@cedarjs/auth-dbauth-web 7.0.0-canary.3074 → 7.0.0-canary.3077

package/dist/oauth.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Web client for dbAuth's OAuth routes.
+ *
+ * The OAuth handler lives in the same auth function as the rest of dbAuth,
+ * under the `/oauth` sub-path (e.g. `${RWJS_API_URL}/auth/oauth`). This
+ * module derives that base URL exactly the way `dbAuth.ts` does, and offers
+ * the same `dbAuthUrl` override affordance.
+ */
+/**
+ * The three account flows the server distinguishes between, so a user can
+ * never accidentally create a duplicate account by logging in with a
+ * provider.
+ */
+export type OAuthFlow = 'login' | 'signup' | 'link';
+/**
+ * Error codes the OAuth handler's redirect can carry as `?error=<code>`.
+ */
+export type OAuthErrorCode = 'unknown_provider' | 'invalid_state' | 'provider_error' | 'unknown_identity' | 'email_in_use' | 'identity_in_use' | 'not_authenticated' | 'flow_not_enabled' | 'cannot_unlink_last_identity' | 'untrusted_origin' | 'server_error';
+export interface OAuthClientOptions {
+    /**
+     * Overrides the derived dbAuth base URL (the same override `dbAuth.ts`
+     * offers via `DbAuthClientArgs.dbAuthUrl`).
+     */
+    dbAuthUrl?: string;
+}
+export interface GetOAuthUrlOptions extends OAuthClientOptions {
+    /** Which account flow to start. Defaults to `'login'`. */
+    flow?: OAuthFlow;
+}
+export interface UnlinkOAuthProviderSuccess {
+    ok: true;
+}
+export interface UnlinkOAuthProviderFailure {
+    error: string;
+}
+export type UnlinkOAuthProviderResult = UnlinkOAuthProviderSuccess | UnlinkOAuthProviderFailure;
+/**
+ * Builds the absolute URL for a provider's `authorize` route. Navigate the
+ * full page to this URL (e.g. `window.location.href = getOAuthUrl(...)`) —
+ * it starts a browser redirect flow, so it must not be `fetch`ed.
+ */
+export declare function getOAuthUrl(provider: string, options?: GetOAuthUrlOptions): string;
+/**
+ * Unlinks a provider identity from the current dbAuth session. Requires the
+ * dbAuth session cookie, so the request is sent with credentials included.
+ *
+ * The server only accepts this request from a trusted `Origin` (the app's
+ * own origin by default, or one listed in `trustedOrigins`/`cors.origin`) —
+ * see the `trustedOrigins` option on `OAuthHandlerOptions`.
+ */
+export declare function unlinkOAuthProvider(provider: string, options?: OAuthClientOptions): Promise<UnlinkOAuthProviderResult>;
+/**
+ * Extracts and narrows the `error` query param the OAuth handler's redirect
+ * carries after a failed flow. Returns `null` when there is no `error`
+ * param, or when its value isn't one of the known OAuth error codes.
+ */
+export declare function getOAuthError(searchParams: URLSearchParams | string): OAuthErrorCode | null;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEnD;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,kBAAkB,GAClB,eAAe,GACf,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,mBAAmB,GACnB,kBAAkB,GAClB,6BAA6B,GAC7B,kBAAkB,GAClB,cAAc,CAAA;AAuBlB,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,0DAA0D;IAC1D,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,IAAI,CAAA;CACT;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,MAAM,yBAAyB,GACnC,0BAA0B,GAAG,0BAA0B,CAAA;AAMzD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,MAAM,CAKR;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,yBAAyB,CAAC,CAoBpC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,eAAe,GAAG,MAAM,GACrC,cAAc,GAAG,IAAI,CAavB"}

package/dist/oauth.js

@@ -0,0 +1,52 @@
+const OAUTH_ERROR_CODES = [
+  "unknown_provider",
+  "invalid_state",
+  "provider_error",
+  "unknown_identity",
+  "email_in_use",
+  "identity_in_use",
+  "not_authenticated",
+  "flow_not_enabled",
+  "cannot_unlink_last_identity",
+  "untrusted_origin",
+  "server_error"
+];
+function isOAuthErrorCode(value) {
+  return OAUTH_ERROR_CODES.includes(value);
+}
+function getDbAuthUrl(dbAuthUrl) {
+  return dbAuthUrl || `${RWJS_API_URL}/auth`;
+}
+function getOAuthUrl(provider, options) {
+  const flow = options?.flow ?? "login";
+  const baseUrl = getDbAuthUrl(options?.dbAuthUrl);
+  return `${baseUrl}/oauth/${encodeURIComponent(provider)}/authorize?flow=${flow}`;
+}
+async function unlinkOAuthProvider(provider, options) {
+  const baseUrl = getDbAuthUrl(options?.dbAuthUrl);
+  const response = await fetch(
+    `${baseUrl}/oauth/${encodeURIComponent(provider)}/unlink`,
+    {
+      method: "POST",
+      credentials: "include"
+    }
+  );
+  try {
+    return await response.json();
+  } catch {
+    return { error: "server_error" };
+  }
+}
+function getOAuthError(searchParams) {
+  const params = typeof searchParams === "string" ? new URLSearchParams(searchParams) : searchParams;
+  const error = params.get("error");
+  if (error && isOAuthErrorCode(error)) {
+    return error;
+  }
+  return null;
+}
+export {
+  getOAuthError,
+  getOAuthUrl,
+  unlinkOAuthProvider
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/auth-dbauth-web",
-  "version": "7.0.0-canary.3074",
+  "version": "7.0.0-canary.3077",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -20,6 +20,12 @@
         "types": "./dist/webAuthn.d.ts",
         "default": "./dist/webAuthn.js"
       }
+    },
+    "./oauth": {
+      "default": {
+        "types": "./dist/oauth.d.ts",
+        "default": "./dist/oauth.js"
+      }
     }
   },
   "main": "./dist/index.js",
@@ -39,11 +45,11 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/auth": "7.0.0-canary.3074",
+    "@cedarjs/auth": "7.0.0-canary.3077",
     "@simplewebauthn/browser": "13.3.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "7.0.0-canary.3074",
+    "@cedarjs/framework-tools": "7.0.0-canary.3077",
     "@types/react": "^19.2.0",
     "concurrently": "9.2.4",
     "publint": "0.3.24",