@cedarjs/auth-dbauth-oauth 7.0.0-canary.3075

package/dist/OAuthHandler.d.ts

@@ -0,0 +1,57 @@
+import type { APIGatewayProxyEvent, Context as LambdaContext } from 'aws-lambda';
+import type { CorsContext } from '@cedarjs/api';
+import { getDbAuthResponseBuilder } from '@cedarjs/auth-dbauth-api';
+import { IdentityModel } from './identity.js';
+import type { NormalizedOAuthRequest } from './request.js';
+import type { OAuthHandlerOptions } from './types.js';
+/**
+ * Handles the redirect-based OAuth flow (`login`/`signup`/`link`/`unlink`)
+ * for dbAuth, under its own base path (`/auth/oauth` by default) rather
+ * than `DbAuthHandler`'s `METHODS`/`VERBS` dispatch table — see the
+ * "Endpoint shape" decision in the implementation plan.
+ *
+ * Constructed per-request, the same way `DbAuthHandler` is, and accepts
+ * both a Lambda-style event and a Fetch `Request` so it works from a
+ * function handler and from `@cedarjs/auth-dbauth-middleware`.
+ */
+export declare class OAuthHandler<TDb extends object = Record<string, unknown>> {
+    event: Request | APIGatewayProxyEvent;
+    options: OAuthHandlerOptions<TDb>;
+    basePath: string;
+    corsContext: CorsContext | undefined;
+    createResponse: ReturnType<typeof getDbAuthResponseBuilder>;
+    identities: IdentityModel;
+    userAccessor: any;
+    _normalizedRequest: NormalizedOAuthRequest | undefined;
+    constructor(event: APIGatewayProxyEvent | Request, _context: LambdaContext, options: OAuthHandlerOptions<TDb>);
+    get normalizedRequest(): NormalizedOAuthRequest;
+    init(): Promise<void>;
+    invoke(): Promise<{
+        statusCode: number;
+        headers: Record<string, string | string[]>;
+        multiValueHeaders?: Record<string, string[]>;
+        body?: string;
+    }>;
+    /**
+     * Cookie config for the transaction cookie: `transactionCookie` when set,
+     * otherwise falls back to `cookie` (the same config the session cookie
+     * uses).
+     */
+    private get _transactionCookieConfig();
+    private _authorize;
+    private _callback;
+    private _handleLogin;
+    private _handleSignup;
+    private _handleLink;
+    private _loginRedirect;
+    private _findUserById;
+    private _unlink;
+    private _statusForError;
+    private _requestHost;
+    private _requestProtocol;
+    private _json;
+    private _notFound;
+    private _redirectWithError;
+    private _handleUnexpectedError;
+}
+//# sourceMappingURL=OAuthHandler.d.ts.map

package/dist/OAuthHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthHandler.d.ts","sourceRoot":"","sources":["../src/OAuthHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAEhF,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,cAAc,CAAA;AAE/D,OAAO,EAKL,wBAAwB,EAKzB,MAAM,0BAA0B,CAAA;AAcjC,OAAO,EAAyB,aAAa,EAAE,MAAM,eAAe,CAAA;AAMpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAS1D,OAAO,KAAK,EAAE,mBAAmB,EAA2B,MAAM,YAAY,CAAA;AAgB9E;;;;;;;;;GASG;AACH,qBAAa,YAAY,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpE,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAA;IACrC,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,cAAc,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAA;IAC3D,UAAU,EAAE,aAAa,CAAA;IACzB,YAAY,EAAE,GAAG,CAAA;IACjB,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAA;gBAGpD,KAAK,EAAE,oBAAoB,GAAG,OAAO,EACrC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC;IAkBnC,IAAI,iBAAiB,IAAI,sBAAsB,CAQ9C;IAEK,IAAI;IAIJ,MAAM;;;;;;IA4DZ;;;;OAIG;IACH,OAAO,KAAK,wBAAwB,GAEnC;YAIa,UAAU;YAmEV,SAAS;YAgGT,YAAY;YAoBZ,aAAa;YA+Cb,WAAW;IAiCzB,OAAO,CAAC,cAAc;YAYR,aAAa;YASb,OAAO;IAsFrB,OAAO,CAAC,eAAe;IAiBvB,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,KAAK;IAWb,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,sBAAsB;CAY/B"}

package/dist/OAuthHandler.js

@@ -0,0 +1,481 @@
+import { createCorsContext, isFetchApiRequest } from "@cedarjs/api";
+import {
+  createExpiresAtDate,
+  createLoginResponse,
+  dbAuthSession,
+  extractCookie,
+  getDbAuthResponseBuilder,
+  isProxiedRequest,
+  isRequestOriginTrusted,
+  resolveRequestHost,
+  resolveRequestProtocol
+} from "@cedarjs/auth-dbauth-api";
+import {
+  CannotUnlinkLastIdentityError,
+  EmailInUseError,
+  FlowNotEnabledError,
+  IdentityInUseError,
+  NotAuthenticatedError,
+  OAuthError,
+  UnknownIdentityError,
+  UnknownProviderError,
+  UntrustedOriginError
+} from "./errors.js";
+import { resolveIdentityFields, IdentityModel } from "./identity.js";
+import {
+  normalizeOAuthRequest,
+  parseAuthorizeFlow,
+  parseOAuthRoute
+} from "./request.js";
+import {
+  clearTransactionCookieString,
+  createTransactionCookieString,
+  decodeTransactionCookie,
+  DEFAULT_TRANSACTION_EXPIRES_SECONDS,
+  getTransactionCookieValue,
+  isTransactionExpired
+} from "./transactionCookie.js";
+function appendQueryParams(path, params) {
+  const separator = path.includes("?") ? "&" : "?";
+  return `${path}${separator}${new URLSearchParams(params).toString()}`;
+}
+class OAuthHandler {
+  event;
+  options;
+  basePath;
+  corsContext;
+  createResponse;
+  identities;
+  userAccessor;
+  _normalizedRequest;
+  constructor(event, _context, options) {
+    this.event = event;
+    this.options = options;
+    this.basePath = options.basePath ?? "/auth/oauth";
+    this.createResponse = getDbAuthResponseBuilder(event);
+    if (options.cors) {
+      this.corsContext = createCorsContext(options.cors);
+    }
+    this.userAccessor = options.db[options.authModelAccessor];
+    this.identities = new IdentityModel(
+      options.db[options.oauthModelAccessor],
+      resolveIdentityFields(options.oauthFields)
+    );
+  }
+  get normalizedRequest() {
+    if (!this._normalizedRequest) {
+      throw new Error(
+        "OAuthHandler has not been initialized. Either await oauthHandler.invoke() or call await oauthHandler.init()."
+      );
+    }
+    return this._normalizedRequest;
+  }
+  async init() {
+    this._normalizedRequest ??= await normalizeOAuthRequest(this.event);
+  }
+  async invoke() {
+    let corsHeaders = {};
+    await this.init();
+    if (this.corsContext) {
+      const corsRequest = {
+        ...this.normalizedRequest,
+        jsonBody: {}
+      };
+      corsHeaders = this.corsContext.getRequestHeaders(corsRequest);
+      if (this.corsContext.shouldHandleCors(corsRequest)) {
+        return this.createResponse({ body: "", statusCode: 200 }, corsHeaders);
+      }
+    }
+    const route = parseOAuthRoute(this.normalizedRequest.path, this.basePath);
+    if (!route) {
+      return this.createResponse(this._notFound(), corsHeaders);
+    }
+    const { method } = this.normalizedRequest;
+    if (route.action === "authorize") {
+      if (method !== "GET") {
+        return this.createResponse(this._notFound(), corsHeaders);
+      }
+      return this.createResponse(
+        await this._authorize(route.provider),
+        corsHeaders
+      );
+    }
+    if (route.action === "callback") {
+      if (method !== "GET" && method !== "POST") {
+        return this.createResponse(this._notFound(), corsHeaders);
+      }
+      return this.createResponse(
+        await this._callback(route.provider),
+        corsHeaders
+      );
+    }
+    if (method !== "POST") {
+      return this.createResponse(this._notFound(), corsHeaders);
+    }
+    return this.createResponse(await this._unlink(route.provider), corsHeaders);
+  }
+  /**
+   * Cookie config for the transaction cookie: `transactionCookie` when set,
+   * otherwise falls back to `cookie` (the same config the session cookie
+   * uses).
+   */
+  get _transactionCookieConfig() {
+    return this.options.transactionCookie ?? this.options.cookie;
+  }
+  // -- authorize --------------------------------------------------------
+  async _authorize(providerKey) {
+    const strategy = this.options.providers[providerKey];
+    if (!strategy) {
+      return this._redirectWithError("unknown_provider", providerKey);
+    }
+    const flow = parseAuthorizeFlow(this.normalizedRequest.query);
+    if (flow === "signup" && this.options.signup.enabled === false) {
+      return this._redirectWithError("flow_not_enabled", providerKey);
+    }
+    if (flow === "link") {
+      const session = dbAuthSession(this.event, this.options.cookie?.name);
+      if (!session) {
+        return this._redirectWithError("not_authenticated", providerKey);
+      }
+    }
+    try {
+      const oauth = await import("oauth4webapi");
+      const state = oauth.generateRandomState();
+      const codeVerifier = oauth.generateRandomCodeVerifier();
+      const codeChallenge = await oauth.calculatePKCECodeChallenge(codeVerifier);
+      const nonce = strategy.usesOidc ? oauth.generateRandomNonce() : void 0;
+      const authorizationUrl = await strategy.getAuthorizationUrl({
+        provider: providerKey,
+        redirectUri: strategy.redirectUri,
+        flow,
+        state,
+        codeVerifier,
+        codeChallenge,
+        nonce
+      });
+      const transactionExpires = this.options.transactionExpires ?? DEFAULT_TRANSACTION_EXPIRES_SECONDS;
+      const headers = new Headers();
+      headers.set("Location", authorizationUrl.toString());
+      headers.append(
+        "set-cookie",
+        createTransactionCookieString({
+          data: {
+            provider: providerKey,
+            flow,
+            state,
+            codeVerifier,
+            nonce,
+            createdAt: Date.now()
+          },
+          cookieConfig: this._transactionCookieConfig,
+          expiresSeconds: transactionExpires
+        })
+      );
+      return { body: "", statusCode: 302, headers };
+    } catch (e) {
+      return this._handleUnexpectedError(e, providerKey);
+    }
+  }
+  // -- callback -----------------------------------------------------------
+  async _callback(providerKey) {
+    const clearCookieHeaders = new Headers();
+    clearCookieHeaders.append(
+      "set-cookie",
+      clearTransactionCookieString(this._transactionCookieConfig)
+    );
+    const cookieHeader = extractCookie(this.event);
+    const txn = decodeTransactionCookie(getTransactionCookieValue(cookieHeader));
+    const transactionExpires = this.options.transactionExpires ?? DEFAULT_TRANSACTION_EXPIRES_SECONDS;
+    if (!txn || txn?.provider !== providerKey) {
+      return this._redirectWithError(
+        "invalid_state",
+        providerKey,
+        clearCookieHeaders
+      );
+    }
+    if (isTransactionExpired(txn, transactionExpires)) {
+      return this._redirectWithError(
+        "invalid_state",
+        providerKey,
+        clearCookieHeaders
+      );
+    }
+    const strategy = this.options.providers[providerKey];
+    if (!strategy) {
+      return this._redirectWithError(
+        "unknown_provider",
+        providerKey,
+        clearCookieHeaders
+      );
+    }
+    const { query, form } = this.normalizedRequest;
+    if (query.error ?? form.error) {
+      return this._redirectWithError(
+        "provider_error",
+        providerKey,
+        clearCookieHeaders
+      );
+    }
+    const state = query.state ?? form.state;
+    if (!state || state !== txn.state) {
+      return this._redirectWithError(
+        "invalid_state",
+        providerKey,
+        clearCookieHeaders
+      );
+    }
+    let profile;
+    try {
+      profile = await strategy.handleCallback({
+        provider: providerKey,
+        redirectUri: strategy.redirectUri,
+        flow: txn.flow,
+        state: txn.state,
+        codeVerifier: txn.codeVerifier,
+        nonce: txn.nonce,
+        query,
+        form
+      });
+    } catch (e) {
+      return this._handleUnexpectedError(e, providerKey, clearCookieHeaders);
+    }
+    try {
+      let result;
+      if (txn.flow === "login") {
+        result = await this._handleLogin(providerKey, profile);
+      } else if (txn.flow === "signup") {
+        result = await this._handleSignup(providerKey, profile);
+      } else {
+        result = await this._handleLink(providerKey, profile);
+      }
+      result.headers.append(
+        "set-cookie",
+        clearTransactionCookieString(this._transactionCookieConfig)
+      );
+      return result;
+    } catch (e) {
+      if (e instanceof OAuthError) {
+        return this._redirectWithError(e.code, providerKey, clearCookieHeaders);
+      }
+      return this._handleUnexpectedError(e, providerKey, clearCookieHeaders);
+    }
+  }
+  async _handleLogin(providerKey, profile) {
+    const identity = await this.identities.findByProviderUserId(
+      providerKey,
+      profile.providerUserId
+    );
+    if (!identity) {
+      throw new UnknownIdentityError(providerKey);
+    }
+    const user = await this._findUserById(this.identities.userIdOf(identity));
+    if (!user) {
+      throw new UnknownIdentityError(providerKey);
+    }
+    return this._loginRedirect(user, this.options.redirects.afterLogin);
+  }
+  async _handleSignup(providerKey, profile) {
+    if (this.options.signup.enabled === false) {
+      throw new FlowNotEnabledError();
+    }
+    const existingIdentity = await this.identities.findByProviderUserId(
+      providerKey,
+      profile.providerUserId
+    );
+    if (existingIdentity) {
+      const user2 = await this._findUserById(
+        this.identities.userIdOf(existingIdentity)
+      );
+      if (user2) {
+        return this._loginRedirect(user2, this.options.redirects.afterLogin);
+      }
+    }
+    if (profile.email) {
+      const existingUser = await this.userAccessor.findFirst({
+        where: { [this.options.authFields.username]: profile.email }
+      });
+      if (existingUser) {
+        throw new EmailInUseError();
+      }
+    }
+    const signup = this.options.signup;
+    if (!("handler" in signup)) {
+      throw new FlowNotEnabledError();
+    }
+    const user = await signup.handler({ provider: providerKey, profile });
+    const userId = user[this.options.authFields.id];
+    await this.identities.create(userId, providerKey, profile);
+    return this._loginRedirect(
+      user,
+      this.options.redirects.afterSignup ?? this.options.redirects.afterLogin
+    );
+  }
+  async _handleLink(providerKey, profile) {
+    const session = dbAuthSession(this.event, this.options.cookie?.name);
+    if (!session) {
+      throw new NotAuthenticatedError();
+    }
+    const userId = session[this.options.authFields.id];
+    const existingIdentity = await this.identities.findByProviderUserId(
+      providerKey,
+      profile.providerUserId
+    );
+    if (existingIdentity) {
+      const existingUserId = this.identities.userIdOf(existingIdentity);
+      if (existingUserId !== userId) {
+        throw new IdentityInUseError();
+      }
+    } else {
+      await this.identities.create(userId, providerKey, profile);
+    }
+    const headers = new Headers();
+    headers.set(
+      "Location",
+      this.options.redirects.afterLink ?? this.options.redirects.afterLogin
+    );
+    return { body: "", statusCode: 302, headers };
+  }
+  _loginRedirect(user, redirectTo) {
+    const expiresAt = createExpiresAtDate(this.options.sessionExpires);
+    const [, headers] = createLoginResponse(user, {
+      cookie: this.options.cookie,
+      allowedUserFields: this.options.allowedUserFields,
+      expiresAt
+    });
+    headers.set("Location", redirectTo);
+    return { body: "", statusCode: 302, headers };
+  }
+  async _findUserById(userId) {
+    const user = await this.userAccessor.findFirst({
+      where: { [this.options.authFields.id]: userId }
+    });
+    return user ?? null;
+  }
+  // -- unlink ---------------------------------------------------------------
+  async _unlink(providerKey) {
+    try {
+      if (!isRequestOriginTrusted(
+        {
+          method: this.normalizedRequest.method,
+          headers: this.normalizedRequest.headers,
+          host: this._requestHost(),
+          protocol: this._requestProtocol(),
+          proxied: isProxiedRequest(this.normalizedRequest.headers)
+        },
+        {
+          trustedOrigins: this.options.trustedOrigins,
+          corsOrigin: this.options.cors?.origin
+        }
+      )) {
+        throw new UntrustedOriginError();
+      }
+      const session = dbAuthSession(this.event, this.options.cookie?.name);
+      if (!session) {
+        throw new NotAuthenticatedError();
+      }
+      const userId = session[this.options.authFields.id];
+      if (!this.options.providers[providerKey]) {
+        throw new UnknownProviderError(providerKey);
+      }
+      const identity = await this.identities.findByUserAndProvider(
+        userId,
+        providerKey
+      );
+      if (!identity) {
+        return this._json({ error: "unknown_identity" }, 404);
+      }
+      const user = await this._findUserById(userId);
+      const hasPassword = Boolean(
+        user?.[this.options.authFields.hashedPassword]
+      );
+      if (!hasPassword) {
+        const allIdentities = await this.identities.findAllForUser(userId);
+        if (allIdentities.length <= 1) {
+          throw new CannotUnlinkLastIdentityError();
+        }
+      }
+      await this.identities.delete(userId, providerKey);
+      if (!hasPassword) {
+        const remaining = await this.identities.findAllForUser(userId);
+        if (remaining.length === 0) {
+          await this.identities.create(
+            userId,
+            providerKey,
+            this.identities.profileOf(identity)
+          );
+          throw new CannotUnlinkLastIdentityError();
+        }
+      }
+      return this._json({ ok: true }, 200);
+    } catch (e) {
+      if (e instanceof OAuthError) {
+        return this._json({ error: e.code }, this._statusForError(e.code));
+      }
+      const message = e instanceof Error ? e.message : String(e);
+      console.error("[@cedarjs/auth-dbauth-oauth] unlink failed:", message);
+      return this._json({ error: "server_error" }, 500);
+    }
+  }
+  _statusForError(code) {
+    switch (code) {
+      case "not_authenticated":
+        return 401;
+      case "untrusted_origin":
+        return 403;
+      case "unknown_provider":
+        return 404;
+      default:
+        return 400;
+    }
+  }
+  // best-effort host the request was sent to, used by origin validation to
+  // allow same-origin `unlink` requests through with no extra
+  // configuration. Prefers `X-Forwarded-Host` over the connection-level
+  // host/URL -- see `resolveRequestHost` for why that's safe behind a proxy
+  _requestHost() {
+    return resolveRequestHost(
+      this.normalizedRequest.headers,
+      isFetchApiRequest(this.event) ? this.event.url : void 0
+    );
+  }
+  // best-effort scheme the request arrived over, used alongside
+  // `_requestHost` for origin validation. See `resolveRequestProtocol` for
+  // when it can and can't be determined reliably
+  _requestProtocol() {
+    return resolveRequestProtocol(
+      this.normalizedRequest.headers,
+      isFetchApiRequest(this.event) ? this.event.url : void 0
+    );
+  }
+  // -- response helpers -------------------------------------------------
+  _json(data, statusCode) {
+    return {
+      body: JSON.stringify(data),
+      statusCode,
+      headers: new Headers({ "content-type": "application/json" })
+    };
+  }
+  _notFound() {
+    return this._json({ error: "not_found" }, 404);
+  }
+  _redirectWithError(code, providerKey, extraHeaders) {
+    const headers = extraHeaders ? new Headers(extraHeaders) : new Headers();
+    headers.set(
+      "Location",
+      appendQueryParams(this.options.redirects.error, {
+        error: code,
+        provider: providerKey
+      })
+    );
+    return { body: "", statusCode: 302, headers };
+  }
+  _handleUnexpectedError(e, providerKey, extraHeaders) {
+    const message = e instanceof Error ? e.message : String(e);
+    console.error("[@cedarjs/auth-dbauth-oauth]", message);
+    const code = e instanceof OAuthError ? e.code : "server_error";
+    return this._redirectWithError(code, providerKey, extraHeaders);
+  }
+}
+export {
+  OAuthHandler
+};

package/dist/errors.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Stable, documented error codes surfaced to the browser via the `error`
+ * query param on the configured error-redirect (or in the JSON body for the
+ * `unlink` flow, which never redirects). Exception text is never leaked to
+ * the client — only one of these codes is.
+ */
+export type OAuthErrorCode = 'unknown_provider' | 'invalid_state' | 'provider_error' | 'unknown_identity' | 'email_in_use' | 'identity_in_use' | 'not_authenticated' | 'flow_not_enabled' | 'cannot_unlink_last_identity' | 'untrusted_origin' | 'server_error';
+/**
+ * Base class for every error the OAuth handler throws. `code` is the stable
+ * identifier written to the error-redirect/JSON response; `message` is for
+ * server-side logs only and is never sent to the client.
+ */
+export declare class OAuthError extends Error {
+    code: OAuthErrorCode;
+    constructor(code: OAuthErrorCode, message: string);
+}
+export declare class UnknownProviderError extends OAuthError {
+    constructor(provider: string);
+}
+export declare class InvalidStateError extends OAuthError {
+    constructor(message?: string);
+}
+export declare class ProviderError extends OAuthError {
+    constructor(message: string);
+}
+export declare class UnknownIdentityError extends OAuthError {
+    constructor(provider: string);
+}
+export declare class EmailInUseError extends OAuthError {
+    constructor(message?: string);
+}
+export declare class IdentityInUseError extends OAuthError {
+    constructor(message?: string);
+}
+export declare class NotAuthenticatedError extends OAuthError {
+    constructor(message?: string);
+}
+export declare class FlowNotEnabledError extends OAuthError {
+    constructor(message?: string);
+}
+export declare class CannotUnlinkLastIdentityError extends OAuthError {
+    constructor(message?: string);
+}
+export declare class UntrustedOriginError extends OAuthError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,kBAAkB,GAClB,eAAe,GACf,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,mBAAmB,GACnB,kBAAkB,GAClB,6BAA6B,GAC7B,kBAAkB,GAClB,cAAc,CAAA;AAElB;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,IAAI,EAAE,cAAc,CAAA;gBAER,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM;CAKlD;AAED,qBAAa,oBAAqB,SAAQ,UAAU;gBACtC,QAAQ,EAAE,MAAM;CAI7B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBAE7C,OAAO,SAA0E;CAKpF;AAED,qBAAa,aAAc,SAAQ,UAAU;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;gBACtC,QAAQ,EAAE,MAAM;CAO7B;AAED,qBAAa,eAAgB,SAAQ,UAAU;gBACjC,OAAO,SAAsD;CAI1E;AAED,qBAAa,kBAAmB,SAAQ,UAAU;gBACpC,OAAO,SAAuD;CAI3E;AAED,qBAAa,qBAAsB,SAAQ,UAAU;gBACvC,OAAO,SAAuD;CAI3E;AAED,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,SAAmC;CAIvD;AAED,qBAAa,6BAA8B,SAAQ,UAAU;gBAEzD,OAAO,SAAyE;CAKnF;AAED,qBAAa,oBAAqB,SAAQ,UAAU;gBACtC,OAAO,SAAkC;CAItD"}

package/dist/errors.js

@@ -0,0 +1,84 @@
+class OAuthError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "OAuthError";
+    this.code = code;
+  }
+}
+class UnknownProviderError extends OAuthError {
+  constructor(provider) {
+    super("unknown_provider", `No OAuth provider configured for '${provider}'`);
+    this.name = "UnknownProviderError";
+  }
+}
+class InvalidStateError extends OAuthError {
+  constructor(message = "OAuth transaction cookie is missing, expired, or state does not match") {
+    super("invalid_state", message);
+    this.name = "InvalidStateError";
+  }
+}
+class ProviderError extends OAuthError {
+  constructor(message) {
+    super("provider_error", message);
+    this.name = "ProviderError";
+  }
+}
+class UnknownIdentityError extends OAuthError {
+  constructor(provider) {
+    super(
+      "unknown_identity",
+      `No account is linked to this ${provider} identity`
+    );
+    this.name = "UnknownIdentityError";
+  }
+}
+class EmailInUseError extends OAuthError {
+  constructor(message = "An account already exists with this email address") {
+    super("email_in_use", message);
+    this.name = "EmailInUseError";
+  }
+}
+class IdentityInUseError extends OAuthError {
+  constructor(message = "This identity is already linked to another account") {
+    super("identity_in_use", message);
+    this.name = "IdentityInUseError";
+  }
+}
+class NotAuthenticatedError extends OAuthError {
+  constructor(message = "You must be logged in to link or unlink an account") {
+    super("not_authenticated", message);
+    this.name = "NotAuthenticatedError";
+  }
+}
+class FlowNotEnabledError extends OAuthError {
+  constructor(message = "This OAuth flow is not enabled") {
+    super("flow_not_enabled", message);
+    this.name = "FlowNotEnabledError";
+  }
+}
+class CannotUnlinkLastIdentityError extends OAuthError {
+  constructor(message = "Cannot unlink the last identity from an account with no password set") {
+    super("cannot_unlink_last_identity", message);
+    this.name = "CannotUnlinkLastIdentityError";
+  }
+}
+class UntrustedOriginError extends OAuthError {
+  constructor(message = "Request origin is not trusted") {
+    super("untrusted_origin", message);
+    this.name = "UntrustedOriginError";
+  }
+}
+export {
+  CannotUnlinkLastIdentityError,
+  EmailInUseError,
+  FlowNotEnabledError,
+  IdentityInUseError,
+  InvalidStateError,
+  NotAuthenticatedError,
+  OAuthError,
+  ProviderError,
+  UnknownIdentityError,
+  UnknownProviderError,
+  UntrustedOriginError
+};