@draftlab/auth 0.15.0 → 0.16.0

package/dist/esm/allow.js

@@ -0,0 +1,26 @@
+// src/allow.ts
+import { isDomainMatch } from "./util";
+var defaultAllowCheck = (input, req) => {
+  return Promise.resolve((() => {
+    let redirectHostname;
+    try {
+      redirectHostname = new URL(input.redirectURI).hostname;
+    } catch {
+      return false;
+    }
+    if (redirectHostname === "localhost" || redirectHostname === "127.0.0.1") {
+      return true;
+    }
+    let currentHostname;
+    try {
+      const forwardedHost = req.headers.get("x-forwarded-host");
+      currentHostname = forwardedHost ? new URL(`https://${forwardedHost}`).hostname : new URL(req.url).hostname;
+    } catch {
+      return false;
+    }
+    return isDomainMatch(redirectHostname, currentHostname);
+  })());
+};
+export {
+  defaultAllowCheck
+};

package/dist/esm/client.js

@@ -0,0 +1,254 @@
+// src/client.ts
+import { createLocalJWKSet, errors, jwtVerify } from "jose";
+import {
+  InvalidAccessTokenError,
+  InvalidAuthorizationCodeError,
+  InvalidRefreshTokenError,
+  InvalidSubjectError
+} from "./error";
+import { generatePKCE } from "./pkce";
+var createClient = (input) => {
+  const jwksCache = new Map;
+  const issuerCache = new Map;
+  const issuer = input.issuer;
+  if (!issuer) {
+    throw new Error("No issuer configured");
+  }
+  const f = input.fetch ?? fetch;
+  const getIssuer = async () => {
+    const cached = issuerCache.get(issuer);
+    if (cached)
+      return cached;
+    const wellKnown = await f(`${issuer}/.well-known/oauth-authorization-server`).then((r) => r.json());
+    issuerCache.set(issuer, wellKnown);
+    return wellKnown;
+  };
+  const getJWKS = async () => {
+    const wk = await getIssuer();
+    const cached = jwksCache.get(issuer);
+    if (cached)
+      return cached;
+    const keyset = await f(wk.jwks_uri).then((r) => r.json());
+    const result = createLocalJWKSet(keyset);
+    jwksCache.set(issuer, result);
+    return result;
+  };
+  const client = {
+    async authorize(redirectURI, response, opts) {
+      try {
+        const wk = await getIssuer();
+        const authUrl = new URL(wk.authorization_endpoint);
+        const challenge = {
+          state: crypto.randomUUID()
+        };
+        authUrl.searchParams.set("client_id", input.clientID);
+        authUrl.searchParams.set("redirect_uri", redirectURI);
+        authUrl.searchParams.set("response_type", response);
+        authUrl.searchParams.set("state", challenge.state);
+        if (opts?.provider) {
+          authUrl.searchParams.set("provider", opts.provider);
+        }
+        if (opts?.pkce && response === "code") {
+          const pkce = await generatePKCE();
+          authUrl.searchParams.set("code_challenge_method", "S256");
+          authUrl.searchParams.set("code_challenge", pkce.challenge);
+          challenge.verifier = pkce.verifier;
+        }
+        return {
+          success: true,
+          data: {
+            challenge,
+            url: authUrl.toString()
+          }
+        };
+      } catch (error) {
+        return { success: false, error };
+      }
+    },
+    async exchange(code, redirectURI, verifier) {
+      try {
+        const wk = await getIssuer();
+        const response = await f(wk.token_endpoint, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          body: new URLSearchParams({
+            code,
+            redirect_uri: redirectURI,
+            grant_type: "authorization_code",
+            client_id: input.clientID,
+            ...verifier ? { code_verifier: verifier } : {}
+          }).toString()
+        });
+        if (!response.ok) {
+          return {
+            success: false,
+            error: new InvalidAuthorizationCodeError
+          };
+        }
+        const responseText = await response.text();
+        let json;
+        try {
+          json = JSON.parse(responseText);
+        } catch {
+          return {
+            success: false,
+            error: new InvalidAuthorizationCodeError
+          };
+        }
+        const tokenResponse = json;
+        return {
+          success: true,
+          data: {
+            access: tokenResponse.access_token,
+            refresh: tokenResponse.refresh_token,
+            expiresIn: tokenResponse.expires_in
+          }
+        };
+      } catch {
+        return {
+          success: false,
+          error: new InvalidAuthorizationCodeError
+        };
+      }
+    },
+    async refresh(refresh, opts) {
+      try {
+        if (opts?.access) {
+          try {
+            const jwks = await getJWKS();
+            await jwtVerify(opts.access, jwks, { issuer });
+            return { success: true, data: {} };
+          } catch {}
+        }
+        const wk = await getIssuer();
+        const response = await f(wk.token_endpoint, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          body: new URLSearchParams({
+            refresh_token: refresh,
+            grant_type: "refresh_token"
+          }).toString()
+        });
+        if (!response.ok) {
+          return {
+            success: false,
+            error: new InvalidRefreshTokenError
+          };
+        }
+        const tokenResponse = await response.json();
+        return {
+          success: true,
+          data: {
+            tokens: {
+              access: tokenResponse.access_token,
+              refresh: tokenResponse.refresh_token,
+              expiresIn: tokenResponse.expires_in
+            }
+          }
+        };
+      } catch {
+        return {
+          success: false,
+          error: new InvalidRefreshTokenError
+        };
+      }
+    },
+    async verify(subjects, token, options) {
+      try {
+        const jwks = await getJWKS();
+        const jwtResult = await jwtVerify(token, jwks, {
+          issuer: options?.issuer ?? issuer,
+          audience: options?.audience ?? input.clientID
+        });
+        const validated = await subjects[jwtResult.payload.type]?.["~standard"].validate(jwtResult.payload.properties);
+        if (!validated?.issues && jwtResult.payload.mode === "access") {
+          return {
+            success: true,
+            data: {
+              aud: jwtResult.payload.aud,
+              sub: jwtResult.payload.sub,
+              subject: {
+                type: jwtResult.payload.type,
+                properties: validated?.value
+              }
+            }
+          };
+        }
+        return {
+          success: false,
+          error: new InvalidSubjectError
+        };
+      } catch (e) {
+        if (e instanceof errors.JWTExpired && options?.refresh) {
+          const refreshed = await client.refresh(options.refresh);
+          if (!refreshed.success)
+            return refreshed;
+          if (!refreshed.data.tokens) {
+            return {
+              success: false,
+              error: new InvalidAccessTokenError
+            };
+          }
+          const verified = await client.verify(subjects, refreshed.data.tokens.access, {
+            refresh: refreshed.data.tokens.refresh,
+            issuer: options?.issuer,
+            audience: options?.audience,
+            fetch: options?.fetch
+          });
+          if (!verified.success)
+            return verified;
+          return {
+            success: true,
+            data: {
+              ...verified.data,
+              tokens: refreshed.data.tokens
+            }
+          };
+        }
+        return {
+          success: false,
+          error: new InvalidAccessTokenError
+        };
+      }
+    },
+    async revoke(token, opts) {
+      try {
+        const wk = await getIssuer();
+        const body = new URLSearchParams({
+          token,
+          ...opts?.tokenTypeHint ? { token_type_hint: opts.tokenTypeHint } : {}
+        });
+        const response = await f(wk.token_endpoint.replace("/token", "/revoke"), {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          body: body.toString()
+        });
+        if (response.ok) {
+          return {
+            success: true,
+            data: undefined
+          };
+        }
+        return {
+          success: false,
+          error: new Error("Failed to revoke token")
+        };
+      } catch (error) {
+        return {
+          success: false,
+          error
+        };
+      }
+    }
+  };
+  return client;
+};
+export {
+  createClient
+};