@growth-labs/auth 0.6.2 → 0.7.1

package/src/routes/callback.ts

@@ -0,0 +1,105 @@
+import { getConfig } from '../config-store.js'
+import { getRuntimeEnv } from '../runtime.js'
+import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js'
+import {
+	clearAuthFlowCookies,
+	getCookie,
+	setIdentityCookie,
+	setTokenCookies,
+} from '../utils/cookies.js'
+import { createIdentityCookiePayload, signIdentityCookie } from '../utils/identity-cookie.js'
+import { exchangeCode } from '../utils/openauth.js'
+import { verifyState } from '../utils/state.js'
+
+interface CallbackContext {
+	request: Request
+	url: URL
+	locals?: Record<string, unknown>
+	waitUntil?: (promise: Promise<unknown>) => void
+}
+
+function getIdentitySecret(): string | null {
+	const secret = getRuntimeEnv().GL_IDENTITY_SECRET
+	return typeof secret === 'string' && secret.length > 0 ? secret : null
+}
+
+export async function GET(context: CallbackContext): Promise<Response> {
+	const options = getConfig()
+	const { url, request } = context
+
+	const code = url.searchParams.get('code')
+	const state = url.searchParams.get('state')
+
+	// Verify CSRF state
+	const storedState = getCookie(request, `${options.cookiePrefix}_state`)
+	if (!state || !storedState || !verifyState(state, storedState)) {
+		return new Response('Invalid state parameter', { status: 403 })
+	}
+
+	// Read PKCE verifier
+	const codeVerifier = getCookie(request, `${options.cookiePrefix}_pkce`)
+	if (!codeVerifier) {
+		return new Response('Missing PKCE verifier', { status: 400 })
+	}
+
+	const provider = getCookie(request, `${options.cookiePrefix}_provider`)
+	const authPath = getCookie(request, `${options.cookiePrefix}_auth_path`) || url.pathname
+
+	// Exchange code for tokens
+	const tokenResponse = await exchangeCode(
+		url,
+		code!,
+		codeVerifier,
+		provider === 'google' || provider === 'password' || provider === 'email-code'
+			? provider
+			: undefined,
+	)
+	if (!tokenResponse) {
+		return Response.redirect(
+			new URL(`${options.loginPath}?error=auth_failed`, url.origin).toString(),
+			302,
+		)
+	}
+
+	// Build redirect response
+	const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/'
+	const response = Response.redirect(new URL(redirectPath, url.origin).toString(), 302)
+
+	// Mutable copy for setting cookies
+	const mutableResponse = new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers),
+	})
+
+	setTokenCookies(mutableResponse, options, tokenResponse.accessToken, tokenResponse.refreshToken)
+	clearAuthFlowCookies(mutableResponse, options)
+	const identitySecret = getIdentitySecret()
+	if (identitySecret) {
+		try {
+			setIdentityCookie(
+				mutableResponse,
+				await signIdentityCookie(
+					await createIdentityCookiePayload(tokenResponse.claims.sub, identitySecret),
+					identitySecret,
+				),
+			)
+		} catch {
+			// Keep login working if the optional analytics identity secret is misconfigured.
+		}
+	}
+
+	// Emit analytics event (non-blocking)
+	if (analyticsAvailable(context)) {
+		const eventName = tokenResponse.isNewUser ? 'signup_completed' : 'login_completed'
+		const promise = emitAuthEvent(context, eventName, {
+			provider: tokenResponse.provider,
+			isNewUser: tokenResponse.isNewUser,
+			auth_path: authPath,
+			identity_user_id: tokenResponse.claims.sub,
+		})
+		context.waitUntil?.(promise)
+	}
+
+	return mutableResponse
+}

package/src/routes/flow.ts

@@ -0,0 +1,53 @@
+import type { ResolvedAuthOptions } from '../options.js'
+import { setAuthFlowCookies } from '../utils/cookies.js'
+import { createAuthFlow } from '../utils/openauth.js'
+
+export interface RouteContext {
+	request: Request
+	url: URL
+}
+
+export async function withAuthFlowCookies(
+	context: RouteContext,
+	options: ResolvedAuthOptions,
+	response: Response,
+	redirectPath: string,
+	provider?: string,
+): Promise<Response> {
+	const authFlow = await createAuthFlow(context)
+	const mutable = new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers),
+	})
+	setAuthFlowCookies(mutable, options, authFlow.verifier, authFlow.state, redirectPath, provider, {
+		pkcePath: '/',
+		additionalPkcePaths: [options.callbackPath],
+	})
+	return mutable
+}
+
+export function redirectLocation(
+	context: RouteContext,
+	pathname: string,
+	params: Record<string, string | undefined>,
+): string {
+	const target = new URL(pathname, context.url.origin)
+	for (const [key, value] of Object.entries(params)) {
+		if (value) target.searchParams.set(key, value)
+	}
+	return target.toString()
+}
+
+export function redirectTo(
+	context: RouteContext,
+	pathname: string,
+	params: Record<string, string | undefined>,
+	status = 303,
+): Response {
+	return Response.redirect(redirectLocation(context, pathname, params), status)
+}
+
+export async function readForm(context: RouteContext): Promise<FormData> {
+	return context.request.formData()
+}

package/src/routes/forgot-password.ts

@@ -0,0 +1,31 @@
+import { getConfig } from '../config-store.js'
+import { forgotPasswordRendererPayload, getRenderer, renderHtmlResponse } from '../renderers.js'
+import { getForgotPasswordUrl } from '../utils/openauth.js'
+import { type RouteContext, withAuthFlowCookies } from './flow.js'
+
+export async function GET(context: RouteContext): Promise<Response> {
+	const options = getConfig()
+
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const target = new URL(getForgotPasswordUrl())
+	target.search = context.url.search
+	const renderer = getRenderer('forgotPassword')
+	if (renderer) {
+		const redirectPath = context.url.searchParams.get('redirect') || '/'
+		const response = await renderHtmlResponse(
+			renderer(
+				forgotPasswordRendererPayload(options, {
+					forgotPasswordUrl: target.toString(),
+					error: context.url.searchParams.get('error'),
+					sent: context.url.searchParams.get('sent'),
+				}),
+			),
+		)
+		return withAuthFlowCookies(context, options, response, redirectPath)
+	}
+
+	return Response.redirect(target.toString(), 302)
+}

package/src/routes/login.ts

@@ -0,0 +1,130 @@
+import { loginPageScript } from '../client/login-page.js'
+import { getConfig } from '../config-store.js'
+import { getRenderer, loginRendererPayload, renderHtmlResponse } from '../renderers.js'
+import { setAuthFlowCookies } from '../utils/cookies.js'
+import { createAuthFlow, getAuthorizationUrl } from '../utils/openauth.js'
+
+interface LoginContext {
+	request: Request
+	url: URL
+}
+
+function _shouldShowForgotLink(options: ReturnType<typeof getConfig>): boolean {
+	return options.providers.includes('password')
+}
+
+export async function GET(context: LoginContext): Promise<Response> {
+	const options = getConfig()
+	const redirectPath = context.url.searchParams.get('redirect') || '/'
+	const selectedProvider = context.url.searchParams.get('provider')
+	const error = context.url.searchParams.get('error')
+	const reset = context.url.searchParams.get('reset')
+
+	if (
+		selectedProvider &&
+		options.providers.includes(selectedProvider as (typeof options.providers)[number])
+	) {
+		const authFlow = await createAuthFlow(context)
+		const issuerProvider = selectedProvider === 'email-code' ? 'code' : selectedProvider
+		const { url } = await getAuthorizationUrl(context, issuerProvider, redirectPath, authFlow)
+		const redirectResponse = Response.redirect(url, 302)
+		const response = new Response(redirectResponse.body, {
+			status: redirectResponse.status,
+			statusText: redirectResponse.statusText,
+			headers: new Headers(redirectResponse.headers),
+		})
+		setAuthFlowCookies(
+			response,
+			options,
+			authFlow.verifier,
+			authFlow.state,
+			redirectPath,
+			selectedProvider,
+		)
+		return response
+	}
+
+	const data = {
+		redirectPath,
+		error,
+		reset,
+		useLocalPassword: Boolean(getRenderer('password')),
+		useLocalVerifyCode: Boolean(getRenderer('verifyCode')),
+	}
+	const renderer = getRenderer('login')
+	if (renderer) {
+		return renderHtmlResponse(renderer(loginRendererPayload(options, data)))
+	}
+
+	const html = renderLoginPage(options, data)
+	return new Response(html, {
+		headers: { 'Content-Type': 'text/html; charset=utf-8' },
+	})
+}
+
+interface LoginPageData {
+	redirectPath: string
+	error: string | null
+	reset: string | null
+	useLocalPassword?: boolean
+	useLocalVerifyCode?: boolean
+}
+
+function renderLoginPage(options: ReturnType<typeof getConfig>, data: LoginPageData): string {
+	const { loginPage, providers } = options
+	const availableProviders = providers.filter((provider) =>
+		['google', 'password', 'email-code'].includes(provider),
+	)
+	const hasGoogle = availableProviders.includes('google')
+	const hasAlternativeProvider =
+		availableProviders.includes('password') || availableProviders.includes('email-code')
+	const payload = loginRendererPayload(options, data)
+
+	return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${loginPage.title}</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 20px; }
+    h1 { text-align: center; }
+    .logo { display: block; margin: 0 auto 16px; max-height: 48px; }
+    .btn { display: block; width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; cursor: pointer; text-align: center; text-decoration: none; box-sizing: border-box; }
+    .btn-google { background: #4285f4; color: white; border: none; }
+    .divider { text-align: center; margin: 20px 0; color: #888; }
+    input[type="email"], input[type="password"] { display: block; width: 100%; padding: 10px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; box-sizing: border-box; }
+    .error { color: #c00; text-align: center; margin: 12px 0; }
+    .success { color: #080; text-align: center; margin: 12px 0; }
+    .brand { text-align: center; color: #666; margin-bottom: 4px; }
+    .forgot-link { display: block; text-align: right; font-size: 14px; margin: -4px 0 8px; color: #555; }
+  </style>
+</head>
+<body>
+  ${loginPage.logoUrl ? `<img src="${loginPage.logoUrl}" alt="${loginPage.brandName || ''}" class="logo">` : ''}
+  ${loginPage.brandName ? `<p class="brand">${loginPage.brandName}</p>` : ''}
+  <h1>${loginPage.title}</h1>
+  ${data.reset ? '<p class="success">Password reset successfully. Sign in with your new password.</p>' : ''}
+  ${data.error ? '<p class="error">Authentication failed. Please try again.</p>' : ''}
+  ${
+		hasGoogle
+			? `<a href="${payload.providerUrls.google}" class="btn btn-google" data-provider="google">Sign in with Google</a>`
+			: ''
+	}
+  ${hasGoogle && hasAlternativeProvider ? '<div class="divider">or</div>' : ''}
+  ${
+		availableProviders.includes('email-code')
+			? `<a href="${payload.providerUrls.emailCode}" class="btn" data-provider="email-code">Sign in with email</a>`
+			: ''
+	}
+  ${
+		availableProviders.includes('password')
+			? `
+  <a href="${payload.providerUrls.password}" class="btn" data-provider="password">Sign in with password</a>
+  <a href="${options.forgotPasswordPath}" class="forgot-link">Forgot password?</a>`
+			: ''
+	}
+  <script>${loginPageScript()}</script>
+</body>
+</html>`
+}

package/src/routes/logout.ts

@@ -0,0 +1,59 @@
+import { getConfig } from '../config-store.js'
+import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js'
+import { resolveClientSecret } from '../utils/client-secret.js'
+import {
+	clearAuthFlowCookies,
+	clearIdentityCookie,
+	clearTokenCookies,
+	getCookie,
+} from '../utils/cookies.js'
+import { revokeToken } from '../utils/openauth.js'
+
+interface LogoutContext {
+	request: Request
+	url: URL
+	waitUntil?: (promise: Promise<unknown>) => void
+	locals?: Record<string, unknown>
+}
+
+export async function GET(context: LogoutContext): Promise<Response> {
+	const options = getConfig()
+	const refreshToken = getCookie(context.request, `${options.cookiePrefix}_rt`)
+	const clientId = options.clientId || context.url.hostname
+
+	// Revoke at issuer (non-blocking)
+	if (refreshToken) {
+		const clientSecret = resolveClientSecret(options.clientSecret)
+		const promise = clientSecret
+			? revokeToken(refreshToken, clientId, clientSecret)
+			: revokeToken(refreshToken, clientId)
+		context.waitUntil?.(promise)
+	}
+
+	// Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
+	// wired. Without analytics installed this is a no-op (analyticsAvailable
+	// returns false). Documented in packages-docs/event-registry.md.
+	if (analyticsAvailable(context as { locals?: Record<string, unknown> })) {
+		const promise = emitAuthEvent(context, 'auth_logout', {
+			revoked: refreshToken ? 'true' : 'false',
+		})
+		context.waitUntil?.(promise)
+	}
+
+	// Build redirect response
+	const redirectUrl = new URL(options.logoutRedirect, context.url.origin).toString()
+	const response = Response.redirect(redirectUrl, 302)
+
+	// Mutable copy for clearing cookies
+	const mutableResponse = new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers),
+	})
+
+	clearTokenCookies(mutableResponse, options)
+	clearIdentityCookie(mutableResponse)
+	clearAuthFlowCookies(mutableResponse, options)
+
+	return mutableResponse
+}

package/src/routes/password.ts

@@ -0,0 +1,27 @@
+import { getConfig } from '../config-store.js'
+import { getRenderer, passwordRendererPayload, renderHtmlResponse } from '../renderers.js'
+import { type RouteContext, withAuthFlowCookies } from './flow.js'
+
+export async function GET(context: RouteContext): Promise<Response> {
+	const options = getConfig()
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const renderer = getRenderer('password')
+	if (!renderer) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const redirectPath = context.url.searchParams.get('redirect') || '/'
+	const response = await renderHtmlResponse(
+		renderer(
+			passwordRendererPayload(options, {
+				email: context.url.searchParams.get('email'),
+				error: context.url.searchParams.get('error'),
+				redirectPath,
+			}),
+		),
+	)
+	return withAuthFlowCookies(context, options, response, redirectPath, 'password')
+}

package/src/routes/reset-password.ts

@@ -0,0 +1,33 @@
+import { getConfig } from '../config-store.js'
+import { getRenderer, renderHtmlResponse, resetPasswordRendererPayload } from '../renderers.js'
+import { getResetPasswordUrl } from '../utils/openauth.js'
+
+interface ResetPasswordContext {
+	request: Request
+	url: URL
+}
+
+export async function GET(context: ResetPasswordContext): Promise<Response> {
+	const options = getConfig()
+
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const target = new URL(getResetPasswordUrl())
+	target.search = context.url.search
+	const renderer = getRenderer('resetPassword')
+	if (renderer) {
+		return renderHtmlResponse(
+			renderer(
+				resetPasswordRendererPayload(options, {
+					resetPasswordUrl: target.toString(),
+					error: context.url.searchParams.get('error'),
+					token: context.url.searchParams.get('token'),
+				}),
+			),
+		)
+	}
+
+	return Response.redirect(target.toString(), 302)
+}

package/src/routes/verify-code.ts

@@ -0,0 +1,28 @@
+import { getConfig } from '../config-store.js'
+import { getRenderer, renderHtmlResponse, verifyCodeRendererPayload } from '../renderers.js'
+import { type RouteContext, withAuthFlowCookies } from './flow.js'
+
+export async function GET(context: RouteContext): Promise<Response> {
+	const options = getConfig()
+	if (!options.providers.includes('email-code')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const renderer = getRenderer('verifyCode')
+	if (!renderer) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const redirectPath = context.url.searchParams.get('redirect') || '/'
+	const response = await renderHtmlResponse(
+		renderer(
+			verifyCodeRendererPayload(options, {
+				email: context.url.searchParams.get('email'),
+				error: context.url.searchParams.get('error'),
+				sent: context.url.searchParams.get('sent'),
+				redirectPath,
+			}),
+		),
+	)
+	return withAuthFlowCookies(context, options, response, redirectPath, 'email-code')
+}

package/src/runtime-bridge.ts

@@ -0,0 +1,15 @@
+// Side-effect module: stashes the Cloudflare Worker runtime env onto
+// `globalThis.__GL_AUTH_RUNTIME_ENV__` so that `src/config-store.ts` can
+// read env values without statically importing `cloudflare:workers`.
+//
+// Loaded by `src/middleware/auth.ts` only. The package main entry
+// (`dist/index.js`) does NOT statically import this file, which keeps the
+// pure-Node import gate green — `cloudflare:workers` only enters the
+// graph through middleware/routes that already needed it.
+import { getRuntimeEnv } from './runtime.js'
+
+;(
+	globalThis as typeof globalThis & {
+		__GL_AUTH_RUNTIME_ENV__?: Record<string, unknown>
+	}
+).__GL_AUTH_RUNTIME_ENV__ = getRuntimeEnv()

package/src/runtime.ts

@@ -0,0 +1,5 @@
+import { env as cloudflareEnv } from 'cloudflare:workers'
+
+export function getRuntimeEnv(): Record<string, unknown> {
+	return cloudflareEnv as Record<string, unknown>
+}

package/src/server.ts

@@ -0,0 +1,185 @@
+import { getConfig } from './config-store.js'
+import type { ResolvedAuthOptions } from './options.js'
+import { createClientSecretBasicAuthHeader, resolveClientSecret } from './utils/client-secret.js'
+import { getCookie } from './utils/cookies.js'
+import { resolveInternalIssuer } from './utils/issuer.js'
+import { createPKCEChallenge } from './utils/pkce.js'
+
+export type AuthClientCodeResult = { code: string } | { error: string }
+export type AuthClientOkResult = { ok: true } | { error: string }
+
+export interface AuthClientContext {
+	request: Request
+	url: URL
+}
+
+export interface AuthClient {
+	password: {
+		verify(input: { email: string; password: string }): Promise<AuthClientCodeResult>
+		reset: {
+			request(input: { email: string }): Promise<AuthClientOkResult>
+			confirm(input: { token: string; newPassword: string }): Promise<AuthClientOkResult>
+		}
+	}
+	code: {
+		request(input: { email: string }): Promise<AuthClientOkResult>
+		verify(input: { email: string; code: string }): Promise<AuthClientCodeResult>
+	}
+}
+
+interface AuthFlowPayload {
+	client_id: string
+	redirect_uri: string
+	code_challenge: string
+	code_challenge_method: 'S256'
+	state: string
+	resource?: string
+}
+
+function clientId(options: ResolvedAuthOptions, context: AuthClientContext): string {
+	return options.clientId || context.url.hostname
+}
+
+function redirectUri(options: ResolvedAuthOptions, context: AuthClientContext): string {
+	return new URL(options.callbackPath, context.url.origin).toString()
+}
+
+async function authFlowPayload(
+	options: ResolvedAuthOptions,
+	context: AuthClientContext,
+): Promise<AuthFlowPayload | { error: string }> {
+	const verifier = getCookie(context.request, `${options.cookiePrefix}_pkce`)
+	const state = getCookie(context.request, `${options.cookiePrefix}_state`)
+	if (!verifier || !state) {
+		return { error: 'missing_auth_flow' }
+	}
+
+	return {
+		client_id: clientId(options, context),
+		redirect_uri: redirectUri(options, context),
+		code_challenge: await createPKCEChallenge(verifier),
+		code_challenge_method: 'S256',
+		state,
+		...(options.resource && { resource: options.resource }),
+	}
+}
+
+function headersFor(
+	options: ResolvedAuthOptions,
+	context: AuthClientContext,
+): Record<string, string> {
+	const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+	const secret = resolveClientSecret(options.clientSecret)
+	if (secret) {
+		headers.Authorization = createClientSecretBasicAuthHeader(clientId(options, context), secret)
+	}
+	return headers
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === 'object' && value !== null
+}
+
+async function readJson(response: Response): Promise<Record<string, unknown>> {
+	try {
+		const body = await response.json()
+		return isRecord(body) ? body : {}
+	} catch {
+		return {}
+	}
+}
+
+async function postJson<T extends AuthClientCodeResult | AuthClientOkResult>(
+	options: ResolvedAuthOptions,
+	context: AuthClientContext,
+	pathname: string,
+	body: Record<string, unknown>,
+): Promise<T> {
+	try {
+		const response = await fetch(`${resolveInternalIssuer(options)}${pathname}`, {
+			method: 'POST',
+			headers: headersFor(options, context),
+			body: JSON.stringify(body),
+		})
+		const json = await readJson(response)
+
+		if (typeof json.error === 'string') {
+			return { error: json.error } as T
+		}
+		if (!response.ok) {
+			return { error: 'request_failed' } as T
+		}
+		if (typeof json.code === 'string') {
+			return { code: json.code } as T
+		}
+		if (json.ok === true) {
+			return { ok: true } as T
+		}
+		return { error: 'invalid_response' } as T
+	} catch {
+		return { error: 'request_failed' } as T
+	}
+}
+
+export function authClient(context: AuthClientContext): AuthClient {
+	const options = getConfig()
+
+	return {
+		password: {
+			async verify(input) {
+				const flow = await authFlowPayload(options, context)
+				if ('error' in flow) return flow
+				return postJson<AuthClientCodeResult>(options, context, '/api/v1/auth/password/verify', {
+					...flow,
+					email: input.email,
+					password: input.password,
+					provider: 'password',
+				})
+			},
+			reset: {
+				request(input) {
+					return postJson<AuthClientOkResult>(
+						options,
+						context,
+						'/api/v1/auth/password/reset/request',
+						{
+							email: input.email,
+							client_id: clientId(options, context),
+							reset_url_base: context.url.origin,
+						},
+					)
+				},
+				confirm(input) {
+					return postJson<AuthClientOkResult>(
+						options,
+						context,
+						'/api/v1/auth/password/reset/confirm',
+						{
+							client_id: clientId(options, context),
+							token: input.token,
+							new_password: input.newPassword,
+						},
+					)
+				},
+			},
+		},
+		code: {
+			request(input) {
+				return postJson<AuthClientOkResult>(options, context, '/api/v1/auth/code/request', {
+					email: input.email,
+					client_id: clientId(options, context),
+				})
+			},
+			async verify(input) {
+				const flow = await authFlowPayload(options, context)
+				if ('error' in flow) return flow
+				return postJson<AuthClientCodeResult>(options, context, '/api/v1/auth/code/verify', {
+					...flow,
+					email: input.email,
+					code: input.code,
+					provider: 'code',
+				})
+			},
+		},
+	}
+}