@moteurio/plugin-auth-github 2026.10.23-2 → 2026.10.28

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC7G,OAAO,EAMH,KAAK,iBAAiB,IAAI,aAAa,EAC1C,MAAM,sBAAsB,CAAC;AAM9B,eAAO,MAAM,QAAQ,EAAE,cAOtB,CAAC;AAEF,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAAG;AAiGlD,wBAAgB,SAAS,CAAC,GAAG,EAAE,kBAAkB,GAAG,uBAAuB,CAM1E;AAED,wBAAgB,gBAAgB;;;;;;IAU/B;;;;;;;AAED,wBAA+D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACR,cAAc,EACd,kBAAkB,EAClB,uBAAuB,EAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAOH,KAAK,iBAAiB,IAAI,aAAa,EAC1C,MAAM,sBAAsB,CAAC;AAM9B,eAAO,MAAM,QAAQ,EAAE,cAYtB,CAAC;AAEF,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAAG;AAsHlD,wBAAgB,SAAS,CAAC,GAAG,EAAE,kBAAkB,GAAG,uBAAuB,CAM1E;AAED,wBAAgB,gBAAgB;;;;;;IAU/B;;;;;;;AAED,wBAA+D"}

package/dist/index.js

@@ -3,8 +3,8 @@
  */
 import { Router } from 'express';
 import axios from 'axios';
-import { beginOAuth, completeOAuth, oauthConfig, redirectAfterLogin, redirectLoginFailed } from '@moteurio/plugin-sdk';
-import { loginWithProvider } from '@moteurio/core/auth.js';
+import { beginOAuth, completeOAuth, oauthChallenge, oauthConfig, redirectProviderSignIn, redirectLoginFailed } from '@moteurio/plugin-sdk';
+import { startProviderSignIn } from '@moteurio/core/host.js';
 const NOT_OFFERED = { error: 'GitHub sign-in is not available on this server.' };
 export const manifest = {
     id: 'auth-github',
@@ -12,7 +12,12 @@ export const manifest = {
     description: 'Sign in with GitHub',
     source: 'opensource',
     kind: 'optional',
-    scope: 'global'
+    scope: 'global',
+    categories: ['auth'],
+    contributes: {
+        api: { mounts: ['/auth'], openApi: true },
+        auth: { providers: ['github'] }
+    }
 };
 export function init(_ctx) { }
 function createGitHubRouter(ctx) {
@@ -23,11 +28,14 @@ function createGitHubRouter(ctx) {
             res.status(404).json(NOT_OFFERED);
             return;
         }
+        const state = beginOAuth(req, res, 'github');
         const params = new URLSearchParams({
             client_id: config.clientId,
             redirect_uri: config.redirectUri,
             scope: 'read:user user:email',
-            state: beginOAuth(req, res, 'github')
+            state,
+            code_challenge: oauthChallenge(state),
+            code_challenge_method: 'S256'
         });
         res.redirect(`https://github.com/login/oauth/authorize?${params.toString()}`);
     });
@@ -48,6 +56,7 @@ function createGitHubRouter(ctx) {
                 client_id: config.clientId,
                 client_secret: config.clientSecret,
                 code,
+                code_verifier: started.verifier,
                 redirect_uri: config.redirectUri
             }, { headers: { Accept: 'application/json' } });
             const accessToken = tokenRes.data.access_token;
@@ -58,12 +67,18 @@ function createGitHubRouter(ctx) {
                 axios.get('https://api.github.com/user', { headers }),
                 axios.get('https://api.github.com/user/emails', { headers })
             ]);
-            const email = emailsRes.data.find((e) => e.primary && e.verified)?.email;
-            if (!email)
-                return redirectLoginFailed(res, 'email');
+            const email = emailsRes.data.find((e) => e.primary === true && e.verified === true && typeof e.email === 'string')?.email;
             const profile = userRes.data;
-            const { token } = await loginWithProvider({ auth: { githubId: profile.id }, email, name: profile.name || profile.login }, ctx.authCallbacks?.runOnboardingForNewUser);
-            redirectAfterLogin(res, token, started.next);
+            if (!(typeof profile.id === 'number' && Number.isFinite(profile.id)))
+                return redirectLoginFailed(res, 'failed');
+            const suggestedEmail = emailsRes.data.find((item) => item.primary === true && typeof item.email === 'string')?.email;
+            const result = await startProviderSignIn({
+                auth: { githubId: profile.id },
+                email: email ?? '',
+                suggestedEmail,
+                name: profile.name || profile.login
+            }, ctx.authCallbacks?.runOnboardingForNewUser, { link: started.link });
+            redirectProviderSignIn(req, res, result, started.next);
         }
         catch (err) {
             if (err instanceof Error && err.message === 'User is not active') {
@@ -81,7 +96,9 @@ const openapi = {
             summary: 'Redirect to GitHub login',
             tags: ['Auth'],
             description: "Redirects the user to GitHub's OAuth login screen. `next` (a path in the app) is where they land after signing in.",
-            parameters: [{ name: 'next', in: 'query', required: false, schema: { type: 'string' } }],
+            parameters: [
+                { name: 'next', in: 'query', required: false, schema: { type: 'string' } }
+            ],
             responses: { '302': { description: 'Redirect to GitHub OAuth screen' } }
         }
     },
@@ -89,12 +106,16 @@ const openapi = {
         get: {
             summary: 'GitHub OAuth callback',
             tags: ['Auth'],
-            description: 'Checks `state` against the browser that started the sign-in, creates or reuses the account with the verified primary email, then redirects to `AUTH_REDIRECT_AFTER_LOGIN` with `#token=…&next=…`, or `#error=state|email|inactive|failed`.',
+            description: 'Checks `state` against the browser that started the sign-in, matches the provider identity or starts browser-bound verification/linking, then redirects to `AUTH_REDIRECT_AFTER_LOGIN` with `#token=…&next=…`, or `#error=state|email|inactive|failed`.',
             parameters: [
                 { name: 'code', in: 'query', required: true, schema: { type: 'string' } },
                 { name: 'state', in: 'query', required: true, schema: { type: 'string' } }
             ],
-            responses: { '302': { description: 'Redirect to the app with a token or an error in the fragment' } }
+            responses: {
+                '302': {
+                    description: 'Redirect to the app with a token or an error in the fragment'
+                }
+            }
         }
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moteurio/plugin-auth-github",
-  "version": "2026.10.23-2",
+  "version": "2026.10.28",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -11,14 +11,19 @@
     "dist"
   ],
   "dependencies": {
-    "@moteurio/core": "^2026.10.23-2",
-    "@moteurio/plugin-sdk": "^2026.10.23-2",
-    "@moteurio/types": "^2026.10.23-2",
     "axios": "^1.13.6",
     "express": "^4.19.2",
     "openapi-types": "^12.1.3"
   },
+  "peerDependencies": {
+    "@moteurio/core": "^2026.10.28",
+    "@moteurio/plugin-sdk": "^2026.10.28",
+    "@moteurio/types": "^2026.10.28"
+  },
   "devDependencies": {
+    "@moteurio/core": "^2026.10.28",
+    "@moteurio/plugin-sdk": "^2026.10.28",
+    "@moteurio/types": "^2026.10.28",
     "@types/express": "^5.0.3"
   },
   "license": "MIT",