@gatwech/core 0.0.1-beta.1

package/src/env/logger.ts

@@ -0,0 +1,145 @@
+import { getColorDepth } from "./color-depth";
+
+export const TTY_COLORS = {
+  reset: "\x1b[0m",
+  bright: "\x1b[1m",
+  dim: "\x1b[2m",
+  undim: "\x1b[22m",
+  underscore: "\x1b[4m",
+  blink: "\x1b[5m",
+  reverse: "\x1b[7m",
+  hidden: "\x1b[8m",
+  fg: {
+    black: "\x1b[30m",
+    red: "\x1b[31m",
+    green: "\x1b[32m",
+    yellow: "\x1b[33m",
+    blue: "\x1b[34m",
+    magenta: "\x1b[35m",
+    cyan: "\x1b[36m",
+    white: "\x1b[37m",
+  },
+  bg: {
+    black: "\x1b[40m",
+    red: "\x1b[41m",
+    green: "\x1b[42m",
+    yellow: "\x1b[43m",
+    blue: "\x1b[44m",
+    magenta: "\x1b[45m",
+    cyan: "\x1b[46m",
+    white: "\x1b[47m",
+  },
+} as const;
+
+export type LogLevel = "info" | "success" | "warn" | "error" | "debug";
+
+export const levels = ["info", "success", "warn", "error", "debug"] as const;
+
+export function shouldPublishLog(
+  currentLogLevel: LogLevel,
+  logLevel: LogLevel
+): boolean {
+  return levels.indexOf(logLevel) <= levels.indexOf(currentLogLevel);
+}
+
+export interface Logger {
+  disabled?: boolean | undefined;
+  disableColors?: boolean | undefined;
+  level?: Exclude<LogLevel, "success"> | undefined;
+  log?:
+    | ((
+        level: Exclude<LogLevel, "success">,
+        message: string,
+        ...args: any[]
+      ) => void)
+    | undefined;
+}
+
+export type LogHandlerParams =
+  Parameters<NonNullable<Logger["log"]>> extends [LogLevel, ...infer Rest]
+    ? Rest
+    : never;
+
+const levelColors: Record<LogLevel, string> = {
+  info: TTY_COLORS.fg.blue,
+  success: TTY_COLORS.fg.green,
+  warn: TTY_COLORS.fg.yellow,
+  error: TTY_COLORS.fg.red,
+  debug: TTY_COLORS.fg.magenta,
+};
+
+const formatMessage = (
+  level: LogLevel,
+  message: string,
+  colorsEnabled: boolean
+): string => {
+  const timestamp = new Date().toISOString();
+
+  if (colorsEnabled) {
+    return `${TTY_COLORS.dim}${timestamp}${TTY_COLORS.reset} ${
+      levelColors[level]
+    }${level.toUpperCase()}${TTY_COLORS.reset} ${TTY_COLORS.bright}[Better Auth]:${
+      TTY_COLORS.reset
+    } ${message}`;
+  }
+
+  return `${timestamp} ${level.toUpperCase()} [Better Auth]: ${message}`;
+};
+
+export type InternalLogger = {
+  [K in LogLevel]: (...params: LogHandlerParams) => void;
+} & {
+  get level(): LogLevel;
+};
+
+export const createLogger = (options?: Logger | undefined): InternalLogger => {
+  const enabled = options?.disabled !== true;
+  const logLevel = options?.level ?? "error";
+
+  const isDisableColorsSpecified = options?.disableColors !== undefined;
+  const colorsEnabled = isDisableColorsSpecified
+    ? !options.disableColors
+    : getColorDepth() !== 1;
+
+  const LogFunc = (
+    level: LogLevel,
+    message: string,
+    args: any[] = []
+  ): void => {
+    if (!enabled || !shouldPublishLog(logLevel, level)) {
+      return;
+    }
+
+    const formattedMessage = formatMessage(level, message, colorsEnabled);
+
+    if (!options || typeof options.log !== "function") {
+      if (level === "error") {
+        console.error(formattedMessage, ...args);
+      } else if (level === "warn") {
+        console.warn(formattedMessage, ...args);
+      } else {
+        console.log(formattedMessage, ...args);
+      }
+      return;
+    }
+
+    options.log(level === "success" ? "info" : level, message, ...args);
+  };
+
+  const logger = Object.fromEntries(
+    levels.map((level) => [
+      level,
+      (...[message, ...args]: LogHandlerParams) =>
+        LogFunc(level, message, args),
+    ])
+  ) as Record<LogLevel, (...params: LogHandlerParams) => void>;
+
+  return {
+    ...logger,
+    get level() {
+      return logLevel;
+    },
+  };
+};
+
+export const logger = createLogger();

package/src/error/codes.ts

@@ -0,0 +1,31 @@
+import { defineErrorCodes } from "../utils";
+
+export const BASE_ERROR_CODES = defineErrorCodes({
+	USER_NOT_FOUND: "User not found",
+	FAILED_TO_CREATE_USER: "Failed to create user",
+	FAILED_TO_CREATE_SESSION: "Failed to create session",
+	FAILED_TO_UPDATE_USER: "Failed to update user",
+	FAILED_TO_GET_SESSION: "Failed to get session",
+	INVALID_PASSWORD: "Invalid password",
+	INVALID_EMAIL: "Invalid email",
+	INVALID_EMAIL_OR_PASSWORD: "Invalid email or password",
+	SOCIAL_ACCOUNT_ALREADY_LINKED: "Social account already linked",
+	PROVIDER_NOT_FOUND: "Provider not found",
+	INVALID_TOKEN: "Invalid token",
+	ID_TOKEN_NOT_SUPPORTED: "id_token not supported",
+	FAILED_TO_GET_USER_INFO: "Failed to get user info",
+	USER_EMAIL_NOT_FOUND: "User email not found",
+	EMAIL_NOT_VERIFIED: "Email not verified",
+	PASSWORD_TOO_SHORT: "Password too short",
+	PASSWORD_TOO_LONG: "Password too long",
+	USER_ALREADY_EXISTS: "User already exists.",
+	USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL:
+		"User already exists. Use another email.",
+	EMAIL_CAN_NOT_BE_UPDATED: "Email can not be updated",
+	CREDENTIAL_ACCOUNT_NOT_FOUND: "Credential account not found",
+	SESSION_EXPIRED: "Session expired. Re-authenticate to perform this action.",
+	FAILED_TO_UNLINK_LAST_ACCOUNT: "You can't unlink your last account",
+	ACCOUNT_NOT_FOUND: "Account not found",
+	USER_ALREADY_HAS_PASSWORD:
+		"User already has a password. Provide that to delete the account.",
+});

package/src/error/index.ts

@@ -0,0 +1,11 @@
+export class PayvoAuthError extends Error {
+  constructor(message: string, cause?: string | undefined) {
+    super(message);
+    this.name = "PayvoAuthError";
+    this.message = message;
+    this.cause = cause;
+    this.stack = "";
+  }
+}
+
+export { BASE_ERROR_CODES } from "./codes";

package/src/index.ts

@@ -0,0 +1 @@
+export * from "./types";

package/src/oauth2/client-credentials-token.ts

@@ -0,0 +1,102 @@
+import { base64Url } from "@gatwech/utils/base64";
+import { betterFetch } from "@better-fetch/fetch";
+import type { OAuth2Tokens, ProviderOptions } from "./oauth-provider";
+
+export function createClientCredentialsTokenRequest({
+  options,
+  scope,
+  authentication,
+  resource,
+}: {
+  options: ProviderOptions & { clientSecret: string };
+  scope?: string | undefined;
+  authentication?: ("basic" | "post") | undefined;
+  resource?: (string | string[]) | undefined;
+}) {
+  const body = new URLSearchParams();
+  const headers: Record<string, any> = {
+    "content-type": "application/x-www-form-urlencoded",
+    accept: "application/json",
+  };
+
+  body.set("grant_type", "client_credentials");
+  scope && body.set("scope", scope);
+  if (resource) {
+    if (typeof resource === "string") {
+      body.append("resource", resource);
+    } else {
+      for (const _resource of resource) {
+        body.append("resource", _resource);
+      }
+    }
+  }
+  if (authentication === "basic") {
+    const primaryClientId = Array.isArray(options.clientId)
+      ? options.clientId[0]
+      : options.clientId;
+    const encodedCredentials = base64Url.encode(
+      `${primaryClientId}:${options.clientSecret}`
+    );
+    headers["authorization"] = `Basic ${encodedCredentials}`;
+  } else {
+    const primaryClientId = Array.isArray(options.clientId)
+      ? options.clientId[0]
+      : options.clientId;
+    body.set("client_id", primaryClientId);
+    body.set("client_secret", options.clientSecret);
+  }
+
+  return {
+    body,
+    headers,
+  };
+}
+
+export async function clientCredentialsToken({
+  options,
+  tokenEndpoint,
+  scope,
+  authentication,
+  resource,
+}: {
+  options: ProviderOptions & { clientSecret: string };
+  tokenEndpoint: string;
+  scope: string;
+  authentication?: ("basic" | "post") | undefined;
+  resource?: (string | string[]) | undefined;
+}): Promise<OAuth2Tokens> {
+  const { body, headers } = createClientCredentialsTokenRequest({
+    options,
+    scope,
+    authentication,
+    resource,
+  });
+
+  const { data, error } = await betterFetch<{
+    access_token: string;
+    expires_in?: number | undefined;
+    token_type?: string | undefined;
+    scope?: string | undefined;
+  }>(tokenEndpoint, {
+    method: "POST",
+    body,
+    headers,
+  });
+  if (error) {
+    throw error;
+  }
+  const tokens: OAuth2Tokens = {
+    accessToken: data.access_token,
+    tokenType: data.token_type,
+    scopes: data.scope?.split(" "),
+  };
+
+  if (data.expires_in) {
+    const now = new Date();
+    tokens.accessTokenExpiresAt = new Date(
+      now.getTime() + data.expires_in * 1000
+    );
+  }
+
+  return tokens;
+}

package/src/oauth2/create-authorization-url.ts

@@ -0,0 +1,85 @@
+import type { ProviderOptions } from "./index";
+import { generateCodeChallenge } from "./utils";
+
+export async function createAuthorizationURL({
+	id,
+	options,
+	authorizationEndpoint,
+	state,
+	codeVerifier,
+	scopes,
+	claims,
+	redirectURI,
+	duration,
+	prompt,
+	accessType,
+	responseType,
+	display,
+	loginHint,
+	hd,
+	responseMode,
+	additionalParams,
+	scopeJoiner,
+}: {
+	id: string;
+	options: ProviderOptions;
+	redirectURI: string;
+	authorizationEndpoint: string;
+	state: string;
+	codeVerifier?: string | undefined;
+	scopes: string[];
+	claims?: string[] | undefined;
+	duration?: string | undefined;
+	prompt?: string | undefined;
+	accessType?: string | undefined;
+	responseType?: string | undefined;
+	display?: string | undefined;
+	loginHint?: string | undefined;
+	hd?: string | undefined;
+	responseMode?: string | undefined;
+	additionalParams?: Record<string, string> | undefined;
+	scopeJoiner?: string | undefined;
+}) {
+	const url = new URL(authorizationEndpoint);
+	url.searchParams.set("response_type", responseType || "code");
+	const primaryClientId = Array.isArray(options.clientId)
+		? options.clientId[0]
+		: options.clientId;
+	url.searchParams.set("client_id", primaryClientId);
+	url.searchParams.set("state", state);
+	url.searchParams.set("scope", scopes.join(scopeJoiner || " "));
+	url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
+	duration && url.searchParams.set("duration", duration);
+	display && url.searchParams.set("display", display);
+	loginHint && url.searchParams.set("login_hint", loginHint);
+	prompt && url.searchParams.set("prompt", prompt);
+	hd && url.searchParams.set("hd", hd);
+	accessType && url.searchParams.set("access_type", accessType);
+	responseMode && url.searchParams.set("response_mode", responseMode);
+	if (codeVerifier) {
+		const codeChallenge = await generateCodeChallenge(codeVerifier);
+		url.searchParams.set("code_challenge_method", "S256");
+		url.searchParams.set("code_challenge", codeChallenge);
+	}
+	if (claims) {
+		const claimsObj = claims.reduce(
+			(acc, claim) => {
+				acc[claim] = null;
+				return acc;
+			},
+			{} as Record<string, null>,
+		);
+		url.searchParams.set(
+			"claims",
+			JSON.stringify({
+				id_token: { email: null, email_verified: null, ...claimsObj },
+			}),
+		);
+	}
+	if (additionalParams) {
+		Object.entries(additionalParams).forEach(([key, value]) => {
+			url.searchParams.set(key, value);
+		});
+	}
+	return url;
+}

package/src/oauth2/index.ts

@@ -0,0 +1,21 @@
+export {
+	clientCredentialsToken,
+	createClientCredentialsTokenRequest,
+} from "./client-credentials-token";
+export { createAuthorizationURL } from "./create-authorization-url";
+export type {
+	OAuth2Tokens,
+	OAuth2UserInfo,
+	OAuthProvider,
+	ProviderOptions,
+} from "./oauth-provider";
+export {
+	createRefreshAccessTokenRequest,
+	refreshAccessToken,
+} from "./refresh-access-token";
+export { generateCodeChallenge, getOAuth2Tokens } from "./utils";
+export {
+	createAuthorizationCodeRequest,
+	validateAuthorizationCode,
+	validateToken,
+} from "./validate-authorization-code";

package/src/oauth2/oauth-provider.ts

@@ -0,0 +1,211 @@
+import type { LiteralString } from "../types";
+
+export interface OAuth2Tokens {
+	tokenType?: string | undefined;
+	accessToken?: string | undefined;
+	refreshToken?: string | undefined;
+	accessTokenExpiresAt?: Date | undefined;
+	refreshTokenExpiresAt?: Date | undefined;
+	scopes?: string[] | undefined;
+	idToken?: string | undefined;
+}
+
+export type OAuth2UserInfo = {
+	id: string | number;
+	name?: string | undefined;
+	email?: (string | null) | undefined;
+	image?: string | undefined;
+	emailVerified: boolean;
+};
+
+export interface OAuthProvider<
+	T extends Record<string, any> = Record<string, any>,
+	O extends Record<string, any> = Partial<ProviderOptions>,
+> {
+	id: LiteralString;
+	createAuthorizationURL: (data: {
+		state: string;
+		codeVerifier: string;
+		scopes?: string[] | undefined;
+		redirectURI: string;
+		display?: string | undefined;
+		loginHint?: string | undefined;
+	}) => Promise<URL> | URL;
+	name: string;
+	validateAuthorizationCode: (data: {
+		code: string;
+		redirectURI: string;
+		codeVerifier?: string | undefined;
+		deviceId?: string | undefined;
+	}) => Promise<OAuth2Tokens>;
+	getUserInfo: (
+		token: OAuth2Tokens & {
+			/**
+			 * The user object from the provider
+			 * This is only available for some providers like Apple
+			 */
+			user?:
+				| {
+						name?: {
+							firstName?: string;
+							lastName?: string;
+						};
+						email?: string;
+				  }
+				| undefined;
+		},
+	) => Promise<{
+		user: OAuth2UserInfo;
+		data: T;
+	} | null>;
+	/**
+	 * Custom function to refresh a token
+	 */
+	refreshAccessToken?:
+		| ((refreshToken: string) => Promise<OAuth2Tokens>)
+		| undefined;
+	revokeToken?: ((token: string) => Promise<void>) | undefined;
+	/**
+	 * Verify the id token
+	 * @param token - The id token
+	 * @param nonce - The nonce
+	 * @returns True if the id token is valid, false otherwise
+	 */
+	verifyIdToken?:
+		| ((token: string, nonce?: string) => Promise<boolean>)
+		| undefined;
+	/**
+	 * Disable implicit sign up for new users. When set to true for the provider,
+	 * sign-in need to be called with with requestSignUp as true to create new users.
+	 */
+	disableImplicitSignUp?: boolean | undefined;
+	/**
+	 * Disable sign up for new users.
+	 */
+	disableSignUp?: boolean | undefined;
+	/**
+	 * Options for the provider
+	 */
+	options?: O | undefined;
+}
+
+export type ProviderOptions<Profile extends Record<string, any> = any> = {
+	/**
+	 * The client ID of your application.
+	 *
+	 * This is usually a string but can be any type depending on the provider.
+	 */
+	clientId?: unknown | undefined;
+	/**
+	 * The client secret of your application
+	 */
+	clientSecret?: string | undefined;
+	/**
+	 * The scopes you want to request from the provider
+	 */
+	scope?: string[] | undefined;
+	/**
+	 * Remove default scopes of the provider
+	 */
+	disableDefaultScope?: boolean | undefined;
+	/**
+	 * The redirect URL for your application. This is where the provider will
+	 * redirect the user after the sign in process. Make sure this URL is
+	 * whitelisted in the provider's dashboard.
+	 */
+	redirectURI?: string | undefined;
+	/**
+	 * The client key of your application
+	 * Tiktok Social Provider uses this field instead of clientId
+	 */
+	clientKey?: string | undefined;
+	/**
+	 * Disable provider from allowing users to sign in
+	 * with this provider with an id token sent from the
+	 * client.
+	 */
+	disableIdTokenSignIn?: boolean | undefined;
+	/**
+	 * verifyIdToken function to verify the id token
+	 */
+	verifyIdToken?:
+		| ((token: string, nonce?: string) => Promise<boolean>)
+		| undefined;
+	/**
+	 * Custom function to get user info from the provider
+	 */
+	getUserInfo?:
+		| ((token: OAuth2Tokens) => Promise<{
+				user: {
+					id: string;
+					name?: string;
+					email?: string | null;
+					image?: string;
+					emailVerified: boolean;
+					[key: string]: any;
+				};
+				data: any;
+		  }>)
+		| undefined;
+	/**
+	 * Custom function to refresh a token
+	 */
+	refreshAccessToken?:
+		| ((refreshToken: string) => Promise<OAuth2Tokens>)
+		| undefined;
+	/**
+	 * Custom function to map the provider profile to a
+	 * user.
+	 */
+	mapProfileToUser?:
+		| ((profile: Profile) =>
+				| {
+						id?: string;
+						name?: string;
+						email?: string | null;
+						image?: string;
+						emailVerified?: boolean;
+						[key: string]: any;
+				  }
+				| Promise<{
+						id?: string;
+						name?: string;
+						email?: string | null;
+						image?: string;
+						emailVerified?: boolean;
+						[key: string]: any;
+				  }>)
+		| undefined;
+	/**
+	 * Disable implicit sign up for new users. When set to true for the provider,
+	 * sign-in need to be called with with requestSignUp as true to create new users.
+	 */
+	disableImplicitSignUp?: boolean | undefined;
+	/**
+	 * Disable sign up for new users.
+	 */
+	disableSignUp?: boolean | undefined;
+	/**
+	 * The prompt to use for the authorization code request
+	 */
+	prompt?:
+		| (
+				| "select_account"
+				| "consent"
+				| "login"
+				| "none"
+				| "select_account consent"
+		  )
+		| undefined;
+	/**
+	 * The response mode to use for the authorization code request
+	 */
+	responseMode?: ("query" | "form_post") | undefined;
+	/**
+	 * If enabled, the user info will be overridden with the provider user info
+	 * This is useful if you want to use the provider user info to update the user info
+	 *
+	 * @default false
+	 */
+	overrideUserInfoOnSignIn?: boolean | undefined;
+};