@gorth-io/structure 0.0.0-alpha.8 → 0.0.0-alpha.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/modules/auth/server/bearer.cjs +1 -1
- package/dist/modules/auth/server/bearer.d.cts.map +1 -1
- package/dist/modules/auth/server/bearer.d.ts.map +1 -1
- package/dist/modules/auth/server/bearer.js +1 -1
- package/dist/modules/auth/server/bearer.js.map +1 -1
- package/dist/modules/auth/server/machine.cjs +1 -1
- package/dist/modules/auth/server/machine.js +1 -1
- package/dist/modules/auth/server/machine.js.map +1 -1
- package/dist/modules/desktop/proxy.d.cts +1 -1
- package/dist/modules/desktop/proxy.d.ts +1 -1
- package/docs/auth.md +6 -0
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("./claims.cjs"),n=require("../../../utils/normalization.cjs");let r=require("better-auth/oauth2");function i(t){if(t instanceof e.AuthError)return t;if((0,r.isInsufficientScopeError)(t))return new e.AuthError(`forbidden`);let n=t;return n?.statusCode===401||typeof n?.code==`string`&&/^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(n.code)?new e.AuthError(`rejected`):n?.statusCode===403?new e.AuthError(`forbidden`):new e.AuthError(`unavailable`)}function a(e){if((0,r.isInsufficientScopeError)(e))return{status:403,code:`insufficient_scope`,headers:{"WWW-Authenticate":`Bearer error="insufficient_scope"`}};let t=i(e);return t.code===`rejected`?{status:401,code:`invalid_access_token`,headers:{"WWW-Authenticate":`Bearer error="invalid_token"`}}:t.code===`forbidden`?{status:403,code:`forbidden`}:{status:503,code:`auth_unavailable`}}function o(a){let{verification:o}=a;try{if(!o.jwksUrl||o.remoteVerify)throw Error();n.parseHttpEndpoint(o.jwksUrl,{allowLoopbackHttp:a.allowLoopbackHttp});for(let e of[o.verifyOptions.issuer,o.verifyOptions.audience]){let t=Array.isArray(e)?e:[e];if(!t.length||t.some(e=>typeof e!=`string`||!e))throw Error()}let e=o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!e.length||e.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw Error()}catch{throw new e.AuthError(`invalid_configuration`)}let s={...o,requiredScopes:o.requiredScopes&&[...o.requiredScopes],verifyOptions:{...o.verifyOptions,typ:`at+jwt`,issuer:Array.isArray(o.verifyOptions.issuer)?[...o.verifyOptions.issuer]:o.verifyOptions.issuer,audience:Array.isArray(o.verifyOptions.audience)?[...o.verifyOptions.audience]:o.verifyOptions.audience,algorithms:[...o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`]],requiredClaims:[.../* @__PURE__ */ new Set([...o.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`iat`,`exp`])]}};return async function(n){try{let i=(0,r.requestToResourceInput)(n);if(
|
|
1
|
+
Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("./claims.cjs"),n=require("../../../utils/normalization.cjs");let r=require("better-auth/oauth2");function i(t){if(t instanceof e.AuthError)return t;if((0,r.isInsufficientScopeError)(t))return new e.AuthError(`forbidden`);let n=t;return n?.statusCode===401||typeof n?.code==`string`&&/^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(n.code)?new e.AuthError(`rejected`):n?.statusCode===403?new e.AuthError(`forbidden`):new e.AuthError(`unavailable`)}function a(e){if((0,r.isInsufficientScopeError)(e))return{status:403,code:`insufficient_scope`,headers:{"WWW-Authenticate":`Bearer error="insufficient_scope"`}};let t=i(e);return t.code===`rejected`?{status:401,code:`invalid_access_token`,headers:{"WWW-Authenticate":`Bearer error="invalid_token"`}}:t.code===`forbidden`?{status:403,code:`forbidden`}:{status:503,code:`auth_unavailable`}}function o(a){let{verification:o}=a;try{if(!o.jwksUrl||o.remoteVerify)throw Error();n.parseHttpEndpoint(o.jwksUrl,{allowLoopbackHttp:a.allowLoopbackHttp});for(let e of[o.verifyOptions.issuer,o.verifyOptions.audience]){let t=Array.isArray(e)?e:[e];if(!t.length||t.some(e=>typeof e!=`string`||!e))throw Error()}let e=o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!e.length||e.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw Error()}catch{throw new e.AuthError(`invalid_configuration`)}let s={...o,requiredScopes:o.requiredScopes&&[...o.requiredScopes],verifyOptions:{...o.verifyOptions,typ:`at+jwt`,issuer:Array.isArray(o.verifyOptions.issuer)?[...o.verifyOptions.issuer]:o.verifyOptions.issuer,audience:Array.isArray(o.verifyOptions.audience)?[...o.verifyOptions.audience]:o.verifyOptions.audience,algorithms:[...o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`]],requiredClaims:[.../* @__PURE__ */ new Set([...o.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`iat`,`exp`])]}};return async function(n){try{let i=(0,r.requestToResourceInput)(n),o=(0,r.parseAccessTokenAuthorization)(i.authorizationHeader);if(o?.scheme!==`Bearer`||!i.authorizationHeader||!/^Bearer [^\s]+$/i.test(i.authorizationHeader))throw new e.AuthError(`rejected`);i.authorizationHeader=`Bearer `+o.token;let c=await(0,r.verifyAccessTokenRequest)(i,s);return t.assertAccessTokenClaims(c,a.claims),await a.authorize?.(c,n),c}catch(e){throw(0,r.isInsufficientScopeError)(e)?e:i(e)}}}exports.authFailure=a,exports.createBearerVerifier=o,exports.normalizeAuthError=i;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bearer.d.cts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;
|
|
1
|
+
{"version":3,"file":"bearer.d.cts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;iBAeiB;EACf;EACA;EACA,UAAU;;wBAGI,mBAAmB,iBAAiB;;wBAepC,YAAY,iBAAiB;iBAkB5B;EACf,cAAc;EACd,SAAS;EACT;EACA,WAAW,QAAQ,YAAY,SAAS,iBAAiB;;;wBAI3C,qBAAqB,SAAS,yBAwDf,SAAS,YAAO,QAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bearer.d.ts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;
|
|
1
|
+
{"version":3,"file":"bearer.d.ts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;iBAeiB;EACf;EACA;EACA,UAAU;;wBAGI,mBAAmB,iBAAiB;;wBAepC,YAAY,iBAAiB;iBAkB5B;EACf,cAAc;EACd,SAAS;EACT;EACA,WAAW,QAAQ,YAAY,SAAS,iBAAiB;;;wBAI3C,qBAAqB,SAAS,yBAwDf,SAAS,YAAO,QAAA"}
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import{AuthError as e}from"../interface.js";import{assertAccessTokenClaims as t}from"./claims.js";import{parseHttpEndpoint as n}from"../../../utils/normalization.js";import{isInsufficientScopeError as r,
|
|
1
|
+
import{AuthError as e}from"../interface.js";import{assertAccessTokenClaims as t}from"./claims.js";import{parseHttpEndpoint as n}from"../../../utils/normalization.js";import{isInsufficientScopeError as r,parseAccessTokenAuthorization as i,requestToResourceInput as a,verifyAccessTokenRequest as o}from"better-auth/oauth2";function s(t){if(t instanceof e)return t;if(r(t))return new e(`forbidden`);let n=t;return n?.statusCode===401||typeof n?.code==`string`&&/^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(n.code)?new e(`rejected`):n?.statusCode===403?new e(`forbidden`):new e(`unavailable`)}function c(e){if(r(e))return{status:403,code:`insufficient_scope`,headers:{"WWW-Authenticate":`Bearer error="insufficient_scope"`}};let t=s(e);return t.code===`rejected`?{status:401,code:`invalid_access_token`,headers:{"WWW-Authenticate":`Bearer error="invalid_token"`}}:t.code===`forbidden`?{status:403,code:`forbidden`}:{status:503,code:`auth_unavailable`}}function l(c){let{verification:l}=c;try{if(!l.jwksUrl||l.remoteVerify)throw Error();n(l.jwksUrl,{allowLoopbackHttp:c.allowLoopbackHttp});for(let e of[l.verifyOptions.issuer,l.verifyOptions.audience]){let t=Array.isArray(e)?e:[e];if(!t.length||t.some(e=>typeof e!=`string`||!e))throw Error()}let e=l.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!e.length||e.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw Error()}catch{throw new e(`invalid_configuration`)}let u={...l,requiredScopes:l.requiredScopes&&[...l.requiredScopes],verifyOptions:{...l.verifyOptions,typ:`at+jwt`,issuer:Array.isArray(l.verifyOptions.issuer)?[...l.verifyOptions.issuer]:l.verifyOptions.issuer,audience:Array.isArray(l.verifyOptions.audience)?[...l.verifyOptions.audience]:l.verifyOptions.audience,algorithms:[...l.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`]],requiredClaims:[.../* @__PURE__ */ new Set([...l.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`iat`,`exp`])]}};return async function(n){try{let r=a(n),s=i(r.authorizationHeader);if(s?.scheme!==`Bearer`||!r.authorizationHeader||!/^Bearer [^\s]+$/i.test(r.authorizationHeader))throw new e(`rejected`);r.authorizationHeader=`Bearer `+s.token;let l=await o(r,u);return t(l,c.claims),await c.authorize?.(l,n),l}catch(e){throw r(e)?e:s(e)}}}export{c as authFailure,l as createBearerVerifier,s as normalizeAuthError};
|
|
2
2
|
//# sourceMappingURL=bearer.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bearer.js","names":["normalizeAuthError","error","AuthError","isInsufficientScopeError","value","authFailure","failure","createBearerVerifier","options","verification","parseHttpEndpoint","values","v","algorithms","a","native","input","requestToResourceInput","request","claims","verifyAccessTokenRequest","assertAccessTokenClaims"],"sources":["../../../../src/modules/auth/server/bearer.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport {\n assertAccessTokenClaims,\n type AccessTokenClaimPolicy,\n} from \"@/modules/auth/server/claims\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport {\n isInsufficientScopeError,\n requestToResourceInput,\n verifyAccessTokenRequest,\n type VerifyAccessTokenOptions,\n} from \"better-auth/oauth2\";\nimport type { JWTPayload } from \"jose\";\n\nexport interface AuthFailure {\n status: number;\n code: string;\n headers?: Record<string, string>;\n}\n\nexport function normalizeAuthError(error: unknown): AuthError {\n if (error instanceof AuthError) return error;\n if (isInsufficientScopeError(error)) return new AuthError(\"forbidden\");\n const value = error as { statusCode?: unknown; code?: unknown } | null;\n if (\n value?.statusCode === 401 ||\n (typeof value?.code === \"string\" &&\n /^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(value.code))\n )\n return new AuthError(\"rejected\");\n if (value?.statusCode === 403) return new AuthError(\"forbidden\");\n return new AuthError(\"unavailable\");\n}\n\n/** Sanitized framework-neutral projection; never includes SDK/transport causes. */\nexport function authFailure(error: unknown): AuthFailure {\n if (isInsufficientScopeError(error))\n return {\n status: 403,\n code: \"insufficient_scope\",\n headers: { \"WWW-Authenticate\": 'Bearer error=\"insufficient_scope\"' },\n };\n const failure = normalizeAuthError(error);\n if (failure.code === \"rejected\")\n return {\n status: 401,\n code: \"invalid_access_token\",\n headers: { \"WWW-Authenticate\": 'Bearer error=\"invalid_token\"' },\n };\n if (failure.code === \"forbidden\") return { status: 403, code: \"forbidden\" };\n return { status: 503, code: \"auth_unavailable\" };\n}\n\nexport interface BearerVerifierOptions {\n verification: VerifyAccessTokenOptions;\n claims?: AccessTokenClaimPolicy;\n allowLoopbackHttp?: boolean;\n authorize?(claims: JWTPayload, request: Request): void | Promise<void>;\n}\n\n/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */\nexport function createBearerVerifier(options: BearerVerifierOptions) {\n const { verification } = options;\n try {\n if (!verification.jwksUrl || verification.remoteVerify) throw new Error();\n parseHttpEndpoint(verification.jwksUrl, {\n allowLoopbackHttp: options.allowLoopbackHttp,\n });\n for (const value of [\n verification.verifyOptions.issuer,\n verification.verifyOptions.audience,\n ]) {\n const values = Array.isArray(value) ? value : [value];\n if (!values.length || values.some((v) => typeof v !== \"string\" || !v))\n throw new Error();\n }\n const algorithms = verification.verifyOptions.algorithms ?? [\n \"RS256\",\n \"ES256\",\n \"EdDSA\",\n ];\n if (\n !algorithms.length ||\n algorithms.some((a) => ![\"RS256\", \"ES256\", \"EdDSA\"].includes(a))\n )\n throw new Error();\n } catch {\n throw new AuthError(\"invalid_configuration\");\n }\n // Snapshot mutable host options so later changes cannot weaken verification.\n const native: VerifyAccessTokenOptions = {\n ...verification,\n requiredScopes: verification.requiredScopes && [...verification.requiredScopes],\n verifyOptions: {\n ...verification.verifyOptions,\n typ: \"at+jwt\",\n issuer: Array.isArray(verification.verifyOptions.issuer)\n ? [...verification.verifyOptions.issuer]\n : verification.verifyOptions.issuer,\n audience: Array.isArray(verification.verifyOptions.audience)\n ? [...verification.verifyOptions.audience]\n : verification.verifyOptions.audience,\n algorithms: [\n ...(verification.verifyOptions.algorithms ?? [\"RS256\", \"ES256\", \"EdDSA\"]),\n ],\n requiredClaims: [\n ...new Set([\n ...(verification.verifyOptions.requiredClaims ?? []),\n \"iss\",\n \"aud\",\n \"sub\",\n \"iat\",\n \"exp\",\n ]),\n ],\n },\n };\n return async function verify(request: Request) {\n try {\n const input = requestToResourceInput(request);\n if (\n !input.authorizationHeader ||\n !/^Bearer [^\\s]+$/i.test(input.authorizationHeader)\n )\n throw new AuthError(\"rejected\");\n input.authorizationHeader = \"Bearer \" +
|
|
1
|
+
{"version":3,"file":"bearer.js","names":["normalizeAuthError","error","AuthError","isInsufficientScopeError","value","authFailure","failure","createBearerVerifier","options","verification","parseHttpEndpoint","values","v","algorithms","a","native","input","requestToResourceInput","request","authorization","parseAccessTokenAuthorization","claims","verifyAccessTokenRequest","assertAccessTokenClaims"],"sources":["../../../../src/modules/auth/server/bearer.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport {\n assertAccessTokenClaims,\n type AccessTokenClaimPolicy,\n} from \"@/modules/auth/server/claims\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport {\n isInsufficientScopeError,\n parseAccessTokenAuthorization,\n requestToResourceInput,\n verifyAccessTokenRequest,\n type VerifyAccessTokenOptions,\n} from \"better-auth/oauth2\";\nimport type { JWTPayload } from \"jose\";\n\nexport interface AuthFailure {\n status: number;\n code: string;\n headers?: Record<string, string>;\n}\n\nexport function normalizeAuthError(error: unknown): AuthError {\n if (error instanceof AuthError) return error;\n if (isInsufficientScopeError(error)) return new AuthError(\"forbidden\");\n const value = error as { statusCode?: unknown; code?: unknown } | null;\n if (\n value?.statusCode === 401 ||\n (typeof value?.code === \"string\" &&\n /^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(value.code))\n )\n return new AuthError(\"rejected\");\n if (value?.statusCode === 403) return new AuthError(\"forbidden\");\n return new AuthError(\"unavailable\");\n}\n\n/** Sanitized framework-neutral projection; never includes SDK/transport causes. */\nexport function authFailure(error: unknown): AuthFailure {\n if (isInsufficientScopeError(error))\n return {\n status: 403,\n code: \"insufficient_scope\",\n headers: { \"WWW-Authenticate\": 'Bearer error=\"insufficient_scope\"' },\n };\n const failure = normalizeAuthError(error);\n if (failure.code === \"rejected\")\n return {\n status: 401,\n code: \"invalid_access_token\",\n headers: { \"WWW-Authenticate\": 'Bearer error=\"invalid_token\"' },\n };\n if (failure.code === \"forbidden\") return { status: 403, code: \"forbidden\" };\n return { status: 503, code: \"auth_unavailable\" };\n}\n\nexport interface BearerVerifierOptions {\n verification: VerifyAccessTokenOptions;\n claims?: AccessTokenClaimPolicy;\n allowLoopbackHttp?: boolean;\n authorize?(claims: JWTPayload, request: Request): void | Promise<void>;\n}\n\n/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */\nexport function createBearerVerifier(options: BearerVerifierOptions) {\n const { verification } = options;\n try {\n if (!verification.jwksUrl || verification.remoteVerify) throw new Error();\n parseHttpEndpoint(verification.jwksUrl, {\n allowLoopbackHttp: options.allowLoopbackHttp,\n });\n for (const value of [\n verification.verifyOptions.issuer,\n verification.verifyOptions.audience,\n ]) {\n const values = Array.isArray(value) ? value : [value];\n if (!values.length || values.some((v) => typeof v !== \"string\" || !v))\n throw new Error();\n }\n const algorithms = verification.verifyOptions.algorithms ?? [\n \"RS256\",\n \"ES256\",\n \"EdDSA\",\n ];\n if (\n !algorithms.length ||\n algorithms.some((a) => ![\"RS256\", \"ES256\", \"EdDSA\"].includes(a))\n )\n throw new Error();\n } catch {\n throw new AuthError(\"invalid_configuration\");\n }\n // Snapshot mutable host options so later changes cannot weaken verification.\n const native: VerifyAccessTokenOptions = {\n ...verification,\n requiredScopes: verification.requiredScopes && [...verification.requiredScopes],\n verifyOptions: {\n ...verification.verifyOptions,\n typ: \"at+jwt\",\n issuer: Array.isArray(verification.verifyOptions.issuer)\n ? [...verification.verifyOptions.issuer]\n : verification.verifyOptions.issuer,\n audience: Array.isArray(verification.verifyOptions.audience)\n ? [...verification.verifyOptions.audience]\n : verification.verifyOptions.audience,\n algorithms: [\n ...(verification.verifyOptions.algorithms ?? [\"RS256\", \"ES256\", \"EdDSA\"]),\n ],\n requiredClaims: [\n ...new Set([\n ...(verification.verifyOptions.requiredClaims ?? []),\n \"iss\",\n \"aud\",\n \"sub\",\n \"iat\",\n \"exp\",\n ]),\n ],\n },\n };\n return async function verify(request: Request) {\n try {\n const input = requestToResourceInput(request);\n const authorization = parseAccessTokenAuthorization(input.authorizationHeader);\n if (\n authorization?.scheme !== \"Bearer\" ||\n !input.authorizationHeader ||\n !/^Bearer [^\\s]+$/i.test(input.authorizationHeader)\n )\n throw new AuthError(\"rejected\");\n input.authorizationHeader = \"Bearer \" + authorization.token;\n const claims = await verifyAccessTokenRequest(input, native);\n assertAccessTokenClaims(claims, options.claims);\n await options.authorize?.(claims, request);\n return claims;\n } catch (error) {\n // Keep the SDK's typed scope error so the adapter can issue RFC 6750's challenge.\n if (isInsufficientScopeError(error)) throw error;\n throw normalizeAuthError(error);\n }\n };\n}\n"],"mappings":"A,iUAqBA,SAAgBA,EAAmB,EAA2B,CAC5D,GAAIC,aAAiBC,EAAW,OAAOD,EACvC,GAAIE,EAAyBF,CAAK,EAAG,OAAO,IAAIC,EAAU,WAAW,EACrE,IAAME,EAAQH,EAQd,OANEG,GAAO,aAAe,KACrB,OAAOA,GAAO,MAAS,UACtB,uDAAuD,KAAKA,EAAM,IAAI,EAEjE,IAAIF,EAAU,UAAU,EAC7BE,GAAO,aAAe,IAAY,IAAIF,EAAU,WAAW,EACxD,IAAIA,EAAU,aAAa,CACpC,CAGA,SAAgBG,EAAY,EAA6B,CACvD,GAAIF,EAAyBF,CAAK,EAChC,MAAO,CACL,OAAQ,IACR,KAAM,qBACN,QAAS,CAAE,mBAAoB,mCAAoC,CACrE,EACF,IAAMK,EAAUN,EAAmBC,CAAK,EAQxC,OAPIK,EAAQ,OAAS,WACZ,CACL,OAAQ,IACR,KAAM,uBACN,QAAS,CAAE,mBAAoB,8BAA+B,CAChE,EACEA,EAAQ,OAAS,YAAoB,CAAE,OAAQ,IAAK,KAAM,WAAY,EACnE,CAAE,OAAQ,IAAK,KAAM,kBAAmB,CACjD,CAUA,SAAgBC,EAAqB,EAAgC,CACnE,GAAM,CAAE,gBAAiBC,EACzB,GAAI,CACF,GAAI,CAACC,EAAa,SAAWA,EAAa,aAAc,MAAU,MAAM,EACxEC,EAAkBD,EAAa,QAAS,CACtC,kBAAmBD,EAAQ,iBAC7B,CAAC,EACD,IAAK,IAAMJ,IAAS,CAClBK,EAAa,cAAc,OAC3BA,EAAa,cAAc,QAC7B,EAAG,CACD,IAAME,EAAS,MAAM,QAAQP,CAAK,EAAIA,EAAQ,CAACA,CAAK,EACpD,GAAI,CAACO,EAAO,QAAUA,EAAO,KAAM,GAAM,OAAOC,GAAM,UAAY,CAACA,CAAC,EAClE,MAAU,MAAM,CACpB,CACA,IAAMC,EAAaJ,EAAa,cAAc,YAAc,CAC1D,QACA,QACA,OACF,EACA,GACE,CAACI,EAAW,QACZA,EAAW,KAAM,GAAM,CAAC,CAAC,QAAS,QAAS,OAAO,CAAC,CAAC,SAASC,CAAC,CAAC,EAE/D,MAAU,MAAM,CACpB,MAAQ,CACN,MAAM,IAAIZ,EAAU,uBAAuB,CAC7C,CAEA,IAAMa,EAAmC,CACvC,GAAGN,EACH,eAAgBA,EAAa,gBAAkB,CAAC,GAAGA,EAAa,cAAc,EAC9E,cAAe,CACb,GAAGA,EAAa,cAChB,IAAK,SACL,OAAQ,MAAM,QAAQA,EAAa,cAAc,MAAM,EACnD,CAAC,GAAGA,EAAa,cAAc,MAAM,EACrCA,EAAa,cAAc,OAC/B,SAAU,MAAM,QAAQA,EAAa,cAAc,QAAQ,EACvD,CAAC,GAAGA,EAAa,cAAc,QAAQ,EACvCA,EAAa,cAAc,SAC/B,WAAY,CACV,GAAIA,EAAa,cAAc,YAAc,CAAC,QAAS,QAAS,OAAO,CACzE,EACA,eAAgB,CACd,mBAAG,IAAI,IAAI,CACT,GAAIA,EAAa,cAAc,gBAAkB,CAAC,EAClD,MACA,MACA,MACA,MACA,KACF,CAAC,CACH,CACF,CACF,EACA,OAAO,eAAsB,EAAkB,CAC7C,GAAI,CACF,IAAMO,EAAQC,EAAuBC,CAAO,EACtCC,EAAgBC,EAA8BJ,EAAM,mBAAmB,EAC7E,GACEG,GAAe,SAAW,UAC1B,CAACH,EAAM,qBACP,CAAC,mBAAmB,KAAKA,EAAM,mBAAmB,EAElD,MAAM,IAAId,EAAU,UAAU,EAChC,EAAM,oBAAsB,UAAYiB,EAAc,MACtD,IAAME,EAAS,MAAMC,EAAyBN,EAAOD,CAAM,EAG3D,OAFAQ,EAAwBF,EAAQb,EAAQ,MAAM,EAC9C,MAAMA,EAAQ,YAAYa,EAAQH,CAAO,EAClCG,CACT,OAASpB,EAAO,CAGd,MADIE,EAAyBF,CAAK,EAASA,EACrCD,EAAmBC,CAAK,CAChC,CACF,CACF,C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../../../utils/normalization.cjs");let n=require("zod"),r=require("better-auth/oauth2");const i=n.z.object({access_token:n.z.string().min(1).max(32768),token_type:n.z.string().refine(e=>e.toLowerCase()===`bearer`),expires_in:n.z.number().int().positive(),scope:n.z.string().optional()});async function a(n){try{if(t.parseHttpEndpoint(n.tokenEndpoint,{allowLoopbackHttp:n.allowLoopbackHttp}),!n.clientId||!n.clientSecret||!n.scopes.length||!n.resources.length||![`client_secret_basic`,`client_secret_post`].includes(n.method)||n.scopes.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();for(let e of n.resources)t.parseHttpEndpoint(e,{allowLoopbackHttp:n.allowLoopbackHttp});let e=await(0,r.clientCredentialsTokenRequest)({options:{clientId:n.clientId,clientSecret:n.clientSecret},tokenEndpoint:n.tokenEndpoint,tokenEndpointAuth:{method:n.method},scope:[...
|
|
1
|
+
Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../../../utils/normalization.cjs");let n=require("zod"),r=require("better-auth/oauth2");const i=n.z.object({access_token:n.z.string().min(1).max(32768),token_type:n.z.string().refine(e=>e.toLowerCase()===`bearer`),expires_in:n.z.number().int().positive(),scope:n.z.string().optional()});async function a(n){try{if(t.parseHttpEndpoint(n.tokenEndpoint,{allowLoopbackHttp:n.allowLoopbackHttp}),!n.clientId||!n.clientSecret||!n.scopes.length||!n.resources.length||![`client_secret_basic`,`client_secret_post`].includes(n.method)||n.scopes.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();for(let e of n.resources)t.parseHttpEndpoint(e,{allowLoopbackHttp:n.allowLoopbackHttp});let e=await(0,r.clientCredentialsTokenRequest)({options:{clientId:n.clientId,clientSecret:n.clientSecret},tokenEndpoint:n.tokenEndpoint,tokenEndpointAuth:{method:n.method},scope:(0,r.mergeScopes)(void 0,[...n.scopes]),resource:[...new Set(n.resources)]});return{url:n.tokenEndpoint,method:`POST`,headers:e.headers,body:e.body,redirect:`error`,cache:`no-store`}}catch{throw new e.AuthError(`invalid_configuration`)}}function o(t){let n=i.safeParse(t);if(!n.success)throw new e.AuthError(`rejected`);return n.data}exports.createMachineTokenRequest=a,exports.machineTokenSchema=i,exports.parseMachineToken=o;
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import{AuthError as e}from"../interface.js";import{parseHttpEndpoint as t}from"../../../utils/normalization.js";import{z as n}from"zod";import{clientCredentialsTokenRequest as r}from"better-auth/oauth2";const
|
|
1
|
+
import{AuthError as e}from"../interface.js";import{parseHttpEndpoint as t}from"../../../utils/normalization.js";import{z as n}from"zod";import{clientCredentialsTokenRequest as r,mergeScopes as i}from"better-auth/oauth2";const a=n.object({access_token:n.string().min(1).max(32768),token_type:n.string().refine(e=>e.toLowerCase()===`bearer`),expires_in:n.number().int().positive(),scope:n.string().optional()});async function o(n){try{if(t(n.tokenEndpoint,{allowLoopbackHttp:n.allowLoopbackHttp}),!n.clientId||!n.clientSecret||!n.scopes.length||!n.resources.length||![`client_secret_basic`,`client_secret_post`].includes(n.method)||n.scopes.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();for(let e of n.resources)t(e,{allowLoopbackHttp:n.allowLoopbackHttp});let e=await r({options:{clientId:n.clientId,clientSecret:n.clientSecret},tokenEndpoint:n.tokenEndpoint,tokenEndpointAuth:{method:n.method},scope:i(void 0,[...n.scopes]),resource:[...new Set(n.resources)]});return{url:n.tokenEndpoint,method:`POST`,headers:e.headers,body:e.body,redirect:`error`,cache:`no-store`}}catch{throw new e(`invalid_configuration`)}}function s(t){let n=a.safeParse(t);if(!n.success)throw new e(`rejected`);return n.data}export{o as createMachineTokenRequest,a as machineTokenSchema,s as parseMachineToken};
|
|
2
2
|
//# sourceMappingURL=machine.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"machine.js","names":["machineTokenSchema","z","value","createMachineTokenRequest","parseHttpEndpoint","options","scope","resource","request","clientCredentialsTokenRequest","AuthError","parseMachineToken","parsed"],"sources":["../../../../src/modules/auth/server/machine.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport { clientCredentialsTokenRequest } from \"better-auth/oauth2\";\nimport { z } from \"zod\";\n\nexport const machineTokenSchema = z.object({\n access_token: z.string().min(1).max(32768),\n token_type: z.string().refine((value) => value.toLowerCase() === \"bearer\"),\n expires_in: z.number().int().positive(),\n scope: z.string().optional(),\n});\nexport type MachineToken = z.infer<typeof machineTokenSchema>;\n\nexport interface MachineTokenRequestOptions {\n tokenEndpoint: string;\n clientId: string;\n clientSecret: string;\n method: \"client_secret_basic\" | \"client_secret_post\";\n scopes: readonly string[];\n resources: readonly string[];\n allowLoopbackHttp?: boolean;\n}\n\n/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */\nexport async function createMachineTokenRequest(options: MachineTokenRequestOptions) {\n try {\n parseHttpEndpoint(options.tokenEndpoint, {\n allowLoopbackHttp: options.allowLoopbackHttp,\n });\n if (\n !options.clientId ||\n !options.clientSecret ||\n !options.scopes.length ||\n !options.resources.length ||\n ![\"client_secret_basic\", \"client_secret_post\"].includes(options.method) ||\n options.scopes.some((scope) => !/^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$/.test(scope))\n )\n throw new Error();\n for (const resource of options.resources)\n parseHttpEndpoint(resource, { allowLoopbackHttp: options.allowLoopbackHttp });\n const request = await clientCredentialsTokenRequest({\n options: { clientId: options.clientId, clientSecret: options.clientSecret },\n tokenEndpoint: options.tokenEndpoint,\n tokenEndpointAuth: { method: options.method },\n scope: [...
|
|
1
|
+
{"version":3,"file":"machine.js","names":["machineTokenSchema","z","value","createMachineTokenRequest","parseHttpEndpoint","options","scope","resource","request","clientCredentialsTokenRequest","mergeScopes","AuthError","parseMachineToken","parsed"],"sources":["../../../../src/modules/auth/server/machine.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport { clientCredentialsTokenRequest, mergeScopes } from \"better-auth/oauth2\";\nimport { z } from \"zod\";\n\nexport const machineTokenSchema = z.object({\n access_token: z.string().min(1).max(32768),\n token_type: z.string().refine((value) => value.toLowerCase() === \"bearer\"),\n expires_in: z.number().int().positive(),\n scope: z.string().optional(),\n});\nexport type MachineToken = z.infer<typeof machineTokenSchema>;\n\nexport interface MachineTokenRequestOptions {\n tokenEndpoint: string;\n clientId: string;\n clientSecret: string;\n method: \"client_secret_basic\" | \"client_secret_post\";\n scopes: readonly string[];\n resources: readonly string[];\n allowLoopbackHttp?: boolean;\n}\n\n/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */\nexport async function createMachineTokenRequest(options: MachineTokenRequestOptions) {\n try {\n parseHttpEndpoint(options.tokenEndpoint, {\n allowLoopbackHttp: options.allowLoopbackHttp,\n });\n if (\n !options.clientId ||\n !options.clientSecret ||\n !options.scopes.length ||\n !options.resources.length ||\n ![\"client_secret_basic\", \"client_secret_post\"].includes(options.method) ||\n options.scopes.some((scope) => !/^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$/.test(scope))\n )\n throw new Error();\n for (const resource of options.resources)\n parseHttpEndpoint(resource, { allowLoopbackHttp: options.allowLoopbackHttp });\n const request = await clientCredentialsTokenRequest({\n options: { clientId: options.clientId, clientSecret: options.clientSecret },\n tokenEndpoint: options.tokenEndpoint,\n tokenEndpointAuth: { method: options.method },\n scope: mergeScopes(undefined, [...options.scopes]),\n resource: [...new Set(options.resources)],\n });\n return {\n url: options.tokenEndpoint,\n method: \"POST\" as const,\n headers: request.headers,\n body: request.body,\n redirect: \"error\" as const,\n cache: \"no-store\" as const,\n };\n } catch {\n throw new AuthError(\"invalid_configuration\");\n }\n}\n\nexport function parseMachineToken(value: unknown): MachineToken {\n const parsed = machineTokenSchema.safeParse(value);\n if (!parsed.success) throw new AuthError(\"rejected\");\n return parsed.data;\n}\n"],"mappings":"A,4NAKA,MAAaA,EAAqBC,EAAE,OAAO,CACzC,aAAcA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,EACzC,WAAYA,EAAE,OAAO,CAAC,CAAC,OAAQ,GAAUC,EAAM,YAAY,IAAM,QAAQ,EACzE,WAAYD,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EACtC,MAAOA,EAAE,OAAO,CAAC,CAAC,SAAS,CAC7B,CAAC,EAcD,eAAsBE,EAA0B,EAAqC,CACnF,GAAI,CAIF,GAHAC,EAAkBC,EAAQ,cAAe,CACvC,kBAAmBA,EAAQ,iBAC7B,CAAC,EAEC,CAACA,EAAQ,UACT,CAACA,EAAQ,cACT,CAACA,EAAQ,OAAO,QAChB,CAACA,EAAQ,UAAU,QACnB,CAAC,CAAC,sBAAuB,oBAAoB,CAAC,CAAC,SAASA,EAAQ,MAAM,GACtEA,EAAQ,OAAO,KAAM,GAAU,CAAC,8BAA8B,KAAKC,CAAK,CAAC,EAEzE,MAAU,MAAM,EAClB,IAAK,IAAMC,KAAYF,EAAQ,UAC7BD,EAAkBG,EAAU,CAAE,kBAAmBF,EAAQ,iBAAkB,CAAC,EAC9E,IAAMG,EAAU,MAAMC,EAA8B,CAClD,QAAS,CAAE,SAAUJ,EAAQ,SAAU,aAAcA,EAAQ,YAAa,EAC1E,cAAeA,EAAQ,cACvB,kBAAmB,CAAE,OAAQA,EAAQ,MAAO,EAC5C,MAAOK,EAAY,IAAA,GAAW,CAAC,GAAGL,EAAQ,MAAM,CAAC,EACjD,SAAU,CAAC,GAAG,IAAI,IAAIA,EAAQ,SAAS,CAAC,CAC1C,CAAC,EACD,MAAO,CACL,IAAKA,EAAQ,cACb,OAAQ,OACR,QAASG,EAAQ,QACjB,KAAMA,EAAQ,KACd,SAAU,QACV,MAAO,UACT,CACF,MAAQ,CACN,MAAM,IAAIG,EAAU,uBAAuB,CAC7C,CACF,CAEA,SAAgBC,EAAkB,EAA8B,CAC9D,IAAMC,EAASb,EAAmB,UAAUE,CAAK,EACjD,GAAI,CAACW,EAAO,QAAS,MAAM,IAAIF,EAAU,UAAU,EACnD,OAAOE,EAAO,IAChB,C"}
|
package/docs/auth.md
CHANGED
|
@@ -181,3 +181,9 @@ References:
|
|
|
181
181
|
- [Session management](https://better-auth.com/docs/concepts/session-management)
|
|
182
182
|
- [OAuth Provider](https://better-auth.com/docs/plugins/oauth-provider)
|
|
183
183
|
- [Electron integration](https://better-auth.com/docs/integrations/electron)
|
|
184
|
+
The server helpers delegate OAuth protocol operations to public `better-auth/oauth2`
|
|
185
|
+
exports, including `verifyAccessTokenRequest`, `clientCredentialsTokenRequest`,
|
|
186
|
+
`parseAccessTokenAuthorization` and `mergeScopes`. Host-specific claim, continuity,
|
|
187
|
+
freshness and durable replay policy remain explicit. `better-auth` is supplied by
|
|
188
|
+
the host as a peer; do not instantiate a second authentication engine in this package.
|
|
189
|
+
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@gorth-io/structure",
|
|
3
|
-
"version": "0.0.0-alpha.
|
|
3
|
+
"version": "0.0.0-alpha.9",
|
|
4
4
|
"description": "TypeScript infrastructure for HTTP clients, authentication coordination, Supabase, and database integrations in the gorth-io ecosystem.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"author": "Gorthenburg",
|