@aura-stack/auth 0.5.0 → 0.6.0

package/dist/actions/signIn/authorization.cjs

@@ -1,281 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/actions/signIn/authorization.ts
-var authorization_exports = {};
-__export(authorization_exports, {
-  createRedirectTo: () => createRedirectTo,
-  createRedirectURI: () => createRedirectURI,
-  createSignInURL: () => createSignInURL,
-  getBaseURL: () => getBaseURL,
-  getOriginURL: () => getOriginURL,
-  getTrustedOrigins: () => getTrustedOrigins
-});
-module.exports = __toCommonJS(authorization_exports);
-
-// src/env.ts
-var import_meta = {};
-var env = new Proxy({}, {
-  get(_, prop) {
-    if (typeof prop !== "string") return void 0;
-    const hasProperty = (process2) => {
-      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
-    };
-    try {
-      if (typeof process !== "undefined" && hasProperty(process.env)) {
-        return process.env[prop];
-      }
-      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
-        return import_meta.env[prop];
-      }
-      if (typeof Deno !== "undefined" && Deno.env?.get) {
-        return Deno.env.get(prop);
-      }
-      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
-        return Bun.env[prop];
-      }
-      const globalValue = globalThis[prop];
-      return typeof globalValue === "string" ? globalValue : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-});
-var getEnv = (key) => {
-  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
-  return env[keys.find((k) => env[k]) ?? ""];
-};
-
-// src/errors.ts
-var AuthInternalError = class extends Error {
-  type = "AUTH_INTERNAL_ERROR";
-  code;
-  constructor(code, message, options) {
-    super(message, options);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-
-// src/utils.ts
-var import_router = require("@aura-stack/router");
-
-// src/assert.ts
-var import_crypto = require("@aura-stack/jose/crypto");
-var unsafeChars = [
-  "<",
-  ">",
-  '"',
-  "`",
-  " ",
-  "\r",
-  "\n",
-  "	",
-  "\\",
-  "%2F",
-  "%5C",
-  "%2f",
-  "%5c",
-  "\r\n",
-  "%0A",
-  "%0D",
-  "%0a",
-  "%0d",
-  "..",
-  "//",
-  "///",
-  "...",
-  "%20",
-  "\0"
-];
-var isValidURL = (value) => {
-  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
-    return false;
-  }
-  const match = value.match(/^(https?:\/\/)(.*)$/);
-  if (!match) return false;
-  const rest = match[2];
-  for (const char of unsafeChars) {
-    if (rest.includes(char)) return false;
-  }
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
-  return regex.test(match[0]);
-};
-var isRelativeURL = (value) => {
-  if (value.length > 100) return false;
-  for (const char of unsafeChars) {
-    if (value.includes(char)) return false;
-  }
-  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
-  return regex.test(value);
-};
-var isSameOrigin = (origin, expected) => {
-  const originURL = new URL(origin);
-  const expectedURL = new URL(expected);
-  return equals(originURL.origin, expectedURL.origin);
-};
-var patternToRegex = (pattern) => {
-  try {
-    if (pattern.length > 2048) return null;
-    pattern = pattern.replace(/\\/g, "");
-    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
-    if (!match) return null;
-    const [, protocol, host, port] = match;
-    const hasWildcard = host.includes("*");
-    if (hasWildcard && !host.startsWith("*.")) return null;
-    if (hasWildcard && host.slice(2).includes("*")) return null;
-    const domain = hasWildcard ? host.slice(2) : host;
-    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
-    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
-    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
-  } catch {
-    return null;
-  }
-};
-var isTrustedOrigin = (url, trustedOrigins) => {
-  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
-  try {
-    const urlOrigin = new URL(url).origin;
-    for (const pattern of trustedOrigins) {
-      const regex = patternToRegex(pattern);
-      if (regex?.test(urlOrigin)) return true;
-      try {
-        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return false;
-};
-
-// src/utils.ts
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var extractPath = (url) => {
-  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
-  const match = url.match(pathRegex);
-  return match && match[2] ? match[2] : "/";
-};
-
-// src/actions/signIn/authorization.ts
-var getTrustedOrigins = async (request, trustedOrigins) => {
-  if (!trustedOrigins) return [];
-  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
-  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
-};
-var getBaseURL = async ({
-  ctx,
-  request,
-  headers: headersInit
-}) => {
-  const origin = getEnv("BASE_URL") || ctx?.baseURL;
-  if (origin && origin !== "/") return origin;
-  if (ctx?.trustedProxyHeaders) {
-    const headers = headersInit && new Headers(headersInit) || request?.headers;
-    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
-    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
-    if (host) return `${protocol}://${host}`;
-    throw new AuthInternalError(
-      "INVALID_OAUTH_CONFIGURATION",
-      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
-    );
-  }
-  try {
-    return new URL(request?.url ?? "not-found").origin;
-  } catch (error) {
-    throw new AuthInternalError(
-      "INVALID_OAUTH_CONFIGURATION",
-      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
-      { cause: error }
-    );
-  }
-};
-var getOriginURL = async (request, context) => {
-  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
-  trustedOrigins.push(new URL(request.url).origin);
-  const origin = await getBaseURL({ request, ctx: context });
-  if (!isTrustedOrigin(origin, trustedOrigins)) {
-    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
-    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
-  }
-  return origin;
-};
-var createRedirectURI = async (request, oauth, context) => {
-  const origin = await getOriginURL(request, context);
-  return `${origin}${context.basePath}/callback/${oauth}`;
-};
-var createSignInURL = async ({
-  request,
-  oauth,
-  ctx,
-  redirectTo
-}) => {
-  const origin = await getOriginURL(request, ctx);
-  const searchParams = new URLSearchParams();
-  if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
-  return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
-};
-var createRedirectTo = async (request, redirectTo, context) => {
-  try {
-    const headers = request.headers;
-    const requestOrigin = await getOriginURL(request, context);
-    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
-    const validateURL = (url) => {
-      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
-      if (isRelativeURL(url)) return url;
-      if (origins.length > 0) {
-        if (isTrustedOrigin(url, origins)) {
-          const urlOrigin = new URL(url).origin;
-          for (const pattern of origins) {
-            const regex = patternToRegex(pattern);
-            if (regex?.test(urlOrigin)) {
-              return isSameOrigin(url, request.url) ? extractPath(url) : url;
-            }
-            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
-          }
-        }
-        context?.logger?.log("OPEN_REDIRECT_ATTACK");
-        return "/";
-      }
-      if (isSameOrigin(url, requestOrigin)) {
-        return extractPath(url);
-      }
-      context?.logger?.log("OPEN_REDIRECT_ATTACK");
-      return "/";
-    };
-    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
-  } catch (error) {
-    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
-    return "/";
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createRedirectTo,
-  createRedirectURI,
-  createSignInURL,
-  getBaseURL,
-  getOriginURL,
-  getTrustedOrigins
-});

package/dist/actions/signIn/authorization.d.ts

@@ -1,54 +0,0 @@
-import { A as AuthConfig } from '../../index-_aXtxb_s.js';
-import { GlobalContext } from '@aura-stack/router';
-import 'zod';
-import '../../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import '../../@types/utility.js';
-import 'jose';
-import 'zod/v4/core';
-
-/**
- * Resolves trusted origins from config (array or function).
- */
-declare const getTrustedOrigins: (request: Request, trustedOrigins: AuthConfig["trustedOrigins"]) => Promise<string[]>;
-declare const getBaseURL: ({ ctx, request, headers: headersInit, }: {
-    ctx?: GlobalContext;
-    request?: Request;
-    headers?: HeadersInit;
-}) => Promise<string>;
-declare const getOriginURL: (request: Request, context?: GlobalContext) => Promise<string>;
-/**
- * Creates the redirect URI for the OAuth callback based on the original request URL and the OAuth provider.
- *
- * @param requestURL - the original request URL
- * @param oauth - OAuth provider name
- * @param context - Global context containing configuration and utilities
- * @returns The redirect URI for the OAuth callback.
- */
-declare const createRedirectURI: (request: Request, oauth: string, context: GlobalContext) => Promise<string>;
-declare const createSignInURL: ({ request, oauth, ctx, redirectTo, }: {
-    request: Request;
-    oauth: string;
-    ctx: GlobalContext;
-    redirectTo?: string;
-}) => Promise<string>;
-/**
- * Verifies if the request's origin matches the expected origin. It accepts the redirectTo search
- * parameter for redirection. It checks the Referer and Origin headers and the request URL against
- * the trusted origins list. If they do not match, it returns "/" to avoid potential open redirect attacks.
- *
- * When `trustedOrigins` is provided, URLs are validated against that list. When not provided,
- * the request's derived origin (from request.url or proxy headers) is used as the only trusted origin.
- *
- * @param request The incoming request object
- * @param redirectTo Optional redirectTo parameter to override the referer
- * @param context Global context containing configuration and utilities
- * @returns A safe URL to redirect to after authentication, or "/" if the URL is not considered safe.
- */
-declare const createRedirectTo: (request: Request, redirectTo?: string, context?: GlobalContext) => Promise<string>;
-
-export { createRedirectTo, createRedirectURI, createSignInURL, getBaseURL, getOriginURL, getTrustedOrigins };

package/dist/actions/signIn/authorization.js

@@ -1,19 +0,0 @@
-import {
-  createRedirectTo,
-  createRedirectURI,
-  createSignInURL,
-  getBaseURL,
-  getOriginURL,
-  getTrustedOrigins
-} from "../../chunk-LATR3NIV.js";
-import "../../chunk-LX3TJ2TJ.js";
-import "../../chunk-WHNDRO3N.js";
-import "../../chunk-U5663F2U.js";
-export {
-  createRedirectTo,
-  createRedirectURI,
-  createSignInURL,
-  getBaseURL,
-  getOriginURL,
-  getTrustedOrigins
-};