@eventcatalog/core 4.12.0-beta.9 → 4.12.1

package/eventcatalog/src/utils/auth-astro/config.ts

@@ -0,0 +1,24 @@
+/**
+ * Adapted from auth-astro 4.2.0 (MIT, https://github.com/nowaythatworked/auth-astro).
+ *
+ * Kept in Core so every Auth.js import resolves to Core's own `@auth/core`. The
+ * auth-astro package pins an older `@auth/core` peer range, which makes npm install
+ * a second, vulnerable copy in user projects.
+ */
+import type { AuthConfig } from '@auth/core/types';
+
+export interface AstroAuthConfig {
+  /**
+   * Base path for the auth routes.
+   * @default '/api/auth'
+   */
+  prefix?: string;
+}
+
+export interface FullAuthConfig extends AstroAuthConfig, Omit<AuthConfig, 'raw'> {}
+
+export const defineConfig = (config: FullAuthConfig) => {
+  config.prefix ??= '/api/auth';
+  config.basePath = config.prefix;
+  return config;
+};

package/eventcatalog/src/utils/auth-astro/server.ts

@@ -0,0 +1,74 @@
+/**
+ * Adapted from auth-astro 4.2.0 (MIT, https://github.com/nowaythatworked/auth-astro).
+ * See ./config.ts for why this lives in Core.
+ */
+import { Auth } from '@auth/core';
+import type { AuthAction, Session } from '@auth/core/types';
+import type { APIContext } from 'astro';
+import { parseString } from 'set-cookie-parser';
+import authConfig from 'auth:config';
+
+const actions: AuthAction[] = ['providers', 'session', 'csrf', 'signin', 'signout', 'callback', 'verify-request', 'error'];
+
+function AstroAuthHandler(prefix: string, options = authConfig) {
+  return async ({ cookies, request }: APIContext) => {
+    const url = new URL(request.url);
+    const action = url.pathname.slice(prefix.length + 1).split('/')[0] as AuthAction;
+
+    if (!actions.includes(action) || !url.pathname.startsWith(prefix + '/')) return;
+
+    const res = await Auth(request, options);
+    if (['callback', 'signin', 'signout'].includes(action)) {
+      // Multiple Set-Cookie headers can't be concatenated, so hand each one to Astro
+      const setCookies = res.headers.getSetCookie();
+      if (setCookies.length > 0) {
+        setCookies.forEach((cookie) => {
+          const { name, value, ...cookieOptions } = parseString(cookie);
+          cookies.set(name, value, cookieOptions as Parameters<(typeof cookies)['set']>[2]);
+        });
+        res.headers.delete('Set-Cookie');
+      }
+    }
+    return res;
+  };
+}
+
+/**
+ * Creates the Astro GET and POST endpoints for authentication.
+ */
+export function AstroAuth(options = authConfig) {
+  const { AUTH_SECRET, AUTH_TRUST_HOST, VERCEL, NODE_ENV } = import.meta.env;
+
+  options.secret ??= AUTH_SECRET;
+  options.trustHost ??= !!(AUTH_TRUST_HOST ?? VERCEL ?? NODE_ENV !== 'production');
+
+  const { prefix = '/api/auth', ...authOptions } = options;
+
+  const handler = AstroAuthHandler(prefix, authOptions);
+  return {
+    async GET(context: APIContext) {
+      return await handler(context);
+    },
+    async POST(context: APIContext) {
+      return await handler(context);
+    },
+  };
+}
+
+/**
+ * Fetches the current session, or `null` if there is none.
+ */
+export async function getSession(req: Request, options = authConfig): Promise<Session | null> {
+  options.secret ??= import.meta.env.AUTH_SECRET;
+  options.trustHost ??= true;
+
+  const url = new URL(`${options.prefix}/session`, req.url);
+  const response = await Auth(new Request(url, { headers: req.headers }), options);
+  const { status = 200 } = response;
+
+  const data = await response.json();
+
+  if (!data || !Object.keys(data).length) return null;
+  if (status === 200) return data;
+  throw new Error(data.message);
+}

package/package.json

@@ -7,7 +7,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
-  "version": "4.12.0-beta.9",
+  "version": "4.12.1",
   "publishConfig": {
     "access": "public"
   },
@@ -78,7 +78,6 @@
     "astro": "7.3.3",
     "astro-expressive-code": "^0.44.0",
     "astro-seo": "^0.8.4",
-    "auth-astro": "^4.2.0",
     "boxen": "^8.0.1",
     "commander": "^12.1.0",
     "cross-env": "^7.0.3",
@@ -124,6 +123,7 @@
     "remark-gfm": "^4.0.1",
     "rimraf": "^6.1.3",
     "semver": "7.6.3",
+    "set-cookie-parser": "^2.7.1",
     "shelljs": "^0.9.0",
     "sonner": "^2.0.7",
     "sql.js": "^1.12.0",
@@ -155,6 +155,7 @@
     "@types/react-dom": "^19.2.3",
     "@types/react-syntax-highlighter": "^15.5.13",
     "@types/semver": "^7.5.8",
+    "@types/set-cookie-parser": "^2.4.10",
     "@types/shelljs": "^0.8.15",
     "@types/update-notifier": "^6.0.8",
     "@types/uuid": "^10.0.0",

package/dist/runtime-dependencies/auth-astro.mjs

@@ -1,3 +0,0 @@
-export * from "auth-astro";
-import * as dependency from "auth-astro";
-export default dependency.default;

package/dist/runtime-dependencies/auth-astro__client.mjs

@@ -1,3 +0,0 @@
-export * from "auth-astro/client";
-import * as dependency from "auth-astro/client";
-export default dependency.default;

package/dist/runtime-dependencies/auth-astro__server.mjs

@@ -1,3 +0,0 @@
-export * from "auth-astro/server";
-import * as dependency from "auth-astro/server";
-export default dependency.default;

package/dist/{chunk-U4YJSTGV.js → chunk-WRLNLWPW.js}

@@ -1,3 +1,10 @@
+import {
+  getFederationDiagnostics,
+  resolveFederationRules
+} from "./chunk-JJPB6EOZ.js";
+import {
+  isFederationEnabled
+} from "./chunk-FV56YFM4.js";
 import {
   withFederationOutputTransaction
 } from "./chunk-WRNH5C3U.js";
@@ -10,13 +17,6 @@ import {
 import {
   createFederationContentCache
 } from "./chunk-R7Z5ALYI.js";
-import {
-  getFederationDiagnostics,
-  resolveFederationRules
-} from "./chunk-JJPB6EOZ.js";
-import {
-  isFederationEnabled
-} from "./chunk-FV56YFM4.js";
 import {
   getEventCatalogConfigFile
 } from "./chunk-RFIXKATC.js";