@gauts/auth 0.7.3 → 0.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +132 -76
- package/SECURITY.md +2 -0
- package/dist/adapters/hono/index.d.ts +3 -3
- package/dist/adapters/hono/index.d.ts.map +1 -1
- package/dist/adapters/hono/index.js +0 -1
- package/dist/adapters/hono/index.js.map +1 -1
- package/dist/adapters/hono/social.d.ts +13 -12
- package/dist/adapters/hono/social.d.ts.map +1 -1
- package/dist/adapters/hono/social.js +122 -85
- package/dist/adapters/hono/social.js.map +1 -1
- package/dist/errors.d.ts +1 -1
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/social/config.d.ts.map +1 -1
- package/dist/social/config.js +0 -16
- package/dist/social/config.js.map +1 -1
- package/dist/social/navigation.d.ts +14 -0
- package/dist/social/navigation.d.ts.map +1 -0
- package/dist/social/navigation.js +64 -0
- package/dist/social/navigation.js.map +1 -0
- package/dist/social/service.d.ts.map +1 -1
- package/dist/social/service.js +24 -3
- package/dist/social/service.js.map +1 -1
- package/dist/social/state.d.ts +11 -6
- package/dist/social/state.d.ts.map +1 -1
- package/dist/social/state.js +29 -6
- package/dist/social/state.js.map +1 -1
- package/dist/social/types.d.ts +11 -5
- package/dist/social/types.d.ts.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -36,21 +36,26 @@ Database-backed password authentication, opaque browser sessions, and optional s
|
|
|
36
36
|
|
|
37
37
|
## Quick start
|
|
38
38
|
|
|
39
|
-
The application defines its credential login, renewal, logout, protected endpoints
|
|
39
|
+
The application defines its credential login, renewal, logout, and protected endpoints. Optional addons are configured separately after this base setup.
|
|
40
40
|
|
|
41
41
|
### 1. Install the package
|
|
42
42
|
|
|
43
|
+
Run these commands inside the Hono API project:
|
|
44
|
+
|
|
43
45
|
```bash
|
|
44
46
|
npm install @gauts/auth
|
|
47
|
+
npm install hono @prisma/client
|
|
45
48
|
```
|
|
46
49
|
|
|
47
|
-
|
|
50
|
+
When the Next.js frontend is a separate project, run these commands inside the frontend project:
|
|
48
51
|
|
|
49
52
|
```bash
|
|
50
|
-
npm install
|
|
53
|
+
npm install @gauts/auth
|
|
51
54
|
npm install next
|
|
52
55
|
```
|
|
53
56
|
|
|
57
|
+
`hono`, `@prisma/client`, and `next` only need to be installed when the corresponding project does not already provide them. The API imports `@gauts/auth/hono` and `@gauts/auth/prisma`; the frontend imports `@gauts/auth/next`.
|
|
58
|
+
|
|
54
59
|
### 2. Add the Prisma schema
|
|
55
60
|
|
|
56
61
|
The default adapter uses this fixed relationship tree:
|
|
@@ -58,11 +63,10 @@ The default adapter uses this fixed relationship tree:
|
|
|
58
63
|
```text
|
|
59
64
|
users
|
|
60
65
|
└── user_accounts
|
|
61
|
-
|
|
62
|
-
└── social_accounts (optional)
|
|
66
|
+
└── account_sessions
|
|
63
67
|
```
|
|
64
68
|
|
|
65
|
-
Add the three required models to the API schema.
|
|
69
|
+
Add the three required models to the API schema. Social authentication is an optional addon with its own schema instructions later in this README.
|
|
66
70
|
|
|
67
71
|
```prisma
|
|
68
72
|
model users {
|
|
@@ -105,30 +109,6 @@ model account_sessions {
|
|
|
105
109
|
}
|
|
106
110
|
```
|
|
107
111
|
|
|
108
|
-
When social authentication is enabled, add this relation inside `user_accounts`:
|
|
109
|
-
|
|
110
|
-
```prisma
|
|
111
|
-
socials social_accounts[]
|
|
112
|
-
```
|
|
113
|
-
|
|
114
|
-
Then add the optional model:
|
|
115
|
-
|
|
116
|
-
```prisma
|
|
117
|
-
model social_accounts {
|
|
118
|
-
id String @id @default(uuid()) @db.VarChar(255)
|
|
119
|
-
account_id String @db.VarChar(255)
|
|
120
|
-
provider String @db.VarChar(32)
|
|
121
|
-
provider_id String @db.VarChar(255)
|
|
122
|
-
created_at DateTime @default(now()) @db.Timestamp(0)
|
|
123
|
-
|
|
124
|
-
account user_accounts @relation(fields: [account_id], references: [id], onDelete: Cascade)
|
|
125
|
-
|
|
126
|
-
@@unique([provider, provider_id])
|
|
127
|
-
@@unique([account_id, provider])
|
|
128
|
-
@@index([account_id])
|
|
129
|
-
}
|
|
130
|
-
```
|
|
131
|
-
|
|
132
112
|
Create the migration through the application's Prisma workflow, then regenerate its client:
|
|
133
113
|
|
|
134
114
|
```bash
|
|
@@ -188,7 +168,7 @@ app.post("/auth/login", async (c) => {
|
|
|
188
168
|
|
|
189
169
|
const passwordValid = await auth.password.verify({
|
|
190
170
|
password: body.password,
|
|
191
|
-
storedHash: account?.
|
|
171
|
+
storedHash: account?.password_hash,
|
|
192
172
|
});
|
|
193
173
|
|
|
194
174
|
if (!account || !passwordValid) {
|
|
@@ -246,6 +226,7 @@ import { nextAuth } from "./lib/auth.js";
|
|
|
246
226
|
|
|
247
227
|
export const proxy = async (request: NextRequest) => {
|
|
248
228
|
const response = NextResponse.next();
|
|
229
|
+
|
|
249
230
|
const renewal = await nextAuth.renew({
|
|
250
231
|
request,
|
|
251
232
|
response,
|
|
@@ -464,22 +445,20 @@ The cache is signed but not encrypted. Do not place passwords, password hashes,
|
|
|
464
445
|
|
|
465
446
|
### Prisma adapter
|
|
466
447
|
|
|
467
|
-
The Prisma adapter uses one fixed, predictable session relationship tree
|
|
448
|
+
The Prisma adapter uses one fixed, predictable session relationship tree:
|
|
468
449
|
|
|
469
450
|
```text
|
|
470
451
|
users
|
|
471
452
|
└── user_accounts
|
|
472
|
-
|
|
473
|
-
└── social_accounts (optional)
|
|
453
|
+
└── account_sessions
|
|
474
454
|
```
|
|
475
455
|
|
|
476
|
-
The required default delegate names are `prisma.users`, `prisma.user_accounts`, and `prisma.account_sessions`.
|
|
456
|
+
The required default delegate names are `prisma.users`, `prisma.user_accounts`, and `prisma.account_sessions`. The fixed Prisma relation fields are:
|
|
477
457
|
|
|
478
458
|
- `user_accounts.user`;
|
|
479
459
|
- `account_sessions.account`;
|
|
480
|
-
- `social_accounts.account` when social persistence is present.
|
|
481
460
|
|
|
482
|
-
There is no relation mapping configuration. Applications may rename delegates with `table`, add payload fields with `select`, and define access conditions with `access`.
|
|
461
|
+
There is no relation mapping configuration. Applications may rename delegates with `table`, add payload fields with `select`, and define access conditions with `access`.
|
|
483
462
|
|
|
484
463
|
#### Default models
|
|
485
464
|
|
|
@@ -544,10 +523,6 @@ const db = createPrismaAdapter({
|
|
|
544
523
|
sessions: {
|
|
545
524
|
table: "admin_sessions",
|
|
546
525
|
},
|
|
547
|
-
// Only when social authentication is enabled.
|
|
548
|
-
socials: {
|
|
549
|
-
table: "admin_social_accounts",
|
|
550
|
-
},
|
|
551
526
|
users: {
|
|
552
527
|
table: "admin_users",
|
|
553
528
|
select: ["role", "status"],
|
|
@@ -558,7 +533,7 @@ const db = createPrismaAdapter({
|
|
|
558
533
|
|
|
559
534
|
| Property | Type / allowed values | Required | Default | Description |
|
|
560
535
|
| ------------------------ | --------------------------------------- | :------: | -------------------- | ---------------------------------------------------------- |
|
|
561
|
-
| `client` | Generated Prisma client | ✅ | — | Prisma client containing the three required auth models.
|
|
536
|
+
| `client` | Generated Prisma client | ✅ | — | Prisma client containing the three required auth models. |
|
|
562
537
|
| `models.users.table` | Compatible user delegate name | ❌ | `"users"` | Overrides the user delegate. |
|
|
563
538
|
| `models.users.select` | Unique scalar field array | ❌ | `[]` | Adds payload fields; `id` and `name` are always included. |
|
|
564
539
|
| `models.users.access` | Scalar equality or allowed-value arrays | ❌ | `{}` | Conditions required on the owning user/entity. |
|
|
@@ -566,7 +541,6 @@ const db = createPrismaAdapter({
|
|
|
566
541
|
| `models.accounts.select` | Unique scalar field array | ❌ | `[]` | Adds payload fields; `id` and `email` are always included. |
|
|
567
542
|
| `models.accounts.access` | Scalar equality or allowed-value arrays | ❌ | `{}` | Conditions required on the authenticating account. |
|
|
568
543
|
| `models.sessions.table` | Compatible session delegate name | ❌ | `"account_sessions"` | Overrides authoritative session persistence. |
|
|
569
|
-
| `models.socials.table` | Compatible social delegate name | ❌ | `"social_accounts"` | Overrides optional provider association persistence. |
|
|
570
544
|
|
|
571
545
|
`select` accepts JSON-safe scalar fields and receives autocomplete from the generated Prisma client. `password`, `hash`, `password_hash`, and `passwordHash` are rejected by both TypeScript and runtime validation. Never select tokens or other secrets because the optional cache is signed, not encrypted.
|
|
572
546
|
|
|
@@ -717,9 +691,63 @@ await auth.createSession({
|
|
|
717
691
|
|
|
718
692
|
## Social authentication
|
|
719
693
|
|
|
720
|
-
Social authentication is disabled unless `social` is configured.
|
|
694
|
+
Social authentication is an optional addon and remains disabled unless `social` is configured. Complete these steps only in applications that need Google, GitHub, or X authentication.
|
|
695
|
+
|
|
696
|
+
### 1. Add the social Prisma schema
|
|
697
|
+
|
|
698
|
+
Add the social relation inside the existing `user_accounts` model in the API schema:
|
|
699
|
+
|
|
700
|
+
```prisma
|
|
701
|
+
model user_accounts {
|
|
702
|
+
// Existing fields and relations...
|
|
703
|
+
|
|
704
|
+
socials social_accounts[]
|
|
705
|
+
}
|
|
706
|
+
```
|
|
707
|
+
|
|
708
|
+
Then add the provider association model:
|
|
709
|
+
|
|
710
|
+
```prisma
|
|
711
|
+
model social_accounts {
|
|
712
|
+
id String @id @default(uuid()) @db.VarChar(255)
|
|
713
|
+
account_id String @db.VarChar(255)
|
|
714
|
+
provider String @db.VarChar(32)
|
|
715
|
+
provider_id String @db.VarChar(255)
|
|
716
|
+
created_at DateTime @default(now()) @db.Timestamp(0)
|
|
717
|
+
|
|
718
|
+
account user_accounts @relation(fields: [account_id], references: [id], onDelete: Cascade)
|
|
719
|
+
|
|
720
|
+
@@unique([provider, provider_id])
|
|
721
|
+
@@unique([account_id, provider])
|
|
722
|
+
@@index([account_id])
|
|
723
|
+
}
|
|
724
|
+
```
|
|
725
|
+
|
|
726
|
+
Run the social migration from the API project, then regenerate its Prisma client:
|
|
727
|
+
|
|
728
|
+
```bash
|
|
729
|
+
npx prisma migrate dev --name add_social_auth
|
|
730
|
+
npx prisma generate
|
|
731
|
+
```
|
|
732
|
+
|
|
733
|
+
Without this model, `createPrismaAdapter()` remains a session-only adapter. Configuring `social` without social database capabilities fails during application startup.
|
|
734
|
+
|
|
735
|
+
The default Prisma delegate is `prisma.social_accounts` and its relation to `user_accounts` must be named `account`. Configure a different compatible delegate only when the application uses another model name:
|
|
736
|
+
|
|
737
|
+
```ts
|
|
738
|
+
const db = createPrismaAdapter({
|
|
739
|
+
client: prisma,
|
|
740
|
+
models: {
|
|
741
|
+
socials: {
|
|
742
|
+
table: "admin_social_accounts",
|
|
743
|
+
},
|
|
744
|
+
},
|
|
745
|
+
});
|
|
746
|
+
```
|
|
747
|
+
|
|
748
|
+
### 2. Configure the providers
|
|
721
749
|
|
|
722
|
-
|
|
750
|
+
Import only the providers used by the API:
|
|
723
751
|
|
|
724
752
|
```ts
|
|
725
753
|
import { createHonoAuth } from "@gauts/auth/hono";
|
|
@@ -730,7 +758,6 @@ export const auth = createHonoAuth({
|
|
|
730
758
|
db: createPrismaAdapter({ client: prisma }),
|
|
731
759
|
secret: requiredEnv("AUTH_SECRET"),
|
|
732
760
|
social: {
|
|
733
|
-
errorUrl: "https://app.example.com/auth/login",
|
|
734
761
|
providers: [
|
|
735
762
|
google({
|
|
736
763
|
callbackUrl: "https://app.example.com/proxy/auth/social/google/callback",
|
|
@@ -748,46 +775,68 @@ export const auth = createHonoAuth({
|
|
|
748
775
|
clientSecret: requiredEnv("X_CLIENT_SECRET"),
|
|
749
776
|
}),
|
|
750
777
|
],
|
|
751
|
-
successUrl: "https://app.example.com/dashboard",
|
|
752
778
|
},
|
|
753
779
|
});
|
|
754
780
|
```
|
|
755
781
|
|
|
756
|
-
|
|
782
|
+
Register every `callbackUrl` shown above in the corresponding provider dashboard.
|
|
783
|
+
|
|
784
|
+
### 3. Add the API route and frontend start
|
|
785
|
+
|
|
786
|
+
Declare one dynamic API route covering every configured provider. `social.handle` is Hono middleware: it completes `start` and expected error responses itself, then calls the application handler only after a successful callback.
|
|
757
787
|
|
|
758
788
|
```ts
|
|
759
|
-
app.get("/auth/social/:provider/:action", async (c) => {
|
|
760
|
-
|
|
789
|
+
app.get("/auth/social/:provider/:action", auth.social.handle, async (c) => {
|
|
790
|
+
const social = c.get("social");
|
|
791
|
+
|
|
792
|
+
await auth.createSession({
|
|
793
|
+
account_id: social.account.id,
|
|
794
|
+
context: c,
|
|
795
|
+
});
|
|
796
|
+
|
|
797
|
+
// Application notifications, audit logs, or other login work.
|
|
798
|
+
|
|
799
|
+
return c.redirect(social.returnTo);
|
|
761
800
|
});
|
|
762
801
|
```
|
|
763
802
|
|
|
764
|
-
The
|
|
803
|
+
The frontend starts authentication with local navigation paths:
|
|
765
804
|
|
|
766
805
|
```text
|
|
767
|
-
GET /proxy/auth/social/google/start?intent=login
|
|
768
|
-
GET /proxy/auth/social/google/start?intent=register
|
|
806
|
+
GET /proxy/auth/social/google/start?intent=login&returnTo=/dashboard&errorTo=/auth/login
|
|
807
|
+
GET /proxy/auth/social/google/start?intent=register&returnTo=/dashboard&errorTo=/auth/login
|
|
769
808
|
GET /proxy/auth/social/google/callback
|
|
770
|
-
GET /proxy/auth/social/github/start?intent=login
|
|
809
|
+
GET /proxy/auth/social/github/start?intent=login&returnTo=/dashboard&errorTo=/auth/login
|
|
771
810
|
GET /proxy/auth/social/github/callback
|
|
772
|
-
GET /proxy/auth/social/x/start?intent=login
|
|
811
|
+
GET /proxy/auth/social/x/start?intent=login&returnTo=/dashboard&errorTo=/auth/login
|
|
773
812
|
GET /proxy/auth/social/x/callback
|
|
774
813
|
```
|
|
775
814
|
|
|
776
|
-
`intent` defaults to `login`.
|
|
815
|
+
`intent` defaults to `login`. `returnTo` and `errorTo` are required local paths supplied by the frontend. `registerTo` is required only when registration continues in an application form. The package rejects external URLs, signs these paths into the OAuth transaction, and never trusts callback query parameters for navigation.
|
|
816
|
+
|
|
817
|
+
Only `start` and `callback` are accepted as actions. The public `/proxy` path in this example forwards to the Hono `/auth` path. Provider callback URLs must exactly match the public callback paths registered with each provider.
|
|
818
|
+
|
|
819
|
+
On an authenticated callback the middleware exposes:
|
|
777
820
|
|
|
778
|
-
|
|
821
|
+
```ts
|
|
822
|
+
const social = c.get("social");
|
|
823
|
+
|
|
824
|
+
social.account;
|
|
825
|
+
social.identity;
|
|
826
|
+
social.registered;
|
|
827
|
+
social.returnTo;
|
|
828
|
+
```
|
|
829
|
+
|
|
830
|
+
The package does not create the application route, session, notifications, logs, or final success response. Those remain explicit in the route handler.
|
|
779
831
|
|
|
780
832
|
### Social configuration
|
|
781
833
|
|
|
782
834
|
| Property | Type / allowed values | Required | Default | Description |
|
|
783
835
|
| ---------------------------- | ------------------------------------ | :---------: | --------- | -------------------------------------------------------------------------- |
|
|
784
836
|
| `social.providers` | `SocialProvider[]` | ✅ | — | Configured Google, GitHub, or X providers. |
|
|
785
|
-
| `social.successUrl` | Absolute HTTP(S) URL | ✅ | — | Fixed redirect after session creation. |
|
|
786
|
-
| `social.errorUrl` | Absolute HTTP(S) URL | ✅ | — | Fixed redirect for expected provider/authentication failures. |
|
|
787
837
|
| `social.cookieName` | Valid cookie name | ❌ | `"__soc"` | Signed temporary OAuth/registration transaction cookie. |
|
|
788
838
|
| `social.registration` | `SocialRegistrationConfig` | ❌ | Disabled | Enables default or application-specific social registration. |
|
|
789
|
-
| `registration.
|
|
790
|
-
| `registration.createAccount` | Async callback returning `accountId` | Conditional | Built-in | Creates required business data when the default structure is insufficient. |
|
|
839
|
+
| `registration.createAccount` | Async callback returning `accountId` | ❌ | Built-in | Creates required business data when the default structure is insufficient. |
|
|
791
840
|
|
|
792
841
|
Provider configuration:
|
|
793
842
|
|
|
@@ -818,26 +867,22 @@ Login only (default):
|
|
|
818
867
|
|
|
819
868
|
```ts
|
|
820
869
|
social: {
|
|
821
|
-
errorUrl,
|
|
822
870
|
providers: [googleProvider],
|
|
823
|
-
successUrl,
|
|
824
871
|
}
|
|
825
872
|
```
|
|
826
873
|
|
|
827
|
-
Default registration creates `users { id, name }`, `user_accounts { id, email, user_id }`, the provider link
|
|
874
|
+
Default registration creates `users { id, name }`, `user_accounts { id, email, user_id }`, and the provider link. The application route creates the session after the middleware succeeds:
|
|
828
875
|
|
|
829
876
|
```ts
|
|
830
877
|
social: {
|
|
831
|
-
errorUrl,
|
|
832
878
|
providers: [googleProvider],
|
|
833
879
|
registration: {},
|
|
834
|
-
successUrl,
|
|
835
880
|
}
|
|
836
881
|
```
|
|
837
882
|
|
|
838
883
|
This requires every additional application column on `users` and `user_accounts` to be nullable or have a database default.
|
|
839
884
|
|
|
840
|
-
For additional required form data, configure
|
|
885
|
+
For additional required form data, configure the account callback:
|
|
841
886
|
|
|
842
887
|
```ts
|
|
843
888
|
import type { SocialRegistrationInput } from "@gauts/auth";
|
|
@@ -847,10 +892,8 @@ type RegisterData = {
|
|
|
847
892
|
};
|
|
848
893
|
|
|
849
894
|
social: {
|
|
850
|
-
errorUrl,
|
|
851
895
|
providers: [googleProvider],
|
|
852
896
|
registration: {
|
|
853
|
-
registerUrl: "https://app.example.com/auth/register/social",
|
|
854
897
|
createAccount: async ({ data, identity }: SocialRegistrationInput<RegisterData>) => {
|
|
855
898
|
const account = await createApplicationAccount({
|
|
856
899
|
companyNumber: data.companyNumber,
|
|
@@ -861,11 +904,16 @@ social: {
|
|
|
861
904
|
return { accountId: account.id };
|
|
862
905
|
},
|
|
863
906
|
},
|
|
864
|
-
successUrl,
|
|
865
907
|
}
|
|
866
908
|
```
|
|
867
909
|
|
|
868
|
-
The
|
|
910
|
+
The frontend includes `registerTo` when it starts OAuth:
|
|
911
|
+
|
|
912
|
+
```text
|
|
913
|
+
/proxy/auth/social/google/start?intent=register&returnTo=/dashboard&errorTo=/auth/login®isterTo=/auth/register/social
|
|
914
|
+
```
|
|
915
|
+
|
|
916
|
+
The application endpoints read the verified identity and complete registration:
|
|
869
917
|
|
|
870
918
|
```ts
|
|
871
919
|
app.get("/auth/register/social", (c) => {
|
|
@@ -875,25 +923,31 @@ app.get("/auth/register/social", (c) => {
|
|
|
875
923
|
app.post("/auth/register/social", async (c) => {
|
|
876
924
|
const data = await c.req.json<{ companyNumber: string }>();
|
|
877
925
|
|
|
878
|
-
await auth.social.completeRegistration({
|
|
926
|
+
const social = await auth.social.completeRegistration({
|
|
879
927
|
context: c,
|
|
880
928
|
data,
|
|
881
929
|
});
|
|
882
930
|
|
|
883
|
-
|
|
931
|
+
await auth.createSession({
|
|
932
|
+
account_id: social.account.id,
|
|
933
|
+
context: c,
|
|
934
|
+
});
|
|
935
|
+
|
|
936
|
+
return c.json({ registered: true, returnTo: social.returnTo });
|
|
884
937
|
});
|
|
885
938
|
```
|
|
886
939
|
|
|
887
|
-
`
|
|
940
|
+
`registerTo` requires `createAccount`; otherwise submitted application data would have no owner. `createAccount` must create the fixed `users`/`user_accounts` relation and return the created account ID. The package then creates `social_accounts`; the application explicitly creates the authenticated session.
|
|
888
941
|
|
|
889
942
|
### OAuth security
|
|
890
943
|
|
|
891
944
|
- Authorization Code flow with PKCE `S256` is used for every provider.
|
|
892
|
-
- State and
|
|
945
|
+
- State, PKCE verifier, intent, and local navigation paths live in the signed, HttpOnly `__soc` cookie for at most 10 minutes.
|
|
893
946
|
- The temporary cookie is cleared after success or expected failure.
|
|
894
947
|
- Only provider-verified email addresses are accepted.
|
|
895
948
|
- Provider IDs, not email addresses, are the stable social link identifiers.
|
|
896
|
-
-
|
|
949
|
+
- The current verified provider email must match the linked account email on every login.
|
|
950
|
+
- Frontend navigation accepts local paths only. The paths are validated before OAuth, signed into the transaction, and restored only after state validation.
|
|
897
951
|
- Social OAuth requires `SameSite=Lax` or `SameSite=None`; `Strict` fails during startup.
|
|
898
952
|
|
|
899
953
|
### Core and adapter composition
|
|
@@ -1040,6 +1094,7 @@ type AuthErrorCode =
|
|
|
1040
1094
|
| "SOCIAL_ACCOUNT_INVALID"
|
|
1041
1095
|
| "SOCIAL_ACCOUNT_NOT_FOUND"
|
|
1042
1096
|
| "SOCIAL_EMAIL_INVALID"
|
|
1097
|
+
| "SOCIAL_EMAIL_MISMATCH"
|
|
1043
1098
|
| "SOCIAL_PROVIDER_ERROR"
|
|
1044
1099
|
| "SOCIAL_REGISTRATION_INVALID"
|
|
1045
1100
|
| "SOCIAL_STATE_INVALID"
|
|
@@ -1059,6 +1114,7 @@ Use `isAuthError(error)` before reading `error.code`.
|
|
|
1059
1114
|
| `SOCIAL_ACCOUNT_INVALID` | `403` | Linked account or owning user failed configured access rules. |
|
|
1060
1115
|
| `SOCIAL_ACCOUNT_NOT_FOUND` | `401` | Provider identity is not linked and registration is unavailable. |
|
|
1061
1116
|
| `SOCIAL_EMAIL_INVALID` | `400` | Provider did not return a verified usable email address. |
|
|
1117
|
+
| `SOCIAL_EMAIL_MISMATCH` | `409` | Verified provider email differs from the linked account email. |
|
|
1062
1118
|
| `SOCIAL_PROVIDER_ERROR` | `401` | Provider denied or failed the OAuth exchange. |
|
|
1063
1119
|
| `SOCIAL_REGISTRATION_INVALID` | `400` | Custom registration did not return a valid account ID. |
|
|
1064
1120
|
| `SOCIAL_STATE_INVALID` | `400` | OAuth/registration state is missing, altered, or expired. |
|
package/SECURITY.md
CHANGED
|
@@ -49,6 +49,8 @@ Activity and possession of the session token cannot extend this absolute limit.
|
|
|
49
49
|
|
|
50
50
|
Configured providers use OAuth Authorization Code with PKCE `S256`. A cryptographically random state value and PKCE verifier are bound to a signed, HttpOnly transaction cookie that expires after 10 minutes. The package accepts only verified provider email addresses and stores only the normalized provider name and stable provider account ID.
|
|
51
51
|
|
|
52
|
+
An existing provider link authenticates only when the provider's current verified email matches the linked account email after case-insensitive normalization. Email changes are rejected explicitly and never relinked automatically to another account.
|
|
53
|
+
|
|
52
54
|
Provider access tokens, refresh tokens, and raw profiles are never persisted or exposed to registration callbacks. Success, error, callback, and optional registration URLs are fixed startup configuration; request parameters cannot select redirect targets.
|
|
53
55
|
|
|
54
56
|
The consuming application must protect custom social registration endpoints with its normal CSRF, host, origin, rate-limit, and validation policies. `AUTH_SECRET` must remain server-only and contain at least 32 high-entropy bytes.
|
|
@@ -4,9 +4,9 @@ import { type SessionCacheConfig } from "../../session/cache.js";
|
|
|
4
4
|
import type { AuthAccount, DbAdapter, ResolvedSession, Session } from "../../session/types.js";
|
|
5
5
|
import type { SocialConfig, SocialDbAdapter } from "../../social/types.js";
|
|
6
6
|
import { type HonoSocial } from "./social.js";
|
|
7
|
-
export type { SessionCacheConfig } from "../../session/cache.js";
|
|
8
|
-
export type { HonoSocial } from "./social.js";
|
|
9
7
|
import { type SessionCookieNames } from "../../session/cookie.js";
|
|
8
|
+
export type { SessionCacheConfig } from "../../session/cache.js";
|
|
9
|
+
export type { HonoSocial, HonoSocialEnv, HonoSocialVariables } from "./social.js";
|
|
10
10
|
export type HonoAuthVariables<TAccount extends AuthAccount = AuthAccount> = {
|
|
11
11
|
account: TAccount;
|
|
12
12
|
session: Session;
|
|
@@ -72,7 +72,7 @@ export type HonoAdapter<TAccount extends AuthAccount = AuthAccount> = {
|
|
|
72
72
|
};
|
|
73
73
|
export type HonoAuth<TAccount extends AuthAccount = AuthAccount> = Auth<TAccount> & HonoAdapter<TAccount>;
|
|
74
74
|
export type HonoSocialAuth<TAccount extends AuthAccount = AuthAccount, TData = undefined> = Auth<TAccount> & HonoAdapter<TAccount> & {
|
|
75
|
-
social: HonoSocial<TData>;
|
|
75
|
+
social: HonoSocial<TAccount, TData>;
|
|
76
76
|
};
|
|
77
77
|
export declare const createHonoAdapter: <TAccount extends AuthAccount>({ auth, cache, cookie, getIp, secret, }: HonoAdapterConfig<TAccount>) => HonoAdapter<TAccount>;
|
|
78
78
|
type CreateHonoAuth = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE5D,OAAO,EAAc,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrE,OAAO,EAGH,KAAK,kBAAkB,EAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE5D,OAAO,EAAc,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrE,OAAO,EAGH,KAAK,kBAAkB,EAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAIH,KAAK,kBAAkB,EAC1B,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElF,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IACxE,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI,GAAG,GAAG;IACxE,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CACpB,CAAC,EAAE,OAAO,KACT,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAEpE,KAAK,gBAAgB,GACf;IACI,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAClB,GACD;IACI,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAER,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IACxE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,YAAY,CAAC,QAAQ,SAAS,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG;IAC/E,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;CACrB,CAAC;AAEF,KAAK,iBAAiB,CAAC,QAAQ,SAAS,WAAW,EAAE,KAAK,IACpD;IACI,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;CAC/B,GACD;IACI,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,SAAS,CAAC;CACtB,CAAC;AAER,MAAM,MAAM,cAAc,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,GAAG,SAAS,IAAI,IAAI,CAC5F,YAAY,CAAC,QAAQ,CAAC,EACtB,IAAI,CACP,GACG,gBAAgB,GAChB,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAEvC,KAAK,eAAe,CAAC,QAAQ,SAAS,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GACnF,gBAAgB,CAAC;AAErB,KAAK,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,SAAS,CAAC,MAAM,QAAQ,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/E,KAAK,kBAAkB,GAAG;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAcF,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IAClE,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,cAAc,EAAE,iBAAiB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,QAAQ,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,GAC7E,WAAW,CAAC,QAAQ,CAAC,CAAC;AAE1B,MAAM,MAAM,cAAc,CACtB,QAAQ,SAAS,WAAW,GAAG,WAAW,EAC1C,KAAK,GAAG,SAAS,IACjB,IAAI,CAAC,QAAQ,CAAC,GACd,WAAW,CAAC,QAAQ,CAAC,GAAG;IACpB,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;CACvC,CAAC;AA0DN,eAAO,MAAM,iBAAiB,GAAI,QAAQ,SAAS,WAAW,EAAE,yCAM7D,iBAAiB,CAAC,QAAQ,CAAC,KAAG,WAAW,CAAC,QAAQ,CAmOpD,CAAC;AAEF,KAAK,cAAc,GAAG;IAClB,CAAC,GAAG,SAAS,SAAS,EAAE,KAAK,EACzB,KAAK,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG;QACrC,EAAE,EAAE,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;KAC/B,GACF,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC,GAAG,SAAS,SAAS,EAClB,KAAK,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG;QACrC,EAAE,EAAE,GAAG,CAAC;QACR,MAAM,CAAC,EAAE,SAAS,CAAC;KACtB,GACF,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC;AAgEF,eAAO,MAAM,cAAc,EAAyB,cAAc,CAAC"}
|
|
@@ -271,7 +271,6 @@ const createHonoAuthImpl = ({ cache, cookie, db, getIp, password, secret, sessio
|
|
|
271
271
|
social: createHonoSocial({
|
|
272
272
|
config: social,
|
|
273
273
|
cookie: resolvedCookie.options,
|
|
274
|
-
createSession: (input) => adapter.createSession(input),
|
|
275
274
|
db: socialDb,
|
|
276
275
|
sessionCookieNames: Object.values(resolvedCookie.names),
|
|
277
276
|
secret,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACH,kBAAkB,GAGrB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACH,kBAAkB,GAGrB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAC;AAChE,OAAO,EACH,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAE5B,MAAM,yBAAyB,CAAC;AA0HjC,MAAM,aAAa,GAAG,CAAC,SAA2B,EAAE,EAAE,EAAE;IACpD,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;IAErC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,wCAAwC;SACpD,CAAC,CAAC;IACP,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,6DAA6D;aACzE,CAAC,CAAC;QACP,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,wCAAwC;aACpD,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,4CAA4C;SACxD,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,KAAK;QACL,OAAO,EAAE;YACL,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,QAAQ,EAAE,IAAa;YACvB,IAAI;YACJ,QAAQ;YACR,MAAM;SACT;KACJ,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;AAEvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAA+B,EAC5D,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,EACL,MAAM,GACoB,EAAyB,EAAE;IACrD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QACrD,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,gCAAgC;SAC5C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,6DAA6D;SACzE,CAAC,CAAC;IACP,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,YAAY,GAAkC,IAAI,CAAC;IAEvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,qEAAqE;aACjF,CAAC,CAAC;QACP,CAAC;QAED,YAAY,GAAG,kBAAkB,CAAW;YACxC,MAAM,EAAE,KAAK;YACb,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC/B,CAAC,CAAC;IACP,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,EAAE,CAAU,EAA+B,EAAE,CAAC,CAAC;QACzE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;QACzC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC7C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,IAAI;KACvD,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAiB,EAAE;QAC3C,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAmB,EAAQ,EAAE;QAC7E,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE;YAClD,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;YACxE,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAA2B,EAAQ,EAAE;QACpF,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE;YACvD,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAU,EAAQ,EAAE;QACpC,IAAI,YAAY,EAAE,CAAC;YACf,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAQ,EAAE;QACtC,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAU,EAAE;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACtC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,EAC5B,MAAM,EACN,OAAO,EACP,KAAK,GACe,EAAsC,EAAE;QAC5D,IAAI,KAAK,CAAC;QAEV,IAAI,CAAC;YACD,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBACjE,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YAED,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACtC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,EACzB,UAAU,EACV,OAAO,EACP,OAAO,GACU,EAAoB,EAAE;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACtC,UAAU;YACV,MAAM,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC;YACvC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,KAAK,GAA8B;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC;QAEF,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7D,OAAO,OAAO,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,EAAE,CAAU,EAAsC,EAAE;QAC5E,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3C,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;gBAChC,MAAM;gBACN,KAAK;gBACL,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;aAChD,CAAC,CAAC;YAEH,IAAI,MAAM,EAAE,CAAC;gBACT,OAAO,MAAM,CAAC;YAClB,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC3B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACJ,UAAU,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,CAAU,EAAoB,EAAE;QACxD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC;QAEZ,IAAI,CAAC;YACD,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC/B,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC;gBACjC,KAAK;aACR,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBACjE,YAAY,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YAED,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACtC,CAAC,CAAC;QACP,CAAC;QAED,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,cAAc,GAA6C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;QAEtC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,CAAU,EAAqB,EAAE;QAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,YAAY,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,OAAO,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO;QACH,YAAY;QACZ,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,cAAc;QACd,cAAc;QACd,aAAa;KAChB,CAAC;AACN,CAAC,CAAC;AAkBF,MAAM,kBAAkB,GAAG,CAAkD,EACzE,KAAK,EACL,MAAM,EACN,EAAE,EACF,KAAK,EACL,QAAQ,EACR,MAAM,EACN,OAAO,EACP,MAAM,GACwB,EAAwD,EAAE;IACxF,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,EAAE;QACF,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAC9B,IAAI;QACJ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9C,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACH,GAAG,IAAI;YACP,GAAG,OAAO;SACb,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAG,EAA8D,CAAC;IAChF,MAAM,OAAO,GAAwC;QACjD,eAAe;QACf,cAAc;QACd,aAAa;QACb,WAAW;QACX,YAAY;KACf,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;QACnE,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,oDAAoD;SAChE,CAAC,CAAC;IACP,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAE7C,OAAO;QACH,GAAG,IAAI;QACP,GAAG,OAAO;QACV,MAAM,EAAE,gBAAgB,CAAC;YACrB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,cAAc,CAAC,OAAO;YAC9B,EAAE,EAAE,QAA2D;YAC/D,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YACvD,MAAM;SACT,CAAC;KACL,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAoC,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
import type { Context } from "hono";
|
|
2
|
-
import type {
|
|
3
|
-
import type {
|
|
1
|
+
import type { Context, Env, MiddlewareHandler } from "hono";
|
|
2
|
+
import type { SocialAuthenticated, SocialConfig, SocialDbAdapter, SocialIdentity } from "../../social/types.js";
|
|
3
|
+
import type { AuthAccount } from "../../session/types.js";
|
|
4
4
|
type CookieOptions = {
|
|
5
5
|
domain?: string;
|
|
6
6
|
httpOnly: true;
|
|
@@ -8,14 +8,9 @@ type CookieOptions = {
|
|
|
8
8
|
sameSite: "Strict" | "Lax" | "None";
|
|
9
9
|
secure: boolean;
|
|
10
10
|
};
|
|
11
|
-
type CreateSessionInput = {
|
|
12
|
-
account_id: string;
|
|
13
|
-
context: Context;
|
|
14
|
-
};
|
|
15
11
|
type HonoSocialDeps<TAccount extends AuthAccount, TData> = {
|
|
16
12
|
config: SocialConfig<TData>;
|
|
17
13
|
cookie: CookieOptions;
|
|
18
|
-
createSession: (input: CreateSessionInput) => Promise<Session>;
|
|
19
14
|
db: SocialDbAdapter<TAccount>;
|
|
20
15
|
sessionCookieNames: readonly string[];
|
|
21
16
|
secret: string;
|
|
@@ -24,11 +19,17 @@ type CompleteRegistrationInput<TData> = {
|
|
|
24
19
|
context: Context;
|
|
25
20
|
data: TData;
|
|
26
21
|
};
|
|
27
|
-
export type
|
|
28
|
-
|
|
22
|
+
export type HonoSocialVariables<TAccount extends AuthAccount = AuthAccount> = {
|
|
23
|
+
social: SocialAuthenticated<TAccount>;
|
|
24
|
+
};
|
|
25
|
+
export type HonoSocialEnv<TAccount extends AuthAccount = AuthAccount> = Env & {
|
|
26
|
+
Variables: HonoSocialVariables<TAccount>;
|
|
27
|
+
};
|
|
28
|
+
export type HonoSocial<TAccount extends AuthAccount = AuthAccount, TData = undefined> = {
|
|
29
|
+
completeRegistration(input: CompleteRegistrationInput<TData>): Promise<SocialAuthenticated<TAccount>>;
|
|
29
30
|
getRegistration(c: Context): SocialIdentity;
|
|
30
|
-
handle:
|
|
31
|
+
handle: MiddlewareHandler<HonoSocialEnv<TAccount>>;
|
|
31
32
|
};
|
|
32
|
-
export declare const createHonoSocial: <TAccount extends AuthAccount, TData>({ config: input, cookie,
|
|
33
|
+
export declare const createHonoSocial: <TAccount extends AuthAccount, TData>({ config: input, cookie, db, sessionCookieNames, secret, }: HonoSocialDeps<TAccount, TData>) => HonoSocial<TAccount, TData>;
|
|
33
34
|
export {};
|
|
34
35
|
//# sourceMappingURL=social.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"social.d.ts","sourceRoot":"","sources":["../../../src/adapters/hono/social.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"social.d.ts","sourceRoot":"","sources":["../../../src/adapters/hono/social.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAa5D,OAAO,KAAK,EACR,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,cAAc,EAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,KAAK,aAAa,GAAG;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,KAAK,cAAc,CAAC,QAAQ,SAAS,WAAW,EAAE,KAAK,IAAI;IACvD,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9B,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,yBAAyB,CAAC,KAAK,IAAI;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IAC1E,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI,GAAG,GAAG;IAC1E,SAAS,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,GAAG,SAAS,IAAI;IACpF,oBAAoB,CAChB,KAAK,EAAE,yBAAyB,CAAC,KAAK,CAAC,GACxC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IAC5C,MAAM,EAAE,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;CACtD,CAAC;AAmDF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,WAAW,EAAE,KAAK,EAAE,4DAMnE,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAmQ9D,CAAC"}
|