@aura-stack/auth 0.5.0 → 0.6.0

package/dist/chunk-2GQLSIJ2.js

@@ -1,40 +0,0 @@
-import {
-  getEnv
-} from "./chunk-WHNDRO3N.js";
-
-// src/oauth/twitch.ts
-var twitch = (options) => {
-  const clientId = options?.clientId ?? getEnv("TWITCH_CLIENT_ID");
-  return {
-    id: "twitch",
-    name: "Twitch",
-    authorize: {
-      url: "https://id.twitch.tv/oauth2/authorize",
-      params: { scope: "user:read:email", responseType: "code" }
-    },
-    accessToken: "https://id.twitch.tv/oauth2/token",
-    userInfo: {
-      url: "https://api.twitch.tv/helix/users",
-      headers: {
-        "Client-ID": clientId
-      }
-    },
-    profile(profile) {
-      const user = profile.data[0];
-      if (!user) {
-        throw new Error("No user data found in Twitch profile response");
-      }
-      return {
-        sub: user.id,
-        name: user.display_name,
-        email: user.email,
-        picture: user.profile_image_url
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  twitch
-};

package/dist/chunk-2IR674WX.js

@@ -1,44 +0,0 @@
-import {
-  createBuiltInOAuthProviders
-} from "./chunk-PDP3PHB3.js";
-import {
-  createProxyLogger
-} from "./chunk-U4RK4LKJ.js";
-import {
-  createJoseInstance
-} from "./chunk-UZQJJD6A.js";
-import {
-  createCookieStore
-} from "./chunk-XY5R3EHH.js";
-import {
-  getEnv,
-  getEnvArray,
-  getEnvBoolean
-} from "./chunk-WHNDRO3N.js";
-
-// src/context.ts
-var createContext = (config) => {
-  const trustedProxyHeadersEnv = getEnv("TRUSTED_PROXY_HEADERS");
-  const useProxyHeaders = trustedProxyHeadersEnv === void 0 ? config?.trustedProxyHeaders ?? false : getEnvBoolean("TRUSTED_PROXY_HEADERS");
-  const logger = createProxyLogger(config);
-  const cookiePrefix = config?.cookies?.prefix;
-  const cookieOverrides = config?.cookies?.overrides ?? {};
-  const secureCookieStore = createCookieStore(true, cookiePrefix, cookieOverrides, logger);
-  const standardCookieStore = createCookieStore(false, cookiePrefix, cookieOverrides, logger);
-  return {
-    oauth: createBuiltInOAuthProviders(config?.oauth),
-    cookies: standardCookieStore,
-    jose: createJoseInstance(config?.secret),
-    secret: config?.secret,
-    basePath: config?.basePath ?? "/auth",
-    trustedProxyHeaders: useProxyHeaders,
-    trustedOrigins: getEnvArray("TRUSTED_ORIGINS").length > 0 ? getEnvArray("TRUSTED_ORIGINS") : config?.trustedOrigins,
-    logger,
-    cookieConfig: { secure: secureCookieStore, standard: standardCookieStore },
-    baseURL: config?.baseURL
-  };
-};
-
-export {
-  createContext
-};

package/dist/chunk-3J5TUH2I.js

@@ -1,50 +0,0 @@
-import {
-  createRedirectTo
-} from "./chunk-LATR3NIV.js";
-import {
-  signOut
-} from "./chunk-KBXWTD6E.js";
-import {
-  getBaseURL
-} from "./chunk-LX3TJ2TJ.js";
-
-// src/actions/signOut/signOut.ts
-import { z } from "zod/v4";
-import { createEndpoint, createEndpointConfig } from "@aura-stack/router";
-var config = createEndpointConfig({
-  schemas: {
-    searchParams: z.object({
-      token_type_hint: z.literal("session_token"),
-      redirectTo: z.string().optional()
-    })
-  }
-});
-var signOutAction = createEndpoint(
-  "POST",
-  "/signOut",
-  async (ctx) => {
-    const {
-      request,
-      searchParams: { redirectTo },
-      context
-    } = ctx;
-    const baseURL = getBaseURL(request);
-    const location = await createRedirectTo(
-      new Request(baseURL, {
-        headers: request.headers
-      }),
-      redirectTo,
-      context
-    );
-    return await signOut({
-      ctx: context,
-      headers: request.headers,
-      redirectTo: location
-    });
-  },
-  config
-);
-
-export {
-  signOutAction
-};

package/dist/chunk-4RWSYUKX.js

@@ -1,98 +0,0 @@
-import {
-  AuthClientError,
-  isNativeError
-} from "./chunk-U5663F2U.js";
-
-// src/client/client.ts
-import { createClient as createClientAPI } from "@aura-stack/router";
-var createClient = createClientAPI;
-var createAuthClient = (options) => {
-  if (typeof window === "undefined" && !options.baseURL) {
-    throw new AuthClientError("`baseURL` is required when createAuthClient is used outside the browser.");
-  }
-  const client = createClient({
-    cache: "no-store",
-    credentials: "include",
-    baseURL: options.baseURL ?? window.location.origin,
-    ...options
-  });
-  const getCSRFToken = async () => {
-    try {
-      const response = await client.get("/csrfToken");
-      if (!response.ok) return null;
-      const data = await response.json();
-      return data.csrfToken;
-    } catch (error) {
-      console.error("Error fetching CSRF token:", error);
-      return null;
-    }
-  };
-  const getSession = async () => {
-    try {
-      const response = await client.get("/session");
-      if (!response.ok) return null;
-      const session = await response.json();
-      if (!session?.authenticated) return null;
-      return session.session;
-    } catch (error) {
-      console.error("Error fetching session:", error);
-      return null;
-    }
-  };
-  const signIn = async (oauth, options2) => {
-    try {
-      const response = await client.get("/signIn/:oauth", {
-        params: {
-          oauth
-        },
-        searchParams: {
-          ...options2,
-          redirect: false
-        }
-      });
-      const json = await response.json();
-      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.signInURL) {
-        window.location.assign(json.signInURL);
-      }
-      return json;
-    } catch (error) {
-      console.error("Error during sign-in:", error);
-      return { redirect: false, signInURL: "/" };
-    }
-  };
-  const signOut = async (options2) => {
-    try {
-      const csrfToken = await getCSRFToken();
-      if (!csrfToken) {
-        throw new AuthClientError("Failed to fetch CSRF token for sign-out.");
-      }
-      const response = await client.post("/signOut", {
-        searchParams: {
-          redirectTo: options2?.redirectTo ?? "/",
-          token_type_hint: "session_token"
-        },
-        headers: {
-          "X-CSRF-Token": csrfToken
-        }
-      });
-      const json = await response.json();
-      if ((options2?.redirect ?? true) && typeof window !== "undefined" && json?.url) {
-        window.location.assign(json.url);
-      }
-      return json;
-    } catch (error) {
-      console.error("Error during sign-out:", error);
-      throw isNativeError(error) ? error : new AuthClientError("Sign-out failed.", "The sign-out request failed.", { cause: error });
-    }
-  };
-  return {
-    getSession,
-    signIn,
-    signOut
-  };
-};
-
-export {
-  createClient,
-  createAuthClient
-};

package/dist/chunk-4YHJ4IEQ.js

@@ -1,25 +0,0 @@
-// src/oauth/bitbucket.ts
-var bitbucket = (options) => {
-  return {
-    id: "bitbucket",
-    name: "Bitbucket",
-    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-    accessToken: "https://bitbucket.org/site/oauth2/access_token",
-    userInfo: "https://api.bitbucket.org/2.0/user",
-    scope: "account email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.uuid ?? profile.account_id,
-        name: profile.display_name ?? profile.nickname,
-        image: profile.links.avatar?.href,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  bitbucket
-};

package/dist/chunk-54CZPKR4.js

@@ -1,25 +0,0 @@
-// src/oauth/strava.ts
-var strava = (options) => {
-  return {
-    id: "strava",
-    name: "Strava",
-    authorizeURL: "https://www.strava.com/oauth/authorize",
-    accessToken: "https://www.strava.com/oauth/token",
-    userInfo: "https://www.strava.com/api/v3/athlete",
-    scope: "read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: `${profile.firstname} ${profile.lastname}`,
-        image: profile.profile,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  strava
-};

package/dist/chunk-5LZ7TOM3.js

@@ -1,25 +0,0 @@
-// src/oauth/gitlab.ts
-var gitlab = (options) => {
-  return {
-    id: "gitlab",
-    name: "GitLab",
-    authorizeURL: "https://gitlab.com/oauth/authorize",
-    accessToken: "https://gitlab.com/oauth/token",
-    userInfo: "https://gitlab.com/api/v4/user",
-    scope: "read_user",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.username,
-        email: profile.email,
-        image: profile.avatar_url
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  gitlab
-};

package/dist/chunk-7BE46WWS.js

@@ -1,88 +0,0 @@
-import {
-  fetchAsync
-} from "./chunk-ZNCZVF6U.js";
-import {
-  OAuthAccessTokenErrorResponse,
-  OAuthAccessTokenResponse
-} from "./chunk-2A5B7GWR.js";
-import {
-  AuthInternalError,
-  OAuthProtocolError
-} from "./chunk-U5663F2U.js";
-
-// src/actions/callback/access-token.ts
-var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
-  const { accessToken, clientId, clientSecret } = oauthConfig;
-  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        has_client_secret: Boolean(clientSecret),
-        has_access_token: Boolean(accessToken),
-        has_redirect_uri: Boolean(redirectURI),
-        has_code: Boolean(code),
-        has_code_verifier: Boolean(codeVerifier)
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
-  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
-  try {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code"
-      }
-    });
-    const response = await fetchAsync(tokenURL, {
-      method: "POST",
-      headers: {
-        ...extraHeaders ?? {},
-        Accept: "application/json",
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        code,
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code",
-        code_verifier: codeVerifier
-      }).toString()
-    });
-    if (!response.ok) {
-      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
-    }
-    const json = await response.json();
-    const token = OAuthAccessTokenResponse.safeParse(json);
-    if (!token.success) {
-      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
-      if (!success) {
-        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
-      }
-      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
-    }
-    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
-    return token.data;
-  } catch (error) {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
-    if (error instanceof Error) {
-      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
-    }
-    throw error;
-  }
-};
-
-export {
-  createAccessToken
-};

package/dist/chunk-7YYXFKLR.js

@@ -1,35 +0,0 @@
-import {
-  getSession
-} from "./chunk-CITNGXDA.js";
-import {
-  expiredCookieAttributes
-} from "./chunk-XY5R3EHH.js";
-import {
-  AuthInternalError
-} from "./chunk-U5663F2U.js";
-import {
-  secureApiHeaders
-} from "./chunk-EBAMFRB7.js";
-
-// src/actions/session/session.ts
-import { createEndpoint, HeadersBuilder } from "@aura-stack/router";
-var sessionAction = createEndpoint("GET", "/session", async (ctx) => {
-  const {
-    request,
-    context: { cookies }
-  } = ctx;
-  try {
-    const session = await getSession({ ctx: ctx.context, headers: request.headers });
-    if (!session.authenticated) {
-      throw new AuthInternalError("INVALID_JWT_TOKEN", "Session not authenticated");
-    }
-    return Response.json(session, { headers: secureApiHeaders });
-  } catch (error) {
-    const headers = new HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ session: null, authenticated: false }, { status: 401, headers });
-  }
-});
-
-export {
-  sessionAction
-};

package/dist/chunk-C3A37LQC.js

@@ -1,33 +0,0 @@
-// src/oauth/atlassian.ts
-var atlassian = (options) => {
-  return {
-    id: "atlassian",
-    name: "Atlassian",
-    authorize: {
-      url: "https://auth.atlassian.com/authorize",
-      params: {
-        audience: "api.atlassian.com",
-        scope: "read:me read:account",
-        prompt: "consent"
-      }
-    },
-    authorizeURL: "https://auth.atlassian.com/authorize",
-    accessToken: "https://auth.atlassian.com/oauth/token",
-    userInfo: "https://api.atlassian.com/me",
-    scope: "read:me read:account",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.account_id,
-        name: profile.name,
-        email: profile.email,
-        image: profile.picture
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  atlassian
-};

package/dist/chunk-CITNGXDA.js

@@ -1,31 +0,0 @@
-import {
-  getErrorName,
-  toISOString
-} from "./chunk-LX3TJ2TJ.js";
-import {
-  getCookie
-} from "./chunk-XY5R3EHH.js";
-
-// src/api/getSession.ts
-var getSession = async ({ ctx, headers }) => {
-  try {
-    const session = getCookie(new Headers(headers), ctx.cookies.sessionToken.name);
-    const decoded = await ctx.jose.decodeJWT(session);
-    ctx?.logger?.log("AUTH_SESSION_VALID");
-    const { exp, iat, jti, nbf, aud, iss, ...user } = decoded;
-    return {
-      session: {
-        user,
-        expires: toISOString(exp * 1e3)
-      },
-      authenticated: true
-    };
-  } catch (error) {
-    ctx?.logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
-    return { session: null, authenticated: false };
-  }
-};
-
-export {
-  getSession
-};

package/dist/chunk-CWX724AG.js

@@ -1,78 +0,0 @@
-import {
-  callbackAction
-} from "./chunk-NHZBQNRR.js";
-import {
-  csrfTokenAction
-} from "./chunk-FPCVZUVG.js";
-import {
-  signInAction
-} from "./chunk-UN7X6SU5.js";
-import {
-  sessionAction
-} from "./chunk-7YYXFKLR.js";
-import {
-  signOutAction
-} from "./chunk-3J5TUH2I.js";
-import {
-  createAuthAPI
-} from "./chunk-LAYPUDQF.js";
-import {
-  createContext
-} from "./chunk-2IR674WX.js";
-import {
-  createErrorHandler,
-  useSecureCookies
-} from "./chunk-LX3TJ2TJ.js";
-
-// src/createAuth.ts
-import { createRouter } from "@aura-stack/router";
-var createInternalConfig = (authConfig) => {
-  const context = createContext(authConfig);
-  return {
-    basePath: authConfig?.basePath ?? "/auth",
-    onError: createErrorHandler(context.logger),
-    context,
-    use: [
-      (ctx) => {
-        const useSecure = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
-        ctx.context.cookies = useSecure ? context.cookieConfig.secure : context.cookieConfig.standard;
-        return ctx;
-      }
-    ]
-  };
-};
-var createAuthInstance = (authConfig) => {
-  const config = createInternalConfig(authConfig);
-  const router = createRouter(
-    [signInAction(config.context.oauth), callbackAction(config.context.oauth), sessionAction, signOutAction, csrfTokenAction],
-    config
-  );
-  return {
-    handlers: router,
-    jose: config.context.jose,
-    api: createAuthAPI(config.context)
-  };
-};
-var createAuth = (config) => {
-  const authInstance = createAuthInstance(config);
-  authInstance.handlers.ALL = async (request) => {
-    const method = request.method.toUpperCase();
-    const methodHandlers = {
-      GET: authInstance.handlers.GET,
-      POST: authInstance.handlers.POST
-    };
-    if (method in methodHandlers) {
-      return await methodHandlers[method](request);
-    }
-    return new Response("Method Not Allowed", {
-      status: 405,
-      headers: { Allow: Object.keys(methodHandlers).join(", ") }
-    });
-  };
-  return authInstance;
-};
-
-export {
-  createAuthInstance,
-  createAuth
-};

package/dist/chunk-D2CSIUKP.js

@@ -1,74 +0,0 @@
-import {
-  createPKCE,
-  createSecretValue
-} from "./chunk-V6LLEAR4.js";
-import {
-  OAuthAuthorization
-} from "./chunk-2A5B7GWR.js";
-import {
-  AuthInternalError
-} from "./chunk-U5663F2U.js";
-
-// src/actions/signIn/authorization-url.ts
-var setSearchParams = (url, params) => {
-  for (const [key, value] of Object.entries(params)) {
-    if (value !== void 0 && value !== "") {
-      url.searchParams.set(key, value);
-    }
-  }
-};
-var buildAuthorizationURL = (oauth, redirect_uri, state, code_challenge, code_challenge_method) => {
-  const authorizeConfig = oauth.authorize;
-  const baseURL = typeof authorizeConfig === "string" ? authorizeConfig : authorizeConfig?.url ?? oauth.authorizeURL;
-  if (!baseURL) {
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing authorization URL in OAuth provider configuration.");
-  }
-  const url = new URL(baseURL);
-  const authorizeParams = typeof authorizeConfig === "string" ? void 0 : authorizeConfig?.params;
-  setSearchParams(url, {
-    response_type: authorizeParams?.responseType ?? oauth.responseType ?? "code",
-    client_id: oauth.clientId,
-    redirect_uri,
-    state,
-    code_challenge,
-    code_challenge_method,
-    scope: authorizeParams?.scope ?? oauth.scope,
-    prompt: authorizeParams?.prompt,
-    response_mode: authorizeParams?.responseMode,
-    login_hint: authorizeParams?.loginHint,
-    nonce: authorizeParams?.nonce,
-    display: authorizeParams?.display,
-    audience: authorizeParams?.audience
-  });
-  return url.toString();
-};
-var createAuthorizationURL = async (oauth, redirectURI, ctx) => {
-  const state = createSecretValue();
-  const { codeVerifier, codeChallenge, method } = await createPKCE();
-  const authorization = buildAuthorizationURL(oauth, redirectURI, state, codeChallenge, method);
-  const parsed = OAuthAuthorization.safeParse({ ...oauth, redirectURI, state, codeChallenge, codeChallengeMethod: method });
-  if (!parsed.success) {
-    ctx?.logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        scope: oauth?.scope ?? "",
-        redirect_uri: redirectURI,
-        has_state: Boolean(state),
-        has_code_challenge: Boolean(codeChallenge),
-        code_challenge_method: method
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  return {
-    authorization,
-    state,
-    codeVerifier,
-    method
-  };
-};
-
-export {
-  setSearchParams,
-  buildAuthorizationURL,
-  createAuthorizationURL
-};

package/dist/chunk-E6G5YCI6.js

@@ -1,25 +0,0 @@
-// src/oauth/pinterest.ts
-var pinterest = (options) => {
-  return {
-    id: "pinterest",
-    name: "Pinterest",
-    authorizeURL: "https://www.pinterest.com/oauth",
-    accessToken: "https://api.pinterest.com/v5/oauth/token",
-    userInfo: "https://api.pinterest.com/v5/user_account",
-    scope: "user_accounts:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.username,
-        image: profile.profile_image,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  pinterest
-};