@finueva/auth 0.5.0 → 0.6.0

package/THIRD_PARTY_NOTICES.md

@@ -2,7 +2,7 @@
 
 `@finueva/auth` bundles browser/runtime code from the packages listed below.
 
-## @chiballc/utils 2.2.22
+## @chiballc/utils 2.5.0
 
 Source: https://github.com/ChibaLLC/utils
 

package/dist/device.js

@@ -1,45 +1,3 @@
-//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
-const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
-const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
-const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
-function jsonParseTransform(key, value) {
-	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
-		warnKeyDropped(key);
-		return;
-	}
-	return value;
-}
-function warnKeyDropped(key) {
-	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
-}
-function destr(value, options = {}) {
-	if (typeof value !== "string") return value;
-	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
-	const _value = value.trim();
-	if (_value.length <= 9) switch (_value.toLowerCase()) {
-		case "true": return true;
-		case "false": return false;
-		case "undefined": return;
-		case "null": return null;
-		case "nan": return NaN;
-		case "infinity": return Number.POSITIVE_INFINITY;
-		case "-infinity": return Number.NEGATIVE_INFINITY;
-	}
-	if (!JsonSigRx.test(value)) {
-		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
-		return value;
-	}
-	try {
-		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
-			if (options.strict) throw new Error("[destr] Possible prototype pollution");
-			return JSON.parse(value, jsonParseTransform);
-		}
-		return JSON.parse(value);
-	} catch (error) {
-		if (options.strict) throw error;
-		return value;
-	}
-}
 String.fromCharCode;
 const HASH_RE = /#/g;
 const AMPERSAND_RE = /&/g;
@@ -215,6 +173,49 @@ function stringifyParsedURL(parsed) {
 	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
 }
 //#endregion
+//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
+const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
+const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+function jsonParseTransform(key, value) {
+	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+		warnKeyDropped(key);
+		return;
+	}
+	return value;
+}
+function warnKeyDropped(key) {
+	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
+}
+function destr(value, options = {}) {
+	if (typeof value !== "string") return value;
+	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
+	const _value = value.trim();
+	if (_value.length <= 9) switch (_value.toLowerCase()) {
+		case "true": return true;
+		case "false": return false;
+		case "undefined": return;
+		case "null": return null;
+		case "nan": return NaN;
+		case "infinity": return Number.POSITIVE_INFINITY;
+		case "-infinity": return Number.NEGATIVE_INFINITY;
+	}
+	if (!JsonSigRx.test(value)) {
+		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
+		return value;
+	}
+	try {
+		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
+			if (options.strict) throw new Error("[destr] Possible prototype pollution");
+			return JSON.parse(value, jsonParseTransform);
+		}
+		return JSON.parse(value);
+	} catch (error) {
+		if (options.strict) throw error;
+		return value;
+	}
+}
+//#endregion
 //#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
 var FetchError = class extends Error {
 	constructor(message, opts) {
@@ -705,7 +706,7 @@ function createDeviceAuth(options) {
 	async function requestAuthorization(requestOptions = {}) {
 		if (requestOptions.signal?.aborted) throw cancelled();
 		try {
-			return normalizeAuthorization((await requestJsonResponse(`${authOrigin}/api/v1/auth/device/code`, {
+			return normalizeAuthorization((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/device/code"), {
 				fetch: requestFetch,
 				timeoutMs,
 				method: "POST",
@@ -734,7 +735,7 @@ function createDeviceAuth(options) {
 			if (requestBudget <= 0) throw expired();
 			let response;
 			try {
-				response = await requestJsonResponse(`${authOrigin}/api/v1/auth/device/token`, {
+				response = await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/device/token"), {
 					fetch: requestFetch,
 					timeoutMs: Math.min(timeoutMs, requestBudget),
 					method: "POST",
@@ -782,7 +783,7 @@ function createDeviceAuth(options) {
 		const current = await getToken();
 		if (!current) return null;
 		try {
-			return await requestJsonResponse(`${authOrigin}/api/v1/auth/${path}`, {
+			return await requestJsonResponse(joinURL(authOrigin, "api/v1/auth", path), {
 				fetch: requestFetch,
 				timeoutMs,
 				method: body ? "POST" : "GET",
@@ -797,7 +798,7 @@ function createDeviceAuth(options) {
 		const current = await getToken();
 		if (!current) return;
 		try {
-			await requestJsonResponse(`${authOrigin}/api/v1/auth/${path}`, {
+			await requestJsonResponse(joinURL(authOrigin, "api/v1/auth", path), {
 				fetch: requestFetch,
 				timeoutMs,
 				method: "POST",

package/dist/index.js

@@ -1635,7 +1635,7 @@ function createAuthClient$1(options) {
 	}, $fetch, pluginPathMethods, pluginsAtoms, atomListeners);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@chiballc+utils@2.2.22_magic-string@0.30.21_magicast@0.5.3_rolldown@1.2.0_vite@7.3.6_@t_7ea103523467af2ecb75df55c94dbb80/node_modules/@chiballc/utils/dist/index.mjs
+//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.0_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_deb761a9672ce7cf69932b564bd2142d/node_modules/@chiballc/utils/dist/index.mjs
 function isPromise(arg) {
 	return arg && typeof arg.then === "function";
 }
@@ -2169,6 +2169,7 @@ function createFetch(globalOptions = {}) {
 }
 //#endregion
 //#region src/shared.ts
+const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
 function normalizeOrigin(value, name) {
@@ -2207,7 +2208,7 @@ function normalizeSession(value) {
 	};
 }
 function normalizeDriveCredential(value, now) {
-	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== 900 || typeof value.token !== "string" || value.token.length === 0 || value.token.length + 7 > 16 * 1024) throw authorityUnavailable();
+	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || value.token.length + 7 > 16 * 1024) throw authorityUnavailable();
 	return {
 		tokenType: "Bearer",
 		token: value.token,

package/dist/server.js

@@ -466,6 +466,7 @@ var AuthError = class extends Error {
 };
 //#endregion
 //#region src/shared.ts
+const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
 function normalizeOrigin(value, name) {
@@ -504,7 +505,7 @@ function normalizeSession(value) {
 	};
 }
 function normalizeDriveCredential(value, now) {
-	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== 900 || typeof value.token !== "string" || value.token.length === 0 || value.token.length + 7 > 16 * 1024) throw authorityUnavailable();
+	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || value.token.length + 7 > 16 * 1024) throw authorityUnavailable();
 	return {
 		tokenType: "Bearer",
 		token: value.token,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,
@@ -48,7 +48,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@chiballc/utils": "2.2.22",
+    "@chiballc/utils": "2.5.0",
     "@types/node": "24.13.3",
     "@typescript/native": "npm:typescript@7.0.2",
     "@vitest/coverage-v8": "4.1.10",