@finueva/auth 0.5.0 → 0.7.0

package/dist/server.js

@@ -173,6 +173,39 @@ function stringifyParsedURL(parsed) {
 	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
 }
 //#endregion
+//#region src/errors.ts
+const messages = {
+	invalid_credentials: "The credentials are invalid.",
+	invalid_auth_input: "The authentication input is invalid.",
+	account_conflict: "The account is not available.",
+	password_reset_invalid: "The password reset request is invalid.",
+	authentication_required: "Authentication is required.",
+	request_origin_denied: "The request origin is not allowed.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	email_verification_required: "Email verification is required.",
+	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
+	credential_rate_limited: "Credential requests are temporarily limited.",
+	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	state_conflict: "The authentication state conflicts with the request.",
+	access_denied: "Access is denied.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	constructor(code, status, retryAfterSeconds) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+//#endregion
 //#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
 const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
 const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
@@ -436,38 +469,32 @@ function createFetch(globalOptions = {}) {
 	return $fetch;
 }
 //#endregion
-//#region src/errors.ts
-const messages = {
-	invalid_credentials: "The credentials are invalid.",
-	authentication_required: "Authentication is required.",
-	request_origin_denied: "The request origin is not allowed.",
-	invalid_invitation: "The invitation is invalid.",
-	invitation_unavailable: "The invitation is not available.",
-	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
-	email_verification_required: "Email verification is required.",
-	invalid_workspace_selection: "The workspace selection is invalid.",
-	organization_context_too_large: "The organization context is too large.",
-	credential_rate_limited: "Credential requests are temporarily limited.",
-	state_conflict: "The authentication state conflicts with the request.",
-	access_denied: "Access is denied.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable."
-};
-var AuthError = class extends Error {
-	code;
-	status;
-	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
-		super(messages[code]);
-		this.name = "AuthError";
-		this.code = code;
-		this.status = status;
-		this.retryAfterSeconds = retryAfterSeconds;
-	}
-};
-//#endregion
 //#region src/shared.ts
+const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
+const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+function normalizeSocialIdTokenInput(value) {
+	if (!isObject(value)) throw new TypeError("social ID token input is invalid");
+	const keys = Object.keys(value);
+	if (keys.length !== 3 && keys.length !== 4 || keys.some((key) => key !== "provider" && key !== "idToken" && key !== "nonce" && key !== "signUp") || value.provider !== "google" && value.provider !== "apple" || typeof value.signUp !== "boolean" || typeof value.idToken !== "string" || value.idToken.length < 1 || new TextEncoder().encode(value.idToken).byteLength > MAX_SOCIAL_ID_TOKEN_BYTES || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.idToken) || value.nonce !== void 0 && (typeof value.nonce !== "string" || value.nonce.length < 1 || value.nonce.length > 256 || !/^[\x20-\x7e]+$/.test(value.nonce))) throw new TypeError("social ID token input is invalid");
+	return {
+		provider: value.provider,
+		idToken: value.idToken,
+		...value.nonce === void 0 ? {} : { nonce: value.nonce },
+		signUp: value.signUp
+	};
+}
+function socialIdTokenRequest(value) {
+	return {
+		provider: value.provider,
+		idToken: {
+			token: value.idToken,
+			...value.nonce === void 0 ? {} : { nonce: value.nonce }
+		},
+		requestSignUp: value.signUp
+	};
+}
 function normalizeOrigin(value, name) {
 	if (value.length === 0 || value.length > 2048 || /[^\x20-\x7e]/.test(value)) throw new TypeError(`${name} must be an ASCII HTTP origin`);
 	let url;
@@ -504,7 +531,7 @@ function normalizeSession(value) {
 	};
 }
 function normalizeDriveCredential(value, now) {
-	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== 900 || typeof value.token !== "string" || value.token.length === 0 || value.token.length + 7 > 16 * 1024) throw authorityUnavailable();
+	if (!isObject(value) || value.tokenType !== "Bearer" || value.expiresIn !== DRIVE_CREDENTIAL_LIFETIME_SECONDS || typeof value.token !== "string" || value.token.length === 0 || new TextEncoder().encode(`Bearer ${value.token}`).byteLength > 16 * 1024) throw authorityUnavailable();
 	return {
 		tokenType: "Bearer",
 		token: value.token,
@@ -546,6 +573,26 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 	const mapped = mapError(isObject(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
 	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
 }
+function fromAccountAuthorityError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
+	if (code === "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") return new AuthError("account_conflict", 409);
+	if (code === "INVALID_TOKEN") return new AuthError("password_reset_invalid", 422);
+	if (code === "INVALID_PASSWORD" || code === "INVALID_EMAIL_OR_PASSWORD") return new AuthError("invalid_credentials", 401);
+	if (code === "INVALID_EMAIL" || code === "PASSWORD_TOO_SHORT" || code === "PASSWORD_TOO_LONG" || code === "BODY_MUST_BE_AN_OBJECT" || code === "EMAIL_CAN_NOT_BE_UPDATED") return new AuthError("invalid_auth_input", 422);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	if (status === 400 || status === 422) return new AuthError("invalid_auth_input", 422);
+	return authorityUnavailable();
+}
+function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
+	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
 function authorityUnavailable() {
 	return new AuthError("identity_authority_unavailable", 503);
 }
@@ -644,7 +691,7 @@ async function requestJsonResponse(url, options) {
 			method: options.method,
 			headers: options.headers,
 			body: options.body,
-			credentials: "include",
+			credentials: options.credentials ?? "include",
 			retry: 0,
 			timeout: options.timeoutMs,
 			redirect: "manual",
@@ -704,6 +751,7 @@ async function readJson(response) {
 }
 //#endregion
 //#region src/server.ts
+const MAX_AUTHORIZATION_BYTES = 16 * 1024;
 function createServerAuth(options) {
 	const authOrigin = normalizeOrigin(options.authOrigin, "authOrigin");
 	const appOrigin = normalizeOrigin(options.appOrigin, "appOrigin");
@@ -711,10 +759,12 @@ function createServerAuth(options) {
 	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
 	const now = options.now ?? Date.now;
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	const authorization = authAuthorizationHeader(options.request.headers.get("authorization"));
 	const cookie = authCookieHeader(options.request.headers.get("cookie"));
-	const authHeaders = () => ({
-		cookie,
-		origin: appOrigin
+	const credentials = authorization ? "omit" : "include";
+	const authHeaders = (includeOrigin = true) => ({
+		...authorization ? { authorization } : { cookie },
+		...includeOrigin ? { origin: appOrigin } : {}
 	});
 	return {
 		async acceptInvitation(input) {
@@ -724,6 +774,7 @@ function createServerAuth(options) {
 					fetch: fetchImpl,
 					timeoutMs,
 					method: "POST",
+					credentials,
 					headers: {
 						...authHeaders(),
 						"content-type": "application/json; charset=utf-8"
@@ -748,7 +799,8 @@ function createServerAuth(options) {
 				fetch: fetchImpl,
 				timeoutMs,
 				method: "GET",
-				headers: { cookie }
+				credentials,
+				headers: authHeaders(false)
 			}));
 		},
 		async listOrganizations() {
@@ -757,18 +809,52 @@ function createServerAuth(options) {
 					fetch: fetchImpl,
 					timeoutMs,
 					method: "GET",
+					credentials,
 					headers: authHeaders()
 				}));
 			} catch (error) {
 				throw fromOrganizationListError(error);
 			}
 		},
+		async signInWithSocialIdToken(input) {
+			if (authorization) throw new AuthError("state_conflict", 409);
+			const body = socialIdTokenRequest(normalizeSocialIdTokenInput(input));
+			const cookies = responseCookies((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/sign-in/social"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json; charset=utf-8"
+				},
+				body,
+				mapError: fromSocialIdTokenAuthorityError
+			})).headers);
+			const cookieHeader = authCookieHeader(cookies.map((value) => value.split(";", 1)[0]).join("; "));
+			if (!cookieHeader) throw authorityUnavailable();
+			const session = normalizeSession(await requestJson(joinURL(authOrigin, "api/v1/auth/get-session"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "GET",
+				credentials: "include",
+				headers: { cookie: cookieHeader }
+			}));
+			if (!session) throw new AuthError("authentication_required", 401);
+			return {
+				...session,
+				applyCookies(headers) {
+					applyCookies(cookies, headers);
+				}
+			};
+		},
 		async getDriveCredential(input) {
 			const workspace = normalizeWorkspaceSelection(input?.workspace);
 			return normalizeDriveCredential(await requestJson(joinURL(authOrigin, "api/v1/auth/drive-credential"), {
 				fetch: fetchImpl,
 				timeoutMs,
 				method: "POST",
+				credentials,
 				headers: {
 					...authHeaders(),
 					"content-type": "application/json; charset=utf-8"
@@ -781,6 +867,7 @@ function createServerAuth(options) {
 			try {
 				response = await fetchImpl(joinURL(authOrigin, "api/v1/auth/sign-out"), {
 					method: "POST",
+					credentials,
 					headers: authHeaders(),
 					redirect: "manual",
 					signal: AbortSignal.timeout(timeoutMs)
@@ -816,5 +903,10 @@ function authCookieHeader(value) {
 		return name.startsWith("better-auth.") || name.startsWith("__Secure-better-auth.");
 	}).join("; ");
 }
+function authAuthorizationHeader(value) {
+	if (value === null) return void 0;
+	if (new TextEncoder().encode(value).byteLength > MAX_AUTHORIZATION_BYTES || /[^\x20-\x7e]/.test(value) || !/^Bearer [^\s,]+$/i.test(value)) throw new AuthError("authentication_required", 401);
+	return value;
+}
 //#endregion
 export { AuthError, createServerAuth };

package/dist/{types-HSdjQWMZ.d.ts → types-B1SZbs6Z.d.ts}

@@ -1,3 +1,13 @@
+//#region src/errors.d.ts
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "identity_authority_unavailable";
+type AuthErrorStatus = 401 | 403 | 409 | 422 | 429 | 503;
+declare class AuthError extends Error {
+  readonly code: AuthErrorCode;
+  readonly status: AuthErrorStatus;
+  readonly retryAfterSeconds?: number;
+  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number);
+}
+//#endregion
 //#region src/types.d.ts
 interface AuthUser {
   id: string;
@@ -64,6 +74,17 @@ interface SignInInput {
   email: string;
   password: string;
 }
+type SocialIdTokenProvider = "google" | "apple";
+interface SocialIdTokenInput {
+  provider: SocialIdTokenProvider;
+  idToken: string;
+  nonce?: string;
+  signUp: boolean;
+}
+interface UpdateProfileInput {
+  name?: string;
+  image?: string | null;
+}
 interface SendVerificationEmailInput {
   email: string;
   callbackURL?: string;
@@ -85,11 +106,17 @@ interface FinuevaAuthClient {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(): Promise<AuthOrganization[]>;
   sendVerificationEmail(input: SendVerificationEmailInput): Promise<void>;
+  signUp(email: string, password: string, name: string): Promise<AuthSession>;
   signIn(input: SignInInput): Promise<AuthSession>;
+  signInWithSocialIdToken(input: SocialIdTokenInput): Promise<AuthSession>;
+  updateProfile(input: UpdateProfileInput): Promise<AuthSession>;
+  changePassword(currentPassword: string, newPassword: string, revokeOtherSessions?: boolean): Promise<AuthSession>;
+  requestPasswordReset(email: string, redirectTo: string): Promise<void>;
+  resetPassword(token: string, newPassword: string): Promise<void>;
   signOut(): Promise<void>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
   onAuthStateChange(listener: (state: AuthState) => void): () => void;
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { WorkspaceSelection as _, AuthPersistenceDriver as a, AuthUser as c, FinuevaAuthClient as d, InvitationAcceptance as f, SignInInput as g, SendVerificationEmailInput as h, AuthPersistence as i, DriveCredential as l, PersonalWorkspaceSelection as m, AuthClientOptions as n, AuthSession as o, OrganizationWorkspaceSelection as p, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, DriveCredentialInput as u };
+export { AuthErrorStatus as C, AuthErrorCode as S, SocialIdTokenInput as _, AuthPersistenceDriver as a, WorkspaceSelection as b, AuthUser as c, FinuevaAuthClient as d, InvitationAcceptance as f, SignInInput as g, SendVerificationEmailInput as h, AuthPersistence as i, DriveCredential as l, PersonalWorkspaceSelection as m, AuthClientOptions as n, AuthSession as o, OrganizationWorkspaceSelection as p, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, DriveCredentialInput as u, SocialIdTokenProvider as v, AuthError as x, UpdateProfileInput as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,
@@ -41,6 +41,7 @@
     "build": "rolldown -c",
     "coverage": "vitest run --coverage",
     "lint": "oxlint . --deny-warnings",
+    "prepack": "pnpm build",
     "test": "pnpm test:unit && pnpm build && pnpm test:package",
     "test:composition": "node scripts/test-composition.mjs",
     "test:package": "node scripts/test-package.mjs",
@@ -48,7 +49,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@chiballc/utils": "2.2.22",
+    "@chiballc/utils": "2.5.0",
     "@types/node": "24.13.3",
     "@typescript/native": "npm:typescript@7.0.2",
     "@vitest/coverage-v8": "4.1.10",

package/dist/errors-Crd93Rah.d.ts

@@ -1,11 +0,0 @@
-//#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "authentication_required" | "request_origin_denied" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "state_conflict" | "access_denied" | "identity_authority_unavailable";
-type AuthErrorStatus = 401 | 403 | 409 | 422 | 429 | 503;
-declare class AuthError extends Error {
-  readonly code: AuthErrorCode;
-  readonly status: AuthErrorStatus;
-  readonly retryAfterSeconds?: number;
-  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number);
-}
-//#endregion
-export { AuthErrorCode as n, AuthErrorStatus as r, AuthError as t };