@gatwech/auth 1.0.0-beta.18

package/dist/jwt-lHV4QHpD.mjs

@@ -0,0 +1,387 @@
+import { t as APIError } from "./api-0pR_I-Nx.mjs";
+import { n as symmetricEncrypt, t as symmetricDecrypt } from "./crypto-Bb42eMrH.mjs";
+import { n as mergeSchema } from "./date-Cx2yCiC4.mjs";
+import { u as sessionMiddleware } from "./session-Dgp133Yt.mjs";
+import { PayvoAuthError } from "@gatwech/core/error";
+import { createAuthEndpoint, createAuthMiddleware } from "@gatwech/core/api";
+import * as z$1 from "zod";
+import { SignJWT, exportJWK, generateKeyPair, importJWK } from "jose";
+import { base64 } from "@gatwech/utils/base64";
+import "@gatwech/utils";
+
+//#region src/plugins/jwt/adapter.ts
+const getJwksAdapter = (adapter, options) => {
+	return {
+		getAllKeys: async (ctx) => {
+			if (options?.adapter?.getJwks) return await options.adapter.getJwks(ctx);
+			return await adapter.findMany({ model: "jwks" });
+		},
+		getLatestKey: async (ctx) => {
+			if (options?.adapter?.getLatestKey) return await options.adapter.getLatestKey(ctx);
+			return (await adapter.findMany({
+				model: "jwks",
+				sortBy: {
+					field: "createdAt",
+					direction: "desc"
+				},
+				limit: 1
+			}))[0];
+		},
+		createJwk: async (ctx, webKey) => {
+			if (options?.adapter?.createJwk) return await options.adapter.createJwk(webKey, ctx);
+			return await adapter.create({
+				model: "jwks",
+				data: {
+					...webKey,
+					createdAt: /* @__PURE__ */ new Date()
+				}
+			});
+		}
+	};
+};
+
+//#endregion
+//#region src/plugins/jwt/schema.ts
+const schema = { jwks: { fields: {
+	publicKey: {
+		type: "string",
+		required: true
+	},
+	privateKey: {
+		type: "string",
+		required: true
+	},
+	createdAt: {
+		type: "date",
+		required: true
+	}
+} } };
+
+//#endregion
+//#region src/utils/time.ts
+const minute = 60;
+const hour = minute * 60;
+const day = hour * 24;
+const week = day * 7;
+const year = day * 365.25;
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+/**
+* https://github.com/panva/jose/blob/723ee6152d7ee2fc81852d2d26777e86df6fce01/src/lib/secs.ts
+*/
+function joseSecs(str) {
+	const matched = REGEX.exec(str);
+	if (!matched || matched[4] && matched[1]) throw new TypeError("Invalid time period format");
+	const value = parseFloat(matched[2]);
+	const unit = matched[3].toLowerCase();
+	let numericDate;
+	switch (unit) {
+		case "sec":
+		case "secs":
+		case "second":
+		case "seconds":
+		case "s":
+			numericDate = Math.round(value);
+			break;
+		case "minute":
+		case "minutes":
+		case "min":
+		case "mins":
+		case "m":
+			numericDate = Math.round(value * minute);
+			break;
+		case "hour":
+		case "hours":
+		case "hr":
+		case "hrs":
+		case "h":
+			numericDate = Math.round(value * hour);
+			break;
+		case "day":
+		case "days":
+		case "d":
+			numericDate = Math.round(value * day);
+			break;
+		case "week":
+		case "weeks":
+		case "w":
+			numericDate = Math.round(value * week);
+			break;
+		default:
+			numericDate = Math.round(value * year);
+			break;
+	}
+	if (matched[1] === "-" || matched[4] === "ago") return -numericDate;
+	return numericDate;
+}
+
+//#endregion
+//#region src/plugins/jwt/utils.ts
+/**
+* Converts an expirationTime to ISO seconds expiration time (the format of JWT exp)
+*
+* See https://github.com/panva/jose/blob/main/src/lib/jwt_claims_set.ts#L245
+*
+* @param expirationTime - see options.jwt.expirationTime
+* @param iat - the iat time to consolidate on
+* @returns
+*/
+function toExpJWT(expirationTime, iat) {
+	if (typeof expirationTime === "number") return expirationTime;
+	else if (expirationTime instanceof Date) return Math.floor(expirationTime.getTime() / 1e3);
+	else return iat + joseSecs(expirationTime);
+}
+async function generateExportedKeyPair(options) {
+	const { alg,...cfg } = options?.jwks?.keyPairConfig ?? {
+		alg: "EdDSA",
+		crv: "Ed25519"
+	};
+	const { publicKey, privateKey } = await generateKeyPair(alg, {
+		...cfg,
+		extractable: true
+	});
+	return {
+		publicWebKey: await exportJWK(publicKey),
+		privateWebKey: await exportJWK(privateKey),
+		alg,
+		cfg
+	};
+}
+/**
+* Creates a Jwk on the database
+*
+* @param ctx
+* @param options
+* @returns
+*/
+async function createJwk(ctx, options) {
+	const { publicWebKey, privateWebKey, alg, cfg } = await generateExportedKeyPair(options);
+	const stringifiedPrivateWebKey = JSON.stringify(privateWebKey);
+	const privateKeyEncryptionEnabled = !options?.jwks?.disablePrivateKeyEncryption;
+	let jwk = {
+		alg,
+		...cfg && "crv" in cfg ? { crv: cfg.crv } : {},
+		publicKey: JSON.stringify(publicWebKey),
+		privateKey: privateKeyEncryptionEnabled ? JSON.stringify(await symmetricEncrypt({
+			key: ctx.context.secret,
+			data: stringifiedPrivateWebKey
+		})) : stringifiedPrivateWebKey,
+		createdAt: /* @__PURE__ */ new Date()
+	};
+	return await getJwksAdapter(ctx.context.adapter, options).createJwk(ctx, jwk);
+}
+
+//#endregion
+//#region src/plugins/jwt/sign.ts
+async function signJWT(ctx, config) {
+	const { options, payload } = config;
+	const nowSeconds = Math.floor(Date.now() / 1e3);
+	const iat = payload.iat;
+	let exp = payload.exp;
+	const defaultExp = toExpJWT(options?.jwt?.expirationTime ?? "15m", iat ?? nowSeconds);
+	exp = exp ?? defaultExp;
+	const nbf = payload.nbf;
+	const iss = payload.iss;
+	const defaultIss = options?.jwt?.issuer ?? ctx.context.options.baseURL;
+	const aud = payload.aud;
+	const defaultAud = options?.jwt?.audience ?? ctx.context.options.baseURL;
+	if (options?.jwt?.sign) {
+		const jwtPayload = {
+			...payload,
+			iat,
+			exp,
+			nbf,
+			iss: iss ?? defaultIss,
+			aud: aud ?? defaultAud
+		};
+		return options.jwt.sign(jwtPayload);
+	}
+	let key = await getJwksAdapter(ctx.context.adapter, options).getLatestKey(ctx);
+	if (!key) key = await createJwk(ctx, options);
+	const privateKeyEncryptionEnabled = !options?.jwks?.disablePrivateKeyEncryption;
+	if (key === void 0) key = await createJwk(ctx, options);
+	let privateWebKey = privateKeyEncryptionEnabled ? await symmetricDecrypt({
+		key: ctx.context.secret,
+		data: JSON.parse(key.privateKey)
+	}).catch(() => {
+		throw new PayvoAuthError("Failed to decrypt private key. Make sure the secret currently in use is the same as the one used to encrypt the private key. If you are using a different secret, either clean up your JWKS or disable private key encryption.");
+	}) : key.privateKey;
+	const alg = key.alg ?? options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+	const privateKey = await importJWK(JSON.parse(privateWebKey), alg);
+	const jwt$1 = new SignJWT(payload).setProtectedHeader({
+		alg,
+		kid: key.id
+	}).setExpirationTime(exp).setIssuer(iss ?? defaultIss).setAudience(aud ?? defaultAud);
+	if (iat) jwt$1.setIssuedAt(iat);
+	if (payload.sub) jwt$1.setSubject(payload.sub);
+	if (payload.nbf) jwt$1.setNotBefore(payload.nbf);
+	if (payload.jti) jwt$1.setJti(payload.jti);
+	return await jwt$1.sign(privateKey);
+}
+async function getJwtToken(ctx, options) {
+	const payload = !options?.jwt?.definePayload ? ctx.context.session.user : await options?.jwt.definePayload(ctx.context.session);
+	return await signJWT(ctx, {
+		options,
+		payload: {
+			iat: Math.floor(Date.now() / 1e3),
+			...payload,
+			sub: await options?.jwt?.getSubject?.(ctx.context.session) ?? ctx.context.session.user.id
+		}
+	});
+}
+
+//#endregion
+//#region src/plugins/jwt/index.ts
+const jwt = (options) => {
+	if (options?.jwt?.sign && !options.jwks?.remoteUrl) throw new PayvoAuthError("jwks_config", "jwks.remoteUrl must be set when using jwt.sign");
+	if (options?.jwks?.remoteUrl && !options.jwks?.keyPairConfig?.alg) throw new PayvoAuthError("jwks_config", "must specify alg when using the oidc plugin and jwks.remoteUrl");
+	return {
+		id: "jwt",
+		options,
+		endpoints: {
+			getJwks: createAuthEndpoint("/jwks", {
+				method: "GET",
+				metadata: { openapi: {
+					description: "Get the JSON Web Key Set",
+					responses: { "200": {
+						description: "JSON Web Key Set retrieved successfully",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { keys: {
+								type: "array",
+								description: "Array of public JSON Web Keys",
+								items: {
+									type: "object",
+									properties: {
+										kid: {
+											type: "string",
+											description: "Key ID uniquely identifying the key, corresponds to the 'id' from the stored Jwk"
+										},
+										kty: {
+											type: "string",
+											description: "Key type (e.g., 'RSA', 'EC', 'OKP')"
+										},
+										alg: {
+											type: "string",
+											description: "Algorithm intended for use with the key (e.g., 'EdDSA', 'RS256')"
+										},
+										use: {
+											type: "string",
+											description: "Intended use of the public key (e.g., 'sig' for signature)",
+											enum: ["sig"],
+											nullable: true
+										},
+										n: {
+											type: "string",
+											description: "Modulus for RSA keys (base64url-encoded)",
+											nullable: true
+										},
+										e: {
+											type: "string",
+											description: "Exponent for RSA keys (base64url-encoded)",
+											nullable: true
+										},
+										crv: {
+											type: "string",
+											description: "Curve name for elliptic curve keys (e.g., 'Ed25519', 'P-256')",
+											nullable: true
+										},
+										x: {
+											type: "string",
+											description: "X coordinate for elliptic curve keys (base64url-encoded)",
+											nullable: true
+										},
+										y: {
+											type: "string",
+											description: "Y coordinate for elliptic curve keys (base64url-encoded)",
+											nullable: true
+										}
+									},
+									required: [
+										"kid",
+										"kty",
+										"alg"
+									]
+								}
+							} },
+							required: ["keys"]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (options?.jwks?.remoteUrl) throw new APIError("NOT_FOUND");
+				let keySets = await getJwksAdapter(ctx.context.adapter).getAllKeys(ctx);
+				if (!keySets || keySets?.length === 0) keySets = [await createJwk(ctx, options)];
+				if (!keySets?.length) throw new PayvoAuthError("No key sets found. Make sure you have a key in your database.");
+				const keyPairConfig = options?.jwks?.keyPairConfig;
+				const defaultCrv = keyPairConfig ? "crv" in keyPairConfig ? keyPairConfig.crv : void 0 : void 0;
+				return ctx.json({ keys: keySets.map((keySet) => {
+					return {
+						alg: keySet.alg ?? options?.jwks?.keyPairConfig?.alg ?? "EdDSA",
+						crv: keySet.crv ?? defaultCrv,
+						...JSON.parse(keySet.publicKey),
+						kid: keySet.id
+					};
+				}) });
+			}),
+			getToken: createAuthEndpoint("/token", {
+				method: "GET",
+				requireHeaders: true,
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					description: "Get a JWT token",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { token: { type: "string" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const jwt$1 = await getJwtToken(ctx, options);
+				return ctx.json({ token: jwt$1 });
+			}),
+			signJWT: createAuthEndpoint("/sign-jwt", {
+				method: "POST",
+				metadata: {
+					SERVER_ONLY: true,
+					$Infer: { body: {} }
+				},
+				body: z$1.object({
+					payload: z$1.record(z$1.string(), z$1.any()),
+					overrideOptions: z$1.record(z$1.string(), z$1.any()).optional()
+				})
+			}, async (c) => {
+				const jwt$1 = await signJWT(c, {
+					options: {
+						...options,
+						...c.body.overrideOptions
+					},
+					payload: c.body.payload
+				});
+				return c.json({ token: jwt$1 });
+			})
+		},
+		hooks: { after: [{
+			matcher(context) {
+				return context.path === "/get-session";
+			},
+			handler: createAuthMiddleware(async (ctx) => {
+				if (options?.disableSettingJwtHeader) return;
+				const session = ctx.context.session || ctx.context.newSession;
+				if (session && session.session) {
+					const jwt$1 = await getJwtToken(ctx, options);
+					const exposedHeaders = ctx.context.responseHeaders?.get("access-control-expose-headers") || "";
+					const headersSet = new Set(exposedHeaders.split(",").map((header) => header.trim()).filter(Boolean));
+					headersSet.add("set-auth-jwt");
+					ctx.setHeader("set-auth-jwt", jwt$1);
+					ctx.setHeader("Access-Control-Expose-Headers", Array.from(headersSet).join(", "));
+				}
+			})
+		}] },
+		schema: mergeSchema(schema, options?.schema)
+	};
+};
+
+//#endregion
+export { generateExportedKeyPair as i, getJwtToken as n, createJwk as r, jwt as t };

package/dist/kysely-adapter-DpzYO8Yf.mjs

@@ -0,0 +1,181 @@
+import { t as createAdapterFactory } from "./adapter-factory-BZ2Qiqpn.mjs";
+import "kysely";
+
+//#region src/adapters/kysely-adapter/kysely-adapter.ts
+const kyselyAdapter = (db, config) => {
+	let lazyOptions = null;
+	const createCustomAdapter = (db$1) => {
+		return ({ getFieldName }) => {
+			const withReturning = async (values, builder, model, where) => {
+				let res;
+				if (config?.type === "mysql") {
+					await builder.execute();
+					const field = values.id ? "id" : where.length > 0 && where[0]?.field ? where[0].field : "id";
+					if (!values.id && where.length === 0) {
+						res = await db$1.selectFrom(model).selectAll().orderBy(getFieldName({
+							model,
+							field
+						}), "desc").limit(1).executeTakeFirst();
+						return res;
+					}
+					const value = values[field] || where[0]?.value;
+					res = await db$1.selectFrom(model).selectAll().orderBy(getFieldName({
+						model,
+						field
+					}), "desc").where(getFieldName({
+						model,
+						field
+					}), "=", value).limit(1).executeTakeFirst();
+					return res;
+				}
+				if (config?.type === "mssql") {
+					res = await builder.outputAll("inserted").executeTakeFirst();
+					return res;
+				}
+				res = await builder.returningAll().executeTakeFirst();
+				return res;
+			};
+			function convertWhereClause(model, w) {
+				if (!w) return {
+					and: null,
+					or: null
+				};
+				const conditions = {
+					and: [],
+					or: []
+				};
+				w.forEach((condition) => {
+					let { field: _field, value: _value, operator = "=", connector = "AND" } = condition;
+					let value = _value;
+					let field = getFieldName({
+						model,
+						field: _field
+					});
+					const expr = (eb) => {
+						if (operator.toLowerCase() === "in") return eb(field, "in", Array.isArray(value) ? value : [value]);
+						if (operator.toLowerCase() === "not_in") return eb(field, "not in", Array.isArray(value) ? value : [value]);
+						if (operator === "contains") return eb(field, "like", `%${value}%`);
+						if (operator === "starts_with") return eb(field, "like", `${value}%`);
+						if (operator === "ends_with") return eb(field, "like", `%${value}`);
+						if (operator === "eq") return eb(field, "=", value);
+						if (operator === "ne") return eb(field, "<>", value);
+						if (operator === "gt") return eb(field, ">", value);
+						if (operator === "gte") return eb(field, ">=", value);
+						if (operator === "lt") return eb(field, "<", value);
+						if (operator === "lte") return eb(field, "<=", value);
+						return eb(field, operator, value);
+					};
+					if (connector === "OR") conditions.or.push(expr);
+					else conditions.and.push(expr);
+				});
+				return {
+					and: conditions.and.length ? conditions.and : null,
+					or: conditions.or.length ? conditions.or : null
+				};
+			}
+			return {
+				async create({ data, model }) {
+					return await withReturning(data, db$1.insertInto(model).values(data), model, []);
+				},
+				async findOne({ model, where, select }) {
+					const { and, or } = convertWhereClause(model, where);
+					let query = db$1.selectFrom(model).selectAll();
+					if (and) query = query.where((eb) => eb.and(and.map((expr) => expr(eb))));
+					if (or) query = query.where((eb) => eb.or(or.map((expr) => expr(eb))));
+					const res = await query.executeTakeFirst();
+					if (!res) return null;
+					return res;
+				},
+				async findMany({ model, where, limit, offset, sortBy }) {
+					const { and, or } = convertWhereClause(model, where);
+					let query = db$1.selectFrom(model);
+					if (and) query = query.where((eb) => eb.and(and.map((expr) => expr(eb))));
+					if (or) query = query.where((eb) => eb.or(or.map((expr) => expr(eb))));
+					if (config?.type === "mssql") {
+						if (!offset) query = query.top(limit || 100);
+					} else query = query.limit(limit || 100);
+					if (sortBy) query = query.orderBy(getFieldName({
+						model,
+						field: sortBy.field
+					}), sortBy.direction);
+					if (offset) if (config?.type === "mssql") {
+						if (!sortBy) query = query.orderBy(getFieldName({
+							model,
+							field: "id"
+						}));
+						query = query.offset(offset).fetch(limit || 100);
+					} else query = query.offset(offset);
+					const res = await query.selectAll().execute();
+					if (!res) return [];
+					return res;
+				},
+				async update({ model, where, update: values }) {
+					const { and, or } = convertWhereClause(model, where);
+					let query = db$1.updateTable(model).set(values);
+					if (and) query = query.where((eb) => eb.and(and.map((expr) => expr(eb))));
+					if (or) query = query.where((eb) => eb.or(or.map((expr) => expr(eb))));
+					return await withReturning(values, query, model, where);
+				},
+				async updateMany({ model, where, update: values }) {
+					const { and, or } = convertWhereClause(model, where);
+					let query = db$1.updateTable(model).set(values);
+					if (and) query = query.where((eb) => eb.and(and.map((expr) => expr(eb))));
+					if (or) query = query.where((eb) => eb.or(or.map((expr) => expr(eb))));
+					return (await query.execute()).length;
+				},
+				async count({ model, where }) {
+					const { and, or } = convertWhereClause(model, where);
+					let query = db$1.selectFrom(model).select(db$1.fn.count("id").as("count"));
+					if (and) query = query.where((eb) => eb.and(and.map((expr) => expr(eb))));
+					if (or) query = query.where((eb) => eb.or(or.map((expr) => expr(eb))));
+					const res = await query.execute();
+					if (typeof res[0].count === "number") return res[0].count;
+					if (typeof res[0].count === "bigint") return Number(res[0].count);
+					return parseInt(res[0].count);
+				},
+				async delete({ model, where }) {
+					const { and, or } = convertWhereClause(model, where);
+					let query = db$1.deleteFrom(model);
+					if (and) query = query.where((eb) => eb.and(and.map((expr) => expr(eb))));
+					if (or) query = query.where((eb) => eb.or(or.map((expr) => expr(eb))));
+					await query.execute();
+				},
+				async deleteMany({ model, where }) {
+					const { and, or } = convertWhereClause(model, where);
+					let query = db$1.deleteFrom(model);
+					if (and) query = query.where((eb) => eb.and(and.map((expr) => expr(eb))));
+					if (or) query = query.where((eb) => eb.or(or.map((expr) => expr(eb))));
+					return (await query.execute()).length;
+				},
+				options: config
+			};
+		};
+	};
+	let adapterOptions = null;
+	adapterOptions = {
+		config: {
+			adapterId: "kysely",
+			adapterName: "Kysely Adapter",
+			usePlural: config?.usePlural,
+			debugLogs: config?.debugLogs,
+			supportsBooleans: config?.type === "sqlite" || config?.type === "mssql" || config?.type === "mysql" || !config?.type ? false : true,
+			supportsDates: config?.type === "sqlite" || config?.type === "mssql" || !config?.type ? false : true,
+			supportsJSON: false,
+			transaction: config?.transaction ?? false ? (cb) => db.transaction().execute((trx) => {
+				return cb(createAdapterFactory({
+					config: adapterOptions.config,
+					adapter: createCustomAdapter(trx)
+				})(lazyOptions));
+			}) : false
+		},
+		adapter: createCustomAdapter(db)
+	};
+	const adapter = createAdapterFactory(adapterOptions);
+	return (options) => {
+		lazyOptions = options;
+		return adapter(options);
+	};
+};
+
+//#endregion
+export { kyselyAdapter as t };