cookies with the `__Secure-` and `__Host-` prefixes.
- *
- * Cookie attributes are serialized in the following order:
- * Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite, Partitioned, Priority.
- */
-declare const setCookie: (cookieName: string, value: string, options?: SerializeOptions) => string;
-declare const expiredCookieAttributes: SerializeOptions;
-/**
- * Get a cookie by name from the request.
- *
- * @param request The incoming request object
- * @param cookie Cookie name to retrieve
- * @returns The value of the cookie or throw an error if not found
- */
-declare const getCookie: (request: Request, cookieName: string) => string;
-/**
- * Get a Set-Cookie header value by cookie name from the response.
- *
- * @param response The response object
- * @param cookieName Cookie name to retrieve
- * @returns The value of the Set-Cookie header or throw an error if not found
- */
-declare const getSetCookie: (response: Response, cookieName: string) => string | undefined;
-/**
- * Create a session cookie containing a signed and encrypted JWT, using the
- * `@aura-stack/jose` package for the encoding.
- *
- * @param jose - Jose Instance
- * @param session - The JWT payload to be encoded in the session cookie
- * @returns The serialized session cookie string
- */
-declare const createSessionCookie: (jose: AuthRuntimeConfig["jose"], session: JWTPayload) => Promise<string>;
-/**
- * Defines the cookie configuration based on the request security and cookie options passed
- * in the Aura Auth configuration (`createAuth` function). This function ensures the correct
- * cookie prefixes and security attributes are applied based on whether the request is secure
- * (HTTPS) or not.
- *
- * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto
- * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Forwarded
- * @param useSecure Whether the request is secure (HTTPS)
- * @param attributes The cookie attributes to be applied
- * @param strategy The cookie strategy: "host", "secure", or "standard"
- * @returns The finalized cookie options to be used for setting cookies
- */
-declare const defineSecureCookieOptions: (useSecure: boolean, attributes: SerializeOptions, strategy: "host" | "secure" | "standard", logger?: InternalLogger) => SerializeOptions;
-/**
- * @param useSecure Whether the request is secure (HTTPS)
- * @param prefix Optional prefix added to all cookie names
- * @param overrides Optional overrides for individual cookie configurations
- * @returns The complete cookie store configuration
- */
-declare const createCookieStore: (useSecure: boolean, prefix?: string, overrides?: CookieConfig["overrides"], logger?: InternalLogger) => CookieStoreConfig;
-
-export { COOKIE_NAME, createCookieStore, createSessionCookie, defaultCookieOptions, defaultHostCookieConfig, defaultSecureCookieConfig, defaultStandardCookieConfig, defineSecureCookieOptions, expiredCookieAttributes, getCookie, getSetCookie, setCookie };

package/dist/cookie.js

@@ -1,29 +0,0 @@
-import {
-  COOKIE_NAME,
-  createCookieStore,
-  createSessionCookie,
-  defaultCookieOptions,
-  defaultHostCookieConfig,
-  defaultSecureCookieConfig,
-  defaultStandardCookieConfig,
-  defineSecureCookieOptions,
-  expiredCookieAttributes,
-  getCookie,
-  getSetCookie,
-  setCookie
-} from "./chunk-5W4BRQYG.js";
-import "./chunk-RRLIF4PQ.js";
-export {
-  COOKIE_NAME,
-  createCookieStore,
-  createSessionCookie,
-  defaultCookieOptions,
-  defaultHostCookieConfig,
-  defaultSecureCookieConfig,
-  defaultStandardCookieConfig,
-  defineSecureCookieOptions,
-  expiredCookieAttributes,
-  getCookie,
-  getSetCookie,
-  setCookie
-};

package/dist/env.cjs

@@ -1,56 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/env.ts
-var env_exports = {};
-__export(env_exports, {
-  env: () => env
-});
-module.exports = __toCommonJS(env_exports);
-var import_meta = {};
-var env = new Proxy({}, {
-  get(_, prop) {
-    if (typeof prop !== "string") return void 0;
-    const hasProperty = (process2) => {
-      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
-    };
-    try {
-      if (typeof process !== "undefined" && hasProperty(process.env)) {
-        return process.env[prop];
-      }
-      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
-        return import_meta.env[prop];
-      }
-      if (typeof Deno !== "undefined" && Deno.env?.get) {
-        return Deno.env.get(prop);
-      }
-      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
-        return Bun.env[prop];
-      }
-      const globalValue = globalThis[prop];
-      return typeof globalValue === "string" ? globalValue : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-});
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  env
-});

package/dist/env.d.ts

@@ -1,7 +0,0 @@
-/**
- * A runtime-agnostic environment variable proxy.
- * Checks multiple sources to ensure compatibility with Node, Bun, Deno, Vite, and Edge platforms.
- */
-declare const env: Record<string, string | undefined>;
-
-export { env };

package/dist/env.js

@@ -1,6 +0,0 @@
-import {
-  env
-} from "./chunk-4MYWAOLG.js";
-export {
-  env
-};