@growth-labs/auth 0.6.2 → 0.7.1

package/src/middleware/auth.ts

@@ -0,0 +1,88 @@
+import { getConfig } from '../config-store.js'
+import '../runtime-bridge.js'
+import type { User } from '../types.js'
+import { resolveClientSecret } from '../utils/client-secret.js'
+import { getCookie, setTokenCookies } from '../utils/cookies.js'
+import { resolveInternalIssuer } from '../utils/issuer.js'
+import { refreshTokens, verifyAccessToken } from '../utils/tokens.js'
+
+export async function onRequest(
+	context: { request: Request; url: URL; locals: Record<string, unknown> },
+	next: () => Promise<Response>,
+): Promise<Response> {
+	const options = getConfig()
+	const issuer = resolveInternalIssuer(options)
+	const { request } = context
+
+	// 1. Read tokens from cookies
+	const accessToken = getCookie(request, `${options.cookiePrefix}_at`)
+	const refreshToken = getCookie(request, `${options.cookiePrefix}_rt`)
+
+	// 2. Attempt to authenticate
+	let user: User | null = null
+	let refreshed: Awaited<ReturnType<typeof refreshTokens>> = null
+
+	if (accessToken) {
+		const verified = await verifyAccessToken(issuer, accessToken)
+		if (verified) {
+			user = {
+				id: verified.sub,
+				email: verified.email,
+				name: verified.name ?? null,
+				avatarUrl: verified.image ?? null,
+			}
+		}
+	}
+
+	if (!user && refreshToken) {
+		const clientId = options.clientId || context.url.hostname
+		const clientSecret = resolveClientSecret(options.clientSecret)
+		refreshed = await refreshTokens(issuer, refreshToken, clientId, clientSecret, options.resource)
+		if (refreshed) {
+			user = {
+				id: refreshed.claims.sub,
+				email: refreshed.claims.email,
+				name: refreshed.claims.name ?? null,
+				avatarUrl: refreshed.claims.image ?? null,
+			}
+		}
+	}
+
+	// 3. Populate context.locals.user
+	context.locals.user = user
+
+	// 4. Gate protected paths
+	if (!user && isGatedPath(context.url.pathname, options.gatedPaths)) {
+		const loginUrl = new URL(
+			`${options.loginPath}?redirect=${encodeURIComponent(context.url.pathname)}`,
+			context.url.origin,
+		)
+		return Response.redirect(loginUrl.toString(), 302)
+	}
+
+	// 5. Continue to the page
+	const response = await next()
+
+	// 6. If tokens were refreshed, set new cookies on the response
+	if (refreshed) {
+		const modifiedResponse = new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers: new Headers(response.headers),
+		})
+		setTokenCookies(modifiedResponse, options, refreshed.accessToken, refreshed.refreshToken)
+		return modifiedResponse
+	}
+
+	return response
+}
+
+function isGatedPath(pathname: string, gatedPaths: string[]): boolean {
+	return gatedPaths.some((pattern) => {
+		if (pattern.endsWith('/*')) {
+			const prefix = pattern.slice(0, -1) // '/premium/*' → '/premium/'
+			return pathname.startsWith(prefix)
+		}
+		return pathname === pattern
+	})
+}

package/src/options.ts

@@ -0,0 +1,75 @@
+import { z } from 'zod'
+import type { AuthRenderers } from './types.js'
+
+// String accepted as either a literal URL or an "env:VAR_NAME" marker that
+// gets resolved against the Worker runtime env at request time. See
+// `src/utils/env-marker.ts` and `src/config-store.ts`. Bare "env:" (no
+// binding name) is rejected — it can never resolve to anything useful.
+const urlOrEnvMarker = z
+	.string()
+	.refine((v) => (v.startsWith('env:') && v.length > 4) || /^https?:\/\//i.test(v), {
+		message: 'Must be a URL (https?://...) or an "env:VAR_NAME" marker',
+	})
+
+// String that, if shaped as an "env:VAR_NAME" marker, must include a
+// non-empty binding name. Literal values pass through unconstrained
+// (they can be any string, e.g. OAuth client IDs). A literal value that
+// happens to start with the reserved "env:" prefix will be treated as a
+// marker — pick a non-colliding name in that edge case.
+const stringOrEnvMarker = z.string().refine((v) => !v.startsWith('env:') || v.length > 4, {
+	message: '"env:" marker must include a binding name (e.g. "env:AUTH_CLIENT_ID")',
+})
+
+export const authOptionsSchema = z.object({
+	// ─── Issuer URLs ───
+	issuer: urlOrEnvMarker,
+	issuerInternal: urlOrEnvMarker.optional(),
+
+	// ─── Client identity ───
+	clientId: stringOrEnvMarker.optional(),
+	clientSecret: z.string().optional(),
+	resource: urlOrEnvMarker.optional(),
+
+	// ─── Cookie configuration ───
+	cookiePrefix: z.string(),
+	sessionCookieDomain: z.string().optional(),
+
+	// ─── Token lifetimes ───
+	accessTokenMaxAge: z.number().default(900),
+	refreshTokenMaxAge: z.number().default(2592000),
+
+	// ─── Path configuration ───
+	gatedPaths: z.array(z.string()).default([]),
+	loginPath: z.string().default('/login'),
+	logoutRedirect: z.string().default('/'),
+	callbackPath: z.string().default('/api/auth/callback'),
+	passwordPath: z.string().default('/password'),
+	verifyCodePath: z.string().default('/verify-code'),
+	forgotPasswordPath: z.string().default('/forgot-password'),
+	resetPasswordPath: z.string().default('/reset-password'),
+	passwordVerifyPath: z.string().default('/api/auth/password/verify'),
+	codeRequestPath: z.string().default('/api/auth/code/request'),
+	codeVerifyPath: z.string().default('/api/auth/code/verify'),
+	passwordResetRequestPath: z.string().default('/api/auth/password/reset/request'),
+	passwordResetConfirmPath: z.string().default('/api/auth/password/reset/confirm'),
+
+	// ─── Providers ───
+	providers: z
+		.array(z.enum(['google', 'password', 'email-code']))
+		.default(['google', 'password', 'email-code']),
+
+	// ─── Login page customization ───
+	loginPage: z
+		.object({
+			title: z.string().default('Sign in'),
+			brandName: z.string().optional(),
+			logoUrl: z.string().optional(),
+		})
+		.default({}),
+
+	// ─── Consumer-owned UI renderers ───
+	renderers: z.custom<AuthRenderers>().default({}),
+})
+
+export type AuthOptions = z.input<typeof authOptionsSchema>
+export type ResolvedAuthOptions = z.output<typeof authOptionsSchema>

package/src/renderers.ts

@@ -0,0 +1,182 @@
+import { renderers as bundledRenderers } from 'virtual:growth-labs/auth/renderers'
+import type {
+	AuthRendererBrand,
+	AuthRendererResult,
+	ForgotPasswordRendererPayload,
+	LoginRendererPayload,
+	PasswordRendererPayload,
+	ResetPasswordRendererPayload,
+	ResolvedAuthRenderers,
+	VerifyCodeRendererPayload,
+} from './types.js'
+
+/**
+ * Look up the bundled renderer for a surface. After 0.3.7 the lookup is
+ * build-time only — renderers are resolved into the virtual module by the
+ * Vite plugin via real static `import` statements. The runtime fallback
+ * that previously read `options.renderers?.[surface]` is gone; it could
+ * never have worked in production (functions captured in `astro.config.mjs`
+ * don't survive serialization), and the new `AuthRenderers` shape is a
+ * `{ module, export }` spec rather than a function anyway.
+ */
+export function getRenderer<K extends keyof ResolvedAuthRenderers>(
+	surface: K,
+): ResolvedAuthRenderers[K] | undefined {
+	return bundledRenderers[surface]
+}
+
+export async function renderHtmlResponse(result: AuthRendererResult): Promise<Response> {
+	const rendered = await result
+	if (rendered instanceof Response) {
+		return rendered
+	}
+	return new Response(rendered, {
+		headers: { 'Content-Type': 'text/html; charset=utf-8' },
+	})
+}
+
+export function rendererBrand(options: {
+	loginPage: { title: string; brandName?: string; logoUrl?: string }
+}): AuthRendererBrand {
+	return {
+		title: options.loginPage.title,
+		brandName: options.loginPage.brandName ?? '',
+		logoUrl: options.loginPage.logoUrl ?? '',
+	}
+}
+
+export function loginRendererPayload(
+	options: {
+		loginPage: { title: string; brandName?: string; logoUrl?: string }
+		loginPath: string
+		passwordPath: string
+		verifyCodePath: string
+		providers: string[]
+	},
+	data: {
+		redirectPath: string
+		error: string | null
+		reset: string | null
+		useLocalPassword?: boolean
+		useLocalVerifyCode?: boolean
+	},
+): LoginRendererPayload {
+	const makeLoginStartUrl = (provider: string) =>
+		`${options.loginPath}?provider=${encodeURIComponent(provider)}&redirect=${encodeURIComponent(data.redirectPath)}`
+	const makeSurfaceUrl = (path: string) =>
+		`${path}?redirect=${encodeURIComponent(data.redirectPath)}`
+
+	return {
+		providerUrls: {
+			google: options.providers.includes('google') ? makeLoginStartUrl('google') : undefined,
+			password: options.providers.includes('password')
+				? data.useLocalPassword
+					? makeSurfaceUrl(options.passwordPath)
+					: makeLoginStartUrl('password')
+				: undefined,
+			emailCode: options.providers.includes('email-code')
+				? data.useLocalVerifyCode
+					? makeSurfaceUrl(options.verifyCodePath)
+					: makeLoginStartUrl('email-code')
+				: undefined,
+		},
+		errorCode: data.error ?? undefined,
+		reset: data.reset ? true : undefined,
+		redirect: data.redirectPath,
+		brand: rendererBrand(options),
+	}
+}
+
+export function forgotPasswordRendererPayload(
+	options: {
+		loginPage: { title: string; brandName?: string; logoUrl?: string }
+		loginPath: string
+		passwordResetRequestPath: string
+	},
+	data: {
+		forgotPasswordUrl: string
+		error: string | null
+		sent: string | null
+	},
+): ForgotPasswordRendererPayload {
+	return {
+		forgotPasswordUrl: data.forgotPasswordUrl,
+		passwordResetRequestUrl: options.passwordResetRequestPath,
+		errorCode: data.error ?? undefined,
+		sent: data.sent ? true : undefined,
+		loginUrl: options.loginPath,
+		brand: rendererBrand(options),
+	}
+}
+
+export function resetPasswordRendererPayload(
+	options: {
+		loginPage: { title: string; brandName?: string; logoUrl?: string }
+		loginPath: string
+		passwordResetConfirmPath: string
+	},
+	data: {
+		resetPasswordUrl: string
+		error: string | null
+		token: string | null
+	},
+): ResetPasswordRendererPayload {
+	return {
+		resetPasswordUrl: data.resetPasswordUrl,
+		passwordResetConfirmUrl: options.passwordResetConfirmPath,
+		errorCode: data.error ?? undefined,
+		token: data.token ?? undefined,
+		loginUrl: options.loginPath,
+		brand: rendererBrand(options),
+	}
+}
+
+export function passwordRendererPayload(
+	options: {
+		loginPage: { title: string; brandName?: string; logoUrl?: string }
+		loginPath: string
+		forgotPasswordPath: string
+		passwordVerifyPath: string
+	},
+	data: {
+		email: string | null
+		error: string | null
+		redirectPath: string
+	},
+): PasswordRendererPayload {
+	return {
+		passwordVerifyUrl: options.passwordVerifyPath,
+		forgotPasswordUrl: options.forgotPasswordPath,
+		email: data.email ?? undefined,
+		errorCode: data.error ?? undefined,
+		redirect: data.redirectPath,
+		loginUrl: options.loginPath,
+		brand: rendererBrand(options),
+	}
+}
+
+export function verifyCodeRendererPayload(
+	options: {
+		loginPage: { title: string; brandName?: string; logoUrl?: string }
+		loginPath: string
+		codeRequestPath: string
+		codeVerifyPath: string
+	},
+	data: {
+		email: string | null
+		error: string | null
+		sent: string | null
+		redirectPath: string
+	},
+): VerifyCodeRendererPayload {
+	return {
+		codeRequestUrl: options.codeRequestPath,
+		codeVerifyUrl: options.codeVerifyPath,
+		email: data.email ?? undefined,
+		errorCode: data.error ?? undefined,
+		sent: data.sent ? true : undefined,
+		redirect: data.redirectPath,
+		loginUrl: options.loginPath,
+		brand: rendererBrand(options),
+	}
+}

package/src/routes/api/code-request.ts

@@ -0,0 +1,33 @@
+import {
+	authClient,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+	statusRedirect,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('email-code')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const email = await readFormString(form, 'email')
+	const redirect = form.get('redirect')?.toString()
+	const result = await authClient(context).code.request({ email })
+
+	return statusRedirect(
+		context,
+		result,
+		options.verifyCodePath,
+		{ email, sent: '1', redirect },
+		options.verifyCodePath,
+		{ email, redirect },
+	)
+}

package/src/routes/api/code-verify.ts

@@ -0,0 +1,35 @@
+import {
+	authClient,
+	callbackRedirect,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('email-code')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const email = await readFormString(form, 'email')
+	const code = await readFormString(form, 'code')
+	const result = await authClient(context).code.verify({ email, code })
+
+	return callbackRedirect(
+		context,
+		result,
+		options.verifyCodePath,
+		{
+			email,
+			redirect: form.get('redirect')?.toString(),
+		},
+		'email-code',
+	)
+}

package/src/routes/api/password-reset-confirm.ts

@@ -0,0 +1,36 @@
+import {
+	authClient,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+	statusRedirect,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const token = await readFormString(form, 'token')
+	const password = await readFormString(form, 'password', { trim: false })
+	const result = await authClient(context).password.reset.confirm({
+		token,
+		newPassword: password,
+	})
+
+	return statusRedirect(
+		context,
+		result,
+		options.loginPath,
+		{ reset: 'success' },
+		options.resetPasswordPath,
+		{ token },
+	)
+}

package/src/routes/api/password-reset-request.ts

@@ -0,0 +1,32 @@
+import {
+	authClient,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+	statusRedirect,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const email = await readFormString(form, 'email')
+	const result = await authClient(context).password.reset.request({ email })
+
+	return statusRedirect(
+		context,
+		result,
+		options.forgotPasswordPath,
+		{ sent: '1' },
+		options.forgotPasswordPath,
+		{ email },
+	)
+}

package/src/routes/api/password-verify.ts

@@ -0,0 +1,35 @@
+import {
+	authClient,
+	callbackRedirect,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const email = await readFormString(form, 'email')
+	const password = await readFormString(form, 'password', { trim: false })
+	const result = await authClient(context).password.verify({ email, password })
+
+	return callbackRedirect(
+		context,
+		result,
+		options.passwordPath,
+		{
+			email,
+			redirect: form.get('redirect')?.toString(),
+		},
+		'password',
+	)
+}

package/src/routes/api/shared.ts

@@ -0,0 +1,130 @@
+import { getConfig } from '../../config-store.js'
+import { type AuthClientCodeResult, type AuthClientOkResult, authClient } from '../../server.js'
+import { getCookie, setCookie } from '../../utils/cookies.js'
+import { type RouteContext, readForm, redirectLocation, redirectTo } from '../flow.js'
+
+const CROSS_SITE_POST_MESSAGE = 'Cross-site POST form submissions are forbidden'
+
+export async function readFormString(
+	form: FormData,
+	key: string,
+	options: { trim?: boolean } = {},
+): Promise<string> {
+	const value = form.get(key)?.toString() ?? ''
+	return options.trim === false ? value : value.trim()
+}
+
+export function rejectCrossSitePost(context: RouteContext): Response | null {
+	const origin = context.request.headers.get('origin')
+	if (!origin) {
+		return new Response(CROSS_SITE_POST_MESSAGE, { status: 403 })
+	}
+
+	try {
+		if (new URL(origin).origin === context.url.origin) {
+			return null
+		}
+	} catch {
+		return new Response(CROSS_SITE_POST_MESSAGE, { status: 403 })
+	}
+
+	return new Response(CROSS_SITE_POST_MESSAGE, { status: 403 })
+}
+
+export function callbackRedirect(
+	context: RouteContext,
+	result: AuthClientCodeResult,
+	errorPath: string,
+	errorParams: Record<string, string | undefined>,
+	provider?: 'password' | 'email-code',
+): Response {
+	if ('error' in result) {
+		return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error)
+	}
+
+	const options = getConfig()
+	const state = getCookie(context.request, `${options.cookiePrefix}_state`)
+	if (!state) {
+		return routeResult(
+			context,
+			errorPath,
+			{ ...errorParams, error: 'missing_auth_flow' },
+			'missing_auth_flow',
+		)
+	}
+
+	const response = mutableHeaders(
+		routeResult(context, options.callbackPath, {
+			code: result.code,
+			state,
+		}),
+	)
+	setCookie(
+		response,
+		`${options.cookiePrefix}_auth_path`,
+		context.url.pathname,
+		authFlowCookieAttrs(),
+	)
+	if (provider) {
+		setCookie(response, `${options.cookiePrefix}_provider`, provider, authFlowCookieAttrs())
+	}
+	return response
+}
+
+export function statusRedirect(
+	context: RouteContext,
+	result: AuthClientOkResult,
+	successPath: string,
+	successParams: Record<string, string | undefined>,
+	errorPath: string,
+	errorParams: Record<string, string | undefined>,
+): Response {
+	if ('error' in result) {
+		return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error)
+	}
+	return routeResult(context, successPath, successParams)
+}
+
+function wantsJson(context: RouteContext): boolean {
+	const accept = context.request.headers.get('accept') ?? ''
+	return accept
+		.split(',')
+		.some((value) => value.trim().toLowerCase().split(';')[0] === 'application/json')
+}
+
+function routeResult(
+	context: RouteContext,
+	pathname: string,
+	params: Record<string, string | undefined>,
+	error?: string,
+): Response {
+	const location = redirectLocation(context, pathname, params)
+	if (!wantsJson(context)) {
+		return redirectTo(context, pathname, params)
+	}
+
+	return Response.json(error ? { error, redirect: location } : { ok: true, redirect: location }, {
+		status: error ? 400 : 200,
+	})
+}
+
+export type { RouteContext }
+export { authClient, getConfig, readForm, redirectTo }
+
+function mutableHeaders(response: Response): Response {
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers),
+	})
+}
+
+function authFlowCookieAttrs() {
+	return {
+		path: '/',
+		httpOnly: true,
+		secure: true,
+		sameSite: 'lax' as const,
+		maxAge: 600,
+	}
+}