@gatwech/auth 1.0.0-beta.18

package/dist/index-Buhn3hkR.d.mts

@@ -0,0 +1,433 @@
+import { g as User } from "./index-Cxi7TbLE.mjs";
+import * as _gatwech_core15 from "@gatwech/core";
+import { GenericEndpointContext } from "@gatwech/core";
+import * as _gatwech_core_oauth20 from "@gatwech/core/oauth2";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthProvider } from "@gatwech/core/oauth2";
+import * as better_call158 from "better-call";
+import * as z$1 from "zod";
+
+//#region src/plugins/generic-oauth/index.d.ts
+/**
+ * Configuration interface for generic OAuth providers.
+ */
+interface GenericOAuthConfig {
+  /** Unique identifier for the OAuth provider */
+  providerId: string;
+  /**
+   * URL to fetch OAuth 2.0 configuration.
+   * If provided, the authorization and token endpoints will be fetched from this URL.
+   */
+  discoveryUrl?: string | undefined;
+  /**
+   * URL for the authorization endpoint.
+   * Optional if using discoveryUrl.
+   */
+  authorizationUrl?: string | undefined;
+  /**
+   * URL for the token endpoint.
+   * Optional if using discoveryUrl.
+   */
+  tokenUrl?: string | undefined;
+  /**
+   * URL for the user info endpoint.
+   * Optional if using discoveryUrl.
+   */
+  userInfoUrl?: string | undefined;
+  /** OAuth client ID */
+  clientId: string;
+  /** OAuth client secret */
+  clientSecret?: string | undefined;
+  /**
+   * Array of OAuth scopes to request.
+   * @default []
+   */
+  scopes?: string[] | undefined;
+  /**
+   * Custom redirect URI.
+   * If not provided, a default URI will be constructed.
+   */
+  redirectURI?: string | undefined;
+  /**
+   * OAuth response type.
+   * @default "code"
+   */
+  responseType?: string | undefined;
+  /**
+   * The response mode to use for the authorization code request.
+    */
+  responseMode?: ("query" | "form_post") | undefined;
+  /**
+   * Prompt parameter for the authorization request.
+   * Controls the authentication experience for the user.
+   */
+  prompt?: ("none" | "login" | "consent" | "select_account") | undefined;
+  /**
+   * Whether to use PKCE (Proof Key for Code Exchange)
+   * @default false
+   */
+  pkce?: boolean | undefined;
+  /**
+   * Access type for the authorization request.
+   * Use "offline" to request a refresh token.
+   */
+  accessType?: string | undefined;
+  /**
+   * Custom function to fetch user info.
+   * If provided, this function will be used instead of the default user info fetching logic.
+   * @param tokens - The OAuth tokens received after successful authentication
+   * @returns A promise that resolves to a User object or null
+   */
+  getUserInfo?: ((tokens: OAuth2Tokens) => Promise<OAuth2UserInfo | null>) | undefined;
+  /**
+   * Custom function to map the user profile to a User object.
+   */
+  mapProfileToUser?: ((profile: Record<string, any>) => Partial<Partial<User>> | Promise<Partial<User>>) | undefined;
+  /**
+   * Additional search-params to add to the authorizationUrl.
+   * Warning: Search-params added here overwrite any default params.
+   */
+  authorizationUrlParams?: (Record<string, string> | ((ctx: GenericEndpointContext) => Record<string, string>)) | undefined;
+  /**
+   * Additional search-params to add to the tokenUrl.
+   * Warning: Search-params added here overwrite any default params.
+   */
+  tokenUrlParams?: (Record<string, string> | ((ctx: GenericEndpointContext) => Record<string, string>)) | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * Disable sign up for new users.
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * Authentication method for token requests.
+   * @default "post"
+   */
+  authentication?: ("basic" | "post") | undefined;
+  /**
+   * Custom headers to include in the discovery request.
+   * Useful for providers like Epic that require specific headers (e.g., Epic-Client-ID).
+   */
+  discoveryHeaders?: Record<string, string> | undefined;
+  /**
+   * Custom headers to include in the authorization request.
+   * Useful for providers like Qonto that require specific headers (e.g., X-Qonto-Staging-Token for local development).
+   */
+  authorizationHeaders?: Record<string, string> | undefined;
+  /**
+   * Override user info with the provider info.
+   *
+   * This will update the user info with the provider info,
+   * when the user signs in with the provider.
+   * @default false
+   */
+  overrideUserInfo?: boolean | undefined;
+}
+interface GenericOAuthOptions {
+  /**
+   * Array of OAuth provider configurations.
+   */
+  config: GenericOAuthConfig[];
+}
+/**
+ * A generic OAuth plugin that can be used to add OAuth support to any provider
+ */
+declare const genericOAuth: (options: GenericOAuthOptions) => {
+  id: "generic-oauth";
+  init: (ctx: _gatwech_core15.AuthContext<_gatwech_core15.PayvoAuthOptions>) => {
+    context: {
+      socialProviders: OAuthProvider<Record<string, any>, Partial<_gatwech_core_oauth20.ProviderOptions<any>>>[];
+    };
+  };
+  endpoints: {
+    /**
+     * ### Endpoint
+     *
+     * POST `/sign-in/oauth2`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.signInWithOAuth2`
+     *
+     * **client:**
+     * `authClient.signIn.oauth2`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/sign-in#api-method-sign-in-oauth2)
+     */
+    signInWithOAuth2: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          providerId: string;
+          callbackURL?: string | undefined;
+          errorCallbackURL?: string | undefined;
+          newUserCallbackURL?: string | undefined;
+          disableRedirect?: boolean | undefined;
+          scopes?: string[] | undefined;
+          requestSignUp?: boolean | undefined;
+          additionalData?: Record<string, any> | undefined;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call158.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          url: string;
+          redirect: boolean;
+        };
+      } : {
+        url: string;
+        redirect: boolean;
+      }>;
+      options: {
+        method: "POST";
+        body: z$1.ZodObject<{
+          providerId: z$1.ZodString;
+          callbackURL: z$1.ZodOptional<z$1.ZodString>;
+          errorCallbackURL: z$1.ZodOptional<z$1.ZodString>;
+          newUserCallbackURL: z$1.ZodOptional<z$1.ZodString>;
+          disableRedirect: z$1.ZodOptional<z$1.ZodBoolean>;
+          scopes: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+          requestSignUp: z$1.ZodOptional<z$1.ZodBoolean>;
+          additionalData: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
+        }, z$1.core.$strip>;
+        metadata: {
+          openapi: {
+            description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        url: {
+                          type: string;
+                        };
+                        redirect: {
+                          type: string;
+                        };
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/sign-in/oauth2";
+    };
+    oAuth2Callback: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query: {
+          code?: string | undefined;
+          error?: string | undefined;
+          error_description?: string | undefined;
+          state?: string | undefined;
+        };
+      } & {
+        params: {
+          providerId: string;
+        };
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call158.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: void;
+      } : void>;
+      options: {
+        method: "GET";
+        query: z$1.ZodObject<{
+          code: z$1.ZodOptional<z$1.ZodString>;
+          error: z$1.ZodOptional<z$1.ZodString>;
+          error_description: z$1.ZodOptional<z$1.ZodString>;
+          state: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$strip>;
+        metadata: {
+          client: boolean;
+          openapi: {
+            description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        url: {
+                          type: string;
+                        };
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/oauth2/callback/:providerId";
+    };
+    /**
+     * ### Endpoint
+     *
+     * POST `/oauth2/link`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.oAuth2LinkAccount`
+     *
+     * **client:**
+     * `authClient.oauth2.link`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/generic-oauth#api-method-oauth2-link)
+     */
+    oAuth2LinkAccount: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          providerId: string;
+          callbackURL: string;
+          scopes?: string[] | undefined;
+          errorCallbackURL?: string | undefined;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call158.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          url: string;
+          redirect: boolean;
+        };
+      } : {
+        url: string;
+        redirect: boolean;
+      }>;
+      options: {
+        method: "POST";
+        body: z$1.ZodObject<{
+          providerId: z$1.ZodString;
+          callbackURL: z$1.ZodString;
+          scopes: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
+          errorCallbackURL: z$1.ZodOptional<z$1.ZodString>;
+        }, z$1.core.$strip>;
+        use: ((inputContext: better_call158.MiddlewareInputContext<better_call158.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        metadata: {
+          openapi: {
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        url: {
+                          type: string;
+                          format: string;
+                          description: string;
+                        };
+                        redirect: {
+                          type: string;
+                          description: string;
+                          enum: boolean[];
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/oauth2/link";
+    };
+  };
+  $ERROR_CODES: {
+    readonly INVALID_OAUTH_CONFIGURATION: "Invalid OAuth configuration";
+  };
+};
+//#endregion
+export { genericOAuth as n, GenericOAuthConfig as t };

package/dist/index-C-u1h_WX.d.mts

@@ -0,0 +1,174 @@
+import { g as User, h as Session } from "./index-Cxi7TbLE.mjs";
+import { GenericEndpointContext } from "@gatwech/core";
+import * as better_call37 from "better-call";
+import * as z$1 from "zod";
+
+//#region src/plugins/one-time-token/index.d.ts
+interface OneTimeTokenOptions {
+  /**
+   * Expires in minutes
+   *
+   * @default 3
+   */
+  expiresIn?: number | undefined;
+  /**
+   * Only allow server initiated requests
+   */
+  disableClientRequest?: boolean | undefined;
+  /**
+   * Generate a custom token
+   */
+  generateToken?: ((session: {
+    user: User & Record<string, any>;
+    session: Session & Record<string, any>;
+  }, ctx: GenericEndpointContext) => Promise<string>) | undefined;
+  /**
+   * This option allows you to configure how the token is stored in your database.
+   * Note: This will not affect the token that's sent, it will only affect the token stored in your database.
+   *
+   * @default "plain"
+   */
+  storeToken?: ("plain" | "hashed" | {
+    type: "custom-hasher";
+    hash: (token: string) => Promise<string>;
+  }) | undefined;
+}
+declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
+  id: "one-time-token";
+  endpoints: {
+    /**
+     * ### Endpoint
+     *
+     * GET `/one-time-token/generate`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.generateOneTimeToken`
+     *
+     * **client:**
+     * `authClient.oneTimeToken.generate`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/one-time-token#api-method-one-time-token-generate)
+     */
+    generateOneTimeToken: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call37.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          token: string;
+        };
+      } : {
+        token: string;
+      }>;
+      options: {
+        method: "GET";
+        use: ((inputContext: better_call37.MiddlewareInputContext<better_call37.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+      } & {
+        use: any[];
+      };
+      path: "/one-time-token/generate";
+    };
+    /**
+     * ### Endpoint
+     *
+     * POST `/one-time-token/verify`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.verifyOneTimeToken`
+     *
+     * **client:**
+     * `authClient.oneTimeToken.verify`
+     *
+     * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/one-time-token#api-method-one-time-token-verify)
+     */
+    verifyOneTimeToken: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          token: string;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call37.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          session: Session & Record<string, any>;
+          user: User & Record<string, any>;
+        };
+      } : {
+        session: Session & Record<string, any>;
+        user: User & Record<string, any>;
+      }>;
+      options: {
+        method: "POST";
+        body: z$1.ZodObject<{
+          token: z$1.ZodString;
+        }, z$1.core.$strip>;
+      } & {
+        use: any[];
+      };
+      path: "/one-time-token/verify";
+    };
+  };
+};
+//#endregion
+export { oneTimeToken as t };

package/dist/index-C7fQuk-V.d.mts

@@ -0,0 +1,41 @@
+import { o as LiteralString } from "./helper-tmxW3BHj.mjs";
+
+//#region src/plugins/access/types.d.ts
+type SubArray<T$1 extends unknown[] | readonly unknown[] | any[]> = T$1[number][];
+type Subset<K extends keyof R, R extends Record<string | LiteralString, readonly string[] | readonly LiteralString[]>> = { [P in K]: SubArray<R[P]> };
+type Statements = {
+  readonly [resource: string]: readonly LiteralString[];
+};
+type AccessControl<TStatements extends Statements = Statements> = ReturnType<typeof createAccessControl<TStatements>>;
+type Role<TStatements extends Statements = Record<string, any>> = {
+  authorize: (request: any, connector?: ("OR" | "AND") | undefined) => AuthorizeResponse;
+  statements: TStatements;
+};
+//#endregion
+//#region src/plugins/access/access.d.ts
+type AuthorizeResponse = {
+  success: false;
+  error: string;
+} | {
+  success: true;
+  error?: never | undefined;
+};
+declare function role<TStatements extends Statements>(statements: TStatements): {
+  authorize<K extends keyof TStatements>(request: { [key in K]?: TStatements[key] | {
+    actions: TStatements[key];
+    connector: "OR" | "AND";
+  } }, connector?: "OR" | "AND"): AuthorizeResponse;
+  statements: TStatements;
+};
+declare function createAccessControl<const TStatements extends Statements>(s: TStatements): {
+  newRole<K extends keyof TStatements>(statements: Subset<K, TStatements>): {
+    authorize<K_1 extends K>(request: K_1 extends infer T extends keyof Subset<K, TStatements> ? { [key in T]?: Subset<K, TStatements>[key] | {
+      actions: Subset<K, TStatements>[key];
+      connector: "OR" | "AND";
+    } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
+    statements: Subset<K, TStatements>;
+  };
+  statements: TStatements;
+};
+//#endregion
+export { Role as a, Subset as c, AccessControl as i, createAccessControl as n, Statements as o, role as r, SubArray as s, AuthorizeResponse as t };