@auth/solid-start 0.1.0

package/LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2022-2023, Balázs Orbán
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.MD

@@ -0,0 +1,80 @@
+# Getting started
+
+Recommended to use [create-jd-app](https://github.com/OrJDev/create-jd-app)
+
+```bash
+npm install @auth/solid-start@latest @auth/core@latest
+```
+
+## Setting It Up
+
+[Generate auth secret](https://generate-secret.vercel.app/32), then set it as an environment variable:
+
+```
+AUTH_SECRET=your_auth_secret
+```
+
+### On Production
+
+Don't forget to trust the host.
+
+```
+AUTH_TRUST_HOST=true
+```
+
+## Creating the api handler
+
+in this example we are using github so make sure to set the following environment variables:
+
+```
+GITHUB_ID=your_github_oatuh_id
+GITHUB_SECRET=your_github_oatuh_secret
+```
+
+```ts
+// routes/api/auth/[...solidauth].ts
+import { SolidAuth, type SolidAuthConfig } from "@auth/solid-start"
+import GitHub from "@auth/core/providers/github"
+
+export const authOpts: SolidAuthConfig = {
+  providers: [
+    GitHub({
+      clientId: process.env.GITHUB_ID,
+      clientSecret: process.env.GITHUB_SECRET,
+    }),
+  ],
+  debug: false,
+}
+
+export const { GET, POST } = SolidAuth(authOpts)
+```
+
+## Signing in and out
+
+```ts
+import { signIn, signOut } from "@auth/solid-start/client"
+const login = () => signIn("github")
+const logout = () => signOut()
+```
+
+## Getting the current session
+
+```ts
+import { getSession } from "@auth/solid-start"
+import { createServerData$ } from "solid-start/server"
+import { authOpts } from "~/routes/api/auth/[...solidauth]"
+
+export const useSession = () => {
+  return createServerData$(
+    async (_, { request }) => {
+      return await getSession(request, authOpts)
+    },
+    { key: () => ["auth_user"] }
+  )
+}
+
+// useSession returns a resource:
+const session = useSession()
+const loading = session.loading
+const user = () => session()?.user
+```

package/client.d.ts

@@ -0,0 +1,20 @@
+import { LiteralUnion, SignInOptions, SignInAuthorizationParams, SignOutParams } from 'next-auth/react';
+import { RedirectableProviderType, BuiltInProviderType } from '@auth/core/providers';
+
+/**
+ * Client-side method to initiate a signin flow
+ * or send the user to the signin page listing all possible providers.
+ * Automatically adds the CSRF token to the request.
+ *
+ * [Documentation](https://next-auth.js.org/getting-started/client#signin)
+ */
+declare function signIn<P extends RedirectableProviderType | undefined = undefined>(providerId?: LiteralUnion<P extends RedirectableProviderType ? P | BuiltInProviderType : BuiltInProviderType>, options?: SignInOptions, authorizationParams?: SignInAuthorizationParams): Promise<Response | undefined>;
+/**
+ * Signs the user out, by removing the session cookie.
+ * Automatically adds the CSRF token to the request.
+ *
+ * [Documentation](https://next-auth.js.org/getting-started/client#signout)
+ */
+declare function signOut(options?: SignOutParams): Promise<void>;
+
+export { signIn, signOut };

package/client.js

@@ -0,0 +1,56 @@
+async function signIn(providerId, options, authorizationParams) {
+  const { callbackUrl = window.location.href, redirect = true } = options ?? {};
+  const isCredentials = providerId === "credentials";
+  const isEmail = providerId === "email";
+  const isSupportingReturn = isCredentials || isEmail;
+  const signInUrl = `/api/auth/${isCredentials ? "callback" : "signin"}/${providerId}`;
+  const _signInUrl = `${signInUrl}?${new URLSearchParams(authorizationParams)}`;
+  const csrfTokenResponse = await fetch("/api/auth/csrf");
+  const { csrfToken } = await csrfTokenResponse.json();
+  const res = await fetch(_signInUrl, {
+    method: "post",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "X-Auth-Return-Redirect": "1"
+    },
+    body: new URLSearchParams({
+      ...options,
+      csrfToken,
+      callbackUrl
+    })
+  });
+  const data = await res.clone().json();
+  const error = new URL(data.url).searchParams.get("error");
+  if (redirect || !isSupportingReturn || !error) {
+    window.location.href = data.url ?? data.redirect ?? callbackUrl;
+    if (data.url.includes("#"))
+      window.location.reload();
+    return;
+  }
+  return res;
+}
+async function signOut(options) {
+  const { callbackUrl = window.location.href } = options ?? {};
+  const csrfTokenResponse = await fetch("/api/auth/csrf");
+  const { csrfToken } = await csrfTokenResponse.json();
+  const res = await fetch(`/api/auth/signout`, {
+    method: "post",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "X-Auth-Return-Redirect": "1"
+    },
+    body: new URLSearchParams({
+      csrfToken,
+      callbackUrl
+    })
+  });
+  const data = await res.json();
+  const url = data.url ?? data.redirect ?? callbackUrl;
+  window.location.href = url;
+  if (url.includes("#"))
+    window.location.reload();
+}
+export {
+  signIn,
+  signOut
+};

package/index.d.ts

@@ -0,0 +1,17 @@
+import { AuthConfig, Session } from '@auth/core/types';
+
+interface SolidAuthConfig extends AuthConfig {
+    /**
+     * Defines the base path for the auth routes.
+     * @default '/api/auth'
+     */
+    prefix?: string;
+}
+declare function SolidAuth(config: SolidAuthConfig): {
+    GET(event: any): Promise<Response | undefined>;
+    POST(event: any): Promise<Response | undefined>;
+};
+type GetSessionResult = Promise<Session | null>;
+declare function getSession(req: Request, options: AuthConfig): GetSessionResult;
+
+export { GetSessionResult, SolidAuth, SolidAuthConfig, getSession };

package/index.js

@@ -0,0 +1,87 @@
+import { Auth } from "@auth/core";
+import { parseString, splitCookiesString } from "set-cookie-parser";
+import { serialize } from "cookie";
+const actions = [
+  "providers",
+  "session",
+  "csrf",
+  "signin",
+  "signout",
+  "callback",
+  "verify-request",
+  "error"
+];
+const getSetCookieCallback = (cook) => {
+  if (!cook)
+    return;
+  const splitCookie = splitCookiesString(cook);
+  for (const cookName of [
+    "__Secure-next-auth.session-token",
+    "next-auth.session-token",
+    "next-auth.pkce.code_verifier",
+    "__Secure-next-auth.pkce.code_verifier"
+  ]) {
+    const temp = splitCookie.find((e) => e.startsWith(`${cookName}=`));
+    if (temp) {
+      return parseString(temp);
+    }
+  }
+  return parseString(splitCookie?.[0] ?? "");
+};
+function SolidAuthHandler(prefix, authOptions) {
+  return async (event) => {
+    const { request } = event;
+    const url = new URL(request.url);
+    const action = url.pathname.slice(prefix.length + 1).split("/")[0];
+    if (!actions.includes(action) || !url.pathname.startsWith(prefix + "/")) {
+      return;
+    }
+    const res = await Auth(request, authOptions);
+    if (["callback", "signin", "signout"].includes(action)) {
+      const parsedCookie = getSetCookieCallback(
+        res.clone().headers.get("Set-Cookie")
+      );
+      if (parsedCookie) {
+        res.headers.set(
+          "Set-Cookie",
+          serialize(parsedCookie.name, parsedCookie.value, parsedCookie)
+        );
+      }
+    }
+    return res;
+  };
+}
+function SolidAuth(config) {
+  const { prefix = "/api/auth", ...authOptions } = config;
+  authOptions.secret ??= process.env.AUTH_SECRET;
+  authOptions.trustHost ??= !!(process.env.AUTH_TRUST_HOST ?? process.env.VERCEL ?? process.env.NODE_ENV !== "production");
+  const handler = SolidAuthHandler(prefix, authOptions);
+  return {
+    async GET(event) {
+      return await handler(event);
+    },
+    async POST(event) {
+      return await handler(event);
+    }
+  };
+}
+async function getSession(req, options) {
+  options.secret ??= process.env.AUTH_SECRET;
+  options.trustHost ??= true;
+  const url = new URL("/api/auth/session", req.url);
+  const response = await Auth(
+    new Request(url, { headers: req.headers }),
+    options
+  );
+  const { status = 200 } = response;
+  const data = await response.json();
+  if (!data || !Object.keys(data).length)
+    return null;
+  if (status === 200)
+    return data;
+  throw new Error(data.message);
+}
+export {
+  SolidAuth,
+  getSession
+};

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@auth/solid-start",
+  "description": "Authentication for SolidStart.",
+  "version": "0.1.0",
+  "type": "module",
+  "files": [
+    "client.*",
+    "index.*",
+    "src"
+  ],
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.js"
+    },
+    "./client": {
+      "types": "./client.d.ts",
+      "import": "./client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@solidjs/meta": "^0.28.0",
+    "@types/cookie": "0.5.1",
+    "@types/node": "^18.7.14",
+    "@types/set-cookie-parser": "^2.4.2",
+    "solid-js": "^1.5.7",
+    "solid-start": "^0.2.1",
+    "tsup": "^6.5.0",
+    "typescript": "^4.8.2",
+    "@auth/core": "0.2.3",
+    "next-auth": "4.18.6"
+  },
+  "peerDependencies": {
+    "@auth/core": "~0.2.2 || ^0.2.2",
+    "solid-js": "^1.5.7",
+    "solid-start": "^0.2.1"
+  },
+  "dependencies": {
+    "set-cookie-parser": "^2.5.1"
+  },
+  "keywords": [
+    "SolidJS",
+    "SolidStart",
+    "Auth"
+  ],
+  "author": "OrJDev <orjdeveloper@gmail.com>",
+  "repository": "https://github.com/nextauthjs/next-auth",
+  "license": "ISC",
+  "scripts": {
+    "build": "tsup --config ./tsup.config.js && node scripts/postbuild",
+    "patch": "npm version patch --no-git-tag-version",
+    "clean": "rm -rf client.* index.*"
+  }
+}

package/src/client.ts

@@ -0,0 +1,102 @@
+import type {
+  LiteralUnion,
+  SignInOptions,
+  SignInAuthorizationParams,
+  SignOutParams,
+} from "next-auth/react"
+import type {
+  BuiltInProviderType,
+  RedirectableProviderType,
+} from "@auth/core/providers"
+
+/**
+ * Client-side method to initiate a signin flow
+ * or send the user to the signin page listing all possible providers.
+ * Automatically adds the CSRF token to the request.
+ *
+ * [Documentation](https://next-auth.js.org/getting-started/client#signin)
+ */
+export async function signIn<
+  P extends RedirectableProviderType | undefined = undefined
+>(
+  providerId?: LiteralUnion<
+    P extends RedirectableProviderType
+      ? P | BuiltInProviderType
+      : BuiltInProviderType
+  >,
+  options?: SignInOptions,
+  authorizationParams?: SignInAuthorizationParams
+) {
+  const { callbackUrl = window.location.href, redirect = true } = options ?? {}
+
+  // TODO: Support custom providers
+  const isCredentials = providerId === "credentials"
+  const isEmail = providerId === "email"
+  const isSupportingReturn = isCredentials || isEmail
+
+  // TODO: Handle custom base path
+  const signInUrl = `/api/auth/${
+    isCredentials ? "callback" : "signin"
+  }/${providerId}`
+
+  const _signInUrl = `${signInUrl}?${new URLSearchParams(authorizationParams)}`
+
+  // TODO: Handle custom base path
+  const csrfTokenResponse = await fetch("/api/auth/csrf")
+  const { csrfToken } = await csrfTokenResponse.json()
+
+  const res = await fetch(_signInUrl, {
+    method: "post",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "X-Auth-Return-Redirect": "1",
+    },
+    // @ts-expect-error -- ignore
+    body: new URLSearchParams({
+      ...options,
+      csrfToken,
+      callbackUrl,
+    }),
+  })
+
+  const data = await res.clone().json()
+  const error = new URL(data.url).searchParams.get("error")
+  if (redirect || !isSupportingReturn || !error) {
+    // TODO: Do not redirect for Credentials and Email providers by default in next major
+    window.location.href = data.url ?? data.redirect ?? callbackUrl
+    // If url contains a hash, the browser does not reload the page. We reload manually
+    if (data.url.includes("#")) window.location.reload()
+    return
+  }
+  return res
+}
+
+/**
+ * Signs the user out, by removing the session cookie.
+ * Automatically adds the CSRF token to the request.
+ *
+ * [Documentation](https://next-auth.js.org/getting-started/client#signout)
+ */
+export async function signOut(options?: SignOutParams) {
+  const { callbackUrl = window.location.href } = options ?? {}
+  // TODO: Custom base path
+  const csrfTokenResponse = await fetch("/api/auth/csrf")
+  const { csrfToken } = await csrfTokenResponse.json()
+  const res = await fetch(`/api/auth/signout`, {
+    method: "post",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "X-Auth-Return-Redirect": "1",
+    },
+    body: new URLSearchParams({
+      csrfToken,
+      callbackUrl,
+    }),
+  })
+  const data = await res.json()
+
+  const url = data.url ?? data.redirect ?? callbackUrl
+  window.location.href = url
+  // If url contains a hash, the browser does not reload the page. We reload manually
+  if (url.includes("#")) window.location.reload()
+}

package/src/index.ts

@@ -0,0 +1,114 @@
+import { Auth } from "@auth/core"
+import { Cookie, parseString, splitCookiesString } from "set-cookie-parser"
+import { serialize } from "cookie"
+import type { AuthAction, AuthConfig, Session } from "@auth/core/types"
+
+export interface SolidAuthConfig extends AuthConfig {
+  /**
+   * Defines the base path for the auth routes.
+   * @default '/api/auth'
+   */
+  prefix?: string
+}
+
+const actions: AuthAction[] = [
+  "providers",
+  "session",
+  "csrf",
+  "signin",
+  "signout",
+  "callback",
+  "verify-request",
+  "error",
+]
+
+// currently multiple cookies are not supported, so we keep the next-auth.pkce.code_verifier cookie for now:
+// because it gets updated anyways
+// src: https://github.com/solidjs/solid-start/issues/293
+const getSetCookieCallback = (cook?: string | null): Cookie | undefined => {
+  if (!cook) return
+  const splitCookie = splitCookiesString(cook)
+  for (const cookName of [
+    "__Secure-next-auth.session-token",
+    "next-auth.session-token",
+    "next-auth.pkce.code_verifier",
+    "__Secure-next-auth.pkce.code_verifier",
+  ]) {
+    const temp = splitCookie.find((e) => e.startsWith(`${cookName}=`))
+    if (temp) {
+      return parseString(temp)
+    }
+  }
+  return parseString(splitCookie?.[0] ?? "") // just return the first cookie if no session token is found
+}
+
+function SolidAuthHandler(prefix: string, authOptions: SolidAuthConfig) {
+  return async (event: any) => {
+    const { request } = event
+    const url = new URL(request.url)
+    const action = url.pathname
+      .slice(prefix.length + 1)
+      .split("/")[0] as AuthAction
+
+    if (!actions.includes(action) || !url.pathname.startsWith(prefix + "/")) {
+      return
+    }
+
+    const res = await Auth(request, authOptions)
+    if (["callback", "signin", "signout"].includes(action)) {
+      const parsedCookie = getSetCookieCallback(
+        res.clone().headers.get("Set-Cookie")
+      )
+      if (parsedCookie) {
+        res.headers.set(
+          "Set-Cookie",
+          serialize(parsedCookie.name, parsedCookie.value, parsedCookie as any)
+        )
+      }
+    }
+    return res
+  }
+}
+
+export function SolidAuth(config: SolidAuthConfig) {
+  const { prefix = "/api/auth", ...authOptions } = config
+  authOptions.secret ??= process.env.AUTH_SECRET
+  authOptions.trustHost ??= !!(
+    process.env.AUTH_TRUST_HOST ??
+    process.env.VERCEL ??
+    process.env.NODE_ENV !== "production"
+  )
+  const handler = SolidAuthHandler(prefix, authOptions)
+  return {
+    async GET(event: any) {
+      return await handler(event)
+    },
+    async POST(event: any) {
+      return await handler(event)
+    },
+  }
+}
+
+export type GetSessionResult = Promise<Session | null>
+
+export async function getSession(
+  req: Request,
+  options: AuthConfig
+): GetSessionResult {
+  options.secret ??= process.env.AUTH_SECRET
+  options.trustHost ??= true
+
+  const url = new URL("/api/auth/session", req.url)
+  const response = await Auth(
+    new Request(url, { headers: req.headers }),
+    options
+  )
+
+  const { status = 200 } = response
+
+  const data = await response.json()
+
+  if (!data || !Object.keys(data).length) return null
+  if (status === 200) return data
+  throw new Error(data.message)
+}