@gatwech/auth 1.0.0-beta.18

package/dist/magic-link-Bk-ueorR.mjs

@@ -0,0 +1,176 @@
+import { R as originCheck } from "./api-0pR_I-Nx.mjs";
+import { r as generateRandomString } from "./crypto-Bb42eMrH.mjs";
+import { c as setSessionCookie } from "./cookies-cJObLwn1.mjs";
+import { BASE_ERROR_CODES } from "@gatwech/core/error";
+import { APIError } from "better-call";
+import { createAuthEndpoint } from "@gatwech/core/api";
+import * as z$1 from "zod";
+import { createHash } from "@gatwech/utils/hash";
+import { base64Url } from "@gatwech/utils/base64";
+
+//#region src/plugins/magic-link/utils.ts
+const defaultKeyHasher = async (otp) => {
+	const hash = await createHash("SHA-256", "none").digest(new TextEncoder().encode(otp));
+	return base64Url.encode(new Uint8Array(hash), { padding: false });
+};
+
+//#endregion
+//#region src/plugins/magic-link/index.ts
+const magicLink = (options) => {
+	const opts = {
+		storeToken: "plain",
+		...options
+	};
+	async function storeToken(ctx, token) {
+		if (opts.storeToken === "hashed") return await defaultKeyHasher(token);
+		if (typeof opts.storeToken === "object" && "type" in opts.storeToken && opts.storeToken.type === "custom-hasher") return await opts.storeToken.hash(token);
+		return token;
+	}
+	return {
+		id: "magic-link",
+		endpoints: {
+			signInMagicLink: createAuthEndpoint("/sign-in/magic-link", {
+				method: "POST",
+				requireHeaders: true,
+				body: z$1.object({
+					email: z$1.string().meta({ description: "Email address to send the magic link" }).email(),
+					name: z$1.string().meta({ description: "User display name. Only used if the user is registering for the first time. Eg: \"my-name\"" }).optional(),
+					callbackURL: z$1.string().meta({ description: "URL to redirect after magic link verification" }).optional(),
+					newUserCallbackURL: z$1.string().meta({ description: "URL to redirect after new user signup. Only used if the user is registering for the first time." }).optional(),
+					errorCallbackURL: z$1.string().meta({ description: "URL to redirect after error." }).optional()
+				}),
+				metadata: { openapi: {
+					description: "Sign in with magic link",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: { type: "boolean" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const { email } = ctx.body;
+				if (opts.disableSignUp) {
+					if (!await ctx.context.internalAdapter.findUserByEmail(email)) throw new APIError("BAD_REQUEST", { message: BASE_ERROR_CODES.USER_NOT_FOUND });
+				}
+				const verificationToken = opts?.generateToken ? await opts.generateToken(email) : generateRandomString(32, "a-z", "A-Z");
+				const storedToken = await storeToken(ctx, verificationToken);
+				await ctx.context.internalAdapter.createVerificationValue({
+					identifier: storedToken,
+					value: JSON.stringify({
+						email,
+						name: ctx.body.name
+					}),
+					expiresAt: new Date(Date.now() + (opts.expiresIn || 300) * 1e3)
+				});
+				const realBaseURL = new URL(ctx.context.baseURL);
+				const pathname = realBaseURL.pathname === "/" ? "" : realBaseURL.pathname;
+				const basePath = pathname ? "" : ctx.context.options.basePath || "";
+				const url = new URL(`${pathname}${basePath}/magic-link/verify`, realBaseURL.origin);
+				url.searchParams.set("token", verificationToken);
+				url.searchParams.set("callbackURL", ctx.body.callbackURL || "/");
+				if (ctx.body.newUserCallbackURL) url.searchParams.set("newUserCallbackURL", ctx.body.newUserCallbackURL);
+				if (ctx.body.errorCallbackURL) url.searchParams.set("errorCallbackURL", ctx.body.errorCallbackURL);
+				await options.sendMagicLink({
+					email,
+					url: url.toString(),
+					token: verificationToken
+				}, ctx.request);
+				return ctx.json({ status: true });
+			}),
+			magicLinkVerify: createAuthEndpoint("/magic-link/verify", {
+				method: "GET",
+				query: z$1.object({
+					token: z$1.string().meta({ description: "Verification token" }),
+					callbackURL: z$1.string().meta({ description: "URL to redirect after magic link verification, if not provided the user will be redirected to the root URL. Eg: \"/dashboard\"" }).optional(),
+					errorCallbackURL: z$1.string().meta({ description: "URL to redirect after error." }).optional(),
+					newUserCallbackURL: z$1.string().meta({ description: "URL to redirect after new user signup. Only used if the user is registering for the first time." }).optional()
+				}),
+				use: [
+					originCheck((ctx) => {
+						return ctx.query.callbackURL ? decodeURIComponent(ctx.query.callbackURL) : "/";
+					}),
+					originCheck((ctx) => {
+						return ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : "/";
+					}),
+					originCheck((ctx) => {
+						return ctx.query.errorCallbackURL ? decodeURIComponent(ctx.query.errorCallbackURL) : "/";
+					})
+				],
+				requireHeaders: true,
+				metadata: { openapi: {
+					description: "Verify magic link",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								session: { $ref: "#/components/schemas/Session" },
+								user: { $ref: "#/components/schemas/User" }
+							}
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const token = ctx.query.token;
+				const callbackURL = new URL(ctx.query.callbackURL ? decodeURIComponent(ctx.query.callbackURL) : "/", ctx.context.baseURL).toString();
+				const errorCallbackURL = new URL(ctx.query.errorCallbackURL ? decodeURIComponent(ctx.query.errorCallbackURL) : callbackURL, ctx.context.baseURL).toString();
+				const newUserCallbackURL = new URL(ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : callbackURL, ctx.context.baseURL).toString();
+				callbackURL?.startsWith("http") || (callbackURL ? `${ctx.context.options.baseURL}${callbackURL}` : ctx.context.options.baseURL);
+				const storedToken = await storeToken(ctx, token);
+				const tokenValue = await ctx.context.internalAdapter.findVerificationValue(storedToken);
+				if (!tokenValue) throw ctx.redirect(`${errorCallbackURL}?error=INVALID_TOKEN`);
+				if (tokenValue.expiresAt < /* @__PURE__ */ new Date()) {
+					await ctx.context.internalAdapter.deleteVerificationValue(tokenValue.id);
+					throw ctx.redirect(`${errorCallbackURL}?error=EXPIRED_TOKEN`);
+				}
+				await ctx.context.internalAdapter.deleteVerificationValue(tokenValue.id);
+				const { email, name } = JSON.parse(tokenValue.value);
+				let isNewUser = false;
+				let user = await ctx.context.internalAdapter.findUserByEmail(email).then((res) => res?.user);
+				if (!user) if (!opts.disableSignUp) {
+					const newUser = await ctx.context.internalAdapter.createUser({
+						email,
+						emailVerified: true,
+						name: name || ""
+					});
+					isNewUser = true;
+					user = newUser;
+					if (!user) throw ctx.redirect(`${errorCallbackURL}?error=failed_to_create_user`);
+				} else throw ctx.redirect(`${errorCallbackURL}?error=new_user_signup_disabled`);
+				if (!user.emailVerified) await ctx.context.internalAdapter.updateUser(user.id, { emailVerified: true });
+				const session = await ctx.context.internalAdapter.createSession(user.id);
+				if (!session) throw ctx.redirect(`${errorCallbackURL}?error=failed_to_create_session`);
+				await setSessionCookie(ctx, {
+					session,
+					user
+				});
+				if (!ctx.query.callbackURL) return ctx.json({
+					token: session.token,
+					user: {
+						id: user.id,
+						email: user.email,
+						emailVerified: user.emailVerified,
+						name: user.name,
+						image: user.image,
+						createdAt: user.createdAt,
+						updatedAt: user.updatedAt
+					}
+				});
+				if (isNewUser) throw ctx.redirect(newUserCallbackURL);
+				throw ctx.redirect(callbackURL);
+			})
+		},
+		rateLimit: [{
+			pathMatcher(path) {
+				return path.startsWith("/sign-in/magic-link") || path.startsWith("/magic-link/verify");
+			},
+			window: opts.rateLimit?.window || 60,
+			max: opts.rateLimit?.max || 5
+		}]
+	};
+};
+
+//#endregion
+export { magicLink as t };

package/dist/misc-beA1w3XV.mjs

@@ -0,0 +1,7 @@
+//#region src/utils/misc.ts
+function capitalizeFirstLetter(str) {
+	return str.charAt(0).toUpperCase() + str.slice(1);
+}
+
+//#endregion
+export { capitalizeFirstLetter as t };

package/dist/multi-session-DRrLKrg9.mjs

@@ -0,0 +1,144 @@
+import { t as APIError } from "./api-0pR_I-Nx.mjs";
+import { c as setSessionCookie, l as parseSetCookieHeader, n as deleteSessionCookie, o as parseCookies } from "./cookies-cJObLwn1.mjs";
+import { u as sessionMiddleware } from "./session-Dgp133Yt.mjs";
+import { defineErrorCodes } from "@gatwech/core/utils";
+import { createAuthEndpoint, createAuthMiddleware } from "@gatwech/core/api";
+import * as z$1 from "zod";
+
+//#region src/plugins/multi-session/index.ts
+const ERROR_CODES = defineErrorCodes({ INVALID_SESSION_TOKEN: "Invalid session token" });
+const multiSession = (options) => {
+	const opts = {
+		maximumSessions: 5,
+		...options
+	};
+	const isMultiSessionCookie = (key) => key.includes("_multi-");
+	return {
+		id: "multi-session",
+		endpoints: {
+			listDeviceSessions: createAuthEndpoint("/multi-session/list-device-sessions", {
+				method: "GET",
+				requireHeaders: true
+			}, async (ctx) => {
+				const cookieHeader = ctx.headers?.get("cookie");
+				if (!cookieHeader) return ctx.json([]);
+				const cookies = Object.fromEntries(parseCookies(cookieHeader));
+				const sessionTokens = (await Promise.all(Object.entries(cookies).filter(([key]) => isMultiSessionCookie(key)).map(async ([key]) => await ctx.getSignedCookie(key, ctx.context.secret)))).filter((v) => v !== null);
+				if (!sessionTokens.length) return ctx.json([]);
+				const uniqueUserSessions = (await ctx.context.internalAdapter.findSessions(sessionTokens)).filter((session) => session && session.session.expiresAt > /* @__PURE__ */ new Date()).reduce((acc, session) => {
+					if (!acc.find((s) => s.user.id === session.user.id)) acc.push(session);
+					return acc;
+				}, []);
+				return ctx.json(uniqueUserSessions);
+			}),
+			setActiveSession: createAuthEndpoint("/multi-session/set-active", {
+				method: "POST",
+				body: z$1.object({ sessionToken: z$1.string().meta({ description: "The session token to set as active" }) }),
+				requireHeaders: true,
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					description: "Set the active session",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { session: { $ref: "#/components/schemas/Session" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const sessionToken = ctx.body.sessionToken;
+				const multiSessionCookieName = `${ctx.context.authCookies.sessionToken.name}_multi-${sessionToken.toLowerCase()}`;
+				if (!await ctx.getSignedCookie(multiSessionCookieName, ctx.context.secret)) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.INVALID_SESSION_TOKEN });
+				const session = await ctx.context.internalAdapter.findSession(sessionToken);
+				if (!session || session.session.expiresAt < /* @__PURE__ */ new Date()) {
+					ctx.setCookie(multiSessionCookieName, "", {
+						...ctx.context.authCookies.sessionToken.options,
+						maxAge: 0
+					});
+					throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.INVALID_SESSION_TOKEN });
+				}
+				await setSessionCookie(ctx, session);
+				return ctx.json(session);
+			}),
+			revokeDeviceSession: createAuthEndpoint("/multi-session/revoke", {
+				method: "POST",
+				body: z$1.object({ sessionToken: z$1.string().meta({ description: "The session token to revoke" }) }),
+				requireHeaders: true,
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					description: "Revoke a device session",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: { type: "boolean" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const sessionToken = ctx.body.sessionToken;
+				const multiSessionCookieName = `${ctx.context.authCookies.sessionToken.name}_multi-${sessionToken.toLowerCase()}`;
+				if (!await ctx.getSignedCookie(multiSessionCookieName, ctx.context.secret)) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.INVALID_SESSION_TOKEN });
+				await ctx.context.internalAdapter.deleteSession(sessionToken);
+				ctx.setCookie(multiSessionCookieName, "", {
+					...ctx.context.authCookies.sessionToken.options,
+					maxAge: 0
+				});
+				if (!(ctx.context.session?.session.token === sessionToken)) return ctx.json({ status: true });
+				const cookieHeader = ctx.headers?.get("cookie");
+				if (cookieHeader) {
+					const cookies = Object.fromEntries(parseCookies(cookieHeader));
+					const sessionTokens = (await Promise.all(Object.entries(cookies).filter(([key]) => isMultiSessionCookie(key)).map(async ([key]) => await ctx.getSignedCookie(key, ctx.context.secret)))).filter((v) => v !== void 0);
+					const internalAdapter = ctx.context.internalAdapter;
+					if (sessionTokens.length > 0) {
+						const validSessions = (await internalAdapter.findSessions(sessionTokens)).filter((session) => session && session.session.expiresAt > /* @__PURE__ */ new Date());
+						if (validSessions.length > 0) {
+							const nextSession = validSessions[0];
+							await setSessionCookie(ctx, nextSession);
+						} else deleteSessionCookie(ctx);
+					} else deleteSessionCookie(ctx);
+				} else deleteSessionCookie(ctx);
+				return ctx.json({ status: true });
+			})
+		},
+		hooks: { after: [{
+			matcher: () => true,
+			handler: createAuthMiddleware(async (ctx) => {
+				const cookieString = ctx.context.responseHeaders?.get("set-cookie");
+				if (!cookieString) return;
+				const setCookies = parseSetCookieHeader(cookieString);
+				const sessionCookieConfig = ctx.context.authCookies.sessionToken;
+				const sessionToken = ctx.context.newSession?.session.token;
+				if (!sessionToken) return;
+				const cookies = parseCookies(ctx.headers?.get("cookie") || "");
+				const cookieName = `${sessionCookieConfig.name}_multi-${sessionToken.toLowerCase()}`;
+				if (setCookies.get(cookieName) || cookies.get(cookieName)) return;
+				if (Object.keys(Object.fromEntries(cookies)).filter(isMultiSessionCookie).length + (cookieString.includes("session_token") ? 1 : 0) >= opts.maximumSessions) return;
+				await ctx.setSignedCookie(cookieName, sessionToken, ctx.context.secret, sessionCookieConfig.options);
+			})
+		}, {
+			matcher: (context) => context.path === "/sign-out",
+			handler: createAuthMiddleware(async (ctx) => {
+				const cookieHeader = ctx.headers?.get("cookie");
+				if (!cookieHeader) return;
+				const cookies = Object.fromEntries(parseCookies(cookieHeader));
+				const ids = Object.keys(cookies).map((key) => {
+					if (isMultiSessionCookie(key)) {
+						ctx.setCookie(key.toLowerCase().replace("__secure-", "__Secure-"), "", {
+							...ctx.context.authCookies.sessionToken.options,
+							maxAge: 0
+						});
+						return cookies[key].split(".")[0];
+					}
+					return null;
+				}).filter((v) => v !== null);
+				await ctx.context.internalAdapter.deleteSessions(ids);
+			})
+		}] },
+		$ERROR_CODES: ERROR_CODES
+	};
+};
+
+//#endregion
+export { multiSession as t };

package/dist/node-sqlite-dialect-BcKxBQnm.mjs

@@ -0,0 +1,155 @@
+import { CompiledQuery, DEFAULT_MIGRATION_LOCK_TABLE, DEFAULT_MIGRATION_TABLE, DefaultQueryCompiler, Kysely, sql } from "kysely";
+
+//#region src/adapters/kysely-adapter/node-sqlite-dialect.ts
+var NodeSqliteAdapter = class {
+	get supportsCreateIfNotExists() {
+		return true;
+	}
+	get supportsTransactionalDdl() {
+		return false;
+	}
+	get supportsReturning() {
+		return true;
+	}
+	async acquireMigrationLock() {}
+	async releaseMigrationLock() {}
+	get supportsOutput() {
+		return true;
+	}
+};
+var NodeSqliteDriver = class {
+	#config;
+	#connectionMutex = new ConnectionMutex();
+	#db;
+	#connection;
+	constructor(config) {
+		this.#config = { ...config };
+	}
+	async init() {
+		this.#db = this.#config.database;
+		this.#connection = new NodeSqliteConnection(this.#db);
+		if (this.#config.onCreateConnection) await this.#config.onCreateConnection(this.#connection);
+	}
+	async acquireConnection() {
+		await this.#connectionMutex.lock();
+		return this.#connection;
+	}
+	async beginTransaction(connection) {
+		await connection.executeQuery(CompiledQuery.raw("begin"));
+	}
+	async commitTransaction(connection) {
+		await connection.executeQuery(CompiledQuery.raw("commit"));
+	}
+	async rollbackTransaction(connection) {
+		await connection.executeQuery(CompiledQuery.raw("rollback"));
+	}
+	async releaseConnection() {
+		this.#connectionMutex.unlock();
+	}
+	async destroy() {
+		this.#db?.close();
+	}
+};
+var NodeSqliteConnection = class {
+	#db;
+	constructor(db) {
+		this.#db = db;
+	}
+	executeQuery(compiledQuery) {
+		const { sql: sql$1, parameters } = compiledQuery;
+		const rows = this.#db.prepare(sql$1).all(...parameters);
+		return Promise.resolve({ rows });
+	}
+	async *streamQuery() {
+		throw new Error("Streaming query is not supported by SQLite driver.");
+	}
+};
+var ConnectionMutex = class {
+	#promise;
+	#resolve;
+	async lock() {
+		while (this.#promise) await this.#promise;
+		this.#promise = new Promise((resolve) => {
+			this.#resolve = resolve;
+		});
+	}
+	unlock() {
+		const resolve = this.#resolve;
+		this.#promise = void 0;
+		this.#resolve = void 0;
+		resolve?.();
+	}
+};
+var NodeSqliteIntrospector = class {
+	#db;
+	constructor(db) {
+		this.#db = db;
+	}
+	async getSchemas() {
+		return [];
+	}
+	async getTables(options = { withInternalKyselyTables: false }) {
+		let query = this.#db.selectFrom("sqlite_schema").where("type", "=", "table").where("name", "not like", "sqlite_%").select("name").$castTo();
+		if (!options.withInternalKyselyTables) query = query.where("name", "!=", DEFAULT_MIGRATION_TABLE).where("name", "!=", DEFAULT_MIGRATION_LOCK_TABLE);
+		const tables = await query.execute();
+		return Promise.all(tables.map(({ name }) => this.#getTableMetadata(name)));
+	}
+	async getMetadata(options) {
+		return { tables: await this.getTables(options) };
+	}
+	async #getTableMetadata(table) {
+		const db = this.#db;
+		const autoIncrementCol = (await db.selectFrom("sqlite_master").where("name", "=", table).select("sql").$castTo().execute())[0]?.sql?.split(/[\(\),]/)?.find((it) => it.toLowerCase().includes("autoincrement"))?.split(/\s+/)?.[0]?.replace(/["`]/g, "");
+		return {
+			name: table,
+			columns: (await db.selectFrom(sql`pragma_table_info(${table})`.as("table_info")).select([
+				"name",
+				"type",
+				"notnull",
+				"dflt_value"
+			]).execute()).map((col) => ({
+				name: col.name,
+				dataType: col.type,
+				isNullable: !col.notnull,
+				isAutoIncrementing: col.name === autoIncrementCol,
+				hasDefaultValue: col.dflt_value != null
+			})),
+			isView: true
+		};
+	}
+};
+var NodeSqliteQueryCompiler = class extends DefaultQueryCompiler {
+	getCurrentParameterPlaceholder() {
+		return "?";
+	}
+	getLeftIdentifierWrapper() {
+		return "\"";
+	}
+	getRightIdentifierWrapper() {
+		return "\"";
+	}
+	getAutoIncrement() {
+		return "autoincrement";
+	}
+};
+var NodeSqliteDialect = class {
+	#config;
+	constructor(config) {
+		this.#config = { ...config };
+	}
+	createDriver() {
+		return new NodeSqliteDriver(this.#config);
+	}
+	createQueryCompiler() {
+		return new NodeSqliteQueryCompiler();
+	}
+	createAdapter() {
+		return new NodeSqliteAdapter();
+	}
+	createIntrospector(db) {
+		return new NodeSqliteIntrospector(db);
+	}
+};
+
+//#endregion
+export { NodeSqliteAdapter, NodeSqliteDialect, NodeSqliteDriver, NodeSqliteIntrospector, NodeSqliteQueryCompiler };

package/dist/oauth-proxy-D1sWh9B_.mjs

@@ -0,0 +1,133 @@
+import { r as getOrigin } from "./url-VB2gAbTI.mjs";
+import { R as originCheck } from "./api-0pR_I-Nx.mjs";
+import { n as symmetricEncrypt, t as symmetricDecrypt } from "./crypto-Bb42eMrH.mjs";
+import { env } from "@gatwech/core/env";
+import { createAuthEndpoint, createAuthMiddleware } from "@gatwech/core/api";
+import * as z$1 from "zod";
+
+//#region src/plugins/oauth-proxy/index.ts
+function getVenderBaseURL() {
+	const vercel = env.VERCEL_URL ? `https://${env.VERCEL_URL}` : void 0;
+	const netlify = env.NETLIFY_URL;
+	const render = env.RENDER_URL;
+	const aws = env.AWS_LAMBDA_FUNCTION_NAME;
+	const google = env.GOOGLE_CLOUD_FUNCTION_NAME;
+	const azure = env.AZURE_FUNCTION_NAME;
+	return vercel || netlify || render || aws || google || azure;
+}
+/**
+* A proxy plugin, that allows you to proxy OAuth requests.
+* Useful for development and preview deployments where
+* the redirect URL can't be known in advance to add to the OAuth provider.
+*/
+const oAuthProxy = (opts) => {
+	const resolveCurrentURL = (ctx) => {
+		return new URL(opts?.currentURL || ctx.request?.url || getVenderBaseURL() || ctx.context.baseURL);
+	};
+	const checkSkipProxy = (ctx) => {
+		if (ctx.request?.headers.get("x-skip-oauth-proxy")) return true;
+		if ((opts?.productionURL || env.PAYVO_AUTH_URL) === ctx.context.options.baseURL) return true;
+		return false;
+	};
+	return {
+		id: "oauth-proxy",
+		options: opts,
+		endpoints: { oAuthProxy: createAuthEndpoint("/oauth-proxy-callback", {
+			method: "GET",
+			query: z$1.object({
+				callbackURL: z$1.string().meta({ description: "The URL to redirect to after the proxy" }),
+				cookies: z$1.string().meta({ description: "The cookies to set after the proxy" })
+			}),
+			use: [originCheck((ctx) => ctx.query.callbackURL)],
+			metadata: { openapi: {
+				description: "OAuth Proxy Callback",
+				parameters: [{
+					in: "query",
+					name: "callbackURL",
+					required: true,
+					description: "The URL to redirect to after the proxy"
+				}, {
+					in: "query",
+					name: "cookies",
+					required: true,
+					description: "The cookies to set after the proxy"
+				}],
+				responses: { 302: {
+					description: "Redirect",
+					headers: { Location: {
+						description: "The URL to redirect to",
+						schema: { type: "string" }
+					} }
+				} }
+			} }
+		}, async (ctx) => {
+			const cookies = ctx.query.cookies;
+			const decryptedCookies = await symmetricDecrypt({
+				key: ctx.context.secret,
+				data: cookies
+			}).catch((e) => {
+				ctx.context.logger.error(e);
+				return null;
+			});
+			const error = ctx.context.options.onAPIError?.errorURL || `${ctx.context.options.baseURL}/api/auth/error`;
+			if (!decryptedCookies) throw ctx.redirect(`${error}?error=OAuthProxy - Invalid cookies or secret`);
+			const isSecureContext = resolveCurrentURL(ctx).protocol === "https:";
+			const prefix = ctx.context.options.advanced?.cookiePrefix || "payvo-auth";
+			const cookieToSet = isSecureContext ? decryptedCookies : decryptedCookies.replace("Secure;", "").replace(`__Secure-${prefix}`, prefix);
+			ctx.setHeader("set-cookie", cookieToSet);
+			throw ctx.redirect(ctx.query.callbackURL);
+		}) },
+		hooks: {
+			after: [{
+				matcher(context) {
+					return !!(context.path?.startsWith("/callback") || context.path?.startsWith("/oauth2/callback"));
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const headers = ctx.context.responseHeaders;
+					const location = headers?.get("location");
+					if (location?.includes("/oauth-proxy-callback?callbackURL")) {
+						if (!location.startsWith("http")) return;
+						const locationURL = new URL(location);
+						if (locationURL.origin === getOrigin(opts?.productionURL || ctx.context.options.baseURL || ctx.context.baseURL)) {
+							const newLocation = locationURL.searchParams.get("callbackURL");
+							if (!newLocation) return;
+							ctx.setHeader("location", newLocation);
+							return;
+						}
+						const setCookies = headers?.get("set-cookie");
+						if (!setCookies) return;
+						const encryptedCookies = await symmetricEncrypt({
+							key: ctx.context.secret,
+							data: setCookies
+						});
+						const locationWithCookies = `${location}&cookies=${encodeURIComponent(encryptedCookies)}`;
+						ctx.setHeader("location", locationWithCookies);
+					}
+				})
+			}],
+			before: [{
+				matcher() {
+					return true;
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					if (checkSkipProxy(ctx) || ctx.path !== "/callback/:id") return;
+					return { context: { context: { oauthConfig: { skipStateCookieCheck: true } } } };
+				})
+			}, {
+				matcher(context) {
+					return !!(context.path?.startsWith("/sign-in/social") || context.path?.startsWith("/sign-in/oauth2"));
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					if (checkSkipProxy(ctx)) return;
+					const url = resolveCurrentURL(ctx);
+					if (!ctx.body) return;
+					ctx.body.callbackURL = `${url.origin}${ctx.context.options.basePath || "/api/auth"}/oauth-proxy-callback?callbackURL=${encodeURIComponent(ctx.body.callbackURL || ctx.context.baseURL)}`;
+					return { context: ctx };
+				})
+			}]
+		}
+	};
+};
+
+//#endregion
+export { oAuthProxy as t };

package/dist/oauth2/index.d.mts

@@ -0,0 +1,60 @@
+import "../helper-tmxW3BHj.mjs";
+import { Mn as generateState, Nn as parseState, g as User, o as Account } from "../index-Cxi7TbLE.mjs";
+import "../types-B1OL7hyf.mjs";
+import "../index-65G5U5DB-DSdjzreF.mjs";
+import "../plugins-hFZT3hmK.mjs";
+import { AuthContext, GenericEndpointContext } from "@gatwech/core";
+export * from "@gatwech/core/oauth2";
+
+//#region src/oauth2/link-account.d.ts
+declare function handleOAuthUserInfo(c: GenericEndpointContext, {
+  userInfo,
+  account,
+  callbackURL,
+  disableSignUp,
+  overrideUserInfo
+}: {
+  userInfo: Omit<User, "createdAt" | "updatedAt">;
+  account: Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
+  callbackURL?: string | undefined;
+  disableSignUp?: boolean | undefined;
+  overrideUserInfo?: boolean | undefined;
+}): Promise<{
+  error: string;
+  data: null;
+  isRegister?: undefined;
+} | {
+  error: string;
+  data: null;
+  isRegister: boolean;
+} | {
+  data: {
+    session: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  };
+  error: null;
+  isRegister: boolean;
+}>;
+//#endregion
+//#region src/oauth2/utils.d.ts
+declare function decryptOAuthToken(token: string, ctx: AuthContext): string | Promise<string>;
+declare function setTokenUtil(token: string | null | undefined, ctx: AuthContext): string | Promise<string> | null | undefined;
+//#endregion
+export { decryptOAuthToken, generateState, handleOAuthUserInfo, parseState, setTokenUtil };