@ghuri/oauth 0.0.0-stage → 0.1.0-alpha.0

package/dist/chunk-TSKPVGEC.js

@@ -0,0 +1,717 @@
+import {
+  Strategy
+} from "./chunk-IS4XX7EU.js";
+
+// src/errors.ts
+import { GhuriError } from "@ghuri/core";
+var OAuthError = class extends GhuriError {
+  constructor(message, code, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+  }
+  code;
+  details;
+};
+var TokenValidationError = class extends OAuthError {
+};
+
+// src/http.ts
+import { tryGetContext } from "@ghuri/core";
+var KEY = /* @__PURE__ */ Symbol.for("ghuri.oauth.fetch");
+function setProviderFetch(fn) {
+  ;
+  globalThis[KEY] = fn;
+}
+function providerFetch(input, init = {}) {
+  const fn = globalThis[KEY] ?? fetch;
+  const timeout = tryGetContext()?.settings.OAUTH?.HTTP_TIMEOUT ?? 1e4;
+  const headers = new Headers(init.headers);
+  if (!headers.has("user-agent")) headers.set("user-agent", "ghuri-oauth");
+  return fn(input, { ...init, headers, signal: init.signal ?? AbortSignal.timeout(timeout) });
+}
+async function readBody(res) {
+  const text = await res.text();
+  const type = res.headers.get("content-type") ?? "";
+  if (type.includes("application/x-www-form-urlencoded") || !type.includes("json") && text.includes("=") && !text.trim().startsWith("{")) {
+    return Object.fromEntries(new URLSearchParams(text));
+  }
+  try {
+    return text ? JSON.parse(text) : {};
+  } catch {
+    throw new OAuthError(
+      `Provider answered ${res.status} with a body that is not JSON.`,
+      "invalid_response",
+      text.slice(0, 200)
+    );
+  }
+}
+async function getJson(url, init = {}) {
+  const headers = new Headers(init.headers);
+  if (!headers.has("accept")) headers.set("accept", "application/json");
+  const res = await providerFetch(url, { ...init, headers });
+  const body = await readBody(res);
+  if (!res.ok) {
+    throw new OAuthError(
+      `GET ${new URL(url).origin}${new URL(url).pathname} failed with ${res.status}.`,
+      body.error ?? "http_error",
+      body
+    );
+  }
+  return body;
+}
+
+// src/client.ts
+function toTokens(body) {
+  const accessToken = body.access_token;
+  if (typeof accessToken !== "string" || !accessToken) {
+    throw new OAuthError(
+      String(body.error_description ?? body.error ?? "The provider did not return an access token."),
+      typeof body.error === "string" ? body.error : "invalid_token_response",
+      body
+    );
+  }
+  const expiresIn = body.expires_in === void 0 ? void 0 : Number(body.expires_in);
+  return {
+    accessToken,
+    tokenType: typeof body.token_type === "string" ? body.token_type : void 0,
+    refreshToken: typeof body.refresh_token === "string" ? body.refresh_token : void 0,
+    expiresIn: Number.isFinite(expiresIn) ? expiresIn : void 0,
+    expiresAt: Number.isFinite(expiresIn) ? Date.now() + expiresIn * 1e3 : void 0,
+    idToken: typeof body.id_token === "string" ? body.id_token : void 0,
+    scope: typeof body.scope === "string" ? body.scope : void 0,
+    raw: body
+  };
+}
+var OAuth2Client = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  authorizationUrl(opts) {
+    const url = new URL(this.config.authorizationURL);
+    const q = url.searchParams;
+    q.set("response_type", "code");
+    q.set("client_id", this.config.clientId);
+    q.set("redirect_uri", opts.redirectUri);
+    q.set("state", opts.state);
+    if (opts.scope?.length) q.set("scope", opts.scope.join(this.config.scopeSeparator ?? " "));
+    if (opts.codeChallenge) {
+      q.set("code_challenge", opts.codeChallenge);
+      q.set("code_challenge_method", "S256");
+    }
+    if (opts.nonce) q.set("nonce", opts.nonce);
+    for (const [k, v] of Object.entries(opts.params ?? {})) q.set(k, v);
+    return url.toString();
+  }
+  async tokenRequest(form) {
+    const body = new URLSearchParams(form);
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    };
+    if (this.config.tokenAuth === "basic" && this.config.clientSecret !== void 0) {
+      const id = encodeURIComponent(this.config.clientId);
+      const secret = encodeURIComponent(this.config.clientSecret);
+      headers.authorization = `Basic ${btoa(`${id}:${secret}`)}`;
+    } else {
+      body.set("client_id", this.config.clientId);
+      if (this.config.clientSecret !== void 0) body.set("client_secret", this.config.clientSecret);
+    }
+    const res = await providerFetch(this.config.tokenURL, { method: "POST", headers, body });
+    const data = await readBody(res);
+    if (!res.ok && !data.error) {
+      throw new OAuthError(`The token endpoint answered ${res.status}.`, "http_error", data);
+    }
+    return toTokens(data);
+  }
+  exchangeCode(code, redirectUri, codeVerifier) {
+    const form = { grant_type: "authorization_code", code, redirect_uri: redirectUri };
+    if (codeVerifier) form.code_verifier = codeVerifier;
+    return this.tokenRequest(form);
+  }
+  refresh(refreshToken, scope) {
+    const form = { grant_type: "refresh_token", refresh_token: refreshToken };
+    if (scope?.length) form.scope = scope.join(this.config.scopeSeparator ?? " ");
+    return this.tokenRequest(form);
+  }
+  /** RFC 7009 token revocation (needs `revocationURL`). */
+  async revoke(token, hint) {
+    if (!this.config.revocationURL) throw new OAuthError("This provider has no revocation endpoint.");
+    const body = new URLSearchParams({ token, client_id: this.config.clientId });
+    if (hint) body.set("token_type_hint", hint);
+    if (this.config.clientSecret !== void 0) body.set("client_secret", this.config.clientSecret);
+    const res = await providerFetch(this.config.revocationURL, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body
+    });
+    if (!res.ok) throw new OAuthError(`Token revocation failed with ${res.status}.`, "revocation_failed");
+  }
+};
+
+// src/crypto.ts
+import { ImproperlyConfigured, tryGetContext as tryGetContext2 } from "@ghuri/core";
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+function b64url(bytes) {
+  const u = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (const b of u) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromB64url(value) {
+  const s = value.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(s + "=".repeat((4 - s.length % 4) % 4));
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function utf8(value) {
+  return enc.encode(value);
+}
+function fromUtf8(bytes) {
+  return dec.decode(bytes);
+}
+function randomToken(bytes = 32) {
+  return b64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function sha256(value) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", utf8(value)));
+}
+async function pkcePair() {
+  const verifier = randomToken(32);
+  return { verifier, challenge: b64url(await sha256(verifier)) };
+}
+function secretKey() {
+  const key = tryGetContext2()?.settings.SECRET_KEY;
+  if (!key) throw new ImproperlyConfigured("The SECRET_KEY setting must not be empty.");
+  return key;
+}
+function fallbackKeys() {
+  return tryGetContext2()?.settings.SECRET_KEY_FALLBACKS ?? [];
+}
+var keyCache = /* @__PURE__ */ new Map();
+async function aesKey(secret, purpose) {
+  const id = `${purpose}\0${secret}`;
+  let k = keyCache.get(id);
+  if (!k) {
+    k = (async () => {
+      const base = await crypto.subtle.importKey("raw", utf8(secret), "HKDF", false, ["deriveKey"]);
+      return crypto.subtle.deriveKey(
+        { name: "HKDF", hash: "SHA-256", salt: utf8("ghuri.oauth"), info: utf8(purpose) },
+        base,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["encrypt", "decrypt"]
+      );
+    })();
+    if (keyCache.size > 32) keyCache.clear();
+    keyCache.set(id, k);
+  }
+  return k;
+}
+async function seal(plaintext, purpose) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const key = await aesKey(secretKey(), purpose);
+  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, utf8(plaintext)));
+  const out = new Uint8Array(iv.length + ct.length);
+  out.set(iv);
+  out.set(ct, iv.length);
+  return b64url(out);
+}
+async function unseal(sealed, purpose) {
+  let data;
+  try {
+    data = fromB64url(sealed);
+  } catch {
+    return null;
+  }
+  if (data.length < 13) return null;
+  const iv = data.slice(0, 12);
+  const ct = data.slice(12);
+  for (const secret of [secretKey(), ...fallbackKeys()]) {
+    try {
+      const key = await aesKey(secret, purpose);
+      return fromUtf8(new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ct)));
+    } catch {
+    }
+  }
+  return null;
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let r = 0;
+  for (let i = 0; i < a.length; i++) r |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return r === 0;
+}
+
+// src/jwt.ts
+var SUPPORTED_ALGORITHMS = [
+  "RS256",
+  "RS384",
+  "RS512",
+  "PS256",
+  "PS384",
+  "PS512",
+  "ES256",
+  "ES384",
+  "ES512",
+  "EdDSA"
+];
+function params(alg) {
+  const hash = `SHA-${alg.slice(2)}`;
+  switch (alg.slice(0, 2)) {
+    case "RS":
+      return {
+        importParams: { name: "RSASSA-PKCS1-v1_5", hash },
+        verifyParams: { name: "RSASSA-PKCS1-v1_5" }
+      };
+    case "PS":
+      return {
+        importParams: { name: "RSA-PSS", hash },
+        verifyParams: { name: "RSA-PSS", saltLength: Number(alg.slice(2)) / 8 }
+      };
+    case "ES": {
+      const namedCurve = { ES256: "P-256", ES384: "P-384", ES512: "P-521" }[alg];
+      return { importParams: { name: "ECDSA", namedCurve }, verifyParams: { name: "ECDSA", hash } };
+    }
+    default:
+      return { importParams: { name: "Ed25519" }, verifyParams: { name: "Ed25519" } };
+  }
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new TokenValidationError("Malformed JWT.");
+  try {
+    return {
+      header: JSON.parse(fromUtf8(fromB64url(parts[0]))),
+      payload: JSON.parse(fromUtf8(fromB64url(parts[1]))),
+      signingInput: `${parts[0]}.${parts[1]}`,
+      signature: fromB64url(parts[2])
+    };
+  } catch {
+    throw new TokenValidationError("Malformed JWT.");
+  }
+}
+var JWKS_TTL = 60 * 60 * 1e3;
+var JWKS_MIN_REFRESH = 60 * 1e3;
+var jwksCache = /* @__PURE__ */ new Map();
+async function fetchJwks(uri) {
+  const doc = await getJson(uri);
+  const keys = Array.isArray(doc.keys) ? doc.keys : [];
+  jwksCache.set(uri, { keys, fetchedAt: Date.now() });
+  return keys;
+}
+async function findKey(uri, kid, kty) {
+  const pick = (keys) => keys.find((k) => (kid === void 0 || k.kid === kid) && k.kty === kty && (!k.use || k.use === "sig"));
+  const cached = jwksCache.get(uri);
+  if (cached && Date.now() - cached.fetchedAt < JWKS_TTL) {
+    const k = pick(cached.keys);
+    if (k) return k;
+    if (Date.now() - cached.fetchedAt < JWKS_MIN_REFRESH) return void 0;
+  }
+  return pick(await fetchJwks(uri));
+}
+function clearJwksCache() {
+  jwksCache.clear();
+}
+function ktyFor(alg) {
+  return alg.startsWith("ES") ? "EC" : alg === "EdDSA" ? "OKP" : "RSA";
+}
+async function verifyJwt(token, opts) {
+  const { header, payload, signingInput, signature } = decodeJwt(token);
+  const alg = header.alg;
+  if (!(opts.algorithms ?? SUPPORTED_ALGORITHMS).includes(alg)) {
+    throw new TokenValidationError(`Unsupported or disallowed JWT algorithm '${header.alg}'.`);
+  }
+  const kty = ktyFor(alg);
+  let jwk;
+  if (opts.keys)
+    jwk = opts.keys.find((k) => (header.kid === void 0 || k.kid === header.kid) && k.kty === kty);
+  else if (opts.jwksUri) jwk = await findKey(opts.jwksUri, header.kid, kty);
+  if (!jwk) throw new TokenValidationError(`No signing key found for kid '${header.kid ?? ""}'.`);
+  const { importParams, verifyParams } = params(alg);
+  let ok;
+  try {
+    const { alg: _a, use: _u, key_ops: _k, ...bare } = jwk;
+    const key = await crypto.subtle.importKey("jwk", bare, importParams, false, ["verify"]);
+    ok = await crypto.subtle.verify(verifyParams, key, signature, utf8(signingInput));
+  } catch {
+    ok = false;
+  }
+  if (!ok) throw new TokenValidationError("Invalid JWT signature.");
+  const now = Math.floor(Date.now() / 1e3);
+  const leeway = opts.leeway ?? 60;
+  if (opts.issuer !== void 0) {
+    const iss = String(payload.iss ?? "");
+    const good = typeof opts.issuer === "function" ? opts.issuer(iss) : iss === opts.issuer;
+    if (!good) throw new TokenValidationError(`Unexpected issuer '${iss}'.`);
+  }
+  if (opts.audience !== void 0) {
+    const aud = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    if (!aud.includes(opts.audience))
+      throw new TokenValidationError("The token was issued for another client.");
+    if (aud.length > 1 && payload.azp !== void 0 && payload.azp !== opts.audience) {
+      throw new TokenValidationError("The token was issued for another client (azp).");
+    }
+  }
+  if (typeof payload.exp !== "number" || payload.exp + leeway < now)
+    throw new TokenValidationError("The token expired.");
+  if (typeof payload.nbf === "number" && payload.nbf - leeway > now)
+    throw new TokenValidationError("The token is not valid yet.");
+  if (typeof payload.iat === "number" && payload.iat - leeway > now)
+    throw new TokenValidationError("The token was issued in the future.");
+  if (opts.nonce !== void 0 && payload.nonce !== opts.nonce)
+    throw new TokenValidationError("Nonce mismatch.");
+  return payload;
+}
+async function signJwt(payload, key, alg, header = {}) {
+  const { importParams, verifyParams } = params(alg);
+  const cryptoKey = key instanceof CryptoKey ? key : await crypto.subtle.importKey(
+    "jwk",
+    (({ alg: _a, use: _u, key_ops: _k, ...bare }) => bare)(key),
+    importParams,
+    false,
+    ["sign"]
+  );
+  const h = b64url(utf8(JSON.stringify({ alg, typ: "JWT", ...header })));
+  const p = b64url(utf8(JSON.stringify(payload)));
+  const sig = await crypto.subtle.sign(verifyParams, cryptoKey, utf8(`${h}.${p}`));
+  return `${h}.${p}.${b64url(sig)}`;
+}
+async function importPkcs8(pem, alg) {
+  const body = pem.replace(/-----(BEGIN|END) PRIVATE KEY-----/g, "").replace(/\s+/g, "");
+  const der = Uint8Array.from(atob(body), (ch) => ch.charCodeAt(0));
+  return crypto.subtle.importKey("pkcs8", der, params(alg).importParams, false, ["sign"]);
+}
+
+// src/state.ts
+import { isSecure, tryGetContext as tryGetContext3 } from "@ghuri/core";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+var PURPOSE = "oauth-state";
+var MAX_FLOWS = 5;
+function stateSettings() {
+  const s = tryGetContext3()?.settings.OAUTH ?? {};
+  return { cookie: s.STATE_COOKIE ?? "ghuri_oauth", maxAge: s.STATE_MAX_AGE ?? 600 };
+}
+async function read(c) {
+  const { cookie, maxAge } = stateSettings();
+  const raw = getCookie(c, cookie);
+  if (!raw) return [];
+  const json = await unseal(raw, PURPOSE);
+  if (!json) return [];
+  try {
+    const flows = JSON.parse(json);
+    const now = Date.now();
+    return Array.isArray(flows) ? flows.filter((f) => f && now - f.createdAt <= maxAge * 1e3) : [];
+  } catch {
+    return [];
+  }
+}
+async function write(c, flows) {
+  const { cookie, maxAge } = stateSettings();
+  if (!flows.length) {
+    deleteCookie(c, cookie, { path: "/", secure: isSecure(c) });
+    return;
+  }
+  setCookie(c, cookie, await seal(JSON.stringify(flows), PURPOSE), {
+    path: "/",
+    httpOnly: true,
+    secure: isSecure(c),
+    // Lax: the provider's redirect back is a top-level GET navigation, which Lax cookies accompany.
+    sameSite: "Lax",
+    maxAge
+  });
+}
+async function savePending(c, flow) {
+  const flows = (await read(c)).filter((f) => f.state !== flow.state);
+  flows.push(flow);
+  await write(c, flows.slice(-MAX_FLOWS));
+}
+async function takePending(c, state) {
+  if (!state) return null;
+  const flows = await read(c);
+  const flow = flows.find((f) => f.state === state) ?? null;
+  if (flow)
+    await write(
+      c,
+      flows.filter((f) => f !== flow)
+    );
+  return flow;
+}
+
+// src/oauth2.ts
+import { getHost, isSecure as isSecure2, tryGetContext as tryGetContext4 } from "@ghuri/core";
+async function envValue(value) {
+  if (typeof value === "function") {
+    return value(tryGetContext4()?.env ?? {});
+  }
+  return value;
+}
+function profileFromClaims(provider, raw) {
+  const id = raw.sub ?? raw.id ?? raw.user_id;
+  if (id === void 0 || id === null)
+    throw new OAuthError("The provider profile has no user id.", "invalid_profile");
+  const verified = raw.email_verified ?? raw.verified_email;
+  return {
+    provider,
+    id: String(id),
+    email: typeof raw.email === "string" ? raw.email : void 0,
+    emailVerified: verified === void 0 ? void 0 : verified === true || verified === "true",
+    username: raw.preferred_username ?? raw.login ?? raw.username ?? raw.nickname ?? void 0,
+    name: raw.name ?? void 0,
+    firstName: raw.given_name ?? raw.first_name ?? void 0,
+    lastName: raw.family_name ?? raw.last_name ?? void 0,
+    avatarUrl: raw.picture ?? raw.avatar_url ?? void 0,
+    raw
+  };
+}
+function origin(c) {
+  const base = tryGetContext4()?.settings.OAUTH?.CALLBACK_BASE_URL;
+  if (base) return base.replace(/\/+$/, "");
+  return `${isSecure2(c) ? "https" : "http"}://${getHost(c)}`;
+}
+var OAuth2Strategy = class extends Strategy {
+  constructor(options, verify) {
+    super();
+    this.options = options;
+    this.verify = verify;
+    this.name = options.name ?? "oauth2";
+  }
+  options;
+  verify;
+  name;
+  async client() {
+    const o = this.options;
+    return new OAuth2Client({
+      authorizationURL: await envValue(o.authorizationURL),
+      tokenURL: await envValue(o.tokenURL),
+      clientId: await envValue(o.clientId),
+      clientSecret: o.clientSecret === void 0 ? void 0 : await envValue(o.clientSecret),
+      tokenAuth: o.tokenAuth,
+      revocationURL: o.revocationURL === void 0 ? void 0 : await envValue(o.revocationURL),
+      scopeSeparator: o.scopeSeparator
+    });
+  }
+  async callbackUrl(c) {
+    const configured = this.options.callbackURL === void 0 ? void 0 : await envValue(this.options.callbackURL);
+    if (configured && /^https?:\/\//i.test(configured)) return configured;
+    return `${origin(c)}${configured ?? c.req.path}`;
+  }
+  /** Extra authorization parameters and flow fields; OIDC adds a nonce. */
+  async startExtras(_c) {
+    return {};
+  }
+  scopes(options) {
+    return [.../* @__PURE__ */ new Set([...this.options.scope ?? [], ...options.scope ?? []])];
+  }
+  async authenticate(c, options) {
+    const q = c.req.query();
+    if (q.error) {
+      await takePending(c, q.state);
+      const message = q.error === "access_denied" ? "You cancelled the login." : q.error_description || q.error;
+      return { type: "fail", status: 401, message };
+    }
+    if (q.code) return this.callback(c, q.code, q.state);
+    return this.start(c, options);
+  }
+  async start(c, options) {
+    const client = await this.client();
+    const state = randomToken(24);
+    const pkce = this.options.pkce === false ? void 0 : await pkcePair();
+    const extras = await this.startExtras(c);
+    const redirectUri = await this.callbackUrl(c);
+    const next = options.next ?? c.req.query("next");
+    await savePending(c, {
+      state,
+      strategy: this.name,
+      redirectUri,
+      verifier: pkce?.verifier,
+      nonce: extras.nonce,
+      next: next || void 0,
+      extra: options.state,
+      createdAt: Date.now()
+    });
+    const ap = this.options.authorizationParams;
+    const params2 = { ...typeof ap === "function" ? ap(c) : ap ?? {}, ...extras.params ?? {} };
+    const url = client.authorizationUrl({
+      redirectUri,
+      state,
+      scope: this.scopes(options),
+      codeChallenge: pkce?.challenge,
+      nonce: extras.nonce,
+      params: params2
+    });
+    return { type: "redirect", url, status: 302 };
+  }
+  async callback(c, code, state) {
+    const flow = await takePending(c, state);
+    if (!flow || flow.strategy !== this.name) {
+      return {
+        type: "fail",
+        status: 400,
+        message: "This login link expired or was already used. Please try again."
+      };
+    }
+    let tokens;
+    let profile;
+    try {
+      const client = await this.client();
+      tokens = await client.exchangeCode(code, flow.redirectUri, flow.verifier);
+      profile = await this.userProfile(tokens, c, flow);
+    } catch (err) {
+      if (err instanceof OAuthError) return { type: "fail", status: 401, message: err.message };
+      throw err;
+    }
+    const result = await this.verify({ profile, tokens, c, flow });
+    if (!result) return { type: "fail", status: 401, message: "This account is not allowed to log in." };
+    const info = { profile, tokens, next: flow.next, state: flow.extra };
+    if (typeof result === "object" && "user" in result && Object.keys(result).every((k) => k === "user" || k === "info")) {
+      return { type: "success", user: result.user, info: { ...info, ...result.info ?? {} } };
+    }
+    return { type: "success", user: result, info };
+  }
+  profileContext(c, tokens) {
+    return {
+      c,
+      getJson,
+      getJsonAuthed: (url, init = {}) => {
+        const headers = new Headers(init.headers);
+        headers.set("authorization", `Bearer ${tokens.accessToken}`);
+        return getJson(url, { ...init, headers });
+      }
+    };
+  }
+  /** The normalized profile for these tokens. */
+  async userProfile(tokens, c, _flow) {
+    const ctx = this.profileContext(c, tokens);
+    if (this.options.profile) return this.options.profile(tokens, ctx);
+    if (!this.options.userInfoURL) {
+      throw new OAuthError(`Strategy '${this.name}' needs a userInfoURL or a profile() function.`);
+    }
+    return profileFromClaims(this.name, await ctx.getJsonAuthed(await envValue(this.options.userInfoURL)));
+  }
+};
+
+// src/oidc.ts
+var DISCOVERY_TTL = 60 * 60 * 1e3;
+var discoveryCache = /* @__PURE__ */ new Map();
+async function discover(issuer) {
+  const key = issuer.replace(/\/+$/, "");
+  const hit = discoveryCache.get(key);
+  if (hit && Date.now() - hit.fetchedAt < DISCOVERY_TTL) return hit.doc;
+  const doc = await getJson(`${key}/.well-known/openid-configuration`);
+  for (const f of ["authorization_endpoint", "token_endpoint", "jwks_uri"]) {
+    if (typeof doc[f] !== "string") throw new OAuthError(`The discovery document of ${key} has no ${f}.`);
+  }
+  discoveryCache.set(key, { doc, fetchedAt: Date.now() });
+  return doc;
+}
+function clearDiscoveryCache() {
+  discoveryCache.clear();
+}
+var OIDCStrategy = class extends OAuth2Strategy {
+  constructor(options, verify) {
+    const lazy = (pick, override) => async () => override ?? pick(await discover(await envValue(options.issuer))) ?? "";
+    super(
+      {
+        ...options,
+        name: options.name ?? "oidc",
+        scope: options.scope ?? ["openid", "email", "profile"],
+        authorizationURL: lazy(
+          (d) => d.authorization_endpoint,
+          options.endpoints?.authorization_endpoint
+        ),
+        tokenURL: lazy((d) => d.token_endpoint, options.endpoints?.token_endpoint),
+        revocationURL: options.revocationURL ?? lazy((d) => d.revocation_endpoint, options.endpoints?.revocation_endpoint)
+      },
+      verify
+    );
+  }
+  async discovery() {
+    const e = this.options.endpoints;
+    const issuer = await envValue(this.options.issuer);
+    if (e?.authorization_endpoint && e.token_endpoint && e.jwks_uri) {
+      return { issuer, ...e };
+    }
+    return { ...await discover(issuer), ...e ?? {} };
+  }
+  async startExtras(_c) {
+    return { nonce: randomToken(16) };
+  }
+  /** Validate an ID token from this provider (also used for tokens obtained by native SDKs). */
+  async validateIdToken(idToken, nonce) {
+    const doc = await this.discovery();
+    const issuer = await envValue(this.options.issuer);
+    return verifyJwt(idToken, {
+      jwksUri: doc.jwks_uri,
+      issuer: this.options.issuerValidation ?? doc.issuer ?? issuer,
+      audience: await envValue(this.options.clientId),
+      nonce,
+      algorithms: this.options.algorithms
+    });
+  }
+  async userProfile(tokens, c, flow) {
+    if (!tokens.idToken) throw new OAuthError("The provider did not return an ID token.", "missing_id_token");
+    let claims;
+    try {
+      claims = await this.validateIdToken(tokens.idToken, flow?.nonce);
+    } catch (err) {
+      if (err instanceof TokenValidationError)
+        throw new OAuthError(`Invalid ID token: ${err.message}`, "invalid_id_token");
+      throw err;
+    }
+    const doc = await this.discovery();
+    if (this.options.fetchUserInfo !== false && doc.userinfo_endpoint) {
+      const info = await this.profileContext(c, tokens).getJsonAuthed(doc.userinfo_endpoint);
+      if (info.sub !== void 0 && String(info.sub) !== String(claims.sub)) {
+        throw new OAuthError("The userinfo subject does not match the ID token.", "invalid_userinfo");
+      }
+      claims = { ...info, ...claims };
+    }
+    if (this.options.profile)
+      return this.options.profile(
+        { ...tokens, raw: { ...tokens.raw, claims } },
+        this.profileContext(c, tokens)
+      );
+    return profileFromClaims(this.name, claims);
+  }
+};
+
+export {
+  OAuthError,
+  TokenValidationError,
+  setProviderFetch,
+  providerFetch,
+  readBody,
+  getJson,
+  toTokens,
+  OAuth2Client,
+  b64url,
+  fromB64url,
+  utf8,
+  fromUtf8,
+  randomToken,
+  sha256,
+  pkcePair,
+  seal,
+  unseal,
+  timingSafeEqual,
+  SUPPORTED_ALGORITHMS,
+  decodeJwt,
+  clearJwksCache,
+  verifyJwt,
+  signJwt,
+  importPkcs8,
+  stateSettings,
+  savePending,
+  takePending,
+  envValue,
+  profileFromClaims,
+  OAuth2Strategy,
+  discover,
+  clearDiscoveryCache,
+  OIDCStrategy
+};
+//# sourceMappingURL=chunk-TSKPVGEC.js.map