@logto/connector-github 1.5.1 → 1.7.0

package/README.md

@@ -1,63 +1,160 @@
 # Github connector
 
-The official Logto connector for GitHub social sign-in.
+Integrate GitHub OAuth app to enable Sign-in with GitHub, account linking, and secure access to GitHub APIs.
 
 **Table of contents**
 
 - [Github connector](#github-connector)
   - [Get started](#get-started)
-  - [Sign in with GitHub account](#sign-in-with-github-account)
-  - [Create and configure OAuth app](#create-and-configure-oauth-app)
-  - [Managing OAuth apps](#managing-oauth-apps)
-  - [Configure your connector](#configure-your-connector)
-    - [Config types](#config-types)
-  - [Test GitHub connector](#test-github-connector)
+  - [Step 1: Create an OAuth app on GitHub](#step-1-create-an-oauth-app-on-github)
+  - [Step 2: Configure your Logto connector](#step-2-configure-your-logto-connector)
+  - [Step 3: Configure scopes (Optional)](#step-3-configure-scopes-optional)
+  - [Step 4: General settings](#step-4-general-settings)
+  - [Step 5: Test your integration (Optional)](#step-5-test-your-integration-optional)
+  - [Utilize the GitHub connector](#utilize-the-github-connector)
+  - [Manage user's GitHub identity](#manage-users-github-identity)
   - [Reference](#reference)
 
 ## Get started
 
-The GitHub connector enables end-users to sign in to your application using their own GitHub accounts via GitHub OAuth 2.0 authentication protocol.
+The GitHub connector enables OAuth 2.0 integration to let your application:
 
-## Sign in with GitHub account
+- Add "Sign-in with GitHub" authentication
+- Link user accounts to GitHub identities
+- Sync user profile info from GitHub
+- Access GitHub APIs through secure token storage in Logto [Secret Vault](https://docs.logto.io/secret-vault/federated-token-set) for automation tasks (e.g., creating GitHub issues, managing repositories from your app)
 
-Go to the [GitHub website](https://github.com/) and sign in with your GitHub account. You may register a new account if you don't have one.
+## Step 1: Create an OAuth app on GitHub
 
-## Create and configure OAuth app
+Before you can use GitHub as an authentication provider, you must create an OAuth App on GitHub to obtain OAuth 2.0 credentials.
 
-Follow the [creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app) guide, and register a new application.
+1. Go to [GitHub](https://github.com/) and sign in with your account, or create a new account if needed.
+2. Navigate to [Settings > Developer settings > OAuth apps](https://github.com/settings/developers).
+3. Click **New OAuth App** to register a new application:
+   - **Application name**: Enter a descriptive name for your app.
+   - **Homepage URL**: Enter your application's homepage URL.
+   - **Authorization callback URL**: Copy the **Callback URI** from your Logto GitHub connector and paste it here. After users sign in with GitHub, they'll be redirected here with an authorization code that Logto uses to complete authentication.
+   - **Application description**: (Optional) Add a brief description of your app.
+4. Click **Register application** to create the OAuth App.
 
-Name your new OAuth application in **Application name** and fill up **Homepage URL** of the app.
-You can leave **Application description** field blank and customize **Authorization callback URL** as `${your_logto_origin}/callback/${connector_id}`. The `connector_id` can be found on the top bar of the Logto Admin Console connector details page.
+**Note**:
 
-> Note: If you encounter the error message "The redirect_uri MUST match the registered callback URL for this application." when logging in, try aligning the Authorization Callback URL of your GitHub OAuth App and your Logto App's redirect URL (of course, including the protocol) to resolve the issue.
+We suggest not checking the box for **Enable Device Flow**, as users who sign in with GitHub on mobile devices would need to confirm the initial sign-in action in the GitHub mobile app. Many GitHub users do not install the GitHub mobile app on their phones, which could block the sign-in flow. Only enable this if you expect end-users to confirm their sign-in flow through the GitHub mobile app. See details about [device flow](https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps#device-flow).
 
-We suggest not to check the box before **Enable Device Flow**, or users who sign in with GitHub on mobile devices must confirm the initial sign-in action in the GitHub app. Many GitHub users do not install the GitHub mobile app on their phones, which could block the sign-in flow. Please ignore our suggestion if you are expecting end-users to confirm their sign-in flow. See details of [device flow](https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps#device-flow).
+For more details on setting up GitHub OAuth Apps, see [Creating an OAuth App](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app).
 
-## Managing OAuth apps
+## Step 2: Configure your Logto connector
 
-Go to the [OAuth Apps page](https://github.com/settings/developers) and you can add, edit or delete existing OAuth apps.
-You can also find `Client ID` and generate `Client secrets` in OAuth app detail pages.
+After creating the OAuth app in GitHub, you'll be redirected to a details page where you can copy the Client ID and generate a Client secret.
 
-## Configure your connector
+1. Copy the **Client ID** from your GitHub OAuth app and paste it into the `clientId` field in Logto.
+2. Click **Generate a new client secret** in GitHub to create a new secret, then copy and paste it into the `clientSecret` field in Logto.
+3. Click **Save and Done** in Logto to connect your identity system with GitHub.
 
-Fill out the `clientId` and `clientSecret` field with _Client ID_ and _Client Secret_ you've got from OAuth app detail pages mentioned in the previous section.
+**Warning**: Keep your Client secret secure and never expose it in client-side code. GitHub client secrets cannot be recovered if lost - you'll need to generate a new one.
 
-`scope` is a space-delimited list of [scopes](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps). If not provided, scope defaults to be `read:user`.
+## Step 3: Configure scopes (Optional)
 
-### Config types
+Scopes define the permissions your app requests from users and control which data your app can access from their GitHub accounts.
 
-| Name         | Type   |
-|--------------|--------|
-| clientId     | string |
-| clientSecret | string |
-| scope        | string |
+Use the `Scopes` field in Logto to request extra permissions from GitHub. Choose one of the following approaches based on your needs:
 
+### Option 1: No extra API scopes needed
 
-## Test GitHub connector
+- Leave the `Scopes` field in your Logto GitHub connector blank.
+- The default scope `read:user` will be requested to ensure Logto can get basic user info (e.g., email, name, avatar) properly.
 
-That's it. The GitHub connector should be available now. Don't forget to [Enable connector in sign-in experience](https://docs.logto.io/docs/recipes/configure-connectors/social-connector/enable-social-sign-in/).
+### Option 2: Request additional scopes at sign-in
+
+- Browse all available [GitHub scopes for OAuth apps](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps) and add only the scopes your app needs.
+- Enter all desired scopes in the **Scopes** field, separated by spaces.
+- Any scopes you list here override the defaults, so always include the authentication scope: `read:user`.
+- Common additional scopes include:
+  - `repo`: Full control of private repositories
+  - `public_repo`: Access to public repositories
+  - `user:email`: Access to user email addresses
+  - `notifications`: Access to notifications
+- Ensure all scopes are spelled correctly and valid. An incorrect or unsupported scope will result in an "Invalid scope" error from GitHub.
+
+### Option 3: Request incremental scopes later
+
+- After the user signs in, you can [request additional scopes](https://docs.logto.io/secret-vault/federated-token-set#reauthentication-and-token-renewal) on demand by reinitiating a federated social authorization flow and updating users' stored token set.
+- These additional scopes do not need to be filled in the `Scopes` field in your Logto GitHub connector, and can be achieved through Logto's Social Verification API.
+
+By following these steps, your Logto GitHub connector requests exactly the permissions your app needs - no more, no less.
+
+**Tip**: If your app requests these scopes to access the GitHub API and perform actions, make sure to enable **Store tokens for persistent API access** in Logto GitHub connector. See the next section for details.
+
+## Step 4: General settings
+
+Here are some general settings that won't block the connection to GitHub but may affect the end-user authentication experience.
+
+### Sync profile information
+
+In the GitHub connector, you can set the policy for syncing profile information, such as user names and avatars. Choose from:
+
+- **Only sync at sign-up**: Profile info is fetched once when the user first signs in.
+- **Always sync at sign-in**: Profile info is updated every time the user signs in.
+
+### Store tokens to access GitHub APIs (Optional)
+
+If you want to access GitHub APIs and perform actions with user authorization (whether via social sign-in or account linking), Logto needs to get specific API scopes and store tokens.
+
+1. Add the required scopes following the instructions above.
+2. Enable **Store tokens for persistent API access** in the Logto GitHub connector. Logto will securely store GitHub access tokens in the [Secret Vault](https://docs.logto.io/secret-vault/federated-token-set).
+
+**Note**:
+
+When using a GitHub **OAuth App** as described in this tutorial, you cannot get a refresh token from GitHub because its access token does not expire unless the user manually revokes it. Therefore, you do not need to add `offline_access` in the `Scopes` field — doing so may cause an error.
+
+If you want the access token to expire or use refresh tokens, consider integrating with a **GitHub App** instead. Learn about the [differences between GitHub Apps and OAuth Apps](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps).
+
+## Step 5: Test your integration (Optional)
+
+Before going live, test your GitHub integration:
+
+1. Use the connector in a Logto development tenant.
+2. Verify that users can sign in with GitHub.
+3. Check that the correct scopes are being requested.
+4. Test API calls if you're storing tokens.
+
+GitHub OAuth Apps work with any GitHub user account immediately - there's no need for test users or app approval like some other platforms.
+
+## Utilize the GitHub connector
+
+Once you've created a GitHub connector and connected it to GitHub, you can incorporate it into your end-user flows. Choose the options that match your needs:
+
+### Enable "Sign-in with GitHub"
+
+1. In Logto Console, go to [Sign-in experience > Sign-up and sign-in](https://cloud.logto.io/to/sign-in-experience/sign-up-and-sign-in).
+2. Add the GitHub connector under **Social sign-in** section to let users authenticate with GitHub.
+
+Learn more about [social sign-in experience](https://docs.logto.io//end-user-flows/sign-up-and-sign-in/social-sign-in).
+
+### Link or unlink a GitHub account
+
+Use the Account API to build a custom Account Center in your app that lets signed-in users link or unlink their GitHub account. [Follow the Account API tutorial](https://docs.logto.io//end-user-flows/account-settings/by-account-api#link-a-new-social-connection)
+
+**Tip**: It's allowed to enable the GitHub connector only for account linking and API access, without enabling it for social sign-in.
+
+### Access GitHub APIs and perform actions
+
+Your application can retrieve stored GitHub access tokens from the Secret Vault to call GitHub APIs and automate backend tasks (for example, creating issues, managing repositories, or automating workflows). Refer to the guide on retrieving stored tokens for API access.
+
+## Manage user's GitHub identity
+
+After a user links their GitHub account, admins can manage that connection in the Logto Console:
+
+1. Navigate to [Logto console > User management](https://cloud.logto.io/to/users) and open the user's profile.
+2. Under **Social connections**, locate the GitHub item and click **Manage**.
+3. On this page, admins can manage the user's GitHub connection, see all profile information granted and synced from their GitHub account, and check the [access token status](https://docs.logto.io/secret-vault/federated-token-set#token-storage-status).
+
+**Note**: GitHub's access token response does not include the specific scope information, so Logto cannot directly display the list of permissions granted by the user. However, as long as the user has consented to the requested scopes during authorization, your application will have the corresponding permissions when accessing the GitHub API.
 
 ## Reference
 
-- [GitHub - Developers - Apps](https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps)
-- [GitHub - Developers - Apps - Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
+[GitHub Developer Documentation - About Apps](https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps)
+
+[GitHub Developer Documentation - Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
+
+[GitHub OAuth App Scopes Documentation](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps)

package/lib/index.js

@@ -52,13 +52,14 @@ var defaultMetadata = {
     },
     {
       key: "scope",
-      type: ConnectorConfigFormItemType.Text,
+      type: ConnectorConfigFormItemType.MultilineText,
       label: "Scope",
       required: false,
-      placeholder: "<scope>",
-      description: "The `scope` determines permissions granted by the user's authorization. If you are not sure what to enter, do not worry, just leave it blank."
+      placeholder: "Enter the scopes (separated by a space)",
+      description: "The `scope` determines permissions granted by the user's authorization. "
     }
-  ]
+  ],
+  isTokenStorageSupported: true
 };
 var defaultTimeout = 5e3;
 
@@ -78,7 +79,9 @@ var emailAddressGuard = z.object({
 var accessTokenResponseGuard = z.object({
   access_token: z.string(),
   scope: z.string(),
-  token_type: z.string()
+  token_type: z.string(),
+  refresh_token: z.string().optional(),
+  expires_in: z.number().optional()
 });
 var userInfoResponseGuard = z.object({
   id: z.number(),
@@ -94,14 +97,14 @@ var authorizationCallbackErrorGuard = z.object({
 var authResponseGuard = z.object({ code: z.string() });
 
 // src/index.ts
-var getAuthorizationUri = (getConfig) => async ({ state, redirectUri }) => {
+var getAuthorizationUri = (getConfig) => async ({ state, redirectUri, scope: scope2 }) => {
   const config = await getConfig(defaultMetadata.id);
   validateConfig(config, githubConfigGuard);
   const queryParameters = new URLSearchParams({
     client_id: config.clientId,
     redirect_uri: redirectUri,
     state,
-    scope: config.scope ?? scope
+    scope: scope2 ?? config.scope ?? scope
   });
   return `${authorizationEndpoint}?${queryParameters.toString()}`;
 };
@@ -141,13 +144,34 @@ var getAccessToken = async (config, codeObject) => {
   }
   const { access_token: accessToken } = result.data;
   assert(accessToken, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));
-  return { accessToken };
+  return result.data;
 };
-var getUserInfo = (getConfig) => async (data) => {
+var _getAccessTokenByRefreshToken = async (config, refreshToken) => {
+  const { clientId: client_id, clientSecret: client_secret } = config;
+  const httpResponse = await ky.post(accessTokenEndpoint, {
+    body: new URLSearchParams({
+      client_id,
+      client_secret,
+      refresh_token: refreshToken,
+      grant_type: "refresh_token"
+    }),
+    timeout: defaultTimeout
+  }).json();
+  const result = accessTokenResponseGuard.safeParse(httpResponse);
+  if (!result.success) {
+    throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
+  }
+  const { access_token } = result.data;
+  assert(access_token, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));
+  return result.data;
+};
+var handleAuthorizationCallback = async (getConfig, data) => {
   const { code } = await authorizationCallbackHandler(data);
   const config = await getConfig(defaultMetadata.id);
   validateConfig(config, githubConfigGuard);
-  const { accessToken } = await getAccessToken(config, { code });
+  return getAccessToken(config, { code });
+};
+var _getUserInfo = async (accessToken) => {
   const authedApi = ky.create({
     timeout: defaultTimeout,
     hooks: {
@@ -195,13 +219,40 @@ var getUserInfo = (getConfig) => async (data) => {
     throw error;
   }
 };
+var getTokenResponseAndUserInfo = (getConfig) => async (data) => {
+  const tokenResponse = await handleAuthorizationCallback(getConfig, data);
+  const userInfo = await _getUserInfo(tokenResponse.access_token);
+  return {
+    tokenResponse,
+    userInfo
+  };
+};
+var getUserInfo = (getConfig) => async (data) => {
+  const { access_token: accessToken } = await handleAuthorizationCallback(getConfig, data);
+  return _getUserInfo(accessToken);
+};
+var getAccessTokenByRefreshToken = (getConfig) => async (refreshToken) => {
+  const config = await getConfig(defaultMetadata.id);
+  validateConfig(config, githubConfigGuard);
+  try {
+    return await _getAccessTokenByRefreshToken(config, refreshToken);
+  } catch (error) {
+    if (error instanceof HTTPError) {
+      const { body: rawBody } = error.response;
+      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(rawBody));
+    }
+    throw error;
+  }
+};
 var createGithubConnector = async ({ getConfig }) => {
   return {
     metadata: defaultMetadata,
     type: ConnectorType.Social,
     configGuard: githubConfigGuard,
     getAuthorizationUri: getAuthorizationUri(getConfig),
-    getUserInfo: getUserInfo(getConfig)
+    getUserInfo: getUserInfo(getConfig),
+    getTokenResponseAndUserInfo: getTokenResponseAndUserInfo(getConfig),
+    getAccessTokenByRefreshToken: getAccessTokenByRefreshToken(getConfig)
   };
 };
 var index_default = createGithubConnector;

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/constant.ts","../src/types.ts"],"sourcesContent":["import { assert, conditional, trySafe } from '@silverhand/essentials';\n\nimport {\n  ConnectorError,\n  ConnectorErrorCodes,\n  validateConfig,\n  ConnectorType,\n  jsonGuard,\n} from '@logto/connector-kit';\nimport type {\n  GetAuthorizationUri,\n  GetUserInfo,\n  SocialConnector,\n  CreateConnector,\n  GetConnectorConfig,\n} from '@logto/connector-kit';\nimport ky, { HTTPError } from 'ky';\n\nimport {\n  authorizationEndpoint,\n  accessTokenEndpoint,\n  scope as defaultScope,\n  userInfoEndpoint,\n  userEmailsEndpoint,\n  defaultMetadata,\n  defaultTimeout,\n} from './constant.js';\nimport type { GithubConfig } from './types.js';\nimport {\n  authorizationCallbackErrorGuard,\n  githubConfigGuard,\n  emailAddressGuard,\n  accessTokenResponseGuard,\n  userInfoResponseGuard,\n  authResponseGuard,\n} from './types.js';\n\nconst getAuthorizationUri =\n  (getConfig: GetConnectorConfig): GetAuthorizationUri =>\n  async ({ state, redirectUri }) => {\n    const config = await getConfig(defaultMetadata.id);\n    validateConfig(config, githubConfigGuard);\n    const queryParameters = new URLSearchParams({\n      client_id: config.clientId,\n      redirect_uri: redirectUri,\n      state,\n      scope: config.scope ?? defaultScope,\n    });\n\n    return `${authorizationEndpoint}?${queryParameters.toString()}`;\n  };\n\nconst authorizationCallbackHandler = async (parameterObject: unknown) => {\n  const result = authResponseGuard.safeParse(parameterObject);\n\n  if (result.success) {\n    return result.data;\n  }\n\n  const parsedError = authorizationCallbackErrorGuard.safeParse(parameterObject);\n\n  if (!parsedError.success) {\n    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));\n  }\n\n  const { error, error_description, error_uri } = parsedError.data;\n\n  if (error === 'access_denied') {\n    throw new ConnectorError(ConnectorErrorCodes.AuthorizationFailed, error_description);\n  }\n\n  throw new ConnectorError(ConnectorErrorCodes.General, {\n    error,\n    errorDescription: error_description,\n    error_uri,\n  });\n};\n\nexport const getAccessToken = async (config: GithubConfig, codeObject: { code: string }) => {\n  const { code } = codeObject;\n  const { clientId: client_id, clientSecret: client_secret } = config;\n\n  const httpResponse = await ky\n    .post(accessTokenEndpoint, {\n      body: new URLSearchParams({\n        client_id,\n        client_secret,\n        code,\n      }),\n      timeout: defaultTimeout,\n    })\n    .json();\n\n  const result = accessTokenResponseGuard.safeParse(httpResponse);\n\n  if (!result.success) {\n    throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);\n  }\n\n  const { access_token: accessToken } = result.data;\n\n  assert(accessToken, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));\n\n  return { accessToken };\n};\n\nconst getUserInfo =\n  (getConfig: GetConnectorConfig): GetUserInfo =>\n  async (data) => {\n    const { code } = await authorizationCallbackHandler(data);\n    const config = await getConfig(defaultMetadata.id);\n    validateConfig(config, githubConfigGuard);\n    const { accessToken } = await getAccessToken(config, { code });\n\n    const authedApi = ky.create({\n      timeout: defaultTimeout,\n      hooks: {\n        beforeRequest: [\n          (request) => {\n            request.headers.set('Authorization', `Bearer ${accessToken}`);\n          },\n        ],\n      },\n    });\n\n    try {\n      /**\n       * If user(s) is using GitHub Apps (instead of OAuth Apps), they can customize\n       * \"Account permissions\" and restrict the \"email addresses\" visibility, and GitHub\n       * hence throws error instead of returning an empty array.\n       *\n       * We try catch the error and return an empty array instead.\n       */\n      const [userInfo, userEmails = []] = await Promise.all([\n        authedApi.get(userInfoEndpoint).json(),\n        trySafe(authedApi.get(userEmailsEndpoint).json()),\n      ]);\n\n      const userInfoResult = userInfoResponseGuard.safeParse(userInfo);\n      const userEmailsResult = emailAddressGuard.array().safeParse(userEmails);\n\n      if (!userInfoResult.success) {\n        throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, userInfoResult.error);\n      }\n\n      if (!userEmailsResult.success) {\n        throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, userEmailsResult.error);\n      }\n\n      const { id, avatar_url: avatar, email: publicEmail, name } = userInfoResult.data;\n\n      return {\n        id: String(id),\n        avatar: conditional(avatar),\n        email: conditional(\n          publicEmail ??\n            userEmailsResult.data.find(({ verified, primary }) => verified && primary)?.email\n        ),\n        name: conditional(name),\n        rawData: jsonGuard.parse({\n          userInfo,\n          userEmails,\n        }),\n      };\n    } catch (error: unknown) {\n      if (error instanceof HTTPError) {\n        const { status, body: rawBody } = error.response;\n\n        if (status === 401) {\n          throw new ConnectorError(ConnectorErrorCodes.SocialAccessTokenInvalid);\n        }\n\n        throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(rawBody));\n      }\n\n      throw error;\n    }\n  };\n\nconst createGithubConnector: CreateConnector<SocialConnector> = async ({ getConfig }) => {\n  return {\n    metadata: defaultMetadata,\n    type: ConnectorType.Social,\n    configGuard: githubConfigGuard,\n    getAuthorizationUri: getAuthorizationUri(getConfig),\n    getUserInfo: getUserInfo(getConfig),\n  };\n};\n\nexport default createGithubConnector;\n","import type { ConnectorMetadata } from '@logto/connector-kit';\nimport { ConnectorPlatform, ConnectorConfigFormItemType } from '@logto/connector-kit';\n\nexport const authorizationEndpoint = 'https://github.com/login/oauth/authorize';\n/**\n * `read:user` read user profile data; `user:email` read user email addresses (including private email addresses).\n * Ref: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps\n */\nexport const scope = 'read:user user:email';\nexport const accessTokenEndpoint = 'https://github.com/login/oauth/access_token';\nexport const userInfoEndpoint = 'https://api.github.com/user';\n// Ref: https://docs.github.com/en/rest/users/emails?apiVersion=2022-11-28#list-email-addresses-for-the-authenticated-user\nexport const userEmailsEndpoint = 'https://api.github.com/user/emails';\n\nexport const defaultMetadata: ConnectorMetadata = {\n  id: 'github-universal',\n  target: 'github',\n  platform: ConnectorPlatform.Universal,\n  name: {\n    en: 'GitHub',\n    'zh-CN': 'GitHub',\n    'tr-TR': 'GitHub',\n    ko: 'GitHub',\n  },\n  logo: './logo.svg',\n  logoDark: './logo-dark.svg',\n  description: {\n    en: 'GitHub is an online community for software development and version control.',\n    'zh-CN': 'GitHub 是极受欢迎的代码托管仓库。',\n    'tr-TR': 'GitHub, yazılım geliştirme ve sürüm kontrolü için çevrimiçi bir topluluktur.',\n    ko: 'GitHub는 소프트웨어 개발과 버전 관리를 위한 온라인 커뮤니티입니다.',\n  },\n  readme: './README.md',\n  formItems: [\n    {\n      key: 'clientId',\n      type: ConnectorConfigFormItemType.Text,\n      label: 'Client ID',\n      required: true,\n      placeholder: '<client-id>',\n    },\n    {\n      key: 'clientSecret',\n      type: ConnectorConfigFormItemType.Text,\n      label: 'Client Secret',\n      required: true,\n      placeholder: '<client-secret>',\n    },\n    {\n      key: 'scope',\n      type: ConnectorConfigFormItemType.Text,\n      label: 'Scope',\n      required: false,\n      placeholder: '<scope>',\n      description:\n        \"The `scope` determines permissions granted by the user's authorization. If you are not sure what to enter, do not worry, just leave it blank.\",\n    },\n  ],\n};\n\nexport const defaultTimeout = 5000;\n","import { z } from 'zod';\n\nexport const githubConfigGuard = z.object({\n  clientId: z.string(),\n  clientSecret: z.string(),\n  scope: z.string().optional(),\n});\n\nexport type GithubConfig = z.infer<typeof githubConfigGuard>;\n\n/**\n * This guard is used to validate the response from the GitHub API when requesting the user's email addresses.\n * Ref: https://docs.github.com/en/rest/users/emails?apiVersion=2022-11-28#list-email-addresses-for-the-authenticated-user\n */\nexport const emailAddressGuard = z.object({\n  email: z.string(),\n  primary: z.boolean(),\n  verified: z.boolean(),\n  visibility: z.string().nullable(),\n});\n\nexport const accessTokenResponseGuard = z.object({\n  access_token: z.string(),\n  scope: z.string(),\n  token_type: z.string(),\n});\n\nexport type AccessTokenResponse = z.infer<typeof accessTokenResponseGuard>;\n\nexport const userInfoResponseGuard = z.object({\n  id: z.number(),\n  avatar_url: z.string().optional().nullable(),\n  email: z.string().optional().nullable(),\n  name: z.string().optional().nullable(),\n});\n\nexport type UserInfoResponse = z.infer<typeof userInfoResponseGuard>;\n\nexport const authorizationCallbackErrorGuard = z.object({\n  error: z.string(),\n  error_description: z.string(),\n  error_uri: z.string(),\n});\n\nexport const authResponseGuard = z.object({ code: z.string() });\n"],"mappings":";AAAA,SAAS,QAAQ,aAAa,eAAe;AAE7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP,OAAO,MAAM,iBAAiB;;;ACf9B,SAAS,mBAAmB,mCAAmC;AAExD,IAAM,wBAAwB;AAK9B,IAAM,QAAQ;AACd,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,qBAAqB;AAE3B,IAAM,kBAAqC;AAAA,EAChD,IAAI;AAAA,EACJ,QAAQ;AAAA,EACR,UAAU,kBAAkB;AAAA,EAC5B,MAAM;AAAA,IACJ,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,IAAI;AAAA,EACN;AAAA,EACA,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,IACX,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,IAAI;AAAA,EACN;AAAA,EACA,QAAQ;AAAA,EACR,WAAW;AAAA,IACT;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,MACb,aACE;AAAA,IACJ;AAAA,EACF;AACF;AAEO,IAAM,iBAAiB;;;AC5D9B,SAAS,SAAS;AAEX,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,UAAU,EAAE,OAAO;AAAA,EACnB,cAAc,EAAE,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAQM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAEM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,cAAc,EAAE,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,OAAO;AACvB,CAAC;AAIM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO;AAAA,EACb,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACvC,CAAC;AAIM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,OAAO,EAAE,OAAO;AAAA,EAChB,mBAAmB,EAAE,OAAO;AAAA,EAC5B,WAAW,EAAE,OAAO;AACtB,CAAC;AAEM,IAAM,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;;;AFP9D,IAAM,sBACJ,CAAC,cACD,OAAO,EAAE,OAAO,YAAY,MAAM;AAChC,QAAM,SAAS,MAAM,UAAU,gBAAgB,EAAE;AACjD,iBAAe,QAAQ,iBAAiB;AACxC,QAAM,kBAAkB,IAAI,gBAAgB;AAAA,IAC1C,WAAW,OAAO;AAAA,IAClB,cAAc;AAAA,IACd;AAAA,IACA,OAAO,OAAO,SAAS;AAAA,EACzB,CAAC;AAED,SAAO,GAAG,qBAAqB,IAAI,gBAAgB,SAAS,CAAC;AAC/D;AAEF,IAAM,+BAA+B,OAAO,oBAA6B;AACvE,QAAM,SAAS,kBAAkB,UAAU,eAAe;AAE1D,MAAI,OAAO,SAAS;AAClB,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,cAAc,gCAAgC,UAAU,eAAe;AAE7E,MAAI,CAAC,YAAY,SAAS;AACxB,UAAM,IAAI,eAAe,oBAAoB,SAAS,KAAK,UAAU,eAAe,CAAC;AAAA,EACvF;AAEA,QAAM,EAAE,OAAO,mBAAmB,UAAU,IAAI,YAAY;AAE5D,MAAI,UAAU,iBAAiB;AAC7B,UAAM,IAAI,eAAe,oBAAoB,qBAAqB,iBAAiB;AAAA,EACrF;AAEA,QAAM,IAAI,eAAe,oBAAoB,SAAS;AAAA,IACpD;AAAA,IACA,kBAAkB;AAAA,IAClB;AAAA,EACF,CAAC;AACH;AAEO,IAAM,iBAAiB,OAAO,QAAsB,eAAiC;AAC1F,QAAM,EAAE,KAAK,IAAI;AACjB,QAAM,EAAE,UAAU,WAAW,cAAc,cAAc,IAAI;AAE7D,QAAM,eAAe,MAAM,GACxB,KAAK,qBAAqB;AAAA,IACzB,MAAM,IAAI,gBAAgB;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,SAAS;AAAA,EACX,CAAC,EACA,KAAK;AAER,QAAM,SAAS,yBAAyB,UAAU,YAAY;AAE9D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,eAAe,oBAAoB,iBAAiB,OAAO,KAAK;AAAA,EAC5E;AAEA,QAAM,EAAE,cAAc,YAAY,IAAI,OAAO;AAE7C,SAAO,aAAa,IAAI,eAAe,oBAAoB,qBAAqB,CAAC;AAEjF,SAAO,EAAE,YAAY;AACvB;AAEA,IAAM,cACJ,CAAC,cACD,OAAO,SAAS;AACd,QAAM,EAAE,KAAK,IAAI,MAAM,6BAA6B,IAAI;AACxD,QAAM,SAAS,MAAM,UAAU,gBAAgB,EAAE;AACjD,iBAAe,QAAQ,iBAAiB;AACxC,QAAM,EAAE,YAAY,IAAI,MAAM,eAAe,QAAQ,EAAE,KAAK,CAAC;AAE7D,QAAM,YAAY,GAAG,OAAO;AAAA,IAC1B,SAAS;AAAA,IACT,OAAO;AAAA,MACL,eAAe;AAAA,QACb,CAAC,YAAY;AACX,kBAAQ,QAAQ,IAAI,iBAAiB,UAAU,WAAW,EAAE;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI;AAQF,UAAM,CAAC,UAAU,aAAa,CAAC,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MACpD,UAAU,IAAI,gBAAgB,EAAE,KAAK;AAAA,MACrC,QAAQ,UAAU,IAAI,kBAAkB,EAAE,KAAK,CAAC;AAAA,IAClD,CAAC;AAED,UAAM,iBAAiB,sBAAsB,UAAU,QAAQ;AAC/D,UAAM,mBAAmB,kBAAkB,MAAM,EAAE,UAAU,UAAU;AAEvE,QAAI,CAAC,eAAe,SAAS;AAC3B,YAAM,IAAI,eAAe,oBAAoB,iBAAiB,eAAe,KAAK;AAAA,IACpF;AAEA,QAAI,CAAC,iBAAiB,SAAS;AAC7B,YAAM,IAAI,eAAe,oBAAoB,iBAAiB,iBAAiB,KAAK;AAAA,IACtF;AAEA,UAAM,EAAE,IAAI,YAAY,QAAQ,OAAO,aAAa,KAAK,IAAI,eAAe;AAE5E,WAAO;AAAA,MACL,IAAI,OAAO,EAAE;AAAA,MACb,QAAQ,YAAY,MAAM;AAAA,MAC1B,OAAO;AAAA,QACL,eACE,iBAAiB,KAAK,KAAK,CAAC,EAAE,UAAU,QAAQ,MAAM,YAAY,OAAO,GAAG;AAAA,MAChF;AAAA,MACA,MAAM,YAAY,IAAI;AAAA,MACtB,SAAS,UAAU,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,SAAS,OAAgB;AACvB,QAAI,iBAAiB,WAAW;AAC9B,YAAM,EAAE,QAAQ,MAAM,QAAQ,IAAI,MAAM;AAExC,UAAI,WAAW,KAAK;AAClB,cAAM,IAAI,eAAe,oBAAoB,wBAAwB;AAAA,MACvE;AAEA,YAAM,IAAI,eAAe,oBAAoB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,IAC/E;AAEA,UAAM;AAAA,EACR;AACF;AAEF,IAAM,wBAA0D,OAAO,EAAE,UAAU,MAAM;AACvF,SAAO;AAAA,IACL,UAAU;AAAA,IACV,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,qBAAqB,oBAAoB,SAAS;AAAA,IAClD,aAAa,YAAY,SAAS;AAAA,EACpC;AACF;AAEA,IAAO,gBAAQ;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/constant.ts","../src/types.ts"],"sourcesContent":["import { assert, conditional, trySafe } from '@silverhand/essentials';\n\nimport {\n  ConnectorError,\n  ConnectorErrorCodes,\n  validateConfig,\n  ConnectorType,\n  jsonGuard,\n} from '@logto/connector-kit';\nimport type {\n  GetAuthorizationUri,\n  GetUserInfo,\n  SocialConnector,\n  CreateConnector,\n  GetConnectorConfig,\n  GetTokenResponseAndUserInfo,\n  GetAccessTokenByRefreshToken,\n} from '@logto/connector-kit';\nimport ky, { HTTPError } from 'ky';\n\nimport {\n  authorizationEndpoint,\n  accessTokenEndpoint,\n  scope as defaultScope,\n  userInfoEndpoint,\n  userEmailsEndpoint,\n  defaultMetadata,\n  defaultTimeout,\n} from './constant.js';\nimport type { GithubConfig } from './types.js';\nimport {\n  authorizationCallbackErrorGuard,\n  githubConfigGuard,\n  emailAddressGuard,\n  accessTokenResponseGuard,\n  userInfoResponseGuard,\n  authResponseGuard,\n} from './types.js';\n\nconst getAuthorizationUri =\n  (getConfig: GetConnectorConfig): GetAuthorizationUri =>\n  async ({ state, redirectUri, scope }) => {\n    const config = await getConfig(defaultMetadata.id);\n    validateConfig(config, githubConfigGuard);\n    const queryParameters = new URLSearchParams({\n      client_id: config.clientId,\n      redirect_uri: redirectUri,\n      state,\n      scope: scope ?? config.scope ?? defaultScope,\n    });\n\n    return `${authorizationEndpoint}?${queryParameters.toString()}`;\n  };\n\nconst authorizationCallbackHandler = async (parameterObject: unknown) => {\n  const result = authResponseGuard.safeParse(parameterObject);\n\n  if (result.success) {\n    return result.data;\n  }\n\n  const parsedError = authorizationCallbackErrorGuard.safeParse(parameterObject);\n\n  if (!parsedError.success) {\n    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));\n  }\n\n  const { error, error_description, error_uri } = parsedError.data;\n\n  if (error === 'access_denied') {\n    throw new ConnectorError(ConnectorErrorCodes.AuthorizationFailed, error_description);\n  }\n\n  throw new ConnectorError(ConnectorErrorCodes.General, {\n    error,\n    errorDescription: error_description,\n    error_uri,\n  });\n};\n\nexport const getAccessToken = async (config: GithubConfig, codeObject: { code: string }) => {\n  const { code } = codeObject;\n  const { clientId: client_id, clientSecret: client_secret } = config;\n\n  const httpResponse = await ky\n    .post(accessTokenEndpoint, {\n      body: new URLSearchParams({\n        client_id,\n        client_secret,\n        code,\n      }),\n      timeout: defaultTimeout,\n    })\n    .json();\n\n  const result = accessTokenResponseGuard.safeParse(httpResponse);\n\n  if (!result.success) {\n    throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);\n  }\n\n  const { access_token: accessToken } = result.data;\n\n  assert(accessToken, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));\n\n  return result.data;\n};\n\n/**\n * {@link https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/refreshing-user-access-tokens#refreshing-a-user-access-token-with-a-refresh-token}\n */\nconst _getAccessTokenByRefreshToken = async (config: GithubConfig, refreshToken: string) => {\n  const { clientId: client_id, clientSecret: client_secret } = config;\n\n  const httpResponse = await ky\n    .post(accessTokenEndpoint, {\n      body: new URLSearchParams({\n        client_id,\n        client_secret,\n        refresh_token: refreshToken,\n        grant_type: 'refresh_token',\n      }),\n      timeout: defaultTimeout,\n    })\n    .json();\n\n  const result = accessTokenResponseGuard.safeParse(httpResponse);\n\n  if (!result.success) {\n    throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);\n  }\n\n  const { access_token } = result.data;\n\n  assert(access_token, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));\n\n  return result.data;\n};\n\nconst handleAuthorizationCallback = async (getConfig: GetConnectorConfig, data: unknown) => {\n  const { code } = await authorizationCallbackHandler(data);\n  const config = await getConfig(defaultMetadata.id);\n  validateConfig(config, githubConfigGuard);\n  return getAccessToken(config, { code });\n};\n\nconst _getUserInfo = async (accessToken: string) => {\n  const authedApi = ky.create({\n    timeout: defaultTimeout,\n    hooks: {\n      beforeRequest: [\n        (request) => {\n          request.headers.set('Authorization', `Bearer ${accessToken}`);\n        },\n      ],\n    },\n  });\n\n  try {\n    /**\n     * If user(s) is using GitHub Apps (instead of OAuth Apps), they can customize\n     * \"Account permissions\" and restrict the \"email addresses\" visibility, and GitHub\n     * hence throws error instead of returning an empty array.\n     *\n     * We try catch the error and return an empty array instead.\n     */\n    const [userInfo, userEmails = []] = await Promise.all([\n      authedApi.get(userInfoEndpoint).json(),\n      trySafe(authedApi.get(userEmailsEndpoint).json()),\n    ]);\n\n    const userInfoResult = userInfoResponseGuard.safeParse(userInfo);\n    const userEmailsResult = emailAddressGuard.array().safeParse(userEmails);\n\n    if (!userInfoResult.success) {\n      throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, userInfoResult.error);\n    }\n\n    if (!userEmailsResult.success) {\n      throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, userEmailsResult.error);\n    }\n\n    const { id, avatar_url: avatar, email: publicEmail, name } = userInfoResult.data;\n\n    return {\n      id: String(id),\n      avatar: conditional(avatar),\n      email: conditional(\n        publicEmail ??\n          userEmailsResult.data.find(({ verified, primary }) => verified && primary)?.email\n      ),\n      name: conditional(name),\n      rawData: jsonGuard.parse({\n        userInfo,\n        userEmails,\n      }),\n    };\n  } catch (error: unknown) {\n    if (error instanceof HTTPError) {\n      const { status, body: rawBody } = error.response;\n\n      if (status === 401) {\n        throw new ConnectorError(ConnectorErrorCodes.SocialAccessTokenInvalid);\n      }\n\n      throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(rawBody));\n    }\n\n    throw error;\n  }\n};\n\nconst getTokenResponseAndUserInfo =\n  (getConfig: GetConnectorConfig): GetTokenResponseAndUserInfo =>\n  async (data) => {\n    const tokenResponse = await handleAuthorizationCallback(getConfig, data);\n    const userInfo = await _getUserInfo(tokenResponse.access_token);\n\n    return {\n      tokenResponse,\n      userInfo,\n    };\n  };\n\nconst getUserInfo =\n  (getConfig: GetConnectorConfig): GetUserInfo =>\n  async (data) => {\n    const { access_token: accessToken } = await handleAuthorizationCallback(getConfig, data);\n    return _getUserInfo(accessToken);\n  };\n\nconst getAccessTokenByRefreshToken =\n  (getConfig: GetConnectorConfig): GetAccessTokenByRefreshToken =>\n  async (refreshToken: string) => {\n    const config = await getConfig(defaultMetadata.id);\n    validateConfig(config, githubConfigGuard);\n\n    try {\n      return await _getAccessTokenByRefreshToken(config, refreshToken);\n    } catch (error: unknown) {\n      if (error instanceof HTTPError) {\n        const { body: rawBody } = error.response;\n\n        throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(rawBody));\n      }\n\n      throw error;\n    }\n  };\n\nconst createGithubConnector: CreateConnector<SocialConnector> = async ({ getConfig }) => {\n  return {\n    metadata: defaultMetadata,\n    type: ConnectorType.Social,\n    configGuard: githubConfigGuard,\n    getAuthorizationUri: getAuthorizationUri(getConfig),\n    getUserInfo: getUserInfo(getConfig),\n    getTokenResponseAndUserInfo: getTokenResponseAndUserInfo(getConfig),\n    getAccessTokenByRefreshToken: getAccessTokenByRefreshToken(getConfig),\n  };\n};\n\nexport default createGithubConnector;\n","import type { ConnectorMetadata } from '@logto/connector-kit';\nimport { ConnectorPlatform, ConnectorConfigFormItemType } from '@logto/connector-kit';\n\nexport const authorizationEndpoint = 'https://github.com/login/oauth/authorize';\n/**\n * `read:user` read user profile data; `user:email` read user email addresses (including private email addresses).\n * Ref: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps\n */\nexport const scope = 'read:user user:email';\nexport const accessTokenEndpoint = 'https://github.com/login/oauth/access_token';\nexport const userInfoEndpoint = 'https://api.github.com/user';\n// Ref: https://docs.github.com/en/rest/users/emails?apiVersion=2022-11-28#list-email-addresses-for-the-authenticated-user\nexport const userEmailsEndpoint = 'https://api.github.com/user/emails';\n\nexport const defaultMetadata: ConnectorMetadata = {\n  id: 'github-universal',\n  target: 'github',\n  platform: ConnectorPlatform.Universal,\n  name: {\n    en: 'GitHub',\n    'zh-CN': 'GitHub',\n    'tr-TR': 'GitHub',\n    ko: 'GitHub',\n  },\n  logo: './logo.svg',\n  logoDark: './logo-dark.svg',\n  description: {\n    en: 'GitHub is an online community for software development and version control.',\n    'zh-CN': 'GitHub 是极受欢迎的代码托管仓库。',\n    'tr-TR': 'GitHub, yazılım geliştirme ve sürüm kontrolü için çevrimiçi bir topluluktur.',\n    ko: 'GitHub는 소프트웨어 개발과 버전 관리를 위한 온라인 커뮤니티입니다.',\n  },\n  readme: './README.md',\n  formItems: [\n    {\n      key: 'clientId',\n      type: ConnectorConfigFormItemType.Text,\n      label: 'Client ID',\n      required: true,\n      placeholder: '<client-id>',\n    },\n    {\n      key: 'clientSecret',\n      type: ConnectorConfigFormItemType.Text,\n      label: 'Client Secret',\n      required: true,\n      placeholder: '<client-secret>',\n    },\n    {\n      key: 'scope',\n      type: ConnectorConfigFormItemType.MultilineText,\n      label: 'Scope',\n      required: false,\n      placeholder: 'Enter the scopes (separated by a space)',\n      description: \"The `scope` determines permissions granted by the user's authorization. \",\n    },\n  ],\n  isTokenStorageSupported: true,\n};\n\nexport const defaultTimeout = 5000;\n","import { z } from 'zod';\n\nexport const githubConfigGuard = z.object({\n  clientId: z.string(),\n  clientSecret: z.string(),\n  scope: z.string().optional(),\n});\n\nexport type GithubConfig = z.infer<typeof githubConfigGuard>;\n\n/**\n * This guard is used to validate the response from the GitHub API when requesting the user's email addresses.\n * Ref: https://docs.github.com/en/rest/users/emails?apiVersion=2022-11-28#list-email-addresses-for-the-authenticated-user\n */\nexport const emailAddressGuard = z.object({\n  email: z.string(),\n  primary: z.boolean(),\n  verified: z.boolean(),\n  visibility: z.string().nullable(),\n});\n\nexport const accessTokenResponseGuard = z.object({\n  access_token: z.string(),\n  scope: z.string(),\n  token_type: z.string(),\n  refresh_token: z.string().optional(),\n  expires_in: z.number().optional(),\n});\n\nexport type AccessTokenResponse = z.infer<typeof accessTokenResponseGuard>;\n\nexport const userInfoResponseGuard = z.object({\n  id: z.number(),\n  avatar_url: z.string().optional().nullable(),\n  email: z.string().optional().nullable(),\n  name: z.string().optional().nullable(),\n});\n\nexport type UserInfoResponse = z.infer<typeof userInfoResponseGuard>;\n\nexport const authorizationCallbackErrorGuard = z.object({\n  error: z.string(),\n  error_description: z.string(),\n  error_uri: z.string(),\n});\n\nexport const authResponseGuard = z.object({ code: z.string() });\n"],"mappings":";AAAA,SAAS,QAAQ,aAAa,eAAe;AAE7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP,OAAO,MAAM,iBAAiB;;;ACjB9B,SAAS,mBAAmB,mCAAmC;AAExD,IAAM,wBAAwB;AAK9B,IAAM,QAAQ;AACd,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,qBAAqB;AAE3B,IAAM,kBAAqC;AAAA,EAChD,IAAI;AAAA,EACJ,QAAQ;AAAA,EACR,UAAU,kBAAkB;AAAA,EAC5B,MAAM;AAAA,IACJ,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,IAAI;AAAA,EACN;AAAA,EACA,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,IACX,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,IAAI;AAAA,EACN;AAAA,EACA,QAAQ;AAAA,EACR,WAAW;AAAA,IACT;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,yBAAyB;AAC3B;AAEO,IAAM,iBAAiB;;;AC5D9B,SAAS,SAAS;AAEX,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,UAAU,EAAE,OAAO;AAAA,EACnB,cAAc,EAAE,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAQM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAEM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,cAAc,EAAE,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAIM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO;AAAA,EACb,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACvC,CAAC;AAIM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,OAAO,EAAE,OAAO;AAAA,EAChB,mBAAmB,EAAE,OAAO;AAAA,EAC5B,WAAW,EAAE,OAAO;AACtB,CAAC;AAEM,IAAM,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;;;AFP9D,IAAM,sBACJ,CAAC,cACD,OAAO,EAAE,OAAO,aAAa,OAAAA,OAAM,MAAM;AACvC,QAAM,SAAS,MAAM,UAAU,gBAAgB,EAAE;AACjD,iBAAe,QAAQ,iBAAiB;AACxC,QAAM,kBAAkB,IAAI,gBAAgB;AAAA,IAC1C,WAAW,OAAO;AAAA,IAClB,cAAc;AAAA,IACd;AAAA,IACA,OAAOA,UAAS,OAAO,SAAS;AAAA,EAClC,CAAC;AAED,SAAO,GAAG,qBAAqB,IAAI,gBAAgB,SAAS,CAAC;AAC/D;AAEF,IAAM,+BAA+B,OAAO,oBAA6B;AACvE,QAAM,SAAS,kBAAkB,UAAU,eAAe;AAE1D,MAAI,OAAO,SAAS;AAClB,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,cAAc,gCAAgC,UAAU,eAAe;AAE7E,MAAI,CAAC,YAAY,SAAS;AACxB,UAAM,IAAI,eAAe,oBAAoB,SAAS,KAAK,UAAU,eAAe,CAAC;AAAA,EACvF;AAEA,QAAM,EAAE,OAAO,mBAAmB,UAAU,IAAI,YAAY;AAE5D,MAAI,UAAU,iBAAiB;AAC7B,UAAM,IAAI,eAAe,oBAAoB,qBAAqB,iBAAiB;AAAA,EACrF;AAEA,QAAM,IAAI,eAAe,oBAAoB,SAAS;AAAA,IACpD;AAAA,IACA,kBAAkB;AAAA,IAClB;AAAA,EACF,CAAC;AACH;AAEO,IAAM,iBAAiB,OAAO,QAAsB,eAAiC;AAC1F,QAAM,EAAE,KAAK,IAAI;AACjB,QAAM,EAAE,UAAU,WAAW,cAAc,cAAc,IAAI;AAE7D,QAAM,eAAe,MAAM,GACxB,KAAK,qBAAqB;AAAA,IACzB,MAAM,IAAI,gBAAgB;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,SAAS;AAAA,EACX,CAAC,EACA,KAAK;AAER,QAAM,SAAS,yBAAyB,UAAU,YAAY;AAE9D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,eAAe,oBAAoB,iBAAiB,OAAO,KAAK;AAAA,EAC5E;AAEA,QAAM,EAAE,cAAc,YAAY,IAAI,OAAO;AAE7C,SAAO,aAAa,IAAI,eAAe,oBAAoB,qBAAqB,CAAC;AAEjF,SAAO,OAAO;AAChB;AAKA,IAAM,gCAAgC,OAAO,QAAsB,iBAAyB;AAC1F,QAAM,EAAE,UAAU,WAAW,cAAc,cAAc,IAAI;AAE7D,QAAM,eAAe,MAAM,GACxB,KAAK,qBAAqB;AAAA,IACzB,MAAM,IAAI,gBAAgB;AAAA,MACxB;AAAA,MACA;AAAA,MACA,eAAe;AAAA,MACf,YAAY;AAAA,IACd,CAAC;AAAA,IACD,SAAS;AAAA,EACX,CAAC,EACA,KAAK;AAER,QAAM,SAAS,yBAAyB,UAAU,YAAY;AAE9D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,eAAe,oBAAoB,iBAAiB,OAAO,KAAK;AAAA,EAC5E;AAEA,QAAM,EAAE,aAAa,IAAI,OAAO;AAEhC,SAAO,cAAc,IAAI,eAAe,oBAAoB,qBAAqB,CAAC;AAElF,SAAO,OAAO;AAChB;AAEA,IAAM,8BAA8B,OAAO,WAA+B,SAAkB;AAC1F,QAAM,EAAE,KAAK,IAAI,MAAM,6BAA6B,IAAI;AACxD,QAAM,SAAS,MAAM,UAAU,gBAAgB,EAAE;AACjD,iBAAe,QAAQ,iBAAiB;AACxC,SAAO,eAAe,QAAQ,EAAE,KAAK,CAAC;AACxC;AAEA,IAAM,eAAe,OAAO,gBAAwB;AAClD,QAAM,YAAY,GAAG,OAAO;AAAA,IAC1B,SAAS;AAAA,IACT,OAAO;AAAA,MACL,eAAe;AAAA,QACb,CAAC,YAAY;AACX,kBAAQ,QAAQ,IAAI,iBAAiB,UAAU,WAAW,EAAE;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI;AAQF,UAAM,CAAC,UAAU,aAAa,CAAC,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MACpD,UAAU,IAAI,gBAAgB,EAAE,KAAK;AAAA,MACrC,QAAQ,UAAU,IAAI,kBAAkB,EAAE,KAAK,CAAC;AAAA,IAClD,CAAC;AAED,UAAM,iBAAiB,sBAAsB,UAAU,QAAQ;AAC/D,UAAM,mBAAmB,kBAAkB,MAAM,EAAE,UAAU,UAAU;AAEvE,QAAI,CAAC,eAAe,SAAS;AAC3B,YAAM,IAAI,eAAe,oBAAoB,iBAAiB,eAAe,KAAK;AAAA,IACpF;AAEA,QAAI,CAAC,iBAAiB,SAAS;AAC7B,YAAM,IAAI,eAAe,oBAAoB,iBAAiB,iBAAiB,KAAK;AAAA,IACtF;AAEA,UAAM,EAAE,IAAI,YAAY,QAAQ,OAAO,aAAa,KAAK,IAAI,eAAe;AAE5E,WAAO;AAAA,MACL,IAAI,OAAO,EAAE;AAAA,MACb,QAAQ,YAAY,MAAM;AAAA,MAC1B,OAAO;AAAA,QACL,eACE,iBAAiB,KAAK,KAAK,CAAC,EAAE,UAAU,QAAQ,MAAM,YAAY,OAAO,GAAG;AAAA,MAChF;AAAA,MACA,MAAM,YAAY,IAAI;AAAA,MACtB,SAAS,UAAU,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,SAAS,OAAgB;AACvB,QAAI,iBAAiB,WAAW;AAC9B,YAAM,EAAE,QAAQ,MAAM,QAAQ,IAAI,MAAM;AAExC,UAAI,WAAW,KAAK;AAClB,cAAM,IAAI,eAAe,oBAAoB,wBAAwB;AAAA,MACvE;AAEA,YAAM,IAAI,eAAe,oBAAoB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,IAC/E;AAEA,UAAM;AAAA,EACR;AACF;AAEA,IAAM,8BACJ,CAAC,cACD,OAAO,SAAS;AACd,QAAM,gBAAgB,MAAM,4BAA4B,WAAW,IAAI;AACvE,QAAM,WAAW,MAAM,aAAa,cAAc,YAAY;AAE9D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEF,IAAM,cACJ,CAAC,cACD,OAAO,SAAS;AACd,QAAM,EAAE,cAAc,YAAY,IAAI,MAAM,4BAA4B,WAAW,IAAI;AACvF,SAAO,aAAa,WAAW;AACjC;AAEF,IAAM,+BACJ,CAAC,cACD,OAAO,iBAAyB;AAC9B,QAAM,SAAS,MAAM,UAAU,gBAAgB,EAAE;AACjD,iBAAe,QAAQ,iBAAiB;AAExC,MAAI;AACF,WAAO,MAAM,8BAA8B,QAAQ,YAAY;AAAA,EACjE,SAAS,OAAgB;AACvB,QAAI,iBAAiB,WAAW;AAC9B,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM;AAEhC,YAAM,IAAI,eAAe,oBAAoB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,IAC/E;AAEA,UAAM;AAAA,EACR;AACF;AAEF,IAAM,wBAA0D,OAAO,EAAE,UAAU,MAAM;AACvF,SAAO;AAAA,IACL,UAAU;AAAA,IACV,MAAM,cAAc;AAAA,IACpB,aAAa;AAAA,IACb,qBAAqB,oBAAoB,SAAS;AAAA,IAClD,aAAa,YAAY,SAAS;AAAA,IAClC,6BAA6B,4BAA4B,SAAS;AAAA,IAClE,8BAA8B,6BAA6B,SAAS;AAAA,EACtE;AACF;AAEA,IAAO,gBAAQ;","names":["scope"]}

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@logto/connector-github",
-  "version": "1.5.1",
+  "version": "1.7.0",
   "description": "Github web connector implementation.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "dependencies": {
-    "@logto/connector-kit": "^4.1.1",
     "@silverhand/essentials": "^2.9.1",
     "ky": "^1.2.3",
     "query-string": "^9.0.0",
     "snakecase-keys": "^8.0.1",
-    "zod": "^3.23.8"
+    "zod": "3.24.3",
+    "@logto/connector-kit": "^4.4.0"
   },
   "main": "./lib/index.js",
   "module": "./lib/index.js",
@@ -23,7 +23,7 @@
     "logo-dark.svg"
   ],
   "engines": {
-    "node": "^20.9.0"
+    "node": "^22.14.0"
   },
   "eslintConfig": {
     "extends": "@silverhand",
@@ -44,17 +44,17 @@
   "devDependencies": {
     "@silverhand/eslint-config": "6.0.1",
     "@silverhand/ts-config": "6.0.0",
-    "@types/node": "^20.11.20",
+    "@types/node": "^22.14.0",
     "@types/supertest": "^6.0.2",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.1.1",
     "eslint": "^8.56.0",
     "lint-staged": "^15.0.2",
-    "nock": "14.0.0-beta.15",
-    "prettier": "^3.0.0",
+    "nock": "^14.0.3",
+    "prettier": "^3.5.3",
     "supertest": "^7.0.0",
-    "tsup": "^8.3.0",
+    "tsup": "^8.5.0",
     "typescript": "^5.5.3",
-    "vitest": "^2.1.9"
+    "vitest": "^3.1.1"
   },
   "scripts": {
     "precommit": "lint-staged",