@eaccess/auth 0.1.18 → 0.1.20

package/dist/index.d.cts

@@ -55,6 +55,7 @@ interface AuthConfig {
         google?: GoogleProviderConfig;
         azure?: AzureProviderConfig;
     };
+    githubUserAgent?: string;
     twoFactor?: {
         enabled?: boolean;
         requireForOAuth?: boolean;
@@ -149,6 +150,7 @@ interface AuthSession {
     lastRememberCheck: Date;
     forceLogout: number;
     verified: boolean;
+    hasPassword: boolean;
     shouldForceLogout?: boolean;
     awaitingTwoFactor?: {
         accountId: number;
@@ -285,6 +287,7 @@ interface AuthManager$1 {
     getEmail(): string | null;
     getStatus(): number | null;
     getVerified(): boolean | null;
+    hasPassword(): boolean | null;
     getRoleNames(rolemask?: number): string[];
     getStatusName(): string | null;
     hasRole(role: number): Promise<boolean>;
@@ -977,6 +980,12 @@ declare class AuthManager implements AuthManager$1 {
      * @returns true if verified, false if unverified, null if not logged in
      */
     getVerified(): boolean | null;
+    /**
+     * Check if the current user has a password set.
+     * OAuth-only users will return false.
+     * @returns true if user has a password, false if OAuth-only, null if not logged in
+     */
+    hasPassword(): boolean | null;
     /**
      * Get human-readable role names for the current user or a specific rolemask.
      * @param rolemask - Optional specific rolemask to check. If omitted, uses current user's roles
@@ -1159,7 +1168,7 @@ declare abstract class BaseOAuthProvider implements OAuthProvider {
     protected processOAuthLogin(userData: OAuthUserData, req: Request): Promise<OAuthCallbackResult>;
     protected abstract getProviderName(): string;
     protected exchangeCodeForToken(code: string, tokenUrl: string): Promise<string>;
-    protected fetchUserFromAPI(accessToken: string, apiUrl: string): Promise<any>;
+    protected fetchUserFromAPI(accessToken: string, apiUrl: string, headers?: Record<string, string>): Promise<any>;
 }
 
 declare class GitHubProvider extends BaseOAuthProvider {

package/dist/index.d.ts

@@ -55,6 +55,7 @@ interface AuthConfig {
         google?: GoogleProviderConfig;
         azure?: AzureProviderConfig;
     };
+    githubUserAgent?: string;
     twoFactor?: {
         enabled?: boolean;
         requireForOAuth?: boolean;
@@ -149,6 +150,7 @@ interface AuthSession {
     lastRememberCheck: Date;
     forceLogout: number;
     verified: boolean;
+    hasPassword: boolean;
     shouldForceLogout?: boolean;
     awaitingTwoFactor?: {
         accountId: number;
@@ -285,6 +287,7 @@ interface AuthManager$1 {
     getEmail(): string | null;
     getStatus(): number | null;
     getVerified(): boolean | null;
+    hasPassword(): boolean | null;
     getRoleNames(rolemask?: number): string[];
     getStatusName(): string | null;
     hasRole(role: number): Promise<boolean>;
@@ -977,6 +980,12 @@ declare class AuthManager implements AuthManager$1 {
      * @returns true if verified, false if unverified, null if not logged in
      */
     getVerified(): boolean | null;
+    /**
+     * Check if the current user has a password set.
+     * OAuth-only users will return false.
+     * @returns true if user has a password, false if OAuth-only, null if not logged in
+     */
+    hasPassword(): boolean | null;
     /**
      * Get human-readable role names for the current user or a specific rolemask.
      * @param rolemask - Optional specific rolemask to check. If omitted, uses current user's roles
@@ -1159,7 +1168,7 @@ declare abstract class BaseOAuthProvider implements OAuthProvider {
     protected processOAuthLogin(userData: OAuthUserData, req: Request): Promise<OAuthCallbackResult>;
     protected abstract getProviderName(): string;
     protected exchangeCodeForToken(code: string, tokenUrl: string): Promise<string>;
-    protected fetchUserFromAPI(accessToken: string, apiUrl: string): Promise<any>;
+    protected fetchUserFromAPI(accessToken: string, apiUrl: string, headers?: Record<string, string>): Promise<any>;
 }
 
 declare class GitHubProvider extends BaseOAuthProvider {

package/dist/index.js

@@ -696,11 +696,12 @@ var BaseOAuthProvider = class {
     }
     return data.access_token;
   }
-  async fetchUserFromAPI(accessToken, apiUrl) {
+  async fetchUserFromAPI(accessToken, apiUrl, headers = {}) {
     const response = await fetch(apiUrl, {
       headers: {
         Authorization: `Bearer ${accessToken}`,
-        Accept: "application/json"
+        Accept: "application/json",
+        ...headers
       }
     });
     if (!response.ok) {
@@ -731,14 +732,24 @@ var GitHubProvider = class extends BaseOAuthProvider {
       throw new Error("No authorization code provided");
     }
     const accessToken = await this.exchangeCodeForToken(code, "https://github.com/login/oauth/access_token");
-    const [user, emails] = await Promise.all([this.fetchUserFromAPI(accessToken, "https://api.github.com/user"), this.fetchUserFromAPI(accessToken, "https://api.github.com/user/emails")]);
-    const primaryEmail = Array.isArray(emails) ? emails.find((email) => email.primary)?.email : null;
-    if (!primaryEmail) {
-      throw new Error("No primary email found in GitHub account");
+    const apiHeaders = {
+      Accept: "application/vnd.github+json",
+      "User-Agent": this.authConfig.githubUserAgent || "EasyAccess",
+      "X-GitHub-Api-Version": "2022-11-28"
+    };
+    const [user, emails] = await Promise.all([
+      this.fetchUserFromAPI(accessToken, "https://api.github.com/user", apiHeaders),
+      this.fetchUserFromAPI(accessToken, "https://api.github.com/user/emails", apiHeaders)
+    ]);
+    const verifiedEmails = Array.isArray(emails) ? emails.filter((email) => email.verified) : [];
+    const primaryEmail = verifiedEmails.find((email) => email.primary)?.email;
+    const fallbackEmail = primaryEmail || verifiedEmails[0]?.email;
+    if (!fallbackEmail) {
+      throw new Error("No verified email found in GitHub account");
     }
     return {
       id: user.id.toString(),
-      email: primaryEmail,
+      email: fallbackEmail,
       username: user.login,
       name: user.name || user.login,
       avatar: user.avatar_url
@@ -1744,6 +1755,7 @@ var AuthManager = class {
     this.req.session.auth.status = account.status;
     this.req.session.auth.rolemask = account.rolemask;
     this.req.session.auth.verified = account.verified;
+    this.req.session.auth.hasPassword = account.password !== null;
     this.req.session.auth.lastResync = /* @__PURE__ */ new Date();
   }
   async processRememberDirective() {
@@ -1797,6 +1809,7 @@ var AuthManager = class {
           lastRememberCheck: /* @__PURE__ */ new Date(),
           forceLogout: account.force_logout,
           verified: account.verified,
+          hasPassword: account.password !== null,
           shouldForceLogout: false
         };
         this.req.session.auth = session;
@@ -1883,6 +1896,7 @@ var AuthManager = class {
             lastRememberCheck: /* @__PURE__ */ new Date(),
             forceLogout: 0,
             verified: false,
+            hasPassword: false,
             awaitingTwoFactor: {
               accountId: account.id,
               expiresAt,
@@ -2021,6 +2035,14 @@ var AuthManager = class {
   getVerified() {
     return this.req.session?.auth?.verified ?? null;
   }
+  /**
+   * Check if the current user has a password set.
+   * OAuth-only users will return false.
+   * @returns true if user has a password, false if OAuth-only, null if not logged in
+   */
+  hasPassword() {
+    return this.req.session?.auth?.hasPassword ?? null;
+  }
   /**
    * Get human-readable role names for the current user or a specific rolemask.
    * @param rolemask - Optional specific rolemask to check. If omitted, uses current user's roles
@@ -2169,6 +2191,7 @@ var AuthManager = class {
           lastRememberCheck: /* @__PURE__ */ new Date(),
           forceLogout: 0,
           verified: false,
+          hasPassword: false,
           awaitingTwoFactor: {
             accountId: account.id,
             expiresAt,