@draftlab/auth 0.15.1 → 0.16.0

package/dist/client.mjs

@@ -1,284 +0,0 @@
-import { InvalidAccessTokenError, InvalidAuthorizationCodeError, InvalidRefreshTokenError, InvalidSubjectError } from "./error.mjs";
-import { generatePKCE } from "./pkce.mjs";
-import { createLocalJWKSet, errors, jwtVerify } from "jose";
-
-//#region src/client.ts
-/**
-* Draft Auth client for OAuth 2.0 authentication.
-*
-* ## Quick Start
-*
-* First, create a client.
-*
-* ```ts title="client.ts"
-* import { createClient } from "@draftlab/auth/client"
-*
-* const client = createClient({
-*   clientID: "my-client",
-*   issuer: "https://auth.myserver.com"
-* })
-* ```
-*
-* Start the OAuth flow by calling `authorize`.
-*
-* ```ts
-* const result = await client.authorize(
-*   "https://myapp.com/callback",
-*   "code"
-* )
-* if (result.success) {
-*   window.location.href = result.data.url
-* }
-* ```
-*
-* When the user completes the flow, exchange the code for tokens.
-*
-* ```ts
-* const result = await client.exchange(code, redirectUri)
-* if (result.success) {
-*   const { access, refresh } = result.data
-*   // Store tokens securely
-* }
-* ```
-*
-* Verify tokens to get user information.
-*
-* ```ts
-* const result = await client.verify(subjects, accessToken)
-* if (result.success) {
-*   // Access user properties: result.data.subject.properties
-* }
-* ```
-*
-* @packageDocumentation
-*/
-/**
-* Create a Draft Auth client.
-*
-* @param input - Client configuration
-* @returns Configured client instance
-*
-* @example Basic setup
-* ```ts
-* const client = createClient({
-*   clientID: "my-web-app",
-*   issuer: "https://auth.mycompany.com"
-* })
-* ```
-*/
-const createClient = (input) => {
-	const jwksCache = /* @__PURE__ */ new Map();
-	const issuerCache = /* @__PURE__ */ new Map();
-	const issuer = input.issuer;
-	if (!issuer) throw new Error("No issuer configured");
-	const f = input.fetch ?? fetch;
-	const getIssuer = async () => {
-		const cached = issuerCache.get(issuer);
-		if (cached) return cached;
-		const wellKnown = await f(`${issuer}/.well-known/oauth-authorization-server`).then((r) => r.json());
-		issuerCache.set(issuer, wellKnown);
-		return wellKnown;
-	};
-	const getJWKS = async () => {
-		const wk = await getIssuer();
-		const cached = jwksCache.get(issuer);
-		if (cached) return cached;
-		const result = createLocalJWKSet(await f(wk.jwks_uri).then((r) => r.json()));
-		jwksCache.set(issuer, result);
-		return result;
-	};
-	const client = {
-		async authorize(redirectURI, response, opts) {
-			try {
-				const wk = await getIssuer();
-				const authUrl = new URL(wk.authorization_endpoint);
-				const challenge = { state: crypto.randomUUID() };
-				authUrl.searchParams.set("client_id", input.clientID);
-				authUrl.searchParams.set("redirect_uri", redirectURI);
-				authUrl.searchParams.set("response_type", response);
-				authUrl.searchParams.set("state", challenge.state);
-				if (opts?.provider) authUrl.searchParams.set("provider", opts.provider);
-				if (opts?.pkce && response === "code") {
-					const pkce = await generatePKCE();
-					authUrl.searchParams.set("code_challenge_method", "S256");
-					authUrl.searchParams.set("code_challenge", pkce.challenge);
-					challenge.verifier = pkce.verifier;
-				}
-				return {
-					success: true,
-					data: {
-						challenge,
-						url: authUrl.toString()
-					}
-				};
-			} catch (error) {
-				return {
-					success: false,
-					error
-				};
-			}
-		},
-		async exchange(code, redirectURI, verifier) {
-			try {
-				const response = await f((await getIssuer()).token_endpoint, {
-					method: "POST",
-					headers: { "Content-Type": "application/x-www-form-urlencoded" },
-					body: new URLSearchParams({
-						code,
-						redirect_uri: redirectURI,
-						grant_type: "authorization_code",
-						client_id: input.clientID,
-						...verifier ? { code_verifier: verifier } : {}
-					}).toString()
-				});
-				if (!response.ok) return {
-					success: false,
-					error: new InvalidAuthorizationCodeError()
-				};
-				const responseText = await response.text();
-				let json;
-				try {
-					json = JSON.parse(responseText);
-				} catch {
-					return {
-						success: false,
-						error: new InvalidAuthorizationCodeError()
-					};
-				}
-				const tokenResponse = json;
-				return {
-					success: true,
-					data: {
-						access: tokenResponse.access_token,
-						refresh: tokenResponse.refresh_token,
-						expiresIn: tokenResponse.expires_in
-					}
-				};
-			} catch {
-				return {
-					success: false,
-					error: new InvalidAuthorizationCodeError()
-				};
-			}
-		},
-		async refresh(refresh, opts) {
-			try {
-				if (opts?.access) try {
-					const jwks = await getJWKS();
-					await jwtVerify(opts.access, jwks, { issuer });
-					return {
-						success: true,
-						data: {}
-					};
-				} catch {}
-				const response = await f((await getIssuer()).token_endpoint, {
-					method: "POST",
-					headers: { "Content-Type": "application/x-www-form-urlencoded" },
-					body: new URLSearchParams({
-						refresh_token: refresh,
-						grant_type: "refresh_token"
-					}).toString()
-				});
-				if (!response.ok) return {
-					success: false,
-					error: new InvalidRefreshTokenError()
-				};
-				const tokenResponse = await response.json();
-				return {
-					success: true,
-					data: { tokens: {
-						access: tokenResponse.access_token,
-						refresh: tokenResponse.refresh_token,
-						expiresIn: tokenResponse.expires_in
-					} }
-				};
-			} catch {
-				return {
-					success: false,
-					error: new InvalidRefreshTokenError()
-				};
-			}
-		},
-		async verify(subjects, token, options) {
-			try {
-				const jwtResult = await jwtVerify(token, await getJWKS(), {
-					issuer: options?.issuer ?? issuer,
-					audience: options?.audience ?? input.clientID
-				});
-				const validated = await subjects[jwtResult.payload.type]?.["~standard"].validate(jwtResult.payload.properties);
-				if (!validated?.issues && jwtResult.payload.mode === "access") return {
-					success: true,
-					data: {
-						aud: jwtResult.payload.aud,
-						sub: jwtResult.payload.sub,
-						subject: {
-							type: jwtResult.payload.type,
-							properties: validated?.value
-						}
-					}
-				};
-				return {
-					success: false,
-					error: new InvalidSubjectError()
-				};
-			} catch (e) {
-				if (e instanceof errors.JWTExpired && options?.refresh) {
-					const refreshed = await client.refresh(options.refresh);
-					if (!refreshed.success) return refreshed;
-					if (!refreshed.data.tokens) return {
-						success: false,
-						error: new InvalidAccessTokenError()
-					};
-					const verified = await client.verify(subjects, refreshed.data.tokens.access, {
-						refresh: refreshed.data.tokens.refresh,
-						issuer: options?.issuer,
-						audience: options?.audience,
-						fetch: options?.fetch
-					});
-					if (!verified.success) return verified;
-					return {
-						success: true,
-						data: {
-							...verified.data,
-							tokens: refreshed.data.tokens
-						}
-					};
-				}
-				return {
-					success: false,
-					error: new InvalidAccessTokenError()
-				};
-			}
-		},
-		async revoke(token, opts) {
-			try {
-				const wk = await getIssuer();
-				const body = new URLSearchParams({
-					token,
-					...opts?.tokenTypeHint ? { token_type_hint: opts.tokenTypeHint } : {}
-				});
-				if ((await f(wk.token_endpoint.replace("/token", "/revoke"), {
-					method: "POST",
-					headers: { "Content-Type": "application/x-www-form-urlencoded" },
-					body: body.toString()
-				})).ok) return {
-					success: true,
-					data: void 0
-				};
-				return {
-					success: false,
-					error: /* @__PURE__ */ new Error("Failed to revoke token")
-				};
-			} catch (error) {
-				return {
-					success: false,
-					error
-				};
-			}
-		}
-	};
-	return client;
-};
-
-//#endregion
-export { createClient };

package/dist/core.d.mts

@@ -1,109 +0,0 @@
-import { AllowCheckInput } from "./allow.mjs";
-import { UnknownStateError } from "./error.mjs";
-import { Prettify } from "./util.mjs";
-import { SubjectPayload, SubjectSchema } from "./subject.mjs";
-import { Router } from "./router/index.mjs";
-import { StorageAdapter } from "./storage/storage.mjs";
-import { Provider } from "./provider/provider.mjs";
-import { Theme } from "./themes/theme.mjs";
-import { AuthorizationState } from "./types.mjs";
-
-//#region src/core.d.ts
-/**
- * Sets the subject payload in the JWT token and returns the response.
- */
-interface OnSuccessResponder<T extends {
-  type: string;
-  properties: unknown;
-}> {
-  subject<Type extends T["type"]>(type: Type, properties: Extract<T, {
-    type: Type;
-  }>["properties"], opts?: {
-    ttl?: {
-      access?: number;
-      refresh?: number;
-    };
-    subject?: string;
-  }): Promise<Response>;
-}
-/**
- * Main issuer input configuration interface.
- */
-interface IssuerInput<Providers extends Record<string, Provider<unknown>>, Subjects extends SubjectSchema, Result = { [Key in keyof Providers]: Prettify<{
-  provider: Key;
-} & (Providers[Key] extends Provider<infer T> ? T : Record<string, unknown>)> }[keyof Providers]> {
-  /** The storage adapter for persisting tokens and sessions */
-  storage: StorageAdapter;
-  /** Auth providers configuration */
-  providers: Providers;
-  /** Subject schemas for token validation */
-  subjects: Subjects;
-  /** Base path for embedded scenarios */
-  basePath?: string;
-  /** Success callback for completed authentication */
-  success(response: OnSuccessResponder<SubjectPayload<Subjects>>, input: Result, req: Request, clientID: string): Promise<Response>;
-  /** Theme configuration for UI */
-  theme?: Theme;
-  /** TTL configuration for tokens and sessions */
-  ttl?: {
-    access?: number;
-    refresh?: number;
-    reuse?: number;
-    retention?: number;
-  };
-  /** Provider selection UI function */
-  select?(providers: Record<string, string>, req: Request): Promise<Response>;
-  /** Optional start callback */
-  start?(req: Request): Promise<void>;
-  /** Error handling callback */
-  error?(error: UnknownStateError, req: Request): Promise<Response>;
-  /** Client authorization check function */
-  allow?(input: AllowCheckInput, req: Request): Promise<boolean>;
-  /**
-       * Refresh callback for updating user claims.
-       *
-       * @example
-       * ```typescript
-       * refresh: async (payload, req) => {
-       *   const user = await getUserBySubject(payload.subject)
-       *   if (!user || !user.active) {
-       *     return undefined // Revoke the token
-       *   }
-       *
-       *   return {
-       *     type: payload.type,
-       *     properties: {
-       *       userID: user.id,
-       *       role: user.role,
-       *       permissions: user.permissions,
-       *       lastLogin: new Date().toISOString()
-       *     }
-       *   }
-       * }
-       * ```
-       */
-  refresh?(payload: {
-    type: SubjectPayload<Subjects>["type"];
-    properties: SubjectPayload<Subjects>["properties"];
-    subject: string;
-    clientID: string;
-    scopes?: string[];
-  }, req: Request): Promise<{
-    type: SubjectPayload<Subjects>["type"];
-    properties: SubjectPayload<Subjects>["properties"];
-    subject?: string;
-    scopes?: string[];
-  } | undefined>;
-}
-/**
- * Create an Draft Auth server, a Router app that handles OAuth 2.0 flows.
- */
-declare const issuer: <Providers extends Record<string, Provider<unknown>>, Subjects extends SubjectSchema, Result = { [key in keyof Providers]: {
-  provider: key;
-} & (Providers[key] extends Provider<infer T> ? T : Record<string, unknown>) }[keyof Providers]>(input: IssuerInput<Providers, Subjects, Result>) => Router<{
-  Variables: {
-    authorization: AuthorizationState;
-  };
-}>;
-//#endregion
-export { OnSuccessResponder, issuer };