@aura-stack/auth 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (215) hide show
  1. package/README.md +36 -1
  2. package/dist/@types/index.cjs +0 -18
  3. package/dist/@types/index.d.ts +2 -12
  4. package/dist/@types/index.js +0 -1
  5. package/dist/assert-B3iQSYlK.js +3 -0
  6. package/dist/assert-NJGroSJd.cjs +3 -0
  7. package/dist/client/index.cjs +1 -135
  8. package/dist/client/index.d.ts +11 -14
  9. package/dist/client/index.js +1 -10
  10. package/dist/crypto-Bz8nIciY.js +1 -0
  11. package/dist/crypto-CoXA5w_4.cjs +1 -0
  12. package/dist/env-bq387KyP.cjs +1 -0
  13. package/dist/env-nvh8QBNz.js +1 -0
  14. package/dist/errors-CCYPHuBO.cjs +1 -0
  15. package/dist/errors-DFWHOho6.js +1 -0
  16. package/dist/index-BkpwQ0l4.d.cts +2279 -0
  17. package/dist/index-nqLV2t91.d.ts +2279 -0
  18. package/dist/index.cjs +1 -2427
  19. package/dist/index.d.cts +2 -0
  20. package/dist/index.d.ts +2 -14
  21. package/dist/index.js +1 -59
  22. package/dist/logger-C59_CDMk.js +1 -0
  23. package/dist/logger-UnUhYL2V.cjs +1 -0
  24. package/dist/oauth/atlassian.cjs +1 -57
  25. package/dist/oauth/atlassian.d.ts +2 -12
  26. package/dist/oauth/atlassian.js +1 -6
  27. package/dist/oauth/bitbucket.cjs +1 -49
  28. package/dist/oauth/bitbucket.d.ts +2 -12
  29. package/dist/oauth/bitbucket.js +1 -6
  30. package/dist/oauth/discord.cjs +1 -57
  31. package/dist/oauth/discord.d.ts +2 -12
  32. package/dist/oauth/discord.js +1 -6
  33. package/dist/oauth/dropbox.cjs +1 -53
  34. package/dist/oauth/dropbox.d.ts +2 -12
  35. package/dist/oauth/dropbox.js +1 -6
  36. package/dist/oauth/figma.cjs +1 -49
  37. package/dist/oauth/figma.d.ts +2 -12
  38. package/dist/oauth/figma.js +1 -6
  39. package/dist/oauth/github.cjs +1 -49
  40. package/dist/oauth/github.d.ts +2 -12
  41. package/dist/oauth/github.js +1 -6
  42. package/dist/oauth/gitlab.cjs +1 -49
  43. package/dist/oauth/gitlab.d.ts +2 -12
  44. package/dist/oauth/gitlab.js +1 -6
  45. package/dist/oauth/index.cjs +1 -673
  46. package/dist/oauth/index.d.ts +2 -12
  47. package/dist/oauth/index.js +1 -68
  48. package/dist/oauth/mailchimp.cjs +1 -49
  49. package/dist/oauth/mailchimp.d.ts +2 -12
  50. package/dist/oauth/mailchimp.js +1 -6
  51. package/dist/oauth/notion.cjs +1 -131
  52. package/dist/oauth/notion.d.ts +2 -12
  53. package/dist/oauth/notion.js +1 -9
  54. package/dist/oauth/pinterest.cjs +1 -49
  55. package/dist/oauth/pinterest.d.ts +2 -12
  56. package/dist/oauth/pinterest.js +1 -6
  57. package/dist/oauth/spotify.cjs +1 -49
  58. package/dist/oauth/spotify.d.ts +2 -12
  59. package/dist/oauth/spotify.js +1 -6
  60. package/dist/oauth/strava.cjs +1 -49
  61. package/dist/oauth/strava.d.ts +2 -12
  62. package/dist/oauth/strava.js +1 -6
  63. package/dist/oauth/twitch.cjs +1 -95
  64. package/dist/oauth/twitch.d.ts +2 -12
  65. package/dist/oauth/twitch.js +1 -7
  66. package/dist/oauth/x.cjs +1 -49
  67. package/dist/oauth/x.d.ts +2 -12
  68. package/dist/oauth/x.js +1 -6
  69. package/dist/oauth-BntNm6aE.cjs +1 -0
  70. package/dist/oauth-DmHy9VrB.js +1 -0
  71. package/dist/shared/crypto.cjs +1 -0
  72. package/dist/shared/crypto.d.ts +47 -0
  73. package/dist/shared/crypto.js +1 -0
  74. package/dist/shared/identity.cjs +1 -0
  75. package/dist/shared/identity.d.ts +2 -0
  76. package/dist/shared/identity.js +1 -0
  77. package/dist/shared/index.cjs +1 -0
  78. package/dist/shared/index.d.ts +5 -0
  79. package/dist/shared/index.js +1 -0
  80. package/package.json +32 -9
  81. package/dist/@types/router.d.cjs +0 -1
  82. package/dist/@types/router.d.d.ts +0 -16
  83. package/dist/@types/router.d.js +0 -0
  84. package/dist/@types/utility.cjs +0 -18
  85. package/dist/@types/utility.d.ts +0 -6
  86. package/dist/@types/utility.js +0 -1
  87. package/dist/actions/callback/access-token.cjs +0 -250
  88. package/dist/actions/callback/access-token.d.ts +0 -33
  89. package/dist/actions/callback/access-token.js +0 -9
  90. package/dist/actions/callback/callback.cjs +0 -715
  91. package/dist/actions/callback/callback.d.ts +0 -42
  92. package/dist/actions/callback/callback.js +0 -18
  93. package/dist/actions/callback/userinfo.cjs +0 -283
  94. package/dist/actions/callback/userinfo.d.ts +0 -25
  95. package/dist/actions/callback/userinfo.js +0 -13
  96. package/dist/actions/csrfToken/csrfToken.cjs +0 -189
  97. package/dist/actions/csrfToken/csrfToken.d.ts +0 -7
  98. package/dist/actions/csrfToken/csrfToken.js +0 -13
  99. package/dist/actions/index.cjs +0 -1161
  100. package/dist/actions/index.d.ts +0 -17
  101. package/dist/actions/index.js +0 -39
  102. package/dist/actions/session/session.cjs +0 -188
  103. package/dist/actions/session/session.d.ts +0 -7
  104. package/dist/actions/session/session.js +0 -12
  105. package/dist/actions/signIn/authorization-url.cjs +0 -288
  106. package/dist/actions/signIn/authorization-url.d.ts +0 -31
  107. package/dist/actions/signIn/authorization-url.js +0 -16
  108. package/dist/actions/signIn/authorization.cjs +0 -281
  109. package/dist/actions/signIn/authorization.d.ts +0 -54
  110. package/dist/actions/signIn/authorization.js +0 -19
  111. package/dist/actions/signIn/signIn.cjs +0 -595
  112. package/dist/actions/signIn/signIn.d.ts +0 -42
  113. package/dist/actions/signIn/signIn.js +0 -16
  114. package/dist/actions/signOut/signOut.cjs +0 -492
  115. package/dist/actions/signOut/signOut.d.ts +0 -16
  116. package/dist/actions/signOut/signOut.js +0 -15
  117. package/dist/api/createApi.cjs +0 -750
  118. package/dist/api/createApi.d.ts +0 -12
  119. package/dist/api/createApi.js +0 -19
  120. package/dist/api/getSession.cjs +0 -141
  121. package/dist/api/getSession.d.ts +0 -16
  122. package/dist/api/getSession.js +0 -10
  123. package/dist/api/signIn.cjs +0 -549
  124. package/dist/api/signIn.d.ts +0 -26
  125. package/dist/api/signIn.js +0 -15
  126. package/dist/api/signOut.cjs +0 -279
  127. package/dist/api/signOut.d.ts +0 -16
  128. package/dist/api/signOut.js +0 -13
  129. package/dist/assert.cjs +0 -194
  130. package/dist/assert.d.ts +0 -37
  131. package/dist/assert.js +0 -26
  132. package/dist/chunk-2A5B7GWR.js +0 -125
  133. package/dist/chunk-2GQLSIJ2.js +0 -40
  134. package/dist/chunk-2IR674WX.js +0 -44
  135. package/dist/chunk-3J5TUH2I.js +0 -50
  136. package/dist/chunk-4RWSYUKX.js +0 -98
  137. package/dist/chunk-4YHJ4IEQ.js +0 -25
  138. package/dist/chunk-54CZPKR4.js +0 -25
  139. package/dist/chunk-5LZ7TOM3.js +0 -25
  140. package/dist/chunk-5X7JZMEF.js +0 -0
  141. package/dist/chunk-7BE46WWS.js +0 -88
  142. package/dist/chunk-7YYXFKLR.js +0 -35
  143. package/dist/chunk-C3A37LQC.js +0 -33
  144. package/dist/chunk-CITNGXDA.js +0 -31
  145. package/dist/chunk-CWX724AG.js +0 -78
  146. package/dist/chunk-D2CSIUKP.js +0 -74
  147. package/dist/chunk-E6G5YCI6.js +0 -25
  148. package/dist/chunk-EBAMFRB7.js +0 -34
  149. package/dist/chunk-EEE7UM5T.js +0 -25
  150. package/dist/chunk-FPCVZUVG.js +0 -37
  151. package/dist/chunk-FW4W3REU.js +0 -25
  152. package/dist/chunk-GNNBM2WJ.js +0 -83
  153. package/dist/chunk-IPKO6UQN.js +0 -25
  154. package/dist/chunk-ITQ7352M.js +0 -0
  155. package/dist/chunk-JOCGX3RP.js +0 -59
  156. package/dist/chunk-KBXWTD6E.js +0 -94
  157. package/dist/chunk-KMMAZFSJ.js +0 -25
  158. package/dist/chunk-LATR3NIV.js +0 -117
  159. package/dist/chunk-LAYPUDQF.js +0 -39
  160. package/dist/chunk-LDU7A2JE.js +0 -25
  161. package/dist/chunk-LX3TJ2TJ.js +0 -294
  162. package/dist/chunk-NHZBQNRR.js +0 -143
  163. package/dist/chunk-OVHNRULD.js +0 -33
  164. package/dist/chunk-PDP3PHB3.js +0 -127
  165. package/dist/chunk-PG7UYFG5.js +0 -0
  166. package/dist/chunk-PHYNROD4.js +0 -47
  167. package/dist/chunk-QQEKY4XP.js +0 -29
  168. package/dist/chunk-U4RK4LKJ.js +0 -348
  169. package/dist/chunk-U5663F2U.js +0 -70
  170. package/dist/chunk-UN7X6SU5.js +0 -53
  171. package/dist/chunk-UZQJJD6A.js +0 -100
  172. package/dist/chunk-V6LLEAR4.js +0 -80
  173. package/dist/chunk-WHNDRO3N.js +0 -50
  174. package/dist/chunk-XY5R3EHH.js +0 -204
  175. package/dist/chunk-ZNCZVF6U.js +0 -14
  176. package/dist/client/client.cjs +0 -135
  177. package/dist/client/client.d.ts +0 -85
  178. package/dist/client/client.js +0 -9
  179. package/dist/context.cjs +0 -1237
  180. package/dist/context.d.ts +0 -16
  181. package/dist/context.js +0 -28
  182. package/dist/cookie.cjs +0 -277
  183. package/dist/cookie.d.ts +0 -89
  184. package/dist/cookie.js +0 -30
  185. package/dist/createAuth.cjs +0 -2320
  186. package/dist/createAuth.d.ts +0 -12
  187. package/dist/createAuth.js +0 -48
  188. package/dist/env.cjs +0 -78
  189. package/dist/env.d.ts +0 -10
  190. package/dist/env.js +0 -12
  191. package/dist/errors.cjs +0 -102
  192. package/dist/errors.d.ts +0 -60
  193. package/dist/errors.js +0 -22
  194. package/dist/headers.cjs +0 -61
  195. package/dist/headers.d.ts +0 -33
  196. package/dist/headers.js +0 -12
  197. package/dist/index-_aXtxb_s.d.ts +0 -1377
  198. package/dist/jose.cjs +0 -166
  199. package/dist/jose.d.ts +0 -12
  200. package/dist/jose.js +0 -20
  201. package/dist/logger.cjs +0 -424
  202. package/dist/logger.d.ts +0 -12
  203. package/dist/logger.js +0 -17
  204. package/dist/request.cjs +0 -38
  205. package/dist/request.d.ts +0 -13
  206. package/dist/request.js +0 -6
  207. package/dist/schemas.cjs +0 -158
  208. package/dist/schemas.d.ts +0 -229
  209. package/dist/schemas.js +0 -24
  210. package/dist/secure.cjs +0 -170
  211. package/dist/secure.d.ts +0 -41
  212. package/dist/secure.js +0 -20
  213. package/dist/utils.cjs +0 -329
  214. package/dist/utils.d.ts +0 -35
  215. package/dist/utils.js +0 -36
@@ -1,595 +0,0 @@
1
- "use strict";
2
- var __defProp = Object.defineProperty;
3
- var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
4
- var __getOwnPropNames = Object.getOwnPropertyNames;
5
- var __hasOwnProp = Object.prototype.hasOwnProperty;
6
- var __export = (target, all) => {
7
- for (var name in all)
8
- __defProp(target, name, { get: all[name], enumerable: true });
9
- };
10
- var __copyProps = (to, from, except, desc) => {
11
- if (from && typeof from === "object" || typeof from === "function") {
12
- for (let key of __getOwnPropNames(from))
13
- if (!__hasOwnProp.call(to, key) && key !== except)
14
- __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
15
- }
16
- return to;
17
- };
18
- var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
19
-
20
- // src/actions/signIn/signIn.ts
21
- var signIn_exports = {};
22
- __export(signIn_exports, {
23
- signInAction: () => signInAction
24
- });
25
- module.exports = __toCommonJS(signIn_exports);
26
- var import_v42 = require("zod/v4");
27
-
28
- // src/headers.ts
29
- var cacheControl = {
30
- "Cache-Control": "no-store",
31
- Pragma: "no-cache",
32
- Expires: "0",
33
- Vary: "Cookie"
34
- };
35
- var contentSecurityPolicy = {
36
- "Content-Security-Policy": [
37
- "default-src 'none'",
38
- "script-src 'self'",
39
- "frame-src 'none'",
40
- "object-src 'none'",
41
- "frame-ancestors 'none'",
42
- "base-uri 'none'"
43
- ].join("; ")
44
- };
45
- var secureHeaders = {
46
- "X-Content-Type-Options": "nosniff",
47
- "X-Frame-Options": "DENY",
48
- "Referrer-Policy": "strict-origin-when-cross-origin"
49
- };
50
- var secureApiHeaders = {
51
- ...cacheControl,
52
- ...contentSecurityPolicy,
53
- ...secureHeaders
54
- };
55
-
56
- // src/errors.ts
57
- var AuthInternalError = class extends Error {
58
- type = "AUTH_INTERNAL_ERROR";
59
- code;
60
- constructor(code, message, options2) {
61
- super(message, options2);
62
- this.code = code;
63
- this.name = new.target.name;
64
- Error.captureStackTrace(this, new.target);
65
- }
66
- };
67
- var AuthSecurityError = class extends Error {
68
- type = "AUTH_SECURITY_ERROR";
69
- code;
70
- constructor(code, message, options2) {
71
- super(message, options2);
72
- this.code = code;
73
- this.name = new.target.name;
74
- Error.captureStackTrace(this, new.target);
75
- }
76
- };
77
-
78
- // src/api/signIn.ts
79
- var import_router2 = require("@aura-stack/router");
80
-
81
- // src/schemas.ts
82
- var import_v4 = require("zod/v4");
83
- var AuthorizeConfigSchema = import_v4.z.union([
84
- (0, import_v4.string)().url(),
85
- (0, import_v4.object)({
86
- url: (0, import_v4.string)().url(),
87
- params: (0, import_v4.object)({
88
- responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
89
- scope: (0, import_v4.string)().optional()
90
- })
91
- })
92
- ]);
93
- var AccessTokenConfigSchema = import_v4.z.union([
94
- (0, import_v4.string)().url(),
95
- (0, import_v4.object)({
96
- url: (0, import_v4.string)().url(),
97
- headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
98
- })
99
- ]);
100
- var UserInfoConfigSchema = import_v4.z.union([
101
- (0, import_v4.string)().url(),
102
- (0, import_v4.object)({
103
- url: (0, import_v4.string)().url(),
104
- headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
105
- method: (0, import_v4.string)().optional()
106
- })
107
- ]);
108
- var OAuthProviderCredentialsSchema = (0, import_v4.object)({
109
- id: (0, import_v4.string)(),
110
- name: (0, import_v4.string)(),
111
- authorize: AuthorizeConfigSchema.optional(),
112
- /** @deprecated */
113
- authorizeURL: (0, import_v4.string)().url().optional(),
114
- accessToken: AccessTokenConfigSchema,
115
- /** @deprecated */
116
- scope: (0, import_v4.string)().optional(),
117
- userInfo: UserInfoConfigSchema,
118
- /** @deprecated */
119
- responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
120
- clientId: (0, import_v4.string)(),
121
- clientSecret: (0, import_v4.string)(),
122
- profile: import_v4.z.function().optional()
123
- });
124
- var OAuthProviderConfigSchema = (0, import_v4.object)({
125
- authorize: AuthorizeConfigSchema.optional(),
126
- /** @deprecated */
127
- authorizeURL: (0, import_v4.string)().url().optional(),
128
- accessToken: AccessTokenConfigSchema,
129
- /** @deprecated */
130
- scope: (0, import_v4.string)().optional(),
131
- userInfo: UserInfoConfigSchema,
132
- /** @deprecated */
133
- responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
134
- clientId: (0, import_v4.string)(),
135
- clientSecret: (0, import_v4.string)()
136
- });
137
- var OAuthAuthorization = OAuthProviderConfigSchema.extend({
138
- redirectURI: (0, import_v4.string)(),
139
- state: (0, import_v4.string)(),
140
- codeChallenge: (0, import_v4.string)(),
141
- codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
142
- });
143
- var OAuthAuthorizationResponse = (0, import_v4.object)({
144
- state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
145
- code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
146
- });
147
- var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
148
- error: (0, import_v4.enum)([
149
- "invalid_request",
150
- "unauthorized_client",
151
- "access_denied",
152
- "unsupported_response_type",
153
- "invalid_scope",
154
- "server_error",
155
- "temporarily_unavailable"
156
- ]),
157
- error_description: (0, import_v4.string)().optional(),
158
- error_uri: (0, import_v4.string)().optional(),
159
- state: (0, import_v4.string)()
160
- });
161
- var OAuthAccessToken = OAuthProviderConfigSchema.extend({
162
- redirectURI: (0, import_v4.string)(),
163
- code: (0, import_v4.string)(),
164
- codeVerifier: (0, import_v4.string)().min(43).max(128)
165
- });
166
- var OAuthAccessTokenResponse = (0, import_v4.object)({
167
- access_token: (0, import_v4.string)(),
168
- token_type: (0, import_v4.string)().optional(),
169
- expires_in: (0, import_v4.number)().optional(),
170
- refresh_token: (0, import_v4.string)().optional(),
171
- scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
172
- });
173
- var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
174
- error: (0, import_v4.enum)([
175
- "invalid_request",
176
- "invalid_client",
177
- "invalid_grant",
178
- "unauthorized_client",
179
- "unsupported_grant_type",
180
- "invalid_scope"
181
- ]),
182
- error_description: (0, import_v4.string)().optional(),
183
- error_uri: (0, import_v4.string)().optional()
184
- });
185
- var OAuthErrorResponse = (0, import_v4.object)({
186
- error: (0, import_v4.string)(),
187
- error_description: (0, import_v4.string)().optional()
188
- });
189
- var OAuthEnvSchema = (0, import_v4.object)({
190
- clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
191
- clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
192
- });
193
-
194
- // src/utils.ts
195
- var import_router = require("@aura-stack/router");
196
-
197
- // src/env.ts
198
- var import_meta = {};
199
- var env = new Proxy({}, {
200
- get(_, prop) {
201
- if (typeof prop !== "string") return void 0;
202
- const hasProperty = (process2) => {
203
- return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
204
- };
205
- try {
206
- if (typeof process !== "undefined" && hasProperty(process.env)) {
207
- return process.env[prop];
208
- }
209
- if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
210
- return import_meta.env[prop];
211
- }
212
- if (typeof Deno !== "undefined" && Deno.env?.get) {
213
- return Deno.env.get(prop);
214
- }
215
- if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
216
- return Bun.env[prop];
217
- }
218
- const globalValue = globalThis[prop];
219
- return typeof globalValue === "string" ? globalValue : void 0;
220
- } catch {
221
- return void 0;
222
- }
223
- }
224
- });
225
- var getEnv = (key) => {
226
- const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
227
- return env[keys.find((k) => env[k]) ?? ""];
228
- };
229
-
230
- // src/assert.ts
231
- var import_crypto = require("@aura-stack/jose/crypto");
232
- var unsafeChars = [
233
- "<",
234
- ">",
235
- '"',
236
- "`",
237
- " ",
238
- "\r",
239
- "\n",
240
- " ",
241
- "\\",
242
- "%2F",
243
- "%5C",
244
- "%2f",
245
- "%5c",
246
- "\r\n",
247
- "%0A",
248
- "%0D",
249
- "%0a",
250
- "%0d",
251
- "..",
252
- "//",
253
- "///",
254
- "...",
255
- "%20",
256
- "\0"
257
- ];
258
- var isValidURL = (value) => {
259
- if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
260
- return false;
261
- }
262
- const match = value.match(/^(https?:\/\/)(.*)$/);
263
- if (!match) return false;
264
- const rest = match[2];
265
- for (const char of unsafeChars) {
266
- if (rest.includes(char)) return false;
267
- }
268
- const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
269
- return regex.test(match[0]);
270
- };
271
- var isRelativeURL = (value) => {
272
- if (value.length > 100) return false;
273
- for (const char of unsafeChars) {
274
- if (value.includes(char)) return false;
275
- }
276
- const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
277
- return regex.test(value);
278
- };
279
- var isSameOrigin = (origin, expected) => {
280
- const originURL = new URL(origin);
281
- const expectedURL = new URL(expected);
282
- return equals(originURL.origin, expectedURL.origin);
283
- };
284
- var patternToRegex = (pattern) => {
285
- try {
286
- if (pattern.length > 2048) return null;
287
- pattern = pattern.replace(/\\/g, "");
288
- const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
289
- if (!match) return null;
290
- const [, protocol, host, port] = match;
291
- const hasWildcard = host.includes("*");
292
- if (hasWildcard && !host.startsWith("*.")) return null;
293
- if (hasWildcard && host.slice(2).includes("*")) return null;
294
- const domain = hasWildcard ? host.slice(2) : host;
295
- const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
296
- const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
297
- const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
298
- return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
299
- } catch {
300
- return null;
301
- }
302
- };
303
- var isTrustedOrigin = (url, trustedOrigins) => {
304
- if (!isValidURL(url) || trustedOrigins.length === 0) return false;
305
- try {
306
- const urlOrigin = new URL(url).origin;
307
- for (const pattern of trustedOrigins) {
308
- const regex = patternToRegex(pattern);
309
- if (regex?.test(urlOrigin)) return true;
310
- try {
311
- if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
312
- } catch {
313
- }
314
- }
315
- } catch {
316
- }
317
- return false;
318
- };
319
-
320
- // src/utils.ts
321
- var equals = (a, b) => {
322
- if (a === null || b === null || a === void 0 || b === void 0) return false;
323
- return a === b;
324
- };
325
- var extractPath = (url) => {
326
- const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
327
- const match = url.match(pathRegex);
328
- return match && match[2] ? match[2] : "/";
329
- };
330
-
331
- // src/jose.ts
332
- var import_jose = require("@aura-stack/jose");
333
- var import_jose2 = require("@aura-stack/jose/jose");
334
- var import_crypto2 = require("@aura-stack/jose/crypto");
335
-
336
- // src/secure.ts
337
- var generateSecure = (length = 32) => {
338
- return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
339
- };
340
- var createSecretValue = (length = 32) => {
341
- return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
342
- };
343
- var createHash = async (data) => {
344
- const subtle = (0, import_crypto2.getSubtleCrypto)();
345
- const digest = await subtle.digest("SHA-256", import_crypto2.encoder.encode(data));
346
- return import_jose2.base64url.encode(new Uint8Array(digest));
347
- };
348
- var createPKCE = async (verifier) => {
349
- const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
350
- const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
351
- if (codeVerifier.length < 43 || codeVerifier.length > 128) {
352
- throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
353
- }
354
- const codeChallenge = await createHash(codeVerifier);
355
- return { codeVerifier, codeChallenge, method: "S256" };
356
- };
357
-
358
- // src/actions/signIn/authorization-url.ts
359
- var setSearchParams = (url, params) => {
360
- for (const [key, value] of Object.entries(params)) {
361
- if (value !== void 0 && value !== "") {
362
- url.searchParams.set(key, value);
363
- }
364
- }
365
- };
366
- var buildAuthorizationURL = (oauth, redirect_uri, state, code_challenge, code_challenge_method) => {
367
- const authorizeConfig = oauth.authorize;
368
- const baseURL = typeof authorizeConfig === "string" ? authorizeConfig : authorizeConfig?.url ?? oauth.authorizeURL;
369
- if (!baseURL) {
370
- throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing authorization URL in OAuth provider configuration.");
371
- }
372
- const url = new URL(baseURL);
373
- const authorizeParams = typeof authorizeConfig === "string" ? void 0 : authorizeConfig?.params;
374
- setSearchParams(url, {
375
- response_type: authorizeParams?.responseType ?? oauth.responseType ?? "code",
376
- client_id: oauth.clientId,
377
- redirect_uri,
378
- state,
379
- code_challenge,
380
- code_challenge_method,
381
- scope: authorizeParams?.scope ?? oauth.scope,
382
- prompt: authorizeParams?.prompt,
383
- response_mode: authorizeParams?.responseMode,
384
- login_hint: authorizeParams?.loginHint,
385
- nonce: authorizeParams?.nonce,
386
- display: authorizeParams?.display,
387
- audience: authorizeParams?.audience
388
- });
389
- return url.toString();
390
- };
391
- var createAuthorizationURL = async (oauth, redirectURI, ctx) => {
392
- const state = createSecretValue();
393
- const { codeVerifier, codeChallenge, method } = await createPKCE();
394
- const authorization = buildAuthorizationURL(oauth, redirectURI, state, codeChallenge, method);
395
- const parsed = OAuthAuthorization.safeParse({ ...oauth, redirectURI, state, codeChallenge, codeChallengeMethod: method });
396
- if (!parsed.success) {
397
- ctx?.logger?.log("INVALID_OAUTH_CONFIGURATION", {
398
- structuredData: {
399
- scope: oauth?.scope ?? "",
400
- redirect_uri: redirectURI,
401
- has_state: Boolean(state),
402
- has_code_challenge: Boolean(codeChallenge),
403
- code_challenge_method: method
404
- }
405
- });
406
- throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
407
- }
408
- return {
409
- authorization,
410
- state,
411
- codeVerifier,
412
- method
413
- };
414
- };
415
-
416
- // src/actions/signIn/authorization.ts
417
- var getTrustedOrigins = async (request, trustedOrigins) => {
418
- if (!trustedOrigins) return [];
419
- const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
420
- return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
421
- };
422
- var getBaseURL = async ({
423
- ctx,
424
- request,
425
- headers: headersInit
426
- }) => {
427
- const origin = getEnv("BASE_URL") || ctx?.baseURL;
428
- if (origin && origin !== "/") return origin;
429
- if (ctx?.trustedProxyHeaders) {
430
- const headers = headersInit && new Headers(headersInit) || request?.headers;
431
- const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
432
- const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
433
- if (host) return `${protocol}://${host}`;
434
- throw new AuthInternalError(
435
- "INVALID_OAUTH_CONFIGURATION",
436
- "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
437
- );
438
- }
439
- try {
440
- return new URL(request?.url ?? "not-found").origin;
441
- } catch (error) {
442
- throw new AuthInternalError(
443
- "INVALID_OAUTH_CONFIGURATION",
444
- "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
445
- { cause: error }
446
- );
447
- }
448
- };
449
- var getOriginURL = async (request, context) => {
450
- const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
451
- trustedOrigins.push(new URL(request.url).origin);
452
- const origin = await getBaseURL({ request, ctx: context });
453
- if (!isTrustedOrigin(origin, trustedOrigins)) {
454
- context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
455
- throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
456
- }
457
- return origin;
458
- };
459
- var createRedirectURI = async (request, oauth, context) => {
460
- const origin = await getOriginURL(request, context);
461
- return `${origin}${context.basePath}/callback/${oauth}`;
462
- };
463
- var createSignInURL = async ({
464
- request,
465
- oauth,
466
- ctx,
467
- redirectTo
468
- }) => {
469
- const origin = await getOriginURL(request, ctx);
470
- const searchParams = new URLSearchParams();
471
- if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
472
- return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
473
- };
474
- var createRedirectTo = async (request, redirectTo, context) => {
475
- try {
476
- const headers = request.headers;
477
- const requestOrigin = await getOriginURL(request, context);
478
- const origins = await getTrustedOrigins(request, context?.trustedOrigins);
479
- const validateURL = (url) => {
480
- if (!isRelativeURL(url) && !isValidURL(url)) return "/";
481
- if (isRelativeURL(url)) return url;
482
- if (origins.length > 0) {
483
- if (isTrustedOrigin(url, origins)) {
484
- const urlOrigin = new URL(url).origin;
485
- for (const pattern of origins) {
486
- const regex = patternToRegex(pattern);
487
- if (regex?.test(urlOrigin)) {
488
- return isSameOrigin(url, request.url) ? extractPath(url) : url;
489
- }
490
- if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
491
- }
492
- }
493
- context?.logger?.log("OPEN_REDIRECT_ATTACK");
494
- return "/";
495
- }
496
- if (isSameOrigin(url, requestOrigin)) {
497
- return extractPath(url);
498
- }
499
- context?.logger?.log("OPEN_REDIRECT_ATTACK");
500
- return "/";
501
- };
502
- return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
503
- } catch (error) {
504
- context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
505
- return "/";
506
- }
507
- };
508
-
509
- // src/api/signIn.ts
510
- var signIn = async (oauth, {
511
- ctx,
512
- headers: headersInit,
513
- redirectTo = "/",
514
- redirect,
515
- request: requestInit
516
- }) => {
517
- const headers = new Headers(headersInit);
518
- const provider = ctx.oauth[oauth];
519
- if (!provider) {
520
- throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", `The OAuth provider "${oauth}" is not configured.`);
521
- }
522
- let request = requestInit;
523
- if (!request) {
524
- const origin = await getBaseURL({ ctx, headers });
525
- const url = `${origin}${ctx.basePath}/signIn/${oauth}`;
526
- request = new Request(url, { headers });
527
- }
528
- if (redirect === false) {
529
- const signInURL = await createSignInURL({ request, oauth, ctx, redirectTo });
530
- return { redirect: false, signInURL };
531
- }
532
- const redirectURI = await createRedirectURI(request, oauth, ctx);
533
- const redirectToValue = await createRedirectTo(request, redirectTo, ctx);
534
- const { authorization, state, codeVerifier } = await createAuthorizationURL(provider, redirectURI, ctx);
535
- ctx?.logger?.log("SIGN_IN_INITIATED", {
536
- structuredData: { oauth_provider: oauth }
537
- });
538
- const headersList = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(ctx.cookies.state.name, state, ctx.cookies.state.attributes).setCookie(ctx.cookies.redirectURI.name, redirectURI, ctx.cookies.redirectURI.attributes).setCookie(ctx.cookies.redirectTo.name, redirectToValue, ctx.cookies.redirectTo.attributes).setCookie(ctx.cookies.codeVerifier.name, codeVerifier, ctx.cookies.codeVerifier.attributes).toHeaders();
539
- return Response.json(
540
- { redirect: redirect ?? true, signInURL: authorization },
541
- {
542
- status: redirect ?? true ? 302 : 200,
543
- headers: headersList
544
- }
545
- );
546
- };
547
-
548
- // src/actions/signIn/signIn.ts
549
- var import_router3 = require("@aura-stack/router");
550
- var signInConfig = (oauth) => {
551
- return (0, import_router3.createEndpointConfig)("/signIn/:oauth", {
552
- schemas: {
553
- params: import_v42.z.object({
554
- oauth: import_v42.z.enum(
555
- Object.keys(oauth),
556
- "The OAuth provider is not supported or invalid."
557
- )
558
- }),
559
- searchParams: import_v42.z.object({
560
- redirect: import_v42.z.stringbool().optional().default(true),
561
- redirectTo: import_v42.z.string().optional()
562
- })
563
- }
564
- });
565
- };
566
- var signInAction = (oauth) => {
567
- return (0, import_router3.createEndpoint)(
568
- "GET",
569
- "/signIn/:oauth",
570
- async (ctx) => {
571
- const {
572
- request,
573
- params: { oauth: oauth2 },
574
- searchParams: { redirectTo, redirect },
575
- context
576
- } = ctx;
577
- const signInResult = await signIn(oauth2, {
578
- ctx: context,
579
- headers: request.headers,
580
- redirect,
581
- redirectTo,
582
- request
583
- });
584
- if (!redirect) {
585
- return Response.json(signInResult, { status: 200 });
586
- }
587
- return signInResult;
588
- },
589
- signInConfig(oauth)
590
- );
591
- };
592
- // Annotate the CommonJS export names for ESM import in node:
593
- 0 && (module.exports = {
594
- signInAction
595
- });
@@ -1,42 +0,0 @@
1
- import * as _aura_stack_router from '@aura-stack/router';
2
- import { z } from 'zod/v4';
3
- import { O as OAuthProviderRecord } from '../../index-_aXtxb_s.js';
4
- import 'zod';
5
- import '../../schemas.js';
6
- import '@aura-stack/jose';
7
- import '@aura-stack/jose/jose';
8
- import '@aura-stack/jose/crypto';
9
- import '@aura-stack/router/cookie';
10
- import '../../@types/utility.js';
11
- import 'jose';
12
- import 'zod/v4/core';
13
-
14
- declare const signInAction: (oauth: OAuthProviderRecord) => _aura_stack_router.RouteEndpoint<"GET", "/signIn/:oauth", {
15
- schemas?: {
16
- params: z.ZodObject<{
17
- oauth: z.ZodEnum<{
18
- [x: string & Record<never, never>]: string & Record<never, never>;
19
- github: "github";
20
- bitbucket: "bitbucket";
21
- figma: "figma";
22
- discord: "discord";
23
- gitlab: "gitlab";
24
- spotify: "spotify";
25
- x: "x";
26
- strava: "strava";
27
- mailchimp: "mailchimp";
28
- pinterest: "pinterest";
29
- twitch: "twitch";
30
- notion: "notion";
31
- dropbox: "dropbox";
32
- atlassian: "atlassian";
33
- }>;
34
- }, z.core.$strip>;
35
- searchParams: z.ZodObject<{
36
- redirect: z.ZodDefault<z.ZodOptional<z.ZodCodec<z.ZodString, z.ZodBoolean>>>;
37
- redirectTo: z.ZodOptional<z.ZodString>;
38
- }, z.core.$strip>;
39
- } | undefined;
40
- }>;
41
-
42
- export { signInAction };
@@ -1,16 +0,0 @@
1
- import {
2
- signInAction
3
- } from "../../chunk-UN7X6SU5.js";
4
- import "../../chunk-JOCGX3RP.js";
5
- import "../../chunk-D2CSIUKP.js";
6
- import "../../chunk-LATR3NIV.js";
7
- import "../../chunk-V6LLEAR4.js";
8
- import "../../chunk-2A5B7GWR.js";
9
- import "../../chunk-UZQJJD6A.js";
10
- import "../../chunk-LX3TJ2TJ.js";
11
- import "../../chunk-WHNDRO3N.js";
12
- import "../../chunk-U5663F2U.js";
13
- import "../../chunk-EBAMFRB7.js";
14
- export {
15
- signInAction
16
- };