@ghuri/oauth 0.0.0-stage → 0.1.0-alpha.1

package/dist/index.js

@@ -0,0 +1,231 @@
+import {
+  authenticate,
+  completeLogin,
+  failureResponse,
+  loginBackendName,
+  runStrategy,
+  userInfo
+} from "./chunk-OIBPPYBX.js";
+import {
+  OAuth2Client,
+  OAuth2Strategy,
+  OAuthError,
+  OIDCStrategy,
+  SUPPORTED_ALGORITHMS,
+  TokenValidationError,
+  b64url,
+  clearDiscoveryCache,
+  clearJwksCache,
+  decodeJwt,
+  discover,
+  envValue,
+  fromB64url,
+  fromUtf8,
+  getJson,
+  importPkcs8,
+  pkcePair,
+  profileFromClaims,
+  providerFetch,
+  randomToken,
+  readBody,
+  savePending,
+  seal,
+  setProviderFetch,
+  sha256,
+  signJwt,
+  stateSettings,
+  takePending,
+  timingSafeEqual,
+  toTokens,
+  unseal,
+  utf8,
+  verifyJwt
+} from "./chunk-TSKPVGEC.js";
+import {
+  CustomStrategy,
+  Strategy,
+  resolveStrategy,
+  strategies
+} from "./chunk-IS4XX7EU.js";
+
+// src/local.ts
+import { authenticate as authAuthenticate, getUserModel, readData, saltedHmac } from "@ghuri/auth";
+import { getHost, isSecure, tryGetContext, wantsJson } from "@ghuri/core";
+var LocalStrategy = class extends Strategy {
+  constructor(options = {}, verify = ({ username, password, c }) => authAuthenticate(c, { username, password })) {
+    super();
+    this.verify = verify;
+    this.name = options.name ?? "local";
+    this.usernameField = options.usernameField ?? "username";
+    this.passwordField = options.passwordField ?? "password";
+  }
+  verify;
+  name;
+  usernameField;
+  passwordField;
+  async authenticate(c) {
+    if (c.req.method !== "POST") return this.pass();
+    const data = await readData(c);
+    const username = data[this.usernameField];
+    const password = data[this.passwordField];
+    if (typeof username !== "string" || !username || typeof password !== "string" || !password) {
+      return this.fail("Missing credentials.", 400);
+    }
+    const user = await this.verify({ username, password, c });
+    return user ? this.success(user) : this.fail("Invalid credentials.", 401);
+  }
+};
+var MAGIC_SALT = "ghuri.oauth.MagicLinkStrategy";
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function hashValue(user, ts) {
+  const lastLogin = user.lastLogin ? new Date(user.lastLogin).toISOString() : "";
+  const emailField = user.constructor?.getEmailFieldName?.() ?? "email";
+  return `${user.pk}${user.password ?? ""}${lastLogin}${ts}${user[emailField] ?? ""}`;
+}
+async function mac(user, ts, secret) {
+  return b64url(await saltedHmac(MAGIC_SALT, hashValue(user, ts), secret, "sha256"));
+}
+var MagicLinkStrategy = class extends Strategy {
+  constructor(options, verify) {
+    super();
+    this.options = options;
+    this.verify = verify;
+    this.name = options.name ?? "magic-link";
+  }
+  options;
+  verify;
+  name;
+  /** A login token for `user` (exposed for custom delivery). */
+  async makeToken(user) {
+    const ts = Math.floor(Date.now() / 1e3);
+    return `${b64url(utf8(String(user.pk)))}.${ts.toString(36)}.${await mac(user, ts)}`;
+  }
+  async checkToken(token) {
+    const [pkPart, tsPart, sig] = token.split(".");
+    if (!pkPart || !tsPart || !sig) return null;
+    const ts = Number.parseInt(tsPart, 36);
+    if (!Number.isFinite(ts) || Date.now() / 1e3 - ts > (this.options.maxAge ?? 900) || ts > Date.now() / 1e3 + 60) {
+      return null;
+    }
+    let pk;
+    try {
+      pk = fromUtf8(fromB64url(pkPart));
+    } catch {
+      return null;
+    }
+    const User = getUserModel();
+    let value;
+    try {
+      value = User._meta.pk.toPython(pk);
+    } catch {
+      return null;
+    }
+    const user = await User.objects.filter({ pk: value }).first();
+    if (!user) return null;
+    const secrets = [
+      void 0,
+      ...tryGetContext()?.settings.SECRET_KEY_FALLBACKS ?? []
+    ];
+    for (const secret of secrets) {
+      if (timingSafeEqual(await mac(user, ts, secret), sig)) return user;
+    }
+    return null;
+  }
+  async authenticate(c, _options) {
+    if (c.req.method === "POST") return this.request(c);
+    const token = c.req.query("token");
+    if (!token) return this.pass();
+    const user = await this.checkToken(token);
+    if (!user) return this.fail("This login link is invalid or has expired.", 400);
+    return this.success(user, { next: c.req.query("next") || void 0 });
+  }
+  async request(c) {
+    const data = await readData(c);
+    const email = String(data[this.options.emailField ?? "email"] ?? "").trim();
+    if (!EMAIL_RE.test(email)) return this.fail("Enter a valid email address.", 400);
+    const user = await this.verify({ email, c });
+    if (user && user.isActive !== false) {
+      const url = new URL(c.req.path, `${isSecure(c) ? "https" : "http"}://${getHost(c)}`);
+      url.searchParams.set("token", await this.makeToken(user));
+      const next = typeof data.next === "string" ? data.next : c.req.query("next");
+      if (next) url.searchParams.set("next", next);
+      await this.options.send({ email, url: url.toString(), user, c });
+    }
+    const detail = "If an account exists for that address, we sent it a login link.";
+    if (wantsJson(c)) return { type: "response", response: c.json({ detail }) };
+    return { type: "redirect", url: this.options.sentRedirect ?? `${c.req.path}?sent=1`, status: 302 };
+  }
+};
+var BearerStrategy = class extends Strategy {
+  constructor(verify, options = {}) {
+    super();
+    this.verify = verify;
+    this.name = options.name ?? "bearer";
+    this.realm = options.realm ?? "api";
+  }
+  verify;
+  name;
+  realm;
+  async authenticate(c) {
+    const header = c.req.header("authorization");
+    if (!header) return this.pass();
+    const m = /^Bearer\s+(\S+)\s*$/i.exec(header);
+    if (!m) return this.pass();
+    const result = await this.verify(m[1], c);
+    if (!result) {
+      return this.fail("Invalid token.", 401, `Bearer realm="${this.realm}", error="invalid_token"`);
+    }
+    if (typeof result === "object" && "user" in result && Object.keys(result).every((k) => k === "user" || k === "info")) {
+      return this.success(result.user, result.info);
+    }
+    return this.success(result);
+  }
+};
+export {
+  BearerStrategy,
+  CustomStrategy,
+  LocalStrategy,
+  MagicLinkStrategy,
+  OAuth2Client,
+  OAuth2Strategy,
+  OAuthError,
+  OIDCStrategy,
+  SUPPORTED_ALGORITHMS,
+  Strategy,
+  TokenValidationError,
+  authenticate,
+  b64url,
+  clearDiscoveryCache,
+  clearJwksCache,
+  completeLogin,
+  decodeJwt,
+  discover,
+  envValue,
+  failureResponse,
+  fromB64url,
+  getJson,
+  importPkcs8,
+  loginBackendName,
+  pkcePair,
+  profileFromClaims,
+  providerFetch,
+  randomToken,
+  readBody,
+  resolveStrategy,
+  runStrategy,
+  savePending,
+  seal,
+  setProviderFetch,
+  sha256,
+  signJwt,
+  stateSettings,
+  strategies,
+  takePending,
+  timingSafeEqual,
+  toTokens,
+  unseal,
+  userInfo,
+  utf8,
+  verifyJwt
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/local.ts"],"sourcesContent":["// Username/password, magic links and bearer tokens.\nimport { authenticate as authAuthenticate, getUserModel, readData, saltedHmac } from '@ghuri/auth'\nimport { getHost, isSecure, tryGetContext, wantsJson } from '@ghuri/core'\nimport type { Context } from 'hono'\nimport { b64url, fromB64url, fromUtf8, timingSafeEqual, utf8 } from './crypto'\nimport { Strategy } from './strategy'\nimport type { AuthenticateOptions, StrategyResult, StrategyUser } from './types'\n\n// ---- LocalStrategy ----\n\nexport interface LocalStrategyOptions {\n  name?: string\n  usernameField?: string\n  passwordField?: string\n}\n\nexport type LocalVerify = (params: {\n  username: string\n  password: string\n  c: Context\n}) => Promise<StrategyUser | null>\n\n/**\n * Username and password from a JSON or form POST. The default `verify` is `@ghuri/auth`'s `authenticate()`, so\n * `AUTHENTICATION_BACKENDS`, password hashers and `userLoginFailed` all apply.\n */\nexport class LocalStrategy extends Strategy {\n  readonly name: string\n  private readonly usernameField: string\n  private readonly passwordField: string\n\n  constructor(\n    options: LocalStrategyOptions = {},\n    readonly verify: LocalVerify = ({ username, password, c }) => authAuthenticate(c, { username, password }),\n  ) {\n    super()\n    this.name = options.name ?? 'local'\n    this.usernameField = options.usernameField ?? 'username'\n    this.passwordField = options.passwordField ?? 'password'\n  }\n\n  async authenticate(c: Context): Promise<StrategyResult> {\n    if (c.req.method !== 'POST') return this.pass()\n    const data = await readData(c)\n    const username = data[this.usernameField]\n    const password = data[this.passwordField]\n    if (typeof username !== 'string' || !username || typeof password !== 'string' || !password) {\n      return this.fail('Missing credentials.', 400)\n    }\n    const user = await this.verify({ username, password, c })\n    return user ? this.success(user) : this.fail('Invalid credentials.', 401)\n  }\n}\n\n// ---- MagicLinkStrategy ----\n\nexport interface MagicLinkOptions {\n  name?: string\n  /** Deliver the link. Called only when `verify` found a user for the address. */\n  send: (params: { email: string; url: string; user: StrategyUser; c: Context }) => Promise<void>\n  /** Seconds a link stays valid (default 900). */\n  maxAge?: number\n  emailField?: string\n  /** Where forms go after asking for a link (default: the same URL with `?sent=1`). */\n  sentRedirect?: string\n}\n\nexport type MagicLinkVerify = (params: { email: string; c: Context }) => Promise<StrategyUser | null>\n\nconst MAGIC_SALT = 'ghuri.oauth.MagicLinkStrategy'\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nfunction hashValue(user: any, ts: number): string {\n  const lastLogin = user.lastLogin ? new Date(user.lastLogin).toISOString() : ''\n  const emailField = (user.constructor?.getEmailFieldName?.() as string | undefined) ?? 'email'\n  return `${user.pk}${user.password ?? ''}${lastLogin}${ts}${user[emailField] ?? ''}`\n}\n\nasync function mac(user: any, ts: number, secret?: string): Promise<string> {\n  return b64url(await saltedHmac(MAGIC_SALT, hashValue(user, ts), secret, 'sha256'))\n}\n\n/**\n * Passwordless login: `POST { email }` sends a link, `GET ?token=` logs in. Links expire after `maxAge` and stop\n * working after one login (the signature covers `lastLogin`) or a password/email change. The POST answers the\n * same whether or not the address has an account.\n */\nexport class MagicLinkStrategy extends Strategy {\n  readonly name: string\n\n  constructor(\n    readonly options: MagicLinkOptions,\n    readonly verify: MagicLinkVerify,\n  ) {\n    super()\n    this.name = options.name ?? 'magic-link'\n  }\n\n  /** A login token for `user` (exposed for custom delivery). */\n  async makeToken(user: any): Promise<string> {\n    const ts = Math.floor(Date.now() / 1000)\n    return `${b64url(utf8(String(user.pk)))}.${ts.toString(36)}.${await mac(user, ts)}`\n  }\n\n  async checkToken(token: string): Promise<StrategyUser | null> {\n    const [pkPart, tsPart, sig] = token.split('.')\n    if (!pkPart || !tsPart || !sig) return null\n    const ts = Number.parseInt(tsPart, 36)\n    if (\n      !Number.isFinite(ts) ||\n      Date.now() / 1000 - ts > (this.options.maxAge ?? 900) ||\n      ts > Date.now() / 1000 + 60\n    ) {\n      return null\n    }\n    let pk: string\n    try {\n      pk = fromUtf8(fromB64url(pkPart))\n    } catch {\n      return null\n    }\n    const User = getUserModel()\n    let value: unknown\n    try {\n      value = User._meta.pk.toPython(pk)\n    } catch {\n      return null\n    }\n    const user = await User.objects.filter({ pk: value }).first()\n    if (!user) return null\n    const secrets = [\n      undefined,\n      ...((tryGetContext()?.settings.SECRET_KEY_FALLBACKS as string[] | undefined) ?? []),\n    ]\n    for (const secret of secrets) {\n      if (timingSafeEqual(await mac(user, ts, secret), sig)) return user\n    }\n    return null\n  }\n\n  async authenticate(c: Context, _options: AuthenticateOptions): Promise<StrategyResult> {\n    if (c.req.method === 'POST') return this.request(c)\n    const token = c.req.query('token')\n    if (!token) return this.pass()\n    const user = await this.checkToken(token)\n    if (!user) return this.fail('This login link is invalid or has expired.', 400)\n    return this.success(user, { next: c.req.query('next') || undefined })\n  }\n\n  private async request(c: Context): Promise<StrategyResult> {\n    const data = await readData(c)\n    const email = String(data[this.options.emailField ?? 'email'] ?? '').trim()\n    if (!EMAIL_RE.test(email)) return this.fail('Enter a valid email address.', 400)\n    const user = await this.verify({ email, c })\n    if (user && user.isActive !== false) {\n      const url = new URL(c.req.path, `${isSecure(c) ? 'https' : 'http'}://${getHost(c)}`)\n      url.searchParams.set('token', await this.makeToken(user))\n      const next = typeof data.next === 'string' ? data.next : c.req.query('next')\n      if (next) url.searchParams.set('next', next)\n      await this.options.send({ email, url: url.toString(), user, c })\n    }\n    const detail = 'If an account exists for that address, we sent it a login link.'\n    if (wantsJson(c)) return { type: 'response', response: c.json({ detail }) }\n    return { type: 'redirect', url: this.options.sentRedirect ?? `${c.req.path}?sent=1`, status: 302 }\n  }\n}\n\n// ---- BearerStrategy ----\n\nexport type BearerVerify = (\n  token: string,\n  c: Context,\n) => Promise<StrategyUser | null | { user: StrategyUser; info?: Record<string, unknown> }>\n\n/** `Authorization: Bearer <token>` → `verify(token)`. No header → pass; unknown token → 401 with a challenge. */\nexport class BearerStrategy extends Strategy {\n  readonly name: string\n  private readonly realm: string\n\n  constructor(\n    readonly verify: BearerVerify,\n    options: { name?: string; realm?: string } = {},\n  ) {\n    super()\n    this.name = options.name ?? 'bearer'\n    this.realm = options.realm ?? 'api'\n  }\n\n  async authenticate(c: Context): Promise<StrategyResult> {\n    const header = c.req.header('authorization')\n    if (!header) return this.pass()\n    const m = /^Bearer\\s+(\\S+)\\s*$/i.exec(header)\n    if (!m) return this.pass()\n    const result = await this.verify(m[1], c)\n    if (!result) {\n      return this.fail('Invalid token.', 401, `Bearer realm=\"${this.realm}\", error=\"invalid_token\"`)\n    }\n    if (\n      typeof result === 'object' &&\n      'user' in result &&\n      Object.keys(result).every((k) => k === 'user' || k === 'info')\n    ) {\n      return this.success(result.user, result.info)\n    }\n    return this.success(result)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SAAS,gBAAgB,kBAAkB,cAAc,UAAU,kBAAkB;AACrF,SAAS,SAAS,UAAU,eAAe,iBAAiB;AAwBrD,IAAM,gBAAN,cAA4B,SAAS;AAAA,EAK1C,YACE,UAAgC,CAAC,GACxB,SAAsB,CAAC,EAAE,UAAU,UAAU,EAAE,MAAM,iBAAiB,GAAG,EAAE,UAAU,SAAS,CAAC,GACxG;AACA,UAAM;AAFG;AAGT,SAAK,OAAO,QAAQ,QAAQ;AAC5B,SAAK,gBAAgB,QAAQ,iBAAiB;AAC9C,SAAK,gBAAgB,QAAQ,iBAAiB;AAAA,EAChD;AAAA,EANW;AAAA,EANF;AAAA,EACQ;AAAA,EACA;AAAA,EAYjB,MAAM,aAAa,GAAqC;AACtD,QAAI,EAAE,IAAI,WAAW,OAAQ,QAAO,KAAK,KAAK;AAC9C,UAAM,OAAO,MAAM,SAAS,CAAC;AAC7B,UAAM,WAAW,KAAK,KAAK,aAAa;AACxC,UAAM,WAAW,KAAK,KAAK,aAAa;AACxC,QAAI,OAAO,aAAa,YAAY,CAAC,YAAY,OAAO,aAAa,YAAY,CAAC,UAAU;AAC1F,aAAO,KAAK,KAAK,wBAAwB,GAAG;AAAA,IAC9C;AACA,UAAM,OAAO,MAAM,KAAK,OAAO,EAAE,UAAU,UAAU,EAAE,CAAC;AACxD,WAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,wBAAwB,GAAG;AAAA,EAC1E;AACF;AAiBA,IAAM,aAAa;AACnB,IAAM,WAAW;AAEjB,SAAS,UAAU,MAAW,IAAoB;AAChD,QAAM,YAAY,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,EAAE,YAAY,IAAI;AAC5E,QAAM,aAAc,KAAK,aAAa,oBAAoB,KAA4B;AACtF,SAAO,GAAG,KAAK,EAAE,GAAG,KAAK,YAAY,EAAE,GAAG,SAAS,GAAG,EAAE,GAAG,KAAK,UAAU,KAAK,EAAE;AACnF;AAEA,eAAe,IAAI,MAAW,IAAY,QAAkC;AAC1E,SAAO,OAAO,MAAM,WAAW,YAAY,UAAU,MAAM,EAAE,GAAG,QAAQ,QAAQ,CAAC;AACnF;AAOO,IAAM,oBAAN,cAAgC,SAAS;AAAA,EAG9C,YACW,SACA,QACT;AACA,UAAM;AAHG;AACA;AAGT,SAAK,OAAO,QAAQ,QAAQ;AAAA,EAC9B;AAAA,EALW;AAAA,EACA;AAAA,EAJF;AAAA;AAAA,EAWT,MAAM,UAAU,MAA4B;AAC1C,UAAM,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACvC,WAAO,GAAG,OAAO,KAAK,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;AAAA,EACnF;AAAA,EAEA,MAAM,WAAW,OAA6C;AAC5D,UAAM,CAAC,QAAQ,QAAQ,GAAG,IAAI,MAAM,MAAM,GAAG;AAC7C,QAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAK,QAAO;AACvC,UAAM,KAAK,OAAO,SAAS,QAAQ,EAAE;AACrC,QACE,CAAC,OAAO,SAAS,EAAE,KACnB,KAAK,IAAI,IAAI,MAAO,MAAM,KAAK,QAAQ,UAAU,QACjD,KAAK,KAAK,IAAI,IAAI,MAAO,IACzB;AACA,aAAO;AAAA,IACT;AACA,QAAI;AACJ,QAAI;AACF,WAAK,SAAS,WAAW,MAAM,CAAC;AAAA,IAClC,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,OAAO,aAAa;AAC1B,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,GAAG,SAAS,EAAE;AAAA,IACnC,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,OAAO,MAAM,KAAK,QAAQ,OAAO,EAAE,IAAI,MAAM,CAAC,EAAE,MAAM;AAC5D,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,UAAU;AAAA,MACd;AAAA,MACA,GAAK,cAAc,GAAG,SAAS,wBAAiD,CAAC;AAAA,IACnF;AACA,eAAW,UAAU,SAAS;AAC5B,UAAI,gBAAgB,MAAM,IAAI,MAAM,IAAI,MAAM,GAAG,GAAG,EAAG,QAAO;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,GAAY,UAAwD;AACrF,QAAI,EAAE,IAAI,WAAW,OAAQ,QAAO,KAAK,QAAQ,CAAC;AAClD,UAAM,QAAQ,EAAE,IAAI,MAAM,OAAO;AACjC,QAAI,CAAC,MAAO,QAAO,KAAK,KAAK;AAC7B,UAAM,OAAO,MAAM,KAAK,WAAW,KAAK;AACxC,QAAI,CAAC,KAAM,QAAO,KAAK,KAAK,8CAA8C,GAAG;AAC7E,WAAO,KAAK,QAAQ,MAAM,EAAE,MAAM,EAAE,IAAI,MAAM,MAAM,KAAK,OAAU,CAAC;AAAA,EACtE;AAAA,EAEA,MAAc,QAAQ,GAAqC;AACzD,UAAM,OAAO,MAAM,SAAS,CAAC;AAC7B,UAAM,QAAQ,OAAO,KAAK,KAAK,QAAQ,cAAc,OAAO,KAAK,EAAE,EAAE,KAAK;AAC1E,QAAI,CAAC,SAAS,KAAK,KAAK,EAAG,QAAO,KAAK,KAAK,gCAAgC,GAAG;AAC/E,UAAM,OAAO,MAAM,KAAK,OAAO,EAAE,OAAO,EAAE,CAAC;AAC3C,QAAI,QAAQ,KAAK,aAAa,OAAO;AACnC,YAAM,MAAM,IAAI,IAAI,EAAE,IAAI,MAAM,GAAG,SAAS,CAAC,IAAI,UAAU,MAAM,MAAM,QAAQ,CAAC,CAAC,EAAE;AACnF,UAAI,aAAa,IAAI,SAAS,MAAM,KAAK,UAAU,IAAI,CAAC;AACxD,YAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,EAAE,IAAI,MAAM,MAAM;AAC3E,UAAI,KAAM,KAAI,aAAa,IAAI,QAAQ,IAAI;AAC3C,YAAM,KAAK,QAAQ,KAAK,EAAE,OAAO,KAAK,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;AAAA,IACjE;AACA,UAAM,SAAS;AACf,QAAI,UAAU,CAAC,EAAG,QAAO,EAAE,MAAM,YAAY,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE;AAC1E,WAAO,EAAE,MAAM,YAAY,KAAK,KAAK,QAAQ,gBAAgB,GAAG,EAAE,IAAI,IAAI,WAAW,QAAQ,IAAI;AAAA,EACnG;AACF;AAUO,IAAM,iBAAN,cAA6B,SAAS;AAAA,EAI3C,YACW,QACT,UAA6C,CAAC,GAC9C;AACA,UAAM;AAHG;AAIT,SAAK,OAAO,QAAQ,QAAQ;AAC5B,SAAK,QAAQ,QAAQ,SAAS;AAAA,EAChC;AAAA,EANW;AAAA,EAJF;AAAA,EACQ;AAAA,EAWjB,MAAM,aAAa,GAAqC;AACtD,UAAM,SAAS,EAAE,IAAI,OAAO,eAAe;AAC3C,QAAI,CAAC,OAAQ,QAAO,KAAK,KAAK;AAC9B,UAAM,IAAI,uBAAuB,KAAK,MAAM;AAC5C,QAAI,CAAC,EAAG,QAAO,KAAK,KAAK;AACzB,UAAM,SAAS,MAAM,KAAK,OAAO,EAAE,CAAC,GAAG,CAAC;AACxC,QAAI,CAAC,QAAQ;AACX,aAAO,KAAK,KAAK,kBAAkB,KAAK,iBAAiB,KAAK,KAAK,0BAA0B;AAAA,IAC/F;AACA,QACE,OAAO,WAAW,YAClB,UAAU,UACV,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC,MAAM,MAAM,UAAU,MAAM,MAAM,GAC7D;AACA,aAAO,KAAK,QAAQ,OAAO,MAAM,OAAO,IAAI;AAAA,IAC9C;AACA,WAAO,KAAK,QAAQ,MAAM;AAAA,EAC5B;AACF;","names":[]}

package/dist/rest.d.ts

@@ -0,0 +1,18 @@
+import { RequestUser } from '@ghuri/core';
+import { Context } from 'hono';
+import { a as StrategyRef } from './strategy-nxNiKJFS.js';
+
+/**
+ * A REST authentication class that runs strategies (usually `BearerStrategy` / `CustomStrategy`):
+ * `authenticationClasses = [StrategyAuthentication(['api-key'])]`.
+ */
+declare function StrategyAuthentication(refs: StrategyRef | StrategyRef[], opts?: {
+    header?: string;
+}): {
+    new (): {
+        authenticate(c: Context): Promise<[RequestUser, unknown] | null>;
+        authenticateHeader(): string;
+    };
+};
+
+export { StrategyAuthentication };

package/dist/rest.js

@@ -0,0 +1,33 @@
+import {
+  runStrategy
+} from "./chunk-OIBPPYBX.js";
+import "./chunk-IS4XX7EU.js";
+
+// src/rest.ts
+import { AuthenticationFailed } from "@ghuri/rest";
+function StrategyAuthentication(refs, opts = {}) {
+  return class StrategyAuthenticationClass {
+    async authenticate(c) {
+      const result = await runStrategy(c, refs);
+      switch (result.type) {
+        case "success":
+          if (result.user?.isActive === false) throw new AuthenticationFailed("User inactive or deleted.");
+          return [result.user, result.info ?? null];
+        case "error":
+          throw result.error;
+        case "fail":
+          if (result.strategy === void 0) return null;
+          throw new AuthenticationFailed(result.message);
+        default:
+          return null;
+      }
+    }
+    authenticateHeader() {
+      return opts.header ?? "Bearer";
+    }
+  };
+}
+export {
+  StrategyAuthentication
+};
+//# sourceMappingURL=rest.js.map

package/dist/rest.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rest.ts"],"sourcesContent":["// @ghuri/oauth/rest — use strategies as REST authentication classes.\nimport type { RequestUser } from '@ghuri/core'\nimport { AuthenticationFailed } from '@ghuri/rest'\nimport type { Context } from 'hono'\nimport { runStrategy } from './authenticate'\nimport type { StrategyRef } from './strategy'\n\n/**\n * A REST authentication class that runs strategies (usually `BearerStrategy` / `CustomStrategy`):\n * `authenticationClasses = [StrategyAuthentication(['api-key'])]`.\n */\nexport function StrategyAuthentication(refs: StrategyRef | StrategyRef[], opts: { header?: string } = {}) {\n  return class StrategyAuthenticationClass {\n    async authenticate(c: Context): Promise<[RequestUser, unknown] | null> {\n      const result = await runStrategy(c, refs)\n      switch (result.type) {\n        case 'success':\n          if (result.user?.isActive === false) throw new AuthenticationFailed('User inactive or deleted.')\n          return [result.user, result.info ?? null]\n        case 'error':\n          throw result.error\n        case 'fail':\n          // All strategies passed: no credentials of this kind; let the next class try.\n          if (result.strategy === undefined) return null\n          throw new AuthenticationFailed(result.message)\n        default:\n          return null\n      }\n    }\n\n    authenticateHeader(): string {\n      return opts.header ?? 'Bearer'\n    }\n  }\n}\n"],"mappings":";;;;;;AAEA,SAAS,4BAA4B;AAS9B,SAAS,uBAAuB,MAAmC,OAA4B,CAAC,GAAG;AACxG,SAAO,MAAM,4BAA4B;AAAA,IACvC,MAAM,aAAa,GAAoD;AACrE,YAAM,SAAS,MAAM,YAAY,GAAG,IAAI;AACxC,cAAQ,OAAO,MAAM;AAAA,QACnB,KAAK;AACH,cAAI,OAAO,MAAM,aAAa,MAAO,OAAM,IAAI,qBAAqB,2BAA2B;AAC/F,iBAAO,CAAC,OAAO,MAAM,OAAO,QAAQ,IAAI;AAAA,QAC1C,KAAK;AACH,gBAAM,OAAO;AAAA,QACf,KAAK;AAEH,cAAI,OAAO,aAAa,OAAW,QAAO;AAC1C,gBAAM,IAAI,qBAAqB,OAAO,OAAO;AAAA,QAC/C;AACE,iBAAO;AAAA,MACX;AAAA,IACF;AAAA,IAEA,qBAA6B;AAC3B,aAAO,KAAK,UAAU;AAAA,IACxB;AAAA,EACF;AACF;","names":[]}

package/dist/strategy-nxNiKJFS.d.ts

@@ -0,0 +1,109 @@
+import { Context } from 'hono';
+
+/** A user as the strategies see it: whatever your user model is (usually `@ghuri/auth`'s `User`). */
+type StrategyUser = any;
+type StrategyResult = {
+    type: 'success';
+    user: StrategyUser;
+    info?: Record<string, unknown>;
+}
+/** `challenge` becomes `WWW-Authenticate`; `message` the error shown or returned. */
+ | {
+    type: 'fail';
+    status?: number;
+    challenge?: string;
+    message?: string;
+} | {
+    type: 'redirect';
+    url: string;
+    status?: number;
+}
+/** Not for this strategy: try the next one. */
+ | {
+    type: 'pass';
+} | {
+    type: 'error';
+    error: unknown;
+}
+/** The strategy answered the request itself (e.g. "we sent you a link"). */
+ | {
+    type: 'response';
+    response: Response;
+};
+interface AuthenticateOptions {
+    successRedirect?: string;
+    failureRedirect?: string;
+    /** Go to the `next` kept across the round trip when it is safe, else here. */
+    successReturnToOrRedirect?: string;
+    /** Log the user in with `@ghuri/auth` (default true). */
+    session?: boolean;
+    /** What to answer on success: a session login (default), a JWT pair, or your own response. */
+    respond?: 'session' | 'jwt' | ((c: Context, user: StrategyUser, info?: Record<string, unknown>) => Response | Promise<Response>);
+    /** Extra scopes for this request (OAuth strategies). */
+    scope?: string[];
+    /** Where to go after login (default: the `next` query parameter); kept across the OAuth round trip. */
+    next?: string;
+    /** Extra values kept across the OAuth round trip, returned in `info.state`. */
+    state?: Record<string, string>;
+}
+/** Provider tokens from an OAuth token endpoint. */
+interface OAuthTokens {
+    accessToken: string;
+    tokenType?: string;
+    refreshToken?: string;
+    /** Seconds, as sent by the provider. */
+    expiresIn?: number;
+    /** Absolute expiry (ms since epoch), computed from `expiresIn`. */
+    expiresAt?: number;
+    idToken?: string;
+    scope?: string;
+    raw: Record<string, unknown>;
+}
+/** A user profile from an identity provider, normalized. */
+interface Profile {
+    provider: string;
+    id: string;
+    email?: string;
+    emailVerified?: boolean;
+    username?: string;
+    name?: string;
+    firstName?: string;
+    lastName?: string;
+    avatarUrl?: string;
+    raw: Record<string, unknown>;
+}
+/** A value, or a function of the Worker/Node env that returns it (`(env) => env.GITHUB_SECRET`). */
+type EnvValue<T> = T | ((env: Record<string, any>) => T);
+
+/**
+ * A way to authenticate a request (Passport.js's `Strategy`). `authenticate()` returns what happened:
+ * success, fail, redirect, pass (not for me), error, or a response of its own.
+ */
+declare abstract class Strategy {
+    abstract readonly name: string;
+    abstract authenticate(c: Context, options: AuthenticateOptions): Promise<StrategyResult>;
+    protected success(user: unknown, info?: Record<string, unknown>): StrategyResult;
+    protected fail(message?: string, status?: number, challenge?: string): StrategyResult;
+    protected redirect(url: string, status?: number): StrategyResult;
+    protected pass(): StrategyResult;
+}
+/** A one-off strategy from a function: `new CustomStrategy('header', async (c) => …)`. */
+declare class CustomStrategy extends Strategy {
+    readonly name: string;
+    private readonly fn;
+    constructor(name: string, fn: (c: Context, options: AuthenticateOptions) => Promise<StrategyResult> | StrategyResult);
+    authenticate(c: Context, options: AuthenticateOptions): Promise<StrategyResult>;
+}
+/** The strategy registry (Passport's `passport.use()`). */
+declare const strategies: {
+    use(name: string, strategy: Strategy): void;
+    get(name: string): Strategy;
+    has(name: string): boolean;
+    unuse(name: string): boolean;
+    names(): string[];
+};
+/** A strategy instance or a registered name. */
+type StrategyRef = string | Strategy;
+declare function resolveStrategy(ref: StrategyRef): Strategy;
+
+export { type AuthenticateOptions as A, CustomStrategy as C, type EnvValue as E, type OAuthTokens as O, type Profile as P, type StrategyResult as S, type StrategyRef as a, type StrategyUser as b, Strategy as c, resolveStrategy as r, strategies as s };

package/dist/testing.d.ts

@@ -0,0 +1,68 @@
+interface MockProviderOptions {
+    /** Base URL of the fake provider (default `https://provider.test`); its OIDC issuer. */
+    issuer?: string;
+    /** Claims / userinfo document of the user who "logs in" (OIDC style: `sub`, `email`, …). */
+    profile?: Record<string, any>;
+    /** Extra fields for token responses. */
+    tokenResponse?: Record<string, unknown>;
+    /** Extra URLs answered for authenticated GETs (provider APIs such as `https://api.github.com/user`). */
+    routes?: Record<string, unknown | ((req: Request) => unknown | Promise<unknown>)>;
+    /** Treat any token endpoint POST as this provider's (default true). */
+    anyTokenEndpoint?: boolean;
+}
+/**
+ * ```ts
+ * const provider = mockOAuthProvider({ profile: { sub: '42', email: 'ann@example.com', email_verified: true } })
+ * const res = await followOAuth(client, '/login/acme/', provider)
+ * provider.restore()
+ * ```
+ */
+declare class MockProvider {
+    readonly options: MockProviderOptions;
+    readonly issuer: string;
+    profile: Record<string, any>;
+    readonly requests: Array<{
+        method: string;
+        url: string;
+    }>;
+    private readonly codes;
+    private readonly accessTokens;
+    private keys?;
+    constructor(options?: MockProviderOptions);
+    get endpoints(): {
+        authorization: string;
+        token: string;
+        userinfo: string;
+        jwks: string;
+        revocation: string;
+    };
+    private signingKey;
+    /**
+     * Act as the user approving the request at `authorizeUrl`: returns the callback URL (with `code` and `state`, or
+     * `error=access_denied` when `deny`).
+     */
+    authorize(authorizeUrl: string, opts?: {
+        deny?: boolean;
+    }): string;
+    private tokenResponse;
+    private authed;
+    private handle;
+    /** Stop intercepting provider requests and forget cached discovery documents and keys. */
+    restore(): void;
+}
+declare function mockOAuthProvider(options?: MockProviderOptions): MockProvider;
+interface TestClientLike {
+    get(path: string, opts?: any): Promise<Response>;
+    post?(path: string, opts?: any): Promise<Response>;
+}
+/**
+ * Run the redirect round trip with the core test client: request `startPath` (GET, or POST with `method`), approve
+ * at the mock provider, then request the callback. Returns the callback's response.
+ */
+declare function followOAuth(client: TestClientLike, startPath: string, provider: MockProvider, opts?: {
+    deny?: boolean;
+    method?: 'GET' | 'POST';
+    body?: Record<string, unknown>;
+}): Promise<Response>;
+
+export { MockProvider, type MockProviderOptions, followOAuth, mockOAuthProvider };

package/dist/testing.js

@@ -0,0 +1,191 @@
+import {
+  b64url,
+  clearDiscoveryCache,
+  clearJwksCache,
+  randomToken,
+  setProviderFetch,
+  sha256,
+  signJwt
+} from "./chunk-TSKPVGEC.js";
+import "./chunk-IS4XX7EU.js";
+
+// src/testing.ts
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), { status, headers: { "content-type": "application/json" } });
+}
+var MockProvider = class {
+  constructor(options = {}) {
+    this.options = options;
+    this.issuer = (options.issuer ?? "https://provider.test").replace(/\/+$/, "");
+    this.profile = options.profile ?? {
+      sub: "1",
+      email: "user@example.com",
+      email_verified: true,
+      name: "Test User"
+    };
+    setProviderFetch((input, init) => this.handle(new Request(input, init)));
+  }
+  options;
+  issuer;
+  profile;
+  requests = [];
+  codes = /* @__PURE__ */ new Map();
+  accessTokens = /* @__PURE__ */ new Set();
+  keys;
+  get endpoints() {
+    return {
+      authorization: `${this.issuer}/authorize`,
+      token: `${this.issuer}/token`,
+      userinfo: `${this.issuer}/userinfo`,
+      jwks: `${this.issuer}/jwks`,
+      revocation: `${this.issuer}/revoke`
+    };
+  }
+  signingKey() {
+    this.keys ??= (async () => {
+      const pair = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, [
+        "sign",
+        "verify"
+      ]);
+      const jwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
+      return { privateKey: pair.privateKey, jwk: { ...jwk, kid: "mock-1", use: "sig", alg: "ES256" } };
+    })();
+    return this.keys;
+  }
+  /**
+   * Act as the user approving the request at `authorizeUrl`: returns the callback URL (with `code` and `state`, or
+   * `error=access_denied` when `deny`).
+   */
+  authorize(authorizeUrl, opts = {}) {
+    const u = new URL(authorizeUrl);
+    const q = u.searchParams;
+    const redirectUri = q.get("redirect_uri");
+    if (!redirectUri) throw new Error("The authorization URL has no redirect_uri.");
+    const back = new URL(redirectUri);
+    if (q.get("state")) back.searchParams.set("state", q.get("state"));
+    if (opts.deny) {
+      back.searchParams.set("error", "access_denied");
+      return back.toString();
+    }
+    const code = randomToken(16);
+    this.codes.set(code, {
+      clientId: q.get("client_id") ?? "",
+      redirectUri,
+      nonce: q.get("nonce") ?? void 0,
+      challenge: q.get("code_challenge") ?? void 0,
+      scope: (q.get("scope") ?? "").split(/[ ,]+/).filter(Boolean)
+    });
+    back.searchParams.set("code", code);
+    return back.toString();
+  }
+  async tokenResponse(form) {
+    const code = form.get("code") ?? "";
+    const issued = this.codes.get(code);
+    if (!issued) return json({ error: "invalid_grant", error_description: "Unknown or used code." }, 400);
+    this.codes.delete(code);
+    if (form.get("redirect_uri") !== issued.redirectUri)
+      return json({ error: "invalid_grant", error_description: "redirect_uri mismatch" }, 400);
+    if (issued.challenge) {
+      const verifier = form.get("code_verifier") ?? "";
+      if (b64url(await sha256(verifier)) !== issued.challenge) {
+        return json({ error: "invalid_grant", error_description: "PKCE verification failed" }, 400);
+      }
+    }
+    const accessToken = randomToken(16);
+    this.accessTokens.add(accessToken);
+    const body = {
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: 3600,
+      refresh_token: randomToken(16),
+      scope: issued.scope.join(" "),
+      ...this.options.tokenResponse
+    };
+    if (issued.scope.includes("openid")) {
+      const now = Math.floor(Date.now() / 1e3);
+      const { privateKey } = await this.signingKey();
+      body.id_token = await signJwt(
+        {
+          iss: this.issuer,
+          aud: issued.clientId,
+          iat: now,
+          exp: now + 600,
+          ...issued.nonce ? { nonce: issued.nonce } : {},
+          ...this.profile,
+          sub: String(this.profile.sub ?? this.profile.id)
+        },
+        privateKey,
+        "ES256",
+        { kid: "mock-1" }
+      );
+    }
+    return json(body);
+  }
+  authed(req) {
+    const m = /^Bearer\s+(\S+)$/i.exec(req.headers.get("authorization") ?? "");
+    return !!m && this.accessTokens.has(m[1]);
+  }
+  async handle(req) {
+    this.requests.push({ method: req.method, url: req.url });
+    const url = req.url.split("?")[0];
+    if (req.method === "POST") {
+      const form = new URLSearchParams(await req.text());
+      if (url === `${this.issuer}/revoke`) return new Response(null, { status: 200 });
+      if (url === this.endpoints.token || this.options.anyTokenEndpoint !== false && form.get("grant_type")) {
+        if (form.get("grant_type") === "refresh_token") {
+          const accessToken = randomToken(16);
+          this.accessTokens.add(accessToken);
+          return json({ access_token: accessToken, token_type: "Bearer", expires_in: 3600 });
+        }
+        return this.tokenResponse(form);
+      }
+    }
+    if (url === `${this.issuer}/.well-known/openid-configuration`) {
+      return json({
+        issuer: this.issuer,
+        authorization_endpoint: this.endpoints.authorization,
+        token_endpoint: this.endpoints.token,
+        userinfo_endpoint: this.endpoints.userinfo,
+        jwks_uri: this.endpoints.jwks,
+        revocation_endpoint: this.endpoints.revocation
+      });
+    }
+    if (url === this.endpoints.jwks) return json({ keys: [(await this.signingKey()).jwk] });
+    const route = this.options.routes?.[url] ?? this.options.routes?.[req.url];
+    if (route !== void 0 || url === this.endpoints.userinfo) {
+      if (!this.authed(req)) return json({ error: "invalid_token" }, 401);
+      const value = route === void 0 ? this.profile : typeof route === "function" ? await route(req) : route;
+      return value instanceof Response ? value : json(value);
+    }
+    return json({ error: "not_found", url: req.url }, 404);
+  }
+  /** Stop intercepting provider requests and forget cached discovery documents and keys. */
+  restore() {
+    setProviderFetch(void 0);
+    clearDiscoveryCache();
+    clearJwksCache();
+  }
+};
+function mockOAuthProvider(options = {}) {
+  clearDiscoveryCache();
+  clearJwksCache();
+  return new MockProvider(options);
+}
+function pathOf(url) {
+  const u = new URL(url, "http://testserver");
+  return `${u.pathname}${u.search}`;
+}
+async function followOAuth(client, startPath, provider, opts = {}) {
+  const start = opts.method === "POST" && client.post ? await client.post(startPath, { form: opts.body ?? {} }) : await client.get(startPath);
+  const location = start.headers.get("location");
+  if (start.status < 300 || start.status >= 400 || !location) {
+    throw new Error(`Expected a redirect to the provider from ${startPath}, got ${start.status}.`);
+  }
+  return client.get(pathOf(provider.authorize(location, opts)));
+}
+export {
+  MockProvider,
+  followOAuth,
+  mockOAuthProvider
+};
+//# sourceMappingURL=testing.js.map