@ghuri/socialauth 0.0.0-stage → 0.1.0-alpha.0

package/dist/index.js

@@ -0,0 +1,1302 @@
+import {
+  SocialAccount,
+  SocialApp,
+  SocialToken,
+  emptyDict
+} from "./chunk-ZNZG4OU3.js";
+import {
+  __export
+} from "./chunk-PZ5AY32C.js";
+
+// src/adapter.ts
+import { getUserModel } from "@ghuri/auth";
+import { reverse } from "@ghuri/core";
+
+// src/settings.ts
+import { tryGetContext } from "@ghuri/core";
+function socialSettings() {
+  const settings = tryGetContext()?.settings ?? {};
+  const s = settings.SOCIALACCOUNT ?? {};
+  return {
+    providers: s.PROVIDERS ?? {},
+    adapter: s.ADAPTER,
+    autoSignup: s.AUTO_SIGNUP ?? true,
+    emailAuthentication: s.EMAIL_AUTHENTICATION ?? false,
+    emailRequired: s.EMAIL_REQUIRED ?? false,
+    loginOnGet: s.LOGIN_ON_GET ?? false,
+    storeTokens: s.STORE_TOKENS ?? false,
+    loginResponse: s.LOGIN_RESPONSE ?? "session",
+    frontendUrl: s.FRONTEND_URL,
+    loginErrorUrl: s.LOGIN_ERROR_URL ?? settings.LOGIN_URL ?? "/accounts/login/"
+  };
+}
+
+// src/adapter.ts
+var ImmediateResponse = class extends Error {
+  constructor(response) {
+    super("ImmediateResponse");
+    this.response = response;
+  }
+  response;
+};
+var USERNAME_ALLOWED = /[^\w.@+-]/g;
+var SocialAccountAdapter = class {
+  /** May new users sign up through social login? */
+  isOpenForSignup(_c, _login) {
+    return true;
+  }
+  /** Called after the provider answered, before anything is looked up or created. */
+  async preSocialLogin(_c, _login) {
+  }
+  /** May the user be created without showing the signup form? */
+  isAutoSignupAllowed(_c, login) {
+    const s = socialSettings();
+    if (!s.autoSignup) return false;
+    if (s.emailRequired && !login.profile.email) return false;
+    return true;
+  }
+  /** A new, unsaved user instance. */
+  newUser(_c, _login) {
+    const User = getUserModel();
+    return new User();
+  }
+  /** Copy profile data (and signup form data) onto the new user. */
+  populateUser(_c, login, user, data) {
+    const M = user.constructor;
+    const has = (f) => !!M._meta.getField?.(f);
+    if (data.username !== void 0) user[M.USERNAME_FIELD] = data.username;
+    if (data.email !== void 0 && has(M.EMAIL_FIELD)) user[M.EMAIL_FIELD] = data.email;
+    if (has("firstName") && login.profile.firstName) user.firstName = login.profile.firstName.slice(0, 150);
+    if (has("lastName") && login.profile.lastName) user.lastName = login.profile.lastName.slice(0, 150);
+    if (has("firstName") && !login.profile.firstName && login.profile.name && has("lastName")) {
+      const [first, ...rest] = login.profile.name.trim().split(/\s+/);
+      user.firstName = (first ?? "").slice(0, 150);
+      user.lastName = rest.join(" ").slice(0, 150);
+    }
+    return user;
+  }
+  /** Save the new user (with an unusable password). */
+  async saveUser(_c, _login, user) {
+    if (typeof user.setUnusablePassword === "function") user.setUnusablePassword();
+    await user.save();
+    return user;
+  }
+  /** Username candidates, best first. */
+  usernameCandidates(login) {
+    const p = login.profile;
+    return [p.username, p.email?.split("@")[0], p.name, p.firstName, `${login.key}${p.id}`].filter(
+      (v) => typeof v === "string" && v.trim().length > 0
+    );
+  }
+  /** A username that is free, from the profile. */
+  async generateUsername(_c, login) {
+    const User = getUserModel();
+    const field = User.USERNAME_FIELD;
+    const maxLength = User._meta.getField(field)?.maxLength ?? 150;
+    const taken = async (name) => User.objects.filter({ [`${field}__iexact`]: name }).exists();
+    for (const raw of this.usernameCandidates(login)) {
+      const base = raw.trim().replace(/\s+/g, "").replace(USERNAME_ALLOWED, "").slice(0, maxLength);
+      if (!base) continue;
+      if (!await taken(base)) return base;
+      for (let i = 2; i < 100; i++) {
+        const suffix = String(i);
+        const candidate = `${base.slice(0, maxLength - suffix.length)}${suffix}`;
+        if (!await taken(candidate)) return candidate;
+      }
+    }
+    return `user${crypto.randomUUID().replace(/-/g, "").slice(0, 12)}`;
+  }
+  /** Where to go after connecting an account. */
+  getConnectRedirectUrl(_c, _account) {
+    try {
+      return reverse("socialaccount_connections");
+    } catch {
+      return "/";
+    }
+  }
+  /** Customize error responses; return undefined for the default. */
+  authenticationError(_c, _error) {
+    return void 0;
+  }
+};
+var cache = /* @__PURE__ */ new WeakMap();
+var fallback;
+function getAdapter() {
+  const cls = socialSettings().adapter;
+  if (!cls) {
+    fallback ??= new SocialAccountAdapter();
+    return fallback;
+  }
+  let a = cache.get(cls);
+  if (!a) {
+    a = new cls();
+    cache.set(cls, a);
+  }
+  return a;
+}
+
+// src/apps.ts
+import * as auth from "@ghuri/auth";
+import { AppConfig, apps, ImproperlyConfigured } from "@ghuri/core";
+
+// src/migrations/index.ts
+var migrations_exports = {};
+__export(migrations_exports, {
+  m0001_initial: () => initial_default,
+  migrations: () => migrations
+});
+
+// src/migrations/0001_initial.ts
+import { Migration, operations as ops } from "@ghuri/orm/migrations";
+var initial_default = new Migration({
+  initial: true,
+  dependencies: [["auth", "0001_initial"]],
+  operations: [
+    ops.CreateModel({
+      name: "SocialAccount",
+      fields: {
+        id: { type: "BigAutoField", primaryKey: true },
+        user: {
+          type: "ForeignKey",
+          to: "auth.User",
+          onDelete: "CASCADE",
+          dbIndex: true,
+          relatedName: "socialAccounts",
+          verboseName: "user"
+        },
+        provider: { type: "CharField", maxLength: 200, verboseName: "provider" },
+        uid: { type: "CharField", maxLength: 191, verboseName: "uid" },
+        lastLogin: { type: "DateTimeField", autoNow: true, verboseName: "last login" },
+        dateJoined: { type: "DateTimeField", autoNowAdd: true, verboseName: "date joined" },
+        extraData: {
+          type: "JSONField",
+          default: { callable: "emptyDict" },
+          verboseName: "extra data"
+        }
+      },
+      options: {
+        dbTable: "socialaccount_socialaccount",
+        verboseName: "social account",
+        verboseNamePlural: "social accounts",
+        uniqueTogether: [["provider", "uid"]]
+      }
+    }),
+    ops.CreateModel({
+      name: "SocialApp",
+      fields: {
+        id: { type: "BigAutoField", primaryKey: true },
+        provider: { type: "CharField", maxLength: 30, verboseName: "provider" },
+        providerId: { type: "CharField", maxLength: 200, blank: true, verboseName: "provider ID" },
+        name: { type: "CharField", maxLength: 40, verboseName: "name" },
+        clientId: { type: "CharField", maxLength: 191, verboseName: "client id" },
+        secret: { type: "CharField", maxLength: 191, blank: true, verboseName: "secret key" },
+        key: { type: "CharField", maxLength: 191, blank: true, verboseName: "key" },
+        settings: {
+          type: "JSONField",
+          blank: true,
+          default: { callable: "emptyDict" },
+          verboseName: "settings"
+        }
+      },
+      options: {
+        dbTable: "socialaccount_socialapp",
+        verboseName: "social application",
+        verboseNamePlural: "social applications"
+      }
+    }),
+    ops.CreateModel({
+      name: "SocialToken",
+      fields: {
+        id: { type: "BigAutoField", primaryKey: true },
+        app: {
+          type: "ForeignKey",
+          to: "socialaccount.SocialApp",
+          onDelete: "CASCADE",
+          null: true,
+          blank: true,
+          dbIndex: true
+        },
+        account: {
+          type: "ForeignKey",
+          to: "socialaccount.SocialAccount",
+          onDelete: "CASCADE",
+          dbIndex: true,
+          relatedName: "tokens"
+        },
+        token: { type: "TextField", verboseName: "token" },
+        tokenSecret: { type: "TextField", blank: true, verboseName: "token secret" },
+        expiresAt: { type: "DateTimeField", null: true, blank: true, verboseName: "expires at" }
+      },
+      options: {
+        dbTable: "socialaccount_socialtoken",
+        verboseName: "social application token",
+        verboseNamePlural: "social application tokens",
+        uniqueTogether: [["app", "account"]]
+      }
+    })
+  ]
+});
+
+// src/migrations/index.ts
+var migrations = {
+  "0001_initial": initial_default
+};
+
+// src/apps.ts
+function appPath() {
+  const meta = import.meta;
+  const dir = meta.dirname;
+  if (!dir || !/[\\/]src$/.test(dir) || !/\.[cm]?ts$/.test(meta.filename ?? "")) return void 0;
+  return dir;
+}
+function migrationsModule() {
+  const adapt = auth.migrationsForUserModel;
+  return typeof adapt === "function" ? adapt("socialaccount", migrations_exports) : migrations_exports;
+}
+var SocialAuthConfig = class extends AppConfig {
+  name = "@ghuri/socialauth";
+  label = "socialaccount";
+  verboseName = "Social Accounts";
+  path = appPath();
+  migrations = migrationsModule();
+  models = { SocialApp, SocialAccount, SocialToken };
+  ready() {
+    if (!apps.isInstalled("auth")) {
+      throw new ImproperlyConfigured(
+        "'socialaccount' requires '@ghuri/auth': add AuthConfig (and ContentTypesConfig) to INSTALLED_APPS."
+      );
+    }
+  }
+};
+
+// src/login.ts
+import { login as authLogin, getUserModel as getUserModel2, isSafeRedirect, tokenPairForUser } from "@ghuri/auth";
+import { cache as cache2, getHost, getUser, isSecure, resolveUrl, reverse as reverse2, tryGetContext as tryGetContext2 } from "@ghuri/core";
+import {
+  loginBackendName,
+  randomToken,
+  seal as seal2,
+  unseal as unseal2,
+  userInfo
+} from "@ghuri/oauth";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+
+// src/signals.ts
+import { Signal } from "@ghuri/core";
+var g = globalThis;
+function singleton(key, make) {
+  const k = Symbol.for(key);
+  if (!g[k]) g[k] = make();
+  return g[k];
+}
+var preSocialLogin = singleton(
+  "ghuri.socialauth.preSocialLogin",
+  () => new Signal("preSocialLogin")
+);
+var socialAccountAdded = singleton("ghuri.socialauth.socialAccountAdded", () => new Signal("socialAccountAdded"));
+var socialAccountUpdated = singleton("ghuri.socialauth.socialAccountUpdated", () => new Signal("socialAccountUpdated"));
+var socialAccountRemoved = singleton(
+  "ghuri.socialauth.socialAccountRemoved",
+  () => new Signal("socialAccountRemoved")
+);
+
+// src/tokens.ts
+import { OAuth2Strategy as OAuth2Strategy2, seal, unseal } from "@ghuri/oauth";
+
+// src/providers.ts
+import { ImproperlyConfigured as ImproperlyConfigured2 } from "@ghuri/core";
+import {
+  getJson,
+  OAuth2Strategy,
+  OAuthError,
+  OIDCStrategy,
+  profileFromClaims,
+  providerFetch,
+  readBody
+} from "@ghuri/oauth";
+var Provider = class {
+  /** Several apps per provider, each with its own `providerId` (OpenID Connect). */
+  multipleApps = false;
+  /** Default scopes when `SCOPE` is not set. */
+  defaultScope = [];
+  scope(settings) {
+    return settings.SCOPE ?? this.defaultScope;
+  }
+  /** May this provider's email be trusted to belong to the user? */
+  emailVerified(profile, settings) {
+    if (settings.VERIFIED_EMAIL !== void 0) return settings.VERIFIED_EMAIL && !!profile.email;
+    return profile.emailVerified === true && !!profile.email;
+  }
+  /**
+   * Native / mobile login: verify a token the app obtained with the provider's own SDK and return the profile.
+   * The token must have been issued to one of our client ids. Default: ID tokens of OpenID Connect providers.
+   */
+  async verifyNativeToken(ctx, tokens) {
+    const strategy = this.createStrategy(ctx);
+    if (!(strategy instanceof OIDCStrategy) || !tokens.idToken) {
+      throw new OAuthError(`${this.name} login with a native token needs an id_token.`, "unsupported");
+    }
+    const audiences = [ctx.app.clientId, ...ctx.app.settings?.audiences ?? []];
+    let claims;
+    let lastError;
+    for (const aud of audiences) {
+      try {
+        const s = this.createStrategy({ ...ctx, app: { ...ctx.app, clientId: aud } });
+        claims = await s.validateIdToken(tokens.idToken);
+        break;
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    if (!claims)
+      throw lastError instanceof Error ? new OAuthError(lastError.message, "invalid_token") : new OAuthError("Invalid ID token.");
+    return this.profileFromClaims(ctx.key, claims);
+  }
+  profileFromClaims(key, claims) {
+    return profileFromClaims(key, claims);
+  }
+};
+function common(ctx, provider2) {
+  return {
+    name: ctx.key,
+    clientId: ctx.app.clientId,
+    clientSecret: ctx.app.secret,
+    callbackURL: ctx.callbackURL,
+    scope: provider2.scope(ctx.settings),
+    authorizationParams: ctx.settings.AUTH_PARAMS
+  };
+}
+function oidc(ctx, provider2, issuer, extra = {}) {
+  return new OIDCStrategy(
+    {
+      ...common(ctx, provider2),
+      issuer,
+      profile: async (tokens) => provider2.profileFromClaims(ctx.key, tokens.raw.claims),
+      ...extra
+    },
+    ctx.verify
+  );
+}
+var GitHubProvider = class extends Provider {
+  id = "github";
+  name = "GitHub";
+  defaultScope = ["read:user", "user:email"];
+  api(ctx) {
+    return String(ctx.app.settings?.apiUrl ?? "https://api.github.com").replace(/\/+$/, "");
+  }
+  createStrategy(ctx) {
+    const web = String(ctx.app.settings?.webUrl ?? "https://github.com").replace(/\/+$/, "");
+    const api = this.api(ctx);
+    return new OAuth2Strategy(
+      {
+        ...common(ctx, this),
+        authorizationURL: `${web}/login/oauth/authorize`,
+        tokenURL: `${web}/login/oauth/access_token`,
+        profile: async (_tokens, p) => this.profile(ctx.key, api, (url) => p.getJsonAuthed(url))
+      },
+      ctx.verify
+    );
+  }
+  async profile(key, api, get) {
+    const user = await get(`${api}/user`);
+    let email = user.email ?? void 0;
+    let verified = false;
+    try {
+      const emails = await get(`${api}/user/emails`);
+      const list = Array.isArray(emails) ? emails : [];
+      const primary = list.find((e) => e.primary && e.verified) ?? list.find((e) => e.verified);
+      if (primary) {
+        email = primary.email;
+        verified = true;
+      }
+    } catch {
+    }
+    return {
+      provider: key,
+      id: String(user.id),
+      username: user.login,
+      name: user.name ?? void 0,
+      email,
+      emailVerified: verified,
+      avatarUrl: user.avatar_url,
+      raw: user
+    };
+  }
+  /** Checks with GitHub that the token belongs to our OAuth app (`POST /applications/{client_id}/token`). */
+  async verifyNativeToken(ctx, tokens) {
+    if (!tokens.accessToken)
+      throw new OAuthError("GitHub login with a native token needs an access_token.", "unsupported");
+    const api = this.api(ctx);
+    const res = await providerFetch(`${api}/applications/${encodeURIComponent(ctx.app.clientId)}/token`, {
+      method: "POST",
+      headers: {
+        authorization: `Basic ${btoa(`${ctx.app.clientId}:${ctx.app.secret ?? ""}`)}`,
+        accept: "application/vnd.github+json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ access_token: tokens.accessToken })
+    });
+    if (!res.ok) throw new OAuthError("GitHub did not accept the access token for this app.", "invalid_token");
+    const headers = { authorization: `Bearer ${tokens.accessToken}` };
+    return this.profile(ctx.key, api, (url) => getJson(url, { headers }));
+  }
+};
+var GoogleProvider = class extends Provider {
+  id = "google";
+  name = "Google";
+  defaultScope = ["openid", "email", "profile"];
+  createStrategy(ctx) {
+    return oidc(ctx, this, "https://accounts.google.com");
+  }
+};
+var FacebookProvider = class extends Provider {
+  id = "facebook";
+  name = "Facebook";
+  defaultScope = ["email", "public_profile"];
+  graph(ctx) {
+    return `https://graph.facebook.com/${String(ctx.settings.VERSION ?? ctx.app.settings?.version ?? "v21.0")}`;
+  }
+  createStrategy(ctx) {
+    const version = String(ctx.settings.VERSION ?? ctx.app.settings?.version ?? "v21.0");
+    const graph = this.graph(ctx);
+    return new OAuth2Strategy(
+      {
+        ...common(ctx, this),
+        scopeSeparator: ",",
+        authorizationURL: `https://www.facebook.com/${version}/dialog/oauth`,
+        tokenURL: `${graph}/oauth/access_token`,
+        profile: async (_t, p) => this.profile(
+          ctx.key,
+          await p.getJsonAuthed(`${graph}/me?fields=id,name,email,first_name,last_name,picture`)
+        )
+      },
+      ctx.verify
+    );
+  }
+  profile(key, me) {
+    return {
+      provider: key,
+      id: String(me.id),
+      name: me.name,
+      firstName: me.first_name,
+      lastName: me.last_name,
+      email: me.email,
+      // Facebook does not say whether the address was confirmed: unverified unless VERIFIED_EMAIL.
+      emailVerified: false,
+      avatarUrl: me.picture?.data?.url,
+      raw: me
+    };
+  }
+  /** Checks the token with `debug_token` (issued to our app id) before trusting it. */
+  async verifyNativeToken(ctx, tokens) {
+    if (!tokens.accessToken)
+      throw new OAuthError("Facebook login with a native token needs an access_token.", "unsupported");
+    const graph = this.graph(ctx);
+    const appToken = `${ctx.app.clientId}|${ctx.app.secret ?? ""}`;
+    const debug = await getJson(
+      `${graph}/debug_token?input_token=${encodeURIComponent(tokens.accessToken)}&access_token=${encodeURIComponent(appToken)}`
+    );
+    if (!debug.data?.is_valid || String(debug.data.app_id) !== ctx.app.clientId) {
+      throw new OAuthError("The Facebook token was not issued to this app.", "invalid_token");
+    }
+    const me = await getJson(`${graph}/me?fields=id,name,email,first_name,last_name,picture`, {
+      headers: { authorization: `Bearer ${tokens.accessToken}` }
+    });
+    return this.profile(ctx.key, me);
+  }
+};
+var MicrosoftProvider = class extends Provider {
+  id = "microsoft";
+  name = "Microsoft";
+  defaultScope = ["openid", "email", "profile", "User.Read"];
+  createStrategy(ctx) {
+    const tenant = String(ctx.app.settings?.tenant ?? ctx.settings.TENANT ?? "common");
+    const multi = ["common", "organizations", "consumers"].includes(tenant);
+    return oidc(ctx, this, `https://login.microsoftonline.com/${tenant}/v2.0`, {
+      // Multi-tenant endpoints publish `{tenantid}` in their issuer; accept any tenant's issuer.
+      issuerValidation: multi ? (iss) => /^https:\/\/login\.microsoftonline\.com\/[0-9a-f-]{36}\/v2\.0$/.test(iss) : void 0,
+      fetchUserInfo: false
+    });
+  }
+  profileFromClaims(key, claims) {
+    const p = profileFromClaims(key, claims);
+    return { ...p, id: String(claims.oid ?? claims.sub), emailVerified: false };
+  }
+  emailVerified(profile, settings) {
+    return settings.VERIFIED_EMAIL === true && !!profile.email;
+  }
+};
+var DiscordProvider = class extends Provider {
+  id = "discord";
+  name = "Discord";
+  defaultScope = ["identify", "email"];
+  createStrategy(ctx) {
+    return new OAuth2Strategy(
+      {
+        ...common(ctx, this),
+        authorizationURL: "https://discord.com/oauth2/authorize",
+        tokenURL: "https://discord.com/api/oauth2/token",
+        profile: async (_t, p) => {
+          const me = await p.getJsonAuthed("https://discord.com/api/users/@me");
+          return {
+            provider: ctx.key,
+            id: String(me.id),
+            username: me.username,
+            name: me.global_name ?? me.username,
+            email: me.email ?? void 0,
+            emailVerified: me.verified === true,
+            avatarUrl: me.avatar ? `https://cdn.discordapp.com/avatars/${me.id}/${me.avatar}.png` : void 0,
+            raw: me
+          };
+        }
+      },
+      ctx.verify
+    );
+  }
+  async verifyNativeToken() {
+    throw new OAuthError(
+      "Discord tokens cannot be checked against a client id; use the redirect flow.",
+      "unsupported"
+    );
+  }
+};
+var GitLabProvider = class extends Provider {
+  id = "gitlab";
+  name = "GitLab";
+  defaultScope = ["openid", "email", "profile"];
+  createStrategy(ctx) {
+    const url = String(ctx.app.settings?.url ?? ctx.settings.GITLAB_URL ?? "https://gitlab.com").replace(
+      /\/+$/,
+      ""
+    );
+    return oidc(ctx, this, url);
+  }
+  profileFromClaims(key, claims) {
+    return { ...profileFromClaims(key, claims), username: claims.nickname ?? claims.preferred_username };
+  }
+};
+var OpenIDConnectProvider = class extends Provider {
+  id = "openid_connect";
+  name = "OpenID Connect";
+  multipleApps = true;
+  defaultScope = ["openid", "email", "profile"];
+  createStrategy(ctx) {
+    const issuer = ctx.app.settings?.serverUrl ?? ctx.app.settings?.server_url;
+    if (typeof issuer !== "string") {
+      throw new ImproperlyConfigured2(
+        `The OpenID Connect app '${ctx.key}' needs settings.serverUrl (the issuer).`
+      );
+    }
+    return oidc(ctx, this, issuer);
+  }
+};
+var KEY = /* @__PURE__ */ Symbol.for("ghuri.socialauth.providers");
+var registry = (() => {
+  const g2 = globalThis;
+  if (!g2[KEY]) {
+    const m = /* @__PURE__ */ new Map();
+    for (const p of [
+      new GitHubProvider(),
+      new GoogleProvider(),
+      new FacebookProvider(),
+      new MicrosoftProvider(),
+      new DiscordProvider(),
+      new GitLabProvider(),
+      new OpenIDConnectProvider()
+    ]) {
+      m.set(p.id, p);
+    }
+    g2[KEY] = m;
+  }
+  return g2[KEY];
+})();
+function registerProvider(provider2) {
+  registry.set(provider2.id, provider2);
+}
+function getProvider(id) {
+  return registry.get(id);
+}
+function allProviders() {
+  return [...registry.values()];
+}
+
+// src/resolve.ts
+function fromRow(row) {
+  return {
+    clientId: row.clientId,
+    secret: row.secret || void 0,
+    key: row.key || void 0,
+    providerId: row.providerId || void 0,
+    name: row.name,
+    settings: row.settings ?? {}
+  };
+}
+async function safeRows(filter) {
+  try {
+    return await SocialApp.objects.filter(filter).orderBy("id");
+  } catch {
+    return [];
+  }
+}
+async function resolveProvider(key) {
+  const all = socialSettings().providers;
+  const direct = getProvider(key);
+  if (direct && !direct.multipleApps) {
+    const settings = all[key] ?? {};
+    if (settings.APP) return { key, provider: direct, app: settings.APP, settings };
+    const [row] = await safeRows({ provider: key });
+    return row ? { key, provider: direct, app: fromRow(row), settings, row } : null;
+  }
+  for (const provider2 of allProviders().filter((p) => p.multipleApps)) {
+    const settings = all[provider2.id] ?? {};
+    const app = settings.APPS?.find((a) => a.providerId === key);
+    if (app) return { key, provider: provider2, app, settings };
+    const [row] = await safeRows({ provider: provider2.id, providerId: key });
+    if (row) return { key, provider: provider2, app: fromRow(row), settings, row };
+  }
+  return null;
+}
+async function configuredProviders() {
+  const all = socialSettings().providers;
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const provider2 of allProviders()) {
+    const settings = all[provider2.id] ?? {};
+    if (provider2.multipleApps) {
+      for (const app of settings.APPS ?? []) {
+        if (app.providerId && !seen.has(app.providerId)) {
+          seen.add(app.providerId);
+          out.push({ key: app.providerId, provider: provider2, app, settings });
+        }
+      }
+      for (const row of await safeRows({ provider: provider2.id })) {
+        if (row.providerId && !seen.has(row.providerId)) {
+          seen.add(row.providerId);
+          out.push({ key: row.providerId, provider: provider2, app: fromRow(row), settings, row });
+        }
+      }
+    } else if (settings.APP) {
+      seen.add(provider2.id);
+      out.push({ key: provider2.id, provider: provider2, app: settings.APP, settings });
+    }
+  }
+  for (const row of await safeRows({})) {
+    const provider2 = getProvider(row.provider);
+    if (provider2 && !provider2.multipleApps && !seen.has(row.provider)) {
+      seen.add(row.provider);
+      out.push({ key: row.provider, provider: provider2, app: fromRow(row), settings: all[row.provider] ?? {}, row });
+    }
+  }
+  return out;
+}
+
+// src/tokens.ts
+var PURPOSE = "socialauth-token";
+async function storeTokens(login, account) {
+  if (!socialSettings().storeTokens || !login.tokens?.accessToken) return;
+  const t = login.tokens;
+  const app = login.row ?? null;
+  const existing = await SocialToken.objects.filter({ account, app }).first();
+  const values = {
+    token: await seal(t.accessToken, PURPOSE),
+    tokenSecret: t.refreshToken ? await seal(t.refreshToken, PURPOSE) : existing?.tokenSecret ?? "",
+    expiresAt: t.expiresAt ? new Date(t.expiresAt) : null
+  };
+  if (existing) {
+    Object.assign(existing, values);
+    await existing.save();
+  } else {
+    await SocialToken.objects.create({ account, app, ...values });
+  }
+}
+async function getAccessToken(account) {
+  const row = await SocialToken.objects.filter({ account }).first();
+  if (!row) return null;
+  const access = await unseal(row.token, PURPOSE);
+  const expiresAt = row.expiresAt ? new Date(row.expiresAt).getTime() : void 0;
+  if (access && (!expiresAt || expiresAt - 3e4 > Date.now())) return access;
+  const refresh = row.tokenSecret ? await unseal(row.tokenSecret, PURPOSE) : null;
+  if (!refresh) return null;
+  const resolved = await resolveProvider(account.provider);
+  if (!resolved) return null;
+  const strategy = resolved.provider.createStrategy({
+    key: resolved.key,
+    app: resolved.app,
+    settings: resolved.settings,
+    callbackURL: "/",
+    verify: async () => null
+  });
+  if (!(strategy instanceof OAuth2Strategy2)) return null;
+  let tokens;
+  try {
+    tokens = await (await strategy.client()).refresh(refresh);
+  } catch {
+    return null;
+  }
+  row.token = await seal(tokens.accessToken, PURPOSE);
+  if (tokens.refreshToken) row.tokenSecret = await seal(tokens.refreshToken, PURPOSE);
+  row.expiresAt = tokens.expiresAt ? new Date(tokens.expiresAt) : null;
+  await row.save();
+  return tokens.accessToken;
+}
+
+// src/login.ts
+var SocialAuthError = class extends Error {
+  constructor(message, status = 400, code = "social_login_failed") {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+};
+function buildLogin(resolved, profile, opts) {
+  return {
+    ...resolved,
+    profile: { ...profile, provider: resolved.key },
+    tokens: opts.tokens,
+    emailVerified: resolved.provider.emailVerified(profile, resolved.settings),
+    process: opts.process ?? "login",
+    next: opts.next
+  };
+}
+function loginRedirectUrl() {
+  return resolveUrl(
+    tryGetContext2()?.settings.LOGIN_REDIRECT_URL ?? "/accounts/profile/"
+  );
+}
+var CODE_PURPOSE = "socialauth-code";
+var CODE_TTL = 60;
+async function makeLoginCode(user) {
+  return seal2(
+    JSON.stringify({
+      uid: String(user.pk),
+      exp: Math.floor(Date.now() / 1e3) + CODE_TTL,
+      jti: randomToken(12)
+    }),
+    CODE_PURPOSE
+  );
+}
+async function redeemLoginCode(code) {
+  const raw = await unseal2(code, CODE_PURPOSE);
+  if (!raw) return null;
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!data.exp || data.exp < Date.now() / 1e3) return null;
+  const key = `ghuri:socialauth:code:${data.jti}`;
+  try {
+    if (await cache2.get(key)) return null;
+    await cache2.set(key, 1, CODE_TTL * 2);
+  } catch {
+  }
+  const User = getUserModel2();
+  const user = await User.objects.filter({ pk: User._meta.pk.toPython(data.uid) }).first();
+  return user && user.isActive !== false ? user : null;
+}
+async function finishLogin(c, user, login, mode) {
+  const s = socialSettings();
+  if (user.isActive === false) throw new SocialAuthError("This account is inactive.", 403, "inactive");
+  if (s.loginResponse === "jwt") {
+    if (mode === "api") return c.json({ ...await tokenPairForUser(user), user: userInfo(user) });
+    if (!s.frontendUrl)
+      throw new SocialAuthError('SOCIALACCOUNT.FRONTEND_URL is required with LOGIN_RESPONSE "jwt".', 500);
+    return c.redirect(`${s.frontendUrl}#code=${encodeURIComponent(await makeLoginCode(user))}`, 302);
+  }
+  await authLogin(c, user, loginBackendName());
+  if (mode === "api") return c.json({ user: userInfo(user) });
+  const next = login.next;
+  return c.redirect(isSafeRedirect(next, [getHost(c)]) ? next : loginRedirectUrl(), 302);
+}
+async function errorResponse(c, err, provider2, mode) {
+  const custom = await getAdapter().authenticationError(c, { provider: provider2, message: err.message, code: err.code });
+  if (custom) return custom;
+  if (mode === "api") return c.json({ detail: err.message, code: err.code }, err.status);
+  const s = socialSettings();
+  if (s.loginResponse === "jwt" && s.frontendUrl) {
+    return c.redirect(`${s.frontendUrl}#error=${encodeURIComponent(err.message)}`, 302);
+  }
+  const url = new URL(s.loginErrorUrl, "http://x");
+  url.searchParams.set("error", err.message);
+  return c.redirect(`${url.pathname}${url.search}`, 302);
+}
+var SIGNUP_COOKIE = "ghuri_social_signup";
+var SIGNUP_PURPOSE = "socialauth-signup";
+var SIGNUP_TTL = 600;
+async function savePendingSignup(c, login) {
+  const pending = {
+    key: login.key,
+    profile: login.profile,
+    tokens: socialSettings().storeTokens ? login.tokens : void 0,
+    emailVerified: login.emailVerified,
+    next: login.next,
+    createdAt: Date.now()
+  };
+  setCookie(c, SIGNUP_COOKIE, await seal2(JSON.stringify(pending), SIGNUP_PURPOSE), {
+    path: "/",
+    httpOnly: true,
+    secure: isSecure(c),
+    sameSite: "Lax",
+    maxAge: SIGNUP_TTL
+  });
+}
+async function readPendingSignup(c) {
+  const raw = getCookie(c, SIGNUP_COOKIE);
+  if (!raw) return null;
+  const json = await unseal2(raw, SIGNUP_PURPOSE);
+  if (!json) return null;
+  try {
+    const p = JSON.parse(json);
+    return Date.now() - p.createdAt <= SIGNUP_TTL * 1e3 ? p : null;
+  } catch {
+    return null;
+  }
+}
+function expirePendingSignup(c, res) {
+  res.headers.append(
+    "set-cookie",
+    `${SIGNUP_COOKIE}=; Max-Age=0; Path=/; HttpOnly; SameSite=Lax${isSecure(c) ? "; Secure" : ""}`
+  );
+  return res;
+}
+async function emailTaken(email, exceptPk) {
+  const User = getUserModel2();
+  let qs = User.objects.filter({ [`${User.EMAIL_FIELD}__iexact`]: email });
+  if (exceptPk !== void 0) qs = qs.exclude({ pk: exceptPk });
+  return qs.exists();
+}
+async function link(c, login, user) {
+  const account = await SocialAccount.objects.create({
+    user,
+    provider: login.key,
+    uid: login.profile.id,
+    extraData: login.profile.raw
+  });
+  await storeTokens(login, account);
+  await socialAccountAdded.send(SocialAccount, { c, login, account });
+  return account;
+}
+async function signup(c, login, data, mode) {
+  const adapter = getAdapter();
+  const User = getUserModel2();
+  const errors = {};
+  const username = (data.username ?? "").trim();
+  const email = (data.email ?? "").trim();
+  if (User.USERNAME_FIELD !== User.EMAIL_FIELD) {
+    if (!username) errors[User.USERNAME_FIELD] = ["This field is required."];
+    else if (await User.objects.filter({ [`${User.USERNAME_FIELD}__iexact`]: username }).exists()) {
+      errors[User.USERNAME_FIELD] = ["A user with that username already exists."];
+    }
+  }
+  if (!email && (socialSettings().emailRequired || User.USERNAME_FIELD === User.EMAIL_FIELD)) {
+    errors[User.EMAIL_FIELD] = ["This field is required."];
+  } else if (email && await emailTaken(email)) {
+    errors[User.EMAIL_FIELD] = [
+      `An account already uses this address. Log in to it first, then connect ${login.provider.name} from your account.`
+    ];
+  }
+  if (Object.keys(errors).length) return errors;
+  let user = adapter.newUser(c, login);
+  user = adapter.populateUser(c, login, user, {
+    username: User.USERNAME_FIELD === User.EMAIL_FIELD ? email : username,
+    email: email || void 0
+  });
+  user = await adapter.saveUser(c, login, user);
+  await link(c, login, user);
+  return finishLogin(c, user, login, mode);
+}
+async function completeSocialLogin(c, login, mode) {
+  const adapter = getAdapter();
+  await preSocialLogin.send(SocialAccount, { c, login });
+  await adapter.preSocialLogin(c, login);
+  const current = getUser(c);
+  const User = getUserModel2();
+  const existing = await SocialAccount.objects.filter({ provider: login.key, uid: login.profile.id }).first();
+  if (existing) {
+    existing.extraData = login.profile.raw;
+    await existing.save();
+    await storeTokens(login, existing);
+    await socialAccountUpdated.send(SocialAccount, { c, login, account: existing });
+    const userId = existing.userId ?? existing.user_id;
+    if (login.process === "connect") {
+      if (!current.isAuthenticated)
+        throw new SocialAuthError("Log in before connecting an account.", 401, "login_required");
+      if (String(userId) !== String(current.pk)) {
+        throw new SocialAuthError(
+          `This ${login.provider.name} account is already connected to another user.`,
+          409,
+          "already_connected"
+        );
+      }
+      return mode === "api" ? c.json({ connected: true }) : c.redirect(adapter.getConnectRedirectUrl(c, existing), 302);
+    }
+    const user = await User.objects.filter({ pk: userId }).first();
+    if (!user) throw new SocialAuthError("The linked user no longer exists.", 401, "user_missing");
+    return finishLogin(c, user, login, mode);
+  }
+  if (login.process === "connect") {
+    if (!current.isAuthenticated)
+      throw new SocialAuthError("Log in before connecting an account.", 401, "login_required");
+    const user = await User.objects.filter({ pk: current.pk }).first();
+    const account = await link(c, login, user);
+    return mode === "api" ? c.json({ connected: true }) : c.redirect(adapter.getConnectRedirectUrl(c, account), 302);
+  }
+  const s = socialSettings();
+  if (s.emailAuthentication && login.emailVerified && login.profile.email) {
+    const matches = await User.objects.filter({ [`${User.EMAIL_FIELD}__iexact`]: login.profile.email }).limit(2);
+    if (matches.length === 1) {
+      await link(c, login, matches[0]);
+      return finishLogin(c, matches[0], login, mode);
+    }
+  }
+  if (!await adapter.isOpenForSignup(c, login)) {
+    throw new SocialAuthError("Sign-ups are closed.", 403, "signup_closed");
+  }
+  if (await adapter.isAutoSignupAllowed(c, login)) {
+    const email = login.profile.email && !await emailTaken(login.profile.email) ? login.profile.email : void 0;
+    if (email || !s.emailRequired && !login.profile.email && User.USERNAME_FIELD !== User.EMAIL_FIELD) {
+      const result = await signup(
+        c,
+        login,
+        {
+          username: User.USERNAME_FIELD === User.EMAIL_FIELD ? email : await adapter.generateUsername(c, login),
+          email
+        },
+        mode
+      );
+      if (result instanceof Response) return result;
+    }
+  }
+  await savePendingSignup(c, login);
+  let signupUrl = "/accounts/signup/";
+  try {
+    signupUrl = reverse2("socialaccount_signup");
+  } catch {
+  }
+  if (mode === "api") {
+    return c.json({ detail: "Finish signing up.", code: "signup_required", signupUrl }, 409);
+  }
+  return c.redirect(signupUrl, 302);
+}
+
+// src/views.ts
+import { getUserModel as getUserModel3, readData, tokenPairForUser as tokenPairForUser2 } from "@ghuri/auth";
+import {
+  csrfExempt,
+  escapeHtml,
+  getCsrfToken,
+  getUser as getUser2,
+  path,
+  reverse as reverse3,
+  urlpatterns,
+  wantsJson
+} from "@ghuri/core";
+import { userInfo as userInfo2 } from "@ghuri/oauth";
+function page(title, body, status = 200) {
+  const html = `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(title)}</title><style>body{font:16px/1.5 system-ui,sans-serif;max-width:28rem;margin:4rem auto;padding:0 1rem}button{font:inherit;padding:.5rem 1rem;cursor:pointer}input{font:inherit;width:100%;padding:.4rem;margin:.2rem 0 .8rem;box-sizing:border-box}.err{color:#b91c1c}</style></head><body><h1>${escapeHtml(title)}</h1>${body}</body></html>`;
+  return new Response(html, { status, headers: { "content-type": "text/html; charset=utf-8" } });
+}
+function csrfInput(c) {
+  try {
+    return `<input type="hidden" name="csrfmiddlewaretoken" value="${escapeHtml(getCsrfToken(c))}">`;
+  } catch {
+    return "";
+  }
+}
+function str(v) {
+  return typeof v === "string" && v ? v : void 0;
+}
+async function provider(c) {
+  const key = c.req.param("provider") ?? "";
+  const resolved = await resolveProvider(key);
+  if (!resolved)
+    throw new SocialAuthError(`Unknown or unconfigured provider '${key}'.`, 404, "unknown_provider");
+  return resolved;
+}
+function strategyFor(c, resolved) {
+  const callbackURL = c.req.path.replace(/login\/(callback\/)?$/, "login/callback/");
+  const override = globalThis[/* @__PURE__ */ Symbol.for("ghuri.socialauth.testStrategy")];
+  const fake = override?.(resolved.key, callbackURL);
+  if (fake) return fake;
+  return resolved.provider.createStrategy({
+    key: resolved.key,
+    app: resolved.app,
+    settings: resolved.settings,
+    callbackURL,
+    // The social flow decides what happens next; the strategy only has to succeed.
+    verify: async () => ({ socialLogin: true })
+  });
+}
+function guarded(mode, fn) {
+  return async (c) => {
+    const m = typeof mode === "function" ? mode(c) : mode;
+    try {
+      return await fn(c);
+    } catch (err) {
+      if (err instanceof ImmediateResponse) return err.response;
+      if (err instanceof SocialAuthError) return errorResponse(c, err, c.req.param("provider") ?? "", m);
+      throw err;
+    }
+  };
+}
+function requireJson(c) {
+  if (!(c.req.header("content-type") ?? "").includes("application/json")) {
+    throw new SocialAuthError("Send a JSON body (Content-Type: application/json).", 415, "json_required");
+  }
+}
+var providersView = async (c) => {
+  const list = await configuredProviders();
+  return c.json({
+    providers: list.map((p) => ({
+      id: p.key,
+      name: p.app.name ?? p.provider.name,
+      provider: p.provider.id,
+      loginUrl: reverse3("socialaccount_login", { provider: p.key }),
+      nativeTokenUrl: reverse3("socialaccount_native_token", { provider: p.key })
+    }))
+  });
+};
+var loginView = guarded("browser", async (c) => {
+  const resolved = await provider(c);
+  const s = socialSettings();
+  if (c.req.method === "GET" && !s.loginOnGet) {
+    if (wantsJson(c)) return c.json({ detail: "POST to this URL to log in.", method: "POST" }, 405);
+    const action = escapeHtml(c.req.url.replace(/^[a-z]+:\/\/[^/]+/i, ""));
+    const name = escapeHtml(resolved.app.name ?? resolved.provider.name);
+    return page(
+      `Continue with ${resolved.app.name ?? resolved.provider.name}`,
+      `<p>You are about to log in with ${name}.</p><form method="post" action="${action}">${csrfInput(c)}<button type="submit">Continue</button></form>`
+    );
+  }
+  if (c.req.method !== "GET" && c.req.method !== "POST") return c.text("Method not allowed", 405);
+  const data = c.req.method === "POST" ? await readData(c) : {};
+  const process = (str(data.process) ?? c.req.query("process")) === "connect" ? "connect" : "login";
+  if (process === "connect" && !getUser2(c).isAuthenticated) {
+    throw new SocialAuthError("Log in before connecting an account.", 401, "login_required");
+  }
+  const result = await strategyFor(c, resolved).authenticate(c, {
+    next: str(data.next) ?? c.req.query("next"),
+    state: { process }
+  });
+  if (result.type === "redirect") return c.redirect(result.url, 302);
+  if (result.type === "error") throw result.error;
+  throw new SocialAuthError(
+    result.type === "fail" ? result.message ?? "Login failed." : "Login failed.",
+    400
+  );
+});
+var callbackView = guarded("browser", async (c) => {
+  const resolved = await provider(c);
+  if (!c.req.query("code") && !c.req.query("error")) {
+    throw new SocialAuthError("The provider did not send an authorization code.", 400, "missing_code");
+  }
+  const result = await strategyFor(c, resolved).authenticate(c, {});
+  if (result.type === "error") throw result.error;
+  if (result.type !== "success") {
+    throw new SocialAuthError(
+      result.type === "fail" ? result.message ?? "Login failed." : "Login failed.",
+      401
+    );
+  }
+  const info = result.info;
+  const login = buildLogin(resolved, info.profile, {
+    tokens: info.tokens,
+    next: info.next,
+    process: info.state?.process === "connect" ? "connect" : "login"
+  });
+  return completeSocialLogin(c, login, "browser");
+});
+var nativeTokenView = csrfExempt(
+  guarded("api", async (c) => {
+    if (c.req.method !== "POST") return c.json({ detail: "Method not allowed" }, 405);
+    requireJson(c);
+    const resolved = await provider(c);
+    const body = await c.req.json().catch(() => ({}));
+    const idToken = str(body.id_token);
+    const accessToken = str(body.access_token);
+    if (!idToken && !accessToken)
+      throw new SocialAuthError("Send id_token or access_token.", 400, "missing_token");
+    let profile;
+    try {
+      profile = await resolved.provider.verifyNativeToken(
+        {
+          key: resolved.key,
+          app: resolved.app,
+          settings: resolved.settings,
+          callbackURL: "/",
+          verify: async () => null
+        },
+        { idToken, accessToken }
+      );
+    } catch (err) {
+      throw new SocialAuthError(err.message || "Invalid token.", 401, "invalid_token");
+    }
+    const login = buildLogin(resolved, profile, {
+      tokens: accessToken ? { accessToken, raw: {} } : void 0,
+      process: str(body.process) === "connect" ? "connect" : "login"
+    });
+    return completeSocialLogin(c, login, "api");
+  })
+);
+var tokenExchangeView = csrfExempt(
+  guarded("api", async (c) => {
+    if (c.req.method !== "POST") return c.json({ detail: "Method not allowed" }, 405);
+    requireJson(c);
+    const body = await c.req.json().catch(() => ({}));
+    const user = str(body.code) ? await redeemLoginCode(str(body.code)) : null;
+    if (!user)
+      throw new SocialAuthError("This login code is invalid, expired or already used.", 400, "invalid_code");
+    return c.json({ ...await tokenPairForUser2(user), user: userInfo2(user) });
+  })
+);
+var signupView = guarded(
+  (c) => wantsJson(c) ? "api" : "browser",
+  async (c) => {
+    const pending = await readPendingSignup(c);
+    if (!pending)
+      throw new SocialAuthError("There is no social signup in progress.", 400, "no_pending_signup");
+    const resolved = await resolveProvider(pending.key);
+    if (!resolved) throw new SocialAuthError("The provider is no longer configured.", 400, "unknown_provider");
+    const login = buildLogin(resolved, pending.profile, { tokens: pending.tokens, next: pending.next });
+    const User = getUserModel3();
+    const uf = User.USERNAME_FIELD;
+    const ef = User.EMAIL_FIELD;
+    const json = wantsJson(c);
+    const render = (values2, errors = {}, status = 200) => {
+      if (json) {
+        return c.json(
+          {
+            provider: pending.key,
+            profile: {
+              email: pending.profile.email,
+              username: pending.profile.username,
+              name: pending.profile.name
+            },
+            fields: [.../* @__PURE__ */ new Set([uf, ef])],
+            errors
+          },
+          status
+        );
+      }
+      const field = (name, label) => `<label>${escapeHtml(label)}<input name="${escapeHtml(name)}" value="${escapeHtml(values2[name] ?? "")}"></label>${(errors[name] ?? []).map((e) => `<p class="err">${escapeHtml(e)}</p>`).join("")}`;
+      const fields = uf === ef ? field(ef, "Email") : field(uf, "Username") + field(ef, "Email");
+      return page(
+        "Finish signing up",
+        `<p>You are signing up with ${escapeHtml(resolved.app.name ?? resolved.provider.name)}.</p><form method="post">${csrfInput(c)}${fields}<button type="submit">Sign up</button></form>`,
+        status
+      );
+    };
+    if (c.req.method === "GET") {
+      return render({ [uf]: pending.profile.username ?? "", [ef]: pending.profile.email ?? "" });
+    }
+    const data = await readData(c);
+    const values = { [uf]: String(data[uf] ?? ""), [ef]: String(data[ef] ?? "") };
+    if (values[ef] && values[ef].toLowerCase() !== (pending.profile.email ?? "").toLowerCase())
+      login.emailVerified = false;
+    const result = await signup(
+      c,
+      login,
+      { username: values[uf], email: values[ef] },
+      json ? "api" : "browser"
+    );
+    if (result instanceof Response) return expirePendingSignup(c, result);
+    return render(values, result, 400);
+  }
+);
+var connectionsView = guarded(
+  (c) => wantsJson(c) ? "api" : "browser",
+  async (c) => {
+    const user = getUser2(c);
+    if (!user.isAuthenticated)
+      throw new SocialAuthError("Log in to manage your connected accounts.", 401, "login_required");
+    const accounts = await SocialAccount.objects.filter({ user: user.pk }).orderBy("provider", "id");
+    if (c.req.method === "POST") {
+      const data = await readData(c);
+      const id = String(data.account ?? "");
+      const account = accounts.find((a) => String(a.pk) === id);
+      if (!account) throw new SocialAuthError("No such connected account.", 404, "not_found");
+      const User = getUserModel3();
+      const full = await User.objects.filter({ pk: user.pk }).first();
+      if (accounts.length === 1 && full && typeof full.hasUsablePassword === "function" && !full.hasUsablePassword()) {
+        throw new SocialAuthError(
+          "Set a password before disconnecting your last connected account.",
+          400,
+          "last_login_method"
+        );
+      }
+      await account.delete();
+      await socialAccountRemoved.send(SocialAccount, { c, account });
+      if (wantsJson(c)) return c.json({ disconnected: id });
+      return c.redirect(c.req.path, 302);
+    }
+    const list = accounts.map((a) => ({
+      id: a.pk,
+      provider: a.provider,
+      uid: a.uid,
+      lastLogin: a.lastLogin,
+      dateJoined: a.dateJoined
+    }));
+    if (wantsJson(c)) return c.json({ accounts: list });
+    const rows = list.map(
+      (a) => `<li>${escapeHtml(a.provider)} <form method="post" style="display:inline">${csrfInput(c)}<input type="hidden" name="account" value="${escapeHtml(a.id)}"><button type="submit">Disconnect</button></form></li>`
+    ).join("");
+    return page("Connected accounts", rows ? `<ul>${rows}</ul>` : "<p>No connected accounts.</p>");
+  }
+);
+var socialUrls = urlpatterns(void 0, [
+  path("providers/", providersView, { name: "socialaccount_providers" }),
+  path("token/", tokenExchangeView, { name: "socialaccount_token_exchange" }),
+  path("signup/", signupView, { name: "socialaccount_signup" }),
+  path("connections/", connectionsView, { name: "socialaccount_connections" }),
+  path("<str:provider>/login/", loginView, { name: "socialaccount_login" }),
+  path("<str:provider>/login/callback/", callbackView, { name: "socialaccount_callback" }),
+  path("<str:provider>/token/", nativeTokenView, { name: "socialaccount_native_token" })
+]);
+export {
+  DiscordProvider,
+  FacebookProvider,
+  GitHubProvider,
+  GitLabProvider,
+  GoogleProvider,
+  ImmediateResponse,
+  MicrosoftProvider,
+  OpenIDConnectProvider,
+  Provider,
+  SocialAccount,
+  SocialAccountAdapter,
+  SocialApp,
+  SocialAuthConfig,
+  SocialAuthError,
+  SocialToken,
+  allProviders,
+  buildLogin,
+  callbackView,
+  completeSocialLogin,
+  configuredProviders,
+  connectionsView,
+  emptyDict,
+  finishLogin,
+  getAccessToken,
+  getAdapter,
+  getProvider,
+  loginView,
+  makeLoginCode,
+  nativeTokenView,
+  preSocialLogin,
+  providersView,
+  redeemLoginCode,
+  registerProvider,
+  resolveProvider,
+  signupView,
+  socialAccountAdded,
+  socialAccountRemoved,
+  socialAccountUpdated,
+  socialSettings,
+  socialUrls,
+  storeTokens,
+  tokenExchangeView
+};
+//# sourceMappingURL=index.js.map