@growth-labs/auth 0.7.0 → 0.7.2

package/src/routes/password.ts

@@ -0,0 +1,27 @@
+import { getConfig } from '../config-store.js'
+import { getRenderer, passwordRendererPayload, renderHtmlResponse } from '../renderers.js'
+import { type RouteContext, withAuthFlowCookies } from './flow.js'
+
+export async function GET(context: RouteContext): Promise<Response> {
+	const options = getConfig()
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const renderer = getRenderer('password')
+	if (!renderer) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const redirectPath = context.url.searchParams.get('redirect') || '/'
+	const response = await renderHtmlResponse(
+		renderer(
+			passwordRendererPayload(options, {
+				email: context.url.searchParams.get('email'),
+				error: context.url.searchParams.get('error'),
+				redirectPath,
+			}),
+		),
+	)
+	return withAuthFlowCookies(context, options, response, redirectPath, 'password')
+}

package/src/routes/reset-password.ts

@@ -0,0 +1,33 @@
+import { getConfig } from '../config-store.js'
+import { getRenderer, renderHtmlResponse, resetPasswordRendererPayload } from '../renderers.js'
+import { getResetPasswordUrl } from '../utils/openauth.js'
+
+interface ResetPasswordContext {
+	request: Request
+	url: URL
+}
+
+export async function GET(context: ResetPasswordContext): Promise<Response> {
+	const options = getConfig()
+
+	if (!options.providers.includes('password')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const target = new URL(getResetPasswordUrl())
+	target.search = context.url.search
+	const renderer = getRenderer('resetPassword')
+	if (renderer) {
+		return renderHtmlResponse(
+			renderer(
+				resetPasswordRendererPayload(options, {
+					resetPasswordUrl: target.toString(),
+					error: context.url.searchParams.get('error'),
+					token: context.url.searchParams.get('token'),
+				}),
+			),
+		)
+	}
+
+	return Response.redirect(target.toString(), 302)
+}

package/src/routes/verify-code.ts

@@ -0,0 +1,28 @@
+import { getConfig } from '../config-store.js'
+import { getRenderer, renderHtmlResponse, verifyCodeRendererPayload } from '../renderers.js'
+import { type RouteContext, withAuthFlowCookies } from './flow.js'
+
+export async function GET(context: RouteContext): Promise<Response> {
+	const options = getConfig()
+	if (!options.providers.includes('email-code')) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const renderer = getRenderer('verifyCode')
+	if (!renderer) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const redirectPath = context.url.searchParams.get('redirect') || '/'
+	const response = await renderHtmlResponse(
+		renderer(
+			verifyCodeRendererPayload(options, {
+				email: context.url.searchParams.get('email'),
+				error: context.url.searchParams.get('error'),
+				sent: context.url.searchParams.get('sent'),
+				redirectPath,
+			}),
+		),
+	)
+	return withAuthFlowCookies(context, options, response, redirectPath, 'email-code')
+}

package/src/runtime-bridge.ts

@@ -0,0 +1,15 @@
+// Side-effect module: stashes the Cloudflare Worker runtime env onto
+// `globalThis.__GL_AUTH_RUNTIME_ENV__` so that `src/config-store.ts` can
+// read env values without statically importing `cloudflare:workers`.
+//
+// Loaded by `src/middleware/auth.ts` only. The package main entry
+// (`dist/index.js`) does NOT statically import this file, which keeps the
+// pure-Node import gate green — `cloudflare:workers` only enters the
+// graph through middleware/routes that already needed it.
+import { getRuntimeEnv } from './runtime.js'
+
+;(
+	globalThis as typeof globalThis & {
+		__GL_AUTH_RUNTIME_ENV__?: Record<string, unknown>
+	}
+).__GL_AUTH_RUNTIME_ENV__ = getRuntimeEnv()

package/src/runtime.ts

@@ -0,0 +1,5 @@
+import { env as cloudflareEnv } from 'cloudflare:workers'
+
+export function getRuntimeEnv(): Record<string, unknown> {
+	return cloudflareEnv as Record<string, unknown>
+}

package/src/server.ts

@@ -0,0 +1,185 @@
+import { getConfig } from './config-store.js'
+import type { ResolvedAuthOptions } from './options.js'
+import { createClientSecretBasicAuthHeader, resolveClientSecret } from './utils/client-secret.js'
+import { getCookie } from './utils/cookies.js'
+import { resolveInternalIssuer } from './utils/issuer.js'
+import { createPKCEChallenge } from './utils/pkce.js'
+
+export type AuthClientCodeResult = { code: string } | { error: string }
+export type AuthClientOkResult = { ok: true } | { error: string }
+
+export interface AuthClientContext {
+	request: Request
+	url: URL
+}
+
+export interface AuthClient {
+	password: {
+		verify(input: { email: string; password: string }): Promise<AuthClientCodeResult>
+		reset: {
+			request(input: { email: string }): Promise<AuthClientOkResult>
+			confirm(input: { token: string; newPassword: string }): Promise<AuthClientOkResult>
+		}
+	}
+	code: {
+		request(input: { email: string }): Promise<AuthClientOkResult>
+		verify(input: { email: string; code: string }): Promise<AuthClientCodeResult>
+	}
+}
+
+interface AuthFlowPayload {
+	client_id: string
+	redirect_uri: string
+	code_challenge: string
+	code_challenge_method: 'S256'
+	state: string
+	resource?: string
+}
+
+function clientId(options: ResolvedAuthOptions, context: AuthClientContext): string {
+	return options.clientId || context.url.hostname
+}
+
+function redirectUri(options: ResolvedAuthOptions, context: AuthClientContext): string {
+	return new URL(options.callbackPath, context.url.origin).toString()
+}
+
+async function authFlowPayload(
+	options: ResolvedAuthOptions,
+	context: AuthClientContext,
+): Promise<AuthFlowPayload | { error: string }> {
+	const verifier = getCookie(context.request, `${options.cookiePrefix}_pkce`)
+	const state = getCookie(context.request, `${options.cookiePrefix}_state`)
+	if (!verifier || !state) {
+		return { error: 'missing_auth_flow' }
+	}
+
+	return {
+		client_id: clientId(options, context),
+		redirect_uri: redirectUri(options, context),
+		code_challenge: await createPKCEChallenge(verifier),
+		code_challenge_method: 'S256',
+		state,
+		...(options.resource && { resource: options.resource }),
+	}
+}
+
+function headersFor(
+	options: ResolvedAuthOptions,
+	context: AuthClientContext,
+): Record<string, string> {
+	const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+	const secret = resolveClientSecret(options.clientSecret)
+	if (secret) {
+		headers.Authorization = createClientSecretBasicAuthHeader(clientId(options, context), secret)
+	}
+	return headers
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === 'object' && value !== null
+}
+
+async function readJson(response: Response): Promise<Record<string, unknown>> {
+	try {
+		const body = await response.json()
+		return isRecord(body) ? body : {}
+	} catch {
+		return {}
+	}
+}
+
+async function postJson<T extends AuthClientCodeResult | AuthClientOkResult>(
+	options: ResolvedAuthOptions,
+	context: AuthClientContext,
+	pathname: string,
+	body: Record<string, unknown>,
+): Promise<T> {
+	try {
+		const response = await fetch(`${resolveInternalIssuer(options)}${pathname}`, {
+			method: 'POST',
+			headers: headersFor(options, context),
+			body: JSON.stringify(body),
+		})
+		const json = await readJson(response)
+
+		if (typeof json.error === 'string') {
+			return { error: json.error } as T
+		}
+		if (!response.ok) {
+			return { error: 'request_failed' } as T
+		}
+		if (typeof json.code === 'string') {
+			return { code: json.code } as T
+		}
+		if (json.ok === true) {
+			return { ok: true } as T
+		}
+		return { error: 'invalid_response' } as T
+	} catch {
+		return { error: 'request_failed' } as T
+	}
+}
+
+export function authClient(context: AuthClientContext): AuthClient {
+	const options = getConfig()
+
+	return {
+		password: {
+			async verify(input) {
+				const flow = await authFlowPayload(options, context)
+				if ('error' in flow) return flow
+				return postJson<AuthClientCodeResult>(options, context, '/api/v1/auth/password/verify', {
+					...flow,
+					email: input.email,
+					password: input.password,
+					provider: 'password',
+				})
+			},
+			reset: {
+				request(input) {
+					return postJson<AuthClientOkResult>(
+						options,
+						context,
+						'/api/v1/auth/password/reset/request',
+						{
+							email: input.email,
+							client_id: clientId(options, context),
+							reset_url_base: context.url.origin,
+						},
+					)
+				},
+				confirm(input) {
+					return postJson<AuthClientOkResult>(
+						options,
+						context,
+						'/api/v1/auth/password/reset/confirm',
+						{
+							client_id: clientId(options, context),
+							token: input.token,
+							new_password: input.newPassword,
+						},
+					)
+				},
+			},
+		},
+		code: {
+			request(input) {
+				return postJson<AuthClientOkResult>(options, context, '/api/v1/auth/code/request', {
+					email: input.email,
+					client_id: clientId(options, context),
+				})
+			},
+			async verify(input) {
+				const flow = await authFlowPayload(options, context)
+				if ('error' in flow) return flow
+				return postJson<AuthClientCodeResult>(options, context, '/api/v1/auth/code/verify', {
+					...flow,
+					email: input.email,
+					code: input.code,
+					provider: 'code',
+				})
+			},
+		},
+	}
+}

package/src/types.ts

@@ -0,0 +1,158 @@
+export interface User {
+	id: string
+	email: string
+	name?: string | null
+	avatarUrl?: string | null
+}
+
+export type AuthenticatedUser = User
+export type UnauthenticatedUser = null
+
+export interface AuthRendererBrand {
+	title: string
+	brandName: string
+	logoUrl: string
+}
+
+export interface LoginRendererPayload {
+	providerUrls: {
+		google?: string
+		password?: string
+		emailCode?: string
+	}
+	errorCode?: 'auth_failed' | 'session_expired' | string
+	reset?: boolean
+	redirect: string
+	brand: AuthRendererBrand
+}
+
+export interface ForgotPasswordRendererPayload {
+	forgotPasswordUrl: string
+	passwordResetRequestUrl: string
+	errorCode?: string
+	sent?: boolean
+	loginUrl: string
+	brand: AuthRendererBrand
+}
+
+export interface ResetPasswordRendererPayload {
+	resetPasswordUrl: string
+	passwordResetConfirmUrl: string
+	errorCode?: string
+	token?: string
+	loginUrl: string
+	brand: AuthRendererBrand
+}
+
+export interface PasswordRendererPayload {
+	passwordVerifyUrl: string
+	forgotPasswordUrl: string
+	email?: string
+	errorCode?: string
+	redirect: string
+	loginUrl: string
+	brand: AuthRendererBrand
+}
+
+export interface VerifyCodeRendererPayload {
+	codeRequestUrl: string
+	codeVerifyUrl: string
+	email?: string
+	errorCode?: string
+	sent?: boolean
+	redirect: string
+	loginUrl: string
+	brand: AuthRendererBrand
+}
+
+export interface EmailCodeConfirmRendererPayload {
+	loginUrl: string
+	brand: AuthRendererBrand
+}
+
+export type AuthRendererResult = string | Response | Promise<string | Response>
+
+export type LoginRenderer = (payload: LoginRendererPayload) => AuthRendererResult
+export type ForgotPasswordRenderer = (payload: ForgotPasswordRendererPayload) => AuthRendererResult
+export type ResetPasswordRenderer = (payload: ResetPasswordRendererPayload) => AuthRendererResult
+export type PasswordRenderer = (payload: PasswordRendererPayload) => AuthRendererResult
+export type VerifyCodeRenderer = (payload: VerifyCodeRendererPayload) => AuthRendererResult
+export type EmailCodeConfirmRenderer = (
+	payload: EmailCodeConfirmRendererPayload,
+) => AuthRendererResult
+
+/**
+ * A renderer registration for the `renderers` integration option.
+ *
+ * `module` is an ES module specifier resolvable by the consumer's bundler
+ * (path alias, package name, or relative path). `export` is the named
+ * export within that module that holds the renderer function. The Vite
+ * plugin emits a real static `import { <export> as <local> } from <module>`
+ * at the top of the virtual `virtual:growth-labs/auth/renderers` module,
+ * which makes the renderer fully bundleable and tree-shakeable in
+ * production. **Do not pass an inline async function** — that approach
+ * (via `Function.prototype.toString()`) crashed in production bundles in
+ * 0.3.6 because Vite's SSR transform rewrote dynamic imports inside the
+ * serialized body to `__vite_ssr_dynamic_import__()`, a helper that does
+ * not exist in production bundles. See `MIGRATION.md`.
+ */
+export interface AuthRendererSpec {
+	module: string
+	export: string
+}
+
+export interface AuthRenderers {
+	login?: AuthRendererSpec
+	forgotPassword?: AuthRendererSpec
+	resetPassword?: AuthRendererSpec
+	password?: AuthRendererSpec
+	verifyCode?: AuthRendererSpec
+	emailCodeConfirm?: AuthRendererSpec
+}
+
+/**
+ * The shape of `virtual:growth-labs/auth/renderers` after the plugin
+ * resolves all registered specs into static ES imports. Internal — only
+ * the package's own routes import from this virtual module.
+ */
+export interface ResolvedAuthRenderers {
+	login?: LoginRenderer
+	forgotPassword?: ForgotPasswordRenderer
+	resetPassword?: ResetPasswordRenderer
+	password?: PasswordRenderer
+	verifyCode?: VerifyCodeRenderer
+	emailCodeConfirm?: EmailCodeConfirmRenderer
+}
+
+export interface TokenRefreshResult {
+	accessToken: string
+	refreshToken: string
+	claims: {
+		sub: string
+		email: string
+		name?: string | null
+		image?: string
+	}
+}
+
+export interface TokenExchangeResult {
+	accessToken: string
+	refreshToken: string
+	isNewUser: boolean
+	provider: 'google' | 'password' | 'email-code' | 'unknown'
+	claims: {
+		sub: string
+		email: string
+		name?: string | null
+		image?: string
+	}
+}
+
+// Augment Astro's locals
+declare global {
+	namespace App {
+		interface Locals {
+			user: User | null
+		}
+	}
+}

package/src/utils/analytics.ts

@@ -0,0 +1,56 @@
+type TrackFn = (context: unknown, event: string, props?: Record<string, unknown>) => Promise<void>
+
+let trackFn: TrackFn | null = null
+let resolved = false
+const ANALYTICS_UTILS_MODULE = '@growth-labs/analytics/utils'
+
+async function importOptionalModule(modulePath: string): Promise<Record<string, unknown> | null> {
+	try {
+		return (await import(/* @vite-ignore */ modulePath)) as Record<string, unknown>
+	} catch {
+		return null
+	}
+}
+
+async function resolveAnalytics(): Promise<void> {
+	if (resolved) return
+	resolved = true
+	const mod = await importOptionalModule(ANALYTICS_UTILS_MODULE)
+	let candidate: unknown
+	try {
+		candidate = mod?.trackServerEvent
+	} catch {
+		candidate = undefined
+	}
+	if (typeof candidate === 'function') {
+		trackFn = candidate as TrackFn
+	}
+}
+
+export async function emitAuthEvent(
+	context: unknown,
+	eventName: string,
+	data: Record<string, unknown>,
+): Promise<void> {
+	await resolveAnalytics()
+	if (!trackFn) return
+	return trackFn(context, eventName, data)
+}
+
+export function analyticsAvailable(context: { locals?: Record<string, unknown> }): boolean {
+	void context
+	return true
+}
+
+export async function trackAuthEvent(
+	context: unknown,
+	eventName: string,
+	data: Record<string, unknown> = {},
+): Promise<void> {
+	return emitAuthEvent(context, eventName, data)
+}
+
+export function _resetAnalytics(): void {
+	trackFn = null
+	resolved = false
+}

package/src/utils/client-secret.ts

@@ -0,0 +1,21 @@
+import { getRuntimeEnv } from '../runtime.js'
+
+export function resolveClientSecret(clientSecret?: string): string | undefined {
+	if (!clientSecret) return undefined
+
+	const runtimeValue = getRuntimeEnv()[clientSecret]
+	if (typeof runtimeValue === 'string' && runtimeValue.length > 0) {
+		return runtimeValue
+	}
+
+	return clientSecret
+}
+
+export function createClientSecretBasicAuthHeader(clientId: string, clientSecret: string): string {
+	return `Basic ${btoa(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`
+}
+
+function formEncode(value: string): string {
+	const params = new URLSearchParams({ value })
+	return params.toString().slice('value='.length)
+}

package/src/utils/cookies.ts

@@ -0,0 +1,134 @@
+import type { ResolvedAuthOptions } from '../options.js'
+
+export interface CookieAttributes {
+	path?: string
+	maxAge?: number
+	httpOnly?: boolean
+	secure?: boolean
+	sameSite?: 'strict' | 'lax' | 'none'
+	domain?: string
+}
+
+const IDENTITY_COOKIE_NAME = 'gl_id'
+const IDENTITY_COOKIE_MAX_AGE = 2592000
+
+export function getCookie(request: Request, name: string): string | null {
+	const header = request.headers.get('cookie')
+	if (!header) return null
+	const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`))
+	return match ? decodeURIComponent(match[1]) : null
+}
+
+export function setCookie(
+	response: Response,
+	name: string,
+	value: string,
+	attributes: CookieAttributes = {},
+): void {
+	const parts = [`${name}=${encodeURIComponent(value)}`]
+	if (attributes.path) parts.push(`Path=${attributes.path}`)
+	if (attributes.maxAge !== undefined) parts.push(`Max-Age=${attributes.maxAge}`)
+	if (attributes.httpOnly) parts.push('HttpOnly')
+	if (attributes.secure) parts.push('Secure')
+	if (attributes.sameSite) parts.push(`SameSite=${attributes.sameSite}`)
+	if (attributes.domain) parts.push(`Domain=${attributes.domain}`)
+	response.headers.append('Set-Cookie', parts.join('; '))
+}
+
+export function clearCookie(response: Response, name: string, domain?: string, path = '/'): void {
+	setCookie(response, name, '', {
+		path,
+		maxAge: 0,
+		...(domain && { domain }),
+	})
+}
+
+export function setIdentityCookie(response: Response, value: string): void {
+	setCookie(response, IDENTITY_COOKIE_NAME, value, {
+		path: '/',
+		maxAge: IDENTITY_COOKIE_MAX_AGE,
+		httpOnly: true,
+		secure: true,
+		sameSite: 'lax',
+	})
+}
+
+export function clearIdentityCookie(response: Response): void {
+	setCookie(response, IDENTITY_COOKIE_NAME, '', {
+		path: '/',
+		maxAge: 0,
+		httpOnly: true,
+		secure: true,
+		sameSite: 'lax',
+	})
+}
+
+export function setTokenCookies(
+	response: Response,
+	options: ResolvedAuthOptions,
+	accessToken: string,
+	refreshToken: string,
+): void {
+	const base: CookieAttributes = {
+		path: '/',
+		httpOnly: true,
+		secure: true,
+		sameSite: 'lax',
+		...(options.sessionCookieDomain && { domain: options.sessionCookieDomain }),
+	}
+	setCookie(response, `${options.cookiePrefix}_at`, accessToken, {
+		...base,
+		maxAge: options.accessTokenMaxAge,
+	})
+	setCookie(response, `${options.cookiePrefix}_rt`, refreshToken, {
+		...base,
+		maxAge: options.refreshTokenMaxAge,
+	})
+}
+
+export function clearTokenCookies(response: Response, options: ResolvedAuthOptions): void {
+	clearCookie(response, `${options.cookiePrefix}_at`, options.sessionCookieDomain)
+	clearCookie(response, `${options.cookiePrefix}_rt`, options.sessionCookieDomain)
+}
+
+export function clearAuthFlowCookies(response: Response, options: ResolvedAuthOptions): void {
+	clearCookie(response, `${options.cookiePrefix}_pkce`, undefined, options.callbackPath)
+	clearCookie(response, `${options.cookiePrefix}_pkce`)
+	clearCookie(response, `${options.cookiePrefix}_state`)
+	clearCookie(response, `${options.cookiePrefix}_redirect`)
+	clearCookie(response, `${options.cookiePrefix}_provider`)
+	clearCookie(response, `${options.cookiePrefix}_auth_path`)
+}
+
+export function setAuthFlowCookies(
+	response: Response,
+	options: ResolvedAuthOptions,
+	verifier: string,
+	state: string,
+	redirectPath: string,
+	provider?: string,
+	flowOptions: { pkcePath?: string; additionalPkcePaths?: string[] } = {},
+): void {
+	const baseAttrs: CookieAttributes = {
+		path: '/',
+		httpOnly: true,
+		secure: true,
+		sameSite: 'lax',
+		maxAge: 600,
+	}
+	const pkcePaths = new Set([
+		flowOptions.pkcePath ?? options.callbackPath,
+		...(flowOptions.additionalPkcePaths ?? []),
+	])
+	for (const path of pkcePaths) {
+		setCookie(response, `${options.cookiePrefix}_pkce`, verifier, {
+			...baseAttrs,
+			path,
+		})
+	}
+	setCookie(response, `${options.cookiePrefix}_state`, state, baseAttrs)
+	setCookie(response, `${options.cookiePrefix}_redirect`, redirectPath, baseAttrs)
+	if (provider) {
+		setCookie(response, `${options.cookiePrefix}_provider`, provider, baseAttrs)
+	}
+}

package/src/utils/encoding.ts

@@ -0,0 +1,5 @@
+export function base64url(bytes: Uint8Array): string {
+	let binary = ''
+	for (const byte of bytes) binary += String.fromCharCode(byte)
+	return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '')
+}