@gatwech/auth 1.0.0-beta.18

package/dist/src/plugins/email-otp/utils.d.ts

@@ -0,0 +1,2 @@
+export declare const defaultKeyHasher: (otp: string) => Promise<string>;
+export declare function splitAtLastColon(input: string): [string, string];

package/dist/src/plugins/generic-oauth/client.d.ts

@@ -0,0 +1,5 @@
+import type { genericOAuth } from ".";
+export declare const genericOAuthClient: () => {
+    id: "generic-oauth-client";
+    $InferServerPlugin: ReturnType<typeof genericOAuth>;
+};

package/dist/src/plugins/generic-oauth/index.d.ts

@@ -0,0 +1,428 @@
+import type { GenericEndpointContext } from "@gatwech/core";
+import type { OAuth2Tokens, OAuth2UserInfo, OAuthProvider } from "@gatwech/core/oauth2";
+import * as z from "zod";
+import type { User } from "../../types";
+/**
+ * Configuration interface for generic OAuth providers.
+ */
+export interface GenericOAuthConfig {
+    /** Unique identifier for the OAuth provider */
+    providerId: string;
+    /**
+     * URL to fetch OAuth 2.0 configuration.
+     * If provided, the authorization and token endpoints will be fetched from this URL.
+     */
+    discoveryUrl?: string | undefined;
+    /**
+     * URL for the authorization endpoint.
+     * Optional if using discoveryUrl.
+     */
+    authorizationUrl?: string | undefined;
+    /**
+     * URL for the token endpoint.
+     * Optional if using discoveryUrl.
+     */
+    tokenUrl?: string | undefined;
+    /**
+     * URL for the user info endpoint.
+     * Optional if using discoveryUrl.
+     */
+    userInfoUrl?: string | undefined;
+    /** OAuth client ID */
+    clientId: string;
+    /** OAuth client secret */
+    clientSecret?: string | undefined;
+    /**
+     * Array of OAuth scopes to request.
+     * @default []
+     */
+    scopes?: string[] | undefined;
+    /**
+     * Custom redirect URI.
+     * If not provided, a default URI will be constructed.
+     */
+    redirectURI?: string | undefined;
+    /**
+     * OAuth response type.
+     * @default "code"
+     */
+    responseType?: string | undefined;
+    /**
+     * The response mode to use for the authorization code request.
+
+     */
+    responseMode?: ("query" | "form_post") | undefined;
+    /**
+     * Prompt parameter for the authorization request.
+     * Controls the authentication experience for the user.
+     */
+    prompt?: ("none" | "login" | "consent" | "select_account") | undefined;
+    /**
+     * Whether to use PKCE (Proof Key for Code Exchange)
+     * @default false
+     */
+    pkce?: boolean | undefined;
+    /**
+     * Access type for the authorization request.
+     * Use "offline" to request a refresh token.
+     */
+    accessType?: string | undefined;
+    /**
+     * Custom function to fetch user info.
+     * If provided, this function will be used instead of the default user info fetching logic.
+     * @param tokens - The OAuth tokens received after successful authentication
+     * @returns A promise that resolves to a User object or null
+     */
+    getUserInfo?: ((tokens: OAuth2Tokens) => Promise<OAuth2UserInfo | null>) | undefined;
+    /**
+     * Custom function to map the user profile to a User object.
+     */
+    mapProfileToUser?: ((profile: Record<string, any>) => Partial<Partial<User>> | Promise<Partial<User>>) | undefined;
+    /**
+     * Additional search-params to add to the authorizationUrl.
+     * Warning: Search-params added here overwrite any default params.
+     */
+    authorizationUrlParams?: (Record<string, string> | ((ctx: GenericEndpointContext) => Record<string, string>)) | undefined;
+    /**
+     * Additional search-params to add to the tokenUrl.
+     * Warning: Search-params added here overwrite any default params.
+     */
+    tokenUrlParams?: (Record<string, string> | ((ctx: GenericEndpointContext) => Record<string, string>)) | undefined;
+    /**
+     * Disable implicit sign up for new users. When set to true for the provider,
+     * sign-in need to be called with with requestSignUp as true to create new users.
+     */
+    disableImplicitSignUp?: boolean | undefined;
+    /**
+     * Disable sign up for new users.
+     */
+    disableSignUp?: boolean | undefined;
+    /**
+     * Authentication method for token requests.
+     * @default "post"
+     */
+    authentication?: ("basic" | "post") | undefined;
+    /**
+     * Custom headers to include in the discovery request.
+     * Useful for providers like Epic that require specific headers (e.g., Epic-Client-ID).
+     */
+    discoveryHeaders?: Record<string, string> | undefined;
+    /**
+     * Custom headers to include in the authorization request.
+     * Useful for providers like Qonto that require specific headers (e.g., X-Qonto-Staging-Token for local development).
+     */
+    authorizationHeaders?: Record<string, string> | undefined;
+    /**
+     * Override user info with the provider info.
+     *
+     * This will update the user info with the provider info,
+     * when the user signs in with the provider.
+     * @default false
+     */
+    overrideUserInfo?: boolean | undefined;
+}
+interface GenericOAuthOptions {
+    /**
+     * Array of OAuth provider configurations.
+     */
+    config: GenericOAuthConfig[];
+}
+/**
+ * A generic OAuth plugin that can be used to add OAuth support to any provider
+ */
+export declare const genericOAuth: (options: GenericOAuthOptions) => {
+    id: "generic-oauth";
+    init: (ctx: import("@gatwech/core").AuthContext<import("@gatwech/core").PayvoAuthOptions>) => {
+        context: {
+            socialProviders: OAuthProvider<Record<string, any>, Partial<import("@gatwech/core/oauth2").ProviderOptions<any>>>[];
+        };
+    };
+    endpoints: {
+        /**
+         * ### Endpoint
+         *
+         * POST `/sign-in/oauth2`
+         *
+         * ### API Methods
+         *
+         * **server:**
+         * `auth.api.signInWithOAuth2`
+         *
+         * **client:**
+         * `authClient.signIn.oauth2`
+         *
+         * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/sign-in#api-method-sign-in-oauth2)
+         */
+        signInWithOAuth2: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+                body: {
+                    providerId: string;
+                    callbackURL?: string | undefined;
+                    errorCallbackURL?: string | undefined;
+                    newUserCallbackURL?: string | undefined;
+                    disableRedirect?: boolean | undefined;
+                    scopes?: string[] | undefined;
+                    requestSignUp?: boolean | undefined;
+                    additionalData?: Record<string, any> | undefined;
+                };
+            } & {
+                method?: "POST" | undefined;
+            } & {
+                query?: Record<string, any> | undefined;
+            } & {
+                params?: Record<string, any>;
+            } & {
+                request?: Request;
+            } & {
+                headers?: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: import("better-call").Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: {
+                    url: string;
+                    redirect: boolean;
+                };
+            } : {
+                url: string;
+                redirect: boolean;
+            }>;
+            options: {
+                method: "POST";
+                body: z.ZodObject<{
+                    providerId: z.ZodString;
+                    callbackURL: z.ZodOptional<z.ZodString>;
+                    errorCallbackURL: z.ZodOptional<z.ZodString>;
+                    newUserCallbackURL: z.ZodOptional<z.ZodString>;
+                    disableRedirect: z.ZodOptional<z.ZodBoolean>;
+                    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    requestSignUp: z.ZodOptional<z.ZodBoolean>;
+                    additionalData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+                }, z.core.$strip>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                url: {
+                                                    type: string;
+                                                };
+                                                redirect: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            };
+            path: "/sign-in/oauth2";
+        };
+        oAuth2Callback: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+                body?: undefined;
+            } & {
+                method?: "GET" | undefined;
+            } & {
+                query: {
+                    code?: string | undefined;
+                    error?: string | undefined;
+                    error_description?: string | undefined;
+                    state?: string | undefined;
+                };
+            } & {
+                params: {
+                    providerId: string;
+                };
+            } & {
+                request?: Request;
+            } & {
+                headers?: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: import("better-call").Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: void;
+            } : void>;
+            options: {
+                method: "GET";
+                query: z.ZodObject<{
+                    code: z.ZodOptional<z.ZodString>;
+                    error: z.ZodOptional<z.ZodString>;
+                    error_description: z.ZodOptional<z.ZodString>;
+                    state: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>;
+                metadata: {
+                    client: boolean;
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                url: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            };
+            path: "/oauth2/callback/:providerId";
+        };
+        /**
+         * ### Endpoint
+         *
+         * POST `/oauth2/link`
+         *
+         * ### API Methods
+         *
+         * **server:**
+         * `auth.api.oAuth2LinkAccount`
+         *
+         * **client:**
+         * `authClient.oauth2.link`
+         *
+         * @see [Read our docs to learn more.](https://payvopayvo.com/docs/plugins/generic-oauth#api-method-oauth2-link)
+         */
+        oAuth2LinkAccount: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+                body: {
+                    providerId: string;
+                    callbackURL: string;
+                    scopes?: string[] | undefined;
+                    errorCallbackURL?: string | undefined;
+                };
+            } & {
+                method?: "POST" | undefined;
+            } & {
+                query?: Record<string, any> | undefined;
+            } & {
+                params?: Record<string, any>;
+            } & {
+                request?: Request;
+            } & {
+                headers?: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: import("better-call").Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: {
+                    url: string;
+                    redirect: boolean;
+                };
+            } : {
+                url: string;
+                redirect: boolean;
+            }>;
+            options: {
+                method: "POST";
+                body: z.ZodObject<{
+                    providerId: z.ZodString;
+                    callbackURL: z.ZodString;
+                    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    errorCallbackURL: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>;
+                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                    session: {
+                        session: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                        user: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            email: string;
+                            emailVerified: boolean;
+                            name: string;
+                            image?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                url: {
+                                                    type: string;
+                                                    format: string;
+                                                    description: string;
+                                                };
+                                                redirect: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            };
+            path: "/oauth2/link";
+        };
+    };
+    $ERROR_CODES: {
+        readonly INVALID_OAUTH_CONFIGURATION: "Invalid OAuth configuration";
+    };
+};
+export {};

package/dist/src/plugins/haveibeenpwned/index.d.ts

@@ -0,0 +1,25 @@
+export interface HaveIBeenPwnedOptions {
+    customPasswordCompromisedMessage?: string | undefined;
+}
+export declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefined) => {
+    id: "haveIBeenPwned";
+    init(ctx: import("@gatwech/core").AuthContext<import("@gatwech/core").PayvoAuthOptions>): {
+        context: {
+            password: {
+                hash(password: string): Promise<string>;
+                verify: (data: {
+                    password: string;
+                    hash: string;
+                }) => Promise<boolean>;
+                config: {
+                    minPasswordLength: number;
+                    maxPasswordLength: number;
+                };
+                checkPassword: (userId: string, ctx: import("@gatwech/core").GenericEndpointContext<import("@gatwech/core").PayvoAuthOptions>) => Promise<boolean>;
+            };
+        };
+    };
+    $ERROR_CODES: {
+        readonly PASSWORD_COMPROMISED: "The password you entered has been compromised. Please choose a different password.";
+    };
+};

package/dist/src/plugins/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @deprecated Please import from `@gatwech/auth/api` directly.
+ */
+export { type AuthEndpoint, type AuthMiddleware, createAuthEndpoint, createAuthMiddleware, optionsMiddleware, } from "@gatwech/core/api";
+export * from "../types/plugins";
+export * from "../utils/hide-metadata";
+export * from "./admin";
+export * from "./anonymous";
+export * from "./api-key";
+export * from "./bearer";
+export * from "./captcha";
+export * from "./custom-session";
+export * from "./device-authorization";
+export * from "./email-otp";
+export * from "./generic-oauth";
+export * from "./haveibeenpwned";
+export * from "./jwt";
+export * from "./last-login-method";
+export * from "./magic-link";
+export * from "./multi-session";
+export * from "./oauth-proxy";
+export * from "./one-tap";
+export * from "./one-time-token";
+export * from "./organization";
+export * from "./phone-number";
+export * from "./two-factor";
+export * from "./passkey";
+export * from "./username";

package/dist/src/plugins/jwt/adapter.d.ts

@@ -0,0 +1,8 @@
+import type { PayvoAuthOptions, GenericEndpointContext } from "@gatwech/core";
+import type { DBAdapter } from "@gatwech/core/db/adapter";
+import type { Jwk, JwtOptions } from "./types";
+export declare const getJwksAdapter: (adapter: DBAdapter<PayvoAuthOptions>, options?: JwtOptions) => {
+    getAllKeys: (ctx: GenericEndpointContext) => Promise<Jwk[] | null | undefined>;
+    getLatestKey: (ctx: GenericEndpointContext) => Promise<Jwk | null | undefined>;
+    createJwk: (ctx: GenericEndpointContext, webKey: Omit<Jwk, "id">) => Promise<Jwk>;
+};

package/dist/src/plugins/jwt/client.d.ts

@@ -0,0 +1,5 @@
+import type { jwt } from "./index";
+export declare const jwtClient: () => {
+    id: "payvo-auth-client";
+    $InferServerPlugin: ReturnType<typeof jwt>;
+};