@cedarjs/auth-dbauth-oauth 7.0.0-canary.3075

package/dist/identity.d.ts

@@ -0,0 +1,26 @@
+import type { OAuthIdentityFields, OAuthUserInfo, UserType } from './types.js';
+export declare function resolveIdentityFields(fields: Partial<OAuthIdentityFields> | undefined): OAuthIdentityFields;
+/**
+ * Thin wrapper around the identity model accessor (`db[oauthModelAccessor]`)
+ * that reads/writes through the configured field names, so the rest of the
+ * handler can talk about `provider`/`providerUserId`/`userId` without caring
+ * how the app named its Prisma columns.
+ */
+export declare class IdentityModel {
+    private accessor;
+    private fields;
+    constructor(accessor: any, fields: OAuthIdentityFields);
+    findByProviderUserId(provider: string, providerUserId: string): Promise<UserType | null>;
+    findByUserAndProvider(userId: unknown, provider: string): Promise<UserType | null>;
+    findAllForUser(userId: unknown): Promise<UserType[]>;
+    create(userId: unknown, provider: string, profile: OAuthUserInfo): Promise<UserType>;
+    delete(userId: unknown, provider: string): Promise<void>;
+    userIdOf(identity: UserType): unknown;
+    /**
+     * Reads a fetched identity row back into the `OAuthUserInfo` shape
+     * `create` accepts, so a row can be recreated from a snapshot taken
+     * before it was deleted.
+     */
+    profileOf(identity: UserType): OAuthUserInfo;
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAG9E,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,SAAS,GAC/C,mBAAmB,CAUrB;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,MAAM,CAAqB;gBAEvB,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,mBAAmB;IAKhD,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAWrB,qBAAqB,CACzB,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAWrB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAMpD,MAAM,CACV,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,QAAQ,CAAC;IAgBd,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO;IAIrC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,aAAa;CAO7C"}

package/dist/identity.js

@@ -0,0 +1,76 @@
+import { DEFAULT_OAUTH_IDENTITY_FIELDS } from "./types.js";
+function resolveIdentityFields(fields) {
+  const definedFields = Object.fromEntries(
+    Object.entries(fields ?? {}).filter(([, value]) => value !== void 0)
+  );
+  return { ...DEFAULT_OAUTH_IDENTITY_FIELDS, ...definedFields };
+}
+class IdentityModel {
+  accessor;
+  fields;
+  constructor(accessor, fields) {
+    this.accessor = accessor;
+    this.fields = fields;
+  }
+  async findByProviderUserId(provider, providerUserId) {
+    const record = await this.accessor.findFirst({
+      where: {
+        [this.fields.provider]: provider,
+        [this.fields.providerUserId]: providerUserId
+      }
+    });
+    return record ?? null;
+  }
+  async findByUserAndProvider(userId, provider) {
+    const record = await this.accessor.findFirst({
+      where: {
+        [this.fields.userId]: userId,
+        [this.fields.provider]: provider
+      }
+    });
+    return record ?? null;
+  }
+  async findAllForUser(userId) {
+    return this.accessor.findMany({
+      where: { [this.fields.userId]: userId }
+    });
+  }
+  async create(userId, provider, profile) {
+    return this.accessor.create({
+      data: {
+        [this.fields.userId]: userId,
+        [this.fields.provider]: provider,
+        [this.fields.providerUserId]: profile.providerUserId,
+        ...profile.username ? { [this.fields.providerUsername]: profile.username } : {},
+        ...profile.email ? { [this.fields.providerEmail]: profile.email } : {}
+      }
+    });
+  }
+  async delete(userId, provider) {
+    await this.accessor.deleteMany({
+      where: {
+        [this.fields.userId]: userId,
+        [this.fields.provider]: provider
+      }
+    });
+  }
+  userIdOf(identity) {
+    return identity[this.fields.userId];
+  }
+  /**
+   * Reads a fetched identity row back into the `OAuthUserInfo` shape
+   * `create` accepts, so a row can be recreated from a snapshot taken
+   * before it was deleted.
+   */
+  profileOf(identity) {
+    return {
+      providerUserId: identity[this.fields.providerUserId],
+      username: identity[this.fields.providerUsername] ?? void 0,
+      email: identity[this.fields.providerEmail] ?? void 0
+    };
+  }
+}
+export {
+  IdentityModel,
+  resolveIdentityFields
+};

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { OAuthHandler } from './OAuthHandler.js';
+export * from './errors.js';
+export * from './types.js';
+export { createOidcStrategy } from './oidc.js';
+export { GOOGLE_PRESET, googleProvider } from './providers/google.js';
+export { githubProvider } from './strategies/github.js';
+export { parseOAuthRoute, parseAuthorizeFlow, normalizeOAuthRequest, } from './request.js';
+export type { NormalizedOAuthRequest, OAuthRoute } from './request.js';
+export { TRANSACTION_COOKIE_NAME, DEFAULT_TRANSACTION_EXPIRES_SECONDS, } from './transactionCookie.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,EACL,uBAAuB,EACvB,mCAAmC,GACpC,MAAM,wBAAwB,CAAA"}

package/dist/index.js

@@ -0,0 +1,27 @@
+import { OAuthHandler } from "./OAuthHandler.js";
+export * from "./errors.js";
+export * from "./types.js";
+import { createOidcStrategy } from "./oidc.js";
+import { GOOGLE_PRESET, googleProvider } from "./providers/google.js";
+import { githubProvider } from "./strategies/github.js";
+import {
+  parseOAuthRoute,
+  parseAuthorizeFlow,
+  normalizeOAuthRequest
+} from "./request.js";
+import {
+  TRANSACTION_COOKIE_NAME,
+  DEFAULT_TRANSACTION_EXPIRES_SECONDS
+} from "./transactionCookie.js";
+export {
+  DEFAULT_TRANSACTION_EXPIRES_SECONDS,
+  GOOGLE_PRESET,
+  OAuthHandler,
+  TRANSACTION_COOKIE_NAME,
+  createOidcStrategy,
+  githubProvider,
+  googleProvider,
+  normalizeOAuthRequest,
+  parseAuthorizeFlow,
+  parseOAuthRoute
+};

package/dist/oidc.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthProviderCredentials, OAuthStrategy, ProviderPreset } from './types.js';
+/**
+ * Turns a data-only `ProviderPreset` (issuer, default scope) plus per-app
+ * credentials into a full `OAuthStrategy`, using `oauth4webapi` for OIDC
+ * discovery, the authorization-code + PKCE + nonce flow, and id_token
+ * verification. `oauth4webapi` is an optional peer dependency and is only
+ * ever lazy-imported here, so apps that don't configure any OIDC provider
+ * never need it installed.
+ */
+export declare function createOidcStrategy(preset: ProviderPreset, credentials: OAuthProviderCredentials): OAuthStrategy;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,wBAAwB,EACxB,aAAa,EAEb,cAAc,EACf,MAAM,YAAY,CAAA;AAEnB;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,wBAAwB,GACpC,aAAa,CA2If"}

package/dist/oidc.js

@@ -0,0 +1,99 @@
+import { ProviderError } from "./errors.js";
+function createOidcStrategy(preset, credentials) {
+  let discoveryPromise;
+  async function discover() {
+    const oauth = await import("oauth4webapi");
+    const issuer = new URL(preset.issuer);
+    const insecureOptions = credentials.allowInsecureRequests ? { [oauth.allowInsecureRequests]: true } : {};
+    const response = await oauth.discoveryRequest(issuer, insecureOptions);
+    const as = await oauth.processDiscoveryResponse(issuer, response);
+    const client = {
+      client_id: credentials.clientId
+    };
+    const clientAuth = oauth.ClientSecretPost(credentials.clientSecret);
+    return { oauth, as, client, clientAuth };
+  }
+  function getDiscovery() {
+    if (!discoveryPromise) {
+      discoveryPromise = discover();
+      discoveryPromise.catch(() => {
+        discoveryPromise = void 0;
+      });
+    }
+    return discoveryPromise;
+  }
+  return {
+    name: preset.name,
+    redirectUri: credentials.redirectUri,
+    usesOidc: true,
+    async getAuthorizationUrl(ctx) {
+      const { as } = await getDiscovery();
+      if (!as.authorization_endpoint) {
+        throw new ProviderError(
+          `${preset.name} discovery document has no authorization_endpoint`
+        );
+      }
+      const url = new URL(as.authorization_endpoint);
+      url.searchParams.set("client_id", credentials.clientId);
+      url.searchParams.set("redirect_uri", ctx.redirectUri);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("scope", credentials.scope ?? preset.scope);
+      url.searchParams.set("state", ctx.state);
+      url.searchParams.set("code_challenge", ctx.codeChallenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      if (ctx.nonce) {
+        url.searchParams.set("nonce", ctx.nonce);
+      }
+      return url;
+    },
+    async handleCallback(ctx) {
+      const { oauth, as, client, clientAuth } = await getDiscovery();
+      const rawParams = { ...ctx.query, ...ctx.form };
+      const params = oauth.validateAuthResponse(
+        as,
+        client,
+        new URLSearchParams(rawParams),
+        ctx.state
+      );
+      const insecureOptions = credentials.allowInsecureRequests ? { [oauth.allowInsecureRequests]: true } : {};
+      const response = await oauth.authorizationCodeGrantRequest(
+        as,
+        client,
+        clientAuth,
+        params,
+        ctx.redirectUri,
+        ctx.codeVerifier,
+        insecureOptions
+      );
+      const result = await oauth.processAuthorizationCodeResponse(
+        as,
+        client,
+        response,
+        {
+          expectedNonce: ctx.nonce ?? oauth.expectNoNonce,
+          requireIdToken: true
+        }
+      );
+      const claims = oauth.getValidatedIdTokenClaims(result);
+      if (!claims) {
+        throw new ProviderError(`${preset.name} did not return an id_token`);
+      }
+      const emailVerified = typeof claims.email_verified === "boolean" ? claims.email_verified : void 0;
+      return {
+        providerUserId: claims.sub,
+        // An unverified email must never seed a username or feed the
+        // duplicate-account (`email_in_use`) check -- anyone can put an
+        // arbitrary address in an OIDC profile the provider hasn't
+        // confirmed they control, so only a claim with
+        // `email_verified: true` is passed through.
+        email: typeof claims.email === "string" && emailVerified === true ? claims.email : void 0,
+        emailVerified,
+        username: typeof claims.name === "string" ? claims.name : void 0,
+        raw: claims
+      };
+    }
+  };
+}
+export {
+  createOidcStrategy
+};

package/dist/providers/google.d.ts

@@ -0,0 +1,24 @@
+import type { OAuthProviderCredentials, OAuthStrategy, ProviderPreset } from '../types.js';
+/**
+ * Data-only Google OIDC preset. Google publishes discovery at
+ * `https://accounts.google.com/.well-known/openid-configuration`.
+ *
+ * @see https://developers.google.com/identity/openid-connect/openid-connect
+ */
+export declare const GOOGLE_PRESET: ProviderPreset;
+/**
+ * Convenience factory: `createOidcStrategy(GOOGLE_PRESET, credentials)`.
+ *
+ * @example
+ * ```ts
+ * providers: {
+ *   google: googleProvider({
+ *     clientId: process.env.GOOGLE_CLIENT_ID,
+ *     clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+ *     redirectUri: `${apiUrl}/auth/oauth/google/callback`,
+ *   }),
+ * }
+ * ```
+ */
+export declare function googleProvider(credentials: OAuthProviderCredentials): OAuthStrategy;
+//# sourceMappingURL=google.d.ts.map

package/dist/providers/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/providers/google.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,wBAAwB,EACxB,aAAa,EACb,cAAc,EACf,MAAM,aAAa,CAAA;AAEpB;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,cAI3B,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,wBAAwB,GACpC,aAAa,CAEf"}

package/dist/providers/google.js

@@ -0,0 +1,13 @@
+import { createOidcStrategy } from "../oidc.js";
+const GOOGLE_PRESET = {
+  name: "Google",
+  issuer: "https://accounts.google.com",
+  scope: "openid email profile"
+};
+function googleProvider(credentials) {
+  return createOidcStrategy(GOOGLE_PRESET, credentials);
+}
+export {
+  GOOGLE_PRESET,
+  googleProvider
+};

package/dist/request.d.ts

@@ -0,0 +1,36 @@
+import type { APIGatewayProxyEvent } from 'aws-lambda';
+import type { OAuthFlow } from './types.js';
+export interface NormalizedOAuthRequest {
+    method: string;
+    /** URL pathname, e.g. `/auth/oauth/google/callback`. */
+    path: string;
+    headers: Headers;
+    query: Record<string, string>;
+    /** Parsed `application/x-www-form-urlencoded` body, present on POST callbacks. */
+    form: Record<string, string>;
+}
+/**
+ * Normalizes a Lambda-style event or a Fetch `Request` into the subset of
+ * fields the OAuth handler needs. Unlike `@cedarjs/api`'s `normalizeRequest`
+ * (which always JSON-parses the body), this also handles
+ * `application/x-www-form-urlencoded` bodies — required for `form_post`
+ * callbacks (Apple-shaped providers POST the callback as a form, not JSON).
+ */
+export declare function normalizeOAuthRequest(event: APIGatewayProxyEvent | Request): Promise<NormalizedOAuthRequest>;
+export interface OAuthRoute {
+    provider: string;
+    action: 'authorize' | 'callback' | 'unlink';
+}
+/**
+ * Parses `{basePath}/{provider}/{action}` out of a request path. Returns
+ * `null` when the path doesn't match a recognized OAuth route (the caller
+ * should treat that as a 404).
+ */
+export declare function parseOAuthRoute(path: string, basePath: string): OAuthRoute | null;
+/**
+ * Reads the `flow` query param off an `/authorize` request. Defaults to
+ * `'login'`. Anything other than `login`/`signup`/`link` is treated as
+ * `login` too — `authorize` never accepts `unlink` as a flow.
+ */
+export declare function parseAuthorizeFlow(query: Record<string, string>): Extract<OAuthFlow, 'login' | 'signup' | 'link'>;
+//# sourceMappingURL=request.d.ts.map

package/dist/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAItD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7B;AAqFD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,oBAAoB,GAAG,OAAO,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAMjC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,QAAQ,CAAA;CAC5C;AA4BD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,UAAU,GAAG,IAAI,CAgCnB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC,CAQjD"}

package/dist/request.js

@@ -0,0 +1,113 @@
+import { isFetchApiRequest } from "@cedarjs/api";
+function parseFormBody(text) {
+  const form = {};
+  new URLSearchParams(text).forEach((value, key) => {
+    form[key] = value;
+  });
+  return form;
+}
+function isFormUrlEncoded(headers) {
+  const contentType = headers.get("content-type") ?? "";
+  return contentType.toLowerCase().includes("application/x-www-form-urlencoded");
+}
+async function normalizeFetchRequest(event) {
+  const url = new URL(event.url);
+  const query = {};
+  url.searchParams.forEach((value, key) => {
+    query[key] = value;
+  });
+  let form = {};
+  if (isFormUrlEncoded(event.headers)) {
+    const text = await event.text();
+    form = text ? parseFormBody(text) : {};
+  }
+  return {
+    method: event.method,
+    path: url.pathname,
+    headers: event.headers,
+    query,
+    form
+  };
+}
+function decodeLambdaBody(event) {
+  if (!event.body) {
+    return "";
+  }
+  return event.isBase64Encoded ? Buffer.from(event.body, "base64").toString("utf-8") : event.body;
+}
+function compactQueryParams(params) {
+  const query = {};
+  for (const [key, value] of Object.entries(params ?? {})) {
+    if (value !== void 0) {
+      query[key] = value;
+    }
+  }
+  return query;
+}
+function normalizeLambdaRequest(event) {
+  const headers = new Headers(event.headers);
+  let form = {};
+  if (isFormUrlEncoded(headers)) {
+    const text = decodeLambdaBody(event);
+    form = text ? parseFormBody(text) : {};
+  }
+  return {
+    method: event.httpMethod,
+    path: event.path,
+    headers,
+    query: compactQueryParams(event.queryStringParameters),
+    form
+  };
+}
+async function normalizeOAuthRequest(event) {
+  if (isFetchApiRequest(event)) {
+    return normalizeFetchRequest(event);
+  }
+  return normalizeLambdaRequest(event);
+}
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") {
+    end--;
+  }
+  return value.slice(0, end);
+}
+function trimLeadingSlashes(value) {
+  let start = 0;
+  while (start < value.length && value[start] === "/") {
+    start++;
+  }
+  return value.slice(start);
+}
+function parseOAuthRoute(path, basePath) {
+  const normalizedBase = trimTrailingSlashes(basePath);
+  if (!path.startsWith(normalizedBase)) {
+    return null;
+  }
+  const boundaryChar = path[normalizedBase.length];
+  if (boundaryChar !== void 0 && boundaryChar !== "/") {
+    return null;
+  }
+  const rest = trimLeadingSlashes(path.slice(normalizedBase.length));
+  const segments = rest.split("/").filter(Boolean);
+  if (segments.length !== 2) {
+    return null;
+  }
+  const [provider, action] = segments;
+  if (action !== "authorize" && action !== "callback" && action !== "unlink") {
+    return null;
+  }
+  return { provider, action };
+}
+function parseAuthorizeFlow(query) {
+  const flow = query.flow;
+  if (flow === "signup" || flow === "link") {
+    return flow;
+  }
+  return "login";
+}
+export {
+  normalizeOAuthRequest,
+  parseAuthorizeFlow,
+  parseOAuthRoute
+};

package/dist/strategies/github.d.ts

@@ -0,0 +1,21 @@
+import type { OAuthProviderCredentials, OAuthStrategy } from '../types.js';
+/**
+ * GitHub's standard user OAuth flow issues no id_token (its OIDC discovery
+ * document is a preview limited to MCP clients), so this strategy is built
+ * entirely through the public `OAuthStrategy` interface — the same one
+ * available to userland strategy packages — rather than the OIDC path in
+ * `oidc.ts`.
+ *
+ * @example
+ * ```ts
+ * providers: {
+ *   github: githubProvider({
+ *     clientId: process.env.GITHUB_CLIENT_ID,
+ *     clientSecret: process.env.GITHUB_CLIENT_SECRET,
+ *     redirectUri: `${apiUrl}/auth/oauth/github/callback`,
+ *   }),
+ * }
+ * ```
+ */
+export declare function githubProvider(credentials: OAuthProviderCredentials): OAuthStrategy;
+//# sourceMappingURL=github.d.ts.map

package/dist/strategies/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/strategies/github.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,wBAAwB,EACxB,aAAa,EAEd,MAAM,aAAa,CAAA;AAoBpB;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,wBAAwB,GACpC,aAAa,CAwGf"}

package/dist/strategies/github.js

@@ -0,0 +1,104 @@
+import { ProviderError } from "../errors.js";
+const AUTHORIZATION_ENDPOINT = "https://github.com/login/oauth/authorize";
+const TOKEN_ENDPOINT = "https://github.com/login/oauth/access_token";
+const PROFILE_ENDPOINT = "https://api.github.com/user";
+const EMAILS_ENDPOINT = "https://api.github.com/user/emails";
+function githubProvider(credentials) {
+  return {
+    name: "GitHub",
+    redirectUri: credentials.redirectUri,
+    usesOidc: false,
+    getAuthorizationUrl(ctx) {
+      const url = new URL(AUTHORIZATION_ENDPOINT);
+      url.searchParams.set("client_id", credentials.clientId);
+      url.searchParams.set("redirect_uri", ctx.redirectUri);
+      url.searchParams.set("scope", credentials.scope ?? "read:user user:email");
+      url.searchParams.set("state", ctx.state);
+      url.searchParams.set("code_challenge", ctx.codeChallenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      return url;
+    },
+    async handleCallback(ctx) {
+      const oauth = await import("oauth4webapi");
+      const as = {
+        issuer: "https://github.com",
+        token_endpoint: TOKEN_ENDPOINT
+      };
+      const client = {
+        client_id: credentials.clientId
+      };
+      const clientAuth = oauth.ClientSecretPost(credentials.clientSecret);
+      const rawParams = { ...ctx.query, ...ctx.form };
+      const params = oauth.validateAuthResponse(
+        as,
+        client,
+        new URLSearchParams(rawParams),
+        ctx.state
+      );
+      const response = await oauth.authorizationCodeGrantRequest(
+        as,
+        client,
+        clientAuth,
+        params,
+        ctx.redirectUri,
+        ctx.codeVerifier,
+        // GitHub's token endpoint returns form-urlencoded by default; ask
+        // for JSON explicitly, which is what oauth4webapi expects to parse.
+        { headers: { Accept: "application/json" } }
+      );
+      const result = await oauth.processAuthorizationCodeResponse(
+        as,
+        client,
+        response,
+        { requireIdToken: false }
+      );
+      const profile = await fetchJson(
+        PROFILE_ENDPOINT,
+        result.access_token
+      );
+      if (typeof profile.id !== "number") {
+        throw new ProviderError(
+          "GitHub profile response is missing a numeric id"
+        );
+      }
+      let email = profile.email ?? void 0;
+      let emailVerified;
+      if (!email) {
+        const emails = await fetchJson(
+          EMAILS_ENDPOINT,
+          result.access_token
+        );
+        const primary = emails.find((e) => e.primary && e.verified);
+        email = primary?.email;
+        emailVerified = primary ? true : void 0;
+      }
+      return {
+        // GitHub's numeric `id` is immutable; `login` (the username) can
+        // change, so it's never used to key account lookup.
+        providerUserId: String(profile.id),
+        email,
+        emailVerified,
+        username: profile.login,
+        raw: profile
+      };
+    }
+  };
+}
+async function fetchJson(url, accessToken) {
+  const response = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      Accept: "application/vnd.github+json",
+      "User-Agent": "CedarJS"
+    }
+  });
+  if (!response.ok) {
+    throw new ProviderError(
+      `GitHub API request to ${url} failed with status ${response.status}`
+    );
+  }
+  return response.json();
+}
+export {
+  githubProvider
+};

package/dist/transactionCookie.d.ts

@@ -0,0 +1,55 @@
+import type { DbAuthCookieConfig } from '@cedarjs/auth-dbauth-api';
+import type { OAuthFlow } from './types.js';
+export declare const TRANSACTION_COOKIE_NAME = "oauth-transaction";
+/** Default lifetime of the OAuth transaction cookie: 10 minutes. */
+export declare const DEFAULT_TRANSACTION_EXPIRES_SECONDS: number;
+export interface OAuthTransactionData {
+    provider: string;
+    flow: OAuthFlow;
+    state: string;
+    codeVerifier: string;
+    nonce?: string;
+    /** Epoch milliseconds the transaction was created at, checked independently of the cookie's `Expires` attribute (which the browser, not the server, enforces). */
+    createdAt: number;
+}
+/**
+ * Encodes transaction data for the cookie value. Reuses `encryptSession`
+ * (AES-256-CBC keyed by `SESSION_SECRET`, same as the dbAuth session cookie)
+ * for the encryption, but not `decryptSession`'s `data;csrf` string
+ * convention — the payload is wrapped in a base64url string first so it can
+ * never collide with the `;` that convention splits on.
+ */
+export declare function encodeTransactionCookie(data: OAuthTransactionData): string;
+/**
+ * Decrypts and decodes a transaction cookie value produced by
+ * `encodeTransactionCookie`. Returns `null` when the cookie is missing,
+ * tampered with, or otherwise unreadable — the caller should treat that as
+ * an expired/invalid transaction rather than a crash.
+ */
+export declare function decodeTransactionCookie(cookieValue: string | null | undefined): OAuthTransactionData | null;
+/**
+ * Returns `true` when the transaction was created more than
+ * `expiresSeconds` ago. The cookie's own `Expires` attribute is enforced by
+ * the browser, not the server, so this is checked independently.
+ */
+export declare function isTransactionExpired(data: OAuthTransactionData, expiresSeconds: number): boolean;
+/**
+ * Builds the `Set-Cookie` header string for the OAuth transaction cookie.
+ */
+export declare function createTransactionCookieString({ data, cookieConfig, expiresSeconds, }: {
+    data: OAuthTransactionData;
+    cookieConfig?: DbAuthCookieConfig;
+    expiresSeconds: number;
+}): string;
+/**
+ * Builds the `Set-Cookie` header string that clears the OAuth transaction
+ * cookie (used once the callback has consumed it, on both success and
+ * failure — clearing on failure prevents a stale transaction from being
+ * replayed).
+ */
+export declare function clearTransactionCookieString(cookieConfig?: DbAuthCookieConfig): string;
+/**
+ * Extracts the raw transaction cookie value out of a `Cookie` header string.
+ */
+export declare function getTransactionCookieValue(cookieHeader: string | null | undefined): string | null;
+//# sourceMappingURL=transactionCookie.d.ts.map

package/dist/transactionCookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transactionCookie.d.ts","sourceRoot":"","sources":["../src/transactionCookie.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,eAAO,MAAM,uBAAuB,sBAAsB,CAAA;AAE1D,oEAAoE;AACpE,eAAO,MAAM,mCAAmC,QAAU,CAAA;AAiB1D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,SAAS,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,kKAAkK;IAClK,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAI1E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC,oBAAoB,GAAG,IAAI,CAyB7B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,cAAc,EAAE,MAAM,GACrB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,IAAI,EACJ,YAAY,EACZ,cAAc,GACf,EAAE;IACD,IAAI,EAAE,oBAAoB,CAAA;IAC1B,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;CACvB,GAAG,MAAM,CAsBT;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,CAAC,EAAE,kBAAkB,GAChC,MAAM,CAKR;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,GAAG,IAAI,CAcf"}