@leaguebrain/provenance 0.0.0-stage → 0.14.0

package/LICENSE

@@ -0,0 +1,7 @@
+Copyright 2023 Tripleslate Software Development, LLC.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,136 @@
-# Temporary Holding Version
+# provenance
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![npm version](https://img.shields.io/npm/v/@leaguebrain/provenance.svg)](https://www.npmjs.com/package/@leaguebrain/provenance) [![license](https://img.shields.io/npm/l/@leaguebrain/provenance.svg)](../../LICENSE)
+
+Server-side OAuth/OIDC implementation for SvelteKit
+
+## features
+
+- Create a `handle` for programmatically defining auth functionality in server hooks
+  - handle requests to redirectUri, login, and logout routes
+  - refresh access tokens (if refresh tokens used by the provider)
+  - add a session object to `event.locals`
+  - track the referrer for redirect after login
+- Provide a `protectRoute` function for redirecting user without session to login
+- Expose a callback to include extra information in the stored cookie session given tokens data
+
+## installation
+
+`npm i --save-dev @leaguebrain/provenance`
+
+## usage
+
+See the [example project](./example/) to see the following writeup in action.
+
+### include vite plugin
+
+Include `provenance` in the vite plugin pipeline. It will generate a light "runtime"
+that forms the bridge between your project's version of `sveltekit` and the `provenance` core logic.
+
+#### `vite.config.ts`
+
+```ts title="vite.config.ts"
+import { defineConfig } from 'vite';
+
+import { sveltekit } from '@sveltejs/kit/vite';
+import { provenance } from '@leaguebrain/provenance/vite';
+
+export default defineConfig({
+  // provenance first
+  plugins: [provenance(), sveltekit()]
+});
+```
+
+`src/lib/server/PROVENANCE.ts` will be written on vite dev server start and build and should be checked in. This output file location can be customized and optionally output in js.
+
+### create auth object
+
+#### `src/lib/server/auth.ts`
+
+##### github
+
+```ts title="src/lib/server/auth.ts"
+import { provenance } from './PROVENANCE';
+import { github } from '@leaguebrain/provenance/providers';
+import { GH_CLIENT_ID, GH_CLIENT_SECRET } from '$env/static/private';
+
+export const auth = provenance(
+  github({
+    clientId: GH_CLIENT_ID,
+    clientSecret: GH_CLIENT_SECRET
+  })
+);
+```
+
+##### keycloak
+
+```ts title="src/lib/server/auth.ts"
+import { provenance } from './PROVENANCE';
+import { keycloak } from '@leaguebrain/provenance/providers';
+import { KC_BASE, KC_REALM, KC_CLIENT_ID, KC_CLIENT_SECRET } from '$env/static/private';
+
+export const auth = provenance(
+  keycloak({
+    base: KC_BASE,
+    realm: KC_REALM,
+    clientId: KC_CLIENT_ID,
+    clientSecret: KC_CLIENT_SECRET
+  })
+);
+```
+
+### match the `App` interfaces to your provider and session callback
+
+You will not be able to access session data from locals if your `App.Session` interface does not match the `provider` and `sessionCallback` passed to `$provenance.provenance` ([see "create auth object"](#create-auth-object)).
+
+#### `src/app.d.ts`
+
+```ts title="src/app.d.ts"
+declare global {
+  namespace App {
+    interface Session {
+      accessToken: string;
+    }
+
+    // interface Error {}
+    // interface Locals {}
+    // interface PageData {}
+    // interface Platform {}
+  }
+}
+
+export {};
+```
+
+Above example applies to `github` provider. Refer to the fields in the `Session` generic parameter on other providers.
+Note that `Locals` does not need to be defined, `provenance` provides a default `session` field of type `App.Session | null`.
+If an app defines other `Locals` fields, they can be defined here without redefining `session` on `Locals` as typescript will merge the two declarations of the interface.
+
+### intialize handle hook
+
+#### `src/hooks.server.ts`
+
+```ts title="hooks.server.ts"
+import { auth } from '$lib/server/auth';
+
+export const handle = auth.handle;
+```
+
+### protect a route
+
+#### `src/routes/protected/+page.server.ts`
+
+```ts title="src/routes/protected/+page.server.ts"
+import { protectRoute } from '@leaguebrain/provenance/initiatives';
+import { auth } from '$lib/server/auth';
+
+export const load = async (event) => {
+  const session = await protectRoute(auth.createContext)(event);
+
+  return {
+    session
+  };
+};
+```
+
+Note that `handle` in `hooks.server.ts` is not invoked during client side routing (typically, navigating to a page without a `+page.server.ts` after first load). This means that protecting a route with `auth.protectRoute` and accessing (up to date) session information must be done in a `+page.server.ts` load, not a `+page.ts` load.

package/dist/context-C2cW461e.d.ts

@@ -0,0 +1,84 @@
+/**
+ * wraps the JSON body of an OAuth 2.0 token endpoint response (RFC 6749 section 5)
+ */
+declare class TokenRequestResult {
+    body: object;
+    constructor(body: object);
+    private string;
+    private requireString;
+    hasErrorCode(): boolean;
+    errorCode(): string;
+    hasErrorDescription(): boolean;
+    errorDescription(): string;
+    hasErrorURI(): boolean;
+    errorURI(): string;
+    hasState(): boolean;
+    state(): string;
+    tokenType(): string;
+    accessToken(): string;
+    accessTokenExpiresInSeconds(): number;
+    accessTokenExpiresAt(): Date;
+    hasRefreshToken(): boolean;
+    refreshToken(): string;
+    hasScopes(): boolean;
+    scopes(): string[];
+}
+
+type Context<ProviderSession, AppSession> = {
+    oauth: {
+        processAuthResponse: (expectedState: string) => {
+            code: string;
+            state: {
+                referrer?: string;
+            };
+        };
+        requestToken: (codeVerifier: string, authorizationCode: string) => Promise<TokenRequestResult>;
+        referrer: string | null;
+        redirectLogin: (referrer: string | null) => Promise<void>;
+        redirectSignup: (referrer: string | null) => Promise<void>;
+        refresh: (refreshToken: string) => Promise<TokenRequestResult>;
+        preLogout: (session: ProviderSession) => Promise<void>;
+    };
+    checks: {
+        state: {
+            use: () => string;
+        };
+        pkce: {
+            use: () => string;
+        };
+    };
+    session: {
+        create: (tokens: TokenRequestResult) => ProviderSession;
+        getCookie: () => ProviderSession | null;
+        setCookie: (session: ProviderSession) => void;
+        deleteCookie: () => void;
+    };
+    locals: {
+        get session(): AppSession | null;
+        set session(value: AppSession | null);
+    };
+    routes: {
+        redirect: (location: string | URL) => never;
+        redirectUri: {
+            is: boolean;
+        };
+        login: {
+            redirect: () => never;
+            is: boolean;
+        };
+        signup: {
+            redirect: () => never;
+            is: boolean;
+        };
+        logout: {
+            redirect: () => never;
+            is: boolean;
+        };
+        home: {
+            redirect: () => never;
+            is: boolean;
+        };
+    };
+};
+
+export { type Context as C, TokenRequestResult as T };

package/dist/helpers/index.d.ts

@@ -0,0 +1,35 @@
+declare const isSessionChunkCookie: (cookieName: string, sessionCookieName: string) => boolean;
+declare const chunkSessionCookies: (session: any) => string[];
+declare const dechunkSessionCookies: (cookies: {
+    name: string;
+    value: string;
+}[], options: {
+    sessionCookieName: string;
+}) => string | null;
+
+declare const encodeBase64: (bytes: Uint8Array) => string;
+declare const decodeBase64: (data: string) => Uint8Array<ArrayBuffer>;
+declare const encodeBase64urlNoPadding: (bytes: Uint8Array) => string;
+declare const decodeBase64urlIgnorePadding: (data: string) => Uint8Array<ArrayBuffer>;
+declare const b64Encode: (data: string) => string;
+declare const b64Decode: (data: string) => string;
+
+/**
+ * decode the payload of a JWT without verifying its signature
+ * @param jwt compact serialized JWT (`header.payload.signature`)
+ * @returns the JWT payload claims
+ */
+declare const decodeJWTPayload: (jwt: string) => Record<string, unknown>;
+
+declare const logStarter: (...rest: string[]) => void;
+
+/**
+ * only allow same-origin relative paths as redirect targets, guarding against
+ * open redirects like `/login?referrer=https://evil.com` (or protocol-relative
+ * `//evil.com` and backslash `/\evil.com` variants)
+ * @param referrer untrusted referrer (from url search params or oauth state)
+ * @returns the referrer if it is a safe relative path, otherwise null
+ */
+declare const sanitizeReferrer: (referrer: string | null | undefined) => string | null;
+
+export { b64Decode, b64Encode, chunkSessionCookies, dechunkSessionCookies, decodeBase64, decodeBase64urlIgnorePadding, decodeJWTPayload, encodeBase64, encodeBase64urlNoPadding, isSessionChunkCookie, logStarter, sanitizeReferrer };

package/dist/helpers/index.js

@@ -0,0 +1,113 @@
+// src/helpers/cookies.ts
+var chunkIndex = (cookieName, sessionCookieName) => {
+  const prefix = `${sessionCookieName}-`;
+  if (!cookieName.startsWith(prefix)) {
+    return null;
+  }
+  const suffix = cookieName.slice(prefix.length);
+  if (!/^\d+$/.test(suffix)) {
+    return null;
+  }
+  return parseInt(suffix);
+};
+var isSessionChunkCookie = (cookieName, sessionCookieName) => chunkIndex(cookieName, sessionCookieName) !== null;
+var chunkSessionCookies = (session) => {
+  const maxCookieSize = 3500;
+  const fullCookie = JSON.stringify(session);
+  const chunksCount = Math.ceil(fullCookie.length / maxCookieSize);
+  const chunks = [...Array(chunksCount).keys()].map(
+    (i) => fullCookie.substring(i * maxCookieSize, (i + 1) * maxCookieSize)
+  );
+  return chunks;
+};
+var dechunkSessionCookies = (cookies, options) => {
+  const sessionChunkCookies = cookies.flatMap((cookie) => {
+    const index = chunkIndex(cookie.name, options.sessionCookieName);
+    return index !== null ? [{ value: cookie.value, index }] : [];
+  });
+  if (sessionChunkCookies.length > 0) {
+    const sorted = sessionChunkCookies.sort((a, b) => a.index - b.index);
+    const fullCookie = sorted.reduce((prev, current) => prev + current.value, "");
+    return fullCookie;
+  } else {
+    return null;
+  }
+};
+
+// src/helpers/encoding.ts
+var bytesToBinary = (bytes) => {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return binary;
+};
+var binaryToBytes = (binary) => {
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+};
+var encodeBase64 = (bytes) => btoa(bytesToBinary(bytes));
+var decodeBase64 = (data) => binaryToBytes(atob(data));
+var encodeBase64urlNoPadding = (bytes) => encodeBase64(bytes).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+var decodeBase64urlIgnorePadding = (data) => {
+  const base64 = data.replaceAll("-", "+").replaceAll("_", "/").replace(/=+$/, "");
+  return decodeBase64(base64.padEnd(Math.ceil(base64.length / 4) * 4, "="));
+};
+var b64Encode = (data) => {
+  const encoder = new TextEncoder();
+  return encodeBase64(encoder.encode(data));
+};
+var b64Decode = (data) => {
+  const decoder = new TextDecoder();
+  return decoder.decode(decodeBase64(data), {});
+};
+
+// src/helpers/jwt.ts
+var decodeJWTPayload = (jwt) => {
+  const parts = jwt.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWT");
+  }
+  let payload;
+  try {
+    payload = JSON.parse(new TextDecoder().decode(decodeBase64urlIgnorePadding(parts[1])));
+  } catch {
+    throw new Error("Invalid JWT: invalid payload encoding");
+  }
+  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+    throw new Error("Invalid JWT: payload is not an object");
+  }
+  return payload;
+};
+
+// src/helpers/logs.ts
+var logStarter = (...rest) => console.log("\x1B[36m%s\x1B[0m", "provenance:", ...rest);
+
+// src/helpers/referrer.ts
+var sanitizeReferrer = (referrer) => {
+  if (!referrer) {
+    return null;
+  }
+  if (!referrer.startsWith("/") || referrer.startsWith("//") || referrer.startsWith("/\\")) {
+    return null;
+  }
+  return referrer;
+};
+export {
+  b64Decode,
+  b64Encode,
+  chunkSessionCookies,
+  dechunkSessionCookies,
+  decodeBase64,
+  decodeBase64urlIgnorePadding,
+  decodeJWTPayload,
+  encodeBase64,
+  encodeBase64urlNoPadding,
+  isSessionChunkCookie,
+  logStarter,
+  sanitizeReferrer
+};
+//# sourceMappingURL=index.js.map

package/dist/helpers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/helpers/cookies.ts","../../src/helpers/encoding.ts","../../src/helpers/jwt.ts","../../src/helpers/logs.ts","../../src/helpers/referrer.ts"],"sourcesContent":["const chunkIndex = (cookieName: string, sessionCookieName: string): number | null => {\n\tconst prefix = `${sessionCookieName}-`;\n\tif (!cookieName.startsWith(prefix)) {\n\t\treturn null;\n\t}\n\n\tconst suffix = cookieName.slice(prefix.length);\n\tif (!/^\\d+$/.test(suffix)) {\n\t\treturn null;\n\t}\n\n\treturn parseInt(suffix);\n};\n\nexport const isSessionChunkCookie = (cookieName: string, sessionCookieName: string): boolean =>\n\tchunkIndex(cookieName, sessionCookieName) !== null;\n\nexport const chunkSessionCookies = (session: any) => {\n\tconst maxCookieSize = 3500;\n\tconst fullCookie = JSON.stringify(session);\n\n\tconst chunksCount = Math.ceil(fullCookie.length / maxCookieSize);\n\tconst chunks = [...Array(chunksCount).keys()].map((i) =>\n\t\tfullCookie.substring(i * maxCookieSize, (i + 1) * maxCookieSize)\n\t);\n\n\treturn chunks;\n};\n\nexport const dechunkSessionCookies = (\n\tcookies: { name: string; value: string }[],\n\toptions: { sessionCookieName: string }\n) => {\n\tconst sessionChunkCookies = cookies.flatMap((cookie) => {\n\t\tconst index = chunkIndex(cookie.name, options.sessionCookieName);\n\t\treturn index !== null ? [{ value: cookie.value, index }] : [];\n\t});\n\n\tif (sessionChunkCookies.length > 0) {\n\t\tconst sorted = sessionChunkCookies.sort((a, b) => a.index - b.index);\n\n\t\tconst fullCookie = sorted.reduce((prev, current) => prev + current.value, '');\n\n\t\treturn fullCookie;\n\t} else {\n\t\treturn null;\n\t}\n};\n","const bytesToBinary = (bytes: Uint8Array) => {\n\tlet binary = '';\n\tfor (let i = 0; i < bytes.length; i++) {\n\t\tbinary += String.fromCharCode(bytes[i]);\n\t}\n\treturn binary;\n};\n\nconst binaryToBytes = (binary: string) => {\n\tconst bytes = new Uint8Array(binary.length);\n\tfor (let i = 0; i < binary.length; i++) {\n\t\tbytes[i] = binary.charCodeAt(i);\n\t}\n\treturn bytes;\n};\n\nexport const encodeBase64 = (bytes: Uint8Array) => btoa(bytesToBinary(bytes));\n\nexport const decodeBase64 = (data: string) => binaryToBytes(atob(data));\n\nexport const encodeBase64urlNoPadding = (bytes: Uint8Array) =>\n\tencodeBase64(bytes).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');\n\nexport const decodeBase64urlIgnorePadding = (data: string) => {\n\tconst base64 = data.replaceAll('-', '+').replaceAll('_', '/').replace(/=+$/, '');\n\treturn decodeBase64(base64.padEnd(Math.ceil(base64.length / 4) * 4, '='));\n};\n\nexport const b64Encode = (data: string) => {\n\tconst encoder = new TextEncoder();\n\n\treturn encodeBase64(encoder.encode(data));\n};\n\nexport const b64Decode = (data: string) => {\n\tconst decoder = new TextDecoder();\n\n\treturn decoder.decode(decodeBase64(data), {});\n};\n","import { decodeBase64urlIgnorePadding } from './encoding';\n\n/**\n * decode the payload of a JWT without verifying its signature\n * @param jwt compact serialized JWT (`header.payload.signature`)\n * @returns the JWT payload claims\n */\nexport const decodeJWTPayload = (jwt: string): Record<string, unknown> => {\n\tconst parts = jwt.split('.');\n\tif (parts.length !== 3) {\n\t\tthrow new Error('Invalid JWT');\n\t}\n\n\tlet payload: unknown;\n\ttry {\n\t\tpayload = JSON.parse(new TextDecoder().decode(decodeBase64urlIgnorePadding(parts[1])));\n\t} catch {\n\t\tthrow new Error('Invalid JWT: invalid payload encoding');\n\t}\n\n\tif (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {\n\t\tthrow new Error('Invalid JWT: payload is not an object');\n\t}\n\n\treturn payload as Record<string, unknown>;\n};\n","export const logStarter = (...rest: string[]) =>\n\tconsole.log('\\x1b[36m%s\\x1b[0m', 'provenance:', ...rest);\n","/**\n * only allow same-origin relative paths as redirect targets, guarding against\n * open redirects like `/login?referrer=https://evil.com` (or protocol-relative\n * `//evil.com` and backslash `/\\evil.com` variants)\n * @param referrer untrusted referrer (from url search params or oauth state)\n * @returns the referrer if it is a safe relative path, otherwise null\n */\nexport const sanitizeReferrer = (referrer: string | null | undefined): string | null => {\n\tif (!referrer) {\n\t\treturn null;\n\t}\n\n\tif (!referrer.startsWith('/') || referrer.startsWith('//') || referrer.startsWith('/\\\\')) {\n\t\treturn null;\n\t}\n\n\treturn referrer;\n};\n"],"mappings":";AAAA,IAAM,aAAa,CAAC,YAAoB,sBAA6C;AACpF,QAAM,SAAS,GAAG,iBAAiB;AACnC,MAAI,CAAC,WAAW,WAAW,MAAM,GAAG;AACnC,WAAO;AAAA,EACR;AAEA,QAAM,SAAS,WAAW,MAAM,OAAO,MAAM;AAC7C,MAAI,CAAC,QAAQ,KAAK,MAAM,GAAG;AAC1B,WAAO;AAAA,EACR;AAEA,SAAO,SAAS,MAAM;AACvB;AAEO,IAAM,uBAAuB,CAAC,YAAoB,sBACxD,WAAW,YAAY,iBAAiB,MAAM;AAExC,IAAM,sBAAsB,CAAC,YAAiB;AACpD,QAAM,gBAAgB;AACtB,QAAM,aAAa,KAAK,UAAU,OAAO;AAEzC,QAAM,cAAc,KAAK,KAAK,WAAW,SAAS,aAAa;AAC/D,QAAM,SAAS,CAAC,GAAG,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE;AAAA,IAAI,CAAC,MAClD,WAAW,UAAU,IAAI,gBAAgB,IAAI,KAAK,aAAa;AAAA,EAChE;AAEA,SAAO;AACR;AAEO,IAAM,wBAAwB,CACpC,SACA,YACI;AACJ,QAAM,sBAAsB,QAAQ,QAAQ,CAAC,WAAW;AACvD,UAAM,QAAQ,WAAW,OAAO,MAAM,QAAQ,iBAAiB;AAC/D,WAAO,UAAU,OAAO,CAAC,EAAE,OAAO,OAAO,OAAO,MAAM,CAAC,IAAI,CAAC;AAAA,EAC7D,CAAC;AAED,MAAI,oBAAoB,SAAS,GAAG;AACnC,UAAM,SAAS,oBAAoB,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAEnE,UAAM,aAAa,OAAO,OAAO,CAAC,MAAM,YAAY,OAAO,QAAQ,OAAO,EAAE;AAE5E,WAAO;AAAA,EACR,OAAO;AACN,WAAO;AAAA,EACR;AACD;;;AC/CA,IAAM,gBAAgB,CAAC,UAAsB;AAC5C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACtC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACvC;AACA,SAAO;AACR;AAEA,IAAM,gBAAgB,CAAC,WAAmB;AACzC,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACvC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAC/B;AACA,SAAO;AACR;AAEO,IAAM,eAAe,CAAC,UAAsB,KAAK,cAAc,KAAK,CAAC;AAErE,IAAM,eAAe,CAAC,SAAiB,cAAc,KAAK,IAAI,CAAC;AAE/D,IAAM,2BAA2B,CAAC,UACxC,aAAa,KAAK,EAAE,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG,EAAE,QAAQ,OAAO,EAAE;AAEzE,IAAM,+BAA+B,CAAC,SAAiB;AAC7D,QAAM,SAAS,KAAK,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E,SAAO,aAAa,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC;AACzE;AAEO,IAAM,YAAY,CAAC,SAAiB;AAC1C,QAAM,UAAU,IAAI,YAAY;AAEhC,SAAO,aAAa,QAAQ,OAAO,IAAI,CAAC;AACzC;AAEO,IAAM,YAAY,CAAC,SAAiB;AAC1C,QAAM,UAAU,IAAI,YAAY;AAEhC,SAAO,QAAQ,OAAO,aAAa,IAAI,GAAG,CAAC,CAAC;AAC7C;;;AC/BO,IAAM,mBAAmB,CAAC,QAAyC;AACzE,QAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,MAAI,MAAM,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,aAAa;AAAA,EAC9B;AAEA,MAAI;AACJ,MAAI;AACH,cAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,6BAA6B,MAAM,CAAC,CAAC,CAAC,CAAC;AAAA,EACtF,QAAQ;AACP,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACxD;AAEA,MAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAAG;AAC9E,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACxD;AAEA,SAAO;AACR;;;ACzBO,IAAM,aAAa,IAAI,SAC7B,QAAQ,IAAI,qBAAqB,eAAe,GAAG,IAAI;;;ACMjD,IAAM,mBAAmB,CAAC,aAAuD;AACvF,MAAI,CAAC,UAAU;AACd,WAAO;AAAA,EACR;AAEA,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,IAAI,KAAK,SAAS,WAAW,KAAK,GAAG;AACzF,WAAO;AAAA,EACR;AAEA,SAAO;AACR;","names":[]}

package/dist/index-CPpCO-Oc.d.ts

@@ -0,0 +1,103 @@
+import { C as Context, T as TokenRequestResult } from './context-C2cW461e.js';
+
+type Resolver<ProviderSession> = (context: Context<ProviderSession, ProviderSession>, resolve: () => Response | Promise<Response>, logging: boolean) => Response | Promise<Response>;
+
+type AuthServerConfiguration = {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    openid: boolean;
+};
+type Checks = {
+    state: string;
+    codeChallenge: string;
+};
+type EndpointsConfiguration<Session> = {
+    createLoginUrl: (redirectUri: string, checks: Checks) => URL;
+    createSignupUrl: (redirectUri: string, checks: Checks) => URL;
+    createLogoutUrl: (session: Session) => {
+        url: URL;
+        body?: URLSearchParams;
+    };
+    createTokenUrl: () => URL;
+    createUserinfoUrl: () => URL;
+};
+type SessionConfiguration<Session> = {
+    transformTokens: (tokens: TokenRequestResult) => Session;
+    validateSession: <T extends Session>(session: T) => T;
+    sessionCookieAge: (session: Session) => number;
+    fixSession: (session: Session) => Session;
+};
+/**
+ * @param sessionCookieAge optional callback to set cookie age based on session (in seconds)
+ * @param fixSession optional callback to alter field(s) in the session after receiving from auth server
+ */
+type ProviderCallbacks<Session> = {
+    sessionCookieAge?: (session: Session) => number;
+    fixSession?: (session: Session) => Session;
+};
+type Provider<Session> = {
+    authServer: AuthServerConfiguration;
+    endpoints: EndpointsConfiguration<Session>;
+    session: SessionConfiguration<Session>;
+    resolvers: Resolver<Session>[];
+};
+/**
+ * @param configuration OAuth auth server and client configuration (specific to provider)
+ * @param callbacks optional callbacks to customize default provider-specific behaviors (ie. alter session values, set the length of the cookie)
+ * @returns initialized provider to be passed to the generated runtime
+ */
+type CreateProvider<ProviderConfiguration, Session> = (configuration: ProviderConfiguration, callbacks?: ProviderCallbacks<Session>) => Provider<Session>;
+
+/**
+ * create a generic provider with auth server configuration, endpoints, and session definition
+ *
+ * see [github](github.ts) and [keycloak](keycloak.ts) for examples
+ */
+declare const provider: <Session extends object>(authServer: AuthServerConfiguration, endpoints: EndpointsConfiguration<Session>, session: Pick<SessionConfiguration<Session>, "transformTokens"> & Partial<SessionConfiguration<Session>>, resolvers?: Resolver<Session>[]) => Provider<Session>;
+
+/**
+ * find configuration in github > developer settings > OAuth Apps > application
+ */
+type GithubConfiguration = {
+    clientId: string;
+    clientSecret: string;
+    scopes: string[];
+};
+type GithubSession = {
+    accessToken: string;
+};
+declare const github: CreateProvider<GithubConfiguration, GithubSession>;
+
+type KeycloakConfiguration = {
+    /** like https://auth-server.com/ (don't include "realms", "protocol", etc.) */
+    base: string;
+    /** realm corresponding to users of this application (multi-tenant is currently not supported) */
+    realm: string;
+    /** client id corresponding to this application */
+    clientId: string;
+    /** client secret corresponding to this application (can be any empty string if not being used for the client) */
+    clientSecret: string;
+    options: {
+        /**
+         * a ms adjustment to access token expiry, based upon which a server request will trigger or not trigger a token set refresh
+         *
+         * at 0 (default), refresh only access tokens that have expired
+         *
+         * at infinity, refresh on every request
+         */
+        eagerRefresh?: number;
+    };
+    scopes: string[];
+};
+type KeycloakSession = {
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+    refreshExpiresAt: number;
+    accessExpiresAt: number;
+    tokenType: string;
+};
+declare const keycloak: CreateProvider<KeycloakConfiguration, KeycloakSession>;
+
+export { type Provider as P, type Resolver as R, type ProviderCallbacks as a, github as g, keycloak as k, provider as p };