@fluixi/oauth2 1.0.0-alpha.1

package/dist/env-config.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Auth configuration from environment variables, with names the framework agrees on.
+ *
+ * Two surfaces with opposite rules, and mixing them is how a secret ships:
+ *
+ *  - the **client** half is public by nature. An issuer, a client id, where the tokens live, a redirect URI:
+ *    all of it reaches the browser whatever you do, because a public client sends them to the
+ *    provider in a URL. Prefixed `VITE_`, which is what makes Vite inline them.
+ *  - the **server** half is a client secret, a signing key, a cookie secret. Never prefixed.
+ *    `credentialsFromEnv` reads those, and `@fluixi/start`'s env guard fails a build that
+ *    names one `VITE_`.
+ *
+ * This module is the client half. It takes the record rather than reading `import.meta.env`
+ * itself, and that is deliberate. Vite replaces `import.meta.env` where it processes the
+ * source, so writing it in app code is reliable in a way that a published package reading it
+ * is not. The cost is one word at the call site:
+ *
+ * ```ts
+ * export const auth = authFromEnv(import.meta.env);
+ * ```
+ *
+ * The same function then works against `process.env`, a worker binding, Deno, or a fixture in
+ * a test, none of which involve a bundler at all.
+ */
+import { type PresetName, type ProviderPreset } from './presets.js';
+import type { TokenClaims } from './verify.js';
+export interface AuthEnvOptions {
+    /**
+     * Prefix for the variable names, after the client prefix. Default `AUTH`.
+     *
+     * `VITE_AUTH_ISSUER`, `VITE_AUTH_CLIENT_ID`, and so on. Pass a provider name for an app
+     * offering several: `prefix: 'OKTA'` reads `VITE_OKTA_ISSUER`, falling back to
+     * `VITE_AUTH_ISSUER` for anything it does not set.
+     */
+    prefix?: string;
+    /**
+     * The client prefix. Default `VITE_`, which is Vite's.
+     *
+     * Pass `''` when reading `process.env` on a server, where nothing is prefixed.
+     */
+    clientPrefix?: string;
+    /** Overrides `<PREFIX>_PROVIDER`, for an app that knows which provider it is. */
+    provider?: PresetName;
+    /** Overrides `<PREFIX>_TOKENS`. */
+    tokens?: 'browser' | 'server';
+    /** Where this provider puts roles, when the preset's default is not right. */
+    roles?: (claims: TokenClaims) => string[];
+}
+/** What the environment said, assembled. */
+export interface AuthEnv {
+    /** The preset, built from whichever variables were present. */
+    provider: ProviderPreset;
+    /** Which preset was chosen, for a message or a log. */
+    providerName: PresetName;
+    clientId: string;
+    /** Where the tokens live. `browser` unless told otherwise. */
+    tokens: 'browser' | 'server';
+    /** The redirect URI, or undefined when the app builds it from its own base URL. */
+    redirectUri?: string;
+    /** Scopes, when the environment overrode the preset's. */
+    scopes?: string[];
+    /** Everything needed by `createBrowserClient`, ready to spread. */
+    client: ProviderPreset['client'] & {
+        clientId: string;
+        tokens: 'browser' | 'server';
+        redirectUri?: string;
+    };
+}
+/**
+ * Read auth configuration from an environment record.
+ *
+ * Variables, with `VITE_AUTH` as the default prefix. Everything is optional except an issuer
+ * (or the provider-specific field that builds one) and a client id.
+ *
+ * | variable | meaning |
+ * | --- | --- |
+ * | `_PROVIDER` | `oidc` (default), `keycloak`, `auth0`, `okta`, `google`, `dex`, `oauth2` |
+ * | `_ISSUER` | the issuer, for `oidc` and `oauth2` |
+ * | `_CLIENT_ID` | this client |
+ * | `_TOKENS` | `browser` (default) or `server` |
+ * | `_REDIRECT_URI` | where the provider sends the browser back |
+ * | `_SCOPES` | space or comma separated, overriding the preset's |
+ * | `_AUDIENCE` | an API identifier. Auth0 needs it for a JWT access token |
+ * | `_DPOP` | `true` or `false`, overriding the preset |
+ * | `_DOMAIN` | the tenant, for `auth0` and `okta` |
+ * | `_BASE_URL` | for `keycloak` and `dex` |
+ * | `_REALM` | for `keycloak` |
+ * | `_AUTH_SERVER` | for `okta`, default `default`, `org` for the org server |
+ * | `_ROLES_CLAIM` | the namespaced claim an Auth0 action adds |
+ *
+ * @example
+ * ```ts
+ * // src/config/auth.ts
+ * import { authFromEnv } from '@fluixi/oauth2/env';
+ * export const auth = authFromEnv(import.meta.env);
+ *
+ * // src/services/auth/auth.ts
+ * const client = createBrowserClient({ ...auth.client, redirectUri: `${env.appUrl}/callback` });
+ * const verify = createTokenVerifier(auth.provider.verifier(auth.clientId));
+ * ```
+ */
+export declare function authFromEnv(source: Record<string, string | undefined>, options?: AuthEnvOptions): AuthEnv;
+//# sourceMappingURL=env-config.d.ts.map

package/dist/env-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-config.d.ts","sourceRoot":"","sources":["../src/env-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAW,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK/C,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,mCAAmC;IACnC,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,8EAA8E;IAC9E,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,MAAM,EAAE,CAAC;CAC3C;AAED,4CAA4C;AAC5C,MAAM,WAAW,OAAO;IACtB,+DAA+D;IAC/D,QAAQ,EAAE,cAAc,CAAC;IACzB,uDAAuD;IACvD,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mEAAmE;IACnE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;QAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC1C,OAAO,GAAE,cAAmB,GAC3B,OAAO,CA4IT"}

package/dist/env-config.js

@@ -0,0 +1,184 @@
+/**
+ * Auth configuration from environment variables, with names the framework agrees on.
+ *
+ * Two surfaces with opposite rules, and mixing them is how a secret ships:
+ *
+ *  - the **client** half is public by nature. An issuer, a client id, where the tokens live, a redirect URI:
+ *    all of it reaches the browser whatever you do, because a public client sends them to the
+ *    provider in a URL. Prefixed `VITE_`, which is what makes Vite inline them.
+ *  - the **server** half is a client secret, a signing key, a cookie secret. Never prefixed.
+ *    `credentialsFromEnv` reads those, and `@fluixi/start`'s env guard fails a build that
+ *    names one `VITE_`.
+ *
+ * This module is the client half. It takes the record rather than reading `import.meta.env`
+ * itself, and that is deliberate. Vite replaces `import.meta.env` where it processes the
+ * source, so writing it in app code is reliable in a way that a published package reading it
+ * is not. The cost is one word at the call site:
+ *
+ * ```ts
+ * export const auth = authFromEnv(import.meta.env);
+ * ```
+ *
+ * The same function then works against `process.env`, a worker binding, Deno, or a fixture in
+ * a test, none of which involve a bundler at all.
+ */
+import { presets } from './presets.js';
+/** Names that mean a secret, which must never arrive through a client-prefixed variable. */
+const SECRETISH = /(SECRET|PASSWORD|PRIVATE_KEY|CREDENTIALS?)($|_)/;
+/** Splits a scope list written with spaces or commas. */
+const scopeList = (value) => value ? value.split(/[\s,]+/).filter(Boolean) : undefined;
+/** `true`, `1` and `on` all mean yes. Anything else present means no. */
+const flag = (value) => value === undefined ? undefined : /^(true|1|on|yes)$/i.test(value.trim());
+/**
+ * Read auth configuration from an environment record.
+ *
+ * Variables, with `VITE_AUTH` as the default prefix. Everything is optional except an issuer
+ * (or the provider-specific field that builds one) and a client id.
+ *
+ * | variable | meaning |
+ * | --- | --- |
+ * | `_PROVIDER` | `oidc` (default), `keycloak`, `auth0`, `okta`, `google`, `dex`, `oauth2` |
+ * | `_ISSUER` | the issuer, for `oidc` and `oauth2` |
+ * | `_CLIENT_ID` | this client |
+ * | `_TOKENS` | `browser` (default) or `server` |
+ * | `_REDIRECT_URI` | where the provider sends the browser back |
+ * | `_SCOPES` | space or comma separated, overriding the preset's |
+ * | `_AUDIENCE` | an API identifier. Auth0 needs it for a JWT access token |
+ * | `_DPOP` | `true` or `false`, overriding the preset |
+ * | `_DOMAIN` | the tenant, for `auth0` and `okta` |
+ * | `_BASE_URL` | for `keycloak` and `dex` |
+ * | `_REALM` | for `keycloak` |
+ * | `_AUTH_SERVER` | for `okta`, default `default`, `org` for the org server |
+ * | `_ROLES_CLAIM` | the namespaced claim an Auth0 action adds |
+ *
+ * @example
+ * ```ts
+ * // src/config/auth.ts
+ * import { authFromEnv } from '@fluixi/oauth2/env';
+ * export const auth = authFromEnv(import.meta.env);
+ *
+ * // src/services/auth/auth.ts
+ * const client = createBrowserClient({ ...auth.client, redirectUri: `${env.appUrl}/callback` });
+ * const verify = createTokenVerifier(auth.provider.verifier(auth.clientId));
+ * ```
+ */
+export function authFromEnv(source, options = {}) {
+    const clientPrefix = options.clientPrefix ?? 'VITE_';
+    const specific = `${clientPrefix}${(options.prefix ?? 'AUTH').toUpperCase()}`;
+    const general = `${clientPrefix}AUTH`;
+    /** The specific prefix wins, so one app can carry several providers. */
+    const read = (suffix) => {
+        const found = source[`${specific}_${suffix}`] ?? source[`${general}_${suffix}`];
+        return found === undefined || found === '' ? undefined : found;
+    };
+    // A secret arriving through a client-prefixed variable is published, whether anything reads
+    // it or not. `@fluixi/start`'s guard fails the build; this catches the case where the build
+    // guard is not in play, and says the same thing.
+    if (clientPrefix) {
+        const exposed = Object.keys(source).filter((name) => name.startsWith(clientPrefix) && SECRETISH.test(name.slice(clientPrefix.length)));
+        if (exposed.length) {
+            throw new Error(`[fluixi/oauth2] ${exposed.join(', ')} ${exposed.length > 1 ? 'are' : 'is'} prefixed \`${clientPrefix}\`, which inlines the value into the browser bundle. ` +
+                'Drop the prefix and read it on the server: `credentialsFromEnv` looks for the unprefixed name.');
+        }
+    }
+    const name = (options.provider ?? read('PROVIDER') ?? 'oidc');
+    if (!(name in presets)) {
+        throw new Error(`[fluixi/oauth2] ${specific}_PROVIDER is "${name}", which is not a preset. ` +
+            `Use one of ${Object.keys(presets).join(', ')}, or \`oidc\` with an issuer for anything else.`);
+    }
+    const clientId = read('CLIENT_ID');
+    if (!clientId) {
+        throw new Error(`[fluixi/oauth2] no client id. Set ${specific}_CLIENT_ID (or ${general}_CLIENT_ID).`);
+    }
+    const scopes = scopeList(read('SCOPES'));
+    const audience = read('AUDIENCE');
+    const rolesClaim = read('ROLES_CLAIM');
+    /** Names the variable a preset needs, so a missing one says which to set. */
+    const require = (suffix) => {
+        const found = read(suffix);
+        if (!found) {
+            throw new Error(`[fluixi/oauth2] the ${name} preset needs ${specific}_${suffix}, which is not set.`);
+        }
+        return found;
+    };
+    let provider;
+    switch (name) {
+        case 'keycloak':
+            provider = presets.keycloak({
+                baseUrl: require('BASE_URL'),
+                realm: require('REALM'),
+                scopes,
+            });
+            break;
+        case 'auth0':
+            provider = presets.auth0({
+                domain: require('DOMAIN'),
+                audience,
+                scopes,
+                rolesClaim,
+            });
+            break;
+        case 'okta': {
+            const server = read('AUTH_SERVER');
+            provider = presets.okta({
+                domain: require('DOMAIN'),
+                // `org` names the org server, which the preset takes as null.
+                authorizationServer: server === 'org' ? null : server,
+                scopes,
+                dpop: flag(read('DPOP')),
+            });
+            break;
+        }
+        case 'google':
+            provider = presets.google({ scopes, hostedDomain: read('HOSTED_DOMAIN') });
+            break;
+        case 'dex':
+            provider = presets.dex({ baseUrl: require('BASE_URL'), scopes });
+            break;
+        case 'oauth2':
+            provider = presets.oauth2({
+                issuer: require('ISSUER'),
+                endpoints: {
+                    authorization: require('AUTHORIZATION_ENDPOINT'),
+                    token: require('TOKEN_ENDPOINT'),
+                    userinfo: read('USERINFO_ENDPOINT'),
+                    revocation: read('REVOCATION_ENDPOINT'),
+                    introspection: read('INTROSPECTION_ENDPOINT'),
+                },
+                scopes,
+                audience: audience ?? (flag(read('NO_AUDIENCE')) ? false : undefined),
+                roles: options.roles,
+            });
+            break;
+        default:
+            provider = presets.oidc({
+                issuer: require('ISSUER'),
+                scopes,
+                // A provider putting no `aud` on an access token. Keycloak without a mapper is the
+                // common case, and the preset moves the check to `azp` rather than dropping it.
+                audience: audience ?? (flag(read('NO_AUDIENCE')) ? false : undefined),
+                roles: options.roles,
+            });
+    }
+    // An explicit override beats the preset, which is how an app turns DPoP off for a provider
+    // that has it on by default.
+    const dpop = flag(read('DPOP'));
+    if (dpop !== undefined)
+        provider = { ...provider, client: { ...provider.client, dpop } };
+    if (options.roles)
+        provider = { ...provider, roles: options.roles };
+    const tokens = options.tokens ?? (read('TOKENS') ?? 'browser');
+    if (tokens !== 'browser' && tokens !== 'server') {
+        throw new Error(`[fluixi/oauth2] ${specific}_TOKENS is "${tokens}". It is \`browser\` or \`server\`.`);
+    }
+    const redirectUri = read('REDIRECT_URI');
+    return {
+        provider,
+        providerName: name,
+        clientId,
+        tokens,
+        redirectUri,
+        scopes,
+        client: { ...provider.client, clientId, tokens, ...(redirectUri ? { redirectUri } : {}) },
+    };
+}

package/dist/env-config.mjs

@@ -0,0 +1,343 @@
+// src/roles.ts
+var rolesFrom = {
+  /** Keycloak, realm roles. Where it puts them unless a client mapper is configured. */
+  keycloakRealm: (claims) => {
+    const realm = claims.realm_access;
+    return realm?.roles ?? [];
+  },
+  /** Keycloak, roles scoped to one client rather than the realm. */
+  keycloakClient: (clientId) => (claims) => {
+    const all = claims.resource_access;
+    return all?.[clientId]?.roles ?? [];
+  },
+  /** Okta, and anything else using a groups claim. Needs a groups claim on the token. */
+  groups: (claims) => Array.isArray(claims.groups) ? claims.groups : [],
+  /** Cognito, which namespaces the claim. */
+  cognito: (claims) => {
+    const groups = claims["cognito:groups"];
+    return Array.isArray(groups) ? groups : [];
+  },
+  /**
+   * Auth0, which requires a namespaced custom claim added by an action.
+   *
+   * `rolesFrom.namespaced('https://adafri.com/roles')`. Auth0 silently drops a custom claim
+   * that is not a URI, so an empty list here usually means the namespace, not the action.
+   */
+  namespaced: (claim) => (claims) => {
+    const value = claims[claim];
+    return Array.isArray(value) ? value : [];
+  },
+  /** The `scope` claim read as a role list, for a provider issuing no roles at all. */
+  scope: (claims) => typeof claims.scope === "string" ? claims.scope.split(" ") : []
+};
+
+// src/presets.ts
+var trim = (url) => url.replace(/\/+$/, "");
+var presets = {
+  /**
+   * Any OIDC provider publishing a discovery document.
+   *
+   * The agnostic path, and the one to reach for first. A provider not listed below almost
+   * certainly works through this.
+   */
+  oidc(options) {
+    return {
+      label: options.issuer,
+      client: { issuer: trim(options.issuer), scopes: options.scopes },
+      roles: options.roles ?? rolesFrom.scope,
+      verifier: (clientId) => ({
+        issuer: trim(options.issuer),
+        audience: options.audience ?? clientId,
+        ...options.audience === false ? { authorizedParty: clientId } : {}
+      }),
+      constraints: []
+    };
+  },
+  /**
+   * A plain OAuth2 server with no discovery document.
+   *
+   * Every endpoint is given, because there is nothing to ask. Token verification needs an
+   * issuer regardless, since a verifier will not accept a token without one.
+   */
+  oauth2(options) {
+    return {
+      label: options.issuer,
+      client: { endpoints: options.endpoints, scopes: options.scopes },
+      roles: options.roles ?? rolesFrom.scope,
+      verifier: (clientId) => ({
+        issuer: trim(options.issuer),
+        audience: options.audience ?? clientId,
+        ...options.audience === false ? { authorizedParty: clientId } : {}
+      }),
+      constraints: ["Publishes no discovery document, so every endpoint is configured by hand."]
+    };
+  },
+  /** Keycloak. A realm is its own issuer. */
+  keycloak(options) {
+    const issuer = `${trim(options.baseUrl)}/realms/${options.realm}`;
+    return {
+      label: "Keycloak",
+      client: {
+        issuer,
+        scopes: options.scopes ?? ["openid", "profile", "email"]
+      },
+      roles: rolesFrom.keycloakRealm,
+      // No `aud` on an access token until an audience mapper is configured, and the client is
+      // named in `azp` instead. So the check moves to `authorizedParty` rather than being
+      // dropped: `audience: false` alone would accept a token minted for any client of the
+      // realm, which is the check being skipped.
+      verifier: (clientId) => ({ issuer, audience: false, authorizedParty: clientId }),
+      constraints: [
+        "Puts no `aud` on an access token until a dedicated audience mapper is configured. Configure one and switch the verifier to `audience: clientId`.",
+        "Revokes the whole session when an authorization code is replayed, so a replay test has to run last."
+      ]
+    };
+  },
+  /**
+   * Auth0.
+   *
+   * `audience` is the field that decides what kind of token comes back. Without it Auth0
+   * issues an opaque token for its own userinfo endpoint and the JWT checks have nothing to
+   * work with.
+   */
+  auth0(options) {
+    const issuer = `https://${options.domain.replace(/^https?:\/\//, "").replace(/\/+$/, "")}/`;
+    return {
+      label: "Auth0",
+      client: {
+        issuer,
+        scopes: options.scopes ?? ["openid", "profile", "email", "offline_access"],
+        ...options.audience ? { extraParams: { audience: options.audience } } : {}
+      },
+      roles: options.rolesClaim ? rolesFrom.namespaced(options.rolesClaim) : rolesFrom.scope,
+      verifier: (clientId) => ({
+        issuer,
+        // The API identifier is the audience of an access token. Without one the token is
+        // opaque and there is nothing for a verifier to check.
+        audience: options.audience ?? false,
+        ...options.audience ? {} : { authorizedParty: clientId }
+      }),
+      constraints: [
+        "Issues an opaque access token unless `audience` names an API, so token verification needs it.",
+        "A refresh token needs three things together: `offline_access` in the scopes, an audience whose API has Allow Offline Access on, and Refresh Token Rotation enabled on the application. Any one missing and the scope is ignored silently.",
+        "Has no roles claim of its own. An action must add a namespaced one, and Auth0 drops a custom claim that is not a URI.",
+        "The issuer carries a trailing slash. A verifier pinned without it rejects every token."
+      ]
+    };
+  },
+  /**
+   * Okta.
+   *
+   * Two authorization servers that are not interchangeable: a custom one per application,
+   * and the org itself for Okta's own management API.
+   */
+  okta(options) {
+    const host = `https://${options.domain.replace(/^https?:\/\//, "").replace(/\/+$/, "")}`;
+    const server = options.authorizationServer === void 0 ? "default" : options.authorizationServer;
+    const issuer = server === null ? host : `${host}/oauth2/${server}`;
+    return {
+      label: "Okta",
+      client: {
+        issuer,
+        scopes: options.scopes ?? ["openid", "profile", "email", "offline_access"],
+        dpop: options.dpop ?? true
+      },
+      roles: rolesFrom.groups,
+      verifier: (clientId) => ({
+        issuer,
+        // An access token from a custom server is minted for that server's audience, named in
+        // the console and `api://default` by default. It does not carry the client id.
+        audience: false,
+        authorizedParty: clientId
+      }),
+      constraints: [
+        "Two authorization servers: /oauth2/<name> for an application, the bare domain for the management API. They are not interchangeable.",
+        "Turns DPoP on by default for a new application, and an integrator org will not let you untick it.",
+        "Binds the refresh token to the DPoP key as well as the access token, so a refresh must be proved with the key that obtained it.",
+        "A public SPA cannot introspect at all. An API Services client with `private_key_jwt` has to ask instead.",
+        "Client credentials against the org server must use `private_key_jwt`, whatever the application is set to."
+      ]
+    };
+  },
+  /**
+   * Google.
+   *
+   * Refuses a public client outright, so server mode is the only option: the token endpoint
+   * checks for a client secret before it looks at PKCE.
+   */
+  google(options = {}) {
+    return {
+      label: "Google",
+      client: {
+        issuer: "https://accounts.google.com",
+        scopes: options.scopes ?? ["openid", "profile", "email"],
+        ...options.hostedDomain ? { extraParams: { hd: options.hostedDomain } } : {}
+      },
+      roles: rolesFrom.scope,
+      verifier: (clientId) => ({
+        // Names itself two ways, and a service pinned to one rejects tokens carrying the
+        // other. Discovery uses the first.
+        issuer: ["https://accounts.google.com", "accounts.google.com"],
+        audience: clientId
+      }),
+      constraints: [
+        "Refuses a public client: the token endpoint reports `client_secret is missing` before checking PKCE, so browser mode cannot work.",
+        "Publishes its issuer both with and without a scheme, so a verifier needs both spellings.",
+        "Issues a refresh token only on the first consent unless `prompt=consent` and `access_type=offline` are sent."
+      ]
+    };
+  },
+  /**
+   * Dex.
+   *
+   * Sends no CORS headers, on discovery or the token endpoint, so a browser cannot talk to it
+   * at all. Server mode only, and giving endpoints explicitly does not help: the token request
+   * is blocked too.
+   */
+  dex(options) {
+    const issuer = trim(options.baseUrl);
+    return {
+      label: "Dex",
+      client: {
+        issuer,
+        scopes: options.scopes ?? ["openid", "profile", "email", "offline_access"]
+      },
+      roles: rolesFrom.groups,
+      verifier: (clientId) => ({ issuer, audience: clientId }),
+      constraints: [
+        "Sends no CORS headers on discovery or the token endpoint, so browser mode cannot work. Naming the endpoints explicitly only moves the failure to the token request.",
+        "Has no admin interface. Users are static entries in its config file, and a password is a bcrypt hash.",
+        "Publishes no revocation endpoint."
+      ]
+    };
+  }
+};
+
+// src/env-config.ts
+var SECRETISH = /(SECRET|PASSWORD|PRIVATE_KEY|CREDENTIALS?)($|_)/;
+var scopeList = (value) => value ? value.split(/[\s,]+/).filter(Boolean) : void 0;
+var flag = (value) => value === void 0 ? void 0 : /^(true|1|on|yes)$/i.test(value.trim());
+function authFromEnv(source, options = {}) {
+  const clientPrefix = options.clientPrefix ?? "VITE_";
+  const specific = `${clientPrefix}${(options.prefix ?? "AUTH").toUpperCase()}`;
+  const general = `${clientPrefix}AUTH`;
+  const read = (suffix) => {
+    const found = source[`${specific}_${suffix}`] ?? source[`${general}_${suffix}`];
+    return found === void 0 || found === "" ? void 0 : found;
+  };
+  if (clientPrefix) {
+    const exposed = Object.keys(source).filter(
+      (name2) => name2.startsWith(clientPrefix) && SECRETISH.test(name2.slice(clientPrefix.length))
+    );
+    if (exposed.length) {
+      throw new Error(
+        `[fluixi/oauth2] ${exposed.join(", ")} ${exposed.length > 1 ? "are" : "is"} prefixed \`${clientPrefix}\`, which inlines the value into the browser bundle. Drop the prefix and read it on the server: \`credentialsFromEnv\` looks for the unprefixed name.`
+      );
+    }
+  }
+  const name = options.provider ?? read("PROVIDER") ?? "oidc";
+  if (!(name in presets)) {
+    throw new Error(
+      `[fluixi/oauth2] ${specific}_PROVIDER is "${name}", which is not a preset. Use one of ${Object.keys(presets).join(", ")}, or \`oidc\` with an issuer for anything else.`
+    );
+  }
+  const clientId = read("CLIENT_ID");
+  if (!clientId) {
+    throw new Error(
+      `[fluixi/oauth2] no client id. Set ${specific}_CLIENT_ID (or ${general}_CLIENT_ID).`
+    );
+  }
+  const scopes = scopeList(read("SCOPES"));
+  const audience = read("AUDIENCE");
+  const rolesClaim = read("ROLES_CLAIM");
+  const require2 = (suffix) => {
+    const found = read(suffix);
+    if (!found) {
+      throw new Error(
+        `[fluixi/oauth2] the ${name} preset needs ${specific}_${suffix}, which is not set.`
+      );
+    }
+    return found;
+  };
+  let provider;
+  switch (name) {
+    case "keycloak":
+      provider = presets.keycloak({
+        baseUrl: require2("BASE_URL"),
+        realm: require2("REALM"),
+        scopes
+      });
+      break;
+    case "auth0":
+      provider = presets.auth0({
+        domain: require2("DOMAIN"),
+        audience,
+        scopes,
+        rolesClaim
+      });
+      break;
+    case "okta": {
+      const server = read("AUTH_SERVER");
+      provider = presets.okta({
+        domain: require2("DOMAIN"),
+        // `org` names the org server, which the preset takes as null.
+        authorizationServer: server === "org" ? null : server,
+        scopes,
+        dpop: flag(read("DPOP"))
+      });
+      break;
+    }
+    case "google":
+      provider = presets.google({ scopes, hostedDomain: read("HOSTED_DOMAIN") });
+      break;
+    case "dex":
+      provider = presets.dex({ baseUrl: require2("BASE_URL"), scopes });
+      break;
+    case "oauth2":
+      provider = presets.oauth2({
+        issuer: require2("ISSUER"),
+        endpoints: {
+          authorization: require2("AUTHORIZATION_ENDPOINT"),
+          token: require2("TOKEN_ENDPOINT"),
+          userinfo: read("USERINFO_ENDPOINT"),
+          revocation: read("REVOCATION_ENDPOINT"),
+          introspection: read("INTROSPECTION_ENDPOINT")
+        },
+        scopes,
+        audience: audience ?? (flag(read("NO_AUDIENCE")) ? false : void 0),
+        roles: options.roles
+      });
+      break;
+    default:
+      provider = presets.oidc({
+        issuer: require2("ISSUER"),
+        scopes,
+        // A provider putting no `aud` on an access token. Keycloak without a mapper is the
+        // common case, and the preset moves the check to `azp` rather than dropping it.
+        audience: audience ?? (flag(read("NO_AUDIENCE")) ? false : void 0),
+        roles: options.roles
+      });
+  }
+  const dpop = flag(read("DPOP"));
+  if (dpop !== void 0) provider = { ...provider, client: { ...provider.client, dpop } };
+  if (options.roles) provider = { ...provider, roles: options.roles };
+  const tokens = options.tokens ?? (read("TOKENS") ?? "browser");
+  if (tokens !== "browser" && tokens !== "server") {
+    throw new Error(
+      `[fluixi/oauth2] ${specific}_TOKENS is "${tokens}". It is \`browser\` or \`server\`.`
+    );
+  }
+  const redirectUri = read("REDIRECT_URI");
+  return {
+    provider,
+    providerName: name,
+    clientId,
+    tokens,
+    redirectUri,
+    scopes,
+    client: { ...provider.client, clientId, tokens, ...redirectUri ? { redirectUri } : {} }
+  };
+}
+export {
+  authFromEnv
+};