@gatwech/core 0.0.1-beta.1

package/src/social-providers/reddit.ts

@@ -0,0 +1,122 @@
+import { base64 } from "@gatwech/utils/base64";
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+  createAuthorizationURL,
+  getOAuth2Tokens,
+  refreshAccessToken,
+} from "../oauth2";
+
+export interface RedditProfile {
+  id: string;
+  name: string;
+  icon_img: string | null;
+  has_verified_email: boolean;
+  oauth_client_id: string;
+  verified: boolean;
+}
+
+export interface RedditOptions extends ProviderOptions<RedditProfile> {
+  clientId: string;
+  duration?: string | undefined;
+}
+
+export const reddit = (options: RedditOptions) => {
+  return {
+    id: "reddit",
+    name: "Reddit",
+    createAuthorizationURL({ state, scopes, redirectURI }) {
+      const _scopes = options.disableDefaultScope ? [] : ["identity"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+      return createAuthorizationURL({
+        id: "reddit",
+        options,
+        authorizationEndpoint: "https://www.reddit.com/api/v1/authorize",
+        scopes: _scopes,
+        state,
+        redirectURI,
+        duration: options.duration,
+      });
+    },
+    validateAuthorizationCode: async ({ code, redirectURI }) => {
+      const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: options.redirectURI || redirectURI,
+      });
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "text/plain",
+        "user-agent": "gatwech",
+        Authorization: `Basic ${base64.encode(
+          `${options.clientId}:${options.clientSecret}`
+        )}`,
+      };
+
+      const { data, error } = await betterFetch<object>(
+        "https://www.reddit.com/api/v1/access_token",
+        {
+          method: "POST",
+          headers,
+          body: body.toString(),
+        }
+      );
+
+      if (error) {
+        throw error;
+      }
+
+      return getOAuth2Tokens(data);
+    },
+
+    refreshAccessToken: options.refreshAccessToken
+      ? options.refreshAccessToken
+      : async (refreshToken) => {
+          return refreshAccessToken({
+            refreshToken,
+            options: {
+              clientId: options.clientId,
+              clientKey: options.clientKey,
+              clientSecret: options.clientSecret,
+            },
+            authentication: "basic",
+            tokenEndpoint: "https://www.reddit.com/api/v1/access_token",
+          });
+        },
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+
+      const { data: profile, error } = await betterFetch<RedditProfile>(
+        "https://oauth.reddit.com/api/v1/me",
+        {
+          headers: {
+            Authorization: `Bearer ${token.accessToken}`,
+            "User-Agent": "gatwech",
+          },
+        }
+      );
+
+      if (error) {
+        return null;
+      }
+
+      const userMap = await options.mapProfileToUser?.(profile);
+
+      return {
+        user: {
+          id: profile.id,
+          name: profile.name,
+          email: profile.oauth_client_id,
+          emailVerified: profile.has_verified_email,
+          image: profile.icon_img?.split("?")[0]!,
+          ...userMap,
+        },
+        data: profile,
+      };
+    },
+    options,
+  } satisfies OAuthProvider<RedditProfile>;
+};

package/src/social-providers/roblox.ts

@@ -0,0 +1,110 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import { refreshAccessToken, validateAuthorizationCode } from "../oauth2";
+
+export interface RobloxProfile extends Record<string, any> {
+	/** the user's id */
+	sub: string;
+	/** the user's username */
+	preferred_username: string;
+	/** the user's display name, will return the same value as the preferred_username if not set */
+	nickname: string;
+	/** the user's display name, again, will return the same value as the preferred_username if not set */
+	name: string;
+	/** the account creation date as a unix timestamp in seconds */
+	created_at: number;
+	/** the user's profile URL */
+	profile: string;
+	/** the user's avatar URL */
+	picture: string;
+}
+
+export interface RobloxOptions extends ProviderOptions<RobloxProfile> {
+	clientId: string;
+	prompt?:
+		| (
+				| "none"
+				| "consent"
+				| "login"
+				| "select_account"
+				| "select_account consent"
+		  )
+		| undefined;
+}
+
+export const roblox = (options: RobloxOptions) => {
+	return {
+		id: "roblox",
+		name: "Roblox",
+		createAuthorizationURL({ state, scopes, redirectURI }) {
+			const _scopes = options.disableDefaultScope ? [] : ["openid", "profile"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			return new URL(
+				`https://apis.roblox.com/oauth/v1/authorize?scope=${_scopes.join(
+					"+",
+				)}&response_type=code&client_id=${
+					options.clientId
+				}&redirect_uri=${encodeURIComponent(
+					options.redirectURI || redirectURI,
+				)}&state=${state}&prompt=${options.prompt || "select_account consent"}`,
+			);
+		},
+		validateAuthorizationCode: async ({ code, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				redirectURI: options.redirectURI || redirectURI,
+				options,
+				tokenEndpoint: "https://apis.roblox.com/oauth/v1/token",
+				authentication: "post",
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint: "https://apis.roblox.com/oauth/v1/token",
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<RobloxProfile>(
+				"https://apis.roblox.com/oauth/v1/userinfo",
+				{
+					headers: {
+						authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+
+			if (error) {
+				return null;
+			}
+
+			const userMap = await options.mapProfileToUser?.(profile);
+
+			return {
+				user: {
+					id: profile.sub,
+					name: profile.nickname || profile.preferred_username || "",
+					image: profile.picture,
+					email: profile.preferred_username || null, // Roblox does not provide email
+					emailVerified: true,
+					...userMap,
+				},
+				data: {
+					...profile,
+				},
+			};
+		},
+		options,
+	} satisfies OAuthProvider<RobloxProfile>;
+};

package/src/social-providers/salesforce.ts

@@ -0,0 +1,159 @@
+import { betterFetch } from "@better-fetch/fetch";
+import { logger } from "../env";
+import { PayvoAuthError } from "../error";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+  createAuthorizationURL,
+  refreshAccessToken,
+  validateAuthorizationCode,
+} from "../oauth2";
+
+export interface SalesforceProfile {
+  sub: string;
+  user_id: string;
+  organization_id: string;
+  preferred_username?: string | undefined;
+  email: string;
+  email_verified?: boolean | undefined;
+  name: string;
+  given_name?: string | undefined;
+  family_name?: string | undefined;
+  zoneinfo?: string | undefined;
+  photos?:
+    | {
+        picture?: string;
+        thumbnail?: string;
+      }
+    | undefined;
+}
+
+export interface SalesforceOptions extends ProviderOptions<SalesforceProfile> {
+  clientId: string;
+  environment?: ("sandbox" | "production") | undefined;
+  loginUrl?: string | undefined;
+  /**
+   * Override the redirect URI if auto-detection fails.
+   * Should match the Callback URL configured in your Salesforce Connected App.
+   * @example "http://localhost:3000/api/v1/auth/callback/salesforce"
+   */
+  redirectURI?: string | undefined;
+}
+
+export const salesforce = (options: SalesforceOptions) => {
+  const environment = options.environment ?? "production";
+  const isSandbox = environment === "sandbox";
+  const authorizationEndpoint = options.loginUrl
+    ? `https://${options.loginUrl}/services/oauth2/authorize`
+    : isSandbox
+      ? "https://test.salesforce.com/services/oauth2/authorize"
+      : "https://login.salesforce.com/services/oauth2/authorize";
+
+  const tokenEndpoint = options.loginUrl
+    ? `https://${options.loginUrl}/services/oauth2/token`
+    : isSandbox
+      ? "https://test.salesforce.com/services/oauth2/token"
+      : "https://login.salesforce.com/services/oauth2/token";
+
+  const userInfoEndpoint = options.loginUrl
+    ? `https://${options.loginUrl}/services/oauth2/userinfo`
+    : isSandbox
+      ? "https://test.salesforce.com/services/oauth2/userinfo"
+      : "https://login.salesforce.com/services/oauth2/userinfo";
+
+  return {
+    id: "salesforce",
+    name: "Salesforce",
+
+    async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+      if (!options.clientId || !options.clientSecret) {
+        logger.error(
+          "Client Id and Client Secret are required for Salesforce. Make sure to provide them in the options."
+        );
+        throw new PayvoAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+      }
+      if (!codeVerifier) {
+        throw new PayvoAuthError("codeVerifier is required for Salesforce");
+      }
+
+      const _scopes = options.disableDefaultScope
+        ? []
+        : ["openid", "email", "profile"];
+      if (options.scope) _scopes.push(...options.scope);
+      if (scopes) _scopes.push(...scopes);
+
+      return createAuthorizationURL({
+        id: "salesforce",
+        options,
+        authorizationEndpoint,
+        scopes: _scopes,
+        state,
+        codeVerifier,
+        redirectURI: options.redirectURI || redirectURI,
+      });
+    },
+
+    validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+      return validateAuthorizationCode({
+        code,
+        codeVerifier,
+        redirectURI: options.redirectURI || redirectURI,
+        options,
+        tokenEndpoint,
+      });
+    },
+
+    refreshAccessToken: options.refreshAccessToken
+      ? options.refreshAccessToken
+      : async (refreshToken) => {
+          return refreshAccessToken({
+            refreshToken,
+            options: {
+              clientId: options.clientId,
+              clientSecret: options.clientSecret,
+            },
+            tokenEndpoint,
+          });
+        },
+
+    async getUserInfo(token) {
+      if (options.getUserInfo) {
+        return options.getUserInfo(token);
+      }
+
+      try {
+        const { data: user } = await betterFetch<SalesforceProfile>(
+          userInfoEndpoint,
+          {
+            headers: {
+              Authorization: `Bearer ${token.accessToken}`,
+            },
+          }
+        );
+
+        if (!user) {
+          logger.error("Failed to fetch user info from Salesforce");
+          return null;
+        }
+
+        const userMap = await options.mapProfileToUser?.(user);
+
+        return {
+          user: {
+            id: user.user_id,
+            name: user.name,
+            email: user.email,
+            image: user.photos?.picture || user.photos?.thumbnail,
+            emailVerified: user.email_verified ?? false,
+            ...userMap,
+          },
+          data: user,
+        };
+      } catch (error) {
+        logger.error("Failed to fetch user info from Salesforce:", error);
+        return null;
+      }
+    },
+
+    options,
+  } satisfies OAuthProvider<SalesforceProfile>;
+};

package/src/social-providers/slack.ts

@@ -0,0 +1,111 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import { refreshAccessToken, validateAuthorizationCode } from "../oauth2";
+
+export interface SlackProfile extends Record<string, any> {
+	ok: boolean;
+	sub: string;
+	"https://slack.com/user_id": string;
+	"https://slack.com/team_id": string;
+	email: string;
+	email_verified: boolean;
+	date_email_verified: number;
+	name: string;
+	picture: string;
+	given_name: string;
+	family_name: string;
+	locale: string;
+	"https://slack.com/team_name": string;
+	"https://slack.com/team_domain": string;
+	"https://slack.com/user_image_24": string;
+	"https://slack.com/user_image_32": string;
+	"https://slack.com/user_image_48": string;
+	"https://slack.com/user_image_72": string;
+	"https://slack.com/user_image_192": string;
+	"https://slack.com/user_image_512": string;
+	"https://slack.com/team_image_34": string;
+	"https://slack.com/team_image_44": string;
+	"https://slack.com/team_image_68": string;
+	"https://slack.com/team_image_88": string;
+	"https://slack.com/team_image_102": string;
+	"https://slack.com/team_image_132": string;
+	"https://slack.com/team_image_230": string;
+	"https://slack.com/team_image_default": boolean;
+}
+
+export interface SlackOptions extends ProviderOptions<SlackProfile> {
+	clientId: string;
+}
+
+export const slack = (options: SlackOptions) => {
+	return {
+		id: "slack",
+		name: "Slack",
+		createAuthorizationURL({ state, scopes, redirectURI }) {
+			const _scopes = options.disableDefaultScope
+				? []
+				: ["openid", "profile", "email"];
+			if (scopes) _scopes.push(...scopes);
+			if (options.scope) _scopes.push(...options.scope);
+			const url = new URL("https://slack.com/openid/connect/authorize");
+			url.searchParams.set("scope", _scopes.join(" "));
+			url.searchParams.set("response_type", "code");
+			url.searchParams.set("client_id", options.clientId);
+			url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
+			url.searchParams.set("state", state);
+			return url;
+		},
+		validateAuthorizationCode: async ({ code, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				redirectURI,
+				options,
+				tokenEndpoint: "https://slack.com/api/openid.connect.token",
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint: "https://slack.com/api/openid.connect.token",
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<SlackProfile>(
+				"https://slack.com/api/openid.connect.userInfo",
+				{
+					headers: {
+						authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+
+			if (error) {
+				return null;
+			}
+
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile["https://slack.com/user_id"],
+					name: profile.name || "",
+					email: profile.email,
+					emailVerified: profile.email_verified,
+					image: profile.picture || profile["https://slack.com/user_image_512"],
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<SlackProfile>;
+};

package/src/social-providers/spotify.ts

@@ -0,0 +1,93 @@
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
+
+export interface SpotifyProfile {
+	id: string;
+	display_name: string;
+	email: string;
+	images: {
+		url: string;
+	}[];
+}
+
+export interface SpotifyOptions extends ProviderOptions<SpotifyProfile> {
+	clientId: string;
+}
+
+export const spotify = (options: SpotifyOptions) => {
+	return {
+		id: "spotify",
+		name: "Spotify",
+		createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+			const _scopes = options.disableDefaultScope ? [] : ["user-read-email"];
+			if (options.scope) _scopes.push(...options.scope);
+			if (scopes) _scopes.push(...scopes);
+			return createAuthorizationURL({
+				id: "spotify",
+				options,
+				authorizationEndpoint: "https://accounts.spotify.com/authorize",
+				scopes: _scopes,
+				state,
+				codeVerifier,
+				redirectURI,
+			});
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint: "https://accounts.spotify.com/api/token",
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken
+			? options.refreshAccessToken
+			: async (refreshToken) => {
+					return refreshAccessToken({
+						refreshToken,
+						options: {
+							clientId: options.clientId,
+							clientKey: options.clientKey,
+							clientSecret: options.clientSecret,
+						},
+						tokenEndpoint: "https://accounts.spotify.com/api/token",
+					});
+				},
+		async getUserInfo(token) {
+			if (options.getUserInfo) {
+				return options.getUserInfo(token);
+			}
+			const { data: profile, error } = await betterFetch<SpotifyProfile>(
+				"https://api.spotify.com/v1/me",
+				{
+					method: "GET",
+					headers: {
+						Authorization: `Bearer ${token.accessToken}`,
+					},
+				},
+			);
+			if (error) {
+				return null;
+			}
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					id: profile.id,
+					name: profile.display_name,
+					email: profile.email,
+					image: profile.images[0]?.url,
+					emailVerified: false,
+					...userMap,
+				},
+				data: profile,
+			};
+		},
+		options,
+	} satisfies OAuthProvider<SpotifyProfile>;
+};