@block-auth.io/node 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,33 @@
-# Temporary Holding Version
+# @block-auth.io/node
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Block-Auth backend SDK for Node.js 18+. It redeems the login code of the Block-Auth widget, keeps the
+session in your server and verifies the Block-Auth webhooks.
+
+```bash
+npm install @block-auth.io/node express express-session
+```
+
+```js
+import express from 'express'
+import session from 'express-session'
+import { BlockAuthRoutes } from '@block-auth.io/node'
+import { blockauthRouter } from '@block-auth.io/node/express'
+
+const routes = new BlockAuthRoutes({
+  apiKey: process.env.BLOCKAUTH_API_KEY,
+  apiSecret: process.env.BLOCKAUTH_API_SECRET,
+  appUrl: process.env.APP_URL,
+})
+
+const app = express()
+app.use(session({ secret: process.env.SESSION_SECRET, resave: false, saveUninitialized: false, cookie: { httpOnly: true, sameSite: 'lax', secure: true } }))
+app.use(blockauthRouter(routes))
+```
+
+This serves `POST /code`, `GET /me`, `POST /logout`, `GET|POST /link` and `POST /webhook` under
+`/auth/blockauth`, the default `authEndpoint` of the Block-Auth widget. Mount `blockauthRouter` before
+`express.json()` so the webhook signature is checked against the raw body.
+
+All the options (allowed origins, session duration, base path, enabled routes and the `onLogin`,
+`onLogout`, `appUser`, `onLinked`, `onSignout`, `onUnlinked`, `isReplay` and `isRevoked` hooks) and
+the manual integration with `AuthCodeClient` are in the [documentation](https://docs.block-auth.io/).

package/dist/express.cjs

@@ -0,0 +1,71 @@
+'use strict';
+
+var express = require('express');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var express__default = /*#__PURE__*/_interopDefault(express);
+
+// src/express.ts
+var MAX_BODY = "64kb";
+function sessionOf(req) {
+  const session = req.session;
+  if (!session || typeof session.regenerate !== "function") {
+    throw new Error("Block-Auth routes need express-session (or a compatible req.session) before blockauthRouter");
+  }
+  return session;
+}
+function expressSessionStore(req) {
+  return {
+    get: (key) => sessionOf(req)[key],
+    set: (key, value) => {
+      sessionOf(req)[key] = value;
+    },
+    remove: (key) => {
+      delete sessionOf(req)[key];
+    },
+    regenerate: () => new Promise((resolve, reject) => {
+      const { cookie: _cookie, regenerate: _regenerate, ...kept } = sessionOf(req);
+      sessionOf(req).regenerate((err) => {
+        if (err) return reject(err);
+        Object.assign(sessionOf(req), kept);
+        resolve();
+      });
+    })
+  };
+}
+function rawBodyOf(req, isWebhook) {
+  if (Buffer.isBuffer(req.body)) return req.body;
+  if (req.body && typeof req.body === "object" && Object.keys(req.body).length > 0) {
+    if (isWebhook) {
+      throw new Error("Mount blockauthRouter before express.json(): the webhook signature needs the raw body");
+    }
+    return Buffer.from(JSON.stringify(req.body), "utf8");
+  }
+  return Buffer.alloc(0);
+}
+function sendRouteResponse(res, result) {
+  res.status(result.status).set("Cache-Control", "no-store").json(result.body);
+}
+function blockauthRouter(routes, session = expressSessionStore) {
+  const router = express__default.default.Router();
+  router.use(routes.basePath, express__default.default.raw({ type: () => true, limit: MAX_BODY }), async (req, res, next) => {
+    try {
+      const path = routes.basePath + req.path;
+      const rawBody = rawBodyOf(req, path === `${routes.basePath}/webhook`);
+      const context = { session: session(req), request: req };
+      const result = await routes.dispatch(req.method, path, rawBody, (name) => req.get(name), context);
+      if (!result) return next();
+      sendRouteResponse(res, result);
+    } catch (err) {
+      next(err);
+    }
+  });
+  return router;
+}
+
+exports.blockauthRouter = blockauthRouter;
+exports.expressSessionStore = expressSessionStore;
+exports.sendRouteResponse = sendRouteResponse;
+//# sourceMappingURL=express.cjs.map
+//# sourceMappingURL=express.cjs.map

package/dist/express.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/express.ts"],"names":["express"],"mappings":";;;;;;;;;AAIA,IAAM,QAAA,GAAW,MAAA;AAOjB,SAAS,UAAU,GAAA,EAA2B;AAC5C,EAAA,MAAM,UAAW,GAAA,CAA4C,OAAA;AAC7D,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,CAAQ,eAAe,UAAA,EAAY;AACxD,IAAA,MAAM,IAAI,MAAM,6FAA6F,CAAA;AAAA,EAC/G;AACA,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,oBAAoB,GAAA,EAA4B;AAC9D,EAAA,OAAO;AAAA,IACL,KAAK,CAAC,GAAA,KAAQ,SAAA,CAAU,GAAG,EAAE,GAAG,CAAA;AAAA,IAChC,GAAA,EAAK,CAAC,GAAA,EAAK,KAAA,KAAU;AACnB,MAAA,SAAA,CAAU,GAAG,CAAA,CAAE,GAAG,CAAA,GAAI,KAAA;AAAA,IACxB,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,GAAA,KAAQ;AACf,MAAA,OAAO,SAAA,CAAU,GAAG,CAAA,CAAE,GAAG,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,YAAY,MACV,IAAI,OAAA,CAAc,CAAC,SAAS,MAAA,KAAW;AACrC,MAAA,MAAM,EAAE,QAAQ,OAAA,EAAS,UAAA,EAAY,aAAa,GAAG,IAAA,EAAK,GAAI,SAAA,CAAU,GAAG,CAAA;AAC3E,MAAA,SAAA,CAAU,GAAG,CAAA,CAAE,UAAA,CAAW,CAAC,GAAA,KAAQ;AACjC,QAAA,IAAI,GAAA,EAAK,OAAO,MAAA,CAAO,GAAG,CAAA;AAC1B,QAAA,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,GAAG,CAAA,EAAG,IAAI,CAAA;AAClC,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC;AAAA,GACL;AACF;AAEA,SAAS,SAAA,CAAU,KAAc,SAAA,EAA4B;AAC3D,EAAA,IAAI,OAAO,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,SAAU,GAAA,CAAI,IAAA;AAC1C,EAAA,IAAI,GAAA,CAAI,IAAA,IAAQ,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,CAAE,MAAA,GAAS,CAAA,EAAG;AAChF,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,IAAI,MAAM,uFAAuF,CAAA;AAAA,IACzG;AACA,IAAA,OAAO,OAAO,IAAA,CAAK,IAAA,CAAK,UAAU,GAAA,CAAI,IAAI,GAAG,MAAM,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,MAAA,CAAO,MAAM,CAAC,CAAA;AACvB;AAEO,SAAS,iBAAA,CAAkB,KAAe,MAAA,EAA6B;AAC5E,EAAA,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,GAAA,CAAI,iBAAiB,UAAU,CAAA,CAAE,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA;AAC7E;AAEO,SAAS,eAAA,CACd,MAAA,EACA,OAAA,GAA0C,mBAAA,EAClC;AACR,EAAA,MAAM,MAAA,GAASA,yBAAQ,MAAA,EAAO;AAC9B,EAAA,MAAA,CAAO,IAAI,MAAA,CAAO,QAAA,EAAUA,wBAAA,CAAQ,GAAA,CAAI,EAAE,IAAA,EAAM,MAAM,IAAA,EAAM,KAAA,EAAO,UAAU,CAAA,EAAG,OAAO,GAAA,EAAK,KAAK,IAAA,KAAS;AACxG,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,GAAW,GAAA,CAAI,IAAA;AACnC,MAAA,MAAM,UAAU,SAAA,CAAU,GAAA,EAAK,SAAS,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,QAAA,CAAU,CAAA;AACpE,MAAA,MAAM,UAAwB,EAAE,OAAA,EAAS,QAAQ,GAAG,CAAA,EAAG,SAAS,GAAA,EAAI;AACpE,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,QAAA,CAAS,IAAI,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,IAAA,KAAS,GAAA,CAAI,GAAA,CAAI,IAAI,GAAG,OAAO,CAAA;AAChG,MAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,IAAA,EAAK;AACzB,MAAA,iBAAA,CAAkB,KAAK,MAAM,CAAA;AAAA,IAC/B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV;AAAA,EACF,CAAC,CAAA;AACD,EAAA,OAAO,MAAA;AACT","file":"express.cjs","sourcesContent":["import express, { type Request, type Response, type Router } from 'express';\n\nimport { type BlockAuthRoutes, type RouteContext, type RouteResponse, type SessionStore } from './routes';\n\nconst MAX_BODY = '64kb';\n\ntype SessionData = Record<string, unknown> & {\n  regenerate(callback: (err?: unknown) => void): void;\n  cookie?: unknown;\n};\n\nfunction sessionOf(req: Request): SessionData {\n  const session = (req as Request & { session?: SessionData }).session;\n  if (!session || typeof session.regenerate !== 'function') {\n    throw new Error('Block-Auth routes need express-session (or a compatible req.session) before blockauthRouter');\n  }\n  return session;\n}\n\nexport function expressSessionStore(req: Request): SessionStore {\n  return {\n    get: (key) => sessionOf(req)[key],\n    set: (key, value) => {\n      sessionOf(req)[key] = value;\n    },\n    remove: (key) => {\n      delete sessionOf(req)[key];\n    },\n    regenerate: () =>\n      new Promise<void>((resolve, reject) => {\n        const { cookie: _cookie, regenerate: _regenerate, ...kept } = sessionOf(req);\n        sessionOf(req).regenerate((err) => {\n          if (err) return reject(err);\n          Object.assign(sessionOf(req), kept);\n          resolve();\n        });\n      }),\n  };\n}\n\nfunction rawBodyOf(req: Request, isWebhook: boolean): Buffer {\n  if (Buffer.isBuffer(req.body)) return req.body;\n  if (req.body && typeof req.body === 'object' && Object.keys(req.body).length > 0) {\n    if (isWebhook) {\n      throw new Error('Mount blockauthRouter before express.json(): the webhook signature needs the raw body');\n    }\n    return Buffer.from(JSON.stringify(req.body), 'utf8');\n  }\n  return Buffer.alloc(0);\n}\n\nexport function sendRouteResponse(res: Response, result: RouteResponse): void {\n  res.status(result.status).set('Cache-Control', 'no-store').json(result.body);\n}\n\nexport function blockauthRouter(\n  routes: BlockAuthRoutes,\n  session: (req: Request) => SessionStore = expressSessionStore,\n): Router {\n  const router = express.Router();\n  router.use(routes.basePath, express.raw({ type: () => true, limit: MAX_BODY }), async (req, res, next) => {\n    try {\n      const path = routes.basePath + req.path;\n      const rawBody = rawBodyOf(req, path === `${routes.basePath}/webhook`);\n      const context: RouteContext = { session: session(req), request: req };\n      const result = await routes.dispatch(req.method, path, rawBody, (name) => req.get(name), context);\n      if (!result) return next();\n      sendRouteResponse(res, result);\n    } catch (err) {\n      next(err);\n    }\n  });\n  return router;\n}\n"]}

package/dist/express.d.cts

@@ -0,0 +1,8 @@
+import { Request, Router, Response } from 'express';
+import { B as BlockAuthRoutes, S as SessionStore, R as RouteResponse } from './routes-DR0gMSlM.cjs';
+
+declare function expressSessionStore(req: Request): SessionStore;
+declare function sendRouteResponse(res: Response, result: RouteResponse): void;
+declare function blockauthRouter(routes: BlockAuthRoutes, session?: (req: Request) => SessionStore): Router;
+
+export { blockauthRouter, expressSessionStore, sendRouteResponse };

package/dist/express.d.ts

@@ -0,0 +1,8 @@
+import { Request, Router, Response } from 'express';
+import { B as BlockAuthRoutes, S as SessionStore, R as RouteResponse } from './routes-DR0gMSlM.js';
+
+declare function expressSessionStore(req: Request): SessionStore;
+declare function sendRouteResponse(res: Response, result: RouteResponse): void;
+declare function blockauthRouter(routes: BlockAuthRoutes, session?: (req: Request) => SessionStore): Router;
+
+export { blockauthRouter, expressSessionStore, sendRouteResponse };

package/dist/express.js

@@ -0,0 +1,63 @@
+import express from 'express';
+
+// src/express.ts
+var MAX_BODY = "64kb";
+function sessionOf(req) {
+  const session = req.session;
+  if (!session || typeof session.regenerate !== "function") {
+    throw new Error("Block-Auth routes need express-session (or a compatible req.session) before blockauthRouter");
+  }
+  return session;
+}
+function expressSessionStore(req) {
+  return {
+    get: (key) => sessionOf(req)[key],
+    set: (key, value) => {
+      sessionOf(req)[key] = value;
+    },
+    remove: (key) => {
+      delete sessionOf(req)[key];
+    },
+    regenerate: () => new Promise((resolve, reject) => {
+      const { cookie: _cookie, regenerate: _regenerate, ...kept } = sessionOf(req);
+      sessionOf(req).regenerate((err) => {
+        if (err) return reject(err);
+        Object.assign(sessionOf(req), kept);
+        resolve();
+      });
+    })
+  };
+}
+function rawBodyOf(req, isWebhook) {
+  if (Buffer.isBuffer(req.body)) return req.body;
+  if (req.body && typeof req.body === "object" && Object.keys(req.body).length > 0) {
+    if (isWebhook) {
+      throw new Error("Mount blockauthRouter before express.json(): the webhook signature needs the raw body");
+    }
+    return Buffer.from(JSON.stringify(req.body), "utf8");
+  }
+  return Buffer.alloc(0);
+}
+function sendRouteResponse(res, result) {
+  res.status(result.status).set("Cache-Control", "no-store").json(result.body);
+}
+function blockauthRouter(routes, session = expressSessionStore) {
+  const router = express.Router();
+  router.use(routes.basePath, express.raw({ type: () => true, limit: MAX_BODY }), async (req, res, next) => {
+    try {
+      const path = routes.basePath + req.path;
+      const rawBody = rawBodyOf(req, path === `${routes.basePath}/webhook`);
+      const context = { session: session(req), request: req };
+      const result = await routes.dispatch(req.method, path, rawBody, (name) => req.get(name), context);
+      if (!result) return next();
+      sendRouteResponse(res, result);
+    } catch (err) {
+      next(err);
+    }
+  });
+  return router;
+}
+
+export { blockauthRouter, expressSessionStore, sendRouteResponse };
+//# sourceMappingURL=express.js.map
+//# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/express.ts"],"names":[],"mappings":";;;AAIA,IAAM,QAAA,GAAW,MAAA;AAOjB,SAAS,UAAU,GAAA,EAA2B;AAC5C,EAAA,MAAM,UAAW,GAAA,CAA4C,OAAA;AAC7D,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,CAAQ,eAAe,UAAA,EAAY;AACxD,IAAA,MAAM,IAAI,MAAM,6FAA6F,CAAA;AAAA,EAC/G;AACA,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,oBAAoB,GAAA,EAA4B;AAC9D,EAAA,OAAO;AAAA,IACL,KAAK,CAAC,GAAA,KAAQ,SAAA,CAAU,GAAG,EAAE,GAAG,CAAA;AAAA,IAChC,GAAA,EAAK,CAAC,GAAA,EAAK,KAAA,KAAU;AACnB,MAAA,SAAA,CAAU,GAAG,CAAA,CAAE,GAAG,CAAA,GAAI,KAAA;AAAA,IACxB,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,GAAA,KAAQ;AACf,MAAA,OAAO,SAAA,CAAU,GAAG,CAAA,CAAE,GAAG,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,YAAY,MACV,IAAI,OAAA,CAAc,CAAC,SAAS,MAAA,KAAW;AACrC,MAAA,MAAM,EAAE,QAAQ,OAAA,EAAS,UAAA,EAAY,aAAa,GAAG,IAAA,EAAK,GAAI,SAAA,CAAU,GAAG,CAAA;AAC3E,MAAA,SAAA,CAAU,GAAG,CAAA,CAAE,UAAA,CAAW,CAAC,GAAA,KAAQ;AACjC,QAAA,IAAI,GAAA,EAAK,OAAO,MAAA,CAAO,GAAG,CAAA;AAC1B,QAAA,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,GAAG,CAAA,EAAG,IAAI,CAAA;AAClC,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC;AAAA,GACL;AACF;AAEA,SAAS,SAAA,CAAU,KAAc,SAAA,EAA4B;AAC3D,EAAA,IAAI,OAAO,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,SAAU,GAAA,CAAI,IAAA;AAC1C,EAAA,IAAI,GAAA,CAAI,IAAA,IAAQ,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,CAAE,MAAA,GAAS,CAAA,EAAG;AAChF,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,IAAI,MAAM,uFAAuF,CAAA;AAAA,IACzG;AACA,IAAA,OAAO,OAAO,IAAA,CAAK,IAAA,CAAK,UAAU,GAAA,CAAI,IAAI,GAAG,MAAM,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,MAAA,CAAO,MAAM,CAAC,CAAA;AACvB;AAEO,SAAS,iBAAA,CAAkB,KAAe,MAAA,EAA6B;AAC5E,EAAA,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,GAAA,CAAI,iBAAiB,UAAU,CAAA,CAAE,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA;AAC7E;AAEO,SAAS,eAAA,CACd,MAAA,EACA,OAAA,GAA0C,mBAAA,EAClC;AACR,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,EAAO;AAC9B,EAAA,MAAA,CAAO,IAAI,MAAA,CAAO,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,EAAE,IAAA,EAAM,MAAM,IAAA,EAAM,KAAA,EAAO,UAAU,CAAA,EAAG,OAAO,GAAA,EAAK,KAAK,IAAA,KAAS;AACxG,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,GAAW,GAAA,CAAI,IAAA;AACnC,MAAA,MAAM,UAAU,SAAA,CAAU,GAAA,EAAK,SAAS,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,QAAA,CAAU,CAAA;AACpE,MAAA,MAAM,UAAwB,EAAE,OAAA,EAAS,QAAQ,GAAG,CAAA,EAAG,SAAS,GAAA,EAAI;AACpE,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,QAAA,CAAS,IAAI,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAC,IAAA,KAAS,GAAA,CAAI,GAAA,CAAI,IAAI,GAAG,OAAO,CAAA;AAChG,MAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,IAAA,EAAK;AACzB,MAAA,iBAAA,CAAkB,KAAK,MAAM,CAAA;AAAA,IAC/B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV;AAAA,EACF,CAAC,CAAA;AACD,EAAA,OAAO,MAAA;AACT","file":"express.js","sourcesContent":["import express, { type Request, type Response, type Router } from 'express';\n\nimport { type BlockAuthRoutes, type RouteContext, type RouteResponse, type SessionStore } from './routes';\n\nconst MAX_BODY = '64kb';\n\ntype SessionData = Record<string, unknown> & {\n  regenerate(callback: (err?: unknown) => void): void;\n  cookie?: unknown;\n};\n\nfunction sessionOf(req: Request): SessionData {\n  const session = (req as Request & { session?: SessionData }).session;\n  if (!session || typeof session.regenerate !== 'function') {\n    throw new Error('Block-Auth routes need express-session (or a compatible req.session) before blockauthRouter');\n  }\n  return session;\n}\n\nexport function expressSessionStore(req: Request): SessionStore {\n  return {\n    get: (key) => sessionOf(req)[key],\n    set: (key, value) => {\n      sessionOf(req)[key] = value;\n    },\n    remove: (key) => {\n      delete sessionOf(req)[key];\n    },\n    regenerate: () =>\n      new Promise<void>((resolve, reject) => {\n        const { cookie: _cookie, regenerate: _regenerate, ...kept } = sessionOf(req);\n        sessionOf(req).regenerate((err) => {\n          if (err) return reject(err);\n          Object.assign(sessionOf(req), kept);\n          resolve();\n        });\n      }),\n  };\n}\n\nfunction rawBodyOf(req: Request, isWebhook: boolean): Buffer {\n  if (Buffer.isBuffer(req.body)) return req.body;\n  if (req.body && typeof req.body === 'object' && Object.keys(req.body).length > 0) {\n    if (isWebhook) {\n      throw new Error('Mount blockauthRouter before express.json(): the webhook signature needs the raw body');\n    }\n    return Buffer.from(JSON.stringify(req.body), 'utf8');\n  }\n  return Buffer.alloc(0);\n}\n\nexport function sendRouteResponse(res: Response, result: RouteResponse): void {\n  res.status(result.status).set('Cache-Control', 'no-store').json(result.body);\n}\n\nexport function blockauthRouter(\n  routes: BlockAuthRoutes,\n  session: (req: Request) => SessionStore = expressSessionStore,\n): Router {\n  const router = express.Router();\n  router.use(routes.basePath, express.raw({ type: () => true, limit: MAX_BODY }), async (req, res, next) => {\n    try {\n      const path = routes.basePath + req.path;\n      const rawBody = rawBodyOf(req, path === `${routes.basePath}/webhook`);\n      const context: RouteContext = { session: session(req), request: req };\n      const result = await routes.dispatch(req.method, path, rawBody, (name) => req.get(name), context);\n      if (!result) return next();\n      sendRouteResponse(res, result);\n    } catch (err) {\n      next(err);\n    }\n  });\n  return router;\n}\n"]}

package/dist/index.cjs

@@ -0,0 +1,391 @@
+'use strict';
+
+var crypto = require('crypto');
+
+// src/client.ts
+
+// src/errors.ts
+var BlockAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BlockAuthError";
+  }
+};
+
+// src/client.ts
+var DEFAULT_WS_URL = "wss://wss.block-auth.io";
+var DEFAULT_WEBHOOK_MAX_SKEW_SECONDS = 300;
+function sha256Hex(value) {
+  return crypto.createHash("sha256").update(value, "utf8").digest("hex");
+}
+function buildWsServerApiUrl(path, wsUrl = "") {
+  const url = new URL(wsUrl || DEFAULT_WS_URL);
+  const scheme = url.protocol === "wss:" ? "https:" : "http:";
+  return `${scheme}//${url.host}/api${path}`;
+}
+var AuthCodeClient = class {
+  constructor(apiKey, apiSecret, options = {}) {
+    if (!apiKey || !apiSecret) throw new BlockAuthError("apiKey and apiSecret are required");
+    this.apiKey = apiKey;
+    this.secretHash = sha256Hex(apiSecret);
+    this.wsUrl = options.wsUrl ?? "";
+    this.timeoutMs = options.timeoutMs ?? 1e4;
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  authorize(redirectUri, state, responseMode) {
+    return this.post("/auth/authorize", { redirectUri, state, responseMode });
+  }
+  exchangeCode(code, redirectUri, codeVerifier, linkExternalId) {
+    return this.post("/auth/token", { code, redirectUri, codeVerifier, linkExternalId });
+  }
+  signOut(address) {
+    return this.post("/auth/signout", { address });
+  }
+  revokeLink(externalId) {
+    return this.post("/auth/link/revoke", { externalId });
+  }
+  verifyWebhook(rawBody, timestamp, signature, maxSkewSeconds = DEFAULT_WEBHOOK_MAX_SKEW_SECONDS) {
+    if (!timestamp || !/^\d+$/.test(timestamp)) throw new BlockAuthError("Invalid webhook timestamp");
+    if (Math.abs(Date.now() / 1e3 - Number(timestamp)) > maxSkewSeconds) {
+      throw new BlockAuthError("Webhook timestamp out of tolerance");
+    }
+    const body = typeof rawBody === "string" ? Buffer.from(rawBody, "utf8") : rawBody;
+    const expected = Buffer.from(
+      "v1=" + crypto.createHmac("sha256", this.secretHash).update(Buffer.concat([Buffer.from(`${timestamp}.`, "utf8"), body])).digest("hex"),
+      "utf8"
+    );
+    const provided = Buffer.from(signature ?? "", "utf8");
+    if (provided.length !== expected.length || !crypto.timingSafeEqual(provided, expected)) {
+      throw new BlockAuthError("Invalid webhook signature");
+    }
+    let payload;
+    try {
+      payload = JSON.parse(body.toString("utf8"));
+    } catch {
+      throw new BlockAuthError("Invalid webhook body");
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+      throw new BlockAuthError("Invalid webhook body");
+    }
+    return payload;
+  }
+  async post(path, params) {
+    const body = { apiKey: this.apiKey, apiSecret: this.secretHash };
+    for (const [key, value] of Object.entries(params)) {
+      if (value !== void 0 && value !== null) body[key] = value;
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(buildWsServerApiUrl(path, this.wsUrl), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "error",
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+      payload = await response.json().catch(() => ({}));
+    } catch (error2) {
+      throw new BlockAuthError(`Request to ${path} failed: ${error2.message}`);
+    }
+    if (payload.success !== true) {
+      throw new BlockAuthError(
+        typeof payload.message === "string" && payload.message ? payload.message : `Request to ${path} failed`
+      );
+    }
+    if (!payload.message || typeof payload.message !== "object") {
+      throw new BlockAuthError(`Unexpected response from ${path}`);
+    }
+    return payload.message;
+  }
+};
+
+// src/routes.ts
+var DEFAULT_BASE_PATH = "/auth/blockauth";
+var MAX_PARAM_LENGTH = 2048;
+var ROUTE_NAMES = ["code", "me", "logout", "link", "webhook"];
+var LINK_CONFLICTS = [
+  "Account already linked",
+  "External id already linked",
+  "Link conflict"
+];
+var WEBHOOK_EVENTS = ["signout", "account.unlinked"];
+var JSON_POSTS = ["POST /code", "POST /logout", "POST /link"];
+function originOf(url) {
+  if (typeof url !== "string") return null;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (!["http:", "https:"].includes(parsed.protocol) || !parsed.hostname || parsed.username || parsed.password) {
+    return null;
+  }
+  return parsed.origin;
+}
+function error(status, code) {
+  return { status, body: { error: code } };
+}
+function isJson(contentType) {
+  return (contentType ?? "").split(";", 1)[0].trim().toLowerCase() === "application/json";
+}
+function parseJson(rawBody) {
+  try {
+    return JSON.parse(rawBody);
+  } catch {
+    return null;
+  }
+}
+function publicUser(user) {
+  return { address: user.address, did: user.did, roles: user.roles };
+}
+var BlockAuthRoutes = class {
+  constructor(options) {
+    const origins = options.allowedOrigins ?? (options.appUrl ? [options.appUrl] : []);
+    const resolved = /* @__PURE__ */ new Set();
+    for (const url of origins) {
+      const origin = originOf(url);
+      if (!origin)
+        throw new BlockAuthError(
+          `Invalid origin in appUrl or allowedOrigins: ${String(url)}`
+        );
+      resolved.add(origin);
+    }
+    if (resolved.size === 0)
+      throw new BlockAuthError(
+        "Set appUrl or allowedOrigins: the origins your frontend runs on"
+      );
+    const unknown = Object.keys(options.routes ?? {}).filter(
+      (name) => !ROUTE_NAMES.includes(name)
+    );
+    if (unknown.length > 0)
+      throw new BlockAuthError(`Unknown routes: ${unknown.join(", ")}`);
+    this.options = options;
+    this.client = options.client ?? new AuthCodeClient(options.apiKey, options.apiSecret, {
+      wsUrl: options.wsUrl,
+      timeoutMs: options.timeoutMs
+    });
+    this.allowedOrigins = resolved;
+    this.basePath = "/" + (options.basePath ?? DEFAULT_BASE_PATH).replace(/^\/+|\/+$/g, "");
+    this.sessionKey = options.sessionKey ?? "blockauth_user";
+    this.enabled = {
+      code: true,
+      me: true,
+      logout: true,
+      link: true,
+      webhook: true,
+      ...options.routes
+    };
+  }
+  async currentUser(context) {
+    const user = await context.session.get(this.sessionKey);
+    const valid = !!user && typeof user === "object" && typeof user.address === "string" && typeof user.expiresAt === "number" && Date.now() / 1e3 < user.expiresAt && !(this.options.isRevoked && await this.options.isRevoked(user));
+    if (!valid) {
+      if (user != null) await context.session.remove(this.sessionKey);
+      return null;
+    }
+    return user;
+  }
+  async code(body, context) {
+    const params = this.codeParams(body);
+    if (!params) return error(400, "invalid_request");
+    let result;
+    try {
+      result = await this.client.exchangeCode(
+        params.code,
+        params.redirectUri,
+        params.codeVerifier
+      );
+    } catch (err) {
+      this.log("Block-Auth could not redeem the login code", err);
+      return error(502, "blockauth_error");
+    }
+    const expiresAt = this.expiresAt(result.signedExpiredAt);
+    if (typeof result.address !== "string" || !result.address || expiresAt === null) {
+      this.log("Block-Auth returned a user without address or signedExpiredAt");
+      return error(502, "blockauth_error");
+    }
+    const user = {
+      address: result.address,
+      did: typeof result.did === "string" && result.did ? result.did : result.address,
+      roles: Array.isArray(result.roles) ? result.roles : [],
+      externalId: result.externalId ?? null,
+      loggedInAt: Math.floor(Date.now() / 1e3),
+      expiresAt
+    };
+    if (this.options.onLogin) {
+      const extra = await this.options.onLogin(user, context);
+      if (extra === false) {
+        await this.client.signOut(user.address).catch(
+          (err) => this.log("Block-Auth sign out of a rejected login failed", err)
+        );
+        return error(403, "forbidden");
+      }
+      if (extra && typeof extra === "object") user.data = extra;
+    }
+    await context.session.regenerate();
+    await context.session.set(this.sessionKey, user);
+    return { status: 200, body: publicUser(user) };
+  }
+  async me(context) {
+    const user = await this.currentUser(context);
+    return user ? { status: 200, body: publicUser(user) } : error(401, "unauthenticated");
+  }
+  async logout(context) {
+    const user = await this.currentUser(context);
+    if (user) {
+      await this.client.signOut(user.address).catch(
+        (err) => this.log(
+          "Block-Auth sign out failed; the local session is closed anyway",
+          err
+        )
+      );
+    }
+    await context.session.remove(this.sessionKey);
+    await context.session.regenerate();
+    if (user && this.options.onLogout)
+      await this.options.onLogout(user, context);
+    return { status: 200, body: { ok: true } };
+  }
+  async linkStatus(context) {
+    if (!this.options.appUser) return error(404, "not_found");
+    const appUser = await this.resolveAppUser(context);
+    return appUser ? { status: 200, body: { linked: appUser.linked === true } } : error(401, "unauthenticated");
+  }
+  async link(body, context) {
+    if (!this.options.appUser) return error(404, "not_found");
+    const appUser = await this.resolveAppUser(context);
+    if (!appUser) return error(401, "unauthenticated");
+    const params = this.codeParams(body);
+    if (!params) return error(400, "invalid_request");
+    let result;
+    try {
+      result = await this.client.exchangeCode(
+        params.code,
+        params.redirectUri,
+        params.codeVerifier,
+        String(appUser.id)
+      );
+    } catch (err) {
+      if (err instanceof BlockAuthError && LINK_CONFLICTS.includes(err.message))
+        return error(409, "already_linked");
+      this.log("Block-Auth could not link the account", err);
+      return error(502, "blockauth_error");
+    }
+    if (this.options.onLinked)
+      await this.options.onLinked(appUser.id, result, context);
+    return { status: 200, body: { linked: true } };
+  }
+  async webhook(rawBody, timestamp, signature) {
+    let event;
+    try {
+      event = this.client.verifyWebhook(
+        rawBody,
+        timestamp,
+        signature,
+        this.options.webhookMaxSkewSeconds
+      );
+    } catch (err) {
+      this.log("Rejected a webhook that failed verification", err);
+      return error(401, "invalid_signature");
+    }
+    if (event.apiKey !== this.options.apiKey)
+      return error(401, "invalid_signature");
+    if (!WEBHOOK_EVENTS.includes(event.event) || typeof event.address !== "string") {
+      return { status: 200, body: { ok: true, ignored: true } };
+    }
+    if (this.options.isReplay && (typeof event.jti !== "string" || await this.options.isReplay(event.jti, event))) {
+      return error(409, "replayed");
+    }
+    const handler = event.event === "signout" ? this.options.onSignout : this.options.onUnlinked;
+    if (handler) await handler(event);
+    return { status: 200, body: { ok: true } };
+  }
+  async dispatch(method, path, rawBody, header, context) {
+    if (!path.startsWith(this.basePath + "/")) return null;
+    const route = `${method.toUpperCase()} ${path.slice(this.basePath.length)}`;
+    const name = {
+      "POST /code": "code",
+      "GET /me": "me",
+      "POST /logout": "logout",
+      "GET /link": "link",
+      "POST /link": "link",
+      "POST /webhook": "webhook"
+    }[route];
+    if (!name || !this.enabled[name]) return null;
+    if (JSON_POSTS.includes(route) && !isJson(header("content-type")))
+      return error(415, "unsupported_media_type");
+    const text = typeof rawBody === "string" ? rawBody : rawBody.toString("utf8");
+    switch (route) {
+      case "POST /code":
+        return this.code(parseJson(text), context);
+      case "GET /me":
+        return this.me(context);
+      case "POST /logout":
+        return this.logout(context);
+      case "GET /link":
+        return this.linkStatus(context);
+      case "POST /link":
+        return this.link(parseJson(text), context);
+      default:
+        return this.webhook(
+          rawBody,
+          header("x-blockauth-timestamp"),
+          header("x-blockauth-signature")
+        );
+    }
+  }
+  codeParams(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body)) return null;
+    const { code, codeVerifier, redirectUri } = body;
+    for (const value of [code, codeVerifier, redirectUri]) {
+      if (typeof value !== "string" || !value || value.length > MAX_PARAM_LENGTH)
+        return null;
+    }
+    const origin = originOf(redirectUri);
+    if (!origin || !this.allowedOrigins.has(origin)) return null;
+    return {
+      code,
+      codeVerifier,
+      redirectUri
+    };
+  }
+  expiresAt(signedExpiredAt) {
+    if (typeof signedExpiredAt !== "string") return null;
+    const match = /^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})$/.exec(
+      signedExpiredAt
+    );
+    if (!match) return null;
+    const [year, month, day, hour, minute, second] = match.slice(1).map(Number);
+    let expiresAt = Date.UTC(year, month - 1, day, hour, minute, second) / 1e3;
+    const now = Math.floor(Date.now() / 1e3);
+    if (this.options.maxSessionSeconds !== void 0) {
+      expiresAt = Math.min(
+        expiresAt,
+        now + Math.max(1, Math.floor(this.options.maxSessionSeconds))
+      );
+    }
+    return Number.isFinite(expiresAt) && expiresAt > now ? expiresAt : null;
+  }
+  async resolveAppUser(context) {
+    const appUser = await this.options.appUser?.(context);
+    if (!appUser || typeof appUser !== "object") return null;
+    const { id } = appUser;
+    if (!(typeof id === "string" && id || typeof id === "number" && Number.isFinite(id)))
+      return null;
+    return appUser;
+  }
+  log(message, err) {
+    this.options.logger?.(message, err);
+  }
+};
+
+exports.AuthCodeClient = AuthCodeClient;
+exports.BlockAuthError = BlockAuthError;
+exports.BlockAuthRoutes = BlockAuthRoutes;
+exports.DEFAULT_BASE_PATH = DEFAULT_BASE_PATH;
+exports.DEFAULT_WS_URL = DEFAULT_WS_URL;
+exports.buildWsServerApiUrl = buildWsServerApiUrl;
+exports.sha256Hex = sha256Hex;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map