npm - @becklyn/deployment-protection - Versions diffs - 0.0.1 - Mend

@becklyn/deployment-protection 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (81) hide show

package/LICENSE +21 -0
package/README.md +158 -0
package/dist/cjs/bypass.d.ts +5 -0
package/dist/cjs/bypass.d.ts.map +1 -0
package/dist/cjs/bypass.js +51 -0
package/dist/cjs/config.d.ts +13 -0
package/dist/cjs/config.d.ts.map +1 -0
package/dist/cjs/config.js +68 -0
package/dist/cjs/constants.d.ts +15 -0
package/dist/cjs/constants.d.ts.map +1 -0
package/dist/cjs/constants.js +19 -0
package/dist/cjs/crypto.d.ts +7 -0
package/dist/cjs/crypto.d.ts.map +1 -0
package/dist/cjs/crypto.js +56 -0
package/dist/cjs/handler.d.ts +6 -0
package/dist/cjs/handler.d.ts.map +1 -0
package/dist/cjs/handler.js +212 -0
package/dist/cjs/index.d.ts +6 -0
package/dist/cjs/index.d.ts.map +1 -0
package/dist/cjs/index.js +17 -0
package/dist/cjs/login-page.d.ts +8 -0
package/dist/cjs/login-page.d.ts.map +1 -0
package/dist/cjs/login-page.js +176 -0
package/dist/cjs/middleware.d.ts +25 -0
package/dist/cjs/middleware.d.ts.map +1 -0
package/dist/cjs/middleware.js +63 -0
package/dist/cjs/password.d.ts +3 -0
package/dist/cjs/password.d.ts.map +1 -0
package/dist/cjs/password.js +12 -0
package/dist/cjs/safe-return-to.d.ts +8 -0
package/dist/cjs/safe-return-to.d.ts.map +1 -0
package/dist/cjs/safe-return-to.js +60 -0
package/dist/cjs/session.d.ts +11 -0
package/dist/cjs/session.d.ts.map +1 -0
package/dist/cjs/session.js +64 -0
package/dist/cjs/types.d.ts +35 -0
package/dist/cjs/types.d.ts.map +1 -0
package/dist/cjs/types.js +2 -0
package/dist/cjs/vercel-oauth.d.ts +30 -0
package/dist/cjs/vercel-oauth.d.ts.map +1 -0
package/dist/cjs/vercel-oauth.js +166 -0
package/dist/es/bypass.d.ts +5 -0
package/dist/es/bypass.d.ts.map +1 -0
package/dist/es/bypass.js +45 -0
package/dist/es/config.d.ts +13 -0
package/dist/es/config.d.ts.map +1 -0
package/dist/es/config.js +62 -0
package/dist/es/constants.d.ts +15 -0
package/dist/es/constants.d.ts.map +1 -0
package/dist/es/constants.js +16 -0
package/dist/es/crypto.d.ts +7 -0
package/dist/es/crypto.d.ts.map +1 -0
package/dist/es/crypto.js +48 -0
package/dist/es/handler.d.ts +6 -0
package/dist/es/handler.d.ts.map +1 -0
package/dist/es/handler.js +209 -0
package/dist/es/index.d.ts +6 -0
package/dist/es/index.d.ts.map +1 -0
package/dist/es/index.js +4 -0
package/dist/es/login-page.d.ts +8 -0
package/dist/es/login-page.d.ts.map +1 -0
package/dist/es/login-page.js +173 -0
package/dist/es/middleware.d.ts +25 -0
package/dist/es/middleware.d.ts.map +1 -0
package/dist/es/middleware.js +59 -0
package/dist/es/password.d.ts +3 -0
package/dist/es/password.d.ts.map +1 -0
package/dist/es/password.js +9 -0
package/dist/es/safe-return-to.d.ts +8 -0
package/dist/es/safe-return-to.d.ts.map +1 -0
package/dist/es/safe-return-to.js +57 -0
package/dist/es/session.d.ts +11 -0
package/dist/es/session.d.ts.map +1 -0
package/dist/es/session.js +59 -0
package/dist/es/types.d.ts +35 -0
package/dist/es/types.d.ts.map +1 -0
package/dist/es/types.js +1 -0
package/dist/es/vercel-oauth.d.ts +30 -0
package/dist/es/vercel-oauth.d.ts.map +1 -0
package/dist/es/vercel-oauth.js +156 -0
package/package.json +46 -0

package/dist/es/login-page.js ADDED Viewed

@@ -0,0 +1,173 @@
+import { VERCEL_AUTHORIZE_PATH } from "./constants";
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+export function renderLoginPage(config, options = {}) {
+    const returnTo = options.returnTo ?? "/";
+    const showPassword = options.showPassword ?? true;
+    const showVercel = options.showVercel ?? false;
+    const error = options.error ? `<p class="error">${escapeHtml(options.error)}</p>` : "";
+    const vercelButton = showVercel
+        ? `<a class="secondary" href="${VERCEL_AUTHORIZE_PATH}?return_to=${encodeURIComponent(returnTo)}">Sign in with Vercel</a>`
+        : "";
+    const passwordForm = showPassword
+        ? `
+      <form method="post" action="${escapeHtml(returnTo)}">
+        <input type="hidden" name="__becklyn_dp" value="1" />
+        <input type="hidden" name="return_to" value="${escapeHtml(returnTo)}" />
+        <label>
+          Username
+          <input name="username" type="text" autocomplete="username" required autofocus />
+        </label>
+        <label>
+          Password
+          <input name="password" type="password" autocomplete="current-password" required />
+        </label>
+        <button type="submit">Continue</button>
+      </form>`
+        : "";
+    const divider = showPassword && showVercel ? `<div class="divider"><span>or</span></div>` : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(config.formTitle)}</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      --bg: #0b0f19;
+      --card: #121826;
+      --text: #e8eefc;
+      --muted: #9aa8c7;
+      --accent: #3b82f6;
+      --border: #243044;
+      --error: #f87171;
+    }
+    @media (prefers-color-scheme: light) {
+      :root {
+        --bg: #f4f7fb;
+        --card: #ffffff;
+        --text: #0f172a;
+        --muted: #64748b;
+        --border: #e2e8f0;
+      }
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, sans-serif;
+      background:
+        radial-gradient(1200px 600px at 10% -10%, rgba(59,130,246,.25), transparent 60%),
+        radial-gradient(900px 500px at 100% 0%, rgba(14,165,233,.18), transparent 55%),
+        var(--bg);
+      color: var(--text);
+      padding: 24px;
+    }
+    .card {
+      width: min(100%, 420px);
+      background: color-mix(in srgb, var(--card) 92%, transparent);
+      border: 1px solid var(--border);
+      border-radius: 16px;
+      padding: 28px;
+      box-shadow: 0 20px 50px rgba(0,0,0,.25);
+      backdrop-filter: blur(8px);
+    }
+    h1 {
+      margin: 0 0 8px;
+      font-size: 1.35rem;
+      letter-spacing: -0.02em;
+    }
+    p {
+      margin: 0 0 20px;
+      color: var(--muted);
+      line-height: 1.5;
+      font-size: .95rem;
+    }
+    form { display: grid; gap: 14px; }
+    label {
+      display: grid;
+      gap: 6px;
+      font-size: .85rem;
+      color: var(--muted);
+    }
+    input {
+      width: 100%;
+      border: 1px solid var(--border);
+      border-radius: 10px;
+      padding: 12px 14px;
+      font: inherit;
+      color: var(--text);
+      background: transparent;
+    }
+    input:focus {
+      outline: 2px solid color-mix(in srgb, var(--accent) 55%, transparent);
+      border-color: var(--accent);
+    }
+    button, .secondary {
+      appearance: none;
+      border: 0;
+      border-radius: 10px;
+      padding: 12px 14px;
+      font: inherit;
+      font-weight: 600;
+      cursor: pointer;
+      text-align: center;
+      text-decoration: none;
+    }
+    button {
+      background: var(--accent);
+      color: white;
+    }
+    .secondary {
+      display: block;
+      background: transparent;
+      color: var(--text);
+      border: 1px solid var(--border);
+    }
+    .divider {
+      display: grid;
+      grid-template-columns: 1fr auto 1fr;
+      gap: 12px;
+      align-items: center;
+      margin: 18px 0;
+      color: var(--muted);
+      font-size: .8rem;
+      text-transform: uppercase;
+      letter-spacing: .08em;
+    }
+    .divider::before, .divider::after {
+      content: "";
+      height: 1px;
+      background: var(--border);
+    }
+    .error {
+      color: var(--error);
+      background: color-mix(in srgb, var(--error) 12%, transparent);
+      border: 1px solid color-mix(in srgb, var(--error) 35%, transparent);
+      border-radius: 10px;
+      padding: 10px 12px;
+      margin: 0 0 16px;
+    }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <h1>${escapeHtml(config.formTitle)}</h1>
+    <p>${escapeHtml(config.formDescription)}</p>
+    ${error}
+    ${passwordForm}
+    ${divider}
+    ${vercelButton}
+  </main>
+</body>
+</html>`;
+}

package/dist/es/middleware.d.ts ADDED Viewed

@@ -0,0 +1,25 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { deploymentProtectionMatcher } from "./constants";
+import type { DeploymentProtectionOptions } from "./types";
+type NextMiddleware = (request: NextRequest, event?: unknown) => Response | NextResponse | Promise<Response | NextResponse | undefined | void> | undefined | void;
+export type WithDeploymentProtectionArgs = [] | [DeploymentProtectionOptions] | [NextMiddleware] | [NextMiddleware, DeploymentProtectionOptions];
+/**
+ * Next.js middleware / proxy wrapper.
+ *
+ * @example middleware.ts (Next ≤15)
+ * ```ts
+ * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * export default withDeploymentProtection();
+ * export const config = { matcher: deploymentProtectionMatcher };
+ * ```
+ *
+ * @example proxy.ts (Next 16+)
+ * ```ts
+ * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * export const proxy = withDeploymentProtection();
+ * export const config = { matcher: deploymentProtectionMatcher };
+ * ```
+ */
+export declare function withDeploymentProtection(...args: WithDeploymentProtectionArgs): (request: NextRequest, event?: unknown) => Promise<Response | NextResponse>;
+export { deploymentProtectionMatcher };
+//# sourceMappingURL=middleware.d.ts.map

package/dist/es/middleware.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AAWpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CAmBtC;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAC"}

package/dist/es/middleware.js ADDED Viewed

@@ -0,0 +1,59 @@
+import { NextResponse } from "next/server";
+import { deploymentProtectionMatcher } from "./constants";
+import { handleDeploymentProtection } from "./handler";
+function isOptions(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        typeof value !== "function");
+}
+/**
+ * Next.js middleware / proxy wrapper.
+ *
+ * @example middleware.ts (Next ≤15)
+ * ```ts
+ * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * export default withDeploymentProtection();
+ * export const config = { matcher: deploymentProtectionMatcher };
+ * ```
+ *
+ * @example proxy.ts (Next 16+)
+ * ```ts
+ * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * export const proxy = withDeploymentProtection();
+ * export const config = { matcher: deploymentProtectionMatcher };
+ * ```
+ */
+export function withDeploymentProtection(...args) {
+    let next;
+    let options = {};
+    if (args.length === 1) {
+        if (typeof args[0] === "function") {
+            next = args[0];
+        }
+        else if (isOptions(args[0])) {
+            options = args[0];
+        }
+    }
+    else if (args.length === 2) {
+        next = args[0];
+        options = args[1] ?? {};
+    }
+    return async function deploymentProtectionMiddleware(request, event) {
+        const protectionResponse = await handleDeploymentProtection(request, options);
+        if (protectionResponse) {
+            // Preserve NextResponse subclass when possible
+            return new NextResponse(protectionResponse.body, {
+                status: protectionResponse.status,
+                statusText: protectionResponse.statusText,
+                headers: protectionResponse.headers,
+            });
+        }
+        if (next) {
+            const result = await next(request, event);
+            return result ?? NextResponse.next();
+        }
+        return NextResponse.next();
+    };
+}
+export { deploymentProtectionMatcher };

package/dist/es/password.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import type { DeploymentProtectionConfig } from "./types";
+export declare function validatePasswordCredentials(config: DeploymentProtectionConfig, username: string, password: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/es/password.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/password.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,wBAAsB,2BAA2B,CAC7C,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAQlB"}

package/dist/es/password.js ADDED Viewed

@@ -0,0 +1,9 @@
+import { timingSafeEqualString } from "./crypto";
+export async function validatePasswordCredentials(config, username, password) {
+    if (!config.username || !config.password) {
+        return false;
+    }
+    const userOk = await timingSafeEqualString(username, config.username);
+    const passOk = await timingSafeEqualString(password, config.password);
+    return userOk && passOk;
+}

package/dist/es/safe-return-to.d.ts ADDED Viewed

@@ -0,0 +1,8 @@
+/**
+ * Sanitize a post-login redirect target so it can never leave the current origin.
+ *
+ * Browsers treat `\` like `/` in URL resolution, so values such as `/\evil.com`
+ * must be rejected in addition to classic `//evil.com` protocol-relative URLs.
+ */
+export declare function safeReturnTo(value: string | null | undefined, fallback?: string): string;
+//# sourceMappingURL=safe-return-to.d.ts.map

package/dist/es/safe-return-to.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"safe-return-to.d.ts","sourceRoot":"","sources":["../../src/safe-return-to.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,SAAM,GAAG,MAAM,CAiDrF"}

package/dist/es/safe-return-to.js ADDED Viewed

@@ -0,0 +1,57 @@
+function hasUnsafeCharacters(value) {
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        // Control chars, DEL, and any Unicode whitespace (incl. regular space).
+        if (code <= 0x1f || code === 0x7f || /\s/.test(value[i])) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Sanitize a post-login redirect target so it can never leave the current origin.
+ *
+ * Browsers treat `\` like `/` in URL resolution, so values such as `/\evil.com`
+ * must be rejected in addition to classic `//evil.com` protocol-relative URLs.
+ */
+export function safeReturnTo(value, fallback = "/") {
+    if (typeof value !== "string" || value.length === 0 || value.length > 2048) {
+        return fallback;
+    }
+    // Fast reject before any decoding / URL parsing.
+    if (!value.startsWith("/") ||
+        value.startsWith("//") ||
+        value.includes("\\") ||
+        hasUnsafeCharacters(value) ||
+        /%5c/i.test(value) || // encoded backslash
+        /%00/i.test(value)) {
+        return fallback;
+    }
+    let decoded;
+    try {
+        // Decode once to catch encoded protocol-relative / backslash payloads.
+        decoded = decodeURIComponent(value);
+    }
+    catch {
+        return fallback;
+    }
+    if (!decoded.startsWith("/") ||
+        decoded.startsWith("//") ||
+        decoded.includes("\\") ||
+        hasUnsafeCharacters(decoded)) {
+        return fallback;
+    }
+    try {
+        const base = "https://safe.invalid";
+        // URL parser normalizes `\` → `/`; reject if that escapes our origin.
+        const url = new URL(decoded, base);
+        if (url.origin !== base || url.username || url.password) {
+            return fallback;
+        }
+        const sanitized = `${url.pathname}${url.search}${url.hash}`;
+        return sanitized.startsWith("/") && !sanitized.startsWith("//") ? sanitized : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}

package/dist/es/session.d.ts ADDED Viewed

@@ -0,0 +1,11 @@
+import type { AuthMethod, SessionPayload } from "./types";
+export declare function createSessionToken(secret: string, method: AuthMethod, subject: string, ttlSeconds: number): Promise<string>;
+export declare function verifySessionToken(secret: string, token: string | undefined | null): Promise<SessionPayload | null>;
+export declare function sessionCookieOptions(maxAge: number, secure: boolean): {
+    httpOnly: boolean;
+    sameSite: "lax";
+    secure: boolean;
+    path: string;
+    maxAge: number;
+};
+//# sourceMappingURL=session.d.ts.map

package/dist/es/session.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAyB1D,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA4BhC;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;;;;;;EAQnE"}

package/dist/es/session.js ADDED Viewed

@@ -0,0 +1,59 @@
+import { base64UrlToBytes, bytesToBase64Url, hmacSign, timingSafeEqualString } from "./crypto";
+function encodePayload(payload) {
+    return bytesToBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+}
+function decodePayload(encoded) {
+    try {
+        const json = new TextDecoder().decode(base64UrlToBytes(encoded));
+        const parsed = JSON.parse(json);
+        if (typeof parsed.exp !== "number" ||
+            typeof parsed.method !== "string" ||
+            typeof parsed.subject !== "string") {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export async function createSessionToken(secret, method, subject, ttlSeconds) {
+    const payload = {
+        exp: Math.floor(Date.now() / 1000) + ttlSeconds,
+        method,
+        subject,
+    };
+    const body = encodePayload(payload);
+    const signature = await hmacSign(secret, body);
+    return `${body}.${signature}`;
+}
+export async function verifySessionToken(secret, token) {
+    if (!token) {
+        return null;
+    }
+    const [body, signature] = token.split(".");
+    if (!body || !signature) {
+        return null;
+    }
+    const expected = await hmacSign(secret, body);
+    if (!(await timingSafeEqualString(signature, expected))) {
+        return null;
+    }
+    const payload = decodePayload(body);
+    if (!payload) {
+        return null;
+    }
+    if (payload.exp < Math.floor(Date.now() / 1000)) {
+        return null;
+    }
+    return payload;
+}
+export function sessionCookieOptions(maxAge, secure) {
+    return {
+        httpOnly: true,
+        sameSite: "lax",
+        secure,
+        path: "/",
+        maxAge,
+    };
+}

package/dist/es/types.d.ts ADDED Viewed

@@ -0,0 +1,35 @@
+export type AuthMethod = "password" | "vercel" | "bypass";
+export interface DeploymentProtectionConfig {
+    enabled: boolean;
+    username: string | null;
+    password: string | null;
+    secret: string | null;
+    bypassSecret: string | null;
+    vercelClientId: string | null;
+    vercelClientSecret: string | null;
+    sessionTtlSeconds: number;
+    formTitle: string;
+    formDescription: string;
+}
+export interface FormOptions {
+    title?: string;
+    description?: string;
+}
+export interface DeploymentProtectionOptions {
+    /**
+     * Optional env override (useful for tests).
+     * Merged over `process.env`.
+     */
+    env?: Record<string, string | undefined>;
+    /** Customize the built-in login form copy. */
+    form?: FormOptions;
+    /** Session lifetime in seconds (default 14 days). */
+    sessionTtlSeconds?: number;
+}
+export interface SessionPayload {
+    exp: number;
+    method: AuthMethod;
+    subject: string;
+}
+export type EnvMap = Record<string, string | undefined>;
+//# sourceMappingURL=types.d.ts.map

package/dist/es/types.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1D,MAAM,WAAW,0BAA0B;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC"}

package/dist/es/types.js ADDED Viewed

	@@ -0,0 +1 @@
1	+ export {};

package/dist/es/vercel-oauth.d.ts ADDED Viewed

@@ -0,0 +1,30 @@
+import type { DeploymentProtectionConfig } from "./types";
+export interface VercelTokenResponse {
+    access_token: string;
+    token_type: string;
+    id_token?: string;
+    expires_in: number;
+    scope?: string;
+    refresh_token?: string;
+}
+export interface VercelUserInfo {
+    sub?: string;
+    name?: string;
+    email?: string;
+    preferred_username?: string;
+}
+export declare function buildVercelAuthorizeRedirect(request: Request, config: DeploymentProtectionConfig, returnTo: string): Promise<Response>;
+export declare function exchangeVercelCode(request: Request, config: DeploymentProtectionConfig, code: string, codeVerifier: string): Promise<VercelTokenResponse>;
+export declare function fetchVercelUserInfo(accessToken: string): Promise<VercelUserInfo>;
+export declare function readCookie(request: Request, name: string): string | null;
+export declare function assertOAuthState(request: Request, state: string | null): Promise<boolean>;
+export declare function decodeIdTokenNonce(idToken: string | undefined): string | null;
+export declare function clearOAuthCookies(response: Response, secure: boolean): void;
+export declare function appendSetCookie(response: Response, name: string, value: string, options: {
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: "lax" | "strict" | "none";
+    path?: string;
+    maxAge?: number;
+}): void;
+//# sourceMappingURL=vercel-oauth.d.ts.map

package/dist/es/vercel-oauth.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"vercel-oauth.d.ts","sourceRoot":"","sources":["../../src/vercel-oauth.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAYD,wBAAsB,4BAA4B,CAC9C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACrB,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAYtF;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqB7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAiB3E;AAED,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACL,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,GACF,IAAI,CAwBN"}

package/dist/es/vercel-oauth.js ADDED Viewed

@@ -0,0 +1,156 @@
+import { OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_STATE_COOKIE, OAUTH_VERIFIER_COOKIE, VERCEL_CALLBACK_PATH, } from "./constants";
+import { randomToken, sha256Base64Url, timingSafeEqualString } from "./crypto";
+function cookieOptions(secure) {
+    return {
+        httpOnly: true,
+        sameSite: "lax",
+        secure,
+        path: "/",
+        maxAge: 10 * 60,
+    };
+}
+export async function buildVercelAuthorizeRedirect(request, config, returnTo) {
+    if (!config.vercelClientId) {
+        return new Response("Vercel OAuth is not configured", { status: 500 });
+    }
+    const state = randomToken(32);
+    const nonce = randomToken(32);
+    const codeVerifier = randomToken(48);
+    const codeChallenge = await sha256Base64Url(codeVerifier);
+    const origin = new URL(request.url).origin;
+    const redirectUri = `${origin}${VERCEL_CALLBACK_PATH}`;
+    const secure = origin.startsWith("https://");
+    const params = new URLSearchParams({
+        client_id: config.vercelClientId,
+        redirect_uri: redirectUri,
+        state,
+        nonce,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+        response_type: "code",
+        scope: "openid email profile",
+    });
+    const response = new Response(null, {
+        status: 302,
+        headers: {
+            Location: `https://vercel.com/oauth/authorize?${params.toString()}`,
+        },
+    });
+    const opts = cookieOptions(secure);
+    appendSetCookie(response, OAUTH_STATE_COOKIE, state, opts);
+    appendSetCookie(response, OAUTH_NONCE_COOKIE, nonce, opts);
+    appendSetCookie(response, OAUTH_VERIFIER_COOKIE, codeVerifier, opts);
+    appendSetCookie(response, OAUTH_RETURN_COOKIE, returnTo || "/", opts);
+    return response;
+}
+export async function exchangeVercelCode(request, config, code, codeVerifier) {
+    if (!config.vercelClientId || !config.vercelClientSecret) {
+        throw new Error("Vercel OAuth is not configured");
+    }
+    const origin = new URL(request.url).origin;
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: config.vercelClientId,
+        client_secret: config.vercelClientSecret,
+        code,
+        code_verifier: codeVerifier,
+        redirect_uri: `${origin}${VERCEL_CALLBACK_PATH}`,
+    });
+    const response = await fetch("https://api.vercel.com/login/oauth/token", {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Token exchange failed: ${errorText}`);
+    }
+    return (await response.json());
+}
+export async function fetchVercelUserInfo(accessToken) {
+    const response = await fetch("https://api.vercel.com/login/oauth/userinfo", {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error("Failed to load Vercel user info");
+    }
+    return (await response.json());
+}
+export function readCookie(request, name) {
+    const cookieHeader = request.headers.get("cookie");
+    if (!cookieHeader) {
+        return null;
+    }
+    for (const part of cookieHeader.split(";")) {
+        const [rawName, ...rest] = part.trim().split("=");
+        if (rawName === name) {
+            return decodeURIComponent(rest.join("="));
+        }
+    }
+    return null;
+}
+export async function assertOAuthState(request, state) {
+    const stored = readCookie(request, OAUTH_STATE_COOKIE);
+    if (!state || !stored) {
+        return false;
+    }
+    return timingSafeEqualString(state, stored);
+}
+export function decodeIdTokenNonce(idToken) {
+    if (!idToken) {
+        return null;
+    }
+    const parts = idToken.split(".");
+    const payload = parts[1];
+    if (!payload) {
+        return null;
+    }
+    try {
+        const padded = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const padLength = (4 - (padded.length % 4)) % 4;
+        const json = atob(padded + "=".repeat(padLength));
+        const data = JSON.parse(json);
+        return data.nonce ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export function clearOAuthCookies(response, secure) {
+    const expired = {
+        httpOnly: true,
+        sameSite: "lax",
+        secure,
+        path: "/",
+        maxAge: 0,
+    };
+    for (const name of [
+        OAUTH_STATE_COOKIE,
+        OAUTH_NONCE_COOKIE,
+        OAUTH_VERIFIER_COOKIE,
+        OAUTH_RETURN_COOKIE,
+    ]) {
+        appendSetCookie(response, name, "", expired);
+    }
+}
+export function appendSetCookie(response, name, value, options) {
+    const parts = [`${name}=${encodeURIComponent(value)}`];
+    if (options.maxAge !== undefined) {
+        parts.push(`Max-Age=${options.maxAge}`);
+    }
+    parts.push(`Path=${options.path ?? "/"}`);
+    if (options.httpOnly) {
+        parts.push("HttpOnly");
+    }
+    if (options.secure) {
+        parts.push("Secure");
+    }
+    if (options.sameSite) {
+        parts.push(`SameSite=${options.sameSite === "none" ? "None" : options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`);
+    }
+    response.headers.append("Set-Cookie", parts.join("; "));
+}