@bajustone/fortress 1.0.0-rc.1

package/src/plugins/social-login/providers/apple.ts

@@ -0,0 +1,34 @@
+import type { ProviderDefinition, ProviderProfile } from '../types';
+
+/**
+ * Apple Sign In — user info comes from the ID token only.
+ * Apple sends the user's name only on the first authorization (in the POST callback body).
+ * Subsequent logins only provide sub and email in the ID token.
+ */
+export const appleProvider: ProviderDefinition = {
+  name: 'apple',
+  discoveryUrl: 'https://appleid.apple.com/.well-known/openid-configuration',
+  issuer: 'https://appleid.apple.com',
+  jwksUri: 'https://appleid.apple.com/auth/keys',
+  authorizationUrl: 'https://appleid.apple.com/auth/authorize',
+  tokenUrl: 'https://appleid.apple.com/auth/token',
+  userInfoUrl: undefined, // No userinfo endpoint — profile from ID token
+  defaultScopes: ['name', 'email'],
+  mapProfile(raw: Record<string, unknown>): ProviderProfile {
+    // Apple ID token claims + optional first-auth name object
+    const nameObj = raw.name as { firstName?: string; lastName?: string } | undefined;
+    const fullName = nameObj
+      ? [nameObj.firstName, nameObj.lastName].filter(Boolean).join(' ')
+      : undefined;
+
+    return {
+      id: String(raw.sub ?? ''),
+      email: String(raw.email ?? ''),
+      emailVerified: raw.email_verified === true || raw.email_verified === 'true',
+      name: fullName || undefined,
+      displayName: fullName || undefined,
+      avatar: undefined, // Apple does not provide avatars
+      raw,
+    };
+  },
+};

package/src/plugins/social-login/providers/discord.ts

@@ -0,0 +1,26 @@
+import type { ProviderDefinition, ProviderProfile } from '../types';
+
+export const discordProvider: ProviderDefinition = {
+  name: 'discord',
+  authorizationUrl: 'https://discord.com/api/oauth2/authorize',
+  tokenUrl: 'https://discord.com/api/oauth2/token',
+  userInfoUrl: 'https://discord.com/api/users/@me',
+  defaultScopes: ['identify', 'email'],
+  mapProfile(raw: Record<string, unknown>): ProviderProfile {
+    const id = String(raw.id ?? '');
+    const avatarHash = raw.avatar ? String(raw.avatar) : null;
+    const avatar = avatarHash
+      ? `https://cdn.discordapp.com/avatars/${id}/${avatarHash}.png`
+      : undefined;
+
+    return {
+      id,
+      email: String(raw.email ?? ''),
+      emailVerified: raw.verified === true,
+      name: String(raw.username ?? ''),
+      displayName: String(raw.global_name ?? raw.username ?? ''),
+      avatar,
+      raw,
+    };
+  },
+};

package/src/plugins/social-login/providers/github.ts

@@ -0,0 +1,54 @@
+import type { ProviderDefinition, ProviderProfile } from '../types';
+import { array, object } from '@bajustone/fetcher/schema';
+import { outboundClient } from '../../../core/http/outbound';
+
+/** GitHub `/user` must be a JSON object; `/user/emails` an array of objects. */
+const userSchema = object({});
+const emailsSchema = array(object({}));
+
+/** GitHub uses custom OAuth2, not OIDC — no discovery URL */
+export const githubProvider: ProviderDefinition = {
+  name: 'github',
+  authorizationUrl: 'https://github.com/login/oauth/authorize',
+  tokenUrl: 'https://github.com/login/oauth/access_token',
+  userInfoUrl: 'https://api.github.com/user',
+  defaultScopes: ['read:user', 'user:email'],
+  async fetchProfile(accessToken: string): Promise<Record<string, unknown>> {
+    // Shared outbound client adds a timeout + validates the response shape.
+    const userRes = await outboundClient.get('https://api.github.com/user', {
+      headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/vnd.github+json' },
+      responseSchema: userSchema,
+    }).result();
+    if (!userRes.ok)
+      throw new Error('Failed to fetch GitHub profile');
+    const user = userRes.data as Record<string, unknown>;
+
+    if (!user.email) {
+      const emailsRes = await outboundClient.get('https://api.github.com/user/emails', {
+        headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/vnd.github+json' },
+        responseSchema: emailsSchema,
+      }).result();
+      if (emailsRes.ok) {
+        const emails = emailsRes.data as Array<Record<string, unknown>>;
+        const primary = emails.find(e => e.primary === true) ?? emails.find(e => e.verified === true);
+        if (primary) {
+          user.email = primary.email;
+          user.email_verified = primary.verified === true;
+        }
+      }
+    }
+
+    return user;
+  },
+  mapProfile(raw: Record<string, unknown>): ProviderProfile {
+    return {
+      id: String(raw.id ?? ''),
+      email: String(raw.email ?? ''),
+      emailVerified: raw.email_verified === true || raw.verified === true,
+      name: String(raw.name ?? raw.login ?? ''),
+      displayName: String(raw.name ?? raw.login ?? ''),
+      avatar: raw.avatar_url ? String(raw.avatar_url) : undefined,
+      raw,
+    };
+  },
+};

package/src/plugins/social-login/providers/google.ts

@@ -0,0 +1,23 @@
+import type { ProviderDefinition, ProviderProfile } from '../types';
+
+export const googleProvider: ProviderDefinition = {
+  name: 'google',
+  discoveryUrl: 'https://accounts.google.com/.well-known/openid-configuration',
+  issuer: 'https://accounts.google.com',
+  jwksUri: 'https://www.googleapis.com/oauth2/v3/certs',
+  authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+  tokenUrl: 'https://oauth2.googleapis.com/token',
+  userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+  defaultScopes: ['openid', 'profile', 'email'],
+  mapProfile(raw: Record<string, unknown>): ProviderProfile {
+    return {
+      id: String(raw.sub ?? ''),
+      email: String(raw.email ?? ''),
+      emailVerified: raw.email_verified === true || raw.email_verified === 'true',
+      name: String(raw.name ?? ''),
+      displayName: String(raw.name ?? ''),
+      avatar: raw.picture ? String(raw.picture) : undefined,
+      raw,
+    };
+  },
+};

package/src/plugins/social-login/providers/index.ts

@@ -0,0 +1,22 @@
+import type { ProviderDefinition } from '../types';
+import { appleProvider } from './apple';
+import { discordProvider } from './discord';
+import { githubProvider } from './github';
+import { googleProvider } from './google';
+import { createMicrosoftProvider } from './microsoft';
+
+/** Built-in provider definitions keyed by name (Microsoft uses default 'common' tenant) */
+export const builtInProviders: Record<string, ProviderDefinition> = {
+  microsoft: createMicrosoftProvider(),
+  google: googleProvider,
+  github: githubProvider,
+  apple: appleProvider,
+  discord: discordProvider,
+};
+
+export { appleProvider } from './apple';
+export { discordProvider } from './discord';
+export { githubProvider } from './github';
+export { googleProvider } from './google';
+export { createMicrosoftProvider } from './microsoft';
+export { createOidcProvider } from './oidc';

package/src/plugins/social-login/providers/microsoft.ts

@@ -0,0 +1,35 @@
+import type { ProviderDefinition, ProviderProfile } from '../types';
+
+export function createMicrosoftProvider(options?: { tenant?: string }): ProviderDefinition {
+  const tenant = options?.tenant ?? 'common';
+  const base = `https://login.microsoftonline.com/${tenant}/oauth2/v2.0`;
+
+  return {
+    name: 'microsoft',
+    discoveryUrl: `https://login.microsoftonline.com/${tenant}/v2.0/.well-known/openid-configuration`,
+    issuer: `https://login.microsoftonline.com/${tenant}/v2.0`,
+    authorizationUrl: `${base}/authorize`,
+    tokenUrl: `${base}/token`,
+    userInfoUrl: 'https://graph.microsoft.com/v1.0/me',
+    defaultScopes: ['openid', 'profile', 'email', 'User.Read'],
+    mapProfile(raw: Record<string, unknown>): ProviderProfile {
+      return {
+        id: String(raw.id ?? raw.sub ?? ''),
+        email: String(raw.mail ?? raw.userPrincipalName ?? raw.email ?? ''),
+        // Fail closed on an absent `email_verified` claim. Microsoft Graph `/me`
+        // and many Entra id_tokens omit it; treating "absent" as verified would
+        // let a Microsoft login auto-link by email to an existing account
+        // (takeover). Match the other providers — absent ⇒ unverified ⇒ no
+        // by-email auto-link. Tenants that trust their directory can opt back in
+        // with a custom `mapProfile`.
+        emailVerified: raw.email_verified === true || raw.email_verified === 'true',
+        name: raw.givenName && raw.surname
+          ? `${raw.givenName} ${raw.surname}`
+          : String(raw.name ?? raw.displayName ?? ''),
+        displayName: String(raw.displayName ?? raw.name ?? ''),
+        avatar: undefined, // Microsoft Graph requires separate photo endpoint
+        raw,
+      };
+    },
+  };
+}

package/src/plugins/social-login/providers/oidc.ts

@@ -0,0 +1,37 @@
+import type { ProviderDefinition, ProviderProfile } from '../types';
+
+const TRAILING_SLASHES = /\/+$/;
+
+/**
+ * Factory for generic OIDC-compliant providers.
+ * Uses standard OIDC discovery to resolve endpoints at runtime.
+ */
+export function createOidcProvider(
+  name: string,
+  issuerUrl: string,
+): ProviderDefinition {
+  // Strip trailing slash for consistent URL construction
+  const issuer = issuerUrl.replace(TRAILING_SLASHES, '');
+
+  return {
+    name,
+    discoveryUrl: `${issuer}/.well-known/openid-configuration`,
+    issuer,
+    // These are placeholders — resolved from discovery at runtime when available.
+    authorizationUrl: `${issuer}/authorize`,
+    tokenUrl: `${issuer}/token`,
+    userInfoUrl: `${issuer}/userinfo`,
+    defaultScopes: ['openid', 'profile', 'email'],
+    mapProfile(raw: Record<string, unknown>): ProviderProfile {
+      return {
+        id: String(raw.sub ?? ''),
+        email: String(raw.email ?? ''),
+        emailVerified: raw.email_verified === true || raw.email_verified === 'true',
+        name: String(raw.name ?? ''),
+        displayName: String(raw.preferred_username ?? raw.name ?? ''),
+        avatar: raw.picture ? String(raw.picture) : undefined,
+        raw,
+      };
+    },
+  };
+}

package/src/plugins/social-login/providers/providers.test.ts

@@ -0,0 +1,211 @@
+import { describe, expect, it } from 'vitest';
+import { appleProvider } from './apple';
+import { discordProvider } from './discord';
+import { githubProvider } from './github';
+import { googleProvider } from './google';
+import { builtInProviders } from './index';
+import { createMicrosoftProvider } from './microsoft';
+import { createOidcProvider } from './oidc';
+
+describe('microsoft provider', () => {
+  const provider = createMicrosoftProvider({ tenant: 'my-tenant' });
+
+  it('interpolates tenant into URLs', () => {
+    expect(provider.authorizationUrl).toContain('my-tenant');
+    expect(provider.tokenUrl).toContain('my-tenant');
+    expect(provider.discoveryUrl).toContain('my-tenant');
+  });
+
+  it('defaults to common tenant', () => {
+    const common = createMicrosoftProvider();
+    expect(common.authorizationUrl).toContain('common');
+  });
+
+  it('maps Graph API profile', () => {
+    const profile = provider.mapProfile({
+      id: 'ms-user-123',
+      mail: 'alice@contoso.com',
+      displayName: 'Alice Smith',
+      givenName: 'Alice',
+      surname: 'Smith',
+    });
+
+    expect(profile.id).toBe('ms-user-123');
+    expect(profile.email).toBe('alice@contoso.com');
+    expect(profile.name).toBe('Alice Smith');
+    expect(profile.displayName).toBe('Alice Smith');
+  });
+
+  it('falls back to userPrincipalName for email', () => {
+    const profile = provider.mapProfile({
+      id: 'ms-user-456',
+      userPrincipalName: 'bob@contoso.com',
+      displayName: 'Bob',
+    });
+
+    expect(profile.email).toBe('bob@contoso.com');
+  });
+
+  it('fails closed on an absent email_verified claim (no by-email auto-link takeover)', () => {
+    // Graph /me and most Entra id_tokens omit email_verified — must NOT be
+    // treated as verified (would enable a by-email account takeover).
+    const profile = provider.mapProfile({ id: 'ms-1', mail: 'eve@contoso.com', displayName: 'Eve' });
+    expect(profile.emailVerified).toBe(false);
+  });
+
+  it('honours an explicit email_verified claim when present', () => {
+    expect(provider.mapProfile({ id: 'ms-2', mail: 'x@contoso.com', email_verified: true }).emailVerified).toBe(true);
+    expect(provider.mapProfile({ id: 'ms-3', mail: 'y@contoso.com', email_verified: false }).emailVerified).toBe(false);
+  });
+});
+
+describe('google provider', () => {
+  it('maps OIDC claims', () => {
+    const profile = googleProvider.mapProfile({
+      sub: '1234567890',
+      email: 'alice@gmail.com',
+      name: 'Alice Smith',
+      picture: 'https://lh3.googleusercontent.com/photo.jpg',
+    });
+
+    expect(profile.id).toBe('1234567890');
+    expect(profile.email).toBe('alice@gmail.com');
+    expect(profile.name).toBe('Alice Smith');
+    expect(profile.avatar).toBe('https://lh3.googleusercontent.com/photo.jpg');
+  });
+
+  it('handles missing picture', () => {
+    const profile = googleProvider.mapProfile({
+      sub: '123',
+      email: 'bob@gmail.com',
+      name: 'Bob',
+    });
+
+    expect(profile.avatar).toBeUndefined();
+  });
+});
+
+describe('github provider', () => {
+  it('has no discovery URL (not OIDC)', () => {
+    expect(githubProvider.discoveryUrl).toBeUndefined();
+  });
+
+  it('maps GitHub profile with numeric ID', () => {
+    const profile = githubProvider.mapProfile({
+      id: '12345',
+      login: 'octocat',
+      name: 'The Octocat',
+      email: 'octocat@github.com',
+      avatar_url: 'https://avatars.githubusercontent.com/u/12345',
+    });
+
+    expect(profile.id).toBe('12345');
+    expect(profile.email).toBe('octocat@github.com');
+    expect(profile.name).toBe('The Octocat');
+    expect(profile.avatar).toBe('https://avatars.githubusercontent.com/u/12345');
+  });
+
+  it('falls back to login when name is missing', () => {
+    const profile = githubProvider.mapProfile({
+      id: '99',
+      login: 'anonymous',
+      email: 'anon@example.com',
+    });
+
+    expect(profile.name).toBe('anonymous');
+    expect(profile.displayName).toBe('anonymous');
+  });
+});
+
+describe('apple provider', () => {
+  it('has no userInfoUrl', () => {
+    expect(appleProvider.userInfoUrl).toBeUndefined();
+  });
+
+  it('maps ID token claims with name object', () => {
+    const profile = appleProvider.mapProfile({
+      sub: 'apple-user-001',
+      email: 'alice@icloud.com',
+      name: { firstName: 'Alice', lastName: 'Smith' },
+    });
+
+    expect(profile.id).toBe('apple-user-001');
+    expect(profile.email).toBe('alice@icloud.com');
+    expect(profile.name).toBe('Alice Smith');
+    expect(profile.avatar).toBeUndefined();
+  });
+
+  it('handles missing name (subsequent logins)', () => {
+    const profile = appleProvider.mapProfile({
+      sub: 'apple-user-001',
+      email: 'alice@icloud.com',
+    });
+
+    expect(profile.name).toBeUndefined();
+  });
+});
+
+describe('discord provider', () => {
+  it('constructs avatar CDN URL', () => {
+    const profile = discordProvider.mapProfile({
+      id: '80351110224678912',
+      username: 'Nelly',
+      global_name: 'Nelly Rose',
+      email: 'nelly@example.com',
+      avatar: 'a_d5efa99b3eeaa7dd43acca82f5692432',
+    });
+
+    expect(profile.id).toBe('80351110224678912');
+    expect(profile.displayName).toBe('Nelly Rose');
+    expect(profile.avatar).toBe(
+      'https://cdn.discordapp.com/avatars/80351110224678912/a_d5efa99b3eeaa7dd43acca82f5692432.png',
+    );
+  });
+
+  it('handles missing avatar', () => {
+    const profile = discordProvider.mapProfile({
+      id: '123',
+      username: 'NoAvatar',
+      email: 'test@example.com',
+    });
+
+    expect(profile.avatar).toBeUndefined();
+  });
+});
+
+describe('generic OIDC provider', () => {
+  const provider = createOidcProvider('corporate-sso', 'https://sso.company.com');
+
+  it('constructs discovery URL from issuer', () => {
+    expect(provider.discoveryUrl).toBe('https://sso.company.com/.well-known/openid-configuration');
+  });
+
+  it('strips trailing slashes from issuer', () => {
+    const p = createOidcProvider('test', 'https://sso.example.com/');
+    expect(p.discoveryUrl).toBe('https://sso.example.com/.well-known/openid-configuration');
+  });
+
+  it('maps standard OIDC claims', () => {
+    const profile = provider.mapProfile({
+      sub: 'emp-789',
+      email: 'jane@company.com',
+      name: 'Jane Doe',
+      preferred_username: 'jdoe',
+      picture: 'https://sso.company.com/photos/jdoe.jpg',
+    });
+
+    expect(profile.id).toBe('emp-789');
+    expect(profile.email).toBe('jane@company.com');
+    expect(profile.displayName).toBe('jdoe');
+    expect(profile.avatar).toBe('https://sso.company.com/photos/jdoe.jpg');
+  });
+});
+
+describe('builtInProviders registry', () => {
+  it('contains all 5 built-in providers', () => {
+    expect(Object.keys(builtInProviders)).toEqual(
+      expect.arrayContaining(['microsoft', 'google', 'github', 'apple', 'discord']),
+    );
+    expect(Object.keys(builtInProviders)).toHaveLength(5);
+  });
+});