@lovable.dev/cloud-auth-js 1.1.3-dev.16 → 1.1.3-dev.17

package/dist/server.js

@@ -1,322 +0,0 @@
-// src/server.ts
-import { betterAuth } from "better-auth";
-import { memoryAdapter } from "better-auth/adapters/memory";
-import { genericOAuth } from "better-auth/plugins";
-import { createRemoteJWKSet, jwtVerify } from "jose";
-var DEFAULT_PROVIDER_ID = "lovable";
-var DEFAULT_SCOPES = ["openid", "offline", "email", "profile"];
-var POPUP_MESSAGE_TYPE = "lovable:better-auth-popup-complete";
-var POPUP_START_SUFFIX = "/lovable-popup/start";
-var POPUP_COMPLETE_SUFFIX = "/lovable-popup/complete";
-var globalForDb = globalThis;
-function getMemoryDb() {
-  globalForDb.__lovableCloudAuthMemoryDb ?? (globalForDb.__lovableCloudAuthMemoryDb = {
-    user: [],
-    session: [],
-    account: [],
-    verification: []
-  });
-  return globalForDb.__lovableCloudAuthMemoryDb;
-}
-function getEnv() {
-  if (typeof process === "undefined")
-    return {};
-  return process.env;
-}
-function parseList(value) {
-  const entries = value?.split(",").map((entry) => entry.trim()).filter(Boolean);
-  return entries && entries.length > 0 ? entries : void 0;
-}
-function required(name, value) {
-  if (value)
-    return value;
-  throw new Error(`Missing required env var: ${name}`);
-}
-function resolveTrustedOrigins(options) {
-  const env = options.env ?? getEnv();
-  return options.trustedOrigins ?? parseList(env.LOVABLE_AUTH_TRUSTED_ORIGINS) ?? [];
-}
-function originToHost(origin) {
-  try {
-    return new URL(origin).host;
-  } catch {
-    return void 0;
-  }
-}
-function resolveAuthBaseURL(authBaseURL, fallbackBaseURL, trustedOrigins) {
-  if (authBaseURL !== void 0)
-    return authBaseURL;
-  const allowedHosts = trustedOrigins.map(originToHost).filter((host) => Boolean(host));
-  if (allowedHosts.length === 0)
-    return fallbackBaseURL;
-  return {
-    allowedHosts,
-    ...fallbackBaseURL ? { fallback: fallbackBaseURL } : {}
-  };
-}
-function isDynamicAuthBaseURL(baseURL) {
-  return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL;
-}
-function resolveDefaultCookieAttributes(isIframe, configured) {
-  return {
-    sameSite: isIframe ? "none" : "lax",
-    secure: true,
-    ...configured
-  };
-}
-function getIdToken(tokens) {
-  if (!tokens || typeof tokens !== "object")
-    return void 0;
-  const fields = tokens;
-  if (typeof fields.idToken === "string")
-    return fields.idToken;
-  if (typeof fields.id_token === "string")
-    return fields.id_token;
-  if (typeof fields.raw?.id_token === "string")
-    return fields.raw.id_token;
-  return void 0;
-}
-async function fetchOpenIdConfiguration(discoveryUrl) {
-  const response = await fetch(discoveryUrl);
-  if (!response.ok)
-    throw new Error(`Failed to fetch OAuth discovery document: ${response.status}`);
-  const json = await response.json();
-  if (typeof json.issuer !== "string" || typeof json.jwks_uri !== "string") {
-    throw new Error("Invalid OAuth discovery document");
-  }
-  return { issuer: json.issuer, jwksUri: json.jwks_uri };
-}
-function getStringClaim(payload, name) {
-  const value = payload[name];
-  return typeof value === "string" ? value : void 0;
-}
-function getBooleanClaim(payload, name) {
-  const value = payload[name];
-  return typeof value === "boolean" ? value : void 0;
-}
-function toVerifiedIdTokenClaims(payload) {
-  const sub = getStringClaim(payload, "sub");
-  if (!sub)
-    throw new Error("Invalid id_token subject");
-  return {
-    sub,
-    email: getStringClaim(payload, "email"),
-    email_verified: getBooleanClaim(payload, "email_verified"),
-    name: getStringClaim(payload, "name"),
-    picture: getStringClaim(payload, "picture")
-  };
-}
-function createIdTokenVerifier(discoveryUrl, clientId) {
-  let discoveryPromise;
-  let jwks;
-  return async (idToken) => {
-    discoveryPromise ?? (discoveryPromise = fetchOpenIdConfiguration(discoveryUrl));
-    const discovery = await discoveryPromise;
-    jwks ?? (jwks = createRemoteJWKSet(new URL(discovery.jwksUri)));
-    const { payload } = await jwtVerify(idToken, jwks, {
-      issuer: discovery.issuer,
-      audience: clientId,
-      requiredClaims: ["sub"]
-    });
-    return toVerifiedIdTokenClaims(payload);
-  };
-}
-function newAuthServer(options = {}) {
-  const env = options.env ?? getEnv();
-  const tenantId = required("LOVABLE_TENANT_ID", options.tenantId ?? env.LOVABLE_TENANT_ID);
-  const clientId = required("LOVABLE_OAUTH_CLIENT_ID", options.clientId ?? env.LOVABLE_OAUTH_CLIENT_ID);
-  const clientSecret = required("LOVABLE_OAUTH_CLIENT_SECRET", options.clientSecret ?? env.LOVABLE_OAUTH_CLIENT_SECRET);
-  const oauthUpstream = options.oauthUpstream ?? `https://${tenantId}.auth.lovable.app`;
-  const trustedOrigins = resolveTrustedOrigins({ env, trustedOrigins: options.trustedOrigins });
-  const fallbackBaseURL = options.fallbackBaseURL ?? trustedOrigins[0];
-  const authOptions = options.authOptions ?? {};
-  const discoveryUrl = `${oauthUpstream}/.well-known/openid-configuration`;
-  const verifyIdToken = createIdTokenVerifier(discoveryUrl, clientId);
-  const baseURL = resolveAuthBaseURL(authOptions.baseURL, fallbackBaseURL, trustedOrigins);
-  const trustedProxyHeaders = authOptions.advanced?.trustedProxyHeaders ?? isDynamicAuthBaseURL(baseURL);
-  const defaultCookieAttributes = resolveDefaultCookieAttributes(
-    options.isIframe,
-    authOptions.advanced?.defaultCookieAttributes
-  );
-  return betterAuth({
-    ...authOptions,
-    ...baseURL ? { baseURL } : {},
-    trustedOrigins: authOptions.trustedOrigins ?? trustedOrigins,
-    advanced: {
-      ...authOptions.advanced,
-      defaultCookieAttributes,
-      trustedProxyHeaders
-    },
-    secret: authOptions.secret ?? env.LOVABLE_AUTH_SECRET ?? "dev-only-better-auth-secret",
-    database: authOptions.database ?? memoryAdapter(getMemoryDb()),
-    session: authOptions.session ?? {
-      cookieCache: { enabled: true, maxAge: 60 * 5 }
-    },
-    plugins: [
-      genericOAuth({
-        config: [
-          {
-            providerId: options.providerId ?? DEFAULT_PROVIDER_ID,
-            clientId,
-            clientSecret,
-            discoveryUrl,
-            scopes: options.scopes ?? DEFAULT_SCOPES,
-            pkce: true,
-            responseType: "code",
-            authentication: "basic",
-            getUserInfo: async (tokens) => {
-              const idToken = getIdToken(tokens);
-              if (!idToken)
-                throw new Error("No id_token returned from Lovable");
-              const claims = await verifyIdToken(idToken);
-              return {
-                id: claims.sub,
-                email: claims.email ?? `${claims.sub}@users.lovable.app`,
-                emailVerified: claims.email_verified ?? false,
-                name: claims.name ?? claims.email ?? claims.sub,
-                image: claims.picture,
-                createdAt: /* @__PURE__ */ new Date(),
-                updatedAt: /* @__PURE__ */ new Date()
-              };
-            }
-          }
-        ]
-      }),
-      ...authOptions.plugins ?? []
-    ]
-  });
-}
-function isLovablePopupStartRequest(request) {
-  if (request.method !== "GET")
-    return false;
-  return new URL(request.url).pathname.endsWith(POPUP_START_SUFFIX);
-}
-function isLovablePopupCompleteRequest(request) {
-  if (request.method !== "GET")
-    return false;
-  return new URL(request.url).pathname.endsWith(POPUP_COMPLETE_SUFFIX);
-}
-function popupStartAuthBasePath(pathname) {
-  return pathname.slice(0, -POPUP_START_SUFFIX.length) || "/api/auth";
-}
-function popupStartBooleanParam(value) {
-  if (value === null)
-    return void 0;
-  return value === "true";
-}
-function popupStartSignInBody(url) {
-  const scopes = url.searchParams.getAll("scope");
-  return {
-    providerId: url.searchParams.get("providerId") || DEFAULT_PROVIDER_ID,
-    callbackURL: url.searchParams.get("callbackURL") || void 0,
-    errorCallbackURL: url.searchParams.get("errorCallbackURL") || void 0,
-    newUserCallbackURL: url.searchParams.get("newUserCallbackURL") || void 0,
-    scopes: scopes.length > 0 ? scopes : void 0,
-    requestSignUp: popupStartBooleanParam(url.searchParams.get("requestSignUp")),
-    disableRedirect: true
-  };
-}
-function getSetCookieHeaders(headers) {
-  const getSetCookie = headers.getSetCookie;
-  if (getSetCookie)
-    return getSetCookie.call(headers);
-  const setCookie = headers.get("set-cookie");
-  return setCookie ? [setCookie] : [];
-}
-function getOAuthRedirectUrl(data) {
-  if (typeof data.url === "string")
-    return data.url;
-  if (typeof data.redirectURL === "string")
-    return data.redirectURL;
-  if (typeof data.redirectUrl === "string")
-    return data.redirectUrl;
-  return void 0;
-}
-function scriptJson(value) {
-  return JSON.stringify(value).replace(/</g, "\\u003c");
-}
-function handleLovablePopupComplete(request) {
-  const url = new URL(request.url);
-  const error = url.searchParams.get("error_description") || url.searchParams.get("error") || void 0;
-  const message = {
-    type: POPUP_MESSAGE_TYPE,
-    popupId: url.searchParams.get("popupId") || "",
-    ...error ? { error } : {},
-    ...url.searchParams.get("returnTo") ? { returnTo: url.searchParams.get("returnTo") } : {}
-  };
-  const html = `<!doctype html>
-<html>
-<head><meta charset="utf-8"><title>Authentication complete</title></head>
-<body>
-<script>
-(() => {
-  const message = ${scriptJson(message)};
-  const targetOrigin = ${scriptJson(url.origin)};
-  if (window.opener && message.popupId) window.opener.postMessage(message, targetOrigin);
-  window.close();
-  setTimeout(() => {
-    if (!window.closed && message.returnTo) window.location.replace(message.returnTo);
-  }, 250);
-})();
-</script>
-</body>
-</html>`;
-  return new Response(html, {
-    headers: {
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "no-store"
-    }
-  });
-}
-async function handleLovablePopupStart(auth, request) {
-  const url = new URL(request.url);
-  const authBasePath = popupStartAuthBasePath(url.pathname);
-  const signInUrl = new URL(request.url);
-  signInUrl.pathname = `${authBasePath}/sign-in/oauth2`;
-  signInUrl.search = "";
-  const headers = new Headers(request.headers);
-  headers.set("content-type", "application/json");
-  const response = await auth.handler(
-    new Request(signInUrl.toString(), {
-      method: "POST",
-      headers,
-      body: JSON.stringify(popupStartSignInBody(url))
-    })
-  );
-  if (!response.ok)
-    return response;
-  const data = await response.json();
-  const redirectUrl = getOAuthRedirectUrl(data);
-  if (!redirectUrl)
-    return new Response("No OAuth redirect URL received", { status: 500 });
-  const redirectHeaders = new Headers({ location: redirectUrl });
-  for (const setCookie of getSetCookieHeaders(response.headers)) {
-    redirectHeaders.append("set-cookie", setCookie);
-  }
-  return new Response(null, { status: 302, headers: redirectHeaders });
-}
-function createAuthRouteHandler(auth = newAuthServer()) {
-  return ({ request }) => {
-    if (isLovablePopupCompleteRequest(request))
-      return handleLovablePopupComplete(request);
-    if (isLovablePopupStartRequest(request))
-      return handleLovablePopupStart(auth, request);
-    return auth.handler(request);
-  };
-}
-function registerAuthRoutes(options = {}) {
-  const handler = createAuthRouteHandler(options.auth ?? newAuthServer(options));
-  return {
-    server: {
-      handlers: {
-        GET: handler,
-        POST: handler
-      }
-    }
-  };
-}
-export {
-  createAuthRouteHandler,
-  newAuthServer,
-  registerAuthRoutes
-};