@mulverse/mulguard-core 1.0.0

package/lib/utils/env.js

@@ -0,0 +1,96 @@
+import { setLogger } from "./logger.js";
+/**
+ *  Set default env variables on the config object
+ * @param suppressWarnings intended for framework authors.
+ */
+export function setEnvDefaults(envObject, config, suppressBasePathWarning = false) {
+    try {
+        const url = envObject.AUTH_URL;
+        if (url) {
+            if (config.basePath) {
+                if (!suppressBasePathWarning) {
+                    const logger = setLogger(config);
+                    logger.warn("env-url-basepath-redundant");
+                }
+            }
+            else {
+                config.basePath = new URL(url).pathname;
+            }
+        }
+    }
+    catch {
+        // Catching and swallowing potential URL parsing errors, we'll fall
+        // back to `/auth` below.
+    }
+    finally {
+        config.basePath ?? (config.basePath = `/auth`);
+    }
+    if (!config.secret?.length) {
+        config.secret = [];
+        const secret = envObject.AUTH_SECRET;
+        if (secret)
+            config.secret.push(secret);
+        for (const i of [1, 2, 3]) {
+            const secret = envObject[`AUTH_SECRET_${i}`];
+            if (secret)
+                config.secret.unshift(secret);
+        }
+    }
+    config.redirectProxyUrl ?? (config.redirectProxyUrl = envObject.AUTH_REDIRECT_PROXY_URL);
+    config.trustHost ?? (config.trustHost = !!(envObject.AUTH_URL ??
+        envObject.AUTH_TRUST_HOST ??
+        envObject.VERCEL ??
+        envObject.CF_PAGES ??
+        envObject.NODE_ENV !== "production"));
+    config.providers = config.providers.map((provider) => {
+        const { id } = typeof provider === "function" ? provider({}) : provider;
+        const ID = id.toUpperCase().replace(/-/g, "_");
+        const clientId = envObject[`AUTH_${ID}_ID`];
+        const clientSecret = envObject[`AUTH_${ID}_SECRET`];
+        const issuer = envObject[`AUTH_${ID}_ISSUER`];
+        const apiKey = envObject[`AUTH_${ID}_KEY`];
+        const finalProvider = typeof provider === "function"
+            ? provider({ clientId, clientSecret, issuer, apiKey })
+            : provider;
+        if (finalProvider.type === "oauth" || finalProvider.type === "oidc") {
+            finalProvider.clientId ?? (finalProvider.clientId = clientId);
+            finalProvider.clientSecret ?? (finalProvider.clientSecret = clientSecret);
+            finalProvider.issuer ?? (finalProvider.issuer = issuer);
+        }
+        else if (finalProvider.type === "email") {
+            finalProvider.apiKey ?? (finalProvider.apiKey = apiKey);
+        }
+        return finalProvider;
+    });
+}
+export function createActionURL(action, protocol, headers, envObject, config) {
+    const basePath = config?.basePath;
+    const envUrl = envObject.AUTH_URL ?? envObject.NEXTAUTH_URL;
+    let url;
+    if (envUrl) {
+        url = new URL(envUrl);
+        if (basePath && basePath !== "/" && url.pathname !== "/") {
+            if (url.pathname !== basePath) {
+                const logger = setLogger(config);
+                logger.warn("env-url-basepath-mismatch");
+            }
+            url.pathname = "/";
+        }
+    }
+    else {
+        const detectedHost = headers.get("x-forwarded-host") ?? headers.get("host");
+        const detectedProtocol = headers.get("x-forwarded-proto") ?? protocol ?? "https";
+        const _protocol = detectedProtocol.endsWith(":")
+            ? detectedProtocol
+            : detectedProtocol + ":";
+        url = new URL(`${_protocol}//${detectedHost}`);
+    }
+    // remove trailing slash
+    const sanitizedUrl = url.toString().replace(/\/$/, "");
+    if (basePath) {
+        // remove leading and trailing slash
+        const sanitizedBasePath = basePath?.replace(/(^\/|\/$)/g, "") ?? "";
+        return new URL(`${sanitizedUrl}/${sanitizedBasePath}/${action}`);
+    }
+    return new URL(`${sanitizedUrl}/${action}`);
+}

package/lib/utils/logger.d.ts

@@ -0,0 +1,18 @@
+import type { WarningCode } from "../../warnings.js";
+import type { AuthConfig } from "../../index.js";
+/**
+ * Override any of the methods, and the rest will use the default logger.
+ *
+ * [Documentation](https://authjs.dev/reference/core#authconfig#logger)
+ */
+export interface LoggerInstance extends Record<string, Function> {
+    warn: (code: WarningCode) => void;
+    error: (error: Error) => void;
+    debug: (message: string, metadata?: unknown) => void;
+}
+/**
+ * Override the built-in logger with user's implementation.
+ * Any `undefined` level will use the default logger.
+ */
+export declare function setLogger(config: Pick<AuthConfig, "logger" | "debug">): LoggerInstance;
+//# sourceMappingURL=logger.d.ts.map

package/lib/utils/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/utils/logger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD;;;;GAIG;AAEH,MAAM,WAAW,cAAe,SAAQ,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC9D,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAA;IACjC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;IAC7B,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;CACrD;AAwCD;;;GAGG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,GAC3C,cAAc,CAchB"}

package/lib/utils/logger.js

@@ -0,0 +1,50 @@
+import { AuthError } from "../../errors.js";
+const red = "\x1b[31m";
+const yellow = "\x1b[33m";
+const grey = "\x1b[90m";
+const reset = "\x1b[0m";
+const defaultLogger = {
+    error(error) {
+        const name = error instanceof AuthError ? error.type : error.name;
+        console.error(`${red}[auth][error]${reset} ${name}: ${error.message}`);
+        if (error.cause &&
+            typeof error.cause === "object" &&
+            "err" in error.cause &&
+            error.cause.err instanceof Error) {
+            const { err, ...data } = error.cause;
+            console.error(`${red}[auth][cause]${reset}:`, err.stack);
+            if (data)
+                console.error(`${red}[auth][details]${reset}:`, JSON.stringify(data, null, 2));
+        }
+        else if (error.stack) {
+            console.error(error.stack.replace(/.*/, "").substring(1));
+        }
+    },
+    warn(code) {
+        const url = `https://warnings.authjs.dev`;
+        console.warn(`${yellow}[auth][warn][${code}]${reset}`, `Read more: ${url}`);
+    },
+    debug(message, metadata) {
+        console.log(`${grey}[auth][debug]:${reset} ${message}`, JSON.stringify(metadata, null, 2));
+    },
+};
+/**
+ * Override the built-in logger with user's implementation.
+ * Any `undefined` level will use the default logger.
+ */
+export function setLogger(config) {
+    const newLogger = {
+        ...defaultLogger,
+    };
+    // Turn off debug logging if `debug` isn't set to `true`
+    if (!config.debug)
+        newLogger.debug = () => { };
+    if (config.logger?.error)
+        newLogger.error = config.logger.error;
+    if (config.logger?.warn)
+        newLogger.warn = config.logger.warn;
+    if (config.logger?.debug)
+        newLogger.debug = config.logger.debug;
+    config.logger ?? (config.logger = newLogger);
+    return newLogger;
+}

package/lib/utils/merge.d.ts

@@ -0,0 +1,3 @@
+/** Deep merge two or more objects */
+export declare function merge<T extends Record<string, unknown>>(target: T, ...sources: Array<Record<string, unknown> | undefined>): T & Record<string, unknown>;
+//# sourceMappingURL=merge.d.ts.map

package/lib/utils/merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/lib/utils/merge.ts"],"names":[],"mappings":"AAIA,qCAAqC;AACrC,wBAAgB,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrD,MAAM,EAAE,CAAC,EACT,GAAG,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,GACrD,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqB7B"}

package/lib/utils/merge.js

@@ -0,0 +1,23 @@
+function isObject(item) {
+    return item !== null && typeof item === "object";
+}
+/** Deep merge two or more objects */
+export function merge(target, ...sources) {
+    if (!sources.length)
+        return target;
+    const source = sources.shift();
+    if (isObject(target) && isObject(source)) {
+        for (const key in source) {
+            if (isObject(source[key])) {
+                if (!isObject(target[key]))
+                    target[key] = Array.isArray(source[key])
+                        ? []
+                        : {};
+                merge(target[key], source[key]);
+            }
+            else if (source[key] !== undefined)
+                target[key] = source[key];
+        }
+    }
+    return merge(target, ...sources);
+}

package/lib/utils/providers.d.ts

@@ -0,0 +1,19 @@
+import type { InternalProvider } from "../../types.js";
+import { type AuthConfig } from "../../index.js";
+/**
+ * Adds `signinUrl` and `callbackUrl` to each provider
+ * and deep merge user-defined options.
+ */
+export default function parseProviders(params: {
+    url: URL;
+    providerId?: string;
+    config: AuthConfig;
+}): {
+    providers: InternalProvider[];
+    provider?: InternalProvider;
+};
+export declare function isOIDCProvider(provider: InternalProvider<"oidc" | "oauth">): provider is InternalProvider<"oidc">;
+export declare function isOAuth2Provider(provider: InternalProvider<"oidc" | "oauth">): provider is InternalProvider<"oauth">;
+/** Either OAuth 2 or OIDC */
+export declare function isOAuthProvider(provider: InternalProvider<any>): provider is InternalProvider<"oauth" | "oidc">;
+//# sourceMappingURL=providers.d.ts.map

package/lib/utils/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/lib/utils/providers.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAW,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD;;;GAGG;AACH,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,MAAM,EAAE;IAC7C,GAAG,EAAE,GAAG,CAAA;IACR,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,UAAU,CAAA;CACnB,GAAG;IACF,SAAS,EAAE,gBAAgB,EAAE,CAAA;IAC7B,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAC5B,CAgDA;AAgHD,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,CAAC,MAAM,GAAG,OAAO,CAAC,GAC3C,QAAQ,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAEtC;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,CAAC,MAAM,GAAG,OAAO,CAAC,GAC3C,QAAQ,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAEvC;AAED,6BAA6B;AAC7B,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAC9B,QAAQ,IAAI,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC,CAEhD"}

package/lib/utils/providers.js

@@ -0,0 +1,149 @@
+import { merge } from "./merge.js";
+import { customFetch } from "../symbols.js";
+/**
+ * Adds `signinUrl` and `callbackUrl` to each provider
+ * and deep merge user-defined options.
+ */
+export default function parseProviders(params) {
+    const { providerId, config } = params;
+    const url = new URL(config.basePath ?? "/auth", params.url.origin);
+    const providers = config.providers.map((p) => {
+        const provider = typeof p === "function" ? p() : p;
+        const { options: userOptions, ...defaults } = provider;
+        const id = (userOptions?.id ?? defaults.id);
+        // TODO: Support if properties have different types, e.g. authorization: string or object
+        const merged = merge(defaults, userOptions, {
+            signinUrl: `${url}/signin/${id}`,
+            callbackUrl: `${url}/callback/${id}`,
+        });
+        if (provider.type === "oauth" || provider.type === "oidc") {
+            merged.redirectProxyUrl ?? (merged.redirectProxyUrl = userOptions?.redirectProxyUrl ?? config.redirectProxyUrl);
+            const normalized = normalizeOAuth(merged);
+            // We currently don't support redirect proxies for response_mode=form_post
+            if (normalized.authorization?.url.searchParams.get("response_mode") ===
+                "form_post") {
+                delete normalized.redirectProxyUrl;
+            }
+            // @ts-expect-error Symbols don't get merged by the `merge` function
+            // so we need to do it manually.
+            normalized[customFetch] ?? (normalized[customFetch] = userOptions?.[customFetch]);
+            return normalized;
+        }
+        return merged;
+    });
+    const provider = providers.find(({ id }) => id === providerId);
+    if (providerId && !provider) {
+        const availableProviders = providers.map((p) => p.id).join(", ");
+        throw new Error(`Provider with id "${providerId}" not found. Available providers: [${availableProviders}].`);
+    }
+    return { providers, provider };
+}
+// TODO: Also add discovery here, if some endpoints/config are missing.
+// We should return both a client and authorization server config.
+function normalizeOAuth(c) {
+    if (c.issuer)
+        c.wellKnown ?? (c.wellKnown = `${c.issuer}/.well-known/openid-configuration`);
+    const authorization = normalizeEndpoint(c.authorization, c.issuer);
+    if (authorization && !authorization.url?.searchParams.has("scope")) {
+        authorization.url.searchParams.set("scope", "openid profile email");
+    }
+    const token = normalizeEndpoint(c.token, c.issuer);
+    const userinfo = normalizeEndpoint(c.userinfo, c.issuer);
+    const checks = c.checks ?? ["pkce"];
+    if (c.redirectProxyUrl) {
+        if (!checks.includes("state"))
+            checks.push("state");
+        c.redirectProxyUrl = `${c.redirectProxyUrl}/callback/${c.id}`;
+    }
+    return {
+        ...c,
+        authorization,
+        token,
+        checks,
+        userinfo,
+        profile: c.profile ?? defaultProfile,
+        account: c.account ?? defaultAccount,
+    };
+}
+/**
+ * Returns basic user profile from the userinfo response/`id_token` claims.
+ * The returned `id` will become the `account.providerAccountId`. `user.id`
+ * and `account.id` are auto-generated UUID's.
+ *
+ * The result if this function is used to create the `User` in the database.
+ * @see https://authjs.dev/reference/core/adapters#user
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#IDToken
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#
+ */
+const defaultProfile = (profile) => {
+    return stripUndefined({
+        id: profile.sub ?? profile.id ?? crypto.randomUUID(),
+        name: profile.name ?? profile.nickname ?? profile.preferred_username,
+        email: profile.email,
+        image: profile.picture,
+    });
+};
+/**
+ * Returns basic OAuth/OIDC values from the token response.
+ * @see https://www.ietf.org/rfc/rfc6749.html#section-5.1
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse
+ * @see https://authjs.dev/reference/core/adapters#account
+ */
+const defaultAccount = (account) => {
+    return stripUndefined({
+        access_token: account.access_token,
+        id_token: account.id_token,
+        refresh_token: account.refresh_token,
+        expires_at: account.expires_at,
+        scope: account.scope,
+        token_type: account.token_type,
+        session_state: account.session_state,
+    });
+};
+function stripUndefined(o) {
+    const result = {};
+    for (const [k, v] of Object.entries(o)) {
+        if (v !== undefined)
+            result[k] = v;
+    }
+    return result;
+}
+function normalizeEndpoint(e, issuer) {
+    if (!e && issuer)
+        return;
+    if (typeof e === "string") {
+        return { url: new URL(e) };
+    }
+    // If e.url is undefined, it's because the provider config
+    // assumes that we will use the issuer endpoint.
+    // The existence of either e.url or provider.issuer is checked in
+    // assert.ts. We fallback to "https://authjs.dev" to be able to pass around
+    // a valid URL even if the user only provided params.
+    // NOTE: This need to be checked when constructing the URL
+    // for the authorization, token and userinfo endpoints.
+    const url = new URL(e?.url ?? "https://authjs.dev");
+    if (e?.params != null) {
+        for (let [key, value] of Object.entries(e.params)) {
+            if (key === "claims") {
+                value = JSON.stringify(value);
+            }
+            url.searchParams.set(key, String(value));
+        }
+    }
+    return {
+        url,
+        request: e?.request,
+        conform: e?.conform,
+        ...(e?.clientPrivateKey ? { clientPrivateKey: e?.clientPrivateKey } : null),
+    };
+}
+export function isOIDCProvider(provider) {
+    return provider.type === "oidc";
+}
+export function isOAuth2Provider(provider) {
+    return provider.type === "oauth";
+}
+/** Either OAuth 2 or OIDC */
+export function isOAuthProvider(provider) {
+    return provider.type === "oauth" || provider.type === "oidc";
+}

package/lib/utils/session.d.ts

@@ -0,0 +1,7 @@
+import type { InternalOptions, User } from "../../types.js";
+import type { SessionStore } from "./cookie.js";
+/**
+ * Returns the currently logged in user, if any.
+ */
+export declare function getLoggedInUser(options: InternalOptions, sessionStore: SessionStore): Promise<User | null>;
+//# sourceMappingURL=session.d.ts.map

package/lib/utils/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/lib/utils/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CA+BtB"}

package/lib/utils/session.js

@@ -0,0 +1,29 @@
+/**
+ * Returns the currently logged in user, if any.
+ */
+export async function getLoggedInUser(options, sessionStore) {
+    const { adapter, jwt, session: { strategy: sessionStrategy }, } = options;
+    const sessionToken = sessionStore.value;
+    if (!sessionToken)
+        return null;
+    // Try to decode JWT
+    if (sessionStrategy === "jwt") {
+        const salt = options.cookies.sessionToken.name;
+        const payload = await jwt.decode({ ...jwt, token: sessionToken, salt });
+        if (payload && payload.sub) {
+            return {
+                id: payload.sub,
+                name: payload.name,
+                email: payload.email,
+                image: payload.picture,
+            };
+        }
+    }
+    else {
+        const userAndSession = await adapter?.getSessionAndUser(sessionToken);
+        if (userAndSession) {
+            return userAndSession.user;
+        }
+    }
+    return null;
+}

package/lib/utils/web.d.ts

@@ -0,0 +1,10 @@
+import type { RequestInternal, ResponseInternal } from "../../types.js";
+import type { AuthConfig } from "../../index.js";
+export declare function toInternalRequest(req: Request, config: AuthConfig): Promise<RequestInternal | undefined>;
+export declare function toRequest(request: RequestInternal): Request;
+export declare function toResponse(res: ResponseInternal): Response;
+/** Web compatible method to create a hash, using SHA256 */
+export declare function createHash(message: string): Promise<string>;
+/** Web compatible method to create a random string of a given length */
+export declare function randomString(size: number): string;
+//# sourceMappingURL=web.d.ts.map

package/lib/utils/web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../../src/lib/utils/web.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAEV,eAAe,EACf,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAgBhD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CA+BtC;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAS3D;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,QAAQ,CAuB1D;AAED,2DAA2D;AAC3D,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,mBAO/C;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,UAKxC"}

package/lib/utils/web.js

@@ -0,0 +1,109 @@
+import * as cookie from "../vendored/cookie.js";
+import { UnknownAction } from "../../errors.js";
+import { setLogger } from "./logger.js";
+import { isAuthAction } from "./actions.js";
+const { parse: parseCookie, serialize: serializeCookie } = cookie;
+async function getBody(req) {
+    if (!("body" in req) || !req.body || req.method !== "POST")
+        return;
+    const contentType = req.headers.get("content-type");
+    if (contentType?.includes("application/json")) {
+        return await req.json();
+    }
+    else if (contentType?.includes("application/x-www-form-urlencoded")) {
+        const params = new URLSearchParams(await req.text());
+        return Object.fromEntries(params);
+    }
+}
+export async function toInternalRequest(req, config) {
+    try {
+        if (req.method !== "GET" && req.method !== "POST")
+            throw new UnknownAction("Only GET and POST requests are supported");
+        // Defaults are usually set in the `init` function, but this is needed below
+        config.basePath ?? (config.basePath = "/auth");
+        const url = new URL(req.url);
+        const { action, providerId } = parseActionAndProviderId(url.pathname, config.basePath);
+        return {
+            url,
+            action,
+            providerId,
+            method: req.method,
+            headers: Object.fromEntries(req.headers),
+            body: req.body ? await getBody(req) : undefined,
+            cookies: parseCookie(req.headers.get("cookie") ?? "") ?? {},
+            error: url.searchParams.get("error") ?? undefined,
+            query: Object.fromEntries(url.searchParams),
+        };
+    }
+    catch (e) {
+        const logger = setLogger(config);
+        logger.error(e);
+        logger.debug("request", req);
+    }
+}
+export function toRequest(request) {
+    return new Request(request.url, {
+        headers: request.headers,
+        method: request.method,
+        body: request.method === "POST"
+            ? JSON.stringify(request.body ?? {})
+            : undefined,
+    });
+}
+export function toResponse(res) {
+    const headers = new Headers(res.headers);
+    res.cookies?.forEach((cookie) => {
+        const { name, value, options } = cookie;
+        const cookieHeader = serializeCookie(name, value, options);
+        if (headers.has("Set-Cookie"))
+            headers.append("Set-Cookie", cookieHeader);
+        else
+            headers.set("Set-Cookie", cookieHeader);
+    });
+    let body = res.body;
+    if (headers.get("content-type") === "application/json")
+        body = JSON.stringify(res.body);
+    else if (headers.get("content-type") === "application/x-www-form-urlencoded")
+        body = new URLSearchParams(res.body).toString();
+    const status = res.redirect ? 302 : (res.status ?? 200);
+    const response = new Response(body, { headers, status });
+    if (res.redirect)
+        response.headers.set("Location", res.redirect);
+    return response;
+}
+/** Web compatible method to create a hash, using SHA256 */
+export async function createHash(message) {
+    const data = new TextEncoder().encode(message);
+    const hash = await crypto.subtle.digest("SHA-256", data);
+    return Array.from(new Uint8Array(hash))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("")
+        .toString();
+}
+/** Web compatible method to create a random string of a given length */
+export function randomString(size) {
+    const i2hex = (i) => ("0" + i.toString(16)).slice(-2);
+    const r = (a, i) => a + i2hex(i);
+    const bytes = crypto.getRandomValues(new Uint8Array(size));
+    return Array.from(bytes).reduce(r, "");
+}
+/** @internal Parse the action and provider id from a URL pathname. */
+export function parseActionAndProviderId(pathname, base) {
+    const a = pathname.match(new RegExp(`^${base}(.+)`));
+    if (a === null)
+        throw new UnknownAction(`Cannot parse action at ${pathname}`);
+    const actionAndProviderId = a.at(-1);
+    const b = actionAndProviderId.replace(/^\//, "").split("/").filter(Boolean);
+    if (b.length !== 1 && b.length !== 2)
+        throw new UnknownAction(`Cannot parse action at ${pathname}`);
+    const [action, providerId] = b;
+    if (!isAuthAction(action))
+        throw new UnknownAction(`Cannot parse action at ${pathname}`);
+    if (providerId &&
+        !["signin", "callback", "webauthn-options"].includes(action))
+        throw new UnknownAction(`Cannot parse action at ${pathname}`);
+    return {
+        action,
+        providerId: providerId == "undefined" ? undefined : providerId,
+    };
+}

package/lib/utils/webauthn-client.d.ts

@@ -0,0 +1,30 @@
+/** @typedef {"authenticate"} WebAuthnAuthenticate */
+/** @typedef {"register"} WebAuthnRegister */
+/** @typedef {WebAuthnRegister | WebAuthnAuthenticate} WebAuthnOptionsAction */
+/**
+ * @template {WebAuthnOptionsAction} T
+ * @typedef {T extends WebAuthnAuthenticate ?
+ *  { options: import("@simplewebauthn/types").PublicKeyCredentialRequestOptionsJSON; action: "authenticate" } :
+ *  T extends WebAuthnRegister ?
+ *  { options: import("@simplewebauthn/types").PublicKeyCredentialCreationOptionsJSON; action: "register" } :
+ * never
+ * } WebAuthnOptionsReturn
+ */
+/**
+ * webauthnScript is the client-side script that handles the webauthn form
+ *
+ * @param {string} authURL is the URL of the auth API
+ * @param {string} providerID is the ID of the webauthn provider
+ */
+export function webauthnScript(authURL: string, providerID: string): Promise<void>;
+export type WebAuthnAuthenticate = "authenticate";
+export type WebAuthnRegister = "register";
+export type WebAuthnOptionsAction = WebAuthnRegister | WebAuthnAuthenticate;
+export type WebAuthnOptionsReturn<T extends WebAuthnOptionsAction> = T extends WebAuthnAuthenticate ? {
+    options: import("@simplewebauthn/types").PublicKeyCredentialRequestOptionsJSON;
+    action: "authenticate";
+} : T extends WebAuthnRegister ? {
+    options: import("@simplewebauthn/types").PublicKeyCredentialCreationOptionsJSON;
+    action: "register";
+} : never;
+//# sourceMappingURL=webauthn-client.d.ts.map

package/lib/utils/webauthn-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-client.d.ts","sourceRoot":"","sources":["../../src/lib/utils/webauthn-client.js"],"names":[],"mappings":"AAIA,qDAAqD;AACrD,6CAA6C;AAC7C,+EAA+E;AAC/E;;;;;;;;GAQG;AAEH;;;;;GAKG;AACH,wCAHW,MAAM,cACN,MAAM,iBA+MhB;mCAhOa,cAAc;+BACd,UAAU;oCACV,gBAAgB,GAAG,oBAAoB;qEAGxC,CAAC,SAAS,oBAAoB,GAC1C;IAAK,OAAO,EAAE,OAAO,uBAAuB,EAAE,qCAAqC,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GAC7G,CAAI,SAAS,gBAAgB,GAC7B;IAAK,OAAO,EAAE,OAAO,uBAAuB,EAAE,sCAAsC,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC1G,KAAO"}