@ghuri/oauth 0.0.0-stage → 0.1.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ghuri contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,150 @@
-# Temporary Holding Version
+# @ghuri/oauth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Login building blocks for [Ghuri](https://github.com/ghurijs/ghuri), in the style of **Passport.js**: register
+**strategies** and turn them into views with `authenticate()`. OAuth 2.0 (PKCE), OpenID Connect (discovery, ID token
+validation), username/password, magic links and bearer tokens are built in; write your own for anything else. Runs on
+Cloudflare Workers and Node with WebCrypto only.
+
+For "Log in with GitHub / Google" without writing code, use [`@ghuri/socialauth`](https://github.com/ghurijs/socialauth),
+which is built on this package.
+
+> Status: alpha (ARCHITECTURE.md §17). Needs `@ghuri/core` and `@ghuri/auth` 0.1.0-alpha.1 or later.
+
+```sh
+npm install @ghuri/oauth
+```
+
+## Quick start
+
+```ts
+// src/accounts/strategies.ts
+import { MagicLinkStrategy, OIDCStrategy, strategies } from '@ghuri/oauth'
+import { User } from '@ghuri/auth'
+
+strategies.use(
+  'acme',
+  new OIDCStrategy(
+    {
+      name: 'acme',
+      issuer: 'https://login.acme.example',
+      clientId: (env) => env.ACME_CLIENT_ID,
+      clientSecret: (env) => env.ACME_CLIENT_SECRET,
+    },
+    // verify: the provider's profile → your user (null refuses the login)
+    async ({ profile }) =>
+      (await User.objects.filter({ email: profile.email }).first()) ??
+      User.objects.createUser(profile.username ?? profile.id, profile.email),
+  ),
+)
+
+strategies.use(
+  'email',
+  new MagicLinkStrategy(
+    { send: async ({ email, url }) => sendMail(email, 'Your login link', url) },
+    async ({ email }) => User.objects.filter({ email }).first(),
+  ),
+)
+```
+
+```ts
+// src/accounts/urls.ts
+import { path } from '@ghuri/core'
+import { authenticate } from '@ghuri/oauth'
+import './strategies'
+
+export const urlpatterns = [
+  // one URL for both legs: without ?code it redirects to the provider, with it it logs in
+  path('login/acme/', authenticate('acme', { failureRedirect: '/login/' })),
+  path('login/email/', authenticate('email', { successRedirect: '/' })),
+]
+```
+
+## Strategies
+
+A strategy's `authenticate(c, options)` returns one of:
+
+| Result | Meaning |
+|---|---|
+| `{ type: 'success', user, info? }` | Log this user in. |
+| `{ type: 'fail', status?, message?, challenge? }` | Refuse (`challenge` becomes `WWW-Authenticate`). |
+| `{ type: 'redirect', url }` | Send the browser somewhere (the provider). |
+| `{ type: 'pass' }` | Not for me: try the next strategy. |
+| `{ type: 'error', error }` | Something broke (becomes a 500). |
+| `{ type: 'response', response }` | The strategy answered itself ("we sent you a link"). |
+
+| Built-in | |
+|---|---|
+| `OAuth2Strategy` | Authorization code flow with PKCE (S256) and state. `authorizationURL`, `tokenURL`, `clientId`, `clientSecret`, `scope`, `userInfoURL` or `profile(tokens, ctx)`, `tokenAuth: 'body' \| 'basic'`, `authorizationParams`, `callbackURL`. |
+| `OIDCStrategy` | OAuth2 + discovery (`issuer`), `nonce`, ID token validation against the issuer's JWKS (RS*, PS*, ES*, EdDSA; `iss`, `aud`/`azp`, `exp`, `nbf`, `iat`, `nonce`), userinfo. `issuerValidation` for multi-tenant issuers. |
+| `LocalStrategy` | Username/password from a JSON or form POST. Default `verify` is `@ghuri/auth`'s `authenticate()`. |
+| `MagicLinkStrategy` | `POST { email }` sends a link (same answer for unknown addresses); `GET ?token=` logs in. Links expire (`maxAge`, default 15 minutes) and stop working after one login. |
+| `BearerStrategy` | `Authorization: Bearer <token>` → `verify(token)`. For API keys. |
+| `CustomStrategy` | `new CustomStrategy('name', (c, options) => result)`. |
+
+Settings values can be functions of the env: `clientId: (env) => env.ACME_CLIENT_ID`.
+
+Profiles are normalized: `{ provider, id, email?, emailVerified?, username?, name?, firstName?, lastName?, avatarUrl?, raw }`.
+
+## `authenticate(names, options)`
+
+Turns strategies into a view. Several names are tried in order until one does not pass.
+
+| Option | |
+|---|---|
+| `successRedirect` / `failureRedirect` | Where to go (failures add `?error=<message>`). |
+| `successReturnToOrRedirect` | The safe `next` kept across the round trip, else this. |
+| `respond` | `'session'` (default: `@ghuri/auth` `login()`), `'jwt'` (JSON `{ access, refresh, user }`), or `(c, user, info) => Response`. |
+| `session` | `false` to skip the session login. |
+| `next` | Override the `next` URL (default: the `?next=` query parameter). |
+| `scope`, `state` | Extra scopes; extra values kept across the round trip (`info.state`). |
+
+Without redirects configured, JSON clients get `{ user }` (or `{ detail }` with 401) and browsers go to a safe `next`
+or `LOGIN_REDIRECT_URL`. `runStrategy(c, names)` runs strategies inside your own view.
+
+## Round-trip state
+
+`state`, the PKCE verifier, the OIDC `nonce` and `next` live in an encrypted (AES-GCM, key derived from `SECRET_KEY`
+with HKDF), HttpOnly, `SameSite=Lax`, 10-minute cookie, so flows work without sessions. Up to five pending flows
+coexist (several tabs). A missing, expired or reused state fails with 400; the provider's `error=access_denied`
+fails with "You cancelled the login."
+
+## REST
+
+```ts
+import { StrategyAuthentication } from '@ghuri/oauth/rest'
+
+strategies.use('api-key', new BearerStrategy(async (token) => ApiKey.userFor(token)))
+
+class Reports extends APIView {
+  authenticationClasses = [StrategyAuthentication(['api-key'])]
+}
+```
+
+## Lower-level pieces
+
+`OAuth2Client` (`authorizationUrl`, `exchangeCode`, `refresh`, `revoke`), `discover(issuer)`, `verifyJwt(token, opts)`,
+`signJwt(payload, key, alg)`, `importPkcs8(pem, alg)`, `seal` / `unseal`, `pkcePair()`.
+
+## Settings
+
+```ts
+OAUTH: {
+  STATE_COOKIE: 'ghuri_oauth',
+  STATE_MAX_AGE: 600,
+  HTTP_TIMEOUT: 10_000,
+  CALLBACK_BASE_URL: undefined,   // default: the request's origin; set it behind proxies that rewrite the host
+}
+```
+
+## Testing
+
+```ts
+import { followOAuth, mockOAuthProvider } from '@ghuri/oauth/testing'
+
+const provider = mockOAuthProvider({ issuer: 'https://login.acme.example', profile: { sub: '42', email: 'ann@example.com', email_verified: true } })
+const res = await followOAuth(client, '/login/acme/', provider)   // redirect → approve → callback
+provider.restore()
+```
+
+The mock intercepts provider requests (token, userinfo, discovery, JWKS, plus `routes` you add), checks PKCE and the
+redirect URI, and signs ID tokens with a fresh ES256 key.

package/dist/chunk-IS4XX7EU.js

@@ -0,0 +1,68 @@
+// src/strategy.ts
+import { ImproperlyConfigured } from "@ghuri/core";
+var Strategy = class {
+  success(user, info) {
+    return { type: "success", user, info };
+  }
+  fail(message, status = 401, challenge) {
+    return { type: "fail", message, status, challenge };
+  }
+  redirect(url, status = 302) {
+    return { type: "redirect", url, status };
+  }
+  pass() {
+    return { type: "pass" };
+  }
+};
+var CustomStrategy = class extends Strategy {
+  constructor(name, fn) {
+    super();
+    this.name = name;
+    this.fn = fn;
+  }
+  name;
+  fn;
+  async authenticate(c, options) {
+    return this.fn(c, options);
+  }
+};
+var KEY = /* @__PURE__ */ Symbol.for("ghuri.oauth.strategies");
+var registry = (() => {
+  const g = globalThis;
+  if (!g[KEY]) g[KEY] = /* @__PURE__ */ new Map();
+  return g[KEY];
+})();
+var strategies = {
+  use(name, strategy) {
+    registry.set(name, strategy);
+  },
+  get(name) {
+    const s = registry.get(name);
+    if (!s) {
+      throw new ImproperlyConfigured(
+        `Unknown authentication strategy '${name}'. Register it with strategies.use('${name}', \u2026).`
+      );
+    }
+    return s;
+  },
+  has(name) {
+    return registry.has(name);
+  },
+  unuse(name) {
+    return registry.delete(name);
+  },
+  names() {
+    return [...registry.keys()];
+  }
+};
+function resolveStrategy(ref) {
+  return typeof ref === "string" ? strategies.get(ref) : ref;
+}
+
+export {
+  Strategy,
+  CustomStrategy,
+  strategies,
+  resolveStrategy
+};
+//# sourceMappingURL=chunk-IS4XX7EU.js.map

package/dist/chunk-IS4XX7EU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/strategy.ts"],"sourcesContent":["import { ImproperlyConfigured } from '@ghuri/core'\nimport type { Context } from 'hono'\nimport type { AuthenticateOptions, StrategyResult } from './types'\n\n/**\n * A way to authenticate a request (Passport.js's `Strategy`). `authenticate()` returns what happened:\n * success, fail, redirect, pass (not for me), error, or a response of its own.\n */\nexport abstract class Strategy {\n  abstract readonly name: string\n  abstract authenticate(c: Context, options: AuthenticateOptions): Promise<StrategyResult>\n\n  protected success(user: unknown, info?: Record<string, unknown>): StrategyResult {\n    return { type: 'success', user, info }\n  }\n  protected fail(message?: string, status = 401, challenge?: string): StrategyResult {\n    return { type: 'fail', message, status, challenge }\n  }\n  protected redirect(url: string, status = 302): StrategyResult {\n    return { type: 'redirect', url, status }\n  }\n  protected pass(): StrategyResult {\n    return { type: 'pass' }\n  }\n}\n\n/** A one-off strategy from a function: `new CustomStrategy('header', async (c) => …)`. */\nexport class CustomStrategy extends Strategy {\n  constructor(\n    readonly name: string,\n    private readonly fn: (\n      c: Context,\n      options: AuthenticateOptions,\n    ) => Promise<StrategyResult> | StrategyResult,\n  ) {\n    super()\n  }\n  async authenticate(c: Context, options: AuthenticateOptions): Promise<StrategyResult> {\n    return this.fn(c, options)\n  }\n}\n\nconst KEY = Symbol.for('ghuri.oauth.strategies')\nconst registry: Map<string, Strategy> = (() => {\n  const g = globalThis as any\n  if (!g[KEY]) g[KEY] = new Map<string, Strategy>()\n  return g[KEY]\n})()\n\n/** The strategy registry (Passport's `passport.use()`). */\nexport const strategies = {\n  use(name: string, strategy: Strategy): void {\n    registry.set(name, strategy)\n  },\n  get(name: string): Strategy {\n    const s = registry.get(name)\n    if (!s) {\n      throw new ImproperlyConfigured(\n        `Unknown authentication strategy '${name}'. Register it with strategies.use('${name}', …).`,\n      )\n    }\n    return s\n  },\n  has(name: string): boolean {\n    return registry.has(name)\n  },\n  unuse(name: string): boolean {\n    return registry.delete(name)\n  },\n  names(): string[] {\n    return [...registry.keys()]\n  },\n}\n\n/** A strategy instance or a registered name. */\nexport type StrategyRef = string | Strategy\n\nexport function resolveStrategy(ref: StrategyRef): Strategy {\n  return typeof ref === 'string' ? strategies.get(ref) : ref\n}\n"],"mappings":";AAAA,SAAS,4BAA4B;AAQ9B,IAAe,WAAf,MAAwB;AAAA,EAInB,QAAQ,MAAe,MAAgD;AAC/E,WAAO,EAAE,MAAM,WAAW,MAAM,KAAK;AAAA,EACvC;AAAA,EACU,KAAK,SAAkB,SAAS,KAAK,WAAoC;AACjF,WAAO,EAAE,MAAM,QAAQ,SAAS,QAAQ,UAAU;AAAA,EACpD;AAAA,EACU,SAAS,KAAa,SAAS,KAAqB;AAC5D,WAAO,EAAE,MAAM,YAAY,KAAK,OAAO;AAAA,EACzC;AAAA,EACU,OAAuB;AAC/B,WAAO,EAAE,MAAM,OAAO;AAAA,EACxB;AACF;AAGO,IAAM,iBAAN,cAA6B,SAAS;AAAA,EAC3C,YACW,MACQ,IAIjB;AACA,UAAM;AANG;AACQ;AAAA,EAMnB;AAAA,EAPW;AAAA,EACQ;AAAA,EAOnB,MAAM,aAAa,GAAY,SAAuD;AACpF,WAAO,KAAK,GAAG,GAAG,OAAO;AAAA,EAC3B;AACF;AAEA,IAAM,MAAM,uBAAO,IAAI,wBAAwB;AAC/C,IAAM,YAAmC,MAAM;AAC7C,QAAM,IAAI;AACV,MAAI,CAAC,EAAE,GAAG,EAAG,GAAE,GAAG,IAAI,oBAAI,IAAsB;AAChD,SAAO,EAAE,GAAG;AACd,GAAG;AAGI,IAAM,aAAa;AAAA,EACxB,IAAI,MAAc,UAA0B;AAC1C,aAAS,IAAI,MAAM,QAAQ;AAAA,EAC7B;AAAA,EACA,IAAI,MAAwB;AAC1B,UAAM,IAAI,SAAS,IAAI,IAAI;AAC3B,QAAI,CAAC,GAAG;AACN,YAAM,IAAI;AAAA,QACR,oCAAoC,IAAI,uCAAuC,IAAI;AAAA,MACrF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,IAAI,MAAuB;AACzB,WAAO,SAAS,IAAI,IAAI;AAAA,EAC1B;AAAA,EACA,MAAM,MAAuB;AAC3B,WAAO,SAAS,OAAO,IAAI;AAAA,EAC7B;AAAA,EACA,QAAkB;AAChB,WAAO,CAAC,GAAG,SAAS,KAAK,CAAC;AAAA,EAC5B;AACF;AAKO,SAAS,gBAAgB,KAA4B;AAC1D,SAAO,OAAO,QAAQ,WAAW,WAAW,IAAI,GAAG,IAAI;AACzD;","names":[]}

package/dist/chunk-OIBPPYBX.js

@@ -0,0 +1,112 @@
+import {
+  resolveStrategy
+} from "./chunk-IS4XX7EU.js";
+
+// src/authenticate.ts
+import { getBackends, isSafeRedirect, login, tokenPairForUser } from "@ghuri/auth";
+import {
+  getHost,
+  ImproperlyConfigured,
+  resolveUrl,
+  tryGetContext,
+  wantsJson
+} from "@ghuri/core";
+async function runStrategy(c, refs, options = {}) {
+  const list = Array.isArray(refs) ? refs : [refs];
+  for (const ref of list) {
+    const strategy = resolveStrategy(ref);
+    let result;
+    try {
+      result = await strategy.authenticate(c, options);
+    } catch (error) {
+      result = { type: "error", error };
+    }
+    if (result.type !== "pass") return { ...result, strategy: strategy.name };
+  }
+  return { type: "fail", status: 401, message: "Authentication credentials were not provided." };
+}
+function loginBackendName() {
+  const backend = getBackends().find((b) => typeof b.getUser === "function");
+  if (!backend) {
+    throw new ImproperlyConfigured(
+      "AUTHENTICATION_BACKENDS has no backend with getUser(); strategies cannot log users in."
+    );
+  }
+  return backend.backendName;
+}
+function userInfo(user) {
+  const M = user?.constructor;
+  const out = { pk: user.pk };
+  const uf = M?.USERNAME_FIELD ?? "username";
+  if (user[uf] !== void 0) out[uf] = user[uf];
+  const ef = M?.EMAIL_FIELD ?? "email";
+  if (user[ef] !== void 0 && ef !== uf) out[ef] = user[ef];
+  return out;
+}
+function loginRedirectUrl() {
+  return resolveUrl(
+    tryGetContext()?.settings.LOGIN_REDIRECT_URL ?? "/accounts/profile/"
+  );
+}
+async function completeLogin(c, user, info, options) {
+  const respond = options.respond ?? "session";
+  const useSession = options.session ?? respond !== "jwt";
+  if (useSession) await login(c, user, loginBackendName());
+  if (typeof respond === "function") return respond(c, user, info);
+  if (respond === "jwt") return c.json({ ...await tokenPairForUser(user), user: userInfo(user) });
+  const next = info?.next ?? c.req.query("next");
+  const safeNext = isSafeRedirect(next, [getHost(c)]) ? next : void 0;
+  let target;
+  if (options.successReturnToOrRedirect !== void 0) target = safeNext ?? options.successReturnToOrRedirect;
+  else if (options.successRedirect !== void 0) target = options.successRedirect;
+  else target = safeNext;
+  if (!target && wantsJson(c)) return c.json({ user: userInfo(user) });
+  return c.redirect(target ?? loginRedirectUrl(), 302);
+}
+function failureResponse(c, result, options) {
+  const message = result.message ?? "Authentication failed.";
+  if (options.failureRedirect && !wantsJson(c)) {
+    const url = new URL(options.failureRedirect, "http://x");
+    url.searchParams.set("error", message);
+    return c.redirect(`${options.failureRedirect.split("?")[0]}${url.search}`, 302);
+  }
+  const headers = {};
+  if (result.challenge) headers["WWW-Authenticate"] = result.challenge;
+  const status = result.status ?? 401;
+  if (wantsJson(c) || !options.failureRedirect) return c.json({ detail: message }, status, headers);
+  return c.text(message, status, headers);
+}
+function authenticate(refs, options = {}) {
+  const view = async (c) => {
+    const result = await runStrategy(c, refs, options);
+    switch (result.type) {
+      case "redirect":
+        return c.redirect(result.url, result.status ?? 302);
+      case "response":
+        return result.response;
+      case "error":
+        throw result.error;
+      case "fail":
+        return failureResponse(c, result, options);
+      case "success": {
+        if (result.user?.isActive === false) {
+          return failureResponse(c, { status: 401, message: "This account is inactive." }, options);
+        }
+        return completeLogin(c, result.user, result.info, options);
+      }
+      default:
+        return failureResponse(c, { status: 401 }, options);
+    }
+  };
+  return view;
+}
+
+export {
+  runStrategy,
+  loginBackendName,
+  userInfo,
+  completeLogin,
+  failureResponse,
+  authenticate
+};
+//# sourceMappingURL=chunk-OIBPPYBX.js.map

package/dist/chunk-OIBPPYBX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/authenticate.ts"],"sourcesContent":["// `authenticate(names, options)`: turn strategies into a view (Passport's `passport.authenticate()`).\nimport { getBackends, isSafeRedirect, login, tokenPairForUser } from '@ghuri/auth'\nimport {\n  getHost,\n  ImproperlyConfigured,\n  resolveUrl,\n  tryGetContext,\n  type ViewFunction,\n  wantsJson,\n} from '@ghuri/core'\nimport type { Context } from 'hono'\nimport { resolveStrategy, type StrategyRef } from './strategy'\nimport type { AuthenticateOptions, StrategyResult, StrategyUser } from './types'\n\nexport type NamedResult = StrategyResult & { strategy?: string }\n\n/** Run strategies in order until one does not `pass`. All pass → fail 401. Thrown errors → `error`. */\nexport async function runStrategy(\n  c: Context,\n  refs: StrategyRef | StrategyRef[],\n  options: AuthenticateOptions = {},\n): Promise<NamedResult> {\n  const list = Array.isArray(refs) ? refs : [refs]\n  for (const ref of list) {\n    const strategy = resolveStrategy(ref)\n    let result: StrategyResult\n    try {\n      result = await strategy.authenticate(c, options)\n    } catch (error) {\n      result = { type: 'error', error }\n    }\n    if (result.type !== 'pass') return { ...result, strategy: strategy.name }\n  }\n  return { type: 'fail', status: 401, message: 'Authentication credentials were not provided.' }\n}\n\n/** The name `login()` stores in the session: the first configured backend that can load users. */\nexport function loginBackendName(): string {\n  const backend = getBackends().find((b) => typeof b.getUser === 'function')\n  if (!backend) {\n    throw new ImproperlyConfigured(\n      'AUTHENTICATION_BACKENDS has no backend with getUser(); strategies cannot log users in.',\n    )\n  }\n  return backend.backendName\n}\n\nexport function userInfo(user: any): Record<string, unknown> {\n  const M = user?.constructor as { USERNAME_FIELD?: string; EMAIL_FIELD?: string } | undefined\n  const out: Record<string, unknown> = { pk: user.pk }\n  const uf = M?.USERNAME_FIELD ?? 'username'\n  if (user[uf] !== undefined) out[uf] = user[uf]\n  const ef = M?.EMAIL_FIELD ?? 'email'\n  if (user[ef] !== undefined && ef !== uf) out[ef] = user[ef]\n  return out\n}\n\nfunction loginRedirectUrl(): string {\n  return resolveUrl(\n    (tryGetContext()?.settings.LOGIN_REDIRECT_URL as string | undefined) ?? '/accounts/profile/',\n  )\n}\n\n/** Log `user` in and answer as `options` say. Exposed for packages that run strategies themselves. */\nexport async function completeLogin(\n  c: Context,\n  user: StrategyUser,\n  info: Record<string, unknown> | undefined,\n  options: AuthenticateOptions,\n): Promise<Response> {\n  const respond = options.respond ?? 'session'\n  const useSession = options.session ?? respond !== 'jwt'\n  if (useSession) await login(c, user, loginBackendName())\n  if (typeof respond === 'function') return respond(c, user, info)\n  if (respond === 'jwt') return c.json({ ...(await tokenPairForUser(user)), user: userInfo(user) })\n\n  const next = (info?.next as string | undefined) ?? c.req.query('next')\n  const safeNext = isSafeRedirect(next, [getHost(c)]) ? next : undefined\n  let target: string | undefined\n  if (options.successReturnToOrRedirect !== undefined) target = safeNext ?? options.successReturnToOrRedirect\n  else if (options.successRedirect !== undefined) target = options.successRedirect\n  else target = safeNext\n  if (!target && wantsJson(c)) return c.json({ user: userInfo(user) })\n  return c.redirect(target ?? loginRedirectUrl(), 302)\n}\n\nexport function failureResponse(\n  c: Context,\n  result: { status?: number; challenge?: string; message?: string },\n  options: AuthenticateOptions,\n): Response {\n  const message = result.message ?? 'Authentication failed.'\n  if (options.failureRedirect && !wantsJson(c)) {\n    const url = new URL(options.failureRedirect, 'http://x')\n    url.searchParams.set('error', message)\n    return c.redirect(`${options.failureRedirect.split('?')[0]}${url.search}`, 302)\n  }\n  const headers: Record<string, string> = {}\n  if (result.challenge) headers['WWW-Authenticate'] = result.challenge\n  const status = (result.status ?? 401) as 400 | 401 | 403\n  if (wantsJson(c) || !options.failureRedirect) return c.json({ detail: message }, status, headers)\n  return c.text(message, status, headers)\n}\n\n/**\n * A view that runs the strategies: `path('login/github/', authenticate('github', { successRedirect: '/' }))`.\n * Several names are tried in order (the first that does not pass wins).\n */\nexport function authenticate(\n  refs: StrategyRef | StrategyRef[],\n  options: AuthenticateOptions = {},\n): ViewFunction {\n  const view: ViewFunction = async (c) => {\n    const result = await runStrategy(c, refs, options)\n    switch (result.type) {\n      case 'redirect':\n        return c.redirect(result.url, (result.status ?? 302) as 302)\n      case 'response':\n        return result.response\n      case 'error':\n        throw result.error\n      case 'fail':\n        return failureResponse(c, result, options)\n      case 'success': {\n        if (result.user?.isActive === false) {\n          return failureResponse(c, { status: 401, message: 'This account is inactive.' }, options)\n        }\n        return completeLogin(c, result.user, result.info, options)\n      }\n      default:\n        return failureResponse(c, { status: 401 }, options)\n    }\n  }\n  return view\n}\n"],"mappings":";;;;;AACA,SAAS,aAAa,gBAAgB,OAAO,wBAAwB;AACrE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAQP,eAAsB,YACpB,GACA,MACA,UAA+B,CAAC,GACV;AACtB,QAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI;AAC/C,aAAW,OAAO,MAAM;AACtB,UAAM,WAAW,gBAAgB,GAAG;AACpC,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,aAAa,GAAG,OAAO;AAAA,IACjD,SAAS,OAAO;AACd,eAAS,EAAE,MAAM,SAAS,MAAM;AAAA,IAClC;AACA,QAAI,OAAO,SAAS,OAAQ,QAAO,EAAE,GAAG,QAAQ,UAAU,SAAS,KAAK;AAAA,EAC1E;AACA,SAAO,EAAE,MAAM,QAAQ,QAAQ,KAAK,SAAS,gDAAgD;AAC/F;AAGO,SAAS,mBAA2B;AACzC,QAAM,UAAU,YAAY,EAAE,KAAK,CAAC,MAAM,OAAO,EAAE,YAAY,UAAU;AACzE,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;AAEO,SAAS,SAAS,MAAoC;AAC3D,QAAM,IAAI,MAAM;AAChB,QAAM,MAA+B,EAAE,IAAI,KAAK,GAAG;AACnD,QAAM,KAAK,GAAG,kBAAkB;AAChC,MAAI,KAAK,EAAE,MAAM,OAAW,KAAI,EAAE,IAAI,KAAK,EAAE;AAC7C,QAAM,KAAK,GAAG,eAAe;AAC7B,MAAI,KAAK,EAAE,MAAM,UAAa,OAAO,GAAI,KAAI,EAAE,IAAI,KAAK,EAAE;AAC1D,SAAO;AACT;AAEA,SAAS,mBAA2B;AAClC,SAAO;AAAA,IACJ,cAAc,GAAG,SAAS,sBAA6C;AAAA,EAC1E;AACF;AAGA,eAAsB,cACpB,GACA,MACA,MACA,SACmB;AACnB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,aAAa,QAAQ,WAAW,YAAY;AAClD,MAAI,WAAY,OAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;AACvD,MAAI,OAAO,YAAY,WAAY,QAAO,QAAQ,GAAG,MAAM,IAAI;AAC/D,MAAI,YAAY,MAAO,QAAO,EAAE,KAAK,EAAE,GAAI,MAAM,iBAAiB,IAAI,GAAI,MAAM,SAAS,IAAI,EAAE,CAAC;AAEhG,QAAM,OAAQ,MAAM,QAA+B,EAAE,IAAI,MAAM,MAAM;AACrE,QAAM,WAAW,eAAe,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO;AAC7D,MAAI;AACJ,MAAI,QAAQ,8BAA8B,OAAW,UAAS,YAAY,QAAQ;AAAA,WACzE,QAAQ,oBAAoB,OAAW,UAAS,QAAQ;AAAA,MAC5D,UAAS;AACd,MAAI,CAAC,UAAU,UAAU,CAAC,EAAG,QAAO,EAAE,KAAK,EAAE,MAAM,SAAS,IAAI,EAAE,CAAC;AACnE,SAAO,EAAE,SAAS,UAAU,iBAAiB,GAAG,GAAG;AACrD;AAEO,SAAS,gBACd,GACA,QACA,SACU;AACV,QAAM,UAAU,OAAO,WAAW;AAClC,MAAI,QAAQ,mBAAmB,CAAC,UAAU,CAAC,GAAG;AAC5C,UAAM,MAAM,IAAI,IAAI,QAAQ,iBAAiB,UAAU;AACvD,QAAI,aAAa,IAAI,SAAS,OAAO;AACrC,WAAO,EAAE,SAAS,GAAG,QAAQ,gBAAgB,MAAM,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,MAAM,IAAI,GAAG;AAAA,EAChF;AACA,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,UAAW,SAAQ,kBAAkB,IAAI,OAAO;AAC3D,QAAM,SAAU,OAAO,UAAU;AACjC,MAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,gBAAiB,QAAO,EAAE,KAAK,EAAE,QAAQ,QAAQ,GAAG,QAAQ,OAAO;AAChG,SAAO,EAAE,KAAK,SAAS,QAAQ,OAAO;AACxC;AAMO,SAAS,aACd,MACA,UAA+B,CAAC,GAClB;AACd,QAAM,OAAqB,OAAO,MAAM;AACtC,UAAM,SAAS,MAAM,YAAY,GAAG,MAAM,OAAO;AACjD,YAAQ,OAAO,MAAM;AAAA,MACnB,KAAK;AACH,eAAO,EAAE,SAAS,OAAO,KAAM,OAAO,UAAU,GAAW;AAAA,MAC7D,KAAK;AACH,eAAO,OAAO;AAAA,MAChB,KAAK;AACH,cAAM,OAAO;AAAA,MACf,KAAK;AACH,eAAO,gBAAgB,GAAG,QAAQ,OAAO;AAAA,MAC3C,KAAK,WAAW;AACd,YAAI,OAAO,MAAM,aAAa,OAAO;AACnC,iBAAO,gBAAgB,GAAG,EAAE,QAAQ,KAAK,SAAS,4BAA4B,GAAG,OAAO;AAAA,QAC1F;AACA,eAAO,cAAc,GAAG,OAAO,MAAM,OAAO,MAAM,OAAO;AAAA,MAC3D;AAAA,MACA;AACE,eAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,GAAG,OAAO;AAAA,IACtD;AAAA,EACF;AACA,SAAO;AACT;","names":[]}