@c9up/warden 0.1.22 → 0.1.23

package/dist/firstcontact/FirstContactManager.js

@@ -1,38 +0,0 @@
-/**
- * FirstContactManager — OAuth2 social authentication.
- *
- * Usage:
- *   firstContact.use('google').redirectUrl()
- *   firstContact.use('google').callback(code)
- */
-export class FirstContactManager {
-    #drivers = new Map();
-    use(name) {
-        const driver = this.#drivers.get(name);
-        if (!driver)
-            throw new Error(`OAuth driver '${name}' not registered. Available: ${[...this.#drivers.keys()].join(", ")}`);
-        return driver;
-    }
-    register(name, driver) {
-        this.#drivers.set(name, driver);
-    }
-    redirect(name, state) {
-        return this.use(name).redirectUrl(state);
-    }
-    /**
-     * Handle the OAuth callback. Pass `state` (from the query string) and
-     * `expectedState` (from the session, stored at redirect time) for CSRF
-     * protection. Omitting `expectedState` logs a security warning.
-     */
-    async callback(name, code, state, expectedState) {
-        if (!expectedState) {
-            throw new Error(`[warden] OAuth callback for '${name}' requires expectedState for CSRF protection. ` +
-                `Store the state from redirect() in the session and pass it here.`);
-        }
-        return this.use(name).callback(code, state, expectedState);
-    }
-    get registeredDrivers() {
-        return [...this.#drivers.keys()];
-    }
-}
-//# sourceMappingURL=FirstContactManager.js.map

package/dist/firstcontact/FirstContactManager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"FirstContactManager.js","sourceRoot":"","sources":["../../src/firstcontact/FirstContactManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,OAAO,mBAAmB;IAC/B,QAAQ,GAAoC,IAAI,GAAG,EAAE,CAAC;IAEtD,GAAG,CAAC,IAAY;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YACV,MAAM,IAAI,KAAK,CACd,iBAAiB,IAAI,gCAAgC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;QACH,OAAO,MAAM,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,MAA0B;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,KAAc;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACd,gCAAgC,IAAI,gDAAgD;gBACnF,kEAAkE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,iBAAiB;QACpB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;CACD"}

package/dist/firstcontact/drivers/GitHubDriver.d.ts

@@ -1,14 +0,0 @@
-/**
- * GitHub OAuth2 driver for FirstContact.
- */
-import type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser } from "../types.js";
-export declare class GitHubDriver implements FirstContactDriver {
-    private config;
-    constructor(config: OAuthConfig);
-    redirectUrl(state?: string): string;
-    callback(code: string, state?: string, expectedState?: string): Promise<{
-        user: OAuthUser;
-        token: OAuthToken;
-    }>;
-}
-//# sourceMappingURL=GitHubDriver.d.ts.map

package/dist/firstcontact/drivers/GitHubDriver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"GitHubDriver.d.ts","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,EACT,MAAM,aAAa,CAAC;AAGrB,qBAAa,YAAa,YAAW,kBAAkB;IAC1C,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEvC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAU7B,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CA+ClD"}

package/dist/firstcontact/drivers/GitHubDriver.js

@@ -1,60 +0,0 @@
-/**
- * GitHub OAuth2 driver for FirstContact.
- */
-import { assertOAuthState } from "../types.js";
-export class GitHubDriver {
-    config;
-    constructor(config) {
-        this.config = config;
-    }
-    redirectUrl(state) {
-        const params = new URLSearchParams({
-            client_id: this.config.clientId,
-            redirect_uri: this.config.callbackUrl,
-            scope: (this.config.scopes ?? ["read:user", "user:email"]).join(" "),
-            ...(state ? { state } : {}),
-        });
-        return `https://github.com/login/oauth/authorize?${params}`;
-    }
-    async callback(code, state, expectedState) {
-        assertOAuthState(state, expectedState);
-        const tokenRes = await fetch("https://github.com/login/oauth/access_token", {
-            method: "POST",
-            headers: {
-                Accept: "application/json",
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({
-                client_id: this.config.clientId,
-                client_secret: this.config.clientSecret,
-                code,
-            }),
-        });
-        if (!tokenRes.ok) {
-            throw new Error(`GitHub OAuth token exchange failed (HTTP ${tokenRes.status})`);
-        }
-        const tokens = (await tokenRes.json());
-        if (!tokens.access_token)
-            throw new Error("GitHub OAuth: no access_token in response");
-        const userRes = await fetch("https://api.github.com/user", {
-            headers: {
-                Authorization: `Bearer ${tokens.access_token}`,
-                Accept: "application/json",
-            },
-        });
-        if (!userRes.ok)
-            throw new Error(`GitHub user API failed (${userRes.status})`);
-        const raw = (await userRes.json());
-        return {
-            user: {
-                id: String(raw.id ?? ""),
-                email: String(raw.email ?? ""),
-                name: String(raw.name ?? raw.login ?? ""),
-                avatarUrl: raw.avatar_url,
-                raw,
-            },
-            token: { accessToken: String(tokens.access_token) },
-        };
-    }
-}
-//# sourceMappingURL=GitHubDriver.js.map

package/dist/firstcontact/drivers/GitHubDriver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GitHubDriver.js","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,OAAO,YAAY;IACJ;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE3C,WAAW,CAAC,KAAc;QACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,4CAA4C,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC3B,6CAA6C,EAC7C;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,IAAI;aACJ,CAAC;SACF,CACD,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;YAC1D,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE;gBAC9C,MAAM,EAAE,kBAAkB;aAC1B;SACD,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE9D,OAAO;YACN,IAAI,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzC,SAAS,EAAE,GAAG,CAAC,UAAgC;gBAC/C,GAAG;aACH;YACD,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;SACnD,CAAC;IACH,CAAC;CACD"}

package/dist/firstcontact/drivers/GoogleDriver.d.ts

@@ -1,14 +0,0 @@
-/**
- * Google OAuth2 driver for FirstContact.
- */
-import type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser } from "../types.js";
-export declare class GoogleDriver implements FirstContactDriver {
-    private config;
-    constructor(config: OAuthConfig);
-    redirectUrl(state?: string): string;
-    callback(code: string, state?: string, expectedState?: string): Promise<{
-        user: OAuthUser;
-        token: OAuthToken;
-    }>;
-}
-//# sourceMappingURL=GoogleDriver.d.ts.map

package/dist/firstcontact/drivers/GoogleDriver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"GoogleDriver.d.ts","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,EACT,MAAM,aAAa,CAAC;AAGrB,qBAAa,YAAa,YAAW,kBAAkB;IAC1C,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEvC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAY7B,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CAgDlD"}

package/dist/firstcontact/drivers/GoogleDriver.js

@@ -1,63 +0,0 @@
-/**
- * Google OAuth2 driver for FirstContact.
- */
-import { assertOAuthState } from "../types.js";
-export class GoogleDriver {
-    config;
-    constructor(config) {
-        this.config = config;
-    }
-    redirectUrl(state) {
-        const params = new URLSearchParams({
-            client_id: this.config.clientId,
-            redirect_uri: this.config.callbackUrl,
-            response_type: "code",
-            scope: (this.config.scopes ?? ["openid", "email", "profile"]).join(" "),
-            access_type: "offline",
-            ...(state ? { state } : {}),
-        });
-        return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-    }
-    async callback(code, state, expectedState) {
-        // CSRF protection: validate state matches what we sent in redirectUrl().
-        assertOAuthState(state, expectedState);
-        const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({
-                code,
-                client_id: this.config.clientId,
-                client_secret: this.config.clientSecret,
-                redirect_uri: this.config.callbackUrl,
-                grant_type: "authorization_code",
-            }),
-        });
-        if (!tokenRes.ok) {
-            throw new Error(`Google OAuth token exchange failed (HTTP ${tokenRes.status})`);
-        }
-        const tokens = (await tokenRes.json());
-        if (!tokens.access_token)
-            throw new Error("Google OAuth: no access_token in response");
-        const userRes = await fetch("https://www.googleapis.com/oauth2/v2/userinfo", {
-            headers: { Authorization: `Bearer ${tokens.access_token}` },
-        });
-        if (!userRes.ok)
-            throw new Error(`Google userinfo failed (${userRes.status})`);
-        const raw = (await userRes.json());
-        return {
-            user: {
-                id: String(raw.id ?? ""),
-                email: String(raw.email ?? ""),
-                name: String(raw.name ?? ""),
-                avatarUrl: raw.picture,
-                raw,
-            },
-            token: {
-                accessToken: String(tokens.access_token),
-                refreshToken: tokens.refresh_token,
-                expiresIn: tokens.expires_in,
-            },
-        };
-    }
-}
-//# sourceMappingURL=GoogleDriver.js.map

package/dist/firstcontact/drivers/GoogleDriver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GoogleDriver.js","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,OAAO,YAAY;IACJ;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE3C,WAAW,CAAC,KAAc;QACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvE,WAAW,EAAE,SAAS;YACtB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,gDAAgD,MAAM,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,yEAAyE;QACzE,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACrC,UAAU,EAAE,oBAAoB;aAChC,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAC1B,+CAA+C,EAC/C;YACC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;SAC3D,CACD,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE9D,OAAO;YACN,IAAI,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC5B,SAAS,EAAE,GAAG,CAAC,OAA6B;gBAC5C,GAAG;aACH;YACD,KAAK,EAAE;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBACxC,YAAY,EAAE,MAAM,CAAC,aAAmC;gBACxD,SAAS,EAAE,MAAM,CAAC,UAAgC;aAClD;SACD,CAAC;IACH,CAAC;CACD"}

package/dist/firstcontact/types.d.ts

@@ -1,44 +0,0 @@
-/**
- * FirstContact — OAuth2 social authentication types.
- */
-export interface OAuthConfig {
-    clientId: string;
-    clientSecret: string;
-    callbackUrl: string;
-    scopes?: string[];
-}
-export interface OAuthUser {
-    id: string;
-    email: string;
-    name: string;
-    avatarUrl?: string;
-    raw: Record<string, unknown>;
-}
-export interface OAuthToken {
-    accessToken: string;
-    refreshToken?: string;
-    expiresIn?: number;
-}
-export interface FirstContactDriver {
-    redirectUrl(state?: string): string;
-    /**
-     * Handle the OAuth callback. `state` MUST be validated against the value
-     * originally passed to `redirectUrl()` to prevent CSRF login attacks.
-     * Throws if state is missing or mismatched.
-     */
-    callback(code: string, state?: string, expectedState?: string): Promise<{
-        user: OAuthUser;
-        token: OAuthToken;
-    }>;
-}
-/**
- * Check the OAuth `state` round-trip, failing CLOSED.
- *
- * The check used to be `if (expectedState && state !== expectedState)`, so a
- * caller that passed no expected state got NO CSRF protection and no sign that
- * it was missing. A driver used directly — without the manager, which already
- * refuses — was therefore open by default. Anything that cannot be verified is
- * refused instead.
- */
-export declare function assertOAuthState(state: string | undefined, expectedState: string | undefined): void;
-//# sourceMappingURL=types.d.ts.map

package/dist/firstcontact/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/firstcontact/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CACP,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,aAAa,EAAE,MAAM,GAAG,SAAS,GAC/B,IAAI,CAUN"}

package/dist/firstcontact/types.js

@@ -1,22 +0,0 @@
-/**
- * FirstContact — OAuth2 social authentication types.
- */
-/**
- * Check the OAuth `state` round-trip, failing CLOSED.
- *
- * The check used to be `if (expectedState && state !== expectedState)`, so a
- * caller that passed no expected state got NO CSRF protection and no sign that
- * it was missing. A driver used directly — without the manager, which already
- * refuses — was therefore open by default. Anything that cannot be verified is
- * refused instead.
- */
-export function assertOAuthState(state, expectedState) {
-    if (!expectedState) {
-        throw new Error("[warden] OAuth callback requires expectedState for CSRF protection. " +
-            "Store the state given to redirectUrl() in the session and pass it here.");
-    }
-    if (state !== expectedState) {
-        throw new Error("OAuth state mismatch — possible CSRF attack");
-    }
-}
-//# sourceMappingURL=types.js.map

package/dist/firstcontact/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/firstcontact/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAqCH;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC/B,KAAyB,EACzB,aAAiC;IAEjC,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACd,sEAAsE;YACrE,yEAAyE,CAC1E,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;AACF,CAAC"}

package/src/firstcontact/FirstContactManager.ts

@@ -1,54 +0,0 @@
-/**
- * FirstContactManager — OAuth2 social authentication.
- *
- * Usage:
- *   firstContact.use('google').redirectUrl()
- *   firstContact.use('google').callback(code)
- */
-
-import type { FirstContactDriver, OAuthToken, OAuthUser } from "./types.js";
-
-export class FirstContactManager {
-	#drivers: Map<string, FirstContactDriver> = new Map();
-
-	use(name: string): FirstContactDriver {
-		const driver = this.#drivers.get(name);
-		if (!driver)
-			throw new Error(
-				`OAuth driver '${name}' not registered. Available: ${[...this.#drivers.keys()].join(", ")}`,
-			);
-		return driver;
-	}
-
-	register(name: string, driver: FirstContactDriver): void {
-		this.#drivers.set(name, driver);
-	}
-
-	redirect(name: string, state?: string): string {
-		return this.use(name).redirectUrl(state);
-	}
-
-	/**
-	 * Handle the OAuth callback. Pass `state` (from the query string) and
-	 * `expectedState` (from the session, stored at redirect time) for CSRF
-	 * protection. Omitting `expectedState` logs a security warning.
-	 */
-	async callback(
-		name: string,
-		code: string,
-		state?: string,
-		expectedState?: string,
-	): Promise<{ user: OAuthUser; token: OAuthToken }> {
-		if (!expectedState) {
-			throw new Error(
-				`[warden] OAuth callback for '${name}' requires expectedState for CSRF protection. ` +
-					`Store the state from redirect() in the session and pass it here.`,
-			);
-		}
-		return this.use(name).callback(code, state, expectedState);
-	}
-
-	get registeredDrivers(): string[] {
-		return [...this.#drivers.keys()];
-	}
-}

package/src/firstcontact/drivers/GitHubDriver.ts

@@ -1,77 +0,0 @@
-/**
- * GitHub OAuth2 driver for FirstContact.
- */
-
-import type {
-	FirstContactDriver,
-	OAuthConfig,
-	OAuthToken,
-	OAuthUser,
-} from "../types.js";
-import { assertOAuthState } from "../types.js";
-
-export class GitHubDriver implements FirstContactDriver {
-	constructor(private config: OAuthConfig) {}
-
-	redirectUrl(state?: string): string {
-		const params = new URLSearchParams({
-			client_id: this.config.clientId,
-			redirect_uri: this.config.callbackUrl,
-			scope: (this.config.scopes ?? ["read:user", "user:email"]).join(" "),
-			...(state ? { state } : {}),
-		});
-		return `https://github.com/login/oauth/authorize?${params}`;
-	}
-
-	async callback(
-		code: string,
-		state?: string,
-		expectedState?: string,
-	): Promise<{ user: OAuthUser; token: OAuthToken }> {
-		assertOAuthState(state, expectedState);
-		const tokenRes = await fetch(
-			"https://github.com/login/oauth/access_token",
-			{
-				method: "POST",
-				headers: {
-					Accept: "application/json",
-					"Content-Type": "application/json",
-				},
-				body: JSON.stringify({
-					client_id: this.config.clientId,
-					client_secret: this.config.clientSecret,
-					code,
-				}),
-			},
-		);
-		if (!tokenRes.ok) {
-			throw new Error(
-				`GitHub OAuth token exchange failed (HTTP ${tokenRes.status})`,
-			);
-		}
-		const tokens = (await tokenRes.json()) as Record<string, unknown>;
-		if (!tokens.access_token)
-			throw new Error("GitHub OAuth: no access_token in response");
-
-		const userRes = await fetch("https://api.github.com/user", {
-			headers: {
-				Authorization: `Bearer ${tokens.access_token}`,
-				Accept: "application/json",
-			},
-		});
-		if (!userRes.ok)
-			throw new Error(`GitHub user API failed (${userRes.status})`);
-		const raw = (await userRes.json()) as Record<string, unknown>;
-
-		return {
-			user: {
-				id: String(raw.id ?? ""),
-				email: String(raw.email ?? ""),
-				name: String(raw.name ?? raw.login ?? ""),
-				avatarUrl: raw.avatar_url as string | undefined,
-				raw,
-			},
-			token: { accessToken: String(tokens.access_token) },
-		};
-	}
-}

package/src/firstcontact/drivers/GoogleDriver.ts

@@ -1,80 +0,0 @@
-/**
- * Google OAuth2 driver for FirstContact.
- */
-
-import type {
-	FirstContactDriver,
-	OAuthConfig,
-	OAuthToken,
-	OAuthUser,
-} from "../types.js";
-import { assertOAuthState } from "../types.js";
-
-export class GoogleDriver implements FirstContactDriver {
-	constructor(private config: OAuthConfig) {}
-
-	redirectUrl(state?: string): string {
-		const params = new URLSearchParams({
-			client_id: this.config.clientId,
-			redirect_uri: this.config.callbackUrl,
-			response_type: "code",
-			scope: (this.config.scopes ?? ["openid", "email", "profile"]).join(" "),
-			access_type: "offline",
-			...(state ? { state } : {}),
-		});
-		return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-	}
-
-	async callback(
-		code: string,
-		state?: string,
-		expectedState?: string,
-	): Promise<{ user: OAuthUser; token: OAuthToken }> {
-		// CSRF protection: validate state matches what we sent in redirectUrl().
-		assertOAuthState(state, expectedState);
-		const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({
-				code,
-				client_id: this.config.clientId,
-				client_secret: this.config.clientSecret,
-				redirect_uri: this.config.callbackUrl,
-				grant_type: "authorization_code",
-			}),
-		});
-		if (!tokenRes.ok) {
-			throw new Error(
-				`Google OAuth token exchange failed (HTTP ${tokenRes.status})`,
-			);
-		}
-		const tokens = (await tokenRes.json()) as Record<string, unknown>;
-		if (!tokens.access_token)
-			throw new Error("Google OAuth: no access_token in response");
-
-		const userRes = await fetch(
-			"https://www.googleapis.com/oauth2/v2/userinfo",
-			{
-				headers: { Authorization: `Bearer ${tokens.access_token}` },
-			},
-		);
-		if (!userRes.ok)
-			throw new Error(`Google userinfo failed (${userRes.status})`);
-		const raw = (await userRes.json()) as Record<string, unknown>;
-
-		return {
-			user: {
-				id: String(raw.id ?? ""),
-				email: String(raw.email ?? ""),
-				name: String(raw.name ?? ""),
-				avatarUrl: raw.picture as string | undefined,
-				raw,
-			},
-			token: {
-				accessToken: String(tokens.access_token),
-				refreshToken: tokens.refresh_token as string | undefined,
-				expiresIn: tokens.expires_in as number | undefined,
-			},
-		};
-	}
-}

package/src/firstcontact/types.ts

@@ -1,62 +0,0 @@
-/**
- * FirstContact — OAuth2 social authentication types.
- */
-
-export interface OAuthConfig {
-	clientId: string;
-	clientSecret: string;
-	callbackUrl: string;
-	scopes?: string[];
-}
-
-export interface OAuthUser {
-	id: string;
-	email: string;
-	name: string;
-	avatarUrl?: string;
-	raw: Record<string, unknown>;
-}
-
-export interface OAuthToken {
-	accessToken: string;
-	refreshToken?: string;
-	expiresIn?: number;
-}
-
-export interface FirstContactDriver {
-	redirectUrl(state?: string): string;
-	/**
-	 * Handle the OAuth callback. `state` MUST be validated against the value
-	 * originally passed to `redirectUrl()` to prevent CSRF login attacks.
-	 * Throws if state is missing or mismatched.
-	 */
-	callback(
-		code: string,
-		state?: string,
-		expectedState?: string,
-	): Promise<{ user: OAuthUser; token: OAuthToken }>;
-}
-
-/**
- * Check the OAuth `state` round-trip, failing CLOSED.
- *
- * The check used to be `if (expectedState && state !== expectedState)`, so a
- * caller that passed no expected state got NO CSRF protection and no sign that
- * it was missing. A driver used directly — without the manager, which already
- * refuses — was therefore open by default. Anything that cannot be verified is
- * refused instead.
- */
-export function assertOAuthState(
-	state: string | undefined,
-	expectedState: string | undefined,
-): void {
-	if (!expectedState) {
-		throw new Error(
-			"[warden] OAuth callback requires expectedState for CSRF protection. " +
-				"Store the state given to redirectUrl() in the session and pass it here.",
-		);
-	}
-	if (state !== expectedState) {
-		throw new Error("OAuth state mismatch — possible CSRF attack");
-	}
-}