@aura-stack/auth 0.5.0 → 0.7.0

package/dist/chunk-EBAMFRB7.js

@@ -1,34 +0,0 @@
-// src/headers.ts
-var cacheControl = {
-  "Cache-Control": "no-store",
-  Pragma: "no-cache",
-  Expires: "0",
-  Vary: "Cookie"
-};
-var contentSecurityPolicy = {
-  "Content-Security-Policy": [
-    "default-src 'none'",
-    "script-src 'self'",
-    "frame-src 'none'",
-    "object-src 'none'",
-    "frame-ancestors 'none'",
-    "base-uri 'none'"
-  ].join("; ")
-};
-var secureHeaders = {
-  "X-Content-Type-Options": "nosniff",
-  "X-Frame-Options": "DENY",
-  "Referrer-Policy": "strict-origin-when-cross-origin"
-};
-var secureApiHeaders = {
-  ...cacheControl,
-  ...contentSecurityPolicy,
-  ...secureHeaders
-};
-
-export {
-  cacheControl,
-  contentSecurityPolicy,
-  secureHeaders,
-  secureApiHeaders
-};

package/dist/chunk-EEE7UM5T.js

@@ -1,25 +0,0 @@
-// src/oauth/x.ts
-var x = (options) => {
-  return {
-    id: "x",
-    name: "X",
-    authorizeURL: "https://twitter.com/i/oauth2/authorize",
-    accessToken: "https://api.twitter.com/2/oauth2/token",
-    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
-    scope: "tweet.read users.read offline.access",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.data.id,
-        name: profile.data.name,
-        image: profile.data.profile_image_url,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  x
-};

package/dist/chunk-FPCVZUVG.js

@@ -1,37 +0,0 @@
-import {
-  createCSRF
-} from "./chunk-V6LLEAR4.js";
-import {
-  getCookie,
-  setCookie
-} from "./chunk-XY5R3EHH.js";
-import {
-  secureApiHeaders
-} from "./chunk-EBAMFRB7.js";
-
-// src/actions/csrfToken/csrfToken.ts
-import { createEndpoint } from "@aura-stack/router";
-var getCSRFToken = (request, cookieName) => {
-  try {
-    return getCookie(request, cookieName);
-  } catch {
-    return void 0;
-  }
-};
-var csrfTokenAction = createEndpoint("GET", "/csrfToken", async (ctx) => {
-  const {
-    request,
-    context: { jose, cookies, logger }
-  } = ctx;
-  const token = getCSRFToken(request, cookies.csrfToken.name);
-  logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } });
-  const csrfToken = await createCSRF(jose, token);
-  logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } });
-  const headers = new Headers(secureApiHeaders);
-  headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes));
-  return Response.json({ csrfToken }, { headers });
-});
-
-export {
-  csrfTokenAction
-};

package/dist/chunk-FW4W3REU.js

@@ -1,25 +0,0 @@
-// src/oauth/github.ts
-var github = (options) => {
-  return {
-    id: "github",
-    name: "GitHub",
-    authorizeURL: "https://github.com/login/oauth/authorize",
-    accessToken: "https://github.com/login/oauth/access_token",
-    userInfo: "https://api.github.com/user",
-    scope: "read:user user:email",
-    responseType: "code",
-    profile: (profile) => {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.login,
-        email: profile.email ?? void 0,
-        image: profile.avatar_url
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  github
-};

package/dist/chunk-GNNBM2WJ.js

@@ -1,83 +0,0 @@
-import {
-  fetchAsync
-} from "./chunk-ZNCZVF6U.js";
-import {
-  generateSecure
-} from "./chunk-V6LLEAR4.js";
-import {
-  OAuthErrorResponse
-} from "./chunk-2A5B7GWR.js";
-import {
-  AURA_AUTH_VERSION
-} from "./chunk-LX3TJ2TJ.js";
-import {
-  OAuthProtocolError,
-  isNativeError,
-  isOAuthProtocolError
-} from "./chunk-U5663F2U.js";
-
-// src/actions/callback/userinfo.ts
-var getDefaultUserInfo = (profile) => {
-  const sub = generateSecure(16);
-  return {
-    sub: profile?.id ?? profile?.sub ?? sub,
-    email: profile?.email,
-    name: profile?.name ?? profile?.username ?? profile?.nickname,
-    image: profile?.image ?? profile?.picture
-  };
-};
-var getUserInfo = async (oauthConfig, accessToken, logger) => {
-  const userInfoConfig = oauthConfig.userInfo;
-  const userinfoURL = typeof userInfoConfig === "string" ? userInfoConfig : userInfoConfig.url;
-  const extraHeaders = typeof userInfoConfig === "string" ? void 0 : userInfoConfig.headers;
-  const method = typeof userInfoConfig === "string" ? "GET" : (userInfoConfig.method ?? "GET").toUpperCase();
-  try {
-    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
-      structuredData: {
-        endpoint: userinfoURL
-      }
-    });
-    const response = await fetchAsync(userinfoURL, {
-      method,
-      headers: {
-        "User-Agent": `Aura Auth/${AURA_AUTH_VERSION}`,
-        Accept: "application/json",
-        Authorization: `Bearer ${accessToken}`,
-        ...extraHeaders ?? {}
-      }
-    });
-    if (!response.ok) {
-      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
-      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
-    }
-    const json = await response.json();
-    const { success, data } = OAuthErrorResponse.safeParse(json);
-    if (success) {
-      logger?.log("OAUTH_USERINFO_ERROR", {
-        message: "Error response received from OAuth userinfo endpoint",
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
-    }
-    logger?.log("OAUTH_USERINFO_SUCCESS");
-    return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
-  } catch (error) {
-    if (isOAuthProtocolError(error)) {
-      throw error;
-    }
-    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
-    if (isNativeError(error)) {
-      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
-        cause: error
-      });
-    }
-    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
-  }
-};
-
-export {
-  getUserInfo
-};

package/dist/chunk-IPKO6UQN.js

@@ -1,25 +0,0 @@
-// src/oauth/spotify.ts
-var spotify = (options) => {
-  return {
-    id: "spotify",
-    name: "Spotify",
-    authorizeURL: "https://accounts.spotify.com/authorize",
-    accessToken: "https://accounts.spotify.com/api/token",
-    userInfo: "https://api.spotify.com/v1/me",
-    scope: "user-read-private user-read-email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.display_name,
-        email: profile.email,
-        image: profile.images[0]?.url ?? void 0
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  spotify
-};

package/dist/chunk-JOCGX3RP.js

@@ -1,59 +0,0 @@
-import {
-  createAuthorizationURL
-} from "./chunk-D2CSIUKP.js";
-import {
-  createRedirectTo,
-  createRedirectURI,
-  createSignInURL,
-  getBaseURL
-} from "./chunk-LATR3NIV.js";
-import {
-  AuthInternalError
-} from "./chunk-U5663F2U.js";
-import {
-  cacheControl
-} from "./chunk-EBAMFRB7.js";
-
-// src/api/signIn.ts
-import { HeadersBuilder } from "@aura-stack/router";
-var signIn = async (oauth, {
-  ctx,
-  headers: headersInit,
-  redirectTo = "/",
-  redirect,
-  request: requestInit
-}) => {
-  const headers = new Headers(headersInit);
-  const provider = ctx.oauth[oauth];
-  if (!provider) {
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", `The OAuth provider "${oauth}" is not configured.`);
-  }
-  let request = requestInit;
-  if (!request) {
-    const origin = await getBaseURL({ ctx, headers });
-    const url = `${origin}${ctx.basePath}/signIn/${oauth}`;
-    request = new Request(url, { headers });
-  }
-  if (redirect === false) {
-    const signInURL = await createSignInURL({ request, oauth, ctx, redirectTo });
-    return { redirect: false, signInURL };
-  }
-  const redirectURI = await createRedirectURI(request, oauth, ctx);
-  const redirectToValue = await createRedirectTo(request, redirectTo, ctx);
-  const { authorization, state, codeVerifier } = await createAuthorizationURL(provider, redirectURI, ctx);
-  ctx?.logger?.log("SIGN_IN_INITIATED", {
-    structuredData: { oauth_provider: oauth }
-  });
-  const headersList = new HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(ctx.cookies.state.name, state, ctx.cookies.state.attributes).setCookie(ctx.cookies.redirectURI.name, redirectURI, ctx.cookies.redirectURI.attributes).setCookie(ctx.cookies.redirectTo.name, redirectToValue, ctx.cookies.redirectTo.attributes).setCookie(ctx.cookies.codeVerifier.name, codeVerifier, ctx.cookies.codeVerifier.attributes).toHeaders();
-  return Response.json(
-    { redirect: redirect ?? true, signInURL: authorization },
-    {
-      status: redirect ?? true ? 302 : 200,
-      headers: headersList
-    }
-  );
-};
-
-export {
-  signIn
-};

package/dist/chunk-KBXWTD6E.js

@@ -1,94 +0,0 @@
-import {
-  verifyCSRF
-} from "./chunk-V6LLEAR4.js";
-import {
-  getErrorName
-} from "./chunk-LX3TJ2TJ.js";
-import {
-  expiredCookieAttributes,
-  getCookie
-} from "./chunk-XY5R3EHH.js";
-import {
-  AuthSecurityError
-} from "./chunk-U5663F2U.js";
-import {
-  secureApiHeaders
-} from "./chunk-EBAMFRB7.js";
-
-// src/api/signOut.ts
-import { HeadersBuilder } from "@aura-stack/router";
-var signOut = async ({
-  ctx,
-  headers: headersInit,
-  redirectTo = "/",
-  skipCSRFCheck = false
-}) => {
-  const headers = new Headers(headersInit);
-  const header = headers.get("X-CSRF-Token");
-  let session = null;
-  let csrfToken = null;
-  try {
-    session = getCookie(headers, ctx.cookies.sessionToken.name);
-  } catch {
-    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-  }
-  try {
-    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
-  } catch {
-    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-  }
-  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
-    structuredData: {
-      has_session: Boolean(session),
-      has_csrf_token: Boolean(csrfToken),
-      has_csrf_header: Boolean(header),
-      skip_csrf_check: skipCSRFCheck
-    }
-  });
-  if (!session) {
-    ctx?.logger?.log("SESSION_TOKEN_MISSING");
-    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-  }
-  if (!skipCSRFCheck) {
-    if (!csrfToken) {
-      ctx?.logger?.log("CSRF_TOKEN_MISSING");
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-    }
-    if (!header) {
-      ctx?.logger?.log("CSRF_HEADER_MISSING");
-      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
-    }
-    try {
-      await verifyCSRF(ctx.jose, csrfToken, header);
-    } catch (error) {
-      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
-    }
-    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
-  } else {
-    try {
-      await ctx.jose.verifyJWS(csrfToken);
-    } catch (error) {
-      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
-    }
-  }
-  try {
-    await ctx.jose.decodeJWT(session);
-    ctx?.logger?.log("SIGN_OUT_SUCCESS");
-  } catch (error) {
-    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
-  }
-  const headersList = new HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-  return Response.json(
-    { redirect: Boolean(redirectTo), url: redirectTo },
-    {
-      status: 202,
-      headers: headersList
-    }
-  );
-};
-
-export {
-  signOut
-};

package/dist/chunk-KMMAZFSJ.js

@@ -1,25 +0,0 @@
-// src/oauth/figma.ts
-var figma = (options) => {
-  return {
-    id: "figma",
-    name: "Figma",
-    authorizeURL: "https://www.figma.com/oauth",
-    accessToken: "https://api.figma.com/v1/oauth/token",
-    userInfo: "https://api.figma.com/v1/me",
-    scope: "current_user:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.handle,
-        email: profile.email,
-        image: profile.img_url
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  figma
-};

package/dist/chunk-LATR3NIV.js

@@ -1,117 +0,0 @@
-import {
-  equals,
-  extractPath,
-  isRelativeURL,
-  isSameOrigin,
-  isTrustedOrigin,
-  isValidURL,
-  patternToRegex
-} from "./chunk-LX3TJ2TJ.js";
-import {
-  getEnv
-} from "./chunk-WHNDRO3N.js";
-import {
-  AuthInternalError
-} from "./chunk-U5663F2U.js";
-
-// src/actions/signIn/authorization.ts
-var getTrustedOrigins = async (request, trustedOrigins) => {
-  if (!trustedOrigins) return [];
-  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
-  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
-};
-var getBaseURL = async ({
-  ctx,
-  request,
-  headers: headersInit
-}) => {
-  const origin = getEnv("BASE_URL") || ctx?.baseURL;
-  if (origin && origin !== "/") return origin;
-  if (ctx?.trustedProxyHeaders) {
-    const headers = headersInit && new Headers(headersInit) || request?.headers;
-    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
-    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
-    if (host) return `${protocol}://${host}`;
-    throw new AuthInternalError(
-      "INVALID_OAUTH_CONFIGURATION",
-      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
-    );
-  }
-  try {
-    return new URL(request?.url ?? "not-found").origin;
-  } catch (error) {
-    throw new AuthInternalError(
-      "INVALID_OAUTH_CONFIGURATION",
-      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
-      { cause: error }
-    );
-  }
-};
-var getOriginURL = async (request, context) => {
-  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
-  trustedOrigins.push(new URL(request.url).origin);
-  const origin = await getBaseURL({ request, ctx: context });
-  if (!isTrustedOrigin(origin, trustedOrigins)) {
-    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
-    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
-  }
-  return origin;
-};
-var createRedirectURI = async (request, oauth, context) => {
-  const origin = await getOriginURL(request, context);
-  return `${origin}${context.basePath}/callback/${oauth}`;
-};
-var createSignInURL = async ({
-  request,
-  oauth,
-  ctx,
-  redirectTo
-}) => {
-  const origin = await getOriginURL(request, ctx);
-  const searchParams = new URLSearchParams();
-  if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
-  return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
-};
-var createRedirectTo = async (request, redirectTo, context) => {
-  try {
-    const headers = request.headers;
-    const requestOrigin = await getOriginURL(request, context);
-    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
-    const validateURL = (url) => {
-      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
-      if (isRelativeURL(url)) return url;
-      if (origins.length > 0) {
-        if (isTrustedOrigin(url, origins)) {
-          const urlOrigin = new URL(url).origin;
-          for (const pattern of origins) {
-            const regex = patternToRegex(pattern);
-            if (regex?.test(urlOrigin)) {
-              return isSameOrigin(url, request.url) ? extractPath(url) : url;
-            }
-            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
-          }
-        }
-        context?.logger?.log("OPEN_REDIRECT_ATTACK");
-        return "/";
-      }
-      if (isSameOrigin(url, requestOrigin)) {
-        return extractPath(url);
-      }
-      context?.logger?.log("OPEN_REDIRECT_ATTACK");
-      return "/";
-    };
-    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
-  } catch (error) {
-    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
-    return "/";
-  }
-};
-
-export {
-  getTrustedOrigins,
-  getBaseURL,
-  getOriginURL,
-  createRedirectURI,
-  createSignInURL,
-  createRedirectTo
-};

package/dist/chunk-LAYPUDQF.js

@@ -1,39 +0,0 @@
-import {
-  getSession
-} from "./chunk-CITNGXDA.js";
-import {
-  signIn
-} from "./chunk-JOCGX3RP.js";
-import {
-  signOut
-} from "./chunk-KBXWTD6E.js";
-import {
-  validateRedirectTo
-} from "./chunk-LX3TJ2TJ.js";
-
-// src/api/createApi.ts
-var createAuthAPI = (ctx) => {
-  return {
-    getSession: async (options) => {
-      const session = await getSession({ ctx, headers: options.headers });
-      return session;
-    },
-    signIn: async (oauth, options) => {
-      return signIn(oauth, {
-        ctx,
-        headers: options?.headers,
-        request: options?.request,
-        redirect: options?.redirect,
-        redirectTo: options?.redirectTo
-      });
-    },
-    signOut: async (options) => {
-      const redirectTo = validateRedirectTo(options?.redirectTo ?? "/");
-      return signOut({ ctx, headers: options.headers, redirectTo, skipCSRFCheck: true });
-    }
-  };
-};
-
-export {
-  createAuthAPI
-};

package/dist/chunk-LDU7A2JE.js

@@ -1,25 +0,0 @@
-// src/oauth/mailchimp.ts
-var mailchimp = (options) => {
-  return {
-    id: "mailchimp",
-    name: "Mailchimp",
-    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
-    accessToken: "https://login.mailchimp.com/oauth2/token",
-    userInfo: "https://login.mailchimp.com/oauth2/metadata",
-    scope: "",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.user_id,
-        name: profile.accountname,
-        email: profile.login.email,
-        image: profile.login.avatar
-      };
-    },
-    ...options
-  };
-};
-
-export {
-  mailchimp
-};