@gauts/auth 0.5.0 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -115,8 +115,13 @@ import { DUMMY_PASSWORD_HASH } from "./password.js";
|
|
|
115
115
|
const app = new Hono<HonoAuthEnv>();
|
|
116
116
|
|
|
117
117
|
app.post("/auth/login", async (c) => {
|
|
118
|
-
const body = await c.req.json<{
|
|
118
|
+
const body = await c.req.json<{
|
|
119
|
+
email: string;
|
|
120
|
+
password: string;
|
|
121
|
+
}>();
|
|
122
|
+
|
|
119
123
|
const account = await findAccount(body.email);
|
|
124
|
+
|
|
120
125
|
const passwordValid = await auth.password.verify({
|
|
121
126
|
password: body.password,
|
|
122
127
|
storedHash: account?.passwordHash ?? DUMMY_PASSWORD_HASH,
|
|
@@ -356,25 +361,25 @@ The cache is signed but not encrypted. Do not place passwords, password hashes,
|
|
|
356
361
|
```ts
|
|
357
362
|
const db = createPrismaAdapter({
|
|
358
363
|
client: prisma,
|
|
359
|
-
config: {
|
|
360
|
-
|
|
361
|
-
|
|
362
|
-
|
|
363
|
-
|
|
364
|
-
|
|
365
|
-
|
|
366
|
-
|
|
367
|
-
|
|
368
|
-
|
|
369
|
-
|
|
370
|
-
|
|
371
|
-
|
|
372
|
-
|
|
373
|
-
|
|
374
|
-
|
|
375
|
-
|
|
376
|
-
|
|
377
|
-
},
|
|
364
|
+
// config: {
|
|
365
|
+
// session: {
|
|
366
|
+
// table: "account_sessions",
|
|
367
|
+
// relations: {
|
|
368
|
+
// account: "account",
|
|
369
|
+
// user: "user",
|
|
370
|
+
// },
|
|
371
|
+
// },
|
|
372
|
+
// access: {
|
|
373
|
+
// account: {
|
|
374
|
+
// allowedRoles: ["OWNER", "ADMIN"],
|
|
375
|
+
// allowedStatuses: ["ACTIVE"],
|
|
376
|
+
// },
|
|
377
|
+
// user: {
|
|
378
|
+
// allowedRoles: ["ADMIN"],
|
|
379
|
+
// allowedStatuses: ["ACTIVE"],
|
|
380
|
+
// },
|
|
381
|
+
// },
|
|
382
|
+
// },
|
|
378
383
|
});
|
|
379
384
|
```
|
|
380
385
|
|
|
@@ -636,7 +641,18 @@ Result values:
|
|
|
636
641
|
|
|
637
642
|
The adapter copies every returned `Set-Cookie` header to the browser response. It forwards only the session cookie and controlled client/origin headers required by the private API. Other cookies, authorization headers, and arbitrary headers are not forwarded.
|
|
638
643
|
|
|
639
|
-
`FORWARD_HEADERS`
|
|
644
|
+
`buildForwardHeaders()` and `FORWARD_HEADERS` are exported from `@gauts/auth/next` for application fetchers that need the same controlled forwarding rules:
|
|
645
|
+
|
|
646
|
+
```ts
|
|
647
|
+
import { buildForwardHeaders } from "@gauts/auth/next";
|
|
648
|
+
|
|
649
|
+
const headers = buildForwardHeaders({
|
|
650
|
+
headers: incoming,
|
|
651
|
+
extra: ["cookie", "authorization"],
|
|
652
|
+
});
|
|
653
|
+
```
|
|
654
|
+
|
|
655
|
+
Safe client and proxy metadata is copied by default. Credentials such as `cookie` and `authorization` are excluded unless explicitly listed in `extra`.
|
|
640
656
|
|
|
641
657
|
When `Origin` is absent and trusted `X-Forwarded-Proto` and `X-Forwarded-Host` headers exist, the adapter reconstructs the public origin from them. It never derives a public origin from the internal Next.js request URL. The deployment proxy must overwrite forwarded headers received from untrusted clients.
|
|
642
658
|
|
|
@@ -19,6 +19,11 @@ export type NextRenewResult = {
|
|
|
19
19
|
export type NextAuth = {
|
|
20
20
|
renew(input: NextRenewInput): Promise<NextRenewResult>;
|
|
21
21
|
};
|
|
22
|
-
export
|
|
22
|
+
export type BuildForwardHeadersInput = {
|
|
23
|
+
extra?: readonly string[];
|
|
24
|
+
headers: Headers;
|
|
25
|
+
};
|
|
26
|
+
export declare const FORWARD_HEADERS: readonly ["accept-language", "cf-connecting-ip", "origin", "referer", "sec-ch-ua", "sec-ch-ua-mobile", "sec-ch-ua-platform", "sec-fetch-dest", "sec-fetch-mode", "sec-fetch-site", "sec-fetch-user", "true-client-ip", "user-agent", "x-forwarded-for", "x-forwarded-host", "x-forwarded-port", "x-forwarded-proto", "x-real-ip"];
|
|
27
|
+
export declare const buildForwardHeaders: ({ extra, headers: incoming, }: BuildForwardHeadersInput) => Headers;
|
|
23
28
|
export declare const createNextAuth: ({ cookie, renewUrl }: NextAuthConfig) => NextAuth;
|
|
24
29
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;AAQF,MAAM,MAAM,wBAAwB,GAAG;IACnC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAIF,eAAO,MAAM,eAAe,mUAmBlB,CAAC;AAEX,eAAO,MAAM,mBAAmB,GAAI,+BAGjC,wBAAwB,KAAG,OAoB7B,CAAC;AAsBF,eAAO,MAAM,cAAc,GAAI,sBAAsB,cAAc,KAAG,QA8DrE,CAAC"}
|
|
@@ -2,9 +2,12 @@ import { createError } from "../../errors.js";
|
|
|
2
2
|
import { parseRenewAt, parseSessionToken, resolveSessionCookieNames, } from "../../session/cookie.js";
|
|
3
3
|
const RENEW_TIMEOUT = 5_000;
|
|
4
4
|
export const FORWARD_HEADERS = [
|
|
5
|
+
"accept-language",
|
|
5
6
|
"cf-connecting-ip",
|
|
6
7
|
"origin",
|
|
7
8
|
"referer",
|
|
9
|
+
"sec-ch-ua",
|
|
10
|
+
"sec-ch-ua-mobile",
|
|
8
11
|
"sec-ch-ua-platform",
|
|
9
12
|
"sec-fetch-dest",
|
|
10
13
|
"sec-fetch-mode",
|
|
@@ -14,23 +17,16 @@ export const FORWARD_HEADERS = [
|
|
|
14
17
|
"user-agent",
|
|
15
18
|
"x-forwarded-for",
|
|
16
19
|
"x-forwarded-host",
|
|
20
|
+
"x-forwarded-port",
|
|
17
21
|
"x-forwarded-proto",
|
|
18
22
|
"x-real-ip",
|
|
19
23
|
];
|
|
20
|
-
const
|
|
21
|
-
const
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
return cookie ? [cookie] : [];
|
|
27
|
-
};
|
|
28
|
-
const getForwardHeaders = ({ request, sessionName, token }) => {
|
|
29
|
-
const headers = new Headers({ cookie: `${sessionName}=${token}` });
|
|
30
|
-
for (const header of FORWARD_HEADERS) {
|
|
31
|
-
const value = request.headers.get(header);
|
|
32
|
-
if (value !== null) {
|
|
33
|
-
headers.set(header, value);
|
|
24
|
+
export const buildForwardHeaders = ({ extra = [], headers: incoming, }) => {
|
|
25
|
+
const headers = new Headers();
|
|
26
|
+
for (const name of [...FORWARD_HEADERS, ...extra]) {
|
|
27
|
+
const value = incoming.get(name);
|
|
28
|
+
if (value?.trim()) {
|
|
29
|
+
headers.set(name, value);
|
|
34
30
|
}
|
|
35
31
|
}
|
|
36
32
|
const origin = headers.get("origin")?.trim();
|
|
@@ -41,6 +37,19 @@ const getForwardHeaders = ({ request, sessionName, token }) => {
|
|
|
41
37
|
}
|
|
42
38
|
return headers;
|
|
43
39
|
};
|
|
40
|
+
const getSetCookies = (headers) => {
|
|
41
|
+
const cookieHeaders = headers;
|
|
42
|
+
if (typeof cookieHeaders.getSetCookie === "function") {
|
|
43
|
+
return cookieHeaders.getSetCookie();
|
|
44
|
+
}
|
|
45
|
+
const cookie = headers.get("set-cookie");
|
|
46
|
+
return cookie ? [cookie] : [];
|
|
47
|
+
};
|
|
48
|
+
const getRenewHeaders = ({ request, sessionName, token }) => {
|
|
49
|
+
const headers = buildForwardHeaders({ headers: request.headers });
|
|
50
|
+
headers.set("cookie", `${sessionName}=${token}`);
|
|
51
|
+
return headers;
|
|
52
|
+
};
|
|
44
53
|
export const createNextAuth = ({ cookie, renewUrl }) => {
|
|
45
54
|
const names = resolveSessionCookieNames(cookie);
|
|
46
55
|
let url;
|
|
@@ -80,7 +89,7 @@ export const createNextAuth = ({ cookie, renewUrl }) => {
|
|
|
80
89
|
}
|
|
81
90
|
const renewal = await fetch(url.toString(), {
|
|
82
91
|
cache: "no-store",
|
|
83
|
-
headers:
|
|
92
|
+
headers: getRenewHeaders({ request, sessionName: names.sessionName, token }),
|
|
84
93
|
method: "POST",
|
|
85
94
|
redirect: "error",
|
|
86
95
|
signal: AbortSignal.timeout(RENEW_TIMEOUT),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACH,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,GAC5B,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACH,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,GAC5B,MAAM,yBAAyB,CAAC;AAsCjC,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,iBAAiB;IACjB,kBAAkB;IAClB,QAAQ;IACR,SAAS;IACT,WAAW;IACX,kBAAkB;IAClB,oBAAoB;IACpB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,WAAW;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,EAChC,KAAK,GAAG,EAAE,EACV,OAAO,EAAE,QAAQ,GACM,EAAW,EAAE;IACpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,eAAe,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAY,EAAE;IACjD,MAAM,aAAa,GAAG,OAErB,CAAC;IAEF,IAAI,OAAO,aAAa,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAqB,EAAW,EAAE;IACpF,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC;IAEjD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAkB,EAAY,EAAE;IAC7E,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,WAAW,CAAC;YACd,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,8BAA8B;SAC1C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;YAE/E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO;oBACH,SAAS,EAAE,KAAK;oBAChB,QAAQ;oBACR,MAAM,EAAE,GAAG;iBACd,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YAE1E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC9D,OAAO;oBACH,SAAS,EAAE,KAAK;oBAChB,QAAQ;oBACR,MAAM,EAAE,IAAI;iBACf,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBACxC,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;gBAC5E,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;aAC7C,CAAC,CAAC;YAEH,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;YAED,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,QAAQ;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;aACzB,CAAC;QACN,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}
|