@codelitdev/oauth-server-kit 0.1.0-alpha.0

package/dist/express.js

@@ -0,0 +1,366 @@
+'use strict';
+
+var express = require('express');
+
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+
+// src/verify-access-token.ts
+function requireAbsoluteUrl(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (e) {
+    throw new Error(`${field} must be an absolute URL`);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error(`${field} must use http or https`);
+  }
+  if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+    throw new Error(`${field} must use https in production`);
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function normalizedUniqueStrings(values) {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+function claimStrings(value) {
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string");
+}
+function optionalString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function validateOAuthVerificationOptions(options) {
+  var _a;
+  requireAbsoluteUrl(options.issuer, "issuer");
+  if (normalizedUniqueStrings(options.audiences).length === 0) {
+    throw new Error("audiences must contain at least one value");
+  }
+  for (const value of Object.values((_a = options.resourceMetadataMappings) != null ? _a : {})) {
+    requireAbsoluteUrl(value, "resourceMetadataMappings");
+  }
+}
+async function verifyOAuthAccessToken(options, token) {
+  var _a, _b;
+  validateOAuthVerificationOptions(options);
+  const issuer = requireAbsoluteUrl(options.issuer, "issuer");
+  const audiences = normalizedUniqueStrings(options.audiences);
+  if (!token.trim()) return { status: "invalid_token" };
+  try {
+    const claims = await options.oauthResourceClient.getActions().verifyAccessToken(token, {
+      verifyOptions: { issuer, audience: audiences },
+      resourceMetadataMappings: (_a = options.resourceMetadataMappings) != null ? _a : {}
+    });
+    const subject = optionalString(claims.sub);
+    const claimIssuer = optionalString(claims.iss);
+    const clientId = (_b = optionalString(claims.azp)) != null ? _b : optionalString(claims.client_id);
+    const tokenAudiences = normalizedUniqueStrings(
+      claimStrings(claims.aud)
+    );
+    const validatedAudiences = tokenAudiences.filter(
+      (audience) => audiences.includes(audience)
+    );
+    if (!subject || (claimIssuer == null ? void 0 : claimIssuer.replace(/\/$/, "")) !== issuer || !clientId || validatedAudiences.length === 0) {
+      return { status: "invalid_token" };
+    }
+    const scopeValue = claims.scope;
+    const scopes = normalizedUniqueStrings(
+      Array.isArray(scopeValue) ? claimStrings(scopeValue) : typeof scopeValue === "string" ? scopeValue.split(/\s+/) : []
+    );
+    const email = optionalString(claims.email);
+    const name = optionalString(claims.name);
+    return {
+      status: "authenticated",
+      identity: __spreadProps(__spreadValues(__spreadValues({
+        method: "oauth",
+        issuer,
+        subject
+      }, email ? { email } : {}), name ? { name } : {}), {
+        clientId,
+        scopes,
+        audiences: validatedAudiences
+      })
+    };
+  } catch (e) {
+    return { status: "invalid_token" };
+  }
+}
+
+// src/express.ts
+function setBearerChallenge(response, resourceMetadataUrl) {
+  if (resourceMetadataUrl) {
+    response.setHeader(
+      "WWW-Authenticate",
+      `Bearer resource_metadata="${resourceMetadataUrl}"`
+    );
+    return;
+  }
+  response.setHeader("WWW-Authenticate", "Bearer");
+}
+function sendAuthenticationError(response, result, resourceMetadataUrl) {
+  if (result.status === "unavailable") {
+    response.status(503).json({ error: "authentication_unavailable" });
+    return;
+  }
+  setBearerChallenge(response, resourceMetadataUrl);
+  if (result.status === "invalid_token") {
+    response.status(401).json({
+      error: "invalid_token",
+      error_description: "The access token is invalid or expired"
+    });
+    return;
+  }
+  response.status(401).json({
+    error: "unauthorized",
+    error_description: "A Bearer access token is required"
+  });
+}
+function bearerToken(request) {
+  var _a;
+  const value = request.headers.authorization;
+  if (!value) return null;
+  const match = value.match(/^Bearer\s+(.+)$/i);
+  return ((_a = match == null ? void 0 : match[1]) == null ? void 0 : _a.trim()) || null;
+}
+function createOAuthBearerMiddleware(options) {
+  validateOAuthVerificationOptions(options);
+  if (options.resourceMetadataUrl) {
+    let metadataUrl;
+    try {
+      metadataUrl = new URL(options.resourceMetadataUrl);
+    } catch (e) {
+      throw new Error("resourceMetadataUrl must be an absolute URL");
+    }
+    if (!["http:", "https:"].includes(metadataUrl.protocol)) {
+      throw new Error("resourceMetadataUrl must use http or https");
+    }
+    if (process.env.NODE_ENV === "production" && metadataUrl.protocol !== "https:") {
+      throw new Error("resourceMetadataUrl must use https in production");
+    }
+  }
+  return async function oauthBearerMiddleware(request, response, next) {
+    const token = bearerToken(request);
+    if (!token) {
+      sendAuthenticationError(
+        response,
+        { status: "missing" },
+        options.resourceMetadataUrl
+      );
+      return;
+    }
+    const result = await verifyOAuthAccessToken(options, token);
+    if (result.status !== "authenticated") {
+      sendAuthenticationError(
+        response,
+        result,
+        options.resourceMetadataUrl
+      );
+      return;
+    }
+    request.auth = result.identity;
+    next();
+  };
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function scriptLiteral(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function frameProtection(response) {
+  response.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
+  response.setHeader("X-Frame-Options", "DENY");
+  response.setHeader("X-Content-Type-Options", "nosniff");
+}
+function absoluteOrigin(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (e) {
+    throw new Error(`${field} must be an absolute URL`);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error(`${field} must use http or https`);
+  }
+  if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+    throw new Error(`${field} must use https in production`);
+  }
+  if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error(`${field} must contain origins without paths`);
+  }
+  return url.origin;
+}
+function normalizeOptions(options) {
+  var _a;
+  if (!options.appName.trim()) throw new Error("appName is required");
+  if (!options.authBasePath.startsWith("/") || options.authBasePath.startsWith("//")) {
+    throw new Error("authBasePath must be an absolute path");
+  }
+  const authBasePath = options.authBasePath === "/" ? "" : options.authBasePath.replace(/\/+$/, "");
+  if (options.authBasePath.includes("?") || options.authBasePath.includes("#") || /\s/.test(options.authBasePath)) {
+    throw new Error("authBasePath must be an absolute path");
+  }
+  if (options.allowedRedirectOrigins.length === 0) {
+    throw new Error("allowedRedirectOrigins must not be empty");
+  }
+  const allowedRedirectOrigins = new Set(
+    options.allowedRedirectOrigins.map(
+      (origin) => absoluteOrigin(origin, "allowedRedirectOrigins")
+    )
+  );
+  let defaultRedirect;
+  try {
+    defaultRedirect = new URL(options.defaultRedirectUrl);
+  } catch (e) {
+    throw new Error("defaultRedirectUrl must be an absolute URL");
+  }
+  if (!allowedRedirectOrigins.has(defaultRedirect.origin)) {
+    throw new Error("defaultRedirectUrl must use an allowed origin");
+  }
+  if (options.loginMethods.length === 0) {
+    throw new Error("loginMethods must contain at least one method");
+  }
+  const methodIds = options.loginMethods.map(
+    (method) => method.type === "email-otp" ? "email-otp" : `social:${method.providerId}`
+  );
+  if (new Set(methodIds).size !== methodIds.length) {
+    throw new Error("loginMethods must have unique method identifiers");
+  }
+  for (const method of options.loginMethods) {
+    if (method.type === "social") {
+      if (!method.providerId.trim() || !method.label.trim()) {
+        throw new Error(
+          "social login methods require providerId and label"
+        );
+      }
+    }
+  }
+  for (const name of (_a = options.legacyHostOnlySessionCookieNames) != null ? _a : []) {
+    if (!/^[A-Za-z0-9._-]+$/.test(name)) {
+      throw new Error("legacy cookie names contain invalid characters");
+    }
+  }
+  return __spreadProps(__spreadValues({}, options), {
+    appName: options.appName.trim(),
+    authBasePath,
+    allowedRedirectOrigins,
+    defaultRedirectUrl: defaultRedirect.toString()
+  });
+}
+var STYLES = `
+*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;background:#0b0b0b;color:#fff;font-family:system-ui,sans-serif}
+.card{width:100%;max-width:400px;padding:32px;border:1px solid #292929;border-radius:14px;background:#111}.logo{width:38px;height:38px;margin:0 auto 20px;display:grid;place-items:center;border-radius:50%;background:#fff;color:#111;font-weight:700}
+h1{margin:0 0 8px;text-align:center;font-size:22px}.sub{margin:0 0 24px;text-align:center;color:#aaa;font-size:13px;line-height:1.5}.error{display:none;margin-bottom:16px;padding:10px 12px;border-radius:8px;background:#3a1717;color:#ff9a9a;font-size:13px}
+form{margin:0}.field{margin-bottom:14px}label{display:block;margin-bottom:6px;font-size:12px}input{width:100%;padding:11px 13px;border:1px solid #333;border-radius:8px;background:#181818;color:#fff;font-size:15px}
+button{width:100%;margin-top:8px;padding:11px;border:1px solid #333;border-radius:8px;background:#1b1b1b;color:#fff;font-size:14px;cursor:pointer}.primary{border-color:#8c7a6b;background:#8c7a6b}.secondary{color:#bbb}.divider{display:flex;align-items:center;gap:10px;margin:18px 0;color:#777;font-size:12px}.divider:before,.divider:after{content:"";flex:1;height:1px;background:#2a2a2a}
+button:disabled{opacity:.55;cursor:not-allowed}.client{margin:20px 0;padding:14px;border:1px solid #2a2a2a;border-radius:9px;background:#181818}.client-name{font-weight:600;word-break:break-all}.scopes{display:flex;flex-wrap:wrap;gap:6px;margin-top:12px}.scope{padding:4px 7px;border:1px solid #333;border-radius:6px;color:#bbb;font-size:12px}.actions{display:flex;gap:8px}.actions button{margin:0}
+`;
+function page(title, body) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(title)}</title><style>${STYLES}</style></head><body><main class="card">${body}</main></body></html>`;
+}
+function clearLegacyCookies(response, names) {
+  for (const name of names != null ? names : []) {
+    response.cookie(name, "", {
+      path: "/",
+      maxAge: 0,
+      httpOnly: true,
+      secure: true,
+      sameSite: "lax"
+    });
+  }
+}
+function loginMarkup(options) {
+  var _a, _b;
+  const emailMethod = options.loginMethods.find(
+    (method) => method.type === "email-otp"
+  );
+  const socialMethods = options.loginMethods.filter(
+    (method) => method.type === "social"
+  );
+  const email = emailMethod ? `<form id="email-form"><div class="field"><label for="email">Email</label><input id="email" type="email" required autocomplete="email"></div><button class="primary" type="submit">${escapeHtml((_a = emailMethod.label) != null ? _a : "Continue with email")}</button></form><form id="otp-form" hidden><div class="field"><label for="otp">Verification code</label><input id="otp" inputmode="numeric" required autocomplete="one-time-code"></div><button class="primary" type="submit">Sign in</button><button class="secondary" type="button" id="change-email">Use a different email</button></form>` : "";
+  const social = socialMethods.map(
+    (method) => `<button type="button" class="social" data-provider="${escapeHtml(method.providerId)}">${escapeHtml(method.label)}</button>`
+  ).join("");
+  const divider = email && social ? '<div class="divider">or</div>' : "";
+  return `<div class="logo">${escapeHtml((_b = options.appName[0]) != null ? _b : "?")}</div><h1>Sign in to ${escapeHtml(options.appName)}</h1><p class="sub">Use one of the configured sign-in methods.</p><div class="error" id="error"></div>${email}${divider}${social}`;
+}
+function loginScript(options, oauth, redirect) {
+  const authBasePath = scriptLiteral(options.authBasePath);
+  const redirectTarget = scriptLiteral(redirect != null ? redirect : "");
+  return `<script>(function(){
+var authBasePath=${authBasePath};var oauth=${oauth};var oauthQuery=location.search.slice(1);var redirectTarget=${redirectTarget};var errorEl=document.getElementById("error");
+function showError(message){errorEl.textContent=message||"Sign-in failed. Please try again.";errorEl.style.display="block"}function clearError(){errorEl.style.display="none"}
+async function post(path,body){var response=await fetch(authBasePath+path,{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify(body)});var data={};try{data=await response.json()}catch{}if(!response.ok)throw new Error("Sign-in failed. Please try again.");return data}
+function follow(data){var target=oauth?(data.url||data.redirect_uri):redirectTarget;if(!target)throw new Error("Sign-in failed. Please try again.");location.assign(target)}
+var emailForm=document.getElementById("email-form"),otpForm=document.getElementById("otp-form"),email="";
+if(emailForm){emailForm.addEventListener("submit",async function(event){event.preventDefault();clearError();email=emailForm.querySelector("input").value;try{await post("/email-otp/send-verification-otp",{email:email,type:"sign-in",...(oauth?{oauth_query:oauthQuery}:{})});emailForm.hidden=true;otpForm.hidden=false}catch(error){showError(error.message)}});otpForm.addEventListener("submit",async function(event){event.preventDefault();clearError();try{var data=await post("/sign-in/email-otp",{email:email,otp:document.getElementById("otp").value,name:email.split("@")[0],...(oauth?{oauth_query:oauthQuery}:{})});follow(data)}catch(error){showError(error.message)}});document.getElementById("change-email").addEventListener("click",function(){otpForm.hidden=true;emailForm.hidden=false;clearError()})}
+document.querySelectorAll("button.social").forEach(function(button){button.addEventListener("click",async function(){clearError();button.disabled=true;try{var body={provider:button.dataset.provider,...(oauth?{oauth_query:oauthQuery}:{callbackURL:redirectTarget,errorCallbackURL:location.href})};follow(await post("/sign-in/social",body))}catch(error){showError(error.message);button.disabled=false}})});
+})();</script>`;
+}
+function allowedRedirect(requested, options) {
+  if (typeof requested !== "string") return options.defaultRedirectUrl;
+  try {
+    const url = new URL(requested);
+    return options.allowedRedirectOrigins.has(url.origin) ? url.toString() : options.defaultRedirectUrl;
+  } catch (e) {
+    return options.defaultRedirectUrl;
+  }
+}
+function createOAuthPagesRouter(rawOptions) {
+  const options = normalizeOptions(rawOptions);
+  const router = express.Router();
+  router.get("/login", (request, response) => {
+    frameProtection(response);
+    clearLegacyCookies(response, options.legacyHostOnlySessionCookieNames);
+    const redirect = allowedRedirect(request.query.redirect, options);
+    response.type("html").send(
+      page(
+        `Sign in to ${options.appName}`,
+        loginMarkup(options) + loginScript(options, false, redirect)
+      )
+    );
+  });
+  router.get("/oauth/login", (_request, response) => {
+    frameProtection(response);
+    clearLegacyCookies(response, options.legacyHostOnlySessionCookieNames);
+    response.type("html").send(
+      page(
+        `Sign in to ${options.appName}`,
+        loginMarkup(options) + loginScript(options, true)
+      )
+    );
+  });
+  router.get("/oauth/consent", (request, response) => {
+    var _a;
+    frameProtection(response);
+    const clientId = typeof request.query.client_id === "string" ? request.query.client_id : "OAuth client";
+    const scope = typeof request.query.scope === "string" ? request.query.scope : "";
+    const scopes = scope.split(/\s+/).filter(Boolean);
+    const badges = scopes.map((item) => `<span class="scope">${escapeHtml(item)}</span>`).join("");
+    const body = `<div class="logo">${escapeHtml((_a = options.appName[0]) != null ? _a : "?")}</div><h1>Authorize ${escapeHtml(options.appName)} access</h1><p class="sub">Review the client and requested scopes.</p><div class="error" id="error"></div><div class="client"><div class="client-name">${escapeHtml(clientId)}</div>${badges ? `<div class="scopes">${badges}</div>` : ""}</div><div class="actions"><button class="primary" id="allow" type="button">Allow</button><button id="deny" type="button">Deny</button></div><script>(function(){var authBasePath=${scriptLiteral(options.authBasePath)},oauthQuery=location.search.slice(1),errorEl=document.getElementById("error"),buttons=[document.getElementById("allow"),document.getElementById("deny")];async function decide(accept){buttons.forEach(function(button){button.disabled=true});errorEl.style.display="none";try{var response=await fetch(authBasePath+"/oauth2/consent",{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({accept:accept,oauth_query:oauthQuery})});var data={};try{data=await response.json()}catch{}var target=data.url||data.redirect_uri;if(!response.ok||!target)throw new Error();location.assign(target)}catch{errorEl.textContent="Could not complete authorization.";errorEl.style.display="block";buttons.forEach(function(button){button.disabled=false})}}buttons[0].addEventListener("click",function(){decide(true)});buttons[1].addEventListener("click",function(){decide(false)})})();</script>`;
+    response.type("html").send(page(`Authorize ${options.appName} access`, body));
+  });
+  return router;
+}
+
+exports.createOAuthBearerMiddleware = createOAuthBearerMiddleware;
+exports.createOAuthPagesRouter = createOAuthPagesRouter;

package/dist/express.mjs

@@ -0,0 +1,262 @@
+import { validateOAuthVerificationOptions, verifyOAuthAccessToken } from './chunk-RJ4ABQXG.mjs';
+import { __spreadProps, __spreadValues } from './chunk-I4E63NIC.mjs';
+import { Router } from 'express';
+
+// src/express.ts
+function setBearerChallenge(response, resourceMetadataUrl) {
+  if (resourceMetadataUrl) {
+    response.setHeader(
+      "WWW-Authenticate",
+      `Bearer resource_metadata="${resourceMetadataUrl}"`
+    );
+    return;
+  }
+  response.setHeader("WWW-Authenticate", "Bearer");
+}
+function sendAuthenticationError(response, result, resourceMetadataUrl) {
+  if (result.status === "unavailable") {
+    response.status(503).json({ error: "authentication_unavailable" });
+    return;
+  }
+  setBearerChallenge(response, resourceMetadataUrl);
+  if (result.status === "invalid_token") {
+    response.status(401).json({
+      error: "invalid_token",
+      error_description: "The access token is invalid or expired"
+    });
+    return;
+  }
+  response.status(401).json({
+    error: "unauthorized",
+    error_description: "A Bearer access token is required"
+  });
+}
+function bearerToken(request) {
+  var _a;
+  const value = request.headers.authorization;
+  if (!value) return null;
+  const match = value.match(/^Bearer\s+(.+)$/i);
+  return ((_a = match == null ? void 0 : match[1]) == null ? void 0 : _a.trim()) || null;
+}
+function createOAuthBearerMiddleware(options) {
+  validateOAuthVerificationOptions(options);
+  if (options.resourceMetadataUrl) {
+    let metadataUrl;
+    try {
+      metadataUrl = new URL(options.resourceMetadataUrl);
+    } catch (e) {
+      throw new Error("resourceMetadataUrl must be an absolute URL");
+    }
+    if (!["http:", "https:"].includes(metadataUrl.protocol)) {
+      throw new Error("resourceMetadataUrl must use http or https");
+    }
+    if (process.env.NODE_ENV === "production" && metadataUrl.protocol !== "https:") {
+      throw new Error("resourceMetadataUrl must use https in production");
+    }
+  }
+  return async function oauthBearerMiddleware(request, response, next) {
+    const token = bearerToken(request);
+    if (!token) {
+      sendAuthenticationError(
+        response,
+        { status: "missing" },
+        options.resourceMetadataUrl
+      );
+      return;
+    }
+    const result = await verifyOAuthAccessToken(options, token);
+    if (result.status !== "authenticated") {
+      sendAuthenticationError(
+        response,
+        result,
+        options.resourceMetadataUrl
+      );
+      return;
+    }
+    request.auth = result.identity;
+    next();
+  };
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function scriptLiteral(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function frameProtection(response) {
+  response.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
+  response.setHeader("X-Frame-Options", "DENY");
+  response.setHeader("X-Content-Type-Options", "nosniff");
+}
+function absoluteOrigin(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (e) {
+    throw new Error(`${field} must be an absolute URL`);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error(`${field} must use http or https`);
+  }
+  if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+    throw new Error(`${field} must use https in production`);
+  }
+  if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error(`${field} must contain origins without paths`);
+  }
+  return url.origin;
+}
+function normalizeOptions(options) {
+  var _a;
+  if (!options.appName.trim()) throw new Error("appName is required");
+  if (!options.authBasePath.startsWith("/") || options.authBasePath.startsWith("//")) {
+    throw new Error("authBasePath must be an absolute path");
+  }
+  const authBasePath = options.authBasePath === "/" ? "" : options.authBasePath.replace(/\/+$/, "");
+  if (options.authBasePath.includes("?") || options.authBasePath.includes("#") || /\s/.test(options.authBasePath)) {
+    throw new Error("authBasePath must be an absolute path");
+  }
+  if (options.allowedRedirectOrigins.length === 0) {
+    throw new Error("allowedRedirectOrigins must not be empty");
+  }
+  const allowedRedirectOrigins = new Set(
+    options.allowedRedirectOrigins.map(
+      (origin) => absoluteOrigin(origin, "allowedRedirectOrigins")
+    )
+  );
+  let defaultRedirect;
+  try {
+    defaultRedirect = new URL(options.defaultRedirectUrl);
+  } catch (e) {
+    throw new Error("defaultRedirectUrl must be an absolute URL");
+  }
+  if (!allowedRedirectOrigins.has(defaultRedirect.origin)) {
+    throw new Error("defaultRedirectUrl must use an allowed origin");
+  }
+  if (options.loginMethods.length === 0) {
+    throw new Error("loginMethods must contain at least one method");
+  }
+  const methodIds = options.loginMethods.map(
+    (method) => method.type === "email-otp" ? "email-otp" : `social:${method.providerId}`
+  );
+  if (new Set(methodIds).size !== methodIds.length) {
+    throw new Error("loginMethods must have unique method identifiers");
+  }
+  for (const method of options.loginMethods) {
+    if (method.type === "social") {
+      if (!method.providerId.trim() || !method.label.trim()) {
+        throw new Error(
+          "social login methods require providerId and label"
+        );
+      }
+    }
+  }
+  for (const name of (_a = options.legacyHostOnlySessionCookieNames) != null ? _a : []) {
+    if (!/^[A-Za-z0-9._-]+$/.test(name)) {
+      throw new Error("legacy cookie names contain invalid characters");
+    }
+  }
+  return __spreadProps(__spreadValues({}, options), {
+    appName: options.appName.trim(),
+    authBasePath,
+    allowedRedirectOrigins,
+    defaultRedirectUrl: defaultRedirect.toString()
+  });
+}
+var STYLES = `
+*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;background:#0b0b0b;color:#fff;font-family:system-ui,sans-serif}
+.card{width:100%;max-width:400px;padding:32px;border:1px solid #292929;border-radius:14px;background:#111}.logo{width:38px;height:38px;margin:0 auto 20px;display:grid;place-items:center;border-radius:50%;background:#fff;color:#111;font-weight:700}
+h1{margin:0 0 8px;text-align:center;font-size:22px}.sub{margin:0 0 24px;text-align:center;color:#aaa;font-size:13px;line-height:1.5}.error{display:none;margin-bottom:16px;padding:10px 12px;border-radius:8px;background:#3a1717;color:#ff9a9a;font-size:13px}
+form{margin:0}.field{margin-bottom:14px}label{display:block;margin-bottom:6px;font-size:12px}input{width:100%;padding:11px 13px;border:1px solid #333;border-radius:8px;background:#181818;color:#fff;font-size:15px}
+button{width:100%;margin-top:8px;padding:11px;border:1px solid #333;border-radius:8px;background:#1b1b1b;color:#fff;font-size:14px;cursor:pointer}.primary{border-color:#8c7a6b;background:#8c7a6b}.secondary{color:#bbb}.divider{display:flex;align-items:center;gap:10px;margin:18px 0;color:#777;font-size:12px}.divider:before,.divider:after{content:"";flex:1;height:1px;background:#2a2a2a}
+button:disabled{opacity:.55;cursor:not-allowed}.client{margin:20px 0;padding:14px;border:1px solid #2a2a2a;border-radius:9px;background:#181818}.client-name{font-weight:600;word-break:break-all}.scopes{display:flex;flex-wrap:wrap;gap:6px;margin-top:12px}.scope{padding:4px 7px;border:1px solid #333;border-radius:6px;color:#bbb;font-size:12px}.actions{display:flex;gap:8px}.actions button{margin:0}
+`;
+function page(title, body) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(title)}</title><style>${STYLES}</style></head><body><main class="card">${body}</main></body></html>`;
+}
+function clearLegacyCookies(response, names) {
+  for (const name of names != null ? names : []) {
+    response.cookie(name, "", {
+      path: "/",
+      maxAge: 0,
+      httpOnly: true,
+      secure: true,
+      sameSite: "lax"
+    });
+  }
+}
+function loginMarkup(options) {
+  var _a, _b;
+  const emailMethod = options.loginMethods.find(
+    (method) => method.type === "email-otp"
+  );
+  const socialMethods = options.loginMethods.filter(
+    (method) => method.type === "social"
+  );
+  const email = emailMethod ? `<form id="email-form"><div class="field"><label for="email">Email</label><input id="email" type="email" required autocomplete="email"></div><button class="primary" type="submit">${escapeHtml((_a = emailMethod.label) != null ? _a : "Continue with email")}</button></form><form id="otp-form" hidden><div class="field"><label for="otp">Verification code</label><input id="otp" inputmode="numeric" required autocomplete="one-time-code"></div><button class="primary" type="submit">Sign in</button><button class="secondary" type="button" id="change-email">Use a different email</button></form>` : "";
+  const social = socialMethods.map(
+    (method) => `<button type="button" class="social" data-provider="${escapeHtml(method.providerId)}">${escapeHtml(method.label)}</button>`
+  ).join("");
+  const divider = email && social ? '<div class="divider">or</div>' : "";
+  return `<div class="logo">${escapeHtml((_b = options.appName[0]) != null ? _b : "?")}</div><h1>Sign in to ${escapeHtml(options.appName)}</h1><p class="sub">Use one of the configured sign-in methods.</p><div class="error" id="error"></div>${email}${divider}${social}`;
+}
+function loginScript(options, oauth, redirect) {
+  const authBasePath = scriptLiteral(options.authBasePath);
+  const redirectTarget = scriptLiteral(redirect != null ? redirect : "");
+  return `<script>(function(){
+var authBasePath=${authBasePath};var oauth=${oauth};var oauthQuery=location.search.slice(1);var redirectTarget=${redirectTarget};var errorEl=document.getElementById("error");
+function showError(message){errorEl.textContent=message||"Sign-in failed. Please try again.";errorEl.style.display="block"}function clearError(){errorEl.style.display="none"}
+async function post(path,body){var response=await fetch(authBasePath+path,{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify(body)});var data={};try{data=await response.json()}catch{}if(!response.ok)throw new Error("Sign-in failed. Please try again.");return data}
+function follow(data){var target=oauth?(data.url||data.redirect_uri):redirectTarget;if(!target)throw new Error("Sign-in failed. Please try again.");location.assign(target)}
+var emailForm=document.getElementById("email-form"),otpForm=document.getElementById("otp-form"),email="";
+if(emailForm){emailForm.addEventListener("submit",async function(event){event.preventDefault();clearError();email=emailForm.querySelector("input").value;try{await post("/email-otp/send-verification-otp",{email:email,type:"sign-in",...(oauth?{oauth_query:oauthQuery}:{})});emailForm.hidden=true;otpForm.hidden=false}catch(error){showError(error.message)}});otpForm.addEventListener("submit",async function(event){event.preventDefault();clearError();try{var data=await post("/sign-in/email-otp",{email:email,otp:document.getElementById("otp").value,name:email.split("@")[0],...(oauth?{oauth_query:oauthQuery}:{})});follow(data)}catch(error){showError(error.message)}});document.getElementById("change-email").addEventListener("click",function(){otpForm.hidden=true;emailForm.hidden=false;clearError()})}
+document.querySelectorAll("button.social").forEach(function(button){button.addEventListener("click",async function(){clearError();button.disabled=true;try{var body={provider:button.dataset.provider,...(oauth?{oauth_query:oauthQuery}:{callbackURL:redirectTarget,errorCallbackURL:location.href})};follow(await post("/sign-in/social",body))}catch(error){showError(error.message);button.disabled=false}})});
+})();</script>`;
+}
+function allowedRedirect(requested, options) {
+  if (typeof requested !== "string") return options.defaultRedirectUrl;
+  try {
+    const url = new URL(requested);
+    return options.allowedRedirectOrigins.has(url.origin) ? url.toString() : options.defaultRedirectUrl;
+  } catch (e) {
+    return options.defaultRedirectUrl;
+  }
+}
+function createOAuthPagesRouter(rawOptions) {
+  const options = normalizeOptions(rawOptions);
+  const router = Router();
+  router.get("/login", (request, response) => {
+    frameProtection(response);
+    clearLegacyCookies(response, options.legacyHostOnlySessionCookieNames);
+    const redirect = allowedRedirect(request.query.redirect, options);
+    response.type("html").send(
+      page(
+        `Sign in to ${options.appName}`,
+        loginMarkup(options) + loginScript(options, false, redirect)
+      )
+    );
+  });
+  router.get("/oauth/login", (_request, response) => {
+    frameProtection(response);
+    clearLegacyCookies(response, options.legacyHostOnlySessionCookieNames);
+    response.type("html").send(
+      page(
+        `Sign in to ${options.appName}`,
+        loginMarkup(options) + loginScript(options, true)
+      )
+    );
+  });
+  router.get("/oauth/consent", (request, response) => {
+    var _a;
+    frameProtection(response);
+    const clientId = typeof request.query.client_id === "string" ? request.query.client_id : "OAuth client";
+    const scope = typeof request.query.scope === "string" ? request.query.scope : "";
+    const scopes = scope.split(/\s+/).filter(Boolean);
+    const badges = scopes.map((item) => `<span class="scope">${escapeHtml(item)}</span>`).join("");
+    const body = `<div class="logo">${escapeHtml((_a = options.appName[0]) != null ? _a : "?")}</div><h1>Authorize ${escapeHtml(options.appName)} access</h1><p class="sub">Review the client and requested scopes.</p><div class="error" id="error"></div><div class="client"><div class="client-name">${escapeHtml(clientId)}</div>${badges ? `<div class="scopes">${badges}</div>` : ""}</div><div class="actions"><button class="primary" id="allow" type="button">Allow</button><button id="deny" type="button">Deny</button></div><script>(function(){var authBasePath=${scriptLiteral(options.authBasePath)},oauthQuery=location.search.slice(1),errorEl=document.getElementById("error"),buttons=[document.getElementById("allow"),document.getElementById("deny")];async function decide(accept){buttons.forEach(function(button){button.disabled=true});errorEl.style.display="none";try{var response=await fetch(authBasePath+"/oauth2/consent",{method:"POST",headers:{"content-type":"application/json",accept:"application/json"},body:JSON.stringify({accept:accept,oauth_query:oauthQuery})});var data={};try{data=await response.json()}catch{}var target=data.url||data.redirect_uri;if(!response.ok||!target)throw new Error();location.assign(target)}catch{errorEl.textContent="Could not complete authorization.";errorEl.style.display="block";buttons.forEach(function(button){button.disabled=false})}}buttons[0].addEventListener("click",function(){decide(true)});buttons[1].addEventListener("click",function(){decide(false)})})();</script>`;
+    response.type("html").send(page(`Authorize ${options.appName} access`, body));
+  });
+  return router;
+}
+
+export { createOAuthBearerMiddleware, createOAuthPagesRouter };

package/dist/index.d.mts

@@ -0,0 +1,17 @@
+import { O as OAuthResourceClient, A as AuthenticationResult } from './types-DJxCmhYu.mjs';
+export { a as AuthenticatedIdentity } from './types-DJxCmhYu.mjs';
+import '@better-auth/oauth-provider/resource-client';
+
+interface VerifyOAuthAccessTokenOptions {
+    oauthResourceClient: OAuthResourceClient;
+    issuer: string;
+    audiences: readonly string[];
+    resourceMetadataMappings?: Readonly<Record<string, string>>;
+}
+/**
+ * Verifies a Better Auth OAuth access token and returns protocol identity only.
+ * Product claims are deliberately discarded.
+ */
+declare function verifyOAuthAccessToken(options: VerifyOAuthAccessTokenOptions, token: string): Promise<AuthenticationResult>;
+
+export { AuthenticationResult, OAuthResourceClient, type VerifyOAuthAccessTokenOptions, verifyOAuthAccessToken };