@ereo/auth 0.1.6

package/dist/index.js

@@ -0,0 +1,1028 @@
+// @bun
+// src/providers/index.ts
+function credentials(config) {
+  return {
+    id: config.id || "credentials",
+    name: config.name || "Credentials",
+    type: "credentials",
+    authorize: config.authorize
+  };
+}
+function github(config) {
+  const baseUrl = config.enterprise?.baseUrl || "https://github.com";
+  const apiBaseUrl = config.enterprise?.baseUrl ? `${config.enterprise.baseUrl}/api/v3` : "https://api.github.com";
+  const authorizationUrl = config.authorizationUrl || `${baseUrl}/login/oauth/authorize`;
+  const tokenUrl = config.tokenUrl || `${baseUrl}/login/oauth/access_token`;
+  const userInfoUrl = config.userInfoUrl || `${apiBaseUrl}/user`;
+  const scope = config.scope || ["read:user", "user:email"];
+  return {
+    id: "github",
+    name: "GitHub",
+    type: "oauth",
+    async authorize(credentials2) {
+      if (credentials2.user) {
+        return credentials2.user;
+      }
+      const code = credentials2.code;
+      if (!code)
+        return null;
+      const tokenResponse = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          code,
+          redirect_uri: config.redirectUri
+        })
+      });
+      const tokenData = await tokenResponse.json();
+      if (!tokenData.access_token)
+        return null;
+      const userResponse = await fetch(userInfoUrl, {
+        headers: {
+          Authorization: `token ${tokenData.access_token}`,
+          "User-Agent": "EreoJS-Auth",
+          Accept: "application/json"
+        }
+      });
+      const user = await userResponse.json();
+      let email = user.email;
+      if (!email) {
+        const emailsResponse = await fetch(`${apiBaseUrl}/user/emails`, {
+          headers: {
+            Authorization: `token ${tokenData.access_token}`,
+            "User-Agent": "EreoJS-Auth",
+            Accept: "application/json"
+          }
+        });
+        const emails = await emailsResponse.json();
+        const primaryEmail = emails.find((e) => e.primary && e.verified);
+        email = primaryEmail?.email || emails[0]?.email || null;
+      }
+      return {
+        id: String(user.id),
+        email: email || undefined,
+        name: user.name || user.login,
+        avatar: user.avatar_url,
+        username: user.login
+      };
+    },
+    getAuthorizationUrl(state, redirectUri) {
+      const params = new URLSearchParams({
+        client_id: config.clientId,
+        redirect_uri: redirectUri,
+        scope: scope.join(" "),
+        state
+      });
+      return `${authorizationUrl}?${params.toString()}`;
+    },
+    async handleCallback(params) {
+      const { code, redirectUri } = params;
+      const tokenResponse = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          code,
+          redirect_uri: redirectUri
+        })
+      });
+      const tokenData = await tokenResponse.json();
+      if (!tokenData.access_token)
+        return null;
+      const userResponse = await fetch(userInfoUrl, {
+        headers: {
+          Authorization: `token ${tokenData.access_token}`,
+          "User-Agent": "EreoJS-Auth",
+          Accept: "application/json"
+        }
+      });
+      const user = await userResponse.json();
+      let email = user.email;
+      if (!email) {
+        const emailsResponse = await fetch(`${apiBaseUrl}/user/emails`, {
+          headers: {
+            Authorization: `token ${tokenData.access_token}`,
+            "User-Agent": "EreoJS-Auth",
+            Accept: "application/json"
+          }
+        });
+        const emails = await emailsResponse.json();
+        const primaryEmail = emails.find((e) => e.primary && e.verified);
+        email = primaryEmail?.email || emails[0]?.email || null;
+      }
+      return {
+        id: String(user.id),
+        email: email || undefined,
+        name: user.name || user.login,
+        avatar: user.avatar_url,
+        username: user.login
+      };
+    }
+  };
+}
+function google(config) {
+  const authorizationUrl = config.authorizationUrl || "https://accounts.google.com/o/oauth2/v2/auth";
+  const tokenUrl = config.tokenUrl || "https://oauth2.googleapis.com/token";
+  const userInfoUrl = config.userInfoUrl || "https://www.googleapis.com/oauth2/v2/userinfo";
+  const scope = config.scope || ["openid", "email", "profile"];
+  return {
+    id: "google",
+    name: "Google",
+    type: "oauth",
+    async authorize(credentials2) {
+      if (credentials2.user) {
+        return credentials2.user;
+      }
+      const code = credentials2.code;
+      if (!code)
+        return null;
+      const tokenResponse = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          code,
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          redirect_uri: config.redirectUri || "postmessage",
+          grant_type: "authorization_code"
+        })
+      });
+      const tokenData = await tokenResponse.json();
+      if (!tokenData.access_token)
+        return null;
+      const userResponse = await fetch(`${userInfoUrl}?access_token=${tokenData.access_token}`);
+      const user = await userResponse.json();
+      if (config.hostedDomain && user.hd !== config.hostedDomain) {
+        return null;
+      }
+      return {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        picture: user.picture,
+        emailVerified: user.verified_email
+      };
+    },
+    getAuthorizationUrl(state, redirectUri) {
+      const params = new URLSearchParams({
+        client_id: config.clientId,
+        redirect_uri: redirectUri,
+        response_type: "code",
+        scope: scope.join(" "),
+        state,
+        access_type: "offline",
+        prompt: "consent"
+      });
+      if (config.hostedDomain) {
+        params.set("hd", config.hostedDomain);
+      }
+      return `${authorizationUrl}?${params.toString()}`;
+    },
+    async handleCallback(params) {
+      const { code, redirectUri } = params;
+      const tokenResponse = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          code,
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          redirect_uri: redirectUri,
+          grant_type: "authorization_code"
+        })
+      });
+      const tokenData = await tokenResponse.json();
+      if (!tokenData.access_token)
+        return null;
+      const userResponse = await fetch(`${userInfoUrl}?access_token=${tokenData.access_token}`);
+      const user = await userResponse.json();
+      if (config.hostedDomain && user.hd !== config.hostedDomain) {
+        return null;
+      }
+      return {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        picture: user.picture,
+        emailVerified: user.verified_email
+      };
+    }
+  };
+}
+function discord(config) {
+  const authorizationUrl = config.authorizationUrl || "https://discord.com/api/oauth2/authorize";
+  const tokenUrl = config.tokenUrl || "https://discord.com/api/oauth2/token";
+  const userInfoUrl = config.userInfoUrl || "https://discord.com/api/users/@me";
+  const scope = config.scope || ["identify", "email"];
+  return {
+    id: "discord",
+    name: "Discord",
+    type: "oauth",
+    async authorize(credentials2) {
+      if (credentials2.user) {
+        return credentials2.user;
+      }
+      const code = credentials2.code;
+      if (!code)
+        return null;
+      const tokenResponse = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          code,
+          grant_type: "authorization_code",
+          redirect_uri: config.redirectUri || ""
+        })
+      });
+      const tokenData = await tokenResponse.json();
+      if (!tokenData.access_token)
+        return null;
+      const userResponse = await fetch(userInfoUrl, {
+        headers: {
+          Authorization: `Bearer ${tokenData.access_token}`
+        }
+      });
+      const user = await userResponse.json();
+      if (config.guildId) {
+        const guildsResponse = await fetch("https://discord.com/api/users/@me/guilds", {
+          headers: {
+            Authorization: `Bearer ${tokenData.access_token}`
+          }
+        });
+        const guilds = await guildsResponse.json();
+        const isMember = guilds.some((g) => g.id === config.guildId);
+        if (!isMember)
+          return null;
+      }
+      const avatarUrl = user.avatar ? `https://cdn.discordapp.com/avatars/${user.id}/${user.avatar}.png` : null;
+      return {
+        id: user.id,
+        email: user.email,
+        name: user.username,
+        avatar: avatarUrl || undefined,
+        discriminator: user.discriminator
+      };
+    },
+    getAuthorizationUrl(state, redirectUri) {
+      const params = new URLSearchParams({
+        client_id: config.clientId,
+        redirect_uri: redirectUri,
+        response_type: "code",
+        scope: scope.join(" "),
+        state
+      });
+      return `${authorizationUrl}?${params.toString()}`;
+    },
+    async handleCallback(params) {
+      const { code, redirectUri } = params;
+      const tokenResponse = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          code,
+          grant_type: "authorization_code",
+          redirect_uri: redirectUri
+        })
+      });
+      const tokenData = await tokenResponse.json();
+      if (!tokenData.access_token)
+        return null;
+      const userResponse = await fetch(userInfoUrl, {
+        headers: {
+          Authorization: `Bearer ${tokenData.access_token}`
+        }
+      });
+      const user = await userResponse.json();
+      if (config.guildId) {
+        const guildsResponse = await fetch("https://discord.com/api/users/@me/guilds", {
+          headers: {
+            Authorization: `Bearer ${tokenData.access_token}`
+          }
+        });
+        const guilds = await guildsResponse.json();
+        const isMember = guilds.some((g) => g.id === config.guildId);
+        if (!isMember)
+          return null;
+      }
+      const avatarUrl = user.avatar ? `https://cdn.discordapp.com/avatars/${user.id}/${user.avatar}.png` : null;
+      return {
+        id: user.id,
+        email: user.email,
+        name: user.username,
+        avatar: avatarUrl || undefined,
+        discriminator: user.discriminator
+      };
+    }
+  };
+}
+function oauth(config) {
+  const scope = config.scope || [];
+  return {
+    id: config.id,
+    name: config.name,
+    type: "oauth",
+    async authorize(credentials2) {
+      if (credentials2.user) {
+        return credentials2.user;
+      }
+      const code = credentials2.code;
+      if (!code || !config.tokenUrl)
+        return null;
+      const tokenResponse = await fetch(config.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          code,
+          grant_type: "authorization_code",
+          redirect_uri: config.redirectUri || ""
+        })
+      });
+      const tokenData = await tokenResponse.json();
+      if (!tokenData.access_token)
+        return null;
+      const userInfoUrl = config.userInfoUrl || config.profileUrl;
+      if (!userInfoUrl) {
+        return null;
+      }
+      const userResponse = await fetch(userInfoUrl, {
+        headers: {
+          Authorization: `Bearer ${tokenData.access_token}`
+        }
+      });
+      const profile = await userResponse.json();
+      if (config.profile) {
+        return config.profile(profile, tokenData);
+      }
+      return {
+        id: profile.id || profile.sub || profile.user_id,
+        email: profile.email,
+        name: profile.name || profile.username
+      };
+    },
+    getAuthorizationUrl(state, redirectUri) {
+      if (!config.authorizationUrl) {
+        throw new Error(`Authorization URL not configured for provider: ${config.id}`);
+      }
+      const params = new URLSearchParams({
+        client_id: config.clientId,
+        redirect_uri: redirectUri,
+        response_type: "code",
+        state
+      });
+      if (scope.length > 0) {
+        params.set("scope", scope.join(" "));
+      }
+      return `${config.authorizationUrl}?${params.toString()}`;
+    },
+    async handleCallback(params) {
+      const { code, redirectUri } = params;
+      if (!config.tokenUrl) {
+        throw new Error(`Token URL not configured for provider: ${config.id}`);
+      }
+      const tokenResponse = await fetch(config.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          code,
+          grant_type: "authorization_code",
+          redirect_uri: redirectUri
+        })
+      });
+      const tokenData = await tokenResponse.json();
+      if (!tokenData.access_token)
+        return null;
+      const userInfoUrl = config.userInfoUrl || config.profileUrl;
+      if (!userInfoUrl) {
+        return null;
+      }
+      const userResponse = await fetch(userInfoUrl, {
+        headers: {
+          Authorization: `Bearer ${tokenData.access_token}`
+        }
+      });
+      const profile = await userResponse.json();
+      if (config.profile) {
+        return config.profile(profile, tokenData);
+      }
+      return {
+        id: profile.id || profile.sub || profile.user_id,
+        email: profile.email,
+        name: profile.name || profile.username
+      };
+    }
+  };
+}
+function mock(config) {
+  return {
+    id: "mock",
+    name: "Mock",
+    type: "credentials",
+    async authorize() {
+      if (config?.delay) {
+        await new Promise((resolve) => setTimeout(resolve, config.delay));
+      }
+      if (config?.user) {
+        return config.user;
+      }
+      if (config?.session) {
+        return {
+          id: config.session.userId,
+          email: config.session.email,
+          name: config.session.name,
+          roles: config.session.roles,
+          ...config.session.claims
+        };
+      }
+      return {
+        id: "mock-user-123",
+        email: "mock@example.com",
+        name: "Mock User",
+        roles: ["user"]
+      };
+    }
+  };
+}
+function apiKey(config) {
+  return {
+    id: "api-key",
+    name: "API Key",
+    type: "credentials",
+    async authorize(credentials2) {
+      const key = credentials2.apiKey;
+      if (!key)
+        return null;
+      return config.validate(key);
+    }
+  };
+}
+
+// src/auth.ts
+async function getSigningKey(secret) {
+  const encoder = new TextEncoder;
+  const keyData = encoder.encode(secret);
+  return crypto.subtle.importKey("raw", keyData, { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+}
+function base64UrlEncode(data) {
+  let binary = "";
+  for (let i = 0;i < data.length; i++) {
+    binary += String.fromCharCode(data[i]);
+  }
+  const base64 = btoa(binary);
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(str) {
+  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  while (base64.length % 4) {
+    base64 += "=";
+  }
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+async function signJWT(payload, secret) {
+  const encoder = new TextEncoder;
+  const header = { alg: "HS256", typ: "JWT" };
+  const headerBase64 = base64UrlEncode(encoder.encode(JSON.stringify(header)));
+  const payloadBase64 = base64UrlEncode(encoder.encode(JSON.stringify(payload)));
+  const signingInput = `${headerBase64}.${payloadBase64}`;
+  const key = await getSigningKey(secret);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(signingInput));
+  const signatureBase64 = base64UrlEncode(new Uint8Array(signature));
+  return `${signingInput}.${signatureBase64}`;
+}
+async function verifyJWT(token, secret) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return null;
+    }
+    const [headerBase64, payloadBase64, signatureBase64] = parts;
+    const encoder = new TextEncoder;
+    const signingInput = `${headerBase64}.${payloadBase64}`;
+    const signature = base64UrlDecode(signatureBase64);
+    const key = await getSigningKey(secret);
+    const isValid = await crypto.subtle.verify("HMAC", key, signature.buffer, encoder.encode(signingInput));
+    if (!isValid) {
+      return null;
+    }
+    const payloadJson = new TextDecoder().decode(base64UrlDecode(payloadBase64));
+    const payload = JSON.parse(payloadJson);
+    if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+      return null;
+    }
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+class SessionStore {
+  maxAge;
+  sessions = new Map;
+  cleanupInterval = null;
+  constructor(maxAge) {
+    this.maxAge = maxAge;
+    this.cleanupInterval = setInterval(() => this.cleanup(), 60 * 1000);
+  }
+  generateId() {
+    const array = new Uint8Array(32);
+    crypto.getRandomValues(array);
+    return base64UrlEncode(array);
+  }
+  set(sessionId, session) {
+    this.sessions.set(sessionId, {
+      session,
+      createdAt: Date.now(),
+      lastAccessed: Date.now()
+    });
+  }
+  get(sessionId) {
+    const stored = this.sessions.get(sessionId);
+    if (!stored) {
+      return null;
+    }
+    if (Date.now() - stored.createdAt > this.maxAge * 1000) {
+      this.sessions.delete(sessionId);
+      return null;
+    }
+    stored.lastAccessed = Date.now();
+    return stored.session;
+  }
+  delete(sessionId) {
+    return this.sessions.delete(sessionId);
+  }
+  update(sessionId, session) {
+    const stored = this.sessions.get(sessionId);
+    if (!stored) {
+      return false;
+    }
+    stored.session = session;
+    stored.lastAccessed = Date.now();
+    return true;
+  }
+  cleanup() {
+    const now = Date.now();
+    const entries = Array.from(this.sessions.entries());
+    for (const [id, stored] of entries) {
+      if (now - stored.createdAt > this.maxAge * 1000) {
+        this.sessions.delete(id);
+      }
+    }
+  }
+  destroy() {
+    if (this.cleanupInterval) {
+      clearInterval(this.cleanupInterval);
+      this.cleanupInterval = null;
+    }
+    this.sessions.clear();
+  }
+  get size() {
+    return this.sessions.size;
+  }
+}
+function parseCookie(cookieString, name) {
+  const cookies = cookieString.split(";");
+  for (const cookie of cookies) {
+    const [key, value] = cookie.trim().split("=");
+    if (key === name && value) {
+      return decodeURIComponent(value);
+    }
+  }
+  return null;
+}
+function buildCookieHeader(name, value, options) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.maxAge !== undefined) {
+    parts.push(`Max-Age=${options.maxAge}`);
+  }
+  if (options.expires) {
+    parts.push(`Expires=${options.expires.toUTCString()}`);
+  }
+  if (options.secure) {
+    parts.push("Secure");
+  }
+  if (options.httpOnly !== false) {
+    parts.push("HttpOnly");
+  }
+  if (options.sameSite) {
+    parts.push(`SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)}`);
+  }
+  if (options.domain) {
+    parts.push(`Domain=${options.domain}`);
+  }
+  parts.push(`Path=${options.path || "/"}`);
+  return parts.join("; ");
+}
+function buildClearCookieHeader(name, options) {
+  return buildCookieHeader(name, "", {
+    maxAge: 0,
+    expires: new Date(0),
+    ...options
+  });
+}
+function createAuthPlugin(config) {
+  const secretValue = config.session?.secret || config.secret;
+  if (!secretValue) {
+    throw new Error("[auth] Session secret is required");
+  }
+  const secret = secretValue;
+  const sessionMaxAge = config.session?.maxAge ?? config.sessionDuration ?? 7 * 24 * 60 * 60;
+  const sessionStrategy = config.session?.strategy ?? "jwt";
+  const sessionUpdateAge = config.session?.updateAge ?? sessionMaxAge / 2;
+  const cookieName = config.cookie?.name || "ereo.session";
+  const cookieOptions = {
+    secure: config.cookie?.secure ?? false,
+    httpOnly: config.cookie?.httpOnly ?? true,
+    sameSite: config.cookie?.sameSite ?? "lax",
+    domain: config.cookie?.domain,
+    path: config.cookie?.path ?? "/"
+  };
+  const sessionStore = new SessionStore(sessionMaxAge);
+  const debug = config.debug ?? false;
+  const log = (...args) => {
+    if (debug) {
+      console.log("[auth]", ...args);
+    }
+  };
+  async function createSession(user, providerId) {
+    const now = new Date;
+    const expiresAt = new Date(now.getTime() + sessionMaxAge * 1000);
+    const sessionId = sessionStore.generateId();
+    let session = {
+      userId: user.id,
+      email: user.email,
+      name: user.name,
+      roles: user.roles ?? [],
+      claims: {},
+      expiresAt,
+      sessionId,
+      issuedAt: now,
+      provider: providerId
+    };
+    for (const [key, value] of Object.entries(user)) {
+      if (!["id", "email", "name", "roles"].includes(key)) {
+        session.claims[key] = value;
+      }
+    }
+    if (config.callbacks?.onSessionCreated) {
+      session = await config.callbacks.onSessionCreated(session);
+    }
+    if (sessionStrategy !== "jwt") {
+      sessionStore.set(sessionId, session);
+    }
+    return session;
+  }
+  async function createToken(session) {
+    const now = Math.floor(Date.now() / 1000);
+    let payload = {
+      sub: session.userId,
+      iat: Math.floor((session.issuedAt?.getTime() ?? Date.now()) / 1000),
+      exp: Math.floor((session.expiresAt?.getTime() ?? Date.now() + sessionMaxAge * 1000) / 1000),
+      sid: session.sessionId,
+      email: session.email,
+      name: session.name,
+      roles: session.roles,
+      provider: session.provider,
+      ...session.claims
+    };
+    if (config.callbacks?.jwt) {
+      payload = await config.callbacks.jwt({ token: payload, session });
+    }
+    return signJWT(payload, secret);
+  }
+  async function sessionFromToken(token) {
+    const payload = await verifyJWT(token, secret);
+    if (!payload) {
+      return null;
+    }
+    if (sessionStrategy === "hybrid" && payload.sid) {
+      const storedSession = sessionStore.get(payload.sid);
+      if (!storedSession) {
+        log("Session not found in store:", payload.sid);
+        return null;
+      }
+      return storedSession;
+    }
+    const { sub, iat, exp, sid, email, name, roles, provider, ...claims } = payload;
+    let session = {
+      userId: sub,
+      email,
+      name,
+      roles,
+      claims,
+      expiresAt: new Date(exp * 1000),
+      sessionId: sid,
+      issuedAt: new Date(iat * 1000),
+      provider
+    };
+    if (config.callbacks?.session) {
+      session = await config.callbacks.session({ token: payload, session });
+    }
+    return session;
+  }
+  async function extractSession(request) {
+    const authHeader = request.headers.get("authorization");
+    if (authHeader?.startsWith("Bearer ")) {
+      const token = authHeader.slice(7);
+      const session = await sessionFromToken(token);
+      if (session) {
+        log("Session extracted from Authorization header");
+        return session;
+      }
+    }
+    const cookie = request.headers.get("cookie");
+    if (cookie) {
+      const sessionCookie = parseCookie(cookie, cookieName);
+      if (sessionCookie) {
+        if (sessionStrategy === "cookie") {
+          const session = sessionStore.get(sessionCookie);
+          if (session) {
+            log("Session extracted from cookie (session store)");
+            return session;
+          }
+        } else {
+          const session = await sessionFromToken(sessionCookie);
+          if (session) {
+            if (config.callbacks?.onSessionValidate) {
+              const isValid = await config.callbacks.onSessionValidate(session);
+              if (!isValid) {
+                log("Session validation failed");
+                return null;
+              }
+            }
+            if (session.expiresAt && new Date(session.expiresAt) < new Date) {
+              log("Session expired");
+              return null;
+            }
+            log("Session extracted from cookie (JWT)");
+            return session;
+          }
+        }
+      }
+    }
+    return null;
+  }
+  return {
+    name: "@ereo/auth",
+    async setup(context) {
+      log(`Initialized with ${config.providers?.length || 0} providers`);
+      console.log(`[auth] Initialized with ${config.providers?.length || 0} providers`);
+      if (config.providers) {
+        for (const provider of config.providers) {
+          log(`Provider registered: ${provider.id} (${provider.type})`);
+        }
+      }
+    },
+    configureServer(server) {
+      const authMiddleware = async (request, ctx, next) => {
+        const session = await extractSession(request);
+        let pendingCookieHeader = null;
+        const authContext = {
+          session,
+          signIn: async (providerId, credentials2) => {
+            const provider = config.providers?.find((p) => p.id === providerId);
+            if (!provider) {
+              throw new Error(`Auth provider not found: ${providerId}`);
+            }
+            const user = await provider.authorize(credentials2);
+            if (!user) {
+              throw new Error("Authentication failed");
+            }
+            if (config.callbacks?.onSignIn) {
+              await config.callbacks.onSignIn(user);
+            }
+            const newSession = await createSession(user, providerId);
+            authContext.session = newSession;
+            const token = await createToken(newSession);
+            pendingCookieHeader = buildCookieHeader(cookieName, sessionStrategy === "cookie" ? newSession.sessionId : token, {
+              ...cookieOptions,
+              maxAge: sessionMaxAge
+            });
+            return newSession;
+          },
+          signOut: async () => {
+            if (authContext.session) {
+              if (config.callbacks?.onSignOut) {
+                await config.callbacks.onSignOut(authContext.session);
+              }
+              if (authContext.session.sessionId) {
+                sessionStore.delete(authContext.session.sessionId);
+              }
+              pendingCookieHeader = buildClearCookieHeader(cookieName, {
+                domain: cookieOptions.domain,
+                path: cookieOptions.path
+              });
+            }
+            authContext.session = null;
+          },
+          isAuthenticated: () => authContext.session !== null,
+          hasRole: (role) => authContext.session?.roles?.includes(role) ?? false,
+          hasAnyRole: (roles) => roles.some((role) => authContext.session?.roles?.includes(role)),
+          hasAllRoles: (roles) => roles.every((role) => authContext.session?.roles?.includes(role)),
+          getUser: () => {
+            if (!authContext.session)
+              return null;
+            return {
+              id: authContext.session.userId,
+              email: authContext.session.email,
+              name: authContext.session.name,
+              roles: authContext.session.roles,
+              ...authContext.session.claims
+            };
+          },
+          getToken: async () => {
+            if (!authContext.session)
+              return null;
+            return createToken(authContext.session);
+          },
+          refreshSession: async () => {
+            if (!authContext.session)
+              return null;
+            const issuedAt = authContext.session.issuedAt?.getTime() ?? 0;
+            const now = Date.now();
+            if (now - issuedAt > sessionUpdateAge * 1000) {
+              const newExpiresAt = new Date(now + sessionMaxAge * 1000);
+              const newIssuedAt = new Date(now);
+              authContext.session = {
+                ...authContext.session,
+                expiresAt: newExpiresAt,
+                issuedAt: newIssuedAt
+              };
+              if (authContext.session.sessionId) {
+                sessionStore.update(authContext.session.sessionId, authContext.session);
+              }
+              const token = await createToken(authContext.session);
+              pendingCookieHeader = buildCookieHeader(cookieName, sessionStrategy === "cookie" ? authContext.session.sessionId : token, {
+                ...cookieOptions,
+                maxAge: sessionMaxAge
+              });
+              log("Session refreshed");
+            }
+            return authContext.session;
+          },
+          getCookieHeader: () => pendingCookieHeader
+        };
+        ctx.set("auth", authContext);
+        const response = await next();
+        if (pendingCookieHeader) {
+          const headers = new Headers(response.headers);
+          headers.append("Set-Cookie", pendingCookieHeader);
+          return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers
+          });
+        }
+        return response;
+      };
+      server.middlewares.push(authMiddleware);
+    }
+  };
+}
+function requireAuth(options) {
+  return {
+    auth: {
+      required: true,
+      roles: options?.roles,
+      permissions: options?.permissions,
+      redirect: options?.redirect,
+      unauthorized: options?.unauthorizedResponse,
+      check: async ({ context }) => {
+        const auth = context.get("auth");
+        if (!auth?.isAuthenticated()) {
+          return false;
+        }
+        if (options?.roles && !auth.hasAnyRole(options.roles)) {
+          return false;
+        }
+        return true;
+      }
+    }
+  };
+}
+function optionalAuth() {
+  return {
+    auth: {
+      required: false
+    }
+  };
+}
+function requireRoles(roles, options) {
+  return {
+    auth: {
+      required: true,
+      roles,
+      redirect: options?.redirect,
+      check: async ({ context }) => {
+        const auth = context.get("auth");
+        if (!auth?.isAuthenticated()) {
+          return false;
+        }
+        if (options?.requireAll) {
+          return auth.hasAllRoles(roles);
+        }
+        return auth.hasAnyRole(roles);
+      }
+    }
+  };
+}
+function useAuth(context) {
+  const auth = context.get("auth");
+  if (!auth) {
+    throw new Error("Auth context not found. Make sure createAuthPlugin is registered.");
+  }
+  return auth;
+}
+function getSession(context) {
+  const auth = context.get("auth");
+  return auth?.session ?? null;
+}
+function getUser(context) {
+  const auth = context.get("auth");
+  return auth?.getUser() ?? null;
+}
+function withAuth(handler, options) {
+  return async (args) => {
+    const auth = useAuth(args.context);
+    if (!auth.isAuthenticated()) {
+      throw new Response("Unauthorized", { status: 401 });
+    }
+    if (options?.roles && !auth.hasAnyRole(options.roles)) {
+      throw new Response("Forbidden", { status: 403 });
+    }
+    return handler({ ...args, auth });
+  };
+}
+function getOAuthUrl(context, providerId, redirectUri) {
+  const config = context.get("authConfig");
+  const provider = config?.providers?.find((p) => p.id === providerId);
+  if (!provider || provider.type !== "oauth" || !provider.getAuthorizationUrl) {
+    throw new Error(`OAuth provider not found or not configured: ${providerId}`);
+  }
+  const state = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+  return provider.getAuthorizationUrl(state, redirectUri);
+}
+async function handleOAuthCallback(context, providerId, params) {
+  const auth = useAuth(context);
+  const config = context.get("authConfig");
+  const provider = config?.providers?.find((p) => p.id === providerId);
+  if (!provider || provider.type !== "oauth" || !provider.handleCallback) {
+    throw new Error(`OAuth provider not found or not configured: ${providerId}`);
+  }
+  const user = await provider.handleCallback(params);
+  if (!user) {
+    throw new Error("OAuth authentication failed");
+  }
+  return auth.signIn(providerId, { user });
+}
+export {
+  withAuth,
+  useAuth,
+  requireRoles,
+  requireAuth,
+  optionalAuth,
+  oauth,
+  mock,
+  handleOAuthCallback,
+  google,
+  github,
+  getUser,
+  getSession,
+  getOAuthUrl,
+  discord,
+  credentials,
+  createAuthPlugin,
+  apiKey
+};