@aura-stack/auth 0.5.0 → 0.6.0

package/dist/actions/index.cjs

@@ -1,1161 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/actions/index.ts
-var actions_exports = {};
-__export(actions_exports, {
-  callbackAction: () => callbackAction,
-  csrfTokenAction: () => csrfTokenAction,
-  sessionAction: () => sessionAction,
-  signInAction: () => signInAction,
-  signOutAction: () => signOutAction
-});
-module.exports = __toCommonJS(actions_exports);
-
-// src/actions/signIn/signIn.ts
-var import_v42 = require("zod/v4");
-
-// src/headers.ts
-var cacheControl = {
-  "Cache-Control": "no-store",
-  Pragma: "no-cache",
-  Expires: "0",
-  Vary: "Cookie"
-};
-var contentSecurityPolicy = {
-  "Content-Security-Policy": [
-    "default-src 'none'",
-    "script-src 'self'",
-    "frame-src 'none'",
-    "object-src 'none'",
-    "frame-ancestors 'none'",
-    "base-uri 'none'"
-  ].join("; ")
-};
-var secureHeaders = {
-  "X-Content-Type-Options": "nosniff",
-  "X-Frame-Options": "DENY",
-  "Referrer-Policy": "strict-origin-when-cross-origin"
-};
-var secureApiHeaders = {
-  ...cacheControl,
-  ...contentSecurityPolicy,
-  ...secureHeaders
-};
-
-// src/errors.ts
-var OAuthProtocolError = class extends Error {
-  type = "OAUTH_PROTOCOL_ERROR";
-  error;
-  errorURI;
-  constructor(error, description, errorURI, options2) {
-    super(description, options2);
-    this.error = error;
-    this.errorURI = errorURI;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var AuthInternalError = class extends Error {
-  type = "AUTH_INTERNAL_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var AuthSecurityError = class extends Error {
-  type = "AUTH_SECURITY_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var isNativeError = (error) => {
-  return error instanceof Error;
-};
-var isOAuthProtocolError = (error) => {
-  return error instanceof OAuthProtocolError;
-};
-
-// src/api/signIn.ts
-var import_router2 = require("@aura-stack/router");
-
-// src/schemas.ts
-var import_v4 = require("zod/v4");
-var AuthorizeConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    params: (0, import_v4.object)({
-      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-      scope: (0, import_v4.string)().optional()
-    })
-  })
-]);
-var AccessTokenConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
-  })
-]);
-var UserInfoConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
-    method: (0, import_v4.string)().optional()
-  })
-]);
-var OAuthProviderCredentialsSchema = (0, import_v4.object)({
-  id: (0, import_v4.string)(),
-  name: (0, import_v4.string)(),
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)(),
-  profile: import_v4.z.function().optional()
-});
-var OAuthProviderConfigSchema = (0, import_v4.object)({
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  state: (0, import_v4.string)(),
-  codeChallenge: (0, import_v4.string)(),
-  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_v4.object)({
-  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional(),
-  state: (0, import_v4.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  code: (0, import_v4.string)(),
-  codeVerifier: (0, import_v4.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_v4.object)({
-  access_token: (0, import_v4.string)(),
-  token_type: (0, import_v4.string)().optional(),
-  expires_in: (0, import_v4.number)().optional(),
-  refresh_token: (0, import_v4.string)().optional(),
-  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
-});
-var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional()
-});
-var OAuthErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.string)(),
-  error_description: (0, import_v4.string)().optional()
-});
-var OAuthEnvSchema = (0, import_v4.object)({
-  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-
-// src/utils.ts
-var import_router = require("@aura-stack/router");
-
-// src/env.ts
-var import_meta = {};
-var env = new Proxy({}, {
-  get(_, prop) {
-    if (typeof prop !== "string") return void 0;
-    const hasProperty = (process2) => {
-      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
-    };
-    try {
-      if (typeof process !== "undefined" && hasProperty(process.env)) {
-        return process.env[prop];
-      }
-      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
-        return import_meta.env[prop];
-      }
-      if (typeof Deno !== "undefined" && Deno.env?.get) {
-        return Deno.env.get(prop);
-      }
-      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
-        return Bun.env[prop];
-      }
-      const globalValue = globalThis[prop];
-      return typeof globalValue === "string" ? globalValue : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-});
-var getEnv = (key) => {
-  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
-  return env[keys.find((k) => env[k]) ?? ""];
-};
-
-// src/assert.ts
-var import_crypto = require("@aura-stack/jose/crypto");
-var unsafeChars = [
-  "<",
-  ">",
-  '"',
-  "`",
-  " ",
-  "\r",
-  "\n",
-  "	",
-  "\\",
-  "%2F",
-  "%5C",
-  "%2f",
-  "%5c",
-  "\r\n",
-  "%0A",
-  "%0D",
-  "%0a",
-  "%0d",
-  "..",
-  "//",
-  "///",
-  "...",
-  "%20",
-  "\0"
-];
-var isValidURL = (value) => {
-  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
-    return false;
-  }
-  const match = value.match(/^(https?:\/\/)(.*)$/);
-  if (!match) return false;
-  const rest = match[2];
-  for (const char of unsafeChars) {
-    if (rest.includes(char)) return false;
-  }
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
-  return regex.test(match[0]);
-};
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-var isRelativeURL = (value) => {
-  if (value.length > 100) return false;
-  for (const char of unsafeChars) {
-    if (value.includes(char)) return false;
-  }
-  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
-  return regex.test(value);
-};
-var isSameOrigin = (origin, expected) => {
-  const originURL = new URL(origin);
-  const expectedURL = new URL(expected);
-  return equals(originURL.origin, expectedURL.origin);
-};
-var patternToRegex = (pattern) => {
-  try {
-    if (pattern.length > 2048) return null;
-    pattern = pattern.replace(/\\/g, "");
-    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
-    if (!match) return null;
-    const [, protocol, host, port] = match;
-    const hasWildcard = host.includes("*");
-    if (hasWildcard && !host.startsWith("*.")) return null;
-    if (hasWildcard && host.slice(2).includes("*")) return null;
-    const domain = hasWildcard ? host.slice(2) : host;
-    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
-    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
-    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
-  } catch {
-    return null;
-  }
-};
-var isTrustedOrigin = (url, trustedOrigins) => {
-  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
-  try {
-    const urlOrigin = new URL(url).origin;
-    for (const pattern of trustedOrigins) {
-      const regex = patternToRegex(pattern);
-      if (regex?.test(urlOrigin)) return true;
-      try {
-        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return false;
-};
-var timingSafeEqual = (a, b) => {
-  const bufferA = import_crypto.encoder.encode(a);
-  const bufferB = import_crypto.encoder.encode(b);
-  const len = Math.max(bufferA.length, bufferB.length);
-  let diff = 0;
-  for (let i = 0; i < len; i++) {
-    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
-  }
-  return diff === 0 && bufferA.length === bufferB.length;
-};
-
-// src/utils.ts
-var AURA_AUTH_VERSION = "0.4.0";
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var getBaseURL = (request) => {
-  const url = new URL(request.url);
-  return `${url.origin}${url.pathname}`;
-};
-var toISOString = (date) => {
-  return new Date(date).toISOString();
-};
-var extractPath = (url) => {
-  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
-  const match = url.match(pathRegex);
-  return match && match[2] ? match[2] : "/";
-};
-var getErrorName = (error) => {
-  if (error instanceof Error) {
-    return error.name;
-  }
-  return typeof error === "string" ? error : "UnknownError";
-};
-
-// src/jose.ts
-var import_jose = require("@aura-stack/jose");
-var import_jose2 = require("@aura-stack/jose/jose");
-var import_crypto2 = require("@aura-stack/jose/crypto");
-var jwtVerificationOptions = {
-  algorithms: ["HS256"],
-  typ: "JWT"
-};
-
-// src/secure.ts
-var generateSecure = (length = 32) => {
-  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
-};
-var createSecretValue = (length = 32) => {
-  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
-};
-var createHash = async (data) => {
-  const subtle = (0, import_crypto2.getSubtleCrypto)();
-  const digest = await subtle.digest("SHA-256", import_crypto2.encoder.encode(data));
-  return import_jose2.base64url.encode(new Uint8Array(digest));
-};
-var createPKCE = async (verifier) => {
-  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
-  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
-  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
-    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
-  }
-  const codeChallenge = await createHash(codeVerifier);
-  return { codeVerifier, codeChallenge, method: "S256" };
-};
-var createCSRF = async (jose, csrfCookie) => {
-  try {
-    const token = generateSecure(32);
-    if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
-      return csrfCookie;
-    }
-    return jose.signJWS({ token });
-  } catch {
-    const token = generateSecure(32);
-    return jose.signJWS({ token });
-  }
-};
-var verifyCSRF = async (jose, cookie, header) => {
-  try {
-    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
-    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
-    if (!isJWTPayloadWithToken(cookiePayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
-    }
-    if (!isJWTPayloadWithToken(headerPayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
-    }
-    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-    }
-    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-    }
-    return true;
-  } catch {
-    throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-  }
-};
-
-// src/actions/signIn/authorization-url.ts
-var setSearchParams = (url, params) => {
-  for (const [key, value] of Object.entries(params)) {
-    if (value !== void 0 && value !== "") {
-      url.searchParams.set(key, value);
-    }
-  }
-};
-var buildAuthorizationURL = (oauth, redirect_uri, state, code_challenge, code_challenge_method) => {
-  const authorizeConfig = oauth.authorize;
-  const baseURL = typeof authorizeConfig === "string" ? authorizeConfig : authorizeConfig?.url ?? oauth.authorizeURL;
-  if (!baseURL) {
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing authorization URL in OAuth provider configuration.");
-  }
-  const url = new URL(baseURL);
-  const authorizeParams = typeof authorizeConfig === "string" ? void 0 : authorizeConfig?.params;
-  setSearchParams(url, {
-    response_type: authorizeParams?.responseType ?? oauth.responseType ?? "code",
-    client_id: oauth.clientId,
-    redirect_uri,
-    state,
-    code_challenge,
-    code_challenge_method,
-    scope: authorizeParams?.scope ?? oauth.scope,
-    prompt: authorizeParams?.prompt,
-    response_mode: authorizeParams?.responseMode,
-    login_hint: authorizeParams?.loginHint,
-    nonce: authorizeParams?.nonce,
-    display: authorizeParams?.display,
-    audience: authorizeParams?.audience
-  });
-  return url.toString();
-};
-var createAuthorizationURL = async (oauth, redirectURI, ctx) => {
-  const state = createSecretValue();
-  const { codeVerifier, codeChallenge, method } = await createPKCE();
-  const authorization = buildAuthorizationURL(oauth, redirectURI, state, codeChallenge, method);
-  const parsed = OAuthAuthorization.safeParse({ ...oauth, redirectURI, state, codeChallenge, codeChallengeMethod: method });
-  if (!parsed.success) {
-    ctx?.logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        scope: oauth?.scope ?? "",
-        redirect_uri: redirectURI,
-        has_state: Boolean(state),
-        has_code_challenge: Boolean(codeChallenge),
-        code_challenge_method: method
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  return {
-    authorization,
-    state,
-    codeVerifier,
-    method
-  };
-};
-
-// src/actions/signIn/authorization.ts
-var getTrustedOrigins = async (request, trustedOrigins) => {
-  if (!trustedOrigins) return [];
-  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
-  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
-};
-var getBaseURL2 = async ({
-  ctx,
-  request,
-  headers: headersInit
-}) => {
-  const origin = getEnv("BASE_URL") || ctx?.baseURL;
-  if (origin && origin !== "/") return origin;
-  if (ctx?.trustedProxyHeaders) {
-    const headers = headersInit && new Headers(headersInit) || request?.headers;
-    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
-    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
-    if (host) return `${protocol}://${host}`;
-    throw new AuthInternalError(
-      "INVALID_OAUTH_CONFIGURATION",
-      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
-    );
-  }
-  try {
-    return new URL(request?.url ?? "not-found").origin;
-  } catch (error) {
-    throw new AuthInternalError(
-      "INVALID_OAUTH_CONFIGURATION",
-      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
-      { cause: error }
-    );
-  }
-};
-var getOriginURL = async (request, context) => {
-  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
-  trustedOrigins.push(new URL(request.url).origin);
-  const origin = await getBaseURL2({ request, ctx: context });
-  if (!isTrustedOrigin(origin, trustedOrigins)) {
-    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
-    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
-  }
-  return origin;
-};
-var createRedirectURI = async (request, oauth, context) => {
-  const origin = await getOriginURL(request, context);
-  return `${origin}${context.basePath}/callback/${oauth}`;
-};
-var createSignInURL = async ({
-  request,
-  oauth,
-  ctx,
-  redirectTo
-}) => {
-  const origin = await getOriginURL(request, ctx);
-  const searchParams = new URLSearchParams();
-  if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
-  return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
-};
-var createRedirectTo = async (request, redirectTo, context) => {
-  try {
-    const headers = request.headers;
-    const requestOrigin = await getOriginURL(request, context);
-    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
-    const validateURL = (url) => {
-      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
-      if (isRelativeURL(url)) return url;
-      if (origins.length > 0) {
-        if (isTrustedOrigin(url, origins)) {
-          const urlOrigin = new URL(url).origin;
-          for (const pattern of origins) {
-            const regex = patternToRegex(pattern);
-            if (regex?.test(urlOrigin)) {
-              return isSameOrigin(url, request.url) ? extractPath(url) : url;
-            }
-            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
-          }
-        }
-        context?.logger?.log("OPEN_REDIRECT_ATTACK");
-        return "/";
-      }
-      if (isSameOrigin(url, requestOrigin)) {
-        return extractPath(url);
-      }
-      context?.logger?.log("OPEN_REDIRECT_ATTACK");
-      return "/";
-    };
-    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
-  } catch (error) {
-    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
-    return "/";
-  }
-};
-
-// src/api/signIn.ts
-var signIn = async (oauth, {
-  ctx,
-  headers: headersInit,
-  redirectTo = "/",
-  redirect,
-  request: requestInit
-}) => {
-  const headers = new Headers(headersInit);
-  const provider = ctx.oauth[oauth];
-  if (!provider) {
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", `The OAuth provider "${oauth}" is not configured.`);
-  }
-  let request = requestInit;
-  if (!request) {
-    const origin = await getBaseURL2({ ctx, headers });
-    const url = `${origin}${ctx.basePath}/signIn/${oauth}`;
-    request = new Request(url, { headers });
-  }
-  if (redirect === false) {
-    const signInURL = await createSignInURL({ request, oauth, ctx, redirectTo });
-    return { redirect: false, signInURL };
-  }
-  const redirectURI = await createRedirectURI(request, oauth, ctx);
-  const redirectToValue = await createRedirectTo(request, redirectTo, ctx);
-  const { authorization, state, codeVerifier } = await createAuthorizationURL(provider, redirectURI, ctx);
-  ctx?.logger?.log("SIGN_IN_INITIATED", {
-    structuredData: { oauth_provider: oauth }
-  });
-  const headersList = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(ctx.cookies.state.name, state, ctx.cookies.state.attributes).setCookie(ctx.cookies.redirectURI.name, redirectURI, ctx.cookies.redirectURI.attributes).setCookie(ctx.cookies.redirectTo.name, redirectToValue, ctx.cookies.redirectTo.attributes).setCookie(ctx.cookies.codeVerifier.name, codeVerifier, ctx.cookies.codeVerifier.attributes).toHeaders();
-  return Response.json(
-    { redirect: redirect ?? true, signInURL: authorization },
-    {
-      status: redirect ?? true ? 302 : 200,
-      headers: headersList
-    }
-  );
-};
-
-// src/actions/signIn/signIn.ts
-var import_router3 = require("@aura-stack/router");
-var signInConfig = (oauth) => {
-  return (0, import_router3.createEndpointConfig)("/signIn/:oauth", {
-    schemas: {
-      params: import_v42.z.object({
-        oauth: import_v42.z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: import_v42.z.object({
-        redirect: import_v42.z.stringbool().optional().default(true),
-        redirectTo: import_v42.z.string().optional()
-      })
-    }
-  });
-};
-var signInAction = (oauth) => {
-  return (0, import_router3.createEndpoint)(
-    "GET",
-    "/signIn/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { redirectTo, redirect },
-        context
-      } = ctx;
-      const signInResult = await signIn(oauth2, {
-        ctx: context,
-        headers: request.headers,
-        redirect,
-        redirectTo,
-        request
-      });
-      if (!redirect) {
-        return Response.json(signInResult, { status: 200 });
-      }
-      return signInResult;
-    },
-    signInConfig(oauth)
-  );
-};
-
-// src/actions/callback/callback.ts
-var import_v43 = require("zod/v4");
-var import_router4 = require("@aura-stack/router");
-
-// src/request.ts
-var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), timeout);
-  const response = await fetch(url, {
-    ...options2,
-    signal: controller.signal
-  }).finally(() => clearTimeout(timeoutId));
-  return response;
-};
-
-// src/actions/callback/userinfo.ts
-var getDefaultUserInfo = (profile) => {
-  const sub = generateSecure(16);
-  return {
-    sub: profile?.id ?? profile?.sub ?? sub,
-    email: profile?.email,
-    name: profile?.name ?? profile?.username ?? profile?.nickname,
-    image: profile?.image ?? profile?.picture
-  };
-};
-var getUserInfo = async (oauthConfig, accessToken, logger) => {
-  const userInfoConfig = oauthConfig.userInfo;
-  const userinfoURL = typeof userInfoConfig === "string" ? userInfoConfig : userInfoConfig.url;
-  const extraHeaders = typeof userInfoConfig === "string" ? void 0 : userInfoConfig.headers;
-  const method = typeof userInfoConfig === "string" ? "GET" : (userInfoConfig.method ?? "GET").toUpperCase();
-  try {
-    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
-      structuredData: {
-        endpoint: userinfoURL
-      }
-    });
-    const response = await fetchAsync(userinfoURL, {
-      method,
-      headers: {
-        "User-Agent": `Aura Auth/${AURA_AUTH_VERSION}`,
-        Accept: "application/json",
-        Authorization: `Bearer ${accessToken}`,
-        ...extraHeaders ?? {}
-      }
-    });
-    if (!response.ok) {
-      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
-      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
-    }
-    const json = await response.json();
-    const { success, data } = OAuthErrorResponse.safeParse(json);
-    if (success) {
-      logger?.log("OAUTH_USERINFO_ERROR", {
-        message: "Error response received from OAuth userinfo endpoint",
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
-    }
-    logger?.log("OAUTH_USERINFO_SUCCESS");
-    return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
-  } catch (error) {
-    if (isOAuthProtocolError(error)) {
-      throw error;
-    }
-    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
-    if (isNativeError(error)) {
-      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
-        cause: error
-      });
-    }
-    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
-  }
-};
-
-// src/actions/callback/access-token.ts
-var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
-  const { accessToken, clientId, clientSecret } = oauthConfig;
-  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        has_client_secret: Boolean(clientSecret),
-        has_access_token: Boolean(accessToken),
-        has_redirect_uri: Boolean(redirectURI),
-        has_code: Boolean(code),
-        has_code_verifier: Boolean(codeVerifier)
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
-  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
-  try {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code"
-      }
-    });
-    const response = await fetchAsync(tokenURL, {
-      method: "POST",
-      headers: {
-        ...extraHeaders ?? {},
-        Accept: "application/json",
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        code,
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code",
-        code_verifier: codeVerifier
-      }).toString()
-    });
-    if (!response.ok) {
-      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
-    }
-    const json = await response.json();
-    const token = OAuthAccessTokenResponse.safeParse(json);
-    if (!token.success) {
-      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
-      if (!success) {
-        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
-      }
-      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
-    }
-    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
-    return token.data;
-  } catch (error) {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
-    if (error instanceof Error) {
-      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
-    }
-    throw error;
-  }
-};
-
-// src/cookie.ts
-var import_cookie = require("@aura-stack/router/cookie");
-var defaultCookieOptions = {
-  httpOnly: true,
-  sameSite: "lax",
-  path: "/",
-  maxAge: 60 * 60 * 24 * 15
-};
-var oauthCookieOptions = {
-  httpOnly: true,
-  maxAge: 5 * 60,
-  sameSite: "lax",
-  expires: new Date(Date.now() + 5 * 60 * 1e3)
-};
-var setCookie = (cookieName, value, options2) => {
-  return (0, import_cookie.serialize)(cookieName, value, options2);
-};
-var expiredCookieAttributes = {
-  ...defaultCookieOptions,
-  expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0,
-  secure: true
-};
-var getCookie = (request, cookieName) => {
-  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
-  if (!cookies) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
-  }
-  const value = (0, import_cookie.parse)(cookies)[cookieName];
-  if (!value) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found. There is no active session`);
-  }
-  return value;
-};
-var createSessionCookie = async (jose, session) => {
-  try {
-    const encoded = await jose.encodeJWT(session);
-    return encoded;
-  } catch (error) {
-    throw new AuthInternalError("INVALID_JWT_TOKEN", "Failed to create session cookie", { cause: error });
-  }
-};
-
-// src/actions/callback/callback.ts
-var callbackConfig = (oauth) => {
-  return (0, import_router4.createEndpointConfig)("/callback/:oauth", {
-    schemas: {
-      params: import_v43.z.object({
-        oauth: import_v43.z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: import_v43.z.object({
-        code: import_v43.z.string("Missing code parameter in the OAuth authorization response."),
-        state: import_v43.z.string("Missing state parameter in the OAuth authorization response.")
-      })
-    },
-    use: [
-      (ctx) => {
-        const {
-          searchParams,
-          context: { logger }
-        } = ctx;
-        const response = OAuthAuthorizationErrorResponse.safeParse(searchParams);
-        if (response.success) {
-          const { error, error_description } = response.data;
-          const criticalAuthErrors = ["access_denied", "server_error"];
-          const severity = criticalAuthErrors.includes(error.toLowerCase()) ? "critical" : "warning";
-          logger?.log("OAUTH_AUTHORIZATION_ERROR", {
-            severity,
-            structuredData: {
-              error,
-              error_description: error_description ?? ""
-            }
-          });
-          throw new OAuthProtocolError(error, error_description || "OAuth Authorization Error");
-        }
-        return ctx;
-      }
-    ]
-  });
-};
-var callbackAction = (oauth) => {
-  return (0, import_router4.createEndpoint)(
-    "GET",
-    "/callback/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { code, state },
-        context
-      } = ctx;
-      const { oauth: providers, cookies, jose, logger, trustedOrigins } = context;
-      const oauthConfig = providers[oauth2];
-      const cookieState = getCookie(request, cookies.state.name);
-      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
-      const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
-      const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
-      if (!timingSafeEqual(cookieState, state)) {
-        logger?.log("MISMATCHING_STATE", {
-          structuredData: {
-            oauth_provider: oauth2
-          }
-        });
-        throw new AuthSecurityError(
-          "MISMATCHING_STATE",
-          "The provided state passed in the OAuth response does not match the stored state."
-        );
-      }
-      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier, logger);
-      const origins = await getTrustedOrigins(request, trustedOrigins);
-      const requestOrigin = await getOriginURL(request, context);
-      if (!isRelativeURL(cookieRedirectTo)) {
-        const isValid = origins.length > 0 ? isTrustedOrigin(cookieRedirectTo, origins) : isSameOrigin(cookieRedirectTo, requestOrigin);
-        if (!isValid) {
-          logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", {
-            structuredData: {
-              redirect_path: cookieRedirectTo,
-              provider: oauth2,
-              has_trusted_origins: origins.length > 0,
-              request_origin: requestOrigin
-            }
-          });
-          throw new AuthSecurityError(
-            "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-            "Invalid redirect path. Potential open redirect attack detected."
-          );
-        }
-      }
-      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token, logger);
-      const sessionCookie = await createSessionCookie(jose, userInfo);
-      const csrfToken = await createCSRF(jose);
-      logger?.log("OAUTH_CALLBACK_SUCCESS", {
-        structuredData: {
-          provider: oauth2
-        }
-      });
-      const headers = new import_router4.HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
-      return Response.json({ oauth: oauth2 }, { status: 302, headers });
-    },
-    callbackConfig(oauth)
-  );
-};
-
-// src/actions/session/session.ts
-var import_router5 = require("@aura-stack/router");
-
-// src/api/getSession.ts
-var getSession = async ({ ctx, headers }) => {
-  try {
-    const session = getCookie(new Headers(headers), ctx.cookies.sessionToken.name);
-    const decoded = await ctx.jose.decodeJWT(session);
-    ctx?.logger?.log("AUTH_SESSION_VALID");
-    const { exp, iat, jti, nbf, aud, iss, ...user } = decoded;
-    return {
-      session: {
-        user,
-        expires: toISOString(exp * 1e3)
-      },
-      authenticated: true
-    };
-  } catch (error) {
-    ctx?.logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
-    return { session: null, authenticated: false };
-  }
-};
-
-// src/actions/session/session.ts
-var sessionAction = (0, import_router5.createEndpoint)("GET", "/session", async (ctx) => {
-  const {
-    request,
-    context: { cookies }
-  } = ctx;
-  try {
-    const session = await getSession({ ctx: ctx.context, headers: request.headers });
-    if (!session.authenticated) {
-      throw new AuthInternalError("INVALID_JWT_TOKEN", "Session not authenticated");
-    }
-    return Response.json(session, { headers: secureApiHeaders });
-  } catch (error) {
-    const headers = new import_router5.HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ session: null, authenticated: false }, { status: 401, headers });
-  }
-});
-
-// src/actions/signOut/signOut.ts
-var import_v44 = require("zod/v4");
-var import_router7 = require("@aura-stack/router");
-
-// src/api/signOut.ts
-var import_router6 = require("@aura-stack/router");
-var signOut = async ({
-  ctx,
-  headers: headersInit,
-  redirectTo = "/",
-  skipCSRFCheck = false
-}) => {
-  const headers = new Headers(headersInit);
-  const header = headers.get("X-CSRF-Token");
-  let session = null;
-  let csrfToken = null;
-  try {
-    session = getCookie(headers, ctx.cookies.sessionToken.name);
-  } catch {
-    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-  }
-  try {
-    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
-  } catch {
-    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-  }
-  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
-    structuredData: {
-      has_session: Boolean(session),
-      has_csrf_token: Boolean(csrfToken),
-      has_csrf_header: Boolean(header),
-      skip_csrf_check: skipCSRFCheck
-    }
-  });
-  if (!session) {
-    ctx?.logger?.log("SESSION_TOKEN_MISSING");
-    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-  }
-  if (!skipCSRFCheck) {
-    if (!csrfToken) {
-      ctx?.logger?.log("CSRF_TOKEN_MISSING");
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-    }
-    if (!header) {
-      ctx?.logger?.log("CSRF_HEADER_MISSING");
-      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
-    }
-    try {
-      await verifyCSRF(ctx.jose, csrfToken, header);
-    } catch (error) {
-      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
-    }
-    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
-  } else {
-    try {
-      await ctx.jose.verifyJWS(csrfToken);
-    } catch (error) {
-      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
-    }
-  }
-  try {
-    await ctx.jose.decodeJWT(session);
-    ctx?.logger?.log("SIGN_OUT_SUCCESS");
-  } catch (error) {
-    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
-  }
-  const headersList = new import_router6.HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-  return Response.json(
-    { redirect: Boolean(redirectTo), url: redirectTo },
-    {
-      status: 202,
-      headers: headersList
-    }
-  );
-};
-
-// src/actions/signOut/signOut.ts
-var config = (0, import_router7.createEndpointConfig)({
-  schemas: {
-    searchParams: import_v44.z.object({
-      token_type_hint: import_v44.z.literal("session_token"),
-      redirectTo: import_v44.z.string().optional()
-    })
-  }
-});
-var signOutAction = (0, import_router7.createEndpoint)(
-  "POST",
-  "/signOut",
-  async (ctx) => {
-    const {
-      request,
-      searchParams: { redirectTo },
-      context
-    } = ctx;
-    const baseURL = getBaseURL(request);
-    const location = await createRedirectTo(
-      new Request(baseURL, {
-        headers: request.headers
-      }),
-      redirectTo,
-      context
-    );
-    return await signOut({
-      ctx: context,
-      headers: request.headers,
-      redirectTo: location
-    });
-  },
-  config
-);
-
-// src/actions/csrfToken/csrfToken.ts
-var import_router8 = require("@aura-stack/router");
-var getCSRFToken = (request, cookieName) => {
-  try {
-    return getCookie(request, cookieName);
-  } catch {
-    return void 0;
-  }
-};
-var csrfTokenAction = (0, import_router8.createEndpoint)("GET", "/csrfToken", async (ctx) => {
-  const {
-    request,
-    context: { jose, cookies, logger }
-  } = ctx;
-  const token = getCSRFToken(request, cookies.csrfToken.name);
-  logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } });
-  const csrfToken = await createCSRF(jose, token);
-  logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } });
-  const headers = new Headers(secureApiHeaders);
-  headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes));
-  return Response.json({ csrfToken }, { headers });
-});
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  callbackAction,
-  csrfTokenAction,
-  sessionAction,
-  signInAction,
-  signOutAction
-});