@growth-labs/auth 0.3.7 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -4
- package/dist/middleware/auth.d.ts.map +1 -1
- package/dist/middleware/auth.js +3 -1
- package/dist/middleware/auth.js.map +1 -1
- package/dist/options.d.ts +6 -0
- package/dist/options.d.ts.map +1 -1
- package/dist/options.js +2 -0
- package/dist/options.js.map +1 -1
- package/dist/routes/logout.d.ts.map +1 -1
- package/dist/routes/logout.js +7 -3
- package/dist/routes/logout.js.map +1 -1
- package/dist/utils/client-secret.d.ts +3 -0
- package/dist/utils/client-secret.d.ts.map +1 -0
- package/dist/utils/client-secret.js +18 -0
- package/dist/utils/client-secret.js.map +1 -0
- package/dist/utils/cookies.d.ts +1 -1
- package/dist/utils/cookies.d.ts.map +1 -1
- package/dist/utils/cookies.js +11 -8
- package/dist/utils/cookies.js.map +1 -1
- package/dist/utils/openauth.d.ts +1 -1
- package/dist/utils/openauth.d.ts.map +1 -1
- package/dist/utils/openauth.js +27 -10
- package/dist/utils/openauth.js.map +1 -1
- package/dist/utils/tokens.d.ts +1 -1
- package/dist/utils/tokens.d.ts.map +1 -1
- package/dist/utils/tokens.js +11 -2
- package/dist/utils/tokens.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -13,6 +13,9 @@ import auth from '@growth-labs/auth'
|
|
|
13
13
|
|
|
14
14
|
auth({
|
|
15
15
|
issuer: 'https://auth.fedweek.com', // OpenAuth issuer URL (separate Worker)
|
|
16
|
+
clientId: 'fedweek-prod', // Optional; defaults to request hostname
|
|
17
|
+
clientSecret: 'AUTH_CLIENT_SECRET', // Worker secret binding name, resolved at request time
|
|
18
|
+
resource: 'https://fedweek.com', // RFC 8707 resource/audience URI
|
|
16
19
|
cookiePrefix: 'fedweek', // → fedweek_at, fedweek_rt, fedweek_provider cookies
|
|
17
20
|
sessionCookieDomain: '.fedweek.com', // Cross-subdomain sharing (optional)
|
|
18
21
|
gatedPaths: ['/premium/*', '/account/*'], // Glob patterns for protected routes
|
|
@@ -28,7 +31,7 @@ auth({
|
|
|
28
31
|
renderers: {
|
|
29
32
|
// Optional all-or-nothing UI overrides per auth surface.
|
|
30
33
|
// Flow logic, cookies, callback exchange, and issuer URLs remain package-owned.
|
|
31
|
-
login:
|
|
34
|
+
login: { module: '/src/auth/auth-render', export: 'renderLogin' },
|
|
32
35
|
},
|
|
33
36
|
accessTokenMaxAge: 900, // 15 min (seconds)
|
|
34
37
|
refreshTokenMaxAge: 2592000, // 30 days
|
|
@@ -114,9 +117,9 @@ internal package-test helper and is not exported from
|
|
|
114
117
|
## OAuth Flow Summary
|
|
115
118
|
|
|
116
119
|
1. User clicks a provider on the local login page → browser hits `/login?provider=...`
|
|
117
|
-
2. The local `/login` start route stores PKCE/state/redirect/provider cookies and redirects to `{issuer}/authorize?provider
|
|
120
|
+
2. The local `/login` start route stores PKCE/state/redirect/provider cookies and redirects to `{issuer}/authorize?provider=...`; configured `resource` is sent as the RFC 8707 resource indicator
|
|
118
121
|
3. Issuer authenticates → redirects to `/api/auth/callback?code=...&state=...`
|
|
119
|
-
4. Callback exchanges code for tokens via PKCE, reads `properties.isNewUser` from the JWT payload with fallback to top-level `isNewUser` for legacy issuers, uses the `{cookiePrefix}_provider` auth-flow cookie set at login start for provider attribution, sets session cookies, sets `gl_id` when `GL_IDENTITY_SECRET` is configured, and redirects to the original page
|
|
122
|
+
4. Callback exchanges code for tokens via PKCE, sends `Authorization: Basic base64(client_id:client_secret)` when `clientSecret` is configured, includes `resource`, reads `properties.isNewUser` from the JWT payload with fallback to top-level `isNewUser` for legacy issuers, uses the `{cookiePrefix}_provider` auth-flow cookie set at login start for provider attribution, sets session cookies, sets `gl_id` when `GL_IDENTITY_SECRET` is configured, and redirects to the original page
|
|
120
123
|
|
|
121
124
|
## Signed Identity Cookie
|
|
122
125
|
|
|
@@ -156,7 +159,9 @@ in their app.
|
|
|
156
159
|
|
|
157
160
|
- Virtual module: `virtual:growth-labs/auth/config` (slash, not hyphen)
|
|
158
161
|
- Cookie names: `{cookiePrefix}_at`, `{cookiePrefix}_rt`, `{cookiePrefix}_pkce`, `{cookiePrefix}_state`, `{cookiePrefix}_redirect`, `{cookiePrefix}_provider`, `gl_id`
|
|
159
|
-
- PKCE flow with `code_verifier` / `code_challenge` (S256)
|
|
162
|
+
- PKCE flow with `code_verifier` / `code_challenge` (S256); `{cookiePrefix}_pkce` is scoped to `callbackPath`
|
|
163
|
+
- Confidential OAuth clients use `client_secret_basic` on token exchange and refresh when `clientSecret` is configured. Prefer a Worker secret binding name such as `AUTH_CLIENT_SECRET`; runtime code resolves that binding before calling the issuer.
|
|
164
|
+
- RFC 8707 `resource` is sent on authorize, token exchange, and refresh when configured
|
|
160
165
|
- `email-code` is a client-side alias for the issuer's OpenAuth `code` provider
|
|
161
166
|
- CSRF state parameter verified on callback
|
|
162
167
|
- Access-token user claims live under `payload.properties.*`; the client falls back to top-level `payload.email`, `payload.name`, `payload.image`, and `payload.isNewUser` for legacy issuers
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAMA,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAuEnB"}
|
package/dist/middleware/auth.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { getConfig } from '../config-store.js';
|
|
2
|
+
import { resolveClientSecret } from '../utils/client-secret.js';
|
|
2
3
|
import { getCookie, setTokenCookies } from '../utils/cookies.js';
|
|
3
4
|
import { refreshTokens, verifyAccessToken } from '../utils/tokens.js';
|
|
4
5
|
export async function onRequest(context, next) {
|
|
@@ -23,7 +24,8 @@ export async function onRequest(context, next) {
|
|
|
23
24
|
}
|
|
24
25
|
if (!user && refreshToken) {
|
|
25
26
|
const clientId = options.clientId || context.url.hostname;
|
|
26
|
-
|
|
27
|
+
const clientSecret = resolveClientSecret(options.clientSecret);
|
|
28
|
+
refreshed = await refreshTokens(options.issuer, refreshToken, clientId, clientSecret, options.resource);
|
|
27
29
|
if (refreshed) {
|
|
28
30
|
user = {
|
|
29
31
|
id: refreshed.claims.sub,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACrE,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACrE,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,SAAS,GAAG,MAAM,aAAa,CAC9B,OAAO,CAAC,MAAM,EACd,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,OAAO,CAAC,QAAQ,CAChB,CAAA;QACD,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;aACzC,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QACzF,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}
|
package/dist/options.d.ts
CHANGED
|
@@ -3,6 +3,8 @@ import type { AuthRenderers } from './types.js';
|
|
|
3
3
|
export declare const authOptionsSchema: z.ZodObject<{
|
|
4
4
|
issuer: z.ZodString;
|
|
5
5
|
clientId: z.ZodOptional<z.ZodString>;
|
|
6
|
+
clientSecret: z.ZodOptional<z.ZodString>;
|
|
7
|
+
resource: z.ZodOptional<z.ZodString>;
|
|
6
8
|
cookiePrefix: z.ZodString;
|
|
7
9
|
sessionCookieDomain: z.ZodOptional<z.ZodString>;
|
|
8
10
|
accessTokenMaxAge: z.ZodDefault<z.ZodNumber>;
|
|
@@ -47,11 +49,15 @@ export declare const authOptionsSchema: z.ZodObject<{
|
|
|
47
49
|
};
|
|
48
50
|
renderers: AuthRenderers;
|
|
49
51
|
clientId?: string | undefined;
|
|
52
|
+
clientSecret?: string | undefined;
|
|
53
|
+
resource?: string | undefined;
|
|
50
54
|
sessionCookieDomain?: string | undefined;
|
|
51
55
|
}, {
|
|
52
56
|
issuer: string;
|
|
53
57
|
cookiePrefix: string;
|
|
54
58
|
clientId?: string | undefined;
|
|
59
|
+
clientSecret?: string | undefined;
|
|
60
|
+
resource?: string | undefined;
|
|
55
61
|
sessionCookieDomain?: string | undefined;
|
|
56
62
|
accessTokenMaxAge?: number | undefined;
|
|
57
63
|
refreshTokenMaxAge?: number | undefined;
|
package/dist/options.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,eAAO,MAAM,iBAAiB
|
|
1
|
+
{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyC5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAA"}
|
package/dist/options.js
CHANGED
|
@@ -4,6 +4,8 @@ export const authOptionsSchema = z.object({
|
|
|
4
4
|
issuer: z.string().url(),
|
|
5
5
|
// ─── Client identity ───
|
|
6
6
|
clientId: z.string().optional(),
|
|
7
|
+
clientSecret: z.string().optional(),
|
|
8
|
+
resource: z.string().url().optional(),
|
|
7
9
|
// ─── Cookie configuration ───
|
|
8
10
|
cookiePrefix: z.string(),
|
|
9
11
|
sessionCookieDomain: z.string().optional(),
|
package/dist/options.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,mBAAmB;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAExB,0BAA0B;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;
|
|
1
|
+
{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,mBAAmB;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAExB,0BAA0B;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAErC,+BAA+B;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE/C,6BAA6B;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAExD,oBAAoB;IACpB,SAAS,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;SACnD,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAE/C,mCAAmC;IACnC,SAAS,EAAE,CAAC;SACV,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAWA,UAAU,aAAa;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCnE"}
|
package/dist/routes/logout.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { getConfig } from '../config-store.js';
|
|
2
2
|
import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js';
|
|
3
|
-
import {
|
|
3
|
+
import { resolveClientSecret } from '../utils/client-secret.js';
|
|
4
|
+
import { clearAuthFlowCookies, clearIdentityCookie, clearTokenCookies, getCookie, } from '../utils/cookies.js';
|
|
4
5
|
import { revokeToken } from '../utils/openauth.js';
|
|
5
6
|
export async function GET(context) {
|
|
6
7
|
const options = getConfig();
|
|
@@ -8,7 +9,10 @@ export async function GET(context) {
|
|
|
8
9
|
const clientId = options.clientId || context.url.hostname;
|
|
9
10
|
// Revoke at issuer (non-blocking)
|
|
10
11
|
if (refreshToken) {
|
|
11
|
-
const
|
|
12
|
+
const clientSecret = resolveClientSecret(options.clientSecret);
|
|
13
|
+
const promise = clientSecret
|
|
14
|
+
? revokeToken(refreshToken, clientId, clientSecret)
|
|
15
|
+
: revokeToken(refreshToken, clientId);
|
|
12
16
|
context.waitUntil?.(promise);
|
|
13
17
|
}
|
|
14
18
|
// Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
|
|
@@ -31,7 +35,7 @@ export async function GET(context) {
|
|
|
31
35
|
});
|
|
32
36
|
clearTokenCookies(mutableResponse, options);
|
|
33
37
|
clearIdentityCookie(mutableResponse);
|
|
34
|
-
|
|
38
|
+
clearAuthFlowCookies(mutableResponse, options);
|
|
35
39
|
return mutableResponse;
|
|
36
40
|
}
|
|
37
41
|
//# sourceMappingURL=logout.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACT,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AASlD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAEzD,kCAAkC;IAClC,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAG,YAAY;YAC3B,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC;YACnD,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QACtC,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,kBAAkB,CAAC,OAA+C,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE;YACrD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACxC,CAAC,CAAA;QACF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3C,mBAAmB,CAAC,eAAe,CAAC,CAAA;IACpC,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,OAAO,eAAe,CAAA;AACvB,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"client-secret.d.ts","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AAEA,wBAAgB,mBAAmB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS7E;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhG"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
import { getRuntimeEnv } from '../runtime.js';
|
|
2
|
+
export function resolveClientSecret(clientSecret) {
|
|
3
|
+
if (!clientSecret)
|
|
4
|
+
return undefined;
|
|
5
|
+
const runtimeValue = getRuntimeEnv()[clientSecret];
|
|
6
|
+
if (typeof runtimeValue === 'string' && runtimeValue.length > 0) {
|
|
7
|
+
return runtimeValue;
|
|
8
|
+
}
|
|
9
|
+
return clientSecret;
|
|
10
|
+
}
|
|
11
|
+
export function createClientSecretBasicAuthHeader(clientId, clientSecret) {
|
|
12
|
+
return `Basic ${btoa(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`;
|
|
13
|
+
}
|
|
14
|
+
function formEncode(value) {
|
|
15
|
+
const params = new URLSearchParams({ value });
|
|
16
|
+
return params.toString().slice('value='.length);
|
|
17
|
+
}
|
|
18
|
+
//# sourceMappingURL=client-secret.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"client-secret.js","sourceRoot":"","sources":["../../src/utils/client-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C,MAAM,UAAU,mBAAmB,CAAC,YAAqB;IACxD,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAA;IAEnC,MAAM,YAAY,GAAG,aAAa,EAAE,CAAC,YAAY,CAAC,CAAA;IAClD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,YAAY,CAAA;IACpB,CAAC;IAED,OAAO,YAAY,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,QAAgB,EAAE,YAAoB;IACvF,OAAO,SAAS,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAChD,CAAC"}
|
package/dist/utils/cookies.d.ts
CHANGED
|
@@ -9,7 +9,7 @@ export interface CookieAttributes {
|
|
|
9
9
|
}
|
|
10
10
|
export declare function getCookie(request: Request, name: string): string | null;
|
|
11
11
|
export declare function setCookie(response: Response, name: string, value: string, attributes?: CookieAttributes): void;
|
|
12
|
-
export declare function clearCookie(response: Response, name: string, domain?: string): void;
|
|
12
|
+
export declare function clearCookie(response: Response, name: string, domain?: string, path?: string): void;
|
|
13
13
|
export declare function setIdentityCookie(response: Response, value: string): void;
|
|
14
14
|
export declare function clearIdentityCookie(response: Response): void;
|
|
15
15
|
export declare function setTokenCookies(response: Response, options: ResolvedAuthOptions, accessToken: string, refreshToken: string): void;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAExD,MAAM,WAAW,gBAAgB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAKD,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKvE;AAED,wBAAgB,SAAS,CACxB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,gBAAqB,GAC/B,IAAI,CASN;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,
|
|
1
|
+
{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAExD,MAAM,WAAW,gBAAgB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAKD,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKvE;AAED,wBAAgB,SAAS,CACxB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,gBAAqB,GAC/B,IAAI,CASN;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,IAAI,CAM/F;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQzE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAQ5D;AAED,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAClB,IAAI,CAgBN;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAGxF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAK3F;AAED,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GACf,IAAI,CAiBN"}
|
package/dist/utils/cookies.js
CHANGED
|
@@ -23,9 +23,9 @@ export function setCookie(response, name, value, attributes = {}) {
|
|
|
23
23
|
parts.push(`Domain=${attributes.domain}`);
|
|
24
24
|
response.headers.append('Set-Cookie', parts.join('; '));
|
|
25
25
|
}
|
|
26
|
-
export function clearCookie(response, name, domain) {
|
|
26
|
+
export function clearCookie(response, name, domain, path = '/') {
|
|
27
27
|
setCookie(response, name, '', {
|
|
28
|
-
path
|
|
28
|
+
path,
|
|
29
29
|
maxAge: 0,
|
|
30
30
|
...(domain && { domain }),
|
|
31
31
|
});
|
|
@@ -70,24 +70,27 @@ export function clearTokenCookies(response, options) {
|
|
|
70
70
|
clearCookie(response, `${options.cookiePrefix}_rt`, options.sessionCookieDomain);
|
|
71
71
|
}
|
|
72
72
|
export function clearAuthFlowCookies(response, options) {
|
|
73
|
-
clearCookie(response, `${options.cookiePrefix}_pkce
|
|
73
|
+
clearCookie(response, `${options.cookiePrefix}_pkce`, undefined, options.callbackPath);
|
|
74
74
|
clearCookie(response, `${options.cookiePrefix}_state`);
|
|
75
75
|
clearCookie(response, `${options.cookiePrefix}_redirect`);
|
|
76
76
|
clearCookie(response, `${options.cookiePrefix}_provider`);
|
|
77
77
|
}
|
|
78
78
|
export function setAuthFlowCookies(response, options, verifier, state, redirectPath, provider) {
|
|
79
|
-
const
|
|
79
|
+
const baseAttrs = {
|
|
80
80
|
path: '/',
|
|
81
81
|
httpOnly: true,
|
|
82
82
|
secure: true,
|
|
83
83
|
sameSite: 'lax',
|
|
84
84
|
maxAge: 600,
|
|
85
85
|
};
|
|
86
|
-
setCookie(response, `${options.cookiePrefix}_pkce`, verifier,
|
|
87
|
-
|
|
88
|
-
|
|
86
|
+
setCookie(response, `${options.cookiePrefix}_pkce`, verifier, {
|
|
87
|
+
...baseAttrs,
|
|
88
|
+
path: options.callbackPath,
|
|
89
|
+
});
|
|
90
|
+
setCookie(response, `${options.cookiePrefix}_state`, state, baseAttrs);
|
|
91
|
+
setCookie(response, `${options.cookiePrefix}_redirect`, redirectPath, baseAttrs);
|
|
89
92
|
if (provider) {
|
|
90
|
-
setCookie(response, `${options.cookiePrefix}_provider`, provider,
|
|
93
|
+
setCookie(response, `${options.cookiePrefix}_provider`, provider, baseAttrs);
|
|
91
94
|
}
|
|
92
95
|
}
|
|
93
96
|
//# sourceMappingURL=cookies.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAWA,MAAM,oBAAoB,GAAG,OAAO,CAAA;AACpC,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAEvC,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,SAAS,CACxB,QAAkB,EAClB,IAAY,EACZ,KAAa,EACb,aAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;IACtE,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAkB,EAAE,IAAY,EAAE,MAAe;
|
|
1
|
+
{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAWA,MAAM,oBAAoB,GAAG,OAAO,CAAA;AACpC,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAEvC,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,SAAS,CACxB,QAAkB,EAClB,IAAY,EACZ,KAAa,EACb,aAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;IACtE,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAkB,EAAE,IAAY,EAAE,MAAe,EAAE,IAAI,GAAG,GAAG;IACxF,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;QAC7B,IAAI;QACJ,MAAM,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB,EAAE,KAAa;IAClE,SAAS,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE;QAChD,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;KACf,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAkB;IACrD,SAAS,CAAC,QAAQ,EAAE,oBAAoB,EAAE,EAAE,EAAE;QAC7C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,CAAC;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;KACf,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,QAAkB,EAClB,OAA4B,EAC5B,WAAmB,EACnB,YAAoB;IAEpB,MAAM,IAAI,GAAqB;QAC9B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;KAC3E,CAAA;IACD,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,WAAW,EAAE;QAC9D,GAAG,IAAI;QACP,MAAM,EAAE,OAAO,CAAC,iBAAiB;KACjC,CAAC,CAAA;IACF,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,YAAY,EAAE;QAC/D,GAAG,IAAI;QACP,MAAM,EAAE,OAAO,CAAC,kBAAkB;KAClC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB,EAAE,OAA4B;IACjF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAChF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,OAA4B;IACpF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IACtF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACtD,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;IACzD,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,QAAkB,EAClB,OAA4B,EAC5B,QAAgB,EAChB,KAAa,EACb,YAAoB,EACpB,QAAiB;IAEjB,MAAM,SAAS,GAAqB;QACnC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACX,CAAA;IACD,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,EAAE,QAAQ,EAAE;QAC7D,GAAG,SAAS;QACZ,IAAI,EAAE,OAAO,CAAC,YAAY;KAC1B,CAAC,CAAA;IACF,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IACtE,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAA;IAChF,IAAI,QAAQ,EAAE,CAAC;QACd,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC"}
|
package/dist/utils/openauth.d.ts
CHANGED
|
@@ -25,5 +25,5 @@ export declare function getMagicLinkUrl(_context: {
|
|
|
25
25
|
export declare function getForgotPasswordUrl(): string;
|
|
26
26
|
export declare function getResetPasswordUrl(): string;
|
|
27
27
|
export declare function exchangeCode(callbackUrl: URL, code: string, codeVerifier: string, providerFromCookie?: TokenExchangeResult['provider']): Promise<TokenExchangeResult | null>;
|
|
28
|
-
export declare function revokeToken(refreshToken: string, clientId?: string): Promise<void>;
|
|
28
|
+
export declare function revokeToken(refreshToken: string, clientId?: string, clientSecret?: string): Promise<void>;
|
|
29
29
|
//# sourceMappingURL=openauth.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"openauth.d.ts","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"openauth.d.ts","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAMtD,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY7E;AAED,wBAAsB,mBAAmB,CACxC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB/D;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAGlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAG9D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAG5C;AAED,wBAAsB,YAAY,CACjC,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,GAClD,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAmDrC;AAED,wBAAsB,WAAW,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAoBf"}
|
package/dist/utils/openauth.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { getConfig } from '../config-store.js';
|
|
2
|
+
import { createClientSecretBasicAuthHeader, resolveClientSecret } from './client-secret.js';
|
|
2
3
|
import { generatePKCE } from './pkce.js';
|
|
3
4
|
import { generateState } from './state.js';
|
|
4
5
|
import { decodeJwtPayload, extractTokenClaims } from './tokens.js';
|
|
@@ -27,6 +28,8 @@ export async function getAuthorizationUrl(context, provider, _redirectPath, auth
|
|
|
27
28
|
code_challenge_method: 'S256',
|
|
28
29
|
provider,
|
|
29
30
|
});
|
|
31
|
+
if (options.resource)
|
|
32
|
+
params.set('resource', options.resource);
|
|
30
33
|
return {
|
|
31
34
|
url: `${options.issuer}/authorize?${params}`,
|
|
32
35
|
pkceVerifier: flow.verifier,
|
|
@@ -53,17 +56,27 @@ export async function exchangeCode(callbackUrl, code, codeVerifier, providerFrom
|
|
|
53
56
|
const options = getConfig();
|
|
54
57
|
const clientId = options.clientId || callbackUrl.hostname;
|
|
55
58
|
const redirectUri = new URL(options.callbackPath, callbackUrl.origin).toString();
|
|
59
|
+
const clientSecret = resolveClientSecret(options.clientSecret);
|
|
60
|
+
const headers = {
|
|
61
|
+
'Content-Type': 'application/x-www-form-urlencoded',
|
|
62
|
+
};
|
|
63
|
+
if (clientSecret) {
|
|
64
|
+
headers.Authorization = createClientSecretBasicAuthHeader(clientId, clientSecret);
|
|
65
|
+
}
|
|
66
|
+
const body = new URLSearchParams({
|
|
67
|
+
grant_type: 'authorization_code',
|
|
68
|
+
code,
|
|
69
|
+
code_verifier: codeVerifier,
|
|
70
|
+
redirect_uri: redirectUri,
|
|
71
|
+
client_id: clientId,
|
|
72
|
+
});
|
|
73
|
+
if (options.resource)
|
|
74
|
+
body.set('resource', options.resource);
|
|
56
75
|
try {
|
|
57
76
|
const response = await fetch(`${options.issuer}/token`, {
|
|
58
77
|
method: 'POST',
|
|
59
|
-
headers
|
|
60
|
-
body:
|
|
61
|
-
grant_type: 'authorization_code',
|
|
62
|
-
code,
|
|
63
|
-
code_verifier: codeVerifier,
|
|
64
|
-
redirect_uri: redirectUri,
|
|
65
|
-
client_id: clientId,
|
|
66
|
-
}).toString(),
|
|
78
|
+
headers,
|
|
79
|
+
body: body.toString(),
|
|
67
80
|
});
|
|
68
81
|
if (!response.ok)
|
|
69
82
|
return null;
|
|
@@ -86,12 +99,16 @@ export async function exchangeCode(callbackUrl, code, codeVerifier, providerFrom
|
|
|
86
99
|
return null;
|
|
87
100
|
}
|
|
88
101
|
}
|
|
89
|
-
export async function revokeToken(refreshToken, clientId) {
|
|
102
|
+
export async function revokeToken(refreshToken, clientId, clientSecret) {
|
|
90
103
|
const options = getConfig();
|
|
104
|
+
const headers = { 'Content-Type': 'application/x-www-form-urlencoded' };
|
|
105
|
+
if (clientId && clientSecret) {
|
|
106
|
+
headers.Authorization = createClientSecretBasicAuthHeader(clientId, clientSecret);
|
|
107
|
+
}
|
|
91
108
|
try {
|
|
92
109
|
await fetch(`${options.issuer}/revoke`, {
|
|
93
110
|
method: 'POST',
|
|
94
|
-
headers
|
|
111
|
+
headers,
|
|
95
112
|
body: new URLSearchParams({
|
|
96
113
|
token: refreshToken,
|
|
97
114
|
token_type_hint: 'refresh_token',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"openauth.js","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAUlE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAE7B,OAAO;QACN,QAAQ;QACR,SAAS;QACT,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAClD,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,QAAgB,EAChB,aAAqB,EACrB,QAAmB;IAEnB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,QAAQ;KACR,CAAC,CAAA;
|
|
1
|
+
{"version":3,"file":"openauth.js","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAUlE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAE7B,OAAO;QACN,QAAQ;QACR,SAAS;QACT,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAClD,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,QAAgB,EAChB,aAAqB,EACrB,QAAmB;IAEnB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,QAAQ;KACR,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE9D,OAAO;QACN,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,cAAc,MAAM,EAAE;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;KACjB,CAAA;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAsB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,qBAAqB,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAsB;IACrD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,uBAAuB,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,kBAAkB,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,iBAAiB,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,WAAgB,EAChB,IAAY,EACZ,YAAoB,EACpB,kBAAoD;IAEpD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAChF,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9D,MAAM,OAAO,GAA2B;QACvC,cAAc,EAAE,mCAAmC;KACnD,CAAA;IACD,IAAI,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,QAAQ;KACnB,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE5D,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,QAAQ,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAA;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;QAEtE,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,kBAAkB,IAAI,SAAS;YACzC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,YAAoB,EACpB,QAAiB,EACjB,YAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAA;IAC/F,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,SAAS,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,KAAK,EAAE,YAAY;gBACnB,eAAe,EAAE,eAAe;gBAChC,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,kCAAkC;IACnC,CAAC;AACF,CAAC"}
|
package/dist/utils/tokens.d.ts
CHANGED
|
@@ -10,7 +10,7 @@ export interface TokenPayloadClaims extends VerifiedClaims {
|
|
|
10
10
|
}
|
|
11
11
|
export declare function extractTokenClaims(payload: Record<string, unknown>): TokenPayloadClaims;
|
|
12
12
|
export declare function verifyAccessToken(issuer: string, token: string): Promise<VerifiedClaims | null>;
|
|
13
|
-
export declare function refreshTokens(issuer: string, refreshToken: string, clientId?: string): Promise<TokenRefreshResult | null>;
|
|
13
|
+
export declare function refreshTokens(issuer: string, refreshToken: string, clientId?: string, clientSecret?: string, resource?: string): Promise<TokenRefreshResult | null>;
|
|
14
14
|
export declare function decodeJwtPayload(jwt: string): Record<string, unknown>;
|
|
15
15
|
/** @internal Test-only helper. Not exported from @growth-labs/auth/utils. */
|
|
16
16
|
export declare function _resetJwksCache(): void;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAmBrD,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACzD,SAAS,EAAE,OAAO,CAAA;CAClB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAWvF;AAED,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAehC;AAED,wBAAsB,aAAa,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4CpC;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMrE;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}
|
package/dist/utils/tokens.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { createLocalJWKSet, jwtVerify } from 'jose';
|
|
2
|
+
import { createClientSecretBasicAuthHeader } from './client-secret.js';
|
|
2
3
|
const jwksCache = new Map();
|
|
3
4
|
async function getJWKS(issuer) {
|
|
4
5
|
let jwks = jwksCache.get(issuer);
|
|
@@ -40,7 +41,7 @@ export async function verifyAccessToken(issuer, token) {
|
|
|
40
41
|
return null;
|
|
41
42
|
}
|
|
42
43
|
}
|
|
43
|
-
export async function refreshTokens(issuer, refreshToken, clientId) {
|
|
44
|
+
export async function refreshTokens(issuer, refreshToken, clientId, clientSecret, resource) {
|
|
44
45
|
try {
|
|
45
46
|
const params = new URLSearchParams({
|
|
46
47
|
grant_type: 'refresh_token',
|
|
@@ -48,9 +49,17 @@ export async function refreshTokens(issuer, refreshToken, clientId) {
|
|
|
48
49
|
});
|
|
49
50
|
if (clientId)
|
|
50
51
|
params.set('client_id', clientId);
|
|
52
|
+
if (resource)
|
|
53
|
+
params.set('resource', resource);
|
|
54
|
+
const headers = {
|
|
55
|
+
'Content-Type': 'application/x-www-form-urlencoded',
|
|
56
|
+
};
|
|
57
|
+
if (clientId && clientSecret) {
|
|
58
|
+
headers.Authorization = createClientSecretBasicAuthHeader(clientId, clientSecret);
|
|
59
|
+
}
|
|
51
60
|
const response = await fetch(`${issuer}/token`, {
|
|
52
61
|
method: 'POST',
|
|
53
|
-
headers
|
|
62
|
+
headers,
|
|
54
63
|
body: params.toString(),
|
|
55
64
|
});
|
|
56
65
|
if (!response.ok)
|
package/dist/utils/tokens.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;
|
|
1
|
+
{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEnD,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAA;AAItE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAA;AAEjD,KAAK,UAAU,OAAO,CAAC,MAAc;IACpC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IAErB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAA;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAA;IAC9D,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAC9B,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3B,OAAO,IAAI,CAAA;AACZ,CAAC;AAaD,MAAM,UAAU,kBAAkB,CAAC,OAAgC;IAClE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAA;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAA;IAE3C,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAa;QAC1B,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAW;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAuB;QAC7D,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAuB;QAChE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,iBAAiB,CAAC;KAC7D,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAkC,CAAC,CAAA;QACrE,OAAO;YACN,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,MAAc,EACd,YAAoB,EACpB,QAAiB,EACjB,YAAqB,EACrB,QAAiB;IAEjB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC3B,CAAC,CAAA;QACF,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC/C,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAE9C,MAAM,OAAO,GAA2B;YACvC,cAAc,EAAE,mCAAmC;SACnD,CAAA;QACD,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAClF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAA;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;QAEtE,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACrF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe;IAC9B,SAAS,CAAC,KAAK,EAAE,CAAA;AAClB,CAAC"}
|