@gatwech/auth 1.0.0-beta.18

package/dist/generic-oauth-CL5X27ZI.mjs

@@ -0,0 +1,445 @@
+import { i as parseState, r as generateState } from "./utils-SOMB4Px5.mjs";
+import { O as handleOAuthUserInfo } from "./api-0pR_I-Nx.mjs";
+import { c as setSessionCookie } from "./cookies-cJObLwn1.mjs";
+import { u as sessionMiddleware } from "./session-Dgp133Yt.mjs";
+import { BASE_ERROR_CODES } from "@gatwech/core/error";
+import { createAuthorizationURL, refreshAccessToken, validateAuthorizationCode } from "@gatwech/core/oauth2";
+import { defineErrorCodes } from "@gatwech/core/utils";
+import { APIError } from "better-call";
+import { createAuthEndpoint } from "@gatwech/core/api";
+import * as z$1 from "zod";
+import { decodeJwt } from "jose";
+import { betterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/generic-oauth/index.ts
+async function getUserInfo(tokens, finalUserInfoUrl) {
+	if (tokens.idToken) {
+		const decoded = decodeJwt(tokens.idToken);
+		if (decoded) {
+			if (decoded.sub && decoded.email) return {
+				id: decoded.sub,
+				emailVerified: decoded.email_verified,
+				image: decoded.picture,
+				...decoded
+			};
+		}
+	}
+	if (!finalUserInfoUrl) return null;
+	const userInfo = await betterFetch(finalUserInfoUrl, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tokens.accessToken}` }
+	});
+	return {
+		id: userInfo.data?.sub,
+		emailVerified: userInfo.data?.email_verified ?? false,
+		email: userInfo.data?.email,
+		image: userInfo.data?.picture,
+		name: userInfo.data?.name,
+		...userInfo.data
+	};
+}
+const ERROR_CODES = defineErrorCodes({ INVALID_OAUTH_CONFIGURATION: "Invalid OAuth configuration" });
+/**
+* A generic OAuth plugin that can be used to add OAuth support to any provider
+*/
+const genericOAuth = (options) => {
+	return {
+		id: "generic-oauth",
+		init: (ctx) => {
+			return { context: { socialProviders: options.config.map((c) => {
+				let finalUserInfoUrl = c.userInfoUrl;
+				return {
+					id: c.providerId,
+					name: c.providerId,
+					createAuthorizationURL(data) {
+						return createAuthorizationURL({
+							id: c.providerId,
+							options: {
+								clientId: c.clientId,
+								clientSecret: c.clientSecret,
+								redirectURI: c.redirectURI
+							},
+							authorizationEndpoint: c.authorizationUrl,
+							state: data.state,
+							codeVerifier: c.pkce ? data.codeVerifier : void 0,
+							scopes: c.scopes || [],
+							redirectURI: `${ctx.baseURL}/oauth2/callback/${c.providerId}`
+						});
+					},
+					async validateAuthorizationCode(data) {
+						let finalTokenUrl = c.tokenUrl;
+						if (c.discoveryUrl) {
+							const discovery = await betterFetch(c.discoveryUrl, {
+								method: "GET",
+								headers: c.discoveryHeaders
+							});
+							if (discovery.data) {
+								finalTokenUrl = discovery.data.token_endpoint;
+								finalUserInfoUrl = discovery.data.userinfo_endpoint;
+							}
+						}
+						if (!finalTokenUrl) throw new APIError("BAD_REQUEST", { message: "Invalid OAuth configuration. Token URL not found." });
+						return validateAuthorizationCode({
+							headers: c.authorizationHeaders,
+							code: data.code,
+							codeVerifier: data.codeVerifier,
+							redirectURI: data.redirectURI,
+							options: {
+								clientId: c.clientId,
+								clientSecret: c.clientSecret,
+								redirectURI: c.redirectURI
+							},
+							tokenEndpoint: finalTokenUrl,
+							authentication: c.authentication
+						});
+					},
+					async refreshAccessToken(refreshToken) {
+						let finalTokenUrl = c.tokenUrl;
+						if (c.discoveryUrl) {
+							const discovery = await betterFetch(c.discoveryUrl, {
+								method: "GET",
+								headers: c.discoveryHeaders
+							});
+							if (discovery.data) finalTokenUrl = discovery.data.token_endpoint;
+						}
+						if (!finalTokenUrl) throw new APIError("BAD_REQUEST", { message: "Invalid OAuth configuration. Token URL not found." });
+						return refreshAccessToken({
+							refreshToken,
+							options: {
+								clientId: c.clientId,
+								clientSecret: c.clientSecret
+							},
+							authentication: c.authentication,
+							tokenEndpoint: finalTokenUrl
+						});
+					},
+					async getUserInfo(tokens) {
+						const userInfo = c.getUserInfo ? await c.getUserInfo(tokens) : await getUserInfo(tokens, finalUserInfoUrl);
+						if (!userInfo) return null;
+						return {
+							user: {
+								id: userInfo?.id,
+								email: userInfo?.email,
+								emailVerified: userInfo?.emailVerified,
+								image: userInfo?.image,
+								name: userInfo?.name,
+								...c.mapProfileToUser?.(userInfo)
+							},
+							data: userInfo
+						};
+					},
+					options: { overrideUserInfoOnSignIn: c.overrideUserInfo }
+				};
+			}).concat(ctx.socialProviders) } };
+		},
+		endpoints: {
+			signInWithOAuth2: createAuthEndpoint("/sign-in/oauth2", {
+				method: "POST",
+				body: z$1.object({
+					providerId: z$1.string().meta({ description: "The provider ID for the OAuth provider" }),
+					callbackURL: z$1.string().meta({ description: "The URL to redirect to after sign in" }).optional(),
+					errorCallbackURL: z$1.string().meta({ description: "The URL to redirect to if an error occurs" }).optional(),
+					newUserCallbackURL: z$1.string().meta({ description: "The URL to redirect to after login if the user is new. Eg: \"/welcome\"" }).optional(),
+					disableRedirect: z$1.boolean().meta({ description: "Disable redirect" }).optional(),
+					scopes: z$1.array(z$1.string()).meta({ description: "Scopes to be passed to the provider authorization request." }).optional(),
+					requestSignUp: z$1.boolean().meta({ description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider. Eg: false" }).optional(),
+					additionalData: z$1.record(z$1.string(), z$1.any()).optional()
+				}),
+				metadata: { openapi: {
+					description: "Sign in with OAuth2",
+					responses: { 200: {
+						description: "Sign in with OAuth2",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								url: { type: "string" },
+								redirect: { type: "boolean" }
+							}
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const { providerId } = ctx.body;
+				const config = options.config.find((c) => c.providerId === providerId);
+				if (!config) throw new APIError("BAD_REQUEST", { message: `No config found for provider ${providerId}` });
+				const { discoveryUrl, authorizationUrl, tokenUrl, clientId, clientSecret, scopes, redirectURI, responseType, pkce, prompt, accessType, authorizationUrlParams, responseMode, authentication } = config;
+				let finalAuthUrl = authorizationUrl;
+				let finalTokenUrl = tokenUrl;
+				if (discoveryUrl) {
+					const discovery = await betterFetch(discoveryUrl, {
+						method: "GET",
+						headers: config.discoveryHeaders,
+						onError(context) {
+							ctx.context.logger.error(context.error.message, context.error, { discoveryUrl });
+						}
+					});
+					if (discovery.data) {
+						finalAuthUrl = discovery.data.authorization_endpoint;
+						finalTokenUrl = discovery.data.token_endpoint;
+					}
+				}
+				if (!finalAuthUrl || !finalTokenUrl) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION });
+				if (authorizationUrlParams) {
+					const withAdditionalParams = new URL(finalAuthUrl);
+					for (const [paramName, paramValue] of Object.entries(authorizationUrlParams)) withAdditionalParams.searchParams.set(paramName, paramValue);
+					finalAuthUrl = withAdditionalParams.toString();
+				}
+				const additionalParams = typeof authorizationUrlParams === "function" ? authorizationUrlParams(ctx) : authorizationUrlParams;
+				const { state, codeVerifier } = await generateState(ctx, void 0, ctx.body.additionalData);
+				const authUrl = await createAuthorizationURL({
+					id: providerId,
+					options: {
+						clientId,
+						clientSecret,
+						redirectURI
+					},
+					authorizationEndpoint: finalAuthUrl,
+					state,
+					codeVerifier: pkce ? codeVerifier : void 0,
+					scopes: ctx.body.scopes ? [...ctx.body.scopes, ...scopes || []] : scopes || [],
+					redirectURI: `${ctx.context.baseURL}/oauth2/callback/${providerId}`,
+					prompt,
+					accessType,
+					responseType,
+					responseMode,
+					additionalParams
+				});
+				return ctx.json({
+					url: authUrl.toString(),
+					redirect: !ctx.body.disableRedirect
+				});
+			}),
+			oAuth2Callback: createAuthEndpoint("/oauth2/callback/:providerId", {
+				method: "GET",
+				query: z$1.object({
+					code: z$1.string().meta({ description: "The OAuth2 code" }).optional(),
+					error: z$1.string().meta({ description: "The error message, if any" }).optional(),
+					error_description: z$1.string().meta({ description: "The error description, if any" }).optional(),
+					state: z$1.string().meta({ description: "The state parameter from the OAuth2 request" }).optional()
+				}),
+				metadata: {
+					client: false,
+					openapi: {
+						description: "OAuth2 callback",
+						responses: { 200: {
+							description: "OAuth2 callback",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: { url: { type: "string" } }
+							} } }
+						} }
+					}
+				}
+			}, async (ctx) => {
+				const defaultErrorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
+				if (ctx.query.error || !ctx.query.code) throw ctx.redirect(`${defaultErrorURL}?error=${ctx.query.error || "oAuth_code_missing"}&error_description=${ctx.query.error_description}`);
+				const provider = options.config.find((p) => p.providerId === ctx.params.providerId);
+				if (!provider) throw new APIError("BAD_REQUEST", { message: `No config found for provider ${ctx.params.providerId}` });
+				let tokens = void 0;
+				const { callbackURL, codeVerifier, errorURL, requestSignUp, newUserURL, link } = await parseState(ctx);
+				const code = ctx.query.code;
+				function redirectOnError(error) {
+					const defaultErrorURL$1 = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
+					let url = errorURL || defaultErrorURL$1;
+					if (url.includes("?")) url = `${url}&error=${error}`;
+					else url = `${url}?error=${error}`;
+					throw ctx.redirect(url);
+				}
+				let finalTokenUrl = provider.tokenUrl;
+				let finalUserInfoUrl = provider.userInfoUrl;
+				if (provider.discoveryUrl) {
+					const discovery = await betterFetch(provider.discoveryUrl, {
+						method: "GET",
+						headers: provider.discoveryHeaders
+					});
+					if (discovery.data) {
+						finalTokenUrl = discovery.data.token_endpoint;
+						finalUserInfoUrl = discovery.data.userinfo_endpoint;
+					}
+				}
+				try {
+					if (!finalTokenUrl) throw new APIError("BAD_REQUEST", { message: "Invalid OAuth configuration." });
+					const additionalParams = typeof provider.tokenUrlParams === "function" ? provider.tokenUrlParams(ctx) : provider.tokenUrlParams;
+					tokens = await validateAuthorizationCode({
+						headers: provider.authorizationHeaders,
+						code,
+						codeVerifier: provider.pkce ? codeVerifier : void 0,
+						redirectURI: `${ctx.context.baseURL}/oauth2/callback/${provider.providerId}`,
+						options: {
+							clientId: provider.clientId,
+							clientSecret: provider.clientSecret,
+							redirectURI: provider.redirectURI
+						},
+						tokenEndpoint: finalTokenUrl,
+						authentication: provider.authentication,
+						additionalParams
+					});
+				} catch (e) {
+					ctx.context.logger.error(e && typeof e === "object" && "name" in e ? e.name : "", e);
+					throw redirectOnError("oauth_code_verification_failed");
+				}
+				if (!tokens) throw new APIError("BAD_REQUEST", { message: "Invalid OAuth configuration." });
+				const userInfo = await (async function handleUserInfo() {
+					const userInfo$1 = provider.getUserInfo ? await provider.getUserInfo(tokens) : await getUserInfo(tokens, finalUserInfoUrl);
+					if (!userInfo$1) throw redirectOnError("user_info_is_missing");
+					const mapUser = provider.mapProfileToUser ? await provider.mapProfileToUser(userInfo$1) : userInfo$1;
+					const email = mapUser.email ? mapUser.email.toLowerCase() : userInfo$1.email?.toLowerCase();
+					if (!email) {
+						ctx.context.logger.error("Unable to get user info", userInfo$1);
+						throw redirectOnError("email_is_missing");
+					}
+					const id = mapUser.id ? String(mapUser.id) : String(userInfo$1.id);
+					const name = mapUser.name ? mapUser.name : userInfo$1.name;
+					if (!name) {
+						ctx.context.logger.error("Unable to get user info", userInfo$1);
+						throw redirectOnError("name_is_missing");
+					}
+					return {
+						...userInfo$1,
+						...mapUser,
+						email,
+						id,
+						name
+					};
+				})();
+				if (link) {
+					if (ctx.context.options.account?.accountLinking?.allowDifferentEmails !== true && link.email !== userInfo.email) return redirectOnError("email_doesn't_match");
+					const existingAccount = await ctx.context.internalAdapter.findAccountByProviderId(String(userInfo.id), provider.providerId);
+					if (existingAccount) {
+						if (existingAccount.userId !== link.userId) return redirectOnError("account_already_linked_to_different_user");
+						const updateData = Object.fromEntries(Object.entries({
+							accessToken: tokens.accessToken,
+							idToken: tokens.idToken,
+							refreshToken: tokens.refreshToken,
+							accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+							refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
+							scope: tokens.scopes?.join(",")
+						}).filter(([_, value]) => value !== void 0));
+						await ctx.context.internalAdapter.updateAccount(existingAccount.id, updateData);
+					} else if (!await ctx.context.internalAdapter.createAccount({
+						userId: link.userId,
+						providerId: provider.providerId,
+						accountId: userInfo.id,
+						accessToken: tokens.accessToken,
+						accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+						refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
+						scope: tokens.scopes?.join(","),
+						refreshToken: tokens.refreshToken,
+						idToken: tokens.idToken
+					})) return redirectOnError("unable_to_link_account");
+					let toRedirectTo$1;
+					try {
+						toRedirectTo$1 = callbackURL.toString();
+					} catch {
+						toRedirectTo$1 = callbackURL;
+					}
+					throw ctx.redirect(toRedirectTo$1);
+				}
+				const result = await handleOAuthUserInfo(ctx, {
+					userInfo,
+					account: {
+						providerId: provider.providerId,
+						accountId: userInfo.id,
+						...tokens,
+						scope: tokens.scopes?.join(",")
+					},
+					callbackURL,
+					disableSignUp: provider.disableImplicitSignUp && !requestSignUp || provider.disableSignUp,
+					overrideUserInfo: provider.overrideUserInfo
+				});
+				if (result.error) return redirectOnError(result.error.split(" ").join("_"));
+				const { session, user } = result.data;
+				await setSessionCookie(ctx, {
+					session,
+					user
+				});
+				let toRedirectTo;
+				try {
+					toRedirectTo = (result.isRegister ? newUserURL || callbackURL : callbackURL).toString();
+				} catch {
+					toRedirectTo = result.isRegister ? newUserURL || callbackURL : callbackURL;
+				}
+				throw ctx.redirect(toRedirectTo);
+			}),
+			oAuth2LinkAccount: createAuthEndpoint("/oauth2/link", {
+				method: "POST",
+				body: z$1.object({
+					providerId: z$1.string(),
+					callbackURL: z$1.string(),
+					scopes: z$1.array(z$1.string()).meta({ description: "Additional scopes to request when linking the account" }).optional(),
+					errorCallbackURL: z$1.string().meta({ description: "The URL to redirect to if there is an error during the link process" }).optional()
+				}),
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					description: "Link an OAuth2 account to the current user session",
+					responses: { "200": {
+						description: "Authorization URL generated successfully for linking an OAuth2 account",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								url: {
+									type: "string",
+									format: "uri",
+									description: "The authorization URL to redirect the user to for linking the OAuth2 account"
+								},
+								redirect: {
+									type: "boolean",
+									description: "Indicates that the client should redirect to the provided URL",
+									enum: [true]
+								}
+							},
+							required: ["url", "redirect"]
+						} } }
+					} }
+				} }
+			}, async (c) => {
+				const session = c.context.session;
+				const provider = options.config.find((p) => p.providerId === c.body.providerId);
+				if (!provider) throw new APIError("NOT_FOUND", { message: BASE_ERROR_CODES.PROVIDER_NOT_FOUND });
+				const { providerId, clientId, clientSecret, redirectURI, authorizationUrl, discoveryUrl, pkce, scopes, prompt, accessType, authorizationUrlParams } = provider;
+				let finalAuthUrl = authorizationUrl;
+				if (!finalAuthUrl) {
+					if (!discoveryUrl) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION });
+					const discovery = await betterFetch(discoveryUrl, {
+						method: "GET",
+						headers: provider.discoveryHeaders,
+						onError(context) {
+							c.context.logger.error(context.error.message, context.error, { discoveryUrl });
+						}
+					});
+					if (discovery.data) finalAuthUrl = discovery.data.authorization_endpoint;
+				}
+				if (!finalAuthUrl) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_OAUTH_CONFIGURATION });
+				const state = await generateState(c, {
+					userId: session.user.id,
+					email: session.user.email
+				}, void 0);
+				const additionalParams = typeof authorizationUrlParams === "function" ? authorizationUrlParams(c) : authorizationUrlParams;
+				const url = await createAuthorizationURL({
+					id: providerId,
+					options: {
+						clientId,
+						clientSecret,
+						redirectURI: redirectURI || `${c.context.baseURL}/oauth2/callback/${providerId}`
+					},
+					authorizationEndpoint: finalAuthUrl,
+					state: state.state,
+					codeVerifier: pkce ? state.codeVerifier : void 0,
+					scopes: c.body.scopes || scopes || [],
+					redirectURI: redirectURI || `${c.context.baseURL}/oauth2/callback/${providerId}`,
+					prompt,
+					accessType,
+					additionalParams
+				});
+				return c.json({
+					url: url.toString(),
+					redirect: true
+				});
+			})
+		},
+		$ERROR_CODES: ERROR_CODES
+	};
+};
+
+//#endregion
+export { genericOAuth as t };

package/dist/get-request-ip-DSjrEpGo.mjs

@@ -0,0 +1,27 @@
+import { isDevelopment, isTest } from "@gatwech/core/env";
+import { z } from "zod";
+
+//#region src/utils/get-request-ip.ts
+const LOCALHOST_IP = "127.0.0.1";
+function getIp(req, options) {
+	if (options.advanced?.ipAddress?.disableIpTracking) return null;
+	if (isTest() || isDevelopment()) return LOCALHOST_IP;
+	const headers = "headers" in req ? req.headers : req;
+	const ipHeaders = options.advanced?.ipAddress?.ipAddressHeaders || ["x-forwarded-for"];
+	for (const key of ipHeaders) {
+		const value = "get" in headers ? headers.get(key) : headers[key];
+		if (typeof value === "string") {
+			const ip = value.split(",")[0].trim();
+			if (isValidIP(ip)) return ip;
+		}
+	}
+	return null;
+}
+function isValidIP(ip) {
+	if (z.ipv4().safeParse(ip).success) return true;
+	if (z.ipv6().safeParse(ip).success) return true;
+	return false;
+}
+
+//#endregion
+export { getIp as t };