@moteurio/plugin-auth-github 2026.10.23 → 2026.10.31

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC7G,OAAO,EAMH,KAAK,iBAAiB,IAAI,aAAa,EAC1C,MAAM,sBAAsB,CAAC;AAM9B,eAAO,MAAM,QAAQ,EAAE,cAOtB,CAAC;AAEF,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAAG;AAiGlD,wBAAgB,SAAS,CAAC,GAAG,EAAE,kBAAkB,GAAG,uBAAuB,CAM1E;AAED,wBAAgB,gBAAgB;;;;;;IAU/B;;;;;;;AAED,wBAA+D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACR,cAAc,EACd,kBAAkB,EAClB,uBAAuB,EAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAOH,KAAK,iBAAiB,IAAI,aAAa,EAC1C,MAAM,sBAAsB,CAAC;AAM9B,eAAO,MAAM,QAAQ,EAAE,cAYtB,CAAC;AAEF,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAAG;AAsHlD,wBAAgB,SAAS,CAAC,GAAG,EAAE,kBAAkB,GAAG,uBAAuB,CAM1E;AAED,wBAAgB,gBAAgB;;;;;;IAU/B;;;;;;;AAED,wBAA+D"}

package/dist/index.js

@@ -3,8 +3,8 @@
  */
 import { Router } from 'express';
 import axios from 'axios';
-import { beginOAuth, completeOAuth, oauthConfig, redirectAfterLogin, redirectLoginFailed } from '@moteurio/plugin-sdk';
-import { loginWithProvider } from '@moteurio/core/auth.js';
+import { beginOAuth, completeOAuth, oauthChallenge, oauthConfig, redirectProviderSignIn, redirectLoginFailed } from '@moteurio/plugin-sdk';
+import { startProviderSignIn } from '@moteurio/core/host.js';
 const NOT_OFFERED = { error: 'GitHub sign-in is not available on this server.' };
 export const manifest = {
     id: 'auth-github',
@@ -12,7 +12,12 @@ export const manifest = {
     description: 'Sign in with GitHub',
     source: 'opensource',
     kind: 'optional',
-    scope: 'global'
+    scope: 'global',
+    categories: ['auth'],
+    contributes: {
+        api: { mounts: ['/auth'], openApi: true },
+        auth: { providers: ['github'] }
+    }
 };
 export function init(_ctx) { }
 function createGitHubRouter(ctx) {
@@ -23,11 +28,14 @@ function createGitHubRouter(ctx) {
             res.status(404).json(NOT_OFFERED);
             return;
         }
+        const state = beginOAuth(req, res, 'github');
         const params = new URLSearchParams({
             client_id: config.clientId,
             redirect_uri: config.redirectUri,
             scope: 'read:user user:email',
-            state: beginOAuth(req, res, 'github')
+            state,
+            code_challenge: oauthChallenge(state),
+            code_challenge_method: 'S256'
         });
         res.redirect(`https://github.com/login/oauth/authorize?${params.toString()}`);
     });
@@ -48,6 +56,7 @@ function createGitHubRouter(ctx) {
                 client_id: config.clientId,
                 client_secret: config.clientSecret,
                 code,
+                code_verifier: started.verifier,
                 redirect_uri: config.redirectUri
             }, { headers: { Accept: 'application/json' } });
             const accessToken = tokenRes.data.access_token;
@@ -58,12 +67,18 @@ function createGitHubRouter(ctx) {
                 axios.get('https://api.github.com/user', { headers }),
                 axios.get('https://api.github.com/user/emails', { headers })
             ]);
-            const email = emailsRes.data.find((e) => e.primary && e.verified)?.email;
-            if (!email)
-                return redirectLoginFailed(res, 'email');
+            const email = emailsRes.data.find((e) => e.primary === true && e.verified === true && typeof e.email === 'string')?.email;
             const profile = userRes.data;
-            const { token } = await loginWithProvider({ auth: { githubId: profile.id }, email, name: profile.name || profile.login }, ctx.authCallbacks?.runOnboardingForNewUser);
-            redirectAfterLogin(res, token, started.next);
+            if (!(typeof profile.id === 'number' && Number.isFinite(profile.id)))
+                return redirectLoginFailed(res, 'failed');
+            const suggestedEmail = emailsRes.data.find((item) => item.primary === true && typeof item.email === 'string')?.email;
+            const result = await startProviderSignIn({
+                auth: { githubId: profile.id },
+                email: email ?? '',
+                suggestedEmail,
+                name: profile.name || profile.login
+            }, ctx.authCallbacks?.runOnboardingForNewUser, { link: started.link });
+            redirectProviderSignIn(req, res, result, started.next);
         }
         catch (err) {
             if (err instanceof Error && err.message === 'User is not active') {
@@ -81,7 +96,9 @@ const openapi = {
             summary: 'Redirect to GitHub login',
             tags: ['Auth'],
             description: "Redirects the user to GitHub's OAuth login screen. `next` (a path in the app) is where they land after signing in.",
-            parameters: [{ name: 'next', in: 'query', required: false, schema: { type: 'string' } }],
+            parameters: [
+                { name: 'next', in: 'query', required: false, schema: { type: 'string' } }
+            ],
             responses: { '302': { description: 'Redirect to GitHub OAuth screen' } }
         }
     },
@@ -89,12 +106,16 @@ const openapi = {
         get: {
             summary: 'GitHub OAuth callback',
             tags: ['Auth'],
-            description: 'Checks `state` against the browser that started the sign-in, creates or reuses the account with the verified primary email, then redirects to `AUTH_REDIRECT_AFTER_LOGIN` with `#token=…&next=…`, or `#error=state|email|inactive|failed`.',
+            description: 'Checks `state` against the browser that started the sign-in, matches the provider identity or starts browser-bound verification/linking, then redirects to `AUTH_REDIRECT_AFTER_LOGIN` with `#token=…&next=…`, or `#error=state|email|inactive|failed`.',
             parameters: [
                 { name: 'code', in: 'query', required: true, schema: { type: 'string' } },
                 { name: 'state', in: 'query', required: true, schema: { type: 'string' } }
             ],
-            responses: { '302': { description: 'Redirect to the app with a token or an error in the fragment' } }
+            responses: {
+                '302': {
+                    description: 'Redirect to the app with a token or an error in the fragment'
+                }
+            }
         }
     }
 };

package/package.json

@@ -1,34 +1,38 @@
 {
-    "name":  "@moteurio/plugin-auth-github",
-    "version": "2026.10.23",
-    "type":  "module",
-    "main":  "./dist/index.js",
-    "types":  "./dist/index.d.ts",
-    "exports":  {
-                    ".":  "./dist/index.js"
-                },
-    "files":  [
-                  "dist"
-              ],
-    "scripts":  {
-                    "build":  "tsc -b",
-                    "clean":  "rimraf dist",
-                    "prepublishOnly":  "pnpm run build",
-                    "test":  "vitest run --passWithNoTests"
-                },
-    "dependencies":  {
-                         "@moteurio/core":  "^2026.10.23",
-                         "@moteurio/plugin-sdk":  "^2026.10.23",
-                         "@moteurio/types":  "^2026.10.23",
-                         "axios":  "^1.13.6",
-                         "express":  "^4.19.2",
-                         "openapi-types":  "^12.1.3"
-                     },
-    "devDependencies":  {
-                            "@types/express":  "^5.0.3"
-                        },
-    "license":  "MIT",
-    "publishConfig":  {
-                          "access":  "public"
-                      }
+  "name": "@moteurio/plugin-auth-github",
+  "version": "2026.10.31",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "axios": "^1.13.6",
+    "express": "^4.19.2",
+    "openapi-types": "^12.1.3"
+  },
+  "peerDependencies": {
+    "@moteurio/core": "^2026.10.31",
+    "@moteurio/plugin-sdk": "^2026.10.31",
+    "@moteurio/types": "^2026.10.31"
+  },
+  "devDependencies": {
+    "@moteurio/core": "^2026.10.31",
+    "@moteurio/plugin-sdk": "^2026.10.31",
+    "@moteurio/types": "^2026.10.31",
+    "@types/express": "^5.0.3"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "clean": "rimraf dist",
+    "test": "vitest run --passWithNoTests"
+  }
 }