@c9up/warden 0.1.21 → 0.1.23

package/src/firstcontact/FirstContactManager.ts

@@ -1,54 +0,0 @@
-/**
- * FirstContactManager — OAuth2 social authentication.
- *
- * Usage:
- *   firstContact.use('google').redirectUrl()
- *   firstContact.use('google').callback(code)
- */
-
-import type { FirstContactDriver, OAuthToken, OAuthUser } from "./types.js";
-
-export class FirstContactManager {
-	#drivers: Map<string, FirstContactDriver> = new Map();
-
-	use(name: string): FirstContactDriver {
-		const driver = this.#drivers.get(name);
-		if (!driver)
-			throw new Error(
-				`OAuth driver '${name}' not registered. Available: ${[...this.#drivers.keys()].join(", ")}`,
-			);
-		return driver;
-	}
-
-	register(name: string, driver: FirstContactDriver): void {
-		this.#drivers.set(name, driver);
-	}
-
-	redirect(name: string, state?: string): string {
-		return this.use(name).redirectUrl(state);
-	}
-
-	/**
-	 * Handle the OAuth callback. Pass `state` (from the query string) and
-	 * `expectedState` (from the session, stored at redirect time) for CSRF
-	 * protection. Omitting `expectedState` logs a security warning.
-	 */
-	async callback(
-		name: string,
-		code: string,
-		state?: string,
-		expectedState?: string,
-	): Promise<{ user: OAuthUser; token: OAuthToken }> {
-		if (!expectedState) {
-			throw new Error(
-				`[warden] OAuth callback for '${name}' requires expectedState for CSRF protection. ` +
-					`Store the state from redirect() in the session and pass it here.`,
-			);
-		}
-		return this.use(name).callback(code, state, expectedState);
-	}
-
-	get registeredDrivers(): string[] {
-		return [...this.#drivers.keys()];
-	}
-}

package/src/firstcontact/drivers/GitHubDriver.ts

@@ -1,77 +0,0 @@
-/**
- * GitHub OAuth2 driver for FirstContact.
- */
-
-import type {
-	FirstContactDriver,
-	OAuthConfig,
-	OAuthToken,
-	OAuthUser,
-} from "../types.js";
-import { assertOAuthState } from "../types.js";
-
-export class GitHubDriver implements FirstContactDriver {
-	constructor(private config: OAuthConfig) {}
-
-	redirectUrl(state?: string): string {
-		const params = new URLSearchParams({
-			client_id: this.config.clientId,
-			redirect_uri: this.config.callbackUrl,
-			scope: (this.config.scopes ?? ["read:user", "user:email"]).join(" "),
-			...(state ? { state } : {}),
-		});
-		return `https://github.com/login/oauth/authorize?${params}`;
-	}
-
-	async callback(
-		code: string,
-		state?: string,
-		expectedState?: string,
-	): Promise<{ user: OAuthUser; token: OAuthToken }> {
-		assertOAuthState(state, expectedState);
-		const tokenRes = await fetch(
-			"https://github.com/login/oauth/access_token",
-			{
-				method: "POST",
-				headers: {
-					Accept: "application/json",
-					"Content-Type": "application/json",
-				},
-				body: JSON.stringify({
-					client_id: this.config.clientId,
-					client_secret: this.config.clientSecret,
-					code,
-				}),
-			},
-		);
-		if (!tokenRes.ok) {
-			throw new Error(
-				`GitHub OAuth token exchange failed (HTTP ${tokenRes.status})`,
-			);
-		}
-		const tokens = (await tokenRes.json()) as Record<string, unknown>;
-		if (!tokens.access_token)
-			throw new Error("GitHub OAuth: no access_token in response");
-
-		const userRes = await fetch("https://api.github.com/user", {
-			headers: {
-				Authorization: `Bearer ${tokens.access_token}`,
-				Accept: "application/json",
-			},
-		});
-		if (!userRes.ok)
-			throw new Error(`GitHub user API failed (${userRes.status})`);
-		const raw = (await userRes.json()) as Record<string, unknown>;
-
-		return {
-			user: {
-				id: String(raw.id ?? ""),
-				email: String(raw.email ?? ""),
-				name: String(raw.name ?? raw.login ?? ""),
-				avatarUrl: raw.avatar_url as string | undefined,
-				raw,
-			},
-			token: { accessToken: String(tokens.access_token) },
-		};
-	}
-}

package/src/firstcontact/drivers/GoogleDriver.ts

@@ -1,80 +0,0 @@
-/**
- * Google OAuth2 driver for FirstContact.
- */
-
-import type {
-	FirstContactDriver,
-	OAuthConfig,
-	OAuthToken,
-	OAuthUser,
-} from "../types.js";
-import { assertOAuthState } from "../types.js";
-
-export class GoogleDriver implements FirstContactDriver {
-	constructor(private config: OAuthConfig) {}
-
-	redirectUrl(state?: string): string {
-		const params = new URLSearchParams({
-			client_id: this.config.clientId,
-			redirect_uri: this.config.callbackUrl,
-			response_type: "code",
-			scope: (this.config.scopes ?? ["openid", "email", "profile"]).join(" "),
-			access_type: "offline",
-			...(state ? { state } : {}),
-		});
-		return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-	}
-
-	async callback(
-		code: string,
-		state?: string,
-		expectedState?: string,
-	): Promise<{ user: OAuthUser; token: OAuthToken }> {
-		// CSRF protection: validate state matches what we sent in redirectUrl().
-		assertOAuthState(state, expectedState);
-		const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({
-				code,
-				client_id: this.config.clientId,
-				client_secret: this.config.clientSecret,
-				redirect_uri: this.config.callbackUrl,
-				grant_type: "authorization_code",
-			}),
-		});
-		if (!tokenRes.ok) {
-			throw new Error(
-				`Google OAuth token exchange failed (HTTP ${tokenRes.status})`,
-			);
-		}
-		const tokens = (await tokenRes.json()) as Record<string, unknown>;
-		if (!tokens.access_token)
-			throw new Error("Google OAuth: no access_token in response");
-
-		const userRes = await fetch(
-			"https://www.googleapis.com/oauth2/v2/userinfo",
-			{
-				headers: { Authorization: `Bearer ${tokens.access_token}` },
-			},
-		);
-		if (!userRes.ok)
-			throw new Error(`Google userinfo failed (${userRes.status})`);
-		const raw = (await userRes.json()) as Record<string, unknown>;
-
-		return {
-			user: {
-				id: String(raw.id ?? ""),
-				email: String(raw.email ?? ""),
-				name: String(raw.name ?? ""),
-				avatarUrl: raw.picture as string | undefined,
-				raw,
-			},
-			token: {
-				accessToken: String(tokens.access_token),
-				refreshToken: tokens.refresh_token as string | undefined,
-				expiresIn: tokens.expires_in as number | undefined,
-			},
-		};
-	}
-}

package/src/firstcontact/types.ts

@@ -1,62 +0,0 @@
-/**
- * FirstContact — OAuth2 social authentication types.
- */
-
-export interface OAuthConfig {
-	clientId: string;
-	clientSecret: string;
-	callbackUrl: string;
-	scopes?: string[];
-}
-
-export interface OAuthUser {
-	id: string;
-	email: string;
-	name: string;
-	avatarUrl?: string;
-	raw: Record<string, unknown>;
-}
-
-export interface OAuthToken {
-	accessToken: string;
-	refreshToken?: string;
-	expiresIn?: number;
-}
-
-export interface FirstContactDriver {
-	redirectUrl(state?: string): string;
-	/**
-	 * Handle the OAuth callback. `state` MUST be validated against the value
-	 * originally passed to `redirectUrl()` to prevent CSRF login attacks.
-	 * Throws if state is missing or mismatched.
-	 */
-	callback(
-		code: string,
-		state?: string,
-		expectedState?: string,
-	): Promise<{ user: OAuthUser; token: OAuthToken }>;
-}
-
-/**
- * Check the OAuth `state` round-trip, failing CLOSED.
- *
- * The check used to be `if (expectedState && state !== expectedState)`, so a
- * caller that passed no expected state got NO CSRF protection and no sign that
- * it was missing. A driver used directly — without the manager, which already
- * refuses — was therefore open by default. Anything that cannot be verified is
- * refused instead.
- */
-export function assertOAuthState(
-	state: string | undefined,
-	expectedState: string | undefined,
-): void {
-	if (!expectedState) {
-		throw new Error(
-			"[warden] OAuth callback requires expectedState for CSRF protection. " +
-				"Store the state given to redirectUrl() in the session and pass it here.",
-		);
-	}
-	if (state !== expectedState) {
-		throw new Error("OAuth state mismatch — possible CSRF attack");
-	}
-}