@logto/connector-google 1.3.0 → 1.5.0

package/README.md

@@ -3,18 +3,17 @@
 The Google connector provides a succinct way for your application to use Google’s OAuth 2.0 authentication system.
 
 **Table of contents**
-- [Google connector](#google-connector)
-  - [Set up a project in the Google API Console](#set-up-a-project-in-the-google-api-console)
-  - [Configure your consent screen](#configure-your-consent-screen)
-    - [Configure and register your application](#configure-and-register-your-application)
-    - [Edit app registration](#edit-app-registration)
-      - [Config OAuth consent screen](#config-oauth-consent-screen)
-      - [Config scopes](#config-scopes)
-      - [Add test users (External user type only)](#add-test-users-external-user-type-only)
-  - [Obtain OAuth 2.0 credentials](#obtain-oauth-20-credentials)
-  - [Configure your connector](#configure-your-connector)
-    - [Config types](#config-types)
-  - [References](#references)
+- [Set up a project in the Google API Console](#set-up-a-project-in-the-google-api-console)
+- [Configure your consent screen](#configure-your-consent-screen)
+  - [Configure and register your application](#configure-and-register-your-application)
+  - [Edit app registration](#edit-app-registration)
+    - [Config OAuth consent screen](#config-oauth-consent-screen)
+    - [Config scopes](#config-scopes)
+    - [Add test users (External user type only)](#add-test-users-external-user-type-only)
+- [Obtain OAuth 2.0 credentials](#obtain-oauth-20-credentials)
+- [Configure your connector](#configure-your-connector)
+  - [Config types](#config-types)
+- [References](#references)
 
 ## Set up a project in the Google API Console
 
@@ -57,8 +56,8 @@ Now you should have the Google OAuth 2.0 consent screen configured.
 - On the **Credentials** page, click the **+ CREATE CREDENTIALS** button on the top menu bar, and select **OAuth client ID**.
 - On the **Create OAuth client ID** page, select **Web application** as the application type.
 - Fill out the basic information for your application.
-- Click **+ Add URI** to add an authorized domain to the **Authorized JavaScript origins** section. This is the domain that your logto authorization page will be served from. In our case, this will be `${your_logto_origin}`. e.g.`https://logto.dev`.
-- Click **+ Add URI** in the ****Authorized redirect URIs**** section to set up the ****Authorized redirect URIs****, which redirect the user to the application after logging in. In our case, this will be `${your_logto_endpoint}/callback/${connector_id}`. e.g. `https://logto.dev/callback/${connector_id}`. The `connector_id` can be found on the top bar of the Logto Admin Console connector details page.
+- Click **+ Add URI** to add an authorized domain to the **Authorized JavaScript origins** section. This is the domain that your logto authorization page will be served from. In our case, this will be `${your_logto_endpoint_origin}`. e.g.`https://foo.logto.app`.
+- Click **+ Add URI** in the ****Authorized redirect URIs**** section to set up the ****Authorized redirect URIs****, which redirect the user to the application after logging in. In our case, this will be `${your_logto_endpoint}/callback/${connector_id}`. e.g. `https://foo.logto.app/callback/${connector_id}`. The `connector_id` can be found on the top bar of the Logto Admin Console connector details page.
 - Click **Create** to finish and then you will get the **Client ID** and **Client Secret**.
 
 ## Configure your connector
@@ -67,13 +66,20 @@ Fill out the `clientId` and `clientSecret` field with _Client ID_ and _Client Se
 
 `scope` is a space-delimited list of [scopes](https://developers.google.com/identity/protocols/oauth2/scopes). If not provided, scope defaults to be `openid profile email`.
 
+`prompts` is an array of strings that specifies the type of user interaction that is required. The string can be one of the following values:
+
+- `none`: The authorization server does not display any authentication or user consent screens; it will return an error if the user is not already authenticated and has not pre-configured consent for the requested scopes. You can use none to check for existing authentication and/or consent.
+- `consent`: The authorization server prompts the user for consent before returning information to the client.
+- `select_account`: The authorization server prompts the user to select a user account. This allows a user who has multiple accounts at the authorization server to select amongst the multiple accounts that they may have current sessions for.
+
 ### Config types
 
-| Name         | Type   |
-|--------------|--------|
-| clientId     | string |
-| clientSecret | string |
-| scope        | string |
+| Name         | Type     |
+|--------------|----------|
+| clientId     | string   |
+| clientSecret | string   |
+| scope        | string   |
+| prompts      | string[] |
 
 ## References
 * [Google Identity: Setting up OAuth 2.0](https://developers.google.com/identity/protocols/oauth2/openid-connect#appsetup)

package/lib/index.js

@@ -1,201 +1,222 @@
-import { got, HTTPError } from 'got';
-import { ConnectorPlatform, ConnectorConfigFormItemType, parseJson, ConnectorError, ConnectorErrorCodes, ConnectorType, validateConfig } from '@logto/connector-kit';
-import { z } from 'zod';
+// src/index.ts
+import { conditional, assert } from "@silverhand/essentials";
+import { got, HTTPError } from "got";
+import {
+  ConnectorError,
+  ConnectorErrorCodes,
+  validateConfig,
+  ConnectorType,
+  parseJson,
+  GoogleConnector as GoogleConnector3
+} from "@logto/connector-kit";
+import { createRemoteJWKSet, jwtVerify } from "jose";
 
-// https://github.com/facebook/jest/issues/7547
-const assert = (value, error) => {
-    if (!value) {
-        // https://github.com/typescript-eslint/typescript-eslint/issues/3814
-        // eslint-disable-next-line @typescript-eslint/no-throw-literal
-        throw error;
-    }
-};
-
-// eslint-disable-next-line id-length
-// eslint-disable-next-line unicorn/prefer-native-coercion-functions
-const notFalsy = (value) => Boolean(value);
-
-/**
- * Conditional return the expression result when it's not {@link Falsy};
- * otherwise return `undefined`.
- *
- * @example
- * ```ts
- * conditional(1 && '2') // '2'
- * conditional(false && '1') // undefined
- * ```
- */
-const conditional = (exp) => (notFalsy(exp) ? exp : undefined);
-
-const authorizationEndpoint = 'https://accounts.google.com/o/oauth2/v2/auth';
-const accessTokenEndpoint = 'https://oauth2.googleapis.com/token';
-const userInfoEndpoint = 'https://openidconnect.googleapis.com/v1/userinfo';
-const scope = 'openid profile email';
-const defaultMetadata = {
-    id: 'google-universal',
-    target: 'google',
-    platform: ConnectorPlatform.Universal,
-    name: {
-        en: 'Google',
-        'zh-CN': 'Google',
-        'tr-TR': 'Google',
-        ko: 'Google',
+// src/constant.ts
+import {
+  ConnectorConfigFormItemType,
+  ConnectorPlatform,
+  GoogleConnector,
+  OidcPrompt
+} from "@logto/connector-kit";
+var authorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
+var accessTokenEndpoint = "https://oauth2.googleapis.com/token";
+var userInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo";
+var scope = "openid profile email";
+var defaultMetadata = {
+  id: GoogleConnector.factoryId,
+  target: GoogleConnector.target,
+  platform: ConnectorPlatform.Universal,
+  name: {
+    en: "Google",
+    "zh-CN": "Google",
+    "tr-TR": "Google",
+    ko: "Google"
+  },
+  logo: "./logo.svg",
+  logoDark: null,
+  description: {
+    en: "Google is a principal search engine technology and email service provider.",
+    "zh-CN": "Google \u662F\u5168\u7403\u6027\u7684\u641C\u7D22\u5F15\u64CE\u548C\u90AE\u4EF6\u670D\u52A1\u63D0\u4F9B\u5546\u3002",
+    "tr-TR": "Google, en b\xFCy\xFCk arama motoru teknolojisi ve e-posta servis sa\u011Flay\u0131c\u0131s\u0131d\u0131r.",
+    ko: "Google\uC740 \uAC00\uC7A5 \uD070 \uAC80\uC0C9 \uC5D4\uC9C4 \uAE30\uC220\uACFC \uC774\uBA54\uC77C \uC11C\uBE44\uC2A4 \uC81C\uACF5\uC790\uC785\uB2C8\uB2E4."
+  },
+  readme: "./README.md",
+  formItems: [
+    {
+      key: "clientId",
+      type: ConnectorConfigFormItemType.Text,
+      label: "Client ID",
+      required: true,
+      placeholder: "<client-id>"
     },
-    logo: './logo.svg',
-    logoDark: null,
-    description: {
-        en: 'Google is a principal search engine technology and email service provider.',
-        'zh-CN': 'Google 是全球性的搜索引擎和邮件服务提供商。',
-        'tr-TR': 'Google, en büyük arama motoru teknolojisi ve e-posta servis sağlayıcısıdır.',
-        ko: 'Google은 가장 큰 검색 엔진 기술과 이메일 서비스 제공자입니다.',
+    {
+      key: "clientSecret",
+      type: ConnectorConfigFormItemType.Text,
+      label: "Client Secret",
+      required: true,
+      placeholder: "<client-secret>"
     },
-    readme: './README.md',
-    formItems: [
-        {
-            key: 'clientId',
-            type: ConnectorConfigFormItemType.Text,
-            label: 'Client ID',
-            required: true,
-            placeholder: '<client-id>',
-        },
-        {
-            key: 'clientSecret',
-            type: ConnectorConfigFormItemType.Text,
-            label: 'Client Secret',
-            required: true,
-            placeholder: '<client-secret>',
-        },
-        {
-            key: 'scope',
-            type: ConnectorConfigFormItemType.Text,
-            label: 'Scope',
-            required: false,
-            placeholder: '<scope>',
-            description: "The `scope` determines permissions granted by the user's authorization. If you are not sure what to enter, do not worry, just leave it blank.",
-        },
-    ],
+    {
+      key: "scope",
+      type: ConnectorConfigFormItemType.Text,
+      label: "Scope",
+      required: false,
+      placeholder: "<scope>",
+      description: "The `scope` determines permissions granted by the user's authorization. If you are not sure what to enter, do not worry, just leave it blank."
+    },
+    {
+      key: "prompts",
+      type: ConnectorConfigFormItemType.MultiSelect,
+      required: false,
+      label: "Prompts",
+      // Google does not support `login` prompt.
+      // Ref: https://developers.google.com/identity/openid-connect/openid-connect#authenticationuriparameters
+      selectItems: Object.values(OidcPrompt).filter((prompt) => prompt !== OidcPrompt.Login).map((prompt) => ({
+        value: prompt
+      }))
+    }
+  ]
 };
-const defaultTimeout = 5000;
+var defaultTimeout = 5e3;
+var jwksUri = "https://www.googleapis.com/oauth2/v3/certs";
 
-const googleConfigGuard = z.object({
-    clientId: z.string(),
-    clientSecret: z.string(),
-    scope: z.string().optional(),
+// src/types.ts
+import { z } from "zod";
+import { GoogleConnector as GoogleConnector2 } from "@logto/connector-kit";
+var accessTokenResponseGuard = z.object({
+  access_token: z.string(),
+  scope: z.string(),
+  token_type: z.string()
 });
-const accessTokenResponseGuard = z.object({
-    access_token: z.string(),
-    scope: z.string(),
-    token_type: z.string(),
+var userInfoResponseGuard = z.object({
+  sub: z.string(),
+  name: z.string().optional(),
+  given_name: z.string().optional(),
+  family_name: z.string().optional(),
+  picture: z.string().optional(),
+  email: z.string().optional(),
+  email_verified: z.boolean().optional(),
+  locale: z.string().optional()
 });
-const userInfoResponseGuard = z.object({
-    sub: z.string(),
-    name: z.string().optional(),
-    given_name: z.string().optional(),
-    family_name: z.string().optional(),
-    picture: z.string().optional(),
-    email: z.string().optional(),
-    email_verified: z.boolean().optional(),
-    locale: z.string().optional(),
+var authResponseGuard = z.object({
+  code: z.string(),
+  redirectUri: z.string()
 });
-const authResponseGuard = z.object({
-    code: z.string(),
-    redirectUri: z.string(),
+var googleOneTapDataGuard = z.object({
+  [GoogleConnector2.oneTapParams.credential]: z.string()
 });
 
-/**
- * The Implementation of OpenID Connect of Google Identity Platform.
- * https://developers.google.com/identity/protocols/oauth2/openid-connect
- */
-const getAuthorizationUri = (getConfig) => async ({ state, redirectUri }) => {
-    const config = await getConfig(defaultMetadata.id);
-    validateConfig(config, googleConfigGuard);
-    const queryParameters = new URLSearchParams({
-        client_id: config.clientId,
-        redirect_uri: redirectUri,
-        response_type: 'code',
-        state,
-        scope: config.scope ?? scope,
-    });
-    return `${authorizationEndpoint}?${queryParameters.toString()}`;
+// src/index.ts
+var getAuthorizationUri = (getConfig) => async ({ state, redirectUri }) => {
+  const config = await getConfig(defaultMetadata.id);
+  validateConfig(config, GoogleConnector3.configGuard);
+  const { clientId, scope: scope2, prompts } = config;
+  const queryParameters = new URLSearchParams({
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    state,
+    scope: scope2 ?? scope,
+    ...conditional(prompts && prompts.length > 0 && { prompt: prompts.join(" ") })
+  });
+  return `${authorizationEndpoint}?${queryParameters.toString()}`;
 };
-const getAccessToken = async (config, codeObject) => {
-    const { code, redirectUri } = codeObject;
-    const { clientId, clientSecret } = config;
-    // Note：Need to decodeURIComponent on code
-    // https://stackoverflow.com/questions/51058256/google-api-node-js-invalid-grant-malformed-auth-code
-    const httpResponse = await got.post(accessTokenEndpoint, {
-        form: {
-            code: decodeURIComponent(code),
-            client_id: clientId,
-            client_secret: clientSecret,
-            redirect_uri: redirectUri,
-            grant_type: 'authorization_code',
-        },
-        timeout: { request: defaultTimeout },
-    });
-    const result = accessTokenResponseGuard.safeParse(parseJson(httpResponse.body));
-    if (!result.success) {
-        throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
-    }
-    const { access_token: accessToken } = result.data;
-    assert(accessToken, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));
-    return { accessToken };
+var getAccessToken = async (config, codeObject) => {
+  const { code, redirectUri } = codeObject;
+  const { clientId, clientSecret } = config;
+  const httpResponse = await got.post(accessTokenEndpoint, {
+    form: {
+      code: decodeURIComponent(code),
+      client_id: clientId,
+      client_secret: clientSecret,
+      redirect_uri: redirectUri,
+      grant_type: "authorization_code"
+    },
+    timeout: { request: defaultTimeout }
+  });
+  const result = accessTokenResponseGuard.safeParse(parseJson(httpResponse.body));
+  if (!result.success) {
+    throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
+  }
+  const { access_token: accessToken } = result.data;
+  assert(accessToken, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));
+  return { accessToken };
 };
-const getUserInfo = (getConfig) => async (data) => {
-    const { code, redirectUri } = await authorizationCallbackHandler(data);
-    const config = await getConfig(defaultMetadata.id);
-    validateConfig(config, googleConfigGuard);
-    const { accessToken } = await getAccessToken(config, { code, redirectUri });
-    try {
-        const httpResponse = await got.post(userInfoEndpoint, {
-            headers: {
-                authorization: `Bearer ${accessToken}`,
-            },
-            timeout: { request: defaultTimeout },
-        });
-        const rawData = parseJson(httpResponse.body);
-        const result = userInfoResponseGuard.safeParse(rawData);
-        if (!result.success) {
-            throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
-        }
-        const { sub: id, picture: avatar, email, email_verified, name } = result.data;
-        return {
-            id,
-            avatar,
-            email: conditional(email_verified && email),
-            name,
-            rawData,
-        };
-    }
-    catch (error) {
-        return getUserInfoErrorHandler(error);
-    }
+var getUserInfoJson = async (data, config) => {
+  const oneTapResult = googleOneTapDataGuard.safeParse(data);
+  if (oneTapResult.success) {
+    const { payload } = await jwtVerify(
+      oneTapResult.data.credential,
+      createRemoteJWKSet(new URL(jwksUri)),
+      {
+        // https://developers.google.com/identity/gsi/web/guides/verify-google-id-token
+        issuer: ["https://accounts.google.com", "accounts.google.com"],
+        audience: config.clientId,
+        clockTolerance: 10
+      }
+    );
+    return payload;
+  }
+  const { code, redirectUri } = await authorizationCallbackHandler(data);
+  const { accessToken } = await getAccessToken(config, { code, redirectUri });
+  const httpResponse = await got.post(userInfoEndpoint, {
+    headers: {
+      authorization: `Bearer ${accessToken}`
+    },
+    timeout: { request: defaultTimeout }
+  });
+  return parseJson(httpResponse.body);
 };
-const authorizationCallbackHandler = async (parameterObject) => {
-    const result = authResponseGuard.safeParse(parameterObject);
+var getUserInfo = (getConfig) => async (data) => {
+  const config = await getConfig(defaultMetadata.id);
+  validateConfig(config, GoogleConnector3.configGuard);
+  try {
+    const rawData = await getUserInfoJson(data, config);
+    const result = userInfoResponseGuard.safeParse(rawData);
     if (!result.success) {
-        throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+      throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
     }
-    return result.data;
+    const { sub: id, picture: avatar, email, email_verified, name } = result.data;
+    return {
+      id,
+      avatar,
+      email: conditional(email_verified && email),
+      name,
+      rawData
+    };
+  } catch (error) {
+    return getUserInfoErrorHandler(error);
+  }
 };
-const getUserInfoErrorHandler = (error) => {
-    if (error instanceof HTTPError) {
-        const { statusCode, body: rawBody } = error.response;
-        if (statusCode === 401) {
-            throw new ConnectorError(ConnectorErrorCodes.SocialAccessTokenInvalid);
-        }
-        throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(rawBody));
+var authorizationCallbackHandler = async (parameterObject) => {
+  const result = authResponseGuard.safeParse(parameterObject);
+  if (!result.success) {
+    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+  }
+  return result.data;
+};
+var getUserInfoErrorHandler = (error) => {
+  if (error instanceof HTTPError) {
+    const { statusCode, body: rawBody } = error.response;
+    if (statusCode === 401) {
+      throw new ConnectorError(ConnectorErrorCodes.SocialAccessTokenInvalid);
     }
-    throw error;
+    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(rawBody));
+  }
+  throw error;
 };
-const createGoogleConnector = async ({ getConfig }) => {
-    return {
-        metadata: defaultMetadata,
-        type: ConnectorType.Social,
-        configGuard: googleConfigGuard,
-        getAuthorizationUri: getAuthorizationUri(getConfig),
-        getUserInfo: getUserInfo(getConfig),
-    };
+var createGoogleConnector = async ({ getConfig }) => {
+  return {
+    metadata: defaultMetadata,
+    type: ConnectorType.Social,
+    configGuard: GoogleConnector3.configGuard,
+    getAuthorizationUri: getAuthorizationUri(getConfig),
+    getUserInfo: getUserInfo(getConfig)
+  };
 };
-
-export { createGoogleConnector as default, getAccessToken };
+var src_default = createGoogleConnector;
+export {
+  src_default as default,
+  getAccessToken
+};
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/constant.ts","../src/types.ts"],"sourcesContent":["/**\n * The Implementation of OpenID Connect of Google Identity Platform.\n * https://developers.google.com/identity/protocols/oauth2/openid-connect\n */\nimport { conditional, assert } from '@silverhand/essentials';\nimport { got, HTTPError } from 'got';\n\nimport type {\n  GetAuthorizationUri,\n  GetUserInfo,\n  GetConnectorConfig,\n  CreateConnector,\n  SocialConnector,\n  GoogleConnectorConfig,\n} from '@logto/connector-kit';\nimport {\n  ConnectorError,\n  ConnectorErrorCodes,\n  validateConfig,\n  ConnectorType,\n  parseJson,\n  GoogleConnector,\n} from '@logto/connector-kit';\nimport { createRemoteJWKSet, jwtVerify } from 'jose';\n\nimport {\n  accessTokenEndpoint,\n  authorizationEndpoint,\n  scope as defaultScope,\n  userInfoEndpoint,\n  defaultMetadata,\n  defaultTimeout,\n  jwksUri,\n} from './constant.js';\nimport {\n  accessTokenResponseGuard,\n  userInfoResponseGuard,\n  authResponseGuard,\n  googleOneTapDataGuard,\n} from './types.js';\n\nconst getAuthorizationUri =\n  (getConfig: GetConnectorConfig): GetAuthorizationUri =>\n  async ({ state, redirectUri }) => {\n    const config = await getConfig(defaultMetadata.id);\n    validateConfig(config, GoogleConnector.configGuard);\n\n    const { clientId, scope, prompts } = config;\n\n    const queryParameters = new URLSearchParams({\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      response_type: 'code',\n      state,\n      scope: scope ?? defaultScope,\n      ...conditional(prompts && prompts.length > 0 && { prompt: prompts.join(' ') }),\n    });\n\n    return `${authorizationEndpoint}?${queryParameters.toString()}`;\n  };\n\nexport const getAccessToken = async (\n  config: GoogleConnectorConfig,\n  codeObject: { code: string; redirectUri: string }\n) => {\n  const { code, redirectUri } = codeObject;\n  const { clientId, clientSecret } = config;\n\n  // Note：Need to decodeURIComponent on code\n  // https://stackoverflow.com/questions/51058256/google-api-node-js-invalid-grant-malformed-auth-code\n  const httpResponse = await got.post(accessTokenEndpoint, {\n    form: {\n      code: decodeURIComponent(code),\n      client_id: clientId,\n      client_secret: clientSecret,\n      redirect_uri: redirectUri,\n      grant_type: 'authorization_code',\n    },\n    timeout: { request: defaultTimeout },\n  });\n\n  const result = accessTokenResponseGuard.safeParse(parseJson(httpResponse.body));\n\n  if (!result.success) {\n    throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);\n  }\n\n  const { access_token: accessToken } = result.data;\n\n  assert(accessToken, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));\n\n  return { accessToken };\n};\n\ntype Json = ReturnType<typeof parseJson>;\n\n/**\n * Get user information JSON from Google Identity Platform. It will use the following order to\n * retrieve user information:\n *\n * 1. Google One Tap: https://developers.google.com/identity/gsi/web/guides/verify-google-id-token\n * 2. Normal Google OAuth: https://developers.google.com/identity/protocols/oauth2/openid-connect\n *\n * @param data The data from the client.\n * @param config The configuration of the connector.\n * @returns A Promise that resolves to the user information JSON.\n */\nconst getUserInfoJson = async (data: unknown, config: GoogleConnectorConfig): Promise<Json> => {\n  // Google One Tap\n  const oneTapResult = googleOneTapDataGuard.safeParse(data);\n\n  if (oneTapResult.success) {\n    const { payload } = await jwtVerify<Json>(\n      oneTapResult.data.credential,\n      createRemoteJWKSet(new URL(jwksUri)),\n      {\n        // https://developers.google.com/identity/gsi/web/guides/verify-google-id-token\n        issuer: ['https://accounts.google.com', 'accounts.google.com'],\n        audience: config.clientId,\n        clockTolerance: 10,\n      }\n    );\n    return payload;\n  }\n\n  // Normal Google OAuth\n  const { code, redirectUri } = await authorizationCallbackHandler(data);\n  const { accessToken } = await getAccessToken(config, { code, redirectUri });\n\n  const httpResponse = await got.post(userInfoEndpoint, {\n    headers: {\n      authorization: `Bearer ${accessToken}`,\n    },\n    timeout: { request: defaultTimeout },\n  });\n  return parseJson(httpResponse.body);\n};\n\nconst getUserInfo =\n  (getConfig: GetConnectorConfig): GetUserInfo =>\n  async (data) => {\n    const config = await getConfig(defaultMetadata.id);\n    validateConfig(config, GoogleConnector.configGuard);\n\n    try {\n      const rawData = await getUserInfoJson(data, config);\n      const result = userInfoResponseGuard.safeParse(rawData);\n\n      if (!result.success) {\n        throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);\n      }\n\n      const { sub: id, picture: avatar, email, email_verified, name } = result.data;\n\n      return {\n        id,\n        avatar,\n        email: conditional(email_verified && email),\n        name,\n        rawData,\n      };\n    } catch (error: unknown) {\n      return getUserInfoErrorHandler(error);\n    }\n  };\n\nconst authorizationCallbackHandler = async (parameterObject: unknown) => {\n  const result = authResponseGuard.safeParse(parameterObject);\n\n  if (!result.success) {\n    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));\n  }\n\n  return result.data;\n};\n\nconst getUserInfoErrorHandler = (error: unknown) => {\n  if (error instanceof HTTPError) {\n    const { statusCode, body: rawBody } = error.response;\n\n    if (statusCode === 401) {\n      throw new ConnectorError(ConnectorErrorCodes.SocialAccessTokenInvalid);\n    }\n\n    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(rawBody));\n  }\n\n  throw error;\n};\n\nconst createGoogleConnector: CreateConnector<SocialConnector> = async ({ getConfig }) => {\n  return {\n    metadata: defaultMetadata,\n    type: ConnectorType.Social,\n    configGuard: GoogleConnector.configGuard,\n    getAuthorizationUri: getAuthorizationUri(getConfig),\n    getUserInfo: getUserInfo(getConfig),\n  };\n};\n\nexport default createGoogleConnector;\n","import type { ConnectorMetadata } from '@logto/connector-kit';\nimport {\n  ConnectorConfigFormItemType,\n  ConnectorPlatform,\n  GoogleConnector,\n  OidcPrompt,\n} from '@logto/connector-kit';\n\nexport const authorizationEndpoint = 'https://accounts.google.com/o/oauth2/v2/auth';\nexport const accessTokenEndpoint = 'https://oauth2.googleapis.com/token';\nexport const userInfoEndpoint = 'https://openidconnect.googleapis.com/v1/userinfo';\nexport const scope = 'openid profile email';\n\n// Instead of defining the metadata in the connector, we reuse the metadata from the connector-kit.\n// This is not the normal practice, but Google One Tap is a special case.\n// @see {@link GoogleConnector} for more information.\nexport const defaultMetadata: ConnectorMetadata = {\n  id: GoogleConnector.factoryId,\n  target: GoogleConnector.target,\n  platform: ConnectorPlatform.Universal,\n  name: {\n    en: 'Google',\n    'zh-CN': 'Google',\n    'tr-TR': 'Google',\n    ko: 'Google',\n  },\n  logo: './logo.svg',\n  logoDark: null,\n  description: {\n    en: 'Google is a principal search engine technology and email service provider.',\n    'zh-CN': 'Google 是全球性的搜索引擎和邮件服务提供商。',\n    'tr-TR': 'Google, en büyük arama motoru teknolojisi ve e-posta servis sağlayıcısıdır.',\n    ko: 'Google은 가장 큰 검색 엔진 기술과 이메일 서비스 제공자입니다.',\n  },\n  readme: './README.md',\n  formItems: [\n    {\n      key: 'clientId',\n      type: ConnectorConfigFormItemType.Text,\n      label: 'Client ID',\n      required: true,\n      placeholder: '<client-id>',\n    },\n    {\n      key: 'clientSecret',\n      type: ConnectorConfigFormItemType.Text,\n      label: 'Client Secret',\n      required: true,\n      placeholder: '<client-secret>',\n    },\n    {\n      key: 'scope',\n      type: ConnectorConfigFormItemType.Text,\n      label: 'Scope',\n      required: false,\n      placeholder: '<scope>',\n      description:\n        \"The `scope` determines permissions granted by the user's authorization. If you are not sure what to enter, do not worry, just leave it blank.\",\n    },\n    {\n      key: 'prompts',\n      type: ConnectorConfigFormItemType.MultiSelect,\n      required: false,\n      label: 'Prompts',\n      // Google does not support `login` prompt.\n      // Ref: https://developers.google.com/identity/openid-connect/openid-connect#authenticationuriparameters\n      selectItems: Object.values(OidcPrompt)\n        .filter((prompt) => prompt !== OidcPrompt.Login)\n        .map((prompt) => ({\n          value: prompt,\n        })),\n    },\n  ],\n};\n\nexport const defaultTimeout = 5000;\n\n// https://developers.google.com/identity/gsi/web/guides/verify-google-id-token\nexport const jwksUri = 'https://www.googleapis.com/oauth2/v3/certs';\n","import { z } from 'zod';\n\nimport { GoogleConnector } from '@logto/connector-kit';\n\nexport const accessTokenResponseGuard = z.object({\n  access_token: z.string(),\n  scope: z.string(),\n  token_type: z.string(),\n});\n\nexport type AccessTokenResponse = z.infer<typeof accessTokenResponseGuard>;\n\nexport const userInfoResponseGuard = z.object({\n  sub: z.string(),\n  name: z.string().optional(),\n  given_name: z.string().optional(),\n  family_name: z.string().optional(),\n  picture: z.string().optional(),\n  email: z.string().optional(),\n  email_verified: z.boolean().optional(),\n  locale: z.string().optional(),\n});\n\nexport type UserInfoResponse = z.infer<typeof userInfoResponseGuard>;\n\nexport const authResponseGuard = z.object({\n  code: z.string(),\n  redirectUri: z.string(),\n});\n\n/**\n * Response payload from Google One Tap. Note the CSRF token is not included since it should be\n * verified by the web server.\n */\nexport const googleOneTapDataGuard = z.object({\n  [GoogleConnector.oneTapParams.credential]: z.string(),\n});\n"],"mappings":";AAIA,SAAS,aAAa,cAAc;AACpC,SAAS,KAAK,iBAAiB;AAU/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAAA;AAAA,OACK;AACP,SAAS,oBAAoB,iBAAiB;;;ACtB9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,IAAM,wBAAwB;AAC9B,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AACzB,IAAM,QAAQ;AAKd,IAAM,kBAAqC;AAAA,EAChD,IAAI,gBAAgB;AAAA,EACpB,QAAQ,gBAAgB;AAAA,EACxB,UAAU,kBAAkB;AAAA,EAC5B,MAAM;AAAA,IACJ,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,IAAI;AAAA,EACN;AAAA,EACA,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,IACX,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,SAAS;AAAA,IACT,IAAI;AAAA,EACN;AAAA,EACA,QAAQ;AAAA,EACR,WAAW;AAAA,IACT;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,MACb,aACE;AAAA,IACJ;AAAA,IACA;AAAA,MACE,KAAK;AAAA,MACL,MAAM,4BAA4B;AAAA,MAClC,UAAU;AAAA,MACV,OAAO;AAAA;AAAA;AAAA,MAGP,aAAa,OAAO,OAAO,UAAU,EAClC,OAAO,CAAC,WAAW,WAAW,WAAW,KAAK,EAC9C,IAAI,CAAC,YAAY;AAAA,QAChB,OAAO;AAAA,MACT,EAAE;AAAA,IACN;AAAA,EACF;AACF;AAEO,IAAM,iBAAiB;AAGvB,IAAM,UAAU;;;AC9EvB,SAAS,SAAS;AAElB,SAAS,mBAAAC,wBAAuB;AAEzB,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,cAAc,EAAE,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,OAAO;AACvB,CAAC;AAIM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAIM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO;AACxB,CAAC;AAMM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,CAACA,iBAAgB,aAAa,UAAU,GAAG,EAAE,OAAO;AACtD,CAAC;;;AFKD,IAAM,sBACJ,CAAC,cACD,OAAO,EAAE,OAAO,YAAY,MAAM;AAChC,QAAM,SAAS,MAAM,UAAU,gBAAgB,EAAE;AACjD,iBAAe,QAAQC,iBAAgB,WAAW;AAElD,QAAM,EAAE,UAAU,OAAAC,QAAO,QAAQ,IAAI;AAErC,QAAM,kBAAkB,IAAI,gBAAgB;AAAA,IAC1C,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf;AAAA,IACA,OAAOA,UAAS;AAAA,IAChB,GAAG,YAAY,WAAW,QAAQ,SAAS,KAAK,EAAE,QAAQ,QAAQ,KAAK,GAAG,EAAE,CAAC;AAAA,EAC/E,CAAC;AAED,SAAO,GAAG,qBAAqB,IAAI,gBAAgB,SAAS,CAAC;AAC/D;AAEK,IAAM,iBAAiB,OAC5B,QACA,eACG;AACH,QAAM,EAAE,MAAM,YAAY,IAAI;AAC9B,QAAM,EAAE,UAAU,aAAa,IAAI;AAInC,QAAM,eAAe,MAAM,IAAI,KAAK,qBAAqB;AAAA,IACvD,MAAM;AAAA,MACJ,MAAM,mBAAmB,IAAI;AAAA,MAC7B,WAAW;AAAA,MACX,eAAe;AAAA,MACf,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,IACA,SAAS,EAAE,SAAS,eAAe;AAAA,EACrC,CAAC;AAED,QAAM,SAAS,yBAAyB,UAAU,UAAU,aAAa,IAAI,CAAC;AAE9E,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,eAAe,oBAAoB,iBAAiB,OAAO,KAAK;AAAA,EAC5E;AAEA,QAAM,EAAE,cAAc,YAAY,IAAI,OAAO;AAE7C,SAAO,aAAa,IAAI,eAAe,oBAAoB,qBAAqB,CAAC;AAEjF,SAAO,EAAE,YAAY;AACvB;AAeA,IAAM,kBAAkB,OAAO,MAAe,WAAiD;AAE7F,QAAM,eAAe,sBAAsB,UAAU,IAAI;AAEzD,MAAI,aAAa,SAAS;AACxB,UAAM,EAAE,QAAQ,IAAI,MAAM;AAAA,MACxB,aAAa,KAAK;AAAA,MAClB,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAAA,MACnC;AAAA;AAAA,QAEE,QAAQ,CAAC,+BAA+B,qBAAqB;AAAA,QAC7D,UAAU,OAAO;AAAA,QACjB,gBAAgB;AAAA,MAClB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,QAAM,EAAE,MAAM,YAAY,IAAI,MAAM,6BAA6B,IAAI;AACrE,QAAM,EAAE,YAAY,IAAI,MAAM,eAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1E,QAAM,eAAe,MAAM,IAAI,KAAK,kBAAkB;AAAA,IACpD,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,IACtC;AAAA,IACA,SAAS,EAAE,SAAS,eAAe;AAAA,EACrC,CAAC;AACD,SAAO,UAAU,aAAa,IAAI;AACpC;AAEA,IAAM,cACJ,CAAC,cACD,OAAO,SAAS;AACd,QAAM,SAAS,MAAM,UAAU,gBAAgB,EAAE;AACjD,iBAAe,QAAQD,iBAAgB,WAAW;AAElD,MAAI;AACF,UAAM,UAAU,MAAM,gBAAgB,MAAM,MAAM;AAClD,UAAM,SAAS,sBAAsB,UAAU,OAAO;AAEtD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,eAAe,oBAAoB,iBAAiB,OAAO,KAAK;AAAA,IAC5E;AAEA,UAAM,EAAE,KAAK,IAAI,SAAS,QAAQ,OAAO,gBAAgB,KAAK,IAAI,OAAO;AAEzE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,OAAO,YAAY,kBAAkB,KAAK;AAAA,MAC1C;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAgB;AACvB,WAAO,wBAAwB,KAAK;AAAA,EACtC;AACF;AAEF,IAAM,+BAA+B,OAAO,oBAA6B;AACvE,QAAM,SAAS,kBAAkB,UAAU,eAAe;AAE1D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,eAAe,oBAAoB,SAAS,KAAK,UAAU,eAAe,CAAC;AAAA,EACvF;AAEA,SAAO,OAAO;AAChB;AAEA,IAAM,0BAA0B,CAAC,UAAmB;AAClD,MAAI,iBAAiB,WAAW;AAC9B,UAAM,EAAE,YAAY,MAAM,QAAQ,IAAI,MAAM;AAE5C,QAAI,eAAe,KAAK;AACtB,YAAM,IAAI,eAAe,oBAAoB,wBAAwB;AAAA,IACvE;AAEA,UAAM,IAAI,eAAe,oBAAoB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,EAC/E;AAEA,QAAM;AACR;AAEA,IAAM,wBAA0D,OAAO,EAAE,UAAU,MAAM;AACvF,SAAO;AAAA,IACL,UAAU;AAAA,IACV,MAAM,cAAc;AAAA,IACpB,aAAaA,iBAAgB;AAAA,IAC7B,qBAAqB,oBAAoB,SAAS;AAAA,IAClD,aAAa,YAAY,SAAS;AAAA,EACpC;AACF;AAEA,IAAO,cAAQ;","names":["GoogleConnector","GoogleConnector","GoogleConnector","scope"]}

package/package.json

@@ -1,10 +1,15 @@
 {
   "name": "@logto/connector-google",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Google web connector implementation.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "dependencies": {
-    "@logto/connector-kit": "^3.0.0"
+    "@logto/connector-kit": "^4.0.0",
+    "@silverhand/essentials": "^2.9.1",
+    "got": "^14.0.0",
+    "jose": "^5.6.3",
+    "snakecase-keys": "^8.0.1",
+    "zod": "^3.23.8"
   },
   "main": "./lib/index.js",
   "module": "./lib/index.js",
@@ -36,11 +41,26 @@
   "publishConfig": {
     "access": "public"
   },
+  "devDependencies": {
+    "@silverhand/eslint-config": "6.0.1",
+    "@silverhand/ts-config": "6.0.0",
+    "@types/node": "^20.11.20",
+    "@types/supertest": "^6.0.2",
+    "@vitest/coverage-v8": "^2.0.0",
+    "eslint": "^8.56.0",
+    "lint-staged": "^15.0.2",
+    "nock": "^13.3.1",
+    "prettier": "^3.0.0",
+    "supertest": "^7.0.0",
+    "tsup": "^8.1.0",
+    "typescript": "^5.5.3",
+    "vitest": "^2.0.0"
+  },
   "scripts": {
     "precommit": "lint-staged",
-    "build:test": "rm -rf lib/ && tsc -p tsconfig.test.json --sourcemap",
-    "build": "rm -rf lib/ && tsc -p tsconfig.build.json --noEmit && rollup -c",
-    "dev": "tsc -p tsconfig.build.json --watch --preserveWatchOutput --incremental",
+    "check": "tsc --noEmit",
+    "build": "tsup",
+    "dev": "tsup --watch",
     "lint": "eslint --ext .ts src",
     "lint:report": "pnpm lint --format json --output-file report.json",
     "test": "vitest src",

package/lib/constant.d.ts

@@ -1,7 +0,0 @@
-import type { ConnectorMetadata } from '@logto/connector-kit';
-export declare const authorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
-export declare const accessTokenEndpoint = "https://oauth2.googleapis.com/token";
-export declare const userInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo";
-export declare const scope = "openid profile email";
-export declare const defaultMetadata: ConnectorMetadata;
-export declare const defaultTimeout = 5000;

package/lib/index.d.ts

@@ -1,10 +0,0 @@
-import type { CreateConnector, SocialConnector } from '@logto/connector-kit';
-import type { GoogleConfig } from './types.js';
-export declare const getAccessToken: (config: GoogleConfig, codeObject: {
-    code: string;
-    redirectUri: string;
-}) => Promise<{
-    accessToken: string;
-}>;
-declare const createGoogleConnector: CreateConnector<SocialConnector>;
-export default createGoogleConnector;

package/lib/mock.d.ts

@@ -1,4 +0,0 @@
-export declare const mockedConfig: {
-    clientId: string;
-    clientSecret: string;
-};

package/lib/types.d.ts

@@ -1,68 +0,0 @@
-import { z } from 'zod';
-export declare const googleConfigGuard: z.ZodObject<{
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    clientSecret: string;
-    scope?: string | undefined;
-}, {
-    clientId: string;
-    clientSecret: string;
-    scope?: string | undefined;
-}>;
-export type GoogleConfig = z.infer<typeof googleConfigGuard>;
-export declare const accessTokenResponseGuard: z.ZodObject<{
-    access_token: z.ZodString;
-    scope: z.ZodString;
-    token_type: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    scope: string;
-    access_token: string;
-    token_type: string;
-}, {
-    scope: string;
-    access_token: string;
-    token_type: string;
-}>;
-export type AccessTokenResponse = z.infer<typeof accessTokenResponseGuard>;
-export declare const userInfoResponseGuard: z.ZodObject<{
-    sub: z.ZodString;
-    name: z.ZodOptional<z.ZodString>;
-    given_name: z.ZodOptional<z.ZodString>;
-    family_name: z.ZodOptional<z.ZodString>;
-    picture: z.ZodOptional<z.ZodString>;
-    email: z.ZodOptional<z.ZodString>;
-    email_verified: z.ZodOptional<z.ZodBoolean>;
-    locale: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    sub: string;
-    name?: string | undefined;
-    given_name?: string | undefined;
-    family_name?: string | undefined;
-    picture?: string | undefined;
-    email?: string | undefined;
-    email_verified?: boolean | undefined;
-    locale?: string | undefined;
-}, {
-    sub: string;
-    name?: string | undefined;
-    given_name?: string | undefined;
-    family_name?: string | undefined;
-    picture?: string | undefined;
-    email?: string | undefined;
-    email_verified?: boolean | undefined;
-    locale?: string | undefined;
-}>;
-export type UserInfoResponse = z.infer<typeof userInfoResponseGuard>;
-export declare const authResponseGuard: z.ZodObject<{
-    code: z.ZodString;
-    redirectUri: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    code: string;
-    redirectUri: string;
-}, {
-    code: string;
-    redirectUri: string;
-}>;