@mulverse/mulguard-core 1.0.0

package/providers/freshbooks.js

@@ -0,0 +1,76 @@
+/**
+ * Add FreshBooks login to your page.
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/freshbooks
+ * ```
+ *
+ * #### Configuration
+ *```ts
+ * import { Auth } from "@auth/core"
+ * import FreshBooks from "@auth/core/providers/freshbooks"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     FreshBooks({
+ *       clientId: FRESHBOOKS_CLIENT_ID,
+ *       clientSecret: FRESHBOOKS_CLIENT_SECRET,
+ *     }),
+ *   ],
+ * })
+ * ```
+ *
+ * ### Resources
+ *
+ *  - [FreshBooks OAuth documentation](https://www.freshbooks.com/api/authenticating-with-oauth-2-0-on-the-new-freshbooks-api
+)
+ *
+ * ### Notes
+ *
+ * By default, Auth.js assumes that the FreshBooks provider is
+ * based on the [OAuth 2](https://www.rfc-editor.org/rfc/rfc6749.html) specification.
+ *
+ * :::tip
+ *
+ * The FreshBooks provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/freshbooks.ts).
+ * To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::
+ *
+ * :::info **Disclaimer**
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ *
+ * :::
+ */
+export default function Freshbooks(options) {
+    return {
+        id: "freshbooks",
+        name: "Freshbooks",
+        type: "oauth",
+        authorization: "https://auth.freshbooks.com/service/auth/oauth/authorize",
+        token: "https://api.freshbooks.com/auth/oauth/token",
+        userinfo: "https://api.freshbooks.com/auth/api/v1/users/me",
+        async profile(profile) {
+            return {
+                id: profile.response.id,
+                name: `${profile.response.first_name} ${profile.response.last_name}`,
+                email: profile.response.email,
+                image: null,
+            };
+        },
+        style: {
+            bg: "#0075dd",
+            text: "#fff",
+        },
+        options,
+    };
+}

package/providers/frontegg.d.ts

@@ -0,0 +1,95 @@
+/**
+ * <div style={{display: "flex", justifyContent: "space-between", alignItems: "center"}}>
+ * <span style={{fontSize: "1.35rem" }}>
+ *  Built-in sign in with <b>Frontegg</b> integration.
+ * </span>
+ * <a href="https://frontegg.com" style={{backgroundColor: "black", padding: "12px", borderRadius: "100%" }}>
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/frontegg.svg" width="24"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/frontegg
+ */
+import type { OIDCConfig, OIDCUserConfig } from "./index.js";
+/** The returned user profile from Frontegg when using the profile callback. [Reference](https://docs.frontegg.com/docs/admin-portal-profile). */
+export interface FronteggProfile {
+    /** The user's unique Frontegg ID */
+    sub: string;
+    /** The user's name */
+    name: string;
+    /** The user's email */
+    email: string;
+    /** A boolean indicating if the user's email is verified */
+    email_verified: boolean;
+    /** The user's picture */
+    profilePictureUrl: string;
+    /** The user's roles */
+    roles: string[];
+    /** The user's custom attributes */
+    [claim: string]: unknown;
+}
+/**
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/frontegg
+ * ```
+ *
+ * #### Configuration
+ * ```ts
+ * import { Auth } from "@auth/core"
+ * import Frontegg from "@auth/core/providers/frontegg"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     Frontegg({
+ *       clientId: AUTH_FRONTEGG_ID,
+ *       clientSecret: AUTH_FRONTEGG_SECRET,
+ *       issuer: AUTH_FRONTEGG_ISSUER
+ *     }),
+ *   ],
+ * })
+ * ```
+ *
+ * ### Configuring Frontegg
+ *
+ * Follow these steps:
+ *
+ * Log into the [Frontegg portal](https://portal.frontegg.com)
+ *
+ * Authentication > Login method > Hosted login > Add your callback url here
+ *
+ * Then, create a `.env.local` file in the project root add the following entries:
+ *
+ * Get the following from the Frontegg's portal:
+ * ```
+ * AUTH_FRONTEGG_ID="<Client ID>" # Environments > Your environment > Env settings
+ * AUTH_FRONTEGG_SECRET="<API KEY>" # Environments > Your environment > Env settings
+ * AUTH_FRONTEGG_ISSUER="<https://[YOUR_SUBDOMAIN].frontegg.com>" # Environments > Your environment > Env settings > Domains > Domain name
+ * ```
+ *
+ * ### Resources
+ *
+ * - [Frontegg Docs](https://docs.frontegg.com/docs/how-to-use-our-docs)
+ *
+ * ### Notes
+ *
+ * The Frontegg provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/frontegg.ts). To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::info
+ * By default, Auth.js assumes that the Frontegg provider is based on the [OIDC](https://openid.net/specs/openid-connect-core-1_0.html) spec
+ * :::
+ *
+ * ## Help
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ */
+export default function Frontegg(options: OIDCUserConfig<FronteggProfile>): OIDCConfig<FronteggProfile>;
+//# sourceMappingURL=frontegg.d.ts.map

package/providers/frontegg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontegg.d.ts","sourceRoot":"","sources":["../src/providers/frontegg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE5D,iJAAiJ;AACjJ,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAA;IACvB,yBAAyB;IACzB,iBAAiB,EAAE,MAAM,CAAA;IACzB,uBAAuB;IACvB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,mCAAmC;IACnC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,MAAM,CAAC,OAAO,UAAU,QAAQ,CAC9B,OAAO,EAAE,cAAc,CAAC,eAAe,CAAC,GACvC,UAAU,CAAC,eAAe,CAAC,CAY7B"}

package/providers/frontegg.js

@@ -0,0 +1,88 @@
+/**
+ * <div style={{display: "flex", justifyContent: "space-between", alignItems: "center"}}>
+ * <span style={{fontSize: "1.35rem" }}>
+ *  Built-in sign in with <b>Frontegg</b> integration.
+ * </span>
+ * <a href="https://frontegg.com" style={{backgroundColor: "black", padding: "12px", borderRadius: "100%" }}>
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/frontegg.svg" width="24"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/frontegg
+ */
+/**
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/frontegg
+ * ```
+ *
+ * #### Configuration
+ * ```ts
+ * import { Auth } from "@auth/core"
+ * import Frontegg from "@auth/core/providers/frontegg"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     Frontegg({
+ *       clientId: AUTH_FRONTEGG_ID,
+ *       clientSecret: AUTH_FRONTEGG_SECRET,
+ *       issuer: AUTH_FRONTEGG_ISSUER
+ *     }),
+ *   ],
+ * })
+ * ```
+ *
+ * ### Configuring Frontegg
+ *
+ * Follow these steps:
+ *
+ * Log into the [Frontegg portal](https://portal.frontegg.com)
+ *
+ * Authentication > Login method > Hosted login > Add your callback url here
+ *
+ * Then, create a `.env.local` file in the project root add the following entries:
+ *
+ * Get the following from the Frontegg's portal:
+ * ```
+ * AUTH_FRONTEGG_ID="<Client ID>" # Environments > Your environment > Env settings
+ * AUTH_FRONTEGG_SECRET="<API KEY>" # Environments > Your environment > Env settings
+ * AUTH_FRONTEGG_ISSUER="<https://[YOUR_SUBDOMAIN].frontegg.com>" # Environments > Your environment > Env settings > Domains > Domain name
+ * ```
+ *
+ * ### Resources
+ *
+ * - [Frontegg Docs](https://docs.frontegg.com/docs/how-to-use-our-docs)
+ *
+ * ### Notes
+ *
+ * The Frontegg provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/frontegg.ts). To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::info
+ * By default, Auth.js assumes that the Frontegg provider is based on the [OIDC](https://openid.net/specs/openid-connect-core-1_0.html) spec
+ * :::
+ *
+ * ## Help
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ */
+export default function Frontegg(options) {
+    return {
+        id: "frontegg",
+        name: "Frontegg",
+        type: "oidc",
+        authorization: `${options.issuer}/oauth/authorize`,
+        token: `${options.issuer}/oauth/token`,
+        userinfo: `${options.issuer}/identity/resources/users/v2/me`,
+        wellKnown: `${options.issuer}/oauth/.well-known/openid-configuration`,
+        issuer: options.issuer,
+        options,
+    };
+}

package/providers/fusionauth.d.ts

@@ -0,0 +1,279 @@
+/**
+ * <div class="provider" style={{backgroundColor: "#000", display: "flex", justifyContent: "space-between", color: "#fff", padding: 16}}>
+ * <span>Built-in <b>FusionAuth</b> integration.</span>
+ * <a href="https://fusionauth.com">
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/fushionauth.svg" height="48" width="48"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/fusionauth
+ */
+import type { OAuthConfig, OAuthUserConfig } from "./oauth.js";
+/**
+ * This is the default openid signature returned from FusionAuth
+ * it can be customized using [lambda functions](https://fusionauth.io/docs/v1/tech/lambdas)
+ */
+export interface FusionAuthProfile extends Record<string, any> {
+    aud: string;
+    exp: number;
+    iat: number;
+    iss: string;
+    sub: string;
+    jti: string;
+    authenticationType: string;
+    email: string;
+    email_verified: boolean;
+    preferred_username?: string;
+    name?: string;
+    given_name?: string;
+    middle_name?: string;
+    family_name?: string;
+    at_hash: string;
+    c_hash: string;
+    scope: string;
+    sid: string;
+    picture?: string;
+}
+/**
+ * Add FusionAuth login to your page.
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/fusionauth
+ * ```
+ *
+ * #### Configuration
+ *```ts
+ * import { Auth } from "@auth/core"
+ * import FusionAuth from "@auth/core/providers/fusionauth"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     FusionAuth({
+ *       clientId: FUSIONAUTH_CLIENT_ID,
+ *       clientSecret: FUSIONAUTH_CLIENT_SECRET,
+ *       tenantId: FUSIONAUTH_TENANT_ID,
+ *       issuer: FUSIONAUTH_ISSUER,
+ *     }),
+ *   ],
+ * })
+ * ```
+ * :::warning
+ * If you're using multi-tenancy, you need to pass in the tenantId option to apply the proper theme.
+ * :::
+ *
+ * ### Resources
+ *
+ *  - [FusionAuth OAuth documentation](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/)
+ *
+ * ### Notes
+ *
+ * By default, Auth.js assumes that the FusionAuth provider is
+ * based on the [OAuth 2](https://www.rfc-editor.org/rfc/rfc6749.html) specification.
+ *
+ * ## Configuration
+ * :::tip
+ * An application can be created at https://your-fusionauth-server-url/admin/application.
+ *
+ * For more information, follow the [FusionAuth 5-minute setup guide](https://fusionauth.io/docs/v1/tech/5-minute-setup-guide).
+ * :::
+ *
+ * In the OAuth settings for your application, configure the following.
+ *
+ * - Redirect URL
+ *   - https://localhost:3000/api/auth/callback/fusionauth
+ * - Enabled grants
+ *   - Make sure _Authorization Code_ is enabled.
+ *
+ * If using JSON Web Tokens, you need to make sure the signing algorithm is RS256, you can create an RS256 key pair by
+ * going to Settings, Key Master, generate RSA and choosing SHA-256 as algorithm. After that, go to the JWT settings of
+ * your application and select this key as Access Token signing key and Id Token signing key.
+ * :::tip
+ *
+ * The FusionAuth provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/fusionauth.ts).
+ * To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::
+ *
+ * :::info **Disclaimer**
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ *
+ * :::
+ *
+ *
+ * It is highly recommended to follow this example call when using the provider in Next.js
+ *  so that you can access both the access_token and id_token on the server.
+ *
+ * ```ts
+ * /// <reference types="next-auth" />
+import NextAuth from 'next-auth';
+export const { handlers, auth, signIn, signOut } = NextAuth({
+  providers: [
+    {
+      id: 'fusionauth',
+      name: 'FusionAuth',
+      type: 'oidc',
+      issuer: process.env.AUTH_FUSIONAUTH_ISSUER!,
+      clientId: process.env.AUTH_FUSIONAUTH_CLIENT_ID!,
+      clientSecret: process.env.AUTH_FUSIONAUTH_CLIENT_SECRET!,
+      authorization: {
+        params: {
+          scope: 'offline_access email openid profile',
+          tenantId: process.env.AUTH_FUSIONAUTH_TENANT_ID!,
+        },
+      },
+      userinfo: `${process.env.AUTH_FUSIONAUTH_ISSUER}/oauth2/userinfo`,
+      // This is due to a known processing issue
+      // TODO: https://github.com/nextauthjs/next-auth/issues/8745#issuecomment-1907799026
+      token: {
+        url: `${process.env.AUTH_FUSIONAUTH_ISSUER}/oauth2/token`,
+        conform: async (response: Response) => {
+          if (response.status === 401) return response;
+
+          const newHeaders = Array.from(response.headers.entries())
+            .filter(([key]) => key.toLowerCase() !== 'www-authenticate')
+            .reduce(
+              (headers, [key, value]) => (headers.append(key, value), headers),
+              new Headers()
+            );
+
+          return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: newHeaders,
+          });
+        },
+      },
+    },
+  ],
+  session: {
+    strategy: 'jwt',
+  },
+  // Required to get the account object in the session and enable
+  // the ability to call API's externally that rely on JWT tokens.
+  callbacks: {
+    async jwt(params) {
+      const { token, user, account } = params;
+      if (account) {
+        // First-time login, save the `access_token`, its expiry and the `refresh_token`
+        return {
+          ...token,
+          ...account,
+        };
+      } else if (
+        token.expires_at &&
+        Date.now() < (token.expires_at as number) * 1000
+      ) {
+        // Subsequent logins, but the `access_token` is still valid
+        return token;
+      } else {
+        // Subsequent logins, but the `access_token` has expired, try to refresh it
+        if (!token.refresh_token) throw new TypeError('Missing refresh_token');
+
+        try {
+          const refreshResponse = await fetch(
+            `${process.env.AUTH_FUSIONAUTH_ISSUER}/oauth2/token`,
+            {
+              method: 'POST',
+              headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+              },
+              body: new URLSearchParams({
+                client_id: process.env.AUTH_FUSIONAUTH_CLIENT_ID!,
+                client_secret: process.env.AUTH_FUSIONAUTH_CLIENT_SECRET!,
+                grant_type: 'refresh_token',
+                refresh_token: token.refresh_token as string,
+              }),
+            }
+          );
+
+          if (!refreshResponse.ok) {
+            throw new Error('Failed to refresh token');
+          }
+
+          const tokensOrError = await refreshResponse.json();
+
+          if (!refreshResponse.ok) throw tokensOrError;
+
+          const newTokens = tokensOrError as {
+            access_token: string;
+            expires_in: number;
+            refresh_token?: string;
+          };
+
+          return {
+            ...token,
+            access_token: newTokens.access_token,
+            expires_at: Math.floor(Date.now() / 1000 + newTokens.expires_in),
+            // Some providers only issue refresh tokens once, so preserve if we did not get a new one
+            refresh_token: newTokens.refresh_token
+              ? newTokens.refresh_token
+              : token.refresh_token,
+          };
+        } catch (error) {
+          console.error('Error refreshing access_token', error);
+          // If we fail to refresh the token, return an error so we can handle it on the page
+          token.error = 'RefreshTokenError';
+          return token;
+        }
+      }
+    },
+    async session(params) {
+      const { session, token } = params;
+      return { ...session, ...token };
+    },
+  },
+});
+
+declare module 'next-auth' {
+  interface Session {
+    access_token: string;
+    expires_in: number;
+    id_token?: string;
+    expires_at: number;
+    refresh_token?: string;
+    refresh_token_id?: string;
+    error?: 'RefreshTokenError';
+    scope: string;
+    token_type: string;
+    userId: string;
+    provider: string;
+    type: string;
+    providerAccountId: string;
+  }
+}
+
+declare module 'next-auth' {
+  interface JWT {
+    access_token: string;
+    expires_in: number;
+    id_token?: string;
+    expires_at: number;
+    refresh_token?: string;
+    refresh_token_id?: string;
+    error?: 'RefreshTokenError';
+    scope: string;
+    token_type: string;
+    userId: string;
+    provider: string;
+    type: string;
+    providerAccountId: string;
+  }
+}
+```
+ *
+ *
+ *
+ */
+export default function FusionAuth<P extends FusionAuthProfile>(options: OAuthUserConfig<P> & {
+    tenantId?: string;
+}): OAuthConfig<P>;
+//# sourceMappingURL=fusionauth.d.ts.map

package/providers/fusionauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fusionauth.d.ts","sourceRoot":"","sources":["../src/providers/fusionauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE9D;;;GAGG;AACH,MAAM,WAAW,iBAAkB,SAAQ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAC5D,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,OAAO,CAAA;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8OG;AACH,MAAM,CAAC,OAAO,UAAU,UAAU,CAAC,CAAC,SAAS,iBAAiB,EAE5D,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD,WAAW,CAAC,CAAC,CAAC,CAuDhB"}