@aura-stack/auth 0.5.0 → 0.6.0

package/dist/chunk-LX3TJ2TJ.js

@@ -1,294 +0,0 @@
-import {
-  getEnv
-} from "./chunk-WHNDRO3N.js";
-import {
-  AuthInternalError,
-  isAuthInternalError,
-  isAuthSecurityError,
-  isOAuthProtocolError
-} from "./chunk-U5663F2U.js";
-
-// src/utils.ts
-import { isInvalidZodSchemaError, isRouterError } from "@aura-stack/router";
-
-// src/assert.ts
-import { encoder } from "@aura-stack/jose/crypto";
-var isFalsy = (value) => {
-  return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
-};
-var isRequest = (value) => {
-  return typeof Request !== "undefined" && value instanceof Request;
-};
-var unsafeChars = [
-  "<",
-  ">",
-  '"',
-  "`",
-  " ",
-  "\r",
-  "\n",
-  "	",
-  "\\",
-  "%2F",
-  "%5C",
-  "%2f",
-  "%5c",
-  "\r\n",
-  "%0A",
-  "%0D",
-  "%0a",
-  "%0d",
-  "..",
-  "//",
-  "///",
-  "...",
-  "%20",
-  "\0"
-];
-var isValidURL = (value) => {
-  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
-    return false;
-  }
-  const match = value.match(/^(https?:\/\/)(.*)$/);
-  if (!match) return false;
-  const rest = match[2];
-  for (const char of unsafeChars) {
-    if (rest.includes(char)) return false;
-  }
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
-  return regex.test(match[0]);
-};
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-var isRelativeURL = (value) => {
-  if (value.length > 100) return false;
-  for (const char of unsafeChars) {
-    if (value.includes(char)) return false;
-  }
-  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
-  return regex.test(value);
-};
-var isSameOrigin = (origin, expected) => {
-  const originURL = new URL(origin);
-  const expectedURL = new URL(expected);
-  return equals(originURL.origin, expectedURL.origin);
-};
-var patternToRegex = (pattern) => {
-  try {
-    if (pattern.length > 2048) return null;
-    pattern = pattern.replace(/\\/g, "");
-    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
-    if (!match) return null;
-    const [, protocol, host, port] = match;
-    const hasWildcard = host.includes("*");
-    if (hasWildcard && !host.startsWith("*.")) return null;
-    if (hasWildcard && host.slice(2).includes("*")) return null;
-    const domain = hasWildcard ? host.slice(2) : host;
-    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
-    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
-    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
-  } catch {
-    return null;
-  }
-};
-var isTrustedOrigin = (url, trustedOrigins) => {
-  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
-  try {
-    const urlOrigin = new URL(url).origin;
-    for (const pattern of trustedOrigins) {
-      const regex = patternToRegex(pattern);
-      if (regex?.test(urlOrigin)) return true;
-      try {
-        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return false;
-};
-var timingSafeEqual = (a, b) => {
-  const bufferA = encoder.encode(a);
-  const bufferB = encoder.encode(b);
-  const len = Math.max(bufferA.length, bufferB.length);
-  let diff = 0;
-  for (let i = 0; i < len; i++) {
-    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
-  }
-  return diff === 0 && bufferA.length === bufferB.length;
-};
-
-// src/utils.ts
-var AURA_AUTH_VERSION = "0.4.0";
-var toSnakeCase = (str) => {
-  return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
-};
-var toUpperCase = (str) => {
-  return str.toUpperCase();
-};
-var toCastCase = (obj, type = "snake") => {
-  return Object.entries(obj).reduce((previous, [key, value]) => {
-    const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
-    return { ...previous, [newKey]: value };
-  }, {});
-};
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var createErrorHandler = (logger) => {
-  return (error) => {
-    if (isRouterError(error)) {
-      const { message, status, statusText } = error;
-      logger?.log("ROUTER_INTERNAL_ERROR");
-      return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
-    }
-    if (isInvalidZodSchemaError(error)) {
-      logger?.log("INVALID_REQUEST");
-      return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
-    }
-    if (isOAuthProtocolError(error)) {
-      const { error: errorCode, message, type, errorURI } = error;
-      logger?.log("OAUTH_PROTOCOL_ERROR", {
-        structuredData: {
-          error: errorCode,
-          error_description: message,
-          error_uri: errorURI ?? ""
-        }
-      });
-      return Response.json(
-        {
-          type,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    if (isAuthInternalError(error)) {
-      const { type, code, message } = error;
-      logger?.log("INVALID_OAUTH_CONFIGURATION", {
-        structuredData: {
-          error: code,
-          error_description: message
-        }
-      });
-      return Response.json(
-        {
-          type,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    if (isAuthSecurityError(error)) {
-      const { type, code, message } = error;
-      logger?.log("INVALID_OAUTH_CONFIGURATION", {
-        structuredData: {
-          error: code,
-          error_description: message
-        }
-      });
-      return Response.json(
-        {
-          type,
-          code,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    logger?.log("SERVER_ERROR");
-    return Response.json(
-      { type: "SERVER_ERROR", code: "SERVER_ERROR", message: "An unexpected error occurred" },
-      { status: 500 }
-    );
-  };
-};
-var getBaseURL = (request) => {
-  const url = new URL(request.url);
-  return `${url.origin}${url.pathname}`;
-};
-var toISOString = (date) => {
-  return new Date(date).toISOString();
-};
-var useSecureCookies = (request, trustedProxyHeaders) => {
-  const headers = request instanceof Headers ? request : request.headers;
-  const url = request instanceof Headers ? null : request.url;
-  return trustedProxyHeaders ? url?.startsWith("https://") || headers.get("X-Forwarded-Proto") === "https" || (headers.get("Forwarded")?.includes("proto=https") ?? false) : url?.startsWith("https://") ?? false;
-};
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
-  }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
-      }
-    };
-  }, {});
-};
-var extractPath = (url) => {
-  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
-  const match = url.match(pathRegex);
-  return match && match[2] ? match[2] : "/";
-};
-var createStructuredData = (data, sdID = "metadata") => {
-  const entries = Object.entries(data);
-  if (entries.length === 0) return `[${sdID}]`;
-  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
-  return `[${sdID} ${values}]`;
-};
-var getErrorName = (error) => {
-  if (error instanceof Error) {
-    return error.name;
-  }
-  return typeof error === "string" ? error : "UnknownError";
-};
-var createBasicAuthHeader = (username, password) => {
-  const getUsername = getEnv(username.toUpperCase()) ?? username;
-  const getPassword = getEnv(password.toUpperCase()) ?? password;
-  if (!getUsername || !getPassword) {
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
-  }
-  const credentials = `${getUsername}:${getPassword}`;
-  return `Basic ${btoa(credentials)}`;
-};
-var validateRedirectTo = (url) => {
-  if (!isRelativeURL(url) && !isValidURL(url)) return "/";
-  if (isRelativeURL(url)) return url;
-  return "/";
-};
-
-export {
-  AURA_AUTH_VERSION,
-  toSnakeCase,
-  toUpperCase,
-  toCastCase,
-  equals,
-  createErrorHandler,
-  getBaseURL,
-  toISOString,
-  useSecureCookies,
-  formatZodError,
-  extractPath,
-  createStructuredData,
-  getErrorName,
-  createBasicAuthHeader,
-  validateRedirectTo,
-  isFalsy,
-  isRequest,
-  unsafeChars,
-  isValidURL,
-  isJWTPayloadWithToken,
-  isRelativeURL,
-  isSameOrigin,
-  patternToRegex,
-  isTrustedOrigin,
-  timingSafeEqual
-};

package/dist/chunk-NHZBQNRR.js

@@ -1,143 +0,0 @@
-import {
-  getUserInfo
-} from "./chunk-GNNBM2WJ.js";
-import {
-  createAccessToken
-} from "./chunk-7BE46WWS.js";
-import {
-  getOriginURL,
-  getTrustedOrigins
-} from "./chunk-LATR3NIV.js";
-import {
-  createCSRF
-} from "./chunk-V6LLEAR4.js";
-import {
-  OAuthAuthorizationErrorResponse
-} from "./chunk-2A5B7GWR.js";
-import {
-  isRelativeURL,
-  isSameOrigin,
-  isTrustedOrigin,
-  timingSafeEqual
-} from "./chunk-LX3TJ2TJ.js";
-import {
-  createSessionCookie,
-  expiredCookieAttributes,
-  getCookie
-} from "./chunk-XY5R3EHH.js";
-import {
-  AuthSecurityError,
-  OAuthProtocolError
-} from "./chunk-U5663F2U.js";
-import {
-  cacheControl
-} from "./chunk-EBAMFRB7.js";
-
-// src/actions/callback/callback.ts
-import { z } from "zod/v4";
-import { createEndpoint, createEndpointConfig, HeadersBuilder } from "@aura-stack/router";
-var callbackConfig = (oauth) => {
-  return createEndpointConfig("/callback/:oauth", {
-    schemas: {
-      params: z.object({
-        oauth: z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: z.object({
-        code: z.string("Missing code parameter in the OAuth authorization response."),
-        state: z.string("Missing state parameter in the OAuth authorization response.")
-      })
-    },
-    use: [
-      (ctx) => {
-        const {
-          searchParams,
-          context: { logger }
-        } = ctx;
-        const response = OAuthAuthorizationErrorResponse.safeParse(searchParams);
-        if (response.success) {
-          const { error, error_description } = response.data;
-          const criticalAuthErrors = ["access_denied", "server_error"];
-          const severity = criticalAuthErrors.includes(error.toLowerCase()) ? "critical" : "warning";
-          logger?.log("OAUTH_AUTHORIZATION_ERROR", {
-            severity,
-            structuredData: {
-              error,
-              error_description: error_description ?? ""
-            }
-          });
-          throw new OAuthProtocolError(error, error_description || "OAuth Authorization Error");
-        }
-        return ctx;
-      }
-    ]
-  });
-};
-var callbackAction = (oauth) => {
-  return createEndpoint(
-    "GET",
-    "/callback/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { code, state },
-        context
-      } = ctx;
-      const { oauth: providers, cookies, jose, logger, trustedOrigins } = context;
-      const oauthConfig = providers[oauth2];
-      const cookieState = getCookie(request, cookies.state.name);
-      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
-      const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
-      const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
-      if (!timingSafeEqual(cookieState, state)) {
-        logger?.log("MISMATCHING_STATE", {
-          structuredData: {
-            oauth_provider: oauth2
-          }
-        });
-        throw new AuthSecurityError(
-          "MISMATCHING_STATE",
-          "The provided state passed in the OAuth response does not match the stored state."
-        );
-      }
-      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier, logger);
-      const origins = await getTrustedOrigins(request, trustedOrigins);
-      const requestOrigin = await getOriginURL(request, context);
-      if (!isRelativeURL(cookieRedirectTo)) {
-        const isValid = origins.length > 0 ? isTrustedOrigin(cookieRedirectTo, origins) : isSameOrigin(cookieRedirectTo, requestOrigin);
-        if (!isValid) {
-          logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", {
-            structuredData: {
-              redirect_path: cookieRedirectTo,
-              provider: oauth2,
-              has_trusted_origins: origins.length > 0,
-              request_origin: requestOrigin
-            }
-          });
-          throw new AuthSecurityError(
-            "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-            "Invalid redirect path. Potential open redirect attack detected."
-          );
-        }
-      }
-      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token, logger);
-      const sessionCookie = await createSessionCookie(jose, userInfo);
-      const csrfToken = await createCSRF(jose);
-      logger?.log("OAUTH_CALLBACK_SUCCESS", {
-        structuredData: {
-          provider: oauth2
-        }
-      });
-      const headers = new HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
-      return Response.json({ oauth: oauth2 }, { status: 302, headers });
-    },
-    callbackConfig(oauth)
-  );
-};
-
-export {
-  callbackAction
-};

package/dist/chunk-OVHNRULD.js

@@ -1,33 +0,0 @@
-// src/oauth/discord.ts
-var discord = (options) => {
-  return {
-    id: "discord",
-    name: "Discord",
-    authorizeURL: "https://discord.com/oauth2/authorize",
-    accessToken: "https://discord.com/api/oauth2/token",
-    userInfo: "https://discord.com/api/users/@me",
-    scope: "identify email",
-    responseType: "code",
-    profile(profile) {
-      let image = "";
-      if (profile.avatar === null) {
-        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-      } else {
-        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-      }
-      return {
-        sub: profile.id,
-        name: profile.global_name ?? profile.username,
-        email: profile.email ?? "",
-        image
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  discord
-};

package/dist/chunk-PDP3PHB3.js

@@ -1,127 +0,0 @@
-import {
-  mailchimp
-} from "./chunk-LDU7A2JE.js";
-import {
-  notion
-} from "./chunk-PHYNROD4.js";
-import {
-  pinterest
-} from "./chunk-E6G5YCI6.js";
-import {
-  spotify
-} from "./chunk-IPKO6UQN.js";
-import {
-  strava
-} from "./chunk-54CZPKR4.js";
-import {
-  twitch
-} from "./chunk-2GQLSIJ2.js";
-import {
-  x
-} from "./chunk-EEE7UM5T.js";
-import {
-  atlassian
-} from "./chunk-C3A37LQC.js";
-import {
-  bitbucket
-} from "./chunk-4YHJ4IEQ.js";
-import {
-  discord
-} from "./chunk-OVHNRULD.js";
-import {
-  dropbox
-} from "./chunk-QQEKY4XP.js";
-import {
-  figma
-} from "./chunk-KMMAZFSJ.js";
-import {
-  github
-} from "./chunk-FW4W3REU.js";
-import {
-  gitlab
-} from "./chunk-5LZ7TOM3.js";
-import {
-  OAuthEnvSchema,
-  OAuthProviderCredentialsSchema
-} from "./chunk-2A5B7GWR.js";
-import {
-  formatZodError
-} from "./chunk-LX3TJ2TJ.js";
-import {
-  getEnv
-} from "./chunk-WHNDRO3N.js";
-import {
-  AuthInternalError
-} from "./chunk-U5663F2U.js";
-
-// src/oauth/index.ts
-var builtInOAuthProviders = {
-  github,
-  bitbucket,
-  figma,
-  discord,
-  gitlab,
-  spotify,
-  x,
-  strava,
-  mailchimp,
-  pinterest,
-  twitch,
-  notion,
-  dropbox,
-  atlassian
-};
-var defineOAuthEnvironment = (oauth) => {
-  const loadEnvs = OAuthEnvSchema.safeParse({
-    clientId: getEnv(`${oauth.toUpperCase()}_CLIENT_ID`),
-    clientSecret: getEnv(`${oauth.toUpperCase()}_CLIENT_SECRET`)
-  });
-  if (!loadEnvs.success) {
-    const msg = JSON.stringify({ [oauth]: formatZodError(loadEnvs.error) }, null, 2);
-    throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
-  }
-  return loadEnvs.data;
-};
-var defineOAuthProviderConfig = (config) => {
-  if (typeof config === "string") {
-    const definition = defineOAuthEnvironment(config);
-    const oauthConfig = builtInOAuthProviders[config]();
-    const parsed2 = OAuthProviderCredentialsSchema.safeParse({ ...oauthConfig, ...definition });
-    if (!parsed2.success) {
-      const details = JSON.stringify({ [config]: formatZodError(parsed2.error) }, null, 2);
-      throw new AuthInternalError(
-        "INVALID_OAUTH_PROVIDER_CONFIGURATION",
-        `Invalid configuration for OAuth provider "${config}": ${details}`
-      );
-    }
-    return parsed2.data;
-  }
-  const hasCredentials = config.clientId && config.clientSecret;
-  const envConfig = hasCredentials ? {} : defineOAuthEnvironment(config.id);
-  const parsed = OAuthProviderCredentialsSchema.safeParse({ ...envConfig, ...config });
-  if (!parsed.success) {
-    const details = JSON.stringify({ [config.id]: formatZodError(parsed.error) }, null, 2);
-    throw new AuthInternalError(
-      "INVALID_OAUTH_PROVIDER_CONFIGURATION",
-      `Invalid configuration for OAuth provider "${config.id}": ${details}`
-    );
-  }
-  return parsed.data;
-};
-var createBuiltInOAuthProviders = (oauth = []) => {
-  return oauth.reduce((previous, config) => {
-    const oauthConfig = defineOAuthProviderConfig(config);
-    if (oauthConfig.id in previous) {
-      throw new AuthInternalError(
-        "DUPLICATED_OAUTH_PROVIDER_ID",
-        `Duplicate OAuth provider id "${oauthConfig.id}" found. Each provider must have a unique id.`
-      );
-    }
-    return { ...previous, [oauthConfig.id]: oauthConfig };
-  }, {});
-};
-
-export {
-  builtInOAuthProviders,
-  createBuiltInOAuthProviders
-};

package/dist/chunk-PHYNROD4.js

@@ -1,47 +0,0 @@
-import {
-  createBasicAuthHeader
-} from "./chunk-LX3TJ2TJ.js";
-
-// src/oauth/notion.ts
-var notion = (options) => {
-  return {
-    id: "notion",
-    name: "Notion",
-    authorize: {
-      url: "https://api.notion.com/v1/oauth/authorize",
-      params: {
-        owner: "user",
-        scope: "user:read",
-        responseType: "code"
-      }
-    },
-    accessToken: {
-      url: "https://api.notion.com/v1/oauth/token",
-      headers: {
-        Authorization: createBasicAuthHeader(
-          options?.clientId ?? "NOTION_CLIENT_ID",
-          options?.clientSecret ?? "NOTION_CLIENT_SECRET"
-        )
-      }
-    },
-    userInfo: {
-      url: "https://api.notion.com/v1/users/me",
-      headers: {
-        "Notion-Version": "2022-06-28"
-      }
-    },
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.name,
-        image: profile.avatar_url ?? "",
-        email: profile?.bot?.owner?.user?.person?.email
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  notion
-};

package/dist/chunk-QQEKY4XP.js

@@ -1,29 +0,0 @@
-// src/oauth/dropbox.ts
-var dropbox = (options) => {
-  return {
-    id: "dropbox",
-    name: "Dropbox",
-    authorize: {
-      url: "https://www.dropbox.com/oauth2/authorize",
-      params: { scope: "account_info.read" }
-    },
-    accessToken: "https://api.dropboxapi.com/oauth2/token",
-    userInfo: {
-      method: "POST",
-      url: "https://api.dropboxapi.com/2/users/get_current_account"
-    },
-    profile(profile) {
-      return {
-        sub: profile.account_id,
-        name: profile.name.display_name,
-        email: profile.email,
-        image: profile.profile_photo_url
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  dropbox
-};