@gatwech/auth 1.0.0-beta.18

package/dist/device-authorization-V4s3h4Mj.mjs

@@ -0,0 +1,557 @@
+import { r as generateRandomString } from "./crypto-Bb42eMrH.mjs";
+import { m as ms } from "./cookies-cJObLwn1.mjs";
+import { n as mergeSchema } from "./date-Cx2yCiC4.mjs";
+import { r as getSessionFromCtx } from "./session-Dgp133Yt.mjs";
+import { defineErrorCodes } from "@gatwech/core/utils";
+import { APIError } from "better-call";
+import { createAuthEndpoint } from "@gatwech/core/api";
+import * as z$1 from "zod";
+
+//#region src/plugins/device-authorization/schema.ts
+const schema = { deviceCode: { fields: {
+	deviceCode: {
+		type: "string",
+		required: true
+	},
+	userCode: {
+		type: "string",
+		required: true
+	},
+	userId: {
+		type: "string",
+		required: false
+	},
+	expiresAt: {
+		type: "date",
+		required: true
+	},
+	status: {
+		type: "string",
+		required: true
+	},
+	lastPolledAt: {
+		type: "date",
+		required: false
+	},
+	pollingInterval: {
+		type: "number",
+		required: false
+	},
+	clientId: {
+		type: "string",
+		required: false
+	},
+	scope: {
+		type: "string",
+		required: false
+	}
+} } };
+const deviceCode = z$1.object({
+	id: z$1.string(),
+	deviceCode: z$1.string(),
+	userCode: z$1.string(),
+	userId: z$1.string().optional(),
+	expiresAt: z$1.date(),
+	status: z$1.string(),
+	lastPolledAt: z$1.date().optional(),
+	pollingInterval: z$1.number().optional(),
+	clientId: z$1.string().optional(),
+	scope: z$1.string().optional()
+});
+
+//#endregion
+//#region src/plugins/device-authorization/index.ts
+const msStringValueSchema = z$1.custom((val) => {
+	try {
+		ms(val);
+	} catch (e) {
+		return false;
+	}
+	return true;
+}, { message: "Invalid time string format. Use formats like '30m', '5s', '1h', etc." });
+const $deviceAuthorizationOptionsSchema = z$1.object({
+	expiresIn: msStringValueSchema.default("30m").describe("Time in seconds until the device code expires. Use formats like '30m', '5s', '1h', etc."),
+	interval: msStringValueSchema.default("5s").describe("Time in seconds between polling attempts. Use formats like '30m', '5s', '1h', etc."),
+	deviceCodeLength: z$1.number().int().positive().default(40).describe("Length of the device code to be generated. Default is 40 characters."),
+	userCodeLength: z$1.number().int().positive().default(8).describe("Length of the user code to be generated. Default is 8 characters."),
+	generateDeviceCode: z$1.custom((val) => typeof val === "function", { message: "generateDeviceCode must be a function that returns a string or a promise that resolves to a string." }).optional().describe("Function to generate a device code. If not provided, a default random string generator will be used."),
+	generateUserCode: z$1.custom((val) => typeof val === "function", { message: "generateUserCode must be a function that returns a string or a promise that resolves to a string." }).optional().describe("Function to generate a user code. If not provided, a default random string generator will be used."),
+	validateClient: z$1.custom((val) => typeof val === "function", { message: "validateClient must be a function that returns a boolean or a promise that resolves to a boolean." }).optional().describe("Function to validate the client ID. If not provided, no validation will be performed."),
+	onDeviceAuthRequest: z$1.custom((val) => typeof val === "function", { message: "onDeviceAuthRequest must be a function that returns void or a promise that resolves to void." }).optional().describe("Function to handle device authorization requests. If not provided, no additional actions will be taken."),
+	schema: z$1.custom(() => true)
+});
+const DEVICE_AUTHORIZATION_ERROR_CODES = defineErrorCodes({
+	INVALID_DEVICE_CODE: "Invalid device code",
+	EXPIRED_DEVICE_CODE: "Device code has expired",
+	EXPIRED_USER_CODE: "User code has expired",
+	AUTHORIZATION_PENDING: "Authorization pending",
+	ACCESS_DENIED: "Access denied",
+	INVALID_USER_CODE: "Invalid user code",
+	DEVICE_CODE_ALREADY_PROCESSED: "Device code already processed",
+	POLLING_TOO_FREQUENTLY: "Polling too frequently",
+	USER_NOT_FOUND: "User not found",
+	FAILED_TO_CREATE_SESSION: "Failed to create session",
+	INVALID_DEVICE_CODE_STATUS: "Invalid device code status",
+	AUTHENTICATION_REQUIRED: "Authentication required"
+});
+const defaultCharset = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+/**
+* @internal
+*/
+const defaultGenerateDeviceCode = (length) => {
+	return generateRandomString(length, "a-z", "A-Z", "0-9");
+};
+/**
+* @internal
+*/
+const defaultGenerateUserCode = (length) => {
+	const chars = new Uint8Array(length);
+	return Array.from(crypto.getRandomValues(chars)).map((byte) => defaultCharset[byte % 32]).join("");
+};
+const deviceAuthorization = (options = {}) => {
+	const opts = $deviceAuthorizationOptionsSchema.parse(options);
+	const generateDeviceCode = async () => {
+		if (opts.generateDeviceCode) return opts.generateDeviceCode();
+		return defaultGenerateDeviceCode(opts.deviceCodeLength);
+	};
+	const generateUserCode = async () => {
+		if (opts.generateUserCode) return opts.generateUserCode();
+		return defaultGenerateUserCode(opts.userCodeLength);
+	};
+	return {
+		id: "device-authorization",
+		schema: mergeSchema(schema, options?.schema),
+		endpoints: {
+			deviceCode: createAuthEndpoint("/device/code", {
+				method: "POST",
+				body: z$1.object({
+					client_id: z$1.string().meta({ description: "The client ID of the application" }),
+					scope: z$1.string().meta({ description: "Space-separated list of scopes" }).optional()
+				}),
+				error: z$1.object({
+					error: z$1.enum(["invalid_request", "invalid_client"]).meta({ description: "Error code" }),
+					error_description: z$1.string().meta({ description: "Detailed error description" })
+				}),
+				metadata: { openapi: {
+					description: `Request a device and user code
+
+Follow [rfc8628#section-3.2](https://datatracker.ietf.org/doc/html/rfc8628#section-3.2)`,
+					responses: {
+						200: {
+							description: "Success",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									device_code: {
+										type: "string",
+										description: "The device verification code"
+									},
+									user_code: {
+										type: "string",
+										description: "The user code to display"
+									},
+									verification_uri: {
+										type: "string",
+										description: "The URL for user verification"
+									},
+									verification_uri_complete: {
+										type: "string",
+										description: "The complete URL with user code"
+									},
+									expires_in: {
+										type: "number",
+										description: "Lifetime in seconds of the device code"
+									},
+									interval: {
+										type: "number",
+										description: "Minimum polling interval in seconds"
+									}
+								}
+							} } }
+						},
+						400: {
+							description: "Error response",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									error: {
+										type: "string",
+										enum: ["invalid_request", "invalid_client"]
+									},
+									error_description: { type: "string" }
+								}
+							} } }
+						}
+					}
+				} }
+			}, async (ctx) => {
+				if (opts.validateClient) {
+					if (!await opts.validateClient(ctx.body.client_id)) throw new APIError("BAD_REQUEST", {
+						error: "invalid_client",
+						error_description: "Invalid client ID"
+					});
+				}
+				if (opts.onDeviceAuthRequest) await opts.onDeviceAuthRequest(ctx.body.client_id, ctx.body.scope);
+				const deviceCode$1 = await generateDeviceCode();
+				const userCode = await generateUserCode();
+				const expiresIn = ms(opts.expiresIn);
+				const expiresAt = new Date(Date.now() + expiresIn);
+				await ctx.context.adapter.create({
+					model: "deviceCode",
+					data: {
+						deviceCode: deviceCode$1,
+						userCode,
+						expiresAt,
+						status: "pending",
+						pollingInterval: ms(opts.interval),
+						clientId: ctx.body.client_id,
+						scope: ctx.body.scope
+					}
+				});
+				const baseURL = new URL(ctx.context.baseURL);
+				const verification_uri = new URL("/device", baseURL);
+				const verification_uri_complete = new URL(verification_uri);
+				verification_uri_complete.searchParams.set("user_code", encodeURIComponent(userCode));
+				return ctx.json({
+					device_code: deviceCode$1,
+					user_code: userCode,
+					verification_uri: verification_uri.toString(),
+					verification_uri_complete: verification_uri_complete.toString(),
+					expires_in: Math.floor(expiresIn / 1e3),
+					interval: Math.floor(ms(opts.interval) / 1e3)
+				}, { headers: { "Cache-Control": "no-store" } });
+			}),
+			deviceToken: createAuthEndpoint("/device/token", {
+				method: "POST",
+				body: z$1.object({
+					grant_type: z$1.literal("urn:ietf:params:oauth:grant-type:device_code").meta({ description: "The grant type for device flow" }),
+					device_code: z$1.string().meta({ description: "The device verification code" }),
+					client_id: z$1.string().meta({ description: "The client ID of the application" })
+				}),
+				error: z$1.object({
+					error: z$1.enum([
+						"authorization_pending",
+						"slow_down",
+						"expired_token",
+						"access_denied",
+						"invalid_request",
+						"invalid_grant"
+					]).meta({ description: "Error code" }),
+					error_description: z$1.string().meta({ description: "Detailed error description" })
+				}),
+				metadata: { openapi: {
+					description: `Exchange device code for access token
+
+Follow [rfc8628#section-3.4](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4)`,
+					responses: {
+						200: {
+							description: "Success",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									session: { $ref: "#/components/schemas/Session" },
+									user: { $ref: "#/components/schemas/User" }
+								}
+							} } }
+						},
+						400: {
+							description: "Error response",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									error: {
+										type: "string",
+										enum: [
+											"authorization_pending",
+											"slow_down",
+											"expired_token",
+											"access_denied",
+											"invalid_request",
+											"invalid_grant"
+										]
+									},
+									error_description: { type: "string" }
+								}
+							} } }
+						}
+					}
+				} }
+			}, async (ctx) => {
+				const { device_code, client_id } = ctx.body;
+				if (opts.validateClient) {
+					if (!await opts.validateClient(client_id)) throw new APIError("BAD_REQUEST", {
+						error: "invalid_grant",
+						error_description: "Invalid client ID"
+					});
+				}
+				const deviceCodeRecord = await ctx.context.adapter.findOne({
+					model: "deviceCode",
+					where: [{
+						field: "deviceCode",
+						value: device_code
+					}]
+				});
+				if (!deviceCodeRecord) throw new APIError("BAD_REQUEST", {
+					error: "invalid_grant",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_DEVICE_CODE
+				});
+				if (deviceCodeRecord.clientId && deviceCodeRecord.clientId !== client_id) throw new APIError("BAD_REQUEST", {
+					error: "invalid_grant",
+					error_description: "Client ID mismatch"
+				});
+				if (deviceCodeRecord.lastPolledAt && deviceCodeRecord.pollingInterval) {
+					if (Date.now() - new Date(deviceCodeRecord.lastPolledAt).getTime() < deviceCodeRecord.pollingInterval) throw new APIError("BAD_REQUEST", {
+						error: "slow_down",
+						error_description: DEVICE_AUTHORIZATION_ERROR_CODES.POLLING_TOO_FREQUENTLY
+					});
+				}
+				await ctx.context.adapter.update({
+					model: "deviceCode",
+					where: [{
+						field: "id",
+						value: deviceCodeRecord.id
+					}],
+					update: { lastPolledAt: /* @__PURE__ */ new Date() }
+				});
+				if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) {
+					await ctx.context.adapter.delete({
+						model: "deviceCode",
+						where: [{
+							field: "id",
+							value: deviceCodeRecord.id
+						}]
+					});
+					throw new APIError("BAD_REQUEST", {
+						error: "expired_token",
+						error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_DEVICE_CODE
+					});
+				}
+				if (deviceCodeRecord.status === "pending") throw new APIError("BAD_REQUEST", {
+					error: "authorization_pending",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.AUTHORIZATION_PENDING
+				});
+				if (deviceCodeRecord.status === "denied") {
+					await ctx.context.adapter.delete({
+						model: "deviceCode",
+						where: [{
+							field: "id",
+							value: deviceCodeRecord.id
+						}]
+					});
+					throw new APIError("BAD_REQUEST", {
+						error: "access_denied",
+						error_description: DEVICE_AUTHORIZATION_ERROR_CODES.ACCESS_DENIED
+					});
+				}
+				if (deviceCodeRecord.status === "approved" && deviceCodeRecord.userId) {
+					await ctx.context.adapter.delete({
+						model: "deviceCode",
+						where: [{
+							field: "id",
+							value: deviceCodeRecord.id
+						}]
+					});
+					const user = await ctx.context.internalAdapter.findUserById(deviceCodeRecord.userId);
+					if (!user) throw new APIError("INTERNAL_SERVER_ERROR", {
+						error: "server_error",
+						error_description: DEVICE_AUTHORIZATION_ERROR_CODES.USER_NOT_FOUND
+					});
+					const session = await ctx.context.internalAdapter.createSession(user.id);
+					if (!session) throw new APIError("INTERNAL_SERVER_ERROR", {
+						error: "server_error",
+						error_description: DEVICE_AUTHORIZATION_ERROR_CODES.FAILED_TO_CREATE_SESSION
+					});
+					ctx.context.setNewSession({
+						session,
+						user
+					});
+					if (ctx.context.options.secondaryStorage) await ctx.context.secondaryStorage?.set(session.token, JSON.stringify({
+						user,
+						session
+					}), Math.floor((new Date(session.expiresAt).getTime() - Date.now()) / 1e3));
+					return ctx.json({
+						access_token: session.token,
+						token_type: "Bearer",
+						expires_in: Math.floor((new Date(session.expiresAt).getTime() - Date.now()) / 1e3),
+						scope: deviceCodeRecord.scope || ""
+					}, { headers: {
+						"Cache-Control": "no-store",
+						Pragma: "no-cache"
+					} });
+				}
+				throw new APIError("INTERNAL_SERVER_ERROR", {
+					error: "server_error",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_DEVICE_CODE_STATUS
+				});
+			}),
+			deviceVerify: createAuthEndpoint("/device", {
+				method: "GET",
+				query: z$1.object({ user_code: z$1.string().meta({ description: "The user code to verify" }) }),
+				error: z$1.object({
+					error: z$1.enum(["invalid_request"]).meta({ description: "Error code" }),
+					error_description: z$1.string().meta({ description: "Detailed error description" })
+				}),
+				metadata: { openapi: {
+					description: "Display device verification page",
+					responses: { 200: {
+						description: "Verification page HTML",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								user_code: {
+									type: "string",
+									description: "The user code to verify"
+								},
+								status: {
+									type: "string",
+									enum: [
+										"pending",
+										"approved",
+										"denied"
+									],
+									description: "Current status of the device authorization"
+								}
+							}
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const { user_code } = ctx.query;
+				const cleanUserCode = user_code.replace(/-/g, "");
+				const deviceCodeRecord = await ctx.context.adapter.findOne({
+					model: "deviceCode",
+					where: [{
+						field: "userCode",
+						value: cleanUserCode
+					}]
+				});
+				if (!deviceCodeRecord) throw new APIError("BAD_REQUEST", {
+					error: "invalid_request",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE
+				});
+				if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
+					error: "expired_token",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE
+				});
+				return ctx.json({
+					user_code,
+					status: deviceCodeRecord.status
+				});
+			}),
+			deviceApprove: createAuthEndpoint("/device/approve", {
+				method: "POST",
+				body: z$1.object({ userCode: z$1.string().meta({ description: "The user code to approve" }) }),
+				error: z$1.object({
+					error: z$1.enum([
+						"invalid_request",
+						"expired_token",
+						"device_code_already_processed"
+					]).meta({ description: "Error code" }),
+					error_description: z$1.string().meta({ description: "Detailed error description" })
+				}),
+				requireHeaders: true,
+				metadata: { openapi: {
+					description: "Approve device authorization",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { success: { type: "boolean" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const session = await getSessionFromCtx(ctx);
+				if (!session) throw new APIError("UNAUTHORIZED", {
+					error: "unauthorized",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.AUTHENTICATION_REQUIRED
+				});
+				const { userCode } = ctx.body;
+				const deviceCodeRecord = await ctx.context.adapter.findOne({
+					model: "deviceCode",
+					where: [{
+						field: "userCode",
+						value: userCode
+					}]
+				});
+				if (!deviceCodeRecord) throw new APIError("BAD_REQUEST", {
+					error: "invalid_request",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE
+				});
+				if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
+					error: "expired_token",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE
+				});
+				if (deviceCodeRecord.status !== "pending") throw new APIError("BAD_REQUEST", {
+					error: "invalid_request",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_ALREADY_PROCESSED
+				});
+				await ctx.context.adapter.update({
+					model: "deviceCode",
+					where: [{
+						field: "id",
+						value: deviceCodeRecord.id
+					}],
+					update: {
+						status: "approved",
+						userId: session.user.id
+					}
+				});
+				return ctx.json({ success: true });
+			}),
+			deviceDeny: createAuthEndpoint("/device/deny", {
+				method: "POST",
+				body: z$1.object({ userCode: z$1.string().meta({ description: "The user code to deny" }) }),
+				error: z$1.object({
+					error: z$1.enum(["invalid_request", "expired_token"]).meta({ description: "Error code" }),
+					error_description: z$1.string().meta({ description: "Detailed error description" })
+				}),
+				metadata: { openapi: {
+					description: "Deny device authorization",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { success: { type: "boolean" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const { userCode } = ctx.body;
+				const cleanUserCode = userCode.replace(/-/g, "");
+				const deviceCodeRecord = await ctx.context.adapter.findOne({
+					model: "deviceCode",
+					where: [{
+						field: "userCode",
+						value: cleanUserCode
+					}]
+				});
+				if (!deviceCodeRecord) throw new APIError("BAD_REQUEST", {
+					error: "invalid_request",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE
+				});
+				if (deviceCodeRecord.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
+					error: "expired_token",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE
+				});
+				if (deviceCodeRecord.status !== "pending") throw new APIError("BAD_REQUEST", {
+					error: "invalid_request",
+					error_description: DEVICE_AUTHORIZATION_ERROR_CODES.DEVICE_CODE_ALREADY_PROCESSED
+				});
+				await ctx.context.adapter.update({
+					model: "deviceCode",
+					where: [{
+						field: "id",
+						value: deviceCodeRecord.id
+					}],
+					update: { status: "denied" }
+				});
+				return ctx.json({ success: true });
+			})
+		},
+		$ERROR_CODES: DEVICE_AUTHORIZATION_ERROR_CODES
+	};
+};
+
+//#endregion
+export { deviceAuthorization as n, $deviceAuthorizationOptionsSchema as t };

package/dist/dialect-CeddeGHf.mjs

@@ -0,0 +1,72 @@
+import { Kysely, MssqlDialect, MysqlDialect, PostgresDialect, SqliteDialect } from "kysely";
+
+//#region src/adapters/kysely-adapter/dialect.ts
+function getKyselyDatabaseType(db) {
+	if (!db) return null;
+	if ("dialect" in db) return getKyselyDatabaseType(db.dialect);
+	if ("createDriver" in db) {
+		if (db instanceof SqliteDialect) return "sqlite";
+		if (db instanceof MysqlDialect) return "mysql";
+		if (db instanceof PostgresDialect) return "postgres";
+		if (db instanceof MssqlDialect) return "mssql";
+	}
+	if ("aggregate" in db) return "sqlite";
+	if ("getConnection" in db) return "mysql";
+	if ("connect" in db) return "postgres";
+	if ("fileControl" in db) return "sqlite";
+	if ("open" in db && "close" in db && "prepare" in db) return "sqlite";
+	return null;
+}
+const createKyselyAdapter = async (config) => {
+	const db = config.database;
+	if (!db) return {
+		kysely: null,
+		databaseType: null,
+		transaction: void 0
+	};
+	if ("db" in db) return {
+		kysely: db.db,
+		databaseType: db.type,
+		transaction: db.transaction
+	};
+	if ("dialect" in db) return {
+		kysely: new Kysely({ dialect: db.dialect }),
+		databaseType: db.type,
+		transaction: db.transaction
+	};
+	let dialect = void 0;
+	const databaseType = getKyselyDatabaseType(db);
+	if ("createDriver" in db) dialect = db;
+	if ("aggregate" in db && !("createSession" in db)) dialect = new SqliteDialect({ database: db });
+	if ("getConnection" in db) dialect = new MysqlDialect(db);
+	if ("connect" in db) dialect = new PostgresDialect({ pool: db });
+	if ("fileControl" in db) {
+		const { BunSqliteDialect } = await import("./bun-sqlite-dialect-CeNvMaZz.mjs");
+		dialect = new BunSqliteDialect({ database: db });
+	}
+	if ("createSession" in db && typeof window === "undefined") {
+		let DatabaseSync = void 0;
+		try {
+			let nodeSqlite = "node:sqlite";
+			({DatabaseSync} = await import(
+				/* @vite-ignore */
+				/* webpackIgnore: true */
+				nodeSqlite
+));
+		} catch (error) {
+			if (error !== null && typeof error === "object" && "code" in error && error.code !== "ERR_UNKNOWN_BUILTIN_MODULE") throw error;
+		}
+		if (DatabaseSync && db instanceof DatabaseSync) {
+			const { NodeSqliteDialect } = await import("./node-sqlite-dialect-BcKxBQnm.mjs");
+			dialect = new NodeSqliteDialect({ database: db });
+		}
+	}
+	return {
+		kysely: dialect ? new Kysely({ dialect }) : null,
+		databaseType,
+		transaction: void 0
+	};
+};
+
+//#endregion
+export { getKyselyDatabaseType as n, createKyselyAdapter as t };