@leaguebrain/provenance 0.0.0-stage → 0.14.0

package/dist/initiatives/index.js

@@ -0,0 +1,74 @@
+// src/initiatives/delete-session-cookies.ts
+var deleteSessionCookies = (createContext) => {
+  return async (event) => {
+    const context = createContext(event);
+    context.session.deleteCookie();
+  };
+};
+
+// src/initiatives/protect-route.ts
+var protectRoute = (createContext) => {
+  return async (event) => {
+    const context = createContext(event);
+    const session = context.locals.session;
+    if (session === null) {
+      return context.routes.login.redirect();
+    }
+    return session;
+  };
+};
+
+// src/initiatives/refresh.ts
+var refresh = (createContext) => {
+  return async (event) => {
+    const context = createContext(event);
+    const session = context.locals.session;
+    if (session?.refreshToken) {
+      try {
+        const newTokens = await context.oauth.refresh(session.refreshToken);
+        const newSession = context.session.create(newTokens);
+        context.session.deleteCookie();
+        context.session.setCookie(newSession);
+        context.locals.session = newSession;
+      } catch (e) {
+        console.error("provenance:", e);
+        context.session.deleteCookie();
+        context.locals.session = null;
+        context.routes.login.redirect();
+      }
+    }
+  };
+};
+
+// src/initiatives/login.ts
+var login = (createContext) => {
+  return async (event) => {
+    const context = createContext(event);
+    context.routes.login.redirect();
+  };
+};
+
+// src/initiatives/signup.ts
+var signup = (createContext) => {
+  return async (event) => {
+    const context = createContext(event);
+    context.routes.signup.redirect();
+  };
+};
+
+// src/initiatives/logout.ts
+var logout = (createContext) => {
+  return async (event) => {
+    const context = createContext(event);
+    context.routes.logout.redirect();
+  };
+};
+export {
+  deleteSessionCookies,
+  login,
+  logout,
+  protectRoute,
+  refresh,
+  signup
+};
+//# sourceMappingURL=index.js.map

package/dist/initiatives/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/initiatives/delete-session-cookies.ts","../../src/initiatives/protect-route.ts","../../src/initiatives/refresh.ts","../../src/initiatives/login.ts","../../src/initiatives/signup.ts","../../src/initiatives/logout.ts"],"sourcesContent":["import { Context } from '../types';\n\nexport const deleteSessionCookies = <RequestEvent, ProviderSession, AppSession>(\n\tcreateContext: (event: RequestEvent) => Context<ProviderSession, AppSession>\n) => {\n\treturn async (event: RequestEvent) => {\n\t\tconst context = createContext(event);\n\n\t\tcontext.session.deleteCookie();\n\t};\n};\n","import { Context } from '../types';\n\nexport const protectRoute = <RequestEvent, ProviderSession, AppSession>(\n\tcreateContext: (event: RequestEvent) => Context<ProviderSession, AppSession>\n) => {\n\treturn async (event: RequestEvent) => {\n\t\tconst context = createContext(event);\n\t\tconst session = context.locals.session;\n\n\t\tif (session === null) {\n\t\t\treturn context.routes.login.redirect();\n\t\t}\n\n\t\treturn session;\n\t};\n};\n","import { Context } from '../types';\n\nexport const refresh = <RequestEvent, ProviderSession, AppSession extends { refreshToken: string }>(\n\tcreateContext: (event: RequestEvent) => Context<ProviderSession, AppSession>\n) => {\n\treturn async (event: RequestEvent) => {\n\t\tconst context = createContext(event);\n\t\tconst session = context.locals.session;\n\n\t\tif (session?.refreshToken) {\n\t\t\ttry {\n\t\t\t\t// the access token has expired, so refresh with the refresh token\n\t\t\t\tconst newTokens = await context.oauth.refresh(session.refreshToken);\n\t\t\t\tconst newSession = context.session.create(newTokens);\n\n\t\t\t\tcontext.session.deleteCookie();\n\t\t\t\tcontext.session.setCookie(newSession);\n\t\t\t\t// the runtime stores the provider session in locals (AppSession is its typed view)\n\t\t\t\tcontext.locals.session = newSession as unknown as AppSession;\n\t\t\t} catch (e) {\n\t\t\t\tconsole.error('provenance:', e);\n\t\t\t\t// delete the session cookie\n\t\t\t\tcontext.session.deleteCookie();\n\t\t\t\tcontext.locals.session = null;\n\t\t\t\t// redirect to login\n\t\t\t\tcontext.routes.login.redirect();\n\t\t\t}\n\t\t}\n\t};\n};\n","import { Context } from '../types';\n\nexport const login = <RequestEvent, ProviderSession, AppSession>(\n\tcreateContext: (event: RequestEvent) => Context<ProviderSession, AppSession>\n) => {\n\treturn async (event: RequestEvent) => {\n\t\tconst context = createContext(event);\n\t\tcontext.routes.login.redirect();\n\t};\n};\n","import { Context } from '../types';\n\nexport const signup = <RequestEvent, ProviderSession, AppSession>(\n\tcreateContext: (event: RequestEvent) => Context<ProviderSession, AppSession>\n) => {\n\treturn async (event: RequestEvent) => {\n\t\tconst context = createContext(event);\n\t\tcontext.routes.signup.redirect();\n\t};\n};\n","import { Context } from '../types';\n\nexport const logout = <RequestEvent, ProviderSession, AppSession>(\n\tcreateContext: (event: RequestEvent) => Context<ProviderSession, AppSession>\n) => {\n\treturn async (event: RequestEvent) => {\n\t\tconst context = createContext(event);\n\t\tcontext.routes.logout.redirect();\n\t};\n};\n"],"mappings":";AAEO,IAAM,uBAAuB,CACnC,kBACI;AACJ,SAAO,OAAO,UAAwB;AACrC,UAAM,UAAU,cAAc,KAAK;AAEnC,YAAQ,QAAQ,aAAa;AAAA,EAC9B;AACD;;;ACRO,IAAM,eAAe,CAC3B,kBACI;AACJ,SAAO,OAAO,UAAwB;AACrC,UAAM,UAAU,cAAc,KAAK;AACnC,UAAM,UAAU,QAAQ,OAAO;AAE/B,QAAI,YAAY,MAAM;AACrB,aAAO,QAAQ,OAAO,MAAM,SAAS;AAAA,IACtC;AAEA,WAAO;AAAA,EACR;AACD;;;ACbO,IAAM,UAAU,CACtB,kBACI;AACJ,SAAO,OAAO,UAAwB;AACrC,UAAM,UAAU,cAAc,KAAK;AACnC,UAAM,UAAU,QAAQ,OAAO;AAE/B,QAAI,SAAS,cAAc;AAC1B,UAAI;AAEH,cAAM,YAAY,MAAM,QAAQ,MAAM,QAAQ,QAAQ,YAAY;AAClE,cAAM,aAAa,QAAQ,QAAQ,OAAO,SAAS;AAEnD,gBAAQ,QAAQ,aAAa;AAC7B,gBAAQ,QAAQ,UAAU,UAAU;AAEpC,gBAAQ,OAAO,UAAU;AAAA,MAC1B,SAAS,GAAG;AACX,gBAAQ,MAAM,eAAe,CAAC;AAE9B,gBAAQ,QAAQ,aAAa;AAC7B,gBAAQ,OAAO,UAAU;AAEzB,gBAAQ,OAAO,MAAM,SAAS;AAAA,MAC/B;AAAA,IACD;AAAA,EACD;AACD;;;AC3BO,IAAM,QAAQ,CACpB,kBACI;AACJ,SAAO,OAAO,UAAwB;AACrC,UAAM,UAAU,cAAc,KAAK;AACnC,YAAQ,OAAO,MAAM,SAAS;AAAA,EAC/B;AACD;;;ACPO,IAAM,SAAS,CACrB,kBACI;AACJ,SAAO,OAAO,UAAwB;AACrC,UAAM,UAAU,cAAc,KAAK;AACnC,YAAQ,OAAO,OAAO,SAAS;AAAA,EAChC;AACD;;;ACPO,IAAM,SAAS,CACrB,kBACI;AACJ,SAAO,OAAO,UAAwB;AACrC,UAAM,UAAU,cAAc,KAAK;AACnC,YAAQ,OAAO,OAAO,SAAS;AAAA,EAChC;AACD;","names":[]}

package/dist/providers/index.d.ts

@@ -0,0 +1,2 @@
+export { P as Provider, a as ProviderCallbacks, g as github, k as keycloak, p as provider } from '../index-CPpCO-Oc.js';
+import '../context-C2cW461e.js';

package/dist/providers/index.js

@@ -0,0 +1,377 @@
+// src/helpers/encoding.ts
+var binaryToBytes = (binary) => {
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+};
+var decodeBase64 = (data) => binaryToBytes(atob(data));
+var decodeBase64urlIgnorePadding = (data) => {
+  const base64 = data.replaceAll("-", "+").replaceAll("_", "/").replace(/=+$/, "");
+  return decodeBase64(base64.padEnd(Math.ceil(base64.length / 4) * 4, "="));
+};
+
+// src/helpers/jwt.ts
+var decodeJWTPayload = (jwt) => {
+  const parts = jwt.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWT");
+  }
+  let payload;
+  try {
+    payload = JSON.parse(new TextDecoder().decode(decodeBase64urlIgnorePadding(parts[1])));
+  } catch {
+    throw new Error("Invalid JWT: invalid payload encoding");
+  }
+  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+    throw new Error("Invalid JWT: payload is not an object");
+  }
+  return payload;
+};
+
+// src/helpers/logs.ts
+var logStarter = (...rest) => console.log("\x1B[36m%s\x1B[0m", "provenance:", ...rest);
+
+// src/helpers/referrer.ts
+var sanitizeReferrer = (referrer) => {
+  if (!referrer) {
+    return null;
+  }
+  if (!referrer.startsWith("/") || referrer.startsWith("//") || referrer.startsWith("/\\")) {
+    return null;
+  }
+  return referrer;
+};
+
+// src/resolvers/locals.ts
+var localsResolver = () => async (context, resolve, logging) => {
+  if (logging) logStarter("locals");
+  let session;
+  try {
+    session = context.session.getCookie();
+  } catch (e) {
+    console.error("provenance:", e);
+    context.session.deleteCookie();
+    session = null;
+  }
+  context.locals.session = session;
+  return await resolve();
+};
+
+// src/resolvers/login.ts
+var loginResolver = () => async (context, resolve, logging) => {
+  if (context.routes.login.is) {
+    const session = context.locals.session;
+    const referrer = sanitizeReferrer(context.oauth.referrer);
+    if (session === null) {
+      if (logging) logStarter("login");
+      await context.oauth.redirectLogin(referrer);
+    } else {
+      return referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();
+    }
+  }
+  return await resolve();
+};
+
+// src/resolvers/logout.ts
+var logoutResolver = () => async (context, resolve, logging) => {
+  if (context.routes.logout.is) {
+    const session = context.locals.session;
+    const referrer = sanitizeReferrer(context.oauth.referrer);
+    if (session !== null) {
+      if (logging) logStarter("logout");
+      context.session.deleteCookie();
+      context.locals.session = null;
+    }
+    return referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();
+  }
+  return await resolve();
+};
+
+// src/resolvers/redirect-uri.ts
+var redirectUriResolver = () => async (context, resolve, logging) => {
+  if (context.routes.redirectUri.is) {
+    if (logging) logStarter("redirectUri");
+    let referrer = void 0;
+    try {
+      const expectedState = context.checks.state.use();
+      const codeVerifier = context.checks.pkce.use();
+      const { code, state } = context.oauth.processAuthResponse(expectedState);
+      referrer = sanitizeReferrer(state.referrer) ?? void 0;
+      const tokens = await context.oauth.requestToken(codeVerifier, code);
+      const session = context.session.create(tokens);
+      context.session.deleteCookie();
+      context.session.setCookie(session);
+    } catch (e) {
+      console.error("provenance:", e);
+    }
+    if (referrer) {
+      context.routes.redirect(referrer);
+    } else {
+      context.routes.home.redirect();
+    }
+  }
+  return await resolve();
+};
+
+// src/resolvers/refresh.ts
+var refreshResolver = (options) => {
+  return async (context, resolve, logging) => {
+    const session = context.locals.session;
+    if (session !== null && Date.now() >= session.accessExpiresAt - options.eagerRefresh) {
+      if (logging) logStarter("refresh");
+      const destroySession = () => {
+        context.session.deleteCookie();
+        context.locals.session = null;
+      };
+      if (session.refreshExpiresAt === void 0 || Date.now() < session.refreshExpiresAt) {
+        try {
+          const newTokens = await context.oauth.refresh(session.refreshToken);
+          const newSession = context.session.create(newTokens);
+          destroySession();
+          context.session.setCookie(newSession);
+          context.locals.session = newSession;
+        } catch (e) {
+          console.error("provenance:", e);
+          destroySession();
+        }
+      } else {
+        destroySession();
+      }
+    }
+    return await resolve();
+  };
+};
+
+// src/resolvers/signup.ts
+var signupResolver = () => async (context, resolve, logging) => {
+  if (context.routes.signup.is) {
+    const session = context.locals.session;
+    const referrer = sanitizeReferrer(context.oauth.referrer);
+    if (session === null) {
+      if (logging) logStarter("signup");
+      await context.oauth.redirectSignup(referrer);
+    } else {
+      return referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();
+    }
+  }
+  return await resolve();
+};
+
+// src/providers/provider.ts
+var DEFAULT_SESSION_COOKIE_AGE = 60 * 10;
+var provider = (authServer, endpoints, session, resolvers) => {
+  return {
+    authServer,
+    endpoints,
+    session: {
+      transformTokens: session.transformTokens,
+      validateSession: session.validateSession || ((session2) => session2),
+      sessionCookieAge: session.sessionCookieAge || (() => DEFAULT_SESSION_COOKIE_AGE),
+      fixSession: session.fixSession || ((session2) => session2)
+    },
+    resolvers: resolvers || [
+      redirectUriResolver(),
+      localsResolver(),
+      loginResolver(),
+      signupResolver(),
+      logoutResolver()
+    ]
+  };
+};
+
+// src/providers/github.ts
+var issuer = "https://github.com/login/oauth/";
+var github = (configuration, callbacks) => {
+  const authServer = {
+    issuer,
+    clientId: configuration.clientId,
+    clientSecret: configuration.clientSecret,
+    openid: false
+  };
+  const endpoints = {
+    createLoginUrl(redirectUri, checks) {
+      const url = new URL(`authorize`, issuer);
+      url.searchParams.append("client_id", configuration.clientId);
+      url.searchParams.append("redirect_uri", redirectUri);
+      url.searchParams.append("state", checks.state);
+      url.searchParams.append("allow_signup", "false");
+      url.searchParams.append("scope", configuration.scopes.join(" "));
+      return url;
+    },
+    createSignupUrl(redirectUri, checks) {
+      const url = new URL(`authorize`, issuer);
+      url.searchParams.append("client_id", configuration.clientId);
+      url.searchParams.append("redirect_uri", redirectUri);
+      url.searchParams.append("state", checks.state);
+      url.searchParams.append("allow_signup", "true");
+      url.searchParams.append("scope", configuration.scopes.join(" "));
+      return url;
+    },
+    createLogoutUrl(_session) {
+      return { url: new URL(`logout`, issuer) };
+    },
+    createTokenUrl() {
+      return new URL(`access_token`, issuer);
+    },
+    createUserinfoUrl() {
+      return new URL(`userinfo`, issuer);
+    }
+  };
+  const session = {
+    transformTokens: (tokens) => {
+      return {
+        accessToken: tokens.accessToken()
+      };
+    },
+    validateSession: (session2) => {
+      if (typeof session2.accessToken !== "string") {
+        throw new Error("Session accessToken is not valid");
+      }
+      return session2;
+    },
+    fixSession: callbacks?.fixSession,
+    sessionCookieAge: callbacks?.sessionCookieAge
+  };
+  return provider(authServer, endpoints, session);
+};
+
+// src/providers/keycloak.ts
+var keycloak = (configuration, callbacks) => {
+  const defaultedOptions = {
+    eagerRefresh: 0,
+    ...configuration.options
+  };
+  const authServer = {
+    issuer: new URL(`/realms/${configuration.realm}`, configuration.base).toString(),
+    clientId: configuration.clientId,
+    clientSecret: configuration.clientSecret,
+    openid: true
+  };
+  const endpoints = {
+    createLoginUrl(redirectUri, checks) {
+      const url = new URL(
+        `/realms/${configuration.realm}/protocol/openid-connect/auth`,
+        configuration.base
+      );
+      url.searchParams.append("client_id", configuration.clientId);
+      url.searchParams.append("redirect_uri", redirectUri);
+      url.searchParams.append("response_type", "code");
+      url.searchParams.append("response_mode", "query");
+      url.searchParams.append("state", checks.state);
+      url.searchParams.append("code_challenge", checks.codeChallenge);
+      url.searchParams.append("code_challenge_method", "S256");
+      url.searchParams.append("scope", configuration.scopes.join(" "));
+      return url;
+    },
+    createSignupUrl(redirectUri, checks) {
+      const url = new URL(
+        `/realms/${configuration.realm}/protocol/openid-connect/registrations`,
+        configuration.base
+      );
+      url.searchParams.append("client_id", configuration.clientId);
+      url.searchParams.append("redirect_uri", redirectUri);
+      url.searchParams.append("response_type", "code");
+      url.searchParams.append("response_mode", "query");
+      url.searchParams.append("state", checks.state);
+      url.searchParams.append("code_challenge", checks.codeChallenge);
+      url.searchParams.append("code_challenge_method", "S256");
+      url.searchParams.append("scope", configuration.scopes.join(" "));
+      return url;
+    },
+    createLogoutUrl: (session2) => {
+      const id_token_hint = session2.idToken;
+      return {
+        url: new URL(
+          `/realms/${configuration.realm}/protocol/openid-connect/logout`,
+          configuration.base
+        ),
+        body: new URLSearchParams({
+          id_token_hint
+        })
+      };
+    },
+    createTokenUrl: () => new URL(`/realms/${configuration.realm}/protocol/openid-connect/token`, configuration.base),
+    createUserinfoUrl: () => new URL(`/realms/${configuration.realm}/protocol/openid-connect/userinfo`, configuration.base)
+  };
+  const session = {
+    transformTokens: (tokens) => {
+      const { id_token, refresh_expires_in } = tokens.body;
+      if (!id_token) {
+        throw new Error(`tokens response does not include 'id_token'`);
+      }
+      if (!tokens.accessTokenExpiresAt()) {
+        throw new Error(`tokens response does not include 'expires_in'`);
+      }
+      if (!tokens.refreshToken()) {
+        throw new Error(`tokens response does not include 'refresh_token'`);
+      }
+      if (!refresh_expires_in) {
+        throw new Error(`tokens response does not include 'refresh_expires_in'`);
+      }
+      const refreshExpiresInSeconds = parseInt(refresh_expires_in);
+      return {
+        idToken: id_token,
+        accessToken: tokens.accessToken(),
+        refreshToken: tokens.refreshToken(),
+        refreshExpiresAt: Date.now() + refreshExpiresInSeconds * 1e3,
+        accessExpiresAt: tokens.accessTokenExpiresAt().getTime(),
+        tokenType: tokens.tokenType()
+      };
+    },
+    validateSession: (session2) => {
+      if (typeof session2.idToken !== "string") {
+        throw new Error("Session idToken is not valid");
+      }
+      if (typeof session2.accessToken !== "string") {
+        throw new Error("Session accessToken is not valid");
+      }
+      if (typeof session2.refreshToken !== "string") {
+        throw new Error("Session refreshToken is not valid");
+      }
+      if (decodeJWTPayload(session2.idToken).iss !== authServer.issuer) {
+        throw new Error("Session idToken issuer mismatch");
+      }
+      if (decodeJWTPayload(session2.accessToken).iss !== authServer.issuer) {
+        throw new Error("Session accessToken issuer mismatch");
+      }
+      if (decodeJWTPayload(session2.refreshToken).iss !== authServer.issuer) {
+        throw new Error("Session refreshToken issuer mismatch");
+      }
+      if (typeof session2.accessExpiresAt !== "number" || session2.accessExpiresAt < 0) {
+        throw new Error("Session accessExpiresAt is not valid");
+      }
+      if (typeof session2.refreshExpiresAt !== "number" || session2.refreshExpiresAt < 0) {
+        throw new Error("Session refreshExpiresAt is not valid");
+      }
+      if (session2.tokenType !== "Bearer") {
+        throw new Error('Session tokenType is not "Bearer" type');
+      }
+      return session2;
+    },
+    fixSession: callbacks?.fixSession,
+    sessionCookieAge: callbacks?.sessionCookieAge || ((session2) => Math.floor((session2.refreshExpiresAt - Date.now()) / 1e3))
+  };
+  const resolvers = [
+    redirectUriResolver(),
+    localsResolver(),
+    loginResolver(),
+    signupResolver(),
+    async (context, resolve) => {
+      if (context.routes.logout.is && context.locals.session) {
+        await context.oauth.preLogout(context.locals.session);
+      }
+      return await resolve();
+    },
+    logoutResolver(),
+    refreshResolver({ eagerRefresh: defaultedOptions.eagerRefresh })
+  ];
+  return provider(authServer, endpoints, session, resolvers);
+};
+export {
+  github,
+  keycloak,
+  provider
+};
+//# sourceMappingURL=index.js.map

package/dist/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/helpers/encoding.ts","../../src/helpers/jwt.ts","../../src/helpers/logs.ts","../../src/helpers/referrer.ts","../../src/resolvers/locals.ts","../../src/resolvers/login.ts","../../src/resolvers/logout.ts","../../src/resolvers/redirect-uri.ts","../../src/resolvers/refresh.ts","../../src/resolvers/signup.ts","../../src/providers/provider.ts","../../src/providers/github.ts","../../src/providers/keycloak.ts"],"sourcesContent":["const bytesToBinary = (bytes: Uint8Array) => {\n\tlet binary = '';\n\tfor (let i = 0; i < bytes.length; i++) {\n\t\tbinary += String.fromCharCode(bytes[i]);\n\t}\n\treturn binary;\n};\n\nconst binaryToBytes = (binary: string) => {\n\tconst bytes = new Uint8Array(binary.length);\n\tfor (let i = 0; i < binary.length; i++) {\n\t\tbytes[i] = binary.charCodeAt(i);\n\t}\n\treturn bytes;\n};\n\nexport const encodeBase64 = (bytes: Uint8Array) => btoa(bytesToBinary(bytes));\n\nexport const decodeBase64 = (data: string) => binaryToBytes(atob(data));\n\nexport const encodeBase64urlNoPadding = (bytes: Uint8Array) =>\n\tencodeBase64(bytes).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');\n\nexport const decodeBase64urlIgnorePadding = (data: string) => {\n\tconst base64 = data.replaceAll('-', '+').replaceAll('_', '/').replace(/=+$/, '');\n\treturn decodeBase64(base64.padEnd(Math.ceil(base64.length / 4) * 4, '='));\n};\n\nexport const b64Encode = (data: string) => {\n\tconst encoder = new TextEncoder();\n\n\treturn encodeBase64(encoder.encode(data));\n};\n\nexport const b64Decode = (data: string) => {\n\tconst decoder = new TextDecoder();\n\n\treturn decoder.decode(decodeBase64(data), {});\n};\n","import { decodeBase64urlIgnorePadding } from './encoding';\n\n/**\n * decode the payload of a JWT without verifying its signature\n * @param jwt compact serialized JWT (`header.payload.signature`)\n * @returns the JWT payload claims\n */\nexport const decodeJWTPayload = (jwt: string): Record<string, unknown> => {\n\tconst parts = jwt.split('.');\n\tif (parts.length !== 3) {\n\t\tthrow new Error('Invalid JWT');\n\t}\n\n\tlet payload: unknown;\n\ttry {\n\t\tpayload = JSON.parse(new TextDecoder().decode(decodeBase64urlIgnorePadding(parts[1])));\n\t} catch {\n\t\tthrow new Error('Invalid JWT: invalid payload encoding');\n\t}\n\n\tif (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {\n\t\tthrow new Error('Invalid JWT: payload is not an object');\n\t}\n\n\treturn payload as Record<string, unknown>;\n};\n","export const logStarter = (...rest: string[]) =>\n\tconsole.log('\\x1b[36m%s\\x1b[0m', 'provenance:', ...rest);\n","/**\n * only allow same-origin relative paths as redirect targets, guarding against\n * open redirects like `/login?referrer=https://evil.com` (or protocol-relative\n * `//evil.com` and backslash `/\\evil.com` variants)\n * @param referrer untrusted referrer (from url search params or oauth state)\n * @returns the referrer if it is a safe relative path, otherwise null\n */\nexport const sanitizeReferrer = (referrer: string | null | undefined): string | null => {\n\tif (!referrer) {\n\t\treturn null;\n\t}\n\n\tif (!referrer.startsWith('/') || referrer.startsWith('//') || referrer.startsWith('/\\\\')) {\n\t\treturn null;\n\t}\n\n\treturn referrer;\n};\n","import { logStarter } from '../helpers';\nimport type { Resolver } from './types';\n\nexport const localsResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (logging) logStarter('locals');\n\n\t\tlet session: Session | null;\n\t\ttry {\n\t\t\tsession = context.session.getCookie();\n\t\t} catch (e) {\n\t\t\t// possibly need to redirect to an auth error page\n\t\t\tconsole.error('provenance:', e);\n\n\t\t\tcontext.session.deleteCookie();\n\t\t\tsession = null;\n\t\t}\n\n\t\tcontext.locals.session = session;\n\t\treturn await resolve();\n\t};\n","import { logStarter, sanitizeReferrer } from '../helpers';\nimport type { Resolver } from './types';\n\nexport const loginResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (context.routes.login.is) {\n\t\t\tconst session = context.locals.session;\n\t\t\tconst referrer = sanitizeReferrer(context.oauth.referrer);\n\n\t\t\tif (session === null) {\n\t\t\t\tif (logging) logStarter('login');\n\n\t\t\t\tawait context.oauth.redirectLogin(referrer);\n\t\t\t} else {\n\t\t\t\treturn referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();\n\t\t\t}\n\t\t}\n\t\treturn await resolve();\n\t};\n","import { logStarter, sanitizeReferrer } from '../helpers';\nimport { Resolver } from './types';\n\nexport const logoutResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (context.routes.logout.is) {\n\t\t\tconst session = context.locals.session;\n\t\t\tconst referrer = sanitizeReferrer(context.oauth.referrer);\n\n\t\t\tif (session !== null) {\n\t\t\t\tif (logging) logStarter('logout');\n\n\t\t\t\tcontext.session.deleteCookie();\n\t\t\t\tcontext.locals.session = null;\n\t\t\t}\n\n\t\t\treturn referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();\n\t\t}\n\t\treturn await resolve();\n\t};\n","import { logStarter, sanitizeReferrer } from '../helpers';\nimport { Resolver } from './types';\n\nexport const redirectUriResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (context.routes.redirectUri.is) {\n\t\t\tif (logging) logStarter('redirectUri');\n\n\t\t\tlet referrer: string | undefined = undefined;\n\t\t\ttry {\n\t\t\t\t// state stored at beginning of authorization flow (right before login redirects to auth server)\n\t\t\t\tconst expectedState = context.checks.state.use();\n\n\t\t\t\t// nonce and code verifier stored at beginning of authorization flow (right before login redirects to auth server)\n\t\t\t\tconst codeVerifier = context.checks.pkce.use();\n\n\t\t\t\t// matching state allows this route to ensure the redirect from auth server originated from this application\n\t\t\t\t// the code returned (in url params) to this redirect uri will be used to get a token set from the oauth2 token endpoint\n\t\t\t\tconst { code, state } = context.oauth.processAuthResponse(expectedState);\n\n\t\t\t\t// set referrer, if available, for redirect\n\t\t\t\treferrer = sanitizeReferrer(state.referrer) ?? undefined;\n\n\t\t\t\t// make a request for tokens using the code and the matching code verifier\n\t\t\t\t// code verifier is required by the auth server to ensure the code matches the originator of the auth request\n\t\t\t\t// nonce allows this application to ensure that the tokens returned came from the same auth server that the code grant request was initiated with, similar to state\n\t\t\t\tconst tokens = await context.oauth.requestToken(codeVerifier, code);\n\n\t\t\t\t// turn the returned tokens into the session (including user, access token, refresh token)\n\t\t\t\tconst session = context.session.create(tokens);\n\t\t\t\tcontext.session.deleteCookie();\n\t\t\t\tcontext.session.setCookie(session);\n\t\t\t} catch (e) {\n\t\t\t\t// possibly need to redirect to an auth error page\n\t\t\t\tconsole.error('provenance:', e);\n\t\t\t}\n\n\t\t\tif (referrer) {\n\t\t\t\t// redirect to the actual route that the user was trying to access\n\t\t\t\tcontext.routes.redirect(referrer);\n\t\t\t} else {\n\t\t\t\t// if any of these checks throw an error (login took longer than the cookies were available), we should try the whole process again\n\t\t\t\t// also if somehow no referrer was set in the state\n\t\t\t\tcontext.routes.home.redirect();\n\t\t\t}\n\t\t}\n\t\treturn await resolve();\n\t};\n","import { logStarter } from '../helpers';\nimport { Resolver } from './types';\n\nexport const refreshResolver = <\n\tSession extends {\n\t\trefreshToken: string;\n\t\taccessExpiresAt: number;\n\t\trefreshExpiresAt?: number;\n\t}\n>(options: {\n\t/** in ms */\n\teagerRefresh: number;\n}): Resolver<Session> => {\n\treturn async (context, resolve, logging) => {\n\t\tconst session = context.locals.session;\n\n\t\t// attempt refresh if there is a session and the access token expires within the \"eagerRefresh\" threshold\n\t\tif (session !== null && Date.now() >= session.accessExpiresAt - options.eagerRefresh) {\n\t\t\tif (logging) logStarter('refresh');\n\n\t\t\tconst destroySession = () => {\n\t\t\t\tcontext.session.deleteCookie();\n\t\t\t\tcontext.locals.session = null;\n\t\t\t};\n\n\t\t\t// don't bother trying to refresh if your session has an expired refresh token\n\t\t\t// in practice, this should be true as the session cookie should expire at the same time as the refresh token\n\t\t\tif (session.refreshExpiresAt === undefined || Date.now() < session.refreshExpiresAt) {\n\t\t\t\ttry {\n\t\t\t\t\t// the access token has expired, so refresh with the refresh token\n\t\t\t\t\tconst newTokens = await context.oauth.refresh(session.refreshToken);\n\t\t\t\t\tconst newSession = context.session.create(newTokens);\n\n\t\t\t\t\tdestroySession();\n\t\t\t\t\tcontext.session.setCookie(newSession);\n\t\t\t\t\tcontext.locals.session = newSession;\n\t\t\t\t} catch (e) {\n\t\t\t\t\t// destroy the session if an error occurs (likely in the oauth refresh flow)\n\t\t\t\t\tconsole.error('provenance:', e);\n\t\t\t\t\tdestroySession();\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tdestroySession();\n\t\t\t}\n\t\t}\n\t\treturn await resolve();\n\t};\n};\n","import { logStarter, sanitizeReferrer } from '../helpers';\nimport type { Resolver } from './types';\n\nexport const signupResolver =\n\t<Session>(): Resolver<Session> =>\n\tasync (context, resolve, logging) => {\n\t\tif (context.routes.signup.is) {\n\t\t\tconst session = context.locals.session;\n\t\t\tconst referrer = sanitizeReferrer(context.oauth.referrer);\n\n\t\t\tif (session === null) {\n\t\t\t\tif (logging) logStarter('signup');\n\n\t\t\t\tawait context.oauth.redirectSignup(referrer);\n\t\t\t} else {\n\t\t\t\treturn referrer ? context.routes.redirect(referrer) : context.routes.home.redirect();\n\t\t\t}\n\t\t}\n\t\treturn await resolve();\n\t};\n","import {\n\ttype Resolver,\n\tlocalsResolver,\n\tloginResolver,\n\tlogoutResolver,\n\tredirectUriResolver,\n\tsignupResolver\n} from '../resolvers';\n\nimport {\n\tAuthServerConfiguration,\n\tEndpointsConfiguration,\n\tProvider,\n\tSessionConfiguration\n} from './types';\n\nconst DEFAULT_SESSION_COOKIE_AGE = 60 * 10;\n\n/**\n * create a generic provider with auth server configuration, endpoints, and session definition\n *\n * see [github](github.ts) and [keycloak](keycloak.ts) for examples\n */\nexport const provider = <Session extends object>(\n\tauthServer: AuthServerConfiguration,\n\tendpoints: EndpointsConfiguration<Session>,\n\tsession: Pick<SessionConfiguration<Session>, 'transformTokens'> &\n\t\tPartial<SessionConfiguration<Session>>,\n\tresolvers?: Resolver<Session>[]\n): Provider<Session> => {\n\treturn {\n\t\tauthServer,\n\t\tendpoints,\n\t\tsession: {\n\t\t\ttransformTokens: session.transformTokens,\n\t\t\tvalidateSession: session.validateSession || ((session) => session),\n\t\t\tsessionCookieAge: session.sessionCookieAge || (() => DEFAULT_SESSION_COOKIE_AGE),\n\t\t\tfixSession: session.fixSession || ((session) => session)\n\t\t},\n\t\tresolvers: resolvers || [\n\t\t\tredirectUriResolver(),\n\t\t\tlocalsResolver(),\n\t\t\tloginResolver(),\n\t\t\tsignupResolver(),\n\t\t\tlogoutResolver()\n\t\t]\n\t};\n};\n","import type { TokenRequestResult } from '../tokens';\n\nimport type { CreateProvider, EndpointsConfiguration } from './types';\nimport { provider } from './provider';\n\n/**\n * find configuration in github > developer settings > OAuth Apps > application\n */\nexport type GithubConfiguration = {\n\tclientId: string;\n\tclientSecret: string;\n\tscopes: string[];\n};\n\ntype GithubSession = {\n\taccessToken: string;\n};\n\nconst issuer = 'https://github.com/login/oauth/';\n\nexport const github: CreateProvider<GithubConfiguration, GithubSession> = (\n\tconfiguration,\n\tcallbacks\n) => {\n\tconst authServer = {\n\t\tissuer: issuer,\n\t\tclientId: configuration.clientId,\n\t\tclientSecret: configuration.clientSecret,\n\t\topenid: false\n\t};\n\tconst endpoints: EndpointsConfiguration<GithubSession> = {\n\t\tcreateLoginUrl(redirectUri, checks) {\n\t\t\tconst url = new URL(`authorize`, issuer);\n\t\t\turl.searchParams.append('client_id', configuration.clientId);\n\t\t\turl.searchParams.append('redirect_uri', redirectUri);\n\t\t\turl.searchParams.append('state', checks.state);\n\t\t\turl.searchParams.append('allow_signup', 'false');\n\t\t\turl.searchParams.append('scope', configuration.scopes.join(' '));\n\n\t\t\treturn url;\n\t\t},\n\t\tcreateSignupUrl(redirectUri, checks) {\n\t\t\tconst url = new URL(`authorize`, issuer);\n\t\t\turl.searchParams.append('client_id', configuration.clientId);\n\t\t\turl.searchParams.append('redirect_uri', redirectUri);\n\t\t\turl.searchParams.append('state', checks.state);\n\t\t\turl.searchParams.append('allow_signup', 'true');\n\t\t\turl.searchParams.append('scope', configuration.scopes.join(' '));\n\n\t\t\treturn url;\n\t\t},\n\t\tcreateLogoutUrl(_session) {\n\t\t\treturn { url: new URL(`logout`, issuer) };\n\t\t},\n\t\tcreateTokenUrl() {\n\t\t\treturn new URL(`access_token`, issuer);\n\t\t},\n\t\tcreateUserinfoUrl() {\n\t\t\treturn new URL(`userinfo`, issuer);\n\t\t}\n\t};\n\n\tconst session = {\n\t\ttransformTokens: (tokens: TokenRequestResult) => {\n\t\t\treturn {\n\t\t\t\taccessToken: tokens.accessToken()\n\t\t\t};\n\t\t},\n\t\tvalidateSession: <T extends GithubSession>(session: T) => {\n\t\t\tif (typeof session.accessToken !== 'string') {\n\t\t\t\tthrow new Error('Session accessToken is not valid');\n\t\t\t}\n\t\t\treturn session;\n\t\t},\n\t\tfixSession: callbacks?.fixSession,\n\t\tsessionCookieAge: callbacks?.sessionCookieAge\n\t};\n\n\treturn provider(authServer, endpoints, session);\n};\n","import type { TokenRequestResult } from '../tokens';\n\nimport {\n\ttype Resolver,\n\tlocalsResolver,\n\tloginResolver,\n\tlogoutResolver,\n\tredirectUriResolver,\n\trefreshResolver,\n\tsignupResolver\n} from '../resolvers';\n\nimport { decodeJWTPayload } from '../helpers/jwt';\n\nimport { provider } from './provider';\nimport type { CreateProvider, EndpointsConfiguration } from './types';\n\nexport type KeycloakConfiguration = {\n\t/** like https://auth-server.com/ (don't include \"realms\", \"protocol\", etc.) */\n\tbase: string;\n\t/** realm corresponding to users of this application (multi-tenant is currently not supported) */\n\trealm: string;\n\t/** client id corresponding to this application */\n\tclientId: string;\n\t/** client secret corresponding to this application (can be any empty string if not being used for the client) */\n\tclientSecret: string;\n\toptions: {\n\t\t/**\n\t\t * a ms adjustment to access token expiry, based upon which a server request will trigger or not trigger a token set refresh\n\t\t *\n\t\t * at 0 (default), refresh only access tokens that have expired\n\t\t *\n\t\t * at infinity, refresh on every request\n\t\t */\n\t\teagerRefresh?: number;\n\t};\n\tscopes: string[];\n};\n\ntype KeycloakSession = {\n\taccessToken: string;\n\trefreshToken: string;\n\tidToken: string;\n\trefreshExpiresAt: number;\n\taccessExpiresAt: number;\n\ttokenType: string;\n};\n\nexport const keycloak: CreateProvider<KeycloakConfiguration, KeycloakSession> = (\n\tconfiguration,\n\tcallbacks\n) => {\n\tconst defaultedOptions = {\n\t\teagerRefresh: 0,\n\t\t...configuration.options\n\t};\n\n\tconst authServer = {\n\t\tissuer: new URL(`/realms/${configuration.realm}`, configuration.base).toString(),\n\t\tclientId: configuration.clientId,\n\t\tclientSecret: configuration.clientSecret,\n\t\topenid: true\n\t};\n\tconst endpoints: EndpointsConfiguration<KeycloakSession> = {\n\t\tcreateLoginUrl(redirectUri, checks) {\n\t\t\tconst url = new URL(\n\t\t\t\t`/realms/${configuration.realm}/protocol/openid-connect/auth`,\n\t\t\t\tconfiguration.base\n\t\t\t);\n\t\t\turl.searchParams.append('client_id', configuration.clientId);\n\t\t\turl.searchParams.append('redirect_uri', redirectUri);\n\t\t\turl.searchParams.append('response_type', 'code');\n\t\t\turl.searchParams.append('response_mode', 'query');\n\t\t\turl.searchParams.append('state', checks.state);\n\t\t\turl.searchParams.append('code_challenge', checks.codeChallenge);\n\t\t\turl.searchParams.append('code_challenge_method', 'S256');\n\t\t\turl.searchParams.append('scope', configuration.scopes.join(' '));\n\n\t\t\treturn url;\n\t\t},\n\t\tcreateSignupUrl(redirectUri, checks) {\n\t\t\tconst url = new URL(\n\t\t\t\t`/realms/${configuration.realm}/protocol/openid-connect/registrations`,\n\t\t\t\tconfiguration.base\n\t\t\t);\n\t\t\turl.searchParams.append('client_id', configuration.clientId);\n\t\t\turl.searchParams.append('redirect_uri', redirectUri);\n\t\t\turl.searchParams.append('response_type', 'code');\n\t\t\turl.searchParams.append('response_mode', 'query');\n\t\t\turl.searchParams.append('state', checks.state);\n\t\t\turl.searchParams.append('code_challenge', checks.codeChallenge);\n\t\t\turl.searchParams.append('code_challenge_method', 'S256');\n\t\t\turl.searchParams.append('scope', configuration.scopes.join(' '));\n\n\t\t\treturn url;\n\t\t},\n\t\tcreateLogoutUrl: (session) => {\n\t\t\tconst id_token_hint = session.idToken;\n\t\t\treturn {\n\t\t\t\turl: new URL(\n\t\t\t\t\t`/realms/${configuration.realm}/protocol/openid-connect/logout`,\n\t\t\t\t\tconfiguration.base\n\t\t\t\t),\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tid_token_hint\n\t\t\t\t})\n\t\t\t};\n\t\t},\n\t\tcreateTokenUrl: () =>\n\t\t\tnew URL(`/realms/${configuration.realm}/protocol/openid-connect/token`, configuration.base),\n\t\tcreateUserinfoUrl: () =>\n\t\t\tnew URL(`/realms/${configuration.realm}/protocol/openid-connect/userinfo`, configuration.base)\n\t};\n\n\tconst session = {\n\t\ttransformTokens: (tokens: TokenRequestResult) => {\n\t\t\tconst { id_token, refresh_expires_in } = tokens.body as {\n\t\t\t\tid_token: string;\n\t\t\t\trefresh_expires_in: string;\n\t\t\t};\n\n\t\t\tif (!id_token) {\n\t\t\t\tthrow new Error(`tokens response does not include 'id_token'`);\n\t\t\t}\n\n\t\t\tif (!tokens.accessTokenExpiresAt()) {\n\t\t\t\tthrow new Error(`tokens response does not include 'expires_in'`);\n\t\t\t}\n\n\t\t\tif (!tokens.refreshToken()) {\n\t\t\t\tthrow new Error(`tokens response does not include 'refresh_token'`);\n\t\t\t}\n\n\t\t\tif (!refresh_expires_in) {\n\t\t\t\tthrow new Error(`tokens response does not include 'refresh_expires_in'`);\n\t\t\t}\n\n\t\t\tconst refreshExpiresInSeconds = parseInt(refresh_expires_in);\n\n\t\t\treturn {\n\t\t\t\tidToken: id_token,\n\t\t\t\taccessToken: tokens.accessToken(),\n\t\t\t\trefreshToken: tokens.refreshToken(),\n\t\t\t\trefreshExpiresAt: Date.now() + refreshExpiresInSeconds * 1000,\n\t\t\t\taccessExpiresAt: tokens.accessTokenExpiresAt().getTime(),\n\t\t\t\ttokenType: tokens.tokenType()\n\t\t\t};\n\t\t},\n\t\tvalidateSession: <T extends KeycloakSession>(session: T) => {\n\t\t\tif (typeof session.idToken !== 'string') {\n\t\t\t\tthrow new Error('Session idToken is not valid');\n\t\t\t}\n\t\t\tif (typeof session.accessToken !== 'string') {\n\t\t\t\tthrow new Error('Session accessToken is not valid');\n\t\t\t}\n\t\t\tif (typeof session.refreshToken !== 'string') {\n\t\t\t\tthrow new Error('Session refreshToken is not valid');\n\t\t\t}\n\n\t\t\tif (decodeJWTPayload(session.idToken).iss !== authServer.issuer) {\n\t\t\t\tthrow new Error('Session idToken issuer mismatch');\n\t\t\t}\n\t\t\tif (decodeJWTPayload(session.accessToken).iss !== authServer.issuer) {\n\t\t\t\tthrow new Error('Session accessToken issuer mismatch');\n\t\t\t}\n\t\t\tif (decodeJWTPayload(session.refreshToken).iss !== authServer.issuer) {\n\t\t\t\tthrow new Error('Session refreshToken issuer mismatch');\n\t\t\t}\n\n\t\t\tif (typeof session.accessExpiresAt !== 'number' || session.accessExpiresAt < 0) {\n\t\t\t\tthrow new Error('Session accessExpiresAt is not valid');\n\t\t\t}\n\t\t\tif (typeof session.refreshExpiresAt !== 'number' || session.refreshExpiresAt < 0) {\n\t\t\t\tthrow new Error('Session refreshExpiresAt is not valid');\n\t\t\t}\n\t\t\tif (session.tokenType !== 'Bearer') {\n\t\t\t\tthrow new Error('Session tokenType is not \"Bearer\" type');\n\t\t\t}\n\n\t\t\treturn session;\n\t\t},\n\t\tfixSession: callbacks?.fixSession,\n\t\tsessionCookieAge:\n\t\t\tcallbacks?.sessionCookieAge ||\n\t\t\t((session) => Math.floor((session.refreshExpiresAt - Date.now()) / 1000))\n\t};\n\n\tconst resolvers: Resolver<KeycloakSession>[] = [\n\t\tredirectUriResolver(),\n\t\tlocalsResolver(),\n\t\tloginResolver(),\n\t\tsignupResolver(),\n\t\tasync (context, resolve) => {\n\t\t\tif (context.routes.logout.is && context.locals.session) {\n\t\t\t\tawait context.oauth.preLogout(context.locals.session);\n\t\t\t}\n\t\t\treturn await resolve();\n\t\t},\n\t\tlogoutResolver(),\n\t\trefreshResolver({ eagerRefresh: defaultedOptions.eagerRefresh })\n\t];\n\n\treturn provider(authServer, endpoints, session, resolvers);\n};\n"],"mappings":";AAQA,IAAM,gBAAgB,CAAC,WAAmB;AACzC,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACvC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAC/B;AACA,SAAO;AACR;AAIO,IAAM,eAAe,CAAC,SAAiB,cAAc,KAAK,IAAI,CAAC;AAK/D,IAAM,+BAA+B,CAAC,SAAiB;AAC7D,QAAM,SAAS,KAAK,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E,SAAO,aAAa,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC;AACzE;;;ACnBO,IAAM,mBAAmB,CAAC,QAAyC;AACzE,QAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,MAAI,MAAM,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,aAAa;AAAA,EAC9B;AAEA,MAAI;AACJ,MAAI;AACH,cAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,6BAA6B,MAAM,CAAC,CAAC,CAAC,CAAC;AAAA,EACtF,QAAQ;AACP,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACxD;AAEA,MAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAAG;AAC9E,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACxD;AAEA,SAAO;AACR;;;ACzBO,IAAM,aAAa,IAAI,SAC7B,QAAQ,IAAI,qBAAqB,eAAe,GAAG,IAAI;;;ACMjD,IAAM,mBAAmB,CAAC,aAAuD;AACvF,MAAI,CAAC,UAAU;AACd,WAAO;AAAA,EACR;AAEA,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,IAAI,KAAK,SAAS,WAAW,KAAK,GAAG;AACzF,WAAO;AAAA,EACR;AAEA,SAAO;AACR;;;ACdO,IAAM,iBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAS,YAAW,QAAQ;AAEhC,MAAI;AACJ,MAAI;AACH,cAAU,QAAQ,QAAQ,UAAU;AAAA,EACrC,SAAS,GAAG;AAEX,YAAQ,MAAM,eAAe,CAAC;AAE9B,YAAQ,QAAQ,aAAa;AAC7B,cAAU;AAAA,EACX;AAEA,UAAQ,OAAO,UAAU;AACzB,SAAO,MAAM,QAAQ;AACtB;;;AClBM,IAAM,gBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAQ,OAAO,MAAM,IAAI;AAC5B,UAAM,UAAU,QAAQ,OAAO;AAC/B,UAAM,WAAW,iBAAiB,QAAQ,MAAM,QAAQ;AAExD,QAAI,YAAY,MAAM;AACrB,UAAI,QAAS,YAAW,OAAO;AAE/B,YAAM,QAAQ,MAAM,cAAc,QAAQ;AAAA,IAC3C,OAAO;AACN,aAAO,WAAW,QAAQ,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,KAAK,SAAS;AAAA,IACpF;AAAA,EACD;AACA,SAAO,MAAM,QAAQ;AACtB;;;AChBM,IAAM,iBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAQ,OAAO,OAAO,IAAI;AAC7B,UAAM,UAAU,QAAQ,OAAO;AAC/B,UAAM,WAAW,iBAAiB,QAAQ,MAAM,QAAQ;AAExD,QAAI,YAAY,MAAM;AACrB,UAAI,QAAS,YAAW,QAAQ;AAEhC,cAAQ,QAAQ,aAAa;AAC7B,cAAQ,OAAO,UAAU;AAAA,IAC1B;AAEA,WAAO,WAAW,QAAQ,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,KAAK,SAAS;AAAA,EACpF;AACA,SAAO,MAAM,QAAQ;AACtB;;;ACjBM,IAAM,sBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAQ,OAAO,YAAY,IAAI;AAClC,QAAI,QAAS,YAAW,aAAa;AAErC,QAAI,WAA+B;AACnC,QAAI;AAEH,YAAM,gBAAgB,QAAQ,OAAO,MAAM,IAAI;AAG/C,YAAM,eAAe,QAAQ,OAAO,KAAK,IAAI;AAI7C,YAAM,EAAE,MAAM,MAAM,IAAI,QAAQ,MAAM,oBAAoB,aAAa;AAGvE,iBAAW,iBAAiB,MAAM,QAAQ,KAAK;AAK/C,YAAM,SAAS,MAAM,QAAQ,MAAM,aAAa,cAAc,IAAI;AAGlE,YAAM,UAAU,QAAQ,QAAQ,OAAO,MAAM;AAC7C,cAAQ,QAAQ,aAAa;AAC7B,cAAQ,QAAQ,UAAU,OAAO;AAAA,IAClC,SAAS,GAAG;AAEX,cAAQ,MAAM,eAAe,CAAC;AAAA,IAC/B;AAEA,QAAI,UAAU;AAEb,cAAQ,OAAO,SAAS,QAAQ;AAAA,IACjC,OAAO;AAGN,cAAQ,OAAO,KAAK,SAAS;AAAA,IAC9B;AAAA,EACD;AACA,SAAO,MAAM,QAAQ;AACtB;;;AC7CM,IAAM,kBAAkB,CAM7B,YAGuB;AACxB,SAAO,OAAO,SAAS,SAAS,YAAY;AAC3C,UAAM,UAAU,QAAQ,OAAO;AAG/B,QAAI,YAAY,QAAQ,KAAK,IAAI,KAAK,QAAQ,kBAAkB,QAAQ,cAAc;AACrF,UAAI,QAAS,YAAW,SAAS;AAEjC,YAAM,iBAAiB,MAAM;AAC5B,gBAAQ,QAAQ,aAAa;AAC7B,gBAAQ,OAAO,UAAU;AAAA,MAC1B;AAIA,UAAI,QAAQ,qBAAqB,UAAa,KAAK,IAAI,IAAI,QAAQ,kBAAkB;AACpF,YAAI;AAEH,gBAAM,YAAY,MAAM,QAAQ,MAAM,QAAQ,QAAQ,YAAY;AAClE,gBAAM,aAAa,QAAQ,QAAQ,OAAO,SAAS;AAEnD,yBAAe;AACf,kBAAQ,QAAQ,UAAU,UAAU;AACpC,kBAAQ,OAAO,UAAU;AAAA,QAC1B,SAAS,GAAG;AAEX,kBAAQ,MAAM,eAAe,CAAC;AAC9B,yBAAe;AAAA,QAChB;AAAA,MACD,OAAO;AACN,uBAAe;AAAA,MAChB;AAAA,IACD;AACA,WAAO,MAAM,QAAQ;AAAA,EACtB;AACD;;;AC5CO,IAAM,iBACZ,MACA,OAAO,SAAS,SAAS,YAAY;AACpC,MAAI,QAAQ,OAAO,OAAO,IAAI;AAC7B,UAAM,UAAU,QAAQ,OAAO;AAC/B,UAAM,WAAW,iBAAiB,QAAQ,MAAM,QAAQ;AAExD,QAAI,YAAY,MAAM;AACrB,UAAI,QAAS,YAAW,QAAQ;AAEhC,YAAM,QAAQ,MAAM,eAAe,QAAQ;AAAA,IAC5C,OAAO;AACN,aAAO,WAAW,QAAQ,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,KAAK,SAAS;AAAA,IACpF;AAAA,EACD;AACA,SAAO,MAAM,QAAQ;AACtB;;;ACHD,IAAM,6BAA6B,KAAK;AAOjC,IAAM,WAAW,CACvB,YACA,WACA,SAEA,cACuB;AACvB,SAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,SAAS;AAAA,MACR,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB,QAAQ,oBAAoB,CAACA,aAAYA;AAAA,MAC1D,kBAAkB,QAAQ,qBAAqB,MAAM;AAAA,MACrD,YAAY,QAAQ,eAAe,CAACA,aAAYA;AAAA,IACjD;AAAA,IACA,WAAW,aAAa;AAAA,MACvB,oBAAoB;AAAA,MACpB,eAAe;AAAA,MACf,cAAc;AAAA,MACd,eAAe;AAAA,MACf,eAAe;AAAA,IAChB;AAAA,EACD;AACD;;;AC7BA,IAAM,SAAS;AAER,IAAM,SAA6D,CACzE,eACA,cACI;AACJ,QAAM,aAAa;AAAA,IAClB;AAAA,IACA,UAAU,cAAc;AAAA,IACxB,cAAc,cAAc;AAAA,IAC5B,QAAQ;AAAA,EACT;AACA,QAAM,YAAmD;AAAA,IACxD,eAAe,aAAa,QAAQ;AACnC,YAAM,MAAM,IAAI,IAAI,aAAa,MAAM;AACvC,UAAI,aAAa,OAAO,aAAa,cAAc,QAAQ;AAC3D,UAAI,aAAa,OAAO,gBAAgB,WAAW;AACnD,UAAI,aAAa,OAAO,SAAS,OAAO,KAAK;AAC7C,UAAI,aAAa,OAAO,gBAAgB,OAAO;AAC/C,UAAI,aAAa,OAAO,SAAS,cAAc,OAAO,KAAK,GAAG,CAAC;AAE/D,aAAO;AAAA,IACR;AAAA,IACA,gBAAgB,aAAa,QAAQ;AACpC,YAAM,MAAM,IAAI,IAAI,aAAa,MAAM;AACvC,UAAI,aAAa,OAAO,aAAa,cAAc,QAAQ;AAC3D,UAAI,aAAa,OAAO,gBAAgB,WAAW;AACnD,UAAI,aAAa,OAAO,SAAS,OAAO,KAAK;AAC7C,UAAI,aAAa,OAAO,gBAAgB,MAAM;AAC9C,UAAI,aAAa,OAAO,SAAS,cAAc,OAAO,KAAK,GAAG,CAAC;AAE/D,aAAO;AAAA,IACR;AAAA,IACA,gBAAgB,UAAU;AACzB,aAAO,EAAE,KAAK,IAAI,IAAI,UAAU,MAAM,EAAE;AAAA,IACzC;AAAA,IACA,iBAAiB;AAChB,aAAO,IAAI,IAAI,gBAAgB,MAAM;AAAA,IACtC;AAAA,IACA,oBAAoB;AACnB,aAAO,IAAI,IAAI,YAAY,MAAM;AAAA,IAClC;AAAA,EACD;AAEA,QAAM,UAAU;AAAA,IACf,iBAAiB,CAAC,WAA+B;AAChD,aAAO;AAAA,QACN,aAAa,OAAO,YAAY;AAAA,MACjC;AAAA,IACD;AAAA,IACA,iBAAiB,CAA0BC,aAAe;AACzD,UAAI,OAAOA,SAAQ,gBAAgB,UAAU;AAC5C,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACnD;AACA,aAAOA;AAAA,IACR;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,kBAAkB,WAAW;AAAA,EAC9B;AAEA,SAAO,SAAS,YAAY,WAAW,OAAO;AAC/C;;;AC/BO,IAAM,WAAmE,CAC/E,eACA,cACI;AACJ,QAAM,mBAAmB;AAAA,IACxB,cAAc;AAAA,IACd,GAAG,cAAc;AAAA,EAClB;AAEA,QAAM,aAAa;AAAA,IAClB,QAAQ,IAAI,IAAI,WAAW,cAAc,KAAK,IAAI,cAAc,IAAI,EAAE,SAAS;AAAA,IAC/E,UAAU,cAAc;AAAA,IACxB,cAAc,cAAc;AAAA,IAC5B,QAAQ;AAAA,EACT;AACA,QAAM,YAAqD;AAAA,IAC1D,eAAe,aAAa,QAAQ;AACnC,YAAM,MAAM,IAAI;AAAA,QACf,WAAW,cAAc,KAAK;AAAA,QAC9B,cAAc;AAAA,MACf;AACA,UAAI,aAAa,OAAO,aAAa,cAAc,QAAQ;AAC3D,UAAI,aAAa,OAAO,gBAAgB,WAAW;AACnD,UAAI,aAAa,OAAO,iBAAiB,MAAM;AAC/C,UAAI,aAAa,OAAO,iBAAiB,OAAO;AAChD,UAAI,aAAa,OAAO,SAAS,OAAO,KAAK;AAC7C,UAAI,aAAa,OAAO,kBAAkB,OAAO,aAAa;AAC9D,UAAI,aAAa,OAAO,yBAAyB,MAAM;AACvD,UAAI,aAAa,OAAO,SAAS,cAAc,OAAO,KAAK,GAAG,CAAC;AAE/D,aAAO;AAAA,IACR;AAAA,IACA,gBAAgB,aAAa,QAAQ;AACpC,YAAM,MAAM,IAAI;AAAA,QACf,WAAW,cAAc,KAAK;AAAA,QAC9B,cAAc;AAAA,MACf;AACA,UAAI,aAAa,OAAO,aAAa,cAAc,QAAQ;AAC3D,UAAI,aAAa,OAAO,gBAAgB,WAAW;AACnD,UAAI,aAAa,OAAO,iBAAiB,MAAM;AAC/C,UAAI,aAAa,OAAO,iBAAiB,OAAO;AAChD,UAAI,aAAa,OAAO,SAAS,OAAO,KAAK;AAC7C,UAAI,aAAa,OAAO,kBAAkB,OAAO,aAAa;AAC9D,UAAI,aAAa,OAAO,yBAAyB,MAAM;AACvD,UAAI,aAAa,OAAO,SAAS,cAAc,OAAO,KAAK,GAAG,CAAC;AAE/D,aAAO;AAAA,IACR;AAAA,IACA,iBAAiB,CAACC,aAAY;AAC7B,YAAM,gBAAgBA,SAAQ;AAC9B,aAAO;AAAA,QACN,KAAK,IAAI;AAAA,UACR,WAAW,cAAc,KAAK;AAAA,UAC9B,cAAc;AAAA,QACf;AAAA,QACA,MAAM,IAAI,gBAAgB;AAAA,UACzB;AAAA,QACD,CAAC;AAAA,MACF;AAAA,IACD;AAAA,IACA,gBAAgB,MACf,IAAI,IAAI,WAAW,cAAc,KAAK,kCAAkC,cAAc,IAAI;AAAA,IAC3F,mBAAmB,MAClB,IAAI,IAAI,WAAW,cAAc,KAAK,qCAAqC,cAAc,IAAI;AAAA,EAC/F;AAEA,QAAM,UAAU;AAAA,IACf,iBAAiB,CAAC,WAA+B;AAChD,YAAM,EAAE,UAAU,mBAAmB,IAAI,OAAO;AAKhD,UAAI,CAAC,UAAU;AACd,cAAM,IAAI,MAAM,6CAA6C;AAAA,MAC9D;AAEA,UAAI,CAAC,OAAO,qBAAqB,GAAG;AACnC,cAAM,IAAI,MAAM,+CAA+C;AAAA,MAChE;AAEA,UAAI,CAAC,OAAO,aAAa,GAAG;AAC3B,cAAM,IAAI,MAAM,kDAAkD;AAAA,MACnE;AAEA,UAAI,CAAC,oBAAoB;AACxB,cAAM,IAAI,MAAM,uDAAuD;AAAA,MACxE;AAEA,YAAM,0BAA0B,SAAS,kBAAkB;AAE3D,aAAO;AAAA,QACN,SAAS;AAAA,QACT,aAAa,OAAO,YAAY;AAAA,QAChC,cAAc,OAAO,aAAa;AAAA,QAClC,kBAAkB,KAAK,IAAI,IAAI,0BAA0B;AAAA,QACzD,iBAAiB,OAAO,qBAAqB,EAAE,QAAQ;AAAA,QACvD,WAAW,OAAO,UAAU;AAAA,MAC7B;AAAA,IACD;AAAA,IACA,iBAAiB,CAA4BA,aAAe;AAC3D,UAAI,OAAOA,SAAQ,YAAY,UAAU;AACxC,cAAM,IAAI,MAAM,8BAA8B;AAAA,MAC/C;AACA,UAAI,OAAOA,SAAQ,gBAAgB,UAAU;AAC5C,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACnD;AACA,UAAI,OAAOA,SAAQ,iBAAiB,UAAU;AAC7C,cAAM,IAAI,MAAM,mCAAmC;AAAA,MACpD;AAEA,UAAI,iBAAiBA,SAAQ,OAAO,EAAE,QAAQ,WAAW,QAAQ;AAChE,cAAM,IAAI,MAAM,iCAAiC;AAAA,MAClD;AACA,UAAI,iBAAiBA,SAAQ,WAAW,EAAE,QAAQ,WAAW,QAAQ;AACpE,cAAM,IAAI,MAAM,qCAAqC;AAAA,MACtD;AACA,UAAI,iBAAiBA,SAAQ,YAAY,EAAE,QAAQ,WAAW,QAAQ;AACrE,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACvD;AAEA,UAAI,OAAOA,SAAQ,oBAAoB,YAAYA,SAAQ,kBAAkB,GAAG;AAC/E,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACvD;AACA,UAAI,OAAOA,SAAQ,qBAAqB,YAAYA,SAAQ,mBAAmB,GAAG;AACjF,cAAM,IAAI,MAAM,uCAAuC;AAAA,MACxD;AACA,UAAIA,SAAQ,cAAc,UAAU;AACnC,cAAM,IAAI,MAAM,wCAAwC;AAAA,MACzD;AAEA,aAAOA;AAAA,IACR;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,kBACC,WAAW,qBACV,CAACA,aAAY,KAAK,OAAOA,SAAQ,mBAAmB,KAAK,IAAI,KAAK,GAAI;AAAA,EACzE;AAEA,QAAM,YAAyC;AAAA,IAC9C,oBAAoB;AAAA,IACpB,eAAe;AAAA,IACf,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS,YAAY;AAC3B,UAAI,QAAQ,OAAO,OAAO,MAAM,QAAQ,OAAO,SAAS;AACvD,cAAM,QAAQ,MAAM,UAAU,QAAQ,OAAO,OAAO;AAAA,MACrD;AACA,aAAO,MAAM,QAAQ;AAAA,IACtB;AAAA,IACA,eAAe;AAAA,IACf,gBAAgB,EAAE,cAAc,iBAAiB,aAAa,CAAC;AAAA,EAChE;AAEA,SAAO,SAAS,YAAY,WAAW,SAAS,SAAS;AAC1D;","names":["session","session","session"]}

package/dist/vite/index.d.ts

@@ -0,0 +1,87 @@
+import { Plugin } from 'vite';
+
+declare const frameworks: readonly ["sveltekit"];
+type Framework = (typeof frameworks)[number];
+type BaseOptions = {
+    /**
+     * run any command after an update of some routes.
+     *
+     * @example
+     * ```ts
+     * 'npm exec prettier ./src/lib/server/PROVENANCE.ts -- -w'
+     * ```
+     */
+    postUpdateRun: string | undefined;
+    dir: string;
+    filename: string;
+    framework: Framework;
+};
+type TSOptions = BaseOptions & {
+    runtime: 'ts';
+};
+type JSOptions = BaseOptions & {
+    generateTypes: boolean;
+    runtime: 'js';
+};
+/**
+ * ### register this plugin in vite config
+ *
+ * `vite.config.[ts|js]`
+ * ```ts title="vite.config.[ts|js]"
+ *	import { sveltekit } from '@sveltejs/kit/vite';
+ *	import { provenance } from '@leaguebrain/provenance/vite';
+ *	import { defineConfig } from 'vite';
+
+ *	export default defineConfig({
+ *		plugins: [provenance(), sveltekit()]
+ *	});
+ * ```
+ *
+ * ### create an auth object that provides a handle hook and a function to protect routes
+ *
+ * `src/lib/server/auth.ts`
+ * ```ts title="src/lib/server/auth.ts"
+ *	import { provenance } from './PROVENANCE';
+ *	import { github } from '@leaguebrain/provenance/providers';
+ *
+ *	import { GH_CLIENT_ID, GH_CLIENT_SECRET } from '$env/static/private';
+ *
+ *	export const auth = provenance(
+ *		github({ clientId: GH_CLIENT_ID, clientSecret: GH_CLIENT_SECRET })
+ *	);
+ * ```
+ *
+ * ### register the handle provided by the auth object
+ *
+ * `src/hooks.server.ts`
+ * ```ts title="hooks.server.ts"
+ *	import { auth } from '$lib/server/auth';
+ *
+ *	export const handle = auth.handle;
+ * ```
+ *
+ * `handle` will programmatically create 3 routes:
+ * - `redirectUri` to handle redirects from the auth server as part of the oauth authorization flow
+ * - `login` to redirect the user to the proper oauth url when navigated
+ * - `logout` to destroy the oauth and cookie session when navigated
+ *
+ * other handle functionality will manage session cookies, provide session in locals, refresh an access token,
+ * and keep track of the last path to which the user navigated (for redirecting back to protected routes after authenticating)
+ *
+ * ### protect server routes in load functions
+ *
+ * `src/routes/protected/+page.server.ts`
+ * ```ts title="src/routes/protected/+page.server.ts"
+ *	import { auth } from '$lib/server/auth';
+ *	import { PageServerLoad } from './types'
+ *
+ *	export const load: PageServerLoad = async (event) => {
+ *		const session = await auth.protectRoute(event);
+ *	};
+ * ```
+ *
+ * `auth.protectRoute` can be awaited in `+page.server.ts` load functions to send the user to the login route if a session is required
+ */
+declare function provenance(o?: Partial<TSOptions | JSOptions>): Plugin[];
+
+export { type JSOptions, type TSOptions, provenance };