@bajustone/fortress 1.0.0-rc.1

package/dist/plugins/social-login.js

@@ -0,0 +1,880 @@
+// src/plugins/social-login/index.ts
+import { object as object2, string, union } from "@bajustone/fetcher/schema";
+import { createRemoteJWKSet, importPKCS8, jwtVerify, SignJWT } from "jose";
+
+// src/core/auth/email.ts
+function normalizeEmail(email) {
+  return email.toLowerCase().normalize("NFC");
+}
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/core/http/outbound.ts
+import { createFetch } from "@bajustone/fetcher";
+var OUTBOUND_TIMEOUT_MS = 1e4;
+function requestWithSignal(request, signal) {
+  return new Request(request, request.body ? { signal, body: request.body, duplex: "half" } : { signal });
+}
+function fullExchangeTimeout(ms) {
+  return async (request, next) => {
+    const controller = new AbortController();
+    const userSignal = request.signal;
+    const abortFromUser = () => controller.abort(userSignal.reason);
+    if (userSignal.aborted)
+      abortFromUser();
+    else
+      userSignal.addEventListener("abort", abortFromUser, { once: true });
+    const timer = setTimeout(() => {
+      controller.abort(new DOMException(`Request timed out after ${ms}ms`, "TimeoutError"));
+    }, ms);
+    let cleaned = false;
+    const cleanup = () => {
+      if (cleaned)
+        return;
+      cleaned = true;
+      clearTimeout(timer);
+      userSignal.removeEventListener("abort", abortFromUser);
+    };
+    try {
+      const response = await next(requestWithSignal(request, controller.signal));
+      if (!response.body) {
+        cleanup();
+        return response;
+      }
+      const reader = response.body.getReader();
+      const body = new ReadableStream({
+        async pull(streamController) {
+          try {
+            const chunk = await reader.read();
+            if (chunk.done) {
+              cleanup();
+              streamController.close();
+            } else {
+              streamController.enqueue(chunk.value);
+            }
+          } catch (error) {
+            cleanup();
+            streamController.error(error);
+          }
+        },
+        async cancel(reason) {
+          cleanup();
+          await reader.cancel(reason);
+        }
+      });
+      return new Response(body, {
+        headers: response.headers,
+        status: response.status,
+        statusText: response.statusText
+      });
+    } catch (error) {
+      cleanup();
+      throw error;
+    }
+  };
+}
+function createOutboundClient(timeoutMs = OUTBOUND_TIMEOUT_MS) {
+  return createFetch({ baseUrl: "", middleware: [fullExchangeTimeout(timeoutMs)] });
+}
+var outboundClient = createOutboundClient();
+
+// src/plugins/social-login/providers/apple.ts
+var appleProvider = {
+  name: "apple",
+  discoveryUrl: "https://appleid.apple.com/.well-known/openid-configuration",
+  issuer: "https://appleid.apple.com",
+  jwksUri: "https://appleid.apple.com/auth/keys",
+  authorizationUrl: "https://appleid.apple.com/auth/authorize",
+  tokenUrl: "https://appleid.apple.com/auth/token",
+  userInfoUrl: void 0,
+  // No userinfo endpoint — profile from ID token
+  defaultScopes: ["name", "email"],
+  mapProfile(raw) {
+    const nameObj = raw.name;
+    const fullName = nameObj ? [nameObj.firstName, nameObj.lastName].filter(Boolean).join(" ") : void 0;
+    return {
+      id: String(raw.sub ?? ""),
+      email: String(raw.email ?? ""),
+      emailVerified: raw.email_verified === true || raw.email_verified === "true",
+      name: fullName || void 0,
+      displayName: fullName || void 0,
+      avatar: void 0,
+      // Apple does not provide avatars
+      raw
+    };
+  }
+};
+
+// src/plugins/social-login/providers/discord.ts
+var discordProvider = {
+  name: "discord",
+  authorizationUrl: "https://discord.com/api/oauth2/authorize",
+  tokenUrl: "https://discord.com/api/oauth2/token",
+  userInfoUrl: "https://discord.com/api/users/@me",
+  defaultScopes: ["identify", "email"],
+  mapProfile(raw) {
+    const id = String(raw.id ?? "");
+    const avatarHash = raw.avatar ? String(raw.avatar) : null;
+    const avatar = avatarHash ? `https://cdn.discordapp.com/avatars/${id}/${avatarHash}.png` : void 0;
+    return {
+      id,
+      email: String(raw.email ?? ""),
+      emailVerified: raw.verified === true,
+      name: String(raw.username ?? ""),
+      displayName: String(raw.global_name ?? raw.username ?? ""),
+      avatar,
+      raw
+    };
+  }
+};
+
+// src/plugins/social-login/providers/github.ts
+import { array, object } from "@bajustone/fetcher/schema";
+var userSchema = object({});
+var emailsSchema = array(object({}));
+var githubProvider = {
+  name: "github",
+  authorizationUrl: "https://github.com/login/oauth/authorize",
+  tokenUrl: "https://github.com/login/oauth/access_token",
+  userInfoUrl: "https://api.github.com/user",
+  defaultScopes: ["read:user", "user:email"],
+  async fetchProfile(accessToken) {
+    const userRes = await outboundClient.get("https://api.github.com/user", {
+      headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/vnd.github+json" },
+      responseSchema: userSchema
+    }).result();
+    if (!userRes.ok)
+      throw new Error("Failed to fetch GitHub profile");
+    const user = userRes.data;
+    if (!user.email) {
+      const emailsRes = await outboundClient.get("https://api.github.com/user/emails", {
+        headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/vnd.github+json" },
+        responseSchema: emailsSchema
+      }).result();
+      if (emailsRes.ok) {
+        const emails = emailsRes.data;
+        const primary = emails.find((e) => e.primary === true) ?? emails.find((e) => e.verified === true);
+        if (primary) {
+          user.email = primary.email;
+          user.email_verified = primary.verified === true;
+        }
+      }
+    }
+    return user;
+  },
+  mapProfile(raw) {
+    return {
+      id: String(raw.id ?? ""),
+      email: String(raw.email ?? ""),
+      emailVerified: raw.email_verified === true || raw.verified === true,
+      name: String(raw.name ?? raw.login ?? ""),
+      displayName: String(raw.name ?? raw.login ?? ""),
+      avatar: raw.avatar_url ? String(raw.avatar_url) : void 0,
+      raw
+    };
+  }
+};
+
+// src/plugins/social-login/providers/google.ts
+var googleProvider = {
+  name: "google",
+  discoveryUrl: "https://accounts.google.com/.well-known/openid-configuration",
+  issuer: "https://accounts.google.com",
+  jwksUri: "https://www.googleapis.com/oauth2/v3/certs",
+  authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenUrl: "https://oauth2.googleapis.com/token",
+  userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
+  defaultScopes: ["openid", "profile", "email"],
+  mapProfile(raw) {
+    return {
+      id: String(raw.sub ?? ""),
+      email: String(raw.email ?? ""),
+      emailVerified: raw.email_verified === true || raw.email_verified === "true",
+      name: String(raw.name ?? ""),
+      displayName: String(raw.name ?? ""),
+      avatar: raw.picture ? String(raw.picture) : void 0,
+      raw
+    };
+  }
+};
+
+// src/plugins/social-login/providers/microsoft.ts
+function createMicrosoftProvider(options) {
+  const tenant = options?.tenant ?? "common";
+  const base = `https://login.microsoftonline.com/${tenant}/oauth2/v2.0`;
+  return {
+    name: "microsoft",
+    discoveryUrl: `https://login.microsoftonline.com/${tenant}/v2.0/.well-known/openid-configuration`,
+    issuer: `https://login.microsoftonline.com/${tenant}/v2.0`,
+    authorizationUrl: `${base}/authorize`,
+    tokenUrl: `${base}/token`,
+    userInfoUrl: "https://graph.microsoft.com/v1.0/me",
+    defaultScopes: ["openid", "profile", "email", "User.Read"],
+    mapProfile(raw) {
+      return {
+        id: String(raw.id ?? raw.sub ?? ""),
+        email: String(raw.mail ?? raw.userPrincipalName ?? raw.email ?? ""),
+        // Fail closed on an absent `email_verified` claim. Microsoft Graph `/me`
+        // and many Entra id_tokens omit it; treating "absent" as verified would
+        // let a Microsoft login auto-link by email to an existing account
+        // (takeover). Match the other providers — absent ⇒ unverified ⇒ no
+        // by-email auto-link. Tenants that trust their directory can opt back in
+        // with a custom `mapProfile`.
+        emailVerified: raw.email_verified === true || raw.email_verified === "true",
+        name: raw.givenName && raw.surname ? `${raw.givenName} ${raw.surname}` : String(raw.name ?? raw.displayName ?? ""),
+        displayName: String(raw.displayName ?? raw.name ?? ""),
+        avatar: void 0,
+        // Microsoft Graph requires separate photo endpoint
+        raw
+      };
+    }
+  };
+}
+
+// src/plugins/social-login/providers/oidc.ts
+var TRAILING_SLASHES = /\/+$/;
+function createOidcProvider(name, issuerUrl) {
+  const issuer = issuerUrl.replace(TRAILING_SLASHES, "");
+  return {
+    name,
+    discoveryUrl: `${issuer}/.well-known/openid-configuration`,
+    issuer,
+    // These are placeholders — resolved from discovery at runtime when available.
+    authorizationUrl: `${issuer}/authorize`,
+    tokenUrl: `${issuer}/token`,
+    userInfoUrl: `${issuer}/userinfo`,
+    defaultScopes: ["openid", "profile", "email"],
+    mapProfile(raw) {
+      return {
+        id: String(raw.sub ?? ""),
+        email: String(raw.email ?? ""),
+        emailVerified: raw.email_verified === true || raw.email_verified === "true",
+        name: String(raw.name ?? ""),
+        displayName: String(raw.preferred_username ?? raw.name ?? ""),
+        avatar: raw.picture ? String(raw.picture) : void 0,
+        raw
+      };
+    }
+  };
+}
+
+// src/plugins/social-login/providers/index.ts
+var builtInProviders = {
+  microsoft: createMicrosoftProvider(),
+  google: googleProvider,
+  github: githubProvider,
+  apple: appleProvider,
+  discord: discordProvider
+};
+
+// src/plugins/social-login/index.ts
+var jsonObjectSchema = object2({});
+var tokenResponseSchema = union([object2({ access_token: string() }), string()]);
+var encoder = new TextEncoder();
+var HEX_32_BYTE_KEY = /^[0-9a-f]+$/i;
+var discoveryCache = /* @__PURE__ */ new Map();
+var jwksCache = /* @__PURE__ */ new Map();
+var appleSecretCache = /* @__PURE__ */ new Map();
+var MICROSOFT_DISCOVERY_ISSUER_PATTERN = /^https:\/\/login\.microsoftonline\.com\/(?:\{tenantid\}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/v2\.0$/i;
+var MICROSOFT_TOKEN_ISSUER_PATTERN = /^https:\/\/login\.microsoftonline\.com\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/v2\.0$/i;
+function randomBase64Url(bytes = 32) {
+  const data = new Uint8Array(bytes);
+  crypto.getRandomValues(data);
+  return btoa(String.fromCharCode(...data)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function timingSafeEqual(a, b) {
+  const left = encoder.encode(a);
+  const right = encoder.encode(b);
+  const len = Math.max(left.length, right.length);
+  let diff = left.length ^ right.length;
+  for (let i = 0; i < len; i++)
+    diff |= (left[i] ?? 0) ^ (right[i] ?? 0);
+  return diff === 0;
+}
+function decodeKeyMaterial(key) {
+  const trimmed = key.trim();
+  if (HEX_32_BYTE_KEY.test(trimmed) && trimmed.length === 64) {
+    return new Uint8Array(trimmed.match(/.{2}/g).map((byte) => Number.parseInt(byte, 16)));
+  }
+  try {
+    const normalized = trimmed.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+    const raw = atob(padded);
+    const bytes = new Uint8Array(raw.length);
+    for (let i = 0; i < raw.length; i++)
+      bytes[i] = raw.charCodeAt(i);
+    if (bytes.length >= 32)
+      return bytes;
+  } catch {
+  }
+  return encoder.encode(key);
+}
+async function importTokenEncryptionKey(key) {
+  const bytes = decodeKeyMaterial(key);
+  if (bytes.length !== 32) {
+    throw Errors.badRequest("socialLogin tokenEncryptionKey must decode to exactly 32 bytes for AES-256-GCM");
+  }
+  const raw = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+  return crypto.subtle.importKey("raw", raw, "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+async function encryptToken(keyPromise, value) {
+  if (!value)
+    return null;
+  if (!keyPromise)
+    throw Errors.badRequest("socialLogin token persistence requires tokenEncryptionKey");
+  const key = await keyPromise;
+  const iv = new Uint8Array(12);
+  crypto.getRandomValues(iv);
+  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, encoder.encode(value)));
+  return `v1.${base64UrlFromBytes(iv)}.${base64UrlFromBytes(ciphertext)}`;
+}
+async function decryptToken(keyPromise, value) {
+  if (!value)
+    return null;
+  if (!keyPromise)
+    throw Errors.badRequest("socialLogin token persistence requires tokenEncryptionKey");
+  const [version, ivEncoded, ciphertextEncoded] = value.split(".");
+  if (version !== "v1" || !ivEncoded || !ciphertextEncoded)
+    throw Errors.badRequest("Invalid encrypted social-login token format");
+  const key = await keyPromise;
+  const iv = base64UrlToBytes(ivEncoded);
+  const ciphertext = base64UrlToBytes(ciphertextEncoded);
+  const ivBuffer = iv.buffer.slice(iv.byteOffset, iv.byteOffset + iv.byteLength);
+  const ciphertextBuffer = ciphertext.buffer.slice(ciphertext.byteOffset, ciphertext.byteOffset + ciphertext.byteLength);
+  const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: ivBuffer }, key, ciphertextBuffer);
+  return new TextDecoder().decode(plaintext);
+}
+function base64UrlFromBytes(data) {
+  return btoa(String.fromCharCode(...data)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlToBytes(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  const raw = atob(padded);
+  const bytes = new Uint8Array(raw.length);
+  for (let i = 0; i < raw.length; i++)
+    bytes[i] = raw.charCodeAt(i);
+  return bytes;
+}
+function resolveProviderDefinition(providerConfig) {
+  if (providerConfig.name === "microsoft" && providerConfig.tenant) {
+    return createMicrosoftProvider({ tenant: providerConfig.tenant });
+  }
+  if (providerConfig.issuer) {
+    const base = createOidcProvider(providerConfig.name, providerConfig.issuer);
+    return {
+      ...base,
+      authorizationUrl: providerConfig.authorizationUrl ?? base.authorizationUrl,
+      tokenUrl: providerConfig.tokenUrl ?? base.tokenUrl,
+      userInfoUrl: providerConfig.userInfoUrl ?? base.userInfoUrl,
+      jwksUri: providerConfig.jwksUri
+    };
+  }
+  const builtIn = builtInProviders[providerConfig.name];
+  if (builtIn)
+    return builtIn;
+  throw Errors.badRequest(`Unknown social login provider: ${providerConfig.name}. Provide an 'issuer' URL for custom OIDC providers.`);
+}
+function isAbsoluteUrl(value) {
+  if (typeof value !== "string" || value.length === 0)
+    return false;
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function isMicrosoftMultiTenant(providerConfig) {
+  return providerConfig.name === "microsoft" && ["common", "organizations", "consumers"].includes(providerConfig.tenant ?? "common");
+}
+async function resolveDiscoveredDefinition(definition, providerConfig) {
+  if (!definition.discoveryUrl || definition.issuer && definition.jwksUri && !providerConfig.issuer) {
+    return definition;
+  }
+  const cacheKey = `${providerConfig.name}:${definition.discoveryUrl}`;
+  const existing = discoveryCache.get(cacheKey);
+  if (existing)
+    return existing;
+  const pending = (async () => {
+    const res = await outboundClient.get(definition.discoveryUrl, { responseSchema: jsonObjectSchema }).result();
+    if (!res.ok)
+      return null;
+    const discovered = res.data;
+    const discoveredIssuer = discovered.issuer;
+    const expectedIssuer = definition.issuer ?? providerConfig.issuer;
+    const trustedIssuer = isMicrosoftMultiTenant(providerConfig) ? typeof discoveredIssuer === "string" && (discoveredIssuer === expectedIssuer || MICROSOFT_DISCOVERY_ISSUER_PATTERN.test(discoveredIssuer)) : typeof discoveredIssuer === "string" && discoveredIssuer === expectedIssuer;
+    if (!trustedIssuer || !isAbsoluteUrl(discovered.jwks_uri))
+      return null;
+    return {
+      ...definition,
+      // Multi-tenant Microsoft authorities advertise a {tenantid} issuer in
+      // discovery; the concrete tenant is checked against the ID token below.
+      issuer: isMicrosoftMultiTenant(providerConfig) ? definition.issuer : discoveredIssuer,
+      authorizationUrl: providerConfig.authorizationUrl ?? (isAbsoluteUrl(discovered.authorization_endpoint) ? discovered.authorization_endpoint : definition.authorizationUrl),
+      tokenUrl: providerConfig.tokenUrl ?? (isAbsoluteUrl(discovered.token_endpoint) ? discovered.token_endpoint : definition.tokenUrl),
+      userInfoUrl: providerConfig.userInfoUrl ?? (isAbsoluteUrl(discovered.userinfo_endpoint) ? discovered.userinfo_endpoint : definition.userInfoUrl),
+      jwksUri: providerConfig.jwksUri ?? discovered.jwks_uri
+    };
+  })();
+  const cached = pending.then((result) => {
+    if (result)
+      return result;
+    if (discoveryCache.get(cacheKey) === cached)
+      discoveryCache.delete(cacheKey);
+    return definition;
+  }, (error) => {
+    if (discoveryCache.get(cacheKey) === cached)
+      discoveryCache.delete(cacheKey);
+    throw error;
+  });
+  discoveryCache.set(cacheKey, cached);
+  return cached;
+}
+async function verifyIdToken(definition, providerConfig, idToken, nonce) {
+  const shouldVerify = Boolean(definition.discoveryUrl || definition.jwksUri || idToken);
+  if (!shouldVerify)
+    return null;
+  if (!idToken)
+    throw Errors.unauthorized(`Provider ${providerConfig.name} did not return an ID token`);
+  if (!definition.jwksUri)
+    throw Errors.unauthorized(`Provider ${providerConfig.name} has no JWKS URI for ID token verification`);
+  if (!definition.issuer)
+    throw Errors.unauthorized(`Provider ${providerConfig.name} has no issuer for ID token verification`);
+  if (!nonce)
+    throw Errors.unauthorized(`Missing stored OIDC nonce for ${providerConfig.name}`);
+  let jwks = jwksCache.get(definition.jwksUri);
+  if (!jwks) {
+    jwks = createRemoteJWKSet(new URL(definition.jwksUri));
+    jwksCache.set(definition.jwksUri, jwks);
+  }
+  const multiTenantMicrosoft = isMicrosoftMultiTenant(providerConfig);
+  const { payload } = await jwtVerify(idToken, jwks, {
+    ...multiTenantMicrosoft ? {} : { issuer: definition.issuer },
+    audience: providerConfig.clientId,
+    // Accept asymmetric OIDC signing algorithms while excluding `none` and
+    // every shared-secret HS* algorithm (which could enable key-confusion).
+    algorithms: ["RS256", "PS256", "ES256", "EdDSA"]
+  }).catch(() => {
+    throw Errors.unauthorized(`Invalid ID token from ${providerConfig.name}`);
+  });
+  if (multiTenantMicrosoft) {
+    const issuer = typeof payload.iss === "string" ? payload.iss : "";
+    const tenantId = typeof payload.tid === "string" ? payload.tid : "";
+    const match = MICROSOFT_TOKEN_ISSUER_PATTERN.exec(issuer);
+    if (!match || !tenantId || match[1].toLowerCase() !== tenantId.toLowerCase())
+      throw Errors.unauthorized(`Invalid ID token issuer from ${providerConfig.name}`);
+  }
+  if (payload.nonce !== nonce)
+    throw Errors.unauthorized(`Invalid ID token nonce from ${providerConfig.name}`);
+  return payload;
+}
+async function buildClientSecret(providerConfig, definition) {
+  if (providerConfig.name !== "apple" || !providerConfig.privateKey)
+    return providerConfig.clientSecret;
+  if (!providerConfig.teamId || !providerConfig.keyId)
+    throw Errors.badRequest("Apple social login requires teamId, keyId, and privateKey");
+  const cacheKey = `${providerConfig.teamId}:${providerConfig.clientId}:${providerConfig.keyId}`;
+  const cached = appleSecretCache.get(cacheKey);
+  if (cached && cached.expiresAt > Date.now() + 6e4)
+    return cached.value;
+  const now = Math.floor(Date.now() / 1e3);
+  const expiresAt = now + 60 * 60;
+  const key = await importPKCS8(providerConfig.privateKey, "ES256");
+  const issuer = definition.issuer ?? "https://appleid.apple.com";
+  const value = await new SignJWT({}).setProtectedHeader({ alg: "ES256", kid: providerConfig.keyId }).setIssuer(providerConfig.teamId).setSubject(providerConfig.clientId).setAudience(issuer).setIssuedAt(now).setExpirationTime(expiresAt).sign(key);
+  appleSecretCache.set(cacheKey, { value, expiresAt: expiresAt * 1e3 });
+  return value;
+}
+async function generatePKCE() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const codeVerifier = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+  const codeChallenge = btoa(String.fromCharCode(...new Uint8Array(hash))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  return { codeVerifier, codeChallenge };
+}
+function socialLogin(config) {
+  const autoRegister = config.autoRegister ?? true;
+  const linkAccounts = config.linkAccounts ?? true;
+  const persistTokens = config.persistTokens ?? false;
+  if (persistTokens && !config.tokenEncryptionKey)
+    throw Errors.badRequest("socialLogin requires tokenEncryptionKey when persistTokens is enabled");
+  if (persistTokens && config.tokenEncryptionKey && decodeKeyMaterial(config.tokenEncryptionKey).length !== 32)
+    throw Errors.badRequest("socialLogin tokenEncryptionKey must decode to exactly 32 bytes for AES-256-GCM");
+  const tokenEncryptionKey = persistTokens && config.tokenEncryptionKey ? importTokenEncryptionKey(config.tokenEncryptionKey) : null;
+  const providerMap = /* @__PURE__ */ new Map();
+  for (const pc of config.providers) {
+    providerMap.set(pc.name, { definition: resolveProviderDefinition(pc), config: pc });
+  }
+  return {
+    name: "social-login",
+    models: [{
+      name: "social_account",
+      fields: {
+        id: { type: "number", required: true },
+        userId: { type: "number", required: true, references: { model: "user", field: "id" } },
+        provider: { type: "string", required: true },
+        providerAccountId: { type: "string", required: true },
+        email: { type: "string" },
+        accessToken: { type: "string" },
+        refreshToken: { type: "string" },
+        tokenExpiresAt: { type: "date" },
+        profile: { type: "string" },
+        createdAt: { type: "date", required: true },
+        updatedAt: { type: "date", required: true }
+      },
+      constraints: [
+        { type: "unique", fields: ["userId", "provider"] },
+        { type: "unique", fields: ["provider", "providerAccountId"] }
+      ]
+    }],
+    methods: (ctx) => ({
+      /**
+       * Get the authorization URL to redirect the user to for a given provider.
+       * Returns the URL and state that must be stored (e.g., in session) for callback verification.
+       */
+      async getAuthorizationUrl(providerName, redirectUri) {
+        const entry = providerMap.get(providerName);
+        if (!entry)
+          throw Errors.badRequest(`Provider '${providerName}' is not configured`);
+        const { definition, config: pc } = entry;
+        const resolvedDefinition = await resolveDiscoveredDefinition(definition, pc);
+        const { codeVerifier, codeChallenge } = await generatePKCE();
+        const state = randomBase64Url();
+        const nonce = randomBase64Url();
+        const scopes = pc.scopes ?? resolvedDefinition.defaultScopes;
+        const params = new URLSearchParams({
+          client_id: pc.clientId,
+          redirect_uri: redirectUri,
+          response_type: "code",
+          scope: scopes.join(" "),
+          state,
+          code_challenge: codeChallenge,
+          code_challenge_method: "S256"
+        });
+        if (scopes.includes("openid") || resolvedDefinition.discoveryUrl)
+          params.set("nonce", nonce);
+        const url = `${resolvedDefinition.authorizationUrl}?${params.toString()}`;
+        return { url, state, codeVerifier, nonce };
+      },
+      /**
+       * Handle the OAuth callback. Exchanges the authorization code for tokens,
+       * fetches the user profile, and performs JIT provisioning / account linking.
+       *
+       * Returns the Fortress user (existing or newly created) and the provider profile.
+       */
+      async handleCallback(providerName, code, redirectUri, codeVerifier, returnedState, storedState, storedNonce) {
+        if (!returnedState || !storedState || !timingSafeEqual(returnedState, storedState))
+          throw Errors.unauthorized("Invalid OAuth state");
+        const entry = providerMap.get(providerName);
+        if (!entry)
+          throw Errors.badRequest(`Provider '${providerName}' is not configured`);
+        const { definition, config: pc } = entry;
+        const resolvedDefinition = await resolveDiscoveredDefinition(definition, pc);
+        const clientSecret = await buildClientSecret(pc, resolvedDefinition);
+        const tokenRes = await outboundClient.post(resolvedDefinition.tokenUrl, {
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            // GitHub defaults to form-urlencoded; explicitly requesting JSON
+            // makes its response interoperable while retaining the fallback.
+            "Accept": "application/json"
+          },
+          body: new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: redirectUri,
+            client_id: pc.clientId,
+            client_secret: clientSecret,
+            code_verifier: codeVerifier
+          }),
+          responseSchema: tokenResponseSchema
+        }).result();
+        if (!tokenRes.ok) {
+          throw Errors.unauthorized(`Failed to exchange authorization code with ${providerName}`);
+        }
+        const tokenData = tokenRes.data;
+        const tokens = typeof tokenData === "string" ? (() => {
+          const form = new URLSearchParams(tokenData);
+          return {
+            access_token: form.get("access_token") ?? "",
+            refresh_token: form.get("refresh_token") ?? void 0,
+            expires_in: form.has("expires_in") ? Number(form.get("expires_in")) : void 0,
+            id_token: form.get("id_token") ?? void 0
+          };
+        })() : tokenData;
+        if (!tokens.access_token)
+          throw Errors.unauthorized(`Failed to exchange authorization code with ${providerName}`);
+        const idTokenClaims = await verifyIdToken(resolvedDefinition, pc, tokens.id_token, storedNonce);
+        let rawProfile;
+        if (resolvedDefinition.fetchProfile) {
+          rawProfile = await resolvedDefinition.fetchProfile(tokens.access_token).catch(() => {
+            throw Errors.unauthorized(`Failed to fetch profile from ${providerName}`);
+          });
+        } else if (resolvedDefinition.userInfoUrl) {
+          const profileRes = await outboundClient.get(resolvedDefinition.userInfoUrl, {
+            headers: { Authorization: `Bearer ${tokens.access_token}` },
+            responseSchema: jsonObjectSchema
+          }).result();
+          if (!profileRes.ok) {
+            throw Errors.unauthorized(`Failed to fetch profile from ${providerName}`);
+          }
+          rawProfile = profileRes.data;
+        } else if (idTokenClaims) {
+          rawProfile = { ...idTokenClaims };
+        } else {
+          throw Errors.unauthorized(`Provider ${providerName} returned no profile data`);
+        }
+        if (idTokenClaims)
+          rawProfile = { ...idTokenClaims, ...rawProfile };
+        const profile = resolvedDefinition.mapProfile(rawProfile);
+        if (!profile.id)
+          throw Errors.unauthorized(`Provider ${providerName} returned no subject`);
+        const canonicalProfileEmail = normalizeEmail(profile.email);
+        if (pc.allowedDomains && pc.allowedDomains.length > 0) {
+          const domain = canonicalProfileEmail.split("@")[1];
+          const allowedDomains = pc.allowedDomains.map((value) => value.normalize("NFC").toLowerCase());
+          if (!domain || !allowedDomains.includes(domain)) {
+            throw Errors.unauthorized(`Email domain '${domain ?? ""}' is not allowed for ${providerName}`);
+          }
+        }
+        return ctx.db.transaction(async (tx) => {
+          const encryptedAccessToken = persistTokens ? await encryptToken(tokenEncryptionKey, tokens.access_token) : null;
+          const encryptedRefreshToken = persistTokens ? await encryptToken(tokenEncryptionKey, tokens.refresh_token) : null;
+          const socialAccount = await tx.findOne({
+            model: "social_account",
+            where: [
+              { field: "provider", operator: "=", value: providerName },
+              { field: "providerAccountId", operator: "=", value: profile.id }
+            ]
+          });
+          let user = null;
+          let isNewUser = false;
+          if (socialAccount) {
+            user = await tx.findOne({
+              model: "user",
+              where: [{ field: "id", operator: "=", value: socialAccount.userId }]
+            });
+            if (!user || !user.isActive)
+              throw Errors.unauthorized("User account not found or disabled");
+            await tx.update({
+              model: "social_account",
+              where: [{ field: "id", operator: "=", value: socialAccount.id }],
+              data: {
+                accessToken: encryptedAccessToken,
+                refreshToken: encryptedRefreshToken ?? socialAccount.refreshToken,
+                tokenExpiresAt: tokens.expires_in ? new Date(Date.now() + tokens.expires_in * 1e3) : null,
+                profile: JSON.stringify(profile.raw),
+                email: canonicalProfileEmail,
+                updatedAt: /* @__PURE__ */ new Date()
+              }
+            });
+          } else {
+            if (linkAccounts && canonicalProfileEmail && profile.emailVerified) {
+              user = await tx.findOne({
+                model: "user",
+                where: [{ field: "email", operator: "=", value: canonicalProfileEmail }]
+              });
+              if (user && !user.isActive)
+                throw Errors.unauthorized("User account not found or disabled");
+            }
+            if (!user) {
+              if (!autoRegister) {
+                throw Errors.unauthorized("Auto-registration is disabled");
+              }
+              const mapped = config.mapProfile ? config.mapProfile(providerName, profile) : null;
+              const email = normalizeEmail(mapped?.email ?? canonicalProfileEmail);
+              const name = mapped?.name ?? profile.name ?? profile.email;
+              user = await tx.create({
+                model: "user",
+                data: {
+                  email,
+                  name,
+                  passwordHash: null,
+                  // Social-only user
+                  isActive: true,
+                  emailVerified: profile.emailVerified
+                }
+              });
+              isNewUser = true;
+              if (config.onFirstLogin) {
+                await config.onFirstLogin({ id: user.id }, providerName, profile);
+              }
+            }
+            await tx.create({
+              model: "social_account",
+              data: {
+                userId: user.id,
+                provider: providerName,
+                providerAccountId: profile.id,
+                email: canonicalProfileEmail,
+                accessToken: encryptedAccessToken,
+                refreshToken: encryptedRefreshToken,
+                tokenExpiresAt: tokens.expires_in ? new Date(Date.now() + tokens.expires_in * 1e3) : null,
+                profile: JSON.stringify(profile.raw)
+              }
+            });
+          }
+          return { user, profile, isNewUser };
+        });
+      },
+      /**
+       * List social accounts linked to a user.
+       */
+      async getLinkedAccounts(userId) {
+        const accounts = await ctx.db.findMany({
+          model: "social_account",
+          where: [{ field: "userId", operator: "=", value: userId }]
+        });
+        return accounts.map((a) => ({
+          provider: a.provider,
+          providerAccountId: a.providerAccountId,
+          email: a.email
+        }));
+      },
+      /**
+       * Return decrypted provider tokens for a linked account.
+       */
+      async getProviderTokens(userId, provider) {
+        const account = await ctx.db.findOne({
+          model: "social_account",
+          where: [
+            { field: "userId", operator: "=", value: userId },
+            { field: "provider", operator: "=", value: provider }
+          ]
+        });
+        if (!account)
+          throw Errors.notFound("Linked social account not found");
+        return {
+          accessToken: await decryptToken(tokenEncryptionKey, account.accessToken),
+          refreshToken: await decryptToken(tokenEncryptionKey, account.refreshToken),
+          tokenExpiresAt: account.tokenExpiresAt
+        };
+      },
+      /**
+       * Unlink a social account from a user.
+       */
+      async unlinkAccount(userId, provider) {
+        await ctx.db.delete({
+          model: "social_account",
+          where: [
+            { field: "userId", operator: "=", value: userId },
+            { field: "provider", operator: "=", value: provider }
+          ]
+        });
+      },
+      /** Get list of configured provider names */
+      getProviders() {
+        return Array.from(providerMap.keys());
+      }
+    })
+  };
+}
+export {
+  socialLogin
+};