@growth-labs/auth 0.7.0 → 0.7.2

package/src/routes/api/code-request.ts

@@ -0,0 +1,33 @@
+import {
+	authClient,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+	statusRedirect,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('email-code')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const email = await readFormString(form, 'email')
+	const redirect = form.get('redirect')?.toString()
+	const result = await authClient(context).code.request({ email })
+
+	return statusRedirect(
+		context,
+		result,
+		options.verifyCodePath,
+		{ email, sent: '1', redirect },
+		options.verifyCodePath,
+		{ email, redirect },
+	)
+}

package/src/routes/api/code-verify.ts

@@ -0,0 +1,35 @@
+import {
+	authClient,
+	callbackRedirect,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('email-code')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const email = await readFormString(form, 'email')
+	const code = await readFormString(form, 'code')
+	const result = await authClient(context).code.verify({ email, code })
+
+	return callbackRedirect(
+		context,
+		result,
+		options.verifyCodePath,
+		{
+			email,
+			redirect: form.get('redirect')?.toString(),
+		},
+		'email-code',
+	)
+}

package/src/routes/api/password-reset-confirm.ts

@@ -0,0 +1,36 @@
+import {
+	authClient,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+	statusRedirect,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const token = await readFormString(form, 'token')
+	const password = await readFormString(form, 'password', { trim: false })
+	const result = await authClient(context).password.reset.confirm({
+		token,
+		newPassword: password,
+	})
+
+	return statusRedirect(
+		context,
+		result,
+		options.loginPath,
+		{ reset: 'success' },
+		options.resetPasswordPath,
+		{ token },
+	)
+}

package/src/routes/api/password-reset-request.ts

@@ -0,0 +1,32 @@
+import {
+	authClient,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+	statusRedirect,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const email = await readFormString(form, 'email')
+	const result = await authClient(context).password.reset.request({ email })
+
+	return statusRedirect(
+		context,
+		result,
+		options.forgotPasswordPath,
+		{ sent: '1' },
+		options.forgotPasswordPath,
+		{ email },
+	)
+}

package/src/routes/api/password-verify.ts

@@ -0,0 +1,35 @@
+import {
+	authClient,
+	callbackRedirect,
+	getConfig,
+	type RouteContext,
+	readForm,
+	readFormString,
+	rejectCrossSitePost,
+} from './shared.js'
+
+export async function POST(context: RouteContext): Promise<Response> {
+	const crossSitePost = rejectCrossSitePost(context)
+	if (crossSitePost) return crossSitePost
+
+	const options = getConfig()
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const form = await readForm(context)
+	const email = await readFormString(form, 'email')
+	const password = await readFormString(form, 'password', { trim: false })
+	const result = await authClient(context).password.verify({ email, password })
+
+	return callbackRedirect(
+		context,
+		result,
+		options.passwordPath,
+		{
+			email,
+			redirect: form.get('redirect')?.toString(),
+		},
+		'password',
+	)
+}

package/src/routes/api/shared.ts

@@ -0,0 +1,130 @@
+import { getConfig } from '../../config-store.js'
+import { type AuthClientCodeResult, type AuthClientOkResult, authClient } from '../../server.js'
+import { getCookie, setCookie } from '../../utils/cookies.js'
+import { type RouteContext, readForm, redirectLocation, redirectTo } from '../flow.js'
+
+const CROSS_SITE_POST_MESSAGE = 'Cross-site POST form submissions are forbidden'
+
+export async function readFormString(
+	form: FormData,
+	key: string,
+	options: { trim?: boolean } = {},
+): Promise<string> {
+	const value = form.get(key)?.toString() ?? ''
+	return options.trim === false ? value : value.trim()
+}
+
+export function rejectCrossSitePost(context: RouteContext): Response | null {
+	const origin = context.request.headers.get('origin')
+	if (!origin) {
+		return new Response(CROSS_SITE_POST_MESSAGE, { status: 403 })
+	}
+
+	try {
+		if (new URL(origin).origin === context.url.origin) {
+			return null
+		}
+	} catch {
+		return new Response(CROSS_SITE_POST_MESSAGE, { status: 403 })
+	}
+
+	return new Response(CROSS_SITE_POST_MESSAGE, { status: 403 })
+}
+
+export function callbackRedirect(
+	context: RouteContext,
+	result: AuthClientCodeResult,
+	errorPath: string,
+	errorParams: Record<string, string | undefined>,
+	provider?: 'password' | 'email-code',
+): Response {
+	if ('error' in result) {
+		return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error)
+	}
+
+	const options = getConfig()
+	const state = getCookie(context.request, `${options.cookiePrefix}_state`)
+	if (!state) {
+		return routeResult(
+			context,
+			errorPath,
+			{ ...errorParams, error: 'missing_auth_flow' },
+			'missing_auth_flow',
+		)
+	}
+
+	const response = mutableHeaders(
+		routeResult(context, options.callbackPath, {
+			code: result.code,
+			state,
+		}),
+	)
+	setCookie(
+		response,
+		`${options.cookiePrefix}_auth_path`,
+		context.url.pathname,
+		authFlowCookieAttrs(),
+	)
+	if (provider) {
+		setCookie(response, `${options.cookiePrefix}_provider`, provider, authFlowCookieAttrs())
+	}
+	return response
+}
+
+export function statusRedirect(
+	context: RouteContext,
+	result: AuthClientOkResult,
+	successPath: string,
+	successParams: Record<string, string | undefined>,
+	errorPath: string,
+	errorParams: Record<string, string | undefined>,
+): Response {
+	if ('error' in result) {
+		return routeResult(context, errorPath, { ...errorParams, error: result.error }, result.error)
+	}
+	return routeResult(context, successPath, successParams)
+}
+
+function wantsJson(context: RouteContext): boolean {
+	const accept = context.request.headers.get('accept') ?? ''
+	return accept
+		.split(',')
+		.some((value) => value.trim().toLowerCase().split(';')[0] === 'application/json')
+}
+
+function routeResult(
+	context: RouteContext,
+	pathname: string,
+	params: Record<string, string | undefined>,
+	error?: string,
+): Response {
+	const location = redirectLocation(context, pathname, params)
+	if (!wantsJson(context)) {
+		return redirectTo(context, pathname, params)
+	}
+
+	return Response.json(error ? { error, redirect: location } : { ok: true, redirect: location }, {
+		status: error ? 400 : 200,
+	})
+}
+
+export type { RouteContext }
+export { authClient, getConfig, readForm, redirectTo }
+
+function mutableHeaders(response: Response): Response {
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers),
+	})
+}
+
+function authFlowCookieAttrs() {
+	return {
+		path: '/',
+		httpOnly: true,
+		secure: true,
+		sameSite: 'lax' as const,
+		maxAge: 600,
+	}
+}

package/src/routes/callback.ts

@@ -0,0 +1,105 @@
+import { getConfig } from '../config-store.js'
+import { getRuntimeEnv } from '../runtime.js'
+import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js'
+import {
+	clearAuthFlowCookies,
+	getCookie,
+	setIdentityCookie,
+	setTokenCookies,
+} from '../utils/cookies.js'
+import { createIdentityCookiePayload, signIdentityCookie } from '../utils/identity-cookie.js'
+import { exchangeCode } from '../utils/openauth.js'
+import { verifyState } from '../utils/state.js'
+
+interface CallbackContext {
+	request: Request
+	url: URL
+	locals?: Record<string, unknown>
+	waitUntil?: (promise: Promise<unknown>) => void
+}
+
+function getIdentitySecret(): string | null {
+	const secret = getRuntimeEnv().GL_IDENTITY_SECRET
+	return typeof secret === 'string' && secret.length > 0 ? secret : null
+}
+
+export async function GET(context: CallbackContext): Promise<Response> {
+	const options = getConfig()
+	const { url, request } = context
+
+	const code = url.searchParams.get('code')
+	const state = url.searchParams.get('state')
+
+	// Verify CSRF state
+	const storedState = getCookie(request, `${options.cookiePrefix}_state`)
+	if (!state || !storedState || !verifyState(state, storedState)) {
+		return new Response('Invalid state parameter', { status: 403 })
+	}
+
+	// Read PKCE verifier
+	const codeVerifier = getCookie(request, `${options.cookiePrefix}_pkce`)
+	if (!codeVerifier) {
+		return new Response('Missing PKCE verifier', { status: 400 })
+	}
+
+	const provider = getCookie(request, `${options.cookiePrefix}_provider`)
+	const authPath = getCookie(request, `${options.cookiePrefix}_auth_path`) || url.pathname
+
+	// Exchange code for tokens
+	const tokenResponse = await exchangeCode(
+		url,
+		code!,
+		codeVerifier,
+		provider === 'google' || provider === 'password' || provider === 'email-code'
+			? provider
+			: undefined,
+	)
+	if (!tokenResponse) {
+		return Response.redirect(
+			new URL(`${options.loginPath}?error=auth_failed`, url.origin).toString(),
+			302,
+		)
+	}
+
+	// Build redirect response
+	const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/'
+	const response = Response.redirect(new URL(redirectPath, url.origin).toString(), 302)
+
+	// Mutable copy for setting cookies
+	const mutableResponse = new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers),
+	})
+
+	setTokenCookies(mutableResponse, options, tokenResponse.accessToken, tokenResponse.refreshToken)
+	clearAuthFlowCookies(mutableResponse, options)
+	const identitySecret = getIdentitySecret()
+	if (identitySecret) {
+		try {
+			setIdentityCookie(
+				mutableResponse,
+				await signIdentityCookie(
+					await createIdentityCookiePayload(tokenResponse.claims.sub, identitySecret),
+					identitySecret,
+				),
+			)
+		} catch {
+			// Keep login working if the optional analytics identity secret is misconfigured.
+		}
+	}
+
+	// Emit analytics event (non-blocking)
+	if (analyticsAvailable(context)) {
+		const eventName = tokenResponse.isNewUser ? 'signup_completed' : 'login_completed'
+		const promise = emitAuthEvent(context, eventName, {
+			provider: tokenResponse.provider,
+			isNewUser: tokenResponse.isNewUser,
+			auth_path: authPath,
+			identity_user_id: tokenResponse.claims.sub,
+		})
+		context.waitUntil?.(promise)
+	}
+
+	return mutableResponse
+}

package/src/routes/flow.ts

@@ -0,0 +1,53 @@
+import type { ResolvedAuthOptions } from '../options.js'
+import { setAuthFlowCookies } from '../utils/cookies.js'
+import { createAuthFlow } from '../utils/openauth.js'
+
+export interface RouteContext {
+	request: Request
+	url: URL
+}
+
+export async function withAuthFlowCookies(
+	context: RouteContext,
+	options: ResolvedAuthOptions,
+	response: Response,
+	redirectPath: string,
+	provider?: string,
+): Promise<Response> {
+	const authFlow = await createAuthFlow(context)
+	const mutable = new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers),
+	})
+	setAuthFlowCookies(mutable, options, authFlow.verifier, authFlow.state, redirectPath, provider, {
+		pkcePath: '/',
+		additionalPkcePaths: [options.callbackPath],
+	})
+	return mutable
+}
+
+export function redirectLocation(
+	context: RouteContext,
+	pathname: string,
+	params: Record<string, string | undefined>,
+): string {
+	const target = new URL(pathname, context.url.origin)
+	for (const [key, value] of Object.entries(params)) {
+		if (value) target.searchParams.set(key, value)
+	}
+	return target.toString()
+}
+
+export function redirectTo(
+	context: RouteContext,
+	pathname: string,
+	params: Record<string, string | undefined>,
+	status = 303,
+): Response {
+	return Response.redirect(redirectLocation(context, pathname, params), status)
+}
+
+export async function readForm(context: RouteContext): Promise<FormData> {
+	return context.request.formData()
+}

package/src/routes/forgot-password.ts

@@ -0,0 +1,31 @@
+import { getConfig } from '../config-store.js'
+import { forgotPasswordRendererPayload, getRenderer, renderHtmlResponse } from '../renderers.js'
+import { getForgotPasswordUrl } from '../utils/openauth.js'
+import { type RouteContext, withAuthFlowCookies } from './flow.js'
+
+export async function GET(context: RouteContext): Promise<Response> {
+	const options = getConfig()
+
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const target = new URL(getForgotPasswordUrl())
+	target.search = context.url.search
+	const renderer = getRenderer('forgotPassword')
+	if (renderer) {
+		const redirectPath = context.url.searchParams.get('redirect') || '/'
+		const response = await renderHtmlResponse(
+			renderer(
+				forgotPasswordRendererPayload(options, {
+					forgotPasswordUrl: target.toString(),
+					error: context.url.searchParams.get('error'),
+					sent: context.url.searchParams.get('sent'),
+				}),
+			),
+		)
+		return withAuthFlowCookies(context, options, response, redirectPath)
+	}
+
+	return Response.redirect(target.toString(), 302)
+}

package/src/routes/login.ts

@@ -0,0 +1,130 @@
+import { loginPageScript } from '../client/login-page.js'
+import { getConfig } from '../config-store.js'
+import { getRenderer, loginRendererPayload, renderHtmlResponse } from '../renderers.js'
+import { setAuthFlowCookies } from '../utils/cookies.js'
+import { createAuthFlow, getAuthorizationUrl } from '../utils/openauth.js'
+
+interface LoginContext {
+	request: Request
+	url: URL
+}
+
+function _shouldShowForgotLink(options: ReturnType<typeof getConfig>): boolean {
+	return options.providers.includes('password')
+}
+
+export async function GET(context: LoginContext): Promise<Response> {
+	const options = getConfig()
+	const redirectPath = context.url.searchParams.get('redirect') || '/'
+	const selectedProvider = context.url.searchParams.get('provider')
+	const error = context.url.searchParams.get('error')
+	const reset = context.url.searchParams.get('reset')
+
+	if (
+		selectedProvider &&
+		options.providers.includes(selectedProvider as (typeof options.providers)[number])
+	) {
+		const authFlow = await createAuthFlow(context)
+		const issuerProvider = selectedProvider === 'email-code' ? 'code' : selectedProvider
+		const { url } = await getAuthorizationUrl(context, issuerProvider, redirectPath, authFlow)
+		const redirectResponse = Response.redirect(url, 302)
+		const response = new Response(redirectResponse.body, {
+			status: redirectResponse.status,
+			statusText: redirectResponse.statusText,
+			headers: new Headers(redirectResponse.headers),
+		})
+		setAuthFlowCookies(
+			response,
+			options,
+			authFlow.verifier,
+			authFlow.state,
+			redirectPath,
+			selectedProvider,
+		)
+		return response
+	}
+
+	const data = {
+		redirectPath,
+		error,
+		reset,
+		useLocalPassword: Boolean(getRenderer('password')),
+		useLocalVerifyCode: Boolean(getRenderer('verifyCode')),
+	}
+	const renderer = getRenderer('login')
+	if (renderer) {
+		return renderHtmlResponse(renderer(loginRendererPayload(options, data)))
+	}
+
+	const html = renderLoginPage(options, data)
+	return new Response(html, {
+		headers: { 'Content-Type': 'text/html; charset=utf-8' },
+	})
+}
+
+interface LoginPageData {
+	redirectPath: string
+	error: string | null
+	reset: string | null
+	useLocalPassword?: boolean
+	useLocalVerifyCode?: boolean
+}
+
+function renderLoginPage(options: ReturnType<typeof getConfig>, data: LoginPageData): string {
+	const { loginPage, providers } = options
+	const availableProviders = providers.filter((provider) =>
+		['google', 'password', 'email-code'].includes(provider),
+	)
+	const hasGoogle = availableProviders.includes('google')
+	const hasAlternativeProvider =
+		availableProviders.includes('password') || availableProviders.includes('email-code')
+	const payload = loginRendererPayload(options, data)
+
+	return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${loginPage.title}</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 20px; }
+    h1 { text-align: center; }
+    .logo { display: block; margin: 0 auto 16px; max-height: 48px; }
+    .btn { display: block; width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; cursor: pointer; text-align: center; text-decoration: none; box-sizing: border-box; }
+    .btn-google { background: #4285f4; color: white; border: none; }
+    .divider { text-align: center; margin: 20px 0; color: #888; }
+    input[type="email"], input[type="password"] { display: block; width: 100%; padding: 10px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; box-sizing: border-box; }
+    .error { color: #c00; text-align: center; margin: 12px 0; }
+    .success { color: #080; text-align: center; margin: 12px 0; }
+    .brand { text-align: center; color: #666; margin-bottom: 4px; }
+    .forgot-link { display: block; text-align: right; font-size: 14px; margin: -4px 0 8px; color: #555; }
+  </style>
+</head>
+<body>
+  ${loginPage.logoUrl ? `<img src="${loginPage.logoUrl}" alt="${loginPage.brandName || ''}" class="logo">` : ''}
+  ${loginPage.brandName ? `<p class="brand">${loginPage.brandName}</p>` : ''}
+  <h1>${loginPage.title}</h1>
+  ${data.reset ? '<p class="success">Password reset successfully. Sign in with your new password.</p>' : ''}
+  ${data.error ? '<p class="error">Authentication failed. Please try again.</p>' : ''}
+  ${
+		hasGoogle
+			? `<a href="${payload.providerUrls.google}" class="btn btn-google" data-provider="google">Sign in with Google</a>`
+			: ''
+	}
+  ${hasGoogle && hasAlternativeProvider ? '<div class="divider">or</div>' : ''}
+  ${
+		availableProviders.includes('email-code')
+			? `<a href="${payload.providerUrls.emailCode}" class="btn" data-provider="email-code">Sign in with email</a>`
+			: ''
+	}
+  ${
+		availableProviders.includes('password')
+			? `
+  <a href="${payload.providerUrls.password}" class="btn" data-provider="password">Sign in with password</a>
+  <a href="${options.forgotPasswordPath}" class="forgot-link">Forgot password?</a>`
+			: ''
+	}
+  <script>${loginPageScript()}</script>
+</body>
+</html>`
+}

package/src/routes/logout.ts

@@ -0,0 +1,59 @@
+import { getConfig } from '../config-store.js'
+import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js'
+import { resolveClientSecret } from '../utils/client-secret.js'
+import {
+	clearAuthFlowCookies,
+	clearIdentityCookie,
+	clearTokenCookies,
+	getCookie,
+} from '../utils/cookies.js'
+import { revokeToken } from '../utils/openauth.js'
+
+interface LogoutContext {
+	request: Request
+	url: URL
+	waitUntil?: (promise: Promise<unknown>) => void
+	locals?: Record<string, unknown>
+}
+
+export async function GET(context: LogoutContext): Promise<Response> {
+	const options = getConfig()
+	const refreshToken = getCookie(context.request, `${options.cookiePrefix}_rt`)
+	const clientId = options.clientId || context.url.hostname
+
+	// Revoke at issuer (non-blocking)
+	if (refreshToken) {
+		const clientSecret = resolveClientSecret(options.clientSecret)
+		const promise = clientSecret
+			? revokeToken(refreshToken, clientId, clientSecret)
+			: revokeToken(refreshToken, clientId)
+		context.waitUntil?.(promise)
+	}
+
+	// Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
+	// wired. Without analytics installed this is a no-op (analyticsAvailable
+	// returns false). Documented in packages-docs/event-registry.md.
+	if (analyticsAvailable(context as { locals?: Record<string, unknown> })) {
+		const promise = emitAuthEvent(context, 'auth_logout', {
+			revoked: refreshToken ? 'true' : 'false',
+		})
+		context.waitUntil?.(promise)
+	}
+
+	// Build redirect response
+	const redirectUrl = new URL(options.logoutRedirect, context.url.origin).toString()
+	const response = Response.redirect(redirectUrl, 302)
+
+	// Mutable copy for clearing cookies
+	const mutableResponse = new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers),
+	})
+
+	clearTokenCookies(mutableResponse, options)
+	clearIdentityCookie(mutableResponse)
+	clearAuthFlowCookies(mutableResponse, options)
+
+	return mutableResponse
+}