@mulverse/mulguard-core 1.0.0

package/src/lib/utils/env.ts

@@ -0,0 +1,113 @@
+import type { AuthAction } from "../../types.js"
+import type { AuthConfig } from "../../index.js"
+import { setLogger } from "./logger.js"
+
+/**
+ *  Set default env variables on the config object
+ * @param suppressWarnings intended for framework authors.
+ */
+export function setEnvDefaults(
+  envObject: any,
+  config: AuthConfig,
+  suppressBasePathWarning = false
+) {
+  try {
+    const url = envObject.AUTH_URL
+    if (url) {
+      if (config.basePath) {
+        if (!suppressBasePathWarning) {
+          const logger = setLogger(config)
+          logger.warn("env-url-basepath-redundant")
+        }
+      } else {
+        config.basePath = new URL(url).pathname
+      }
+    }
+  } catch {
+    // Catching and swallowing potential URL parsing errors, we'll fall
+    // back to `/auth` below.
+  } finally {
+    config.basePath ??= `/auth`
+  }
+
+  if (!config.secret?.length) {
+    config.secret = []
+    const secret = envObject.AUTH_SECRET
+    if (secret) config.secret.push(secret)
+    for (const i of [1, 2, 3]) {
+      const secret = envObject[`AUTH_SECRET_${i}`]
+      if (secret) config.secret.unshift(secret)
+    }
+  }
+
+  config.redirectProxyUrl ??= envObject.AUTH_REDIRECT_PROXY_URL
+  config.trustHost ??= !!(
+    envObject.AUTH_URL ??
+    envObject.AUTH_TRUST_HOST ??
+    envObject.VERCEL ??
+    envObject.CF_PAGES ??
+    envObject.NODE_ENV !== "production"
+  )
+  config.providers = config.providers.map((provider) => {
+    const { id } = typeof provider === "function" ? provider({}) : provider
+    const ID = id.toUpperCase().replace(/-/g, "_")
+    const clientId = envObject[`AUTH_${ID}_ID`]
+    const clientSecret = envObject[`AUTH_${ID}_SECRET`]
+    const issuer = envObject[`AUTH_${ID}_ISSUER`]
+    const apiKey = envObject[`AUTH_${ID}_KEY`]
+    const finalProvider =
+      typeof provider === "function"
+        ? provider({ clientId, clientSecret, issuer, apiKey })
+        : provider
+    if (finalProvider.type === "oauth" || finalProvider.type === "oidc") {
+      finalProvider.clientId ??= clientId
+      finalProvider.clientSecret ??= clientSecret
+      finalProvider.issuer ??= issuer
+    } else if (finalProvider.type === "email") {
+      finalProvider.apiKey ??= apiKey
+    }
+    return finalProvider
+  })
+}
+
+export function createActionURL(
+  action: AuthAction,
+  protocol: string,
+  headers: Headers,
+  envObject: any,
+  config: Pick<AuthConfig, "basePath" | "logger">
+): URL {
+  const basePath = config?.basePath
+  const envUrl = envObject.AUTH_URL ?? envObject.NEXTAUTH_URL
+
+  let url: URL
+  if (envUrl) {
+    url = new URL(envUrl)
+    if (basePath && basePath !== "/" && url.pathname !== "/") {
+      if (url.pathname !== basePath) {
+        const logger = setLogger(config)
+        logger.warn("env-url-basepath-mismatch")
+      }
+      url.pathname = "/"
+    }
+  } else {
+    const detectedHost = headers.get("x-forwarded-host") ?? headers.get("host")
+    const detectedProtocol =
+      headers.get("x-forwarded-proto") ?? protocol ?? "https"
+    const _protocol = detectedProtocol.endsWith(":")
+      ? detectedProtocol
+      : detectedProtocol + ":"
+
+    url = new URL(`${_protocol}//${detectedHost}`)
+  }
+
+  // remove trailing slash
+  const sanitizedUrl = url.toString().replace(/\/$/, "")
+
+  if (basePath) {
+    // remove leading and trailing slash
+    const sanitizedBasePath = basePath?.replace(/(^\/|\/$)/g, "") ?? ""
+    return new URL(`${sanitizedUrl}/${sanitizedBasePath}/${action}`)
+  }
+  return new URL(`${sanitizedUrl}/${action}`)
+}

package/src/lib/utils/logger.ts

@@ -0,0 +1,75 @@
+import { AuthError } from "../../errors.js"
+import type { WarningCode } from "../../warnings.js"
+import type { AuthConfig } from "../../index.js"
+
+/**
+ * Override any of the methods, and the rest will use the default logger.
+ *
+ * [Documentation](https://authjs.dev/reference/core#authconfig#logger)
+ */
+// eslint-disable-next-line @typescript-eslint/no-unsafe-function-type
+export interface LoggerInstance extends Record<string, Function> {
+  warn: (code: WarningCode) => void
+  error: (error: Error) => void
+  debug: (message: string, metadata?: unknown) => void
+}
+
+const red = "\x1b[31m"
+const yellow = "\x1b[33m"
+const grey = "\x1b[90m"
+const reset = "\x1b[0m"
+
+const defaultLogger: LoggerInstance = {
+  error(error) {
+    const name = error instanceof AuthError ? error.type : error.name
+    console.error(`${red}[auth][error]${reset} ${name}: ${error.message}`)
+    if (
+      error.cause &&
+      typeof error.cause === "object" &&
+      "err" in error.cause &&
+      error.cause.err instanceof Error
+    ) {
+      const { err, ...data } = error.cause
+      console.error(`${red}[auth][cause]${reset}:`, err.stack)
+      if (data)
+        console.error(
+          `${red}[auth][details]${reset}:`,
+          JSON.stringify(data, null, 2)
+        )
+    } else if (error.stack) {
+      console.error(error.stack.replace(/.*/, "").substring(1))
+    }
+  },
+  warn(code) {
+    const url = `https://warnings.authjs.dev`
+    console.warn(`${yellow}[auth][warn][${code}]${reset}`, `Read more: ${url}`)
+  },
+  debug(message, metadata) {
+    console.log(
+      `${grey}[auth][debug]:${reset} ${message}`,
+      JSON.stringify(metadata, null, 2)
+    )
+  },
+}
+
+/**
+ * Override the built-in logger with user's implementation.
+ * Any `undefined` level will use the default logger.
+ */
+export function setLogger(
+  config: Pick<AuthConfig, "logger" | "debug">
+): LoggerInstance {
+  const newLogger: LoggerInstance = {
+    ...defaultLogger,
+  }
+
+  // Turn off debug logging if `debug` isn't set to `true`
+  if (!config.debug) newLogger.debug = () => {}
+
+  if (config.logger?.error) newLogger.error = config.logger.error
+  if (config.logger?.warn) newLogger.warn = config.logger.warn
+  if (config.logger?.debug) newLogger.debug = config.logger.debug
+
+  config.logger ??= newLogger
+  return newLogger
+}

package/src/lib/utils/merge.ts

@@ -0,0 +1,30 @@
+function isObject(item: unknown): item is object {
+  return item !== null && typeof item === "object"
+}
+
+/** Deep merge two or more objects */
+export function merge<T extends Record<string, unknown>>(
+  target: T,
+  ...sources: Array<Record<string, unknown> | undefined>
+): T & Record<string, unknown> {
+  if (!sources.length) return target
+  const source = sources.shift()
+
+  if (isObject(target) && isObject(source)) {
+    for (const key in source) {
+      if (isObject(source[key])) {
+        if (!isObject(target[key]))
+          (target as Record<string, unknown>)[key] = Array.isArray(source[key])
+            ? []
+            : {}
+        merge(
+          (target as Record<string, unknown>)[key] as T,
+          source[key] as Record<string, unknown>
+        )
+      } else if (source[key] !== undefined)
+        (target as Record<string, unknown>)[key] = source[key]
+    }
+  }
+
+  return merge(target, ...sources)
+}

package/src/lib/utils/providers.ts

@@ -0,0 +1,203 @@
+import { merge } from "./merge.js"
+
+import type {
+  AccountCallback,
+  OAuthConfig,
+  OAuthConfigInternal,
+  OAuthEndpointType,
+  OAuthUserConfig,
+  ProfileCallback,
+} from "../../providers/index.js"
+import type { InternalProvider, Profile } from "../../types.js"
+import { type AuthConfig } from "../../index.js"
+import { customFetch } from "../symbols.js"
+
+/**
+ * Adds `signinUrl` and `callbackUrl` to each provider
+ * and deep merge user-defined options.
+ */
+export default function parseProviders(params: {
+  url: URL
+  providerId?: string
+  config: AuthConfig
+}): {
+  providers: InternalProvider[]
+  provider?: InternalProvider
+} {
+  const { providerId, config } = params
+  const url = new URL(config.basePath ?? "/auth", params.url.origin)
+
+  const providers = config.providers.map((p) => {
+    const provider = typeof p === "function" ? p() : p
+    const { options: userOptions, ...defaults } = provider
+
+    const id = (userOptions?.id ?? defaults.id) as string
+    // TODO: Support if properties have different types, e.g. authorization: string or object
+    const merged = merge(defaults, userOptions, {
+      signinUrl: `${url}/signin/${id}`,
+      callbackUrl: `${url}/callback/${id}`,
+    })
+
+    if (provider.type === "oauth" || provider.type === "oidc") {
+      merged.redirectProxyUrl ??=
+        userOptions?.redirectProxyUrl ?? config.redirectProxyUrl
+
+      const normalized = normalizeOAuth(merged) as InternalProvider<
+        "oauth" | "oidc"
+      >
+      // We currently don't support redirect proxies for response_mode=form_post
+      if (
+        normalized.authorization?.url.searchParams.get("response_mode") ===
+        "form_post"
+      ) {
+        delete normalized.redirectProxyUrl
+      }
+
+      // @ts-expect-error Symbols don't get merged by the `merge` function
+      // so we need to do it manually.
+      normalized[customFetch] ??= userOptions?.[customFetch]
+      return normalized
+    }
+
+    return merged as InternalProvider
+  })
+
+  const provider = providers.find(({ id }) => id === providerId)
+  if (providerId && !provider) {
+    const availableProviders = providers.map((p) => p.id).join(", ")
+    throw new Error(
+      `Provider with id "${providerId}" not found. Available providers: [${availableProviders}].`
+    )
+  }
+
+  return { providers, provider }
+}
+
+// TODO: Also add discovery here, if some endpoints/config are missing.
+// We should return both a client and authorization server config.
+function normalizeOAuth(
+  c: OAuthConfig<any> | OAuthUserConfig<any>
+): OAuthConfigInternal<any> | object {
+  if (c.issuer) c.wellKnown ??= `${c.issuer}/.well-known/openid-configuration`
+
+  const authorization = normalizeEndpoint(c.authorization, c.issuer)
+  if (authorization && !authorization.url?.searchParams.has("scope")) {
+    authorization.url.searchParams.set("scope", "openid profile email")
+  }
+
+  const token = normalizeEndpoint(c.token, c.issuer)
+
+  const userinfo = normalizeEndpoint(c.userinfo, c.issuer)
+
+  const checks = c.checks ?? ["pkce"]
+  if (c.redirectProxyUrl) {
+    if (!checks.includes("state")) checks.push("state")
+    c.redirectProxyUrl = `${c.redirectProxyUrl}/callback/${c.id}`
+  }
+
+  return {
+    ...c,
+    authorization,
+    token,
+    checks,
+    userinfo,
+    profile: c.profile ?? defaultProfile,
+    account: c.account ?? defaultAccount,
+  }
+}
+
+/**
+ * Returns basic user profile from the userinfo response/`id_token` claims.
+ * The returned `id` will become the `account.providerAccountId`. `user.id`
+ * and `account.id` are auto-generated UUID's.
+ *
+ * The result if this function is used to create the `User` in the database.
+ * @see https://authjs.dev/reference/core/adapters#user
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#IDToken
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#
+ */
+const defaultProfile: ProfileCallback<Profile> = (profile) => {
+  return stripUndefined({
+    id: profile.sub ?? profile.id ?? crypto.randomUUID(),
+    name: profile.name ?? profile.nickname ?? profile.preferred_username,
+    email: profile.email,
+    image: profile.picture,
+  })
+}
+
+/**
+ * Returns basic OAuth/OIDC values from the token response.
+ * @see https://www.ietf.org/rfc/rfc6749.html#section-5.1
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse
+ * @see https://authjs.dev/reference/core/adapters#account
+ */
+const defaultAccount: AccountCallback = (account) => {
+  return stripUndefined({
+    access_token: account.access_token,
+    id_token: account.id_token,
+    refresh_token: account.refresh_token,
+    expires_at: account.expires_at,
+    scope: account.scope,
+    token_type: account.token_type,
+    session_state: account.session_state,
+  })
+}
+
+function stripUndefined<T extends object>(o: T): T {
+  const result = {} as any
+  for (const [k, v] of Object.entries(o)) {
+    if (v !== undefined) result[k] = v
+  }
+  return result as T
+}
+
+function normalizeEndpoint(
+  e?: OAuthConfig<any>[OAuthEndpointType],
+  issuer?: string
+): OAuthConfigInternal<any>[OAuthEndpointType] {
+  if (!e && issuer) return
+  if (typeof e === "string") {
+    return { url: new URL(e) }
+  }
+  // If e.url is undefined, it's because the provider config
+  // assumes that we will use the issuer endpoint.
+  // The existence of either e.url or provider.issuer is checked in
+  // assert.ts. We fallback to "https://authjs.dev" to be able to pass around
+  // a valid URL even if the user only provided params.
+  // NOTE: This need to be checked when constructing the URL
+  // for the authorization, token and userinfo endpoints.
+  const url = new URL(e?.url ?? "https://authjs.dev")
+  if (e?.params != null) {
+    for (let [key, value] of Object.entries(e.params)) {
+      if (key === "claims") {
+        value = JSON.stringify(value)
+      }
+      url.searchParams.set(key, String(value))
+    }
+  }
+  return {
+    url,
+    request: e?.request,
+    conform: e?.conform,
+    ...(e?.clientPrivateKey ? { clientPrivateKey: e?.clientPrivateKey } : null),
+  }
+}
+
+export function isOIDCProvider(
+  provider: InternalProvider<"oidc" | "oauth">
+): provider is InternalProvider<"oidc"> {
+  return provider.type === "oidc"
+}
+
+export function isOAuth2Provider(
+  provider: InternalProvider<"oidc" | "oauth">
+): provider is InternalProvider<"oauth"> {
+  return provider.type === "oauth"
+}
+
+/** Either OAuth 2 or OIDC */
+export function isOAuthProvider(
+  provider: InternalProvider<any>
+): provider is InternalProvider<"oauth" | "oidc"> {
+  return provider.type === "oauth" || provider.type === "oidc"
+}

package/src/lib/utils/session.ts

@@ -0,0 +1,41 @@
+import type { InternalOptions, User } from "../../types.js"
+import type { SessionStore } from "./cookie.js"
+
+/**
+ * Returns the currently logged in user, if any.
+ */
+export async function getLoggedInUser(
+  options: InternalOptions,
+  sessionStore: SessionStore
+): Promise<User | null> {
+  const {
+    adapter,
+    jwt,
+    session: { strategy: sessionStrategy },
+  } = options
+
+  const sessionToken = sessionStore.value
+  if (!sessionToken) return null
+
+  // Try to decode JWT
+  if (sessionStrategy === "jwt") {
+    const salt = options.cookies.sessionToken.name
+    const payload = await jwt.decode({ ...jwt, token: sessionToken, salt })
+
+    if (payload && payload.sub) {
+      return {
+        id: payload.sub,
+        name: payload.name,
+        email: payload.email,
+        image: payload.picture,
+      }
+    }
+  } else {
+    const userAndSession = await adapter?.getSessionAndUser(sessionToken)
+    if (userAndSession) {
+      return userAndSession.user
+    }
+  }
+
+  return null
+}

package/src/lib/utils/web.ts

@@ -0,0 +1,151 @@
+import * as cookie from "../vendored/cookie.js"
+import { UnknownAction } from "../../errors.js"
+import { setLogger } from "./logger.js"
+
+import type {
+  AuthAction,
+  RequestInternal,
+  ResponseInternal,
+} from "../../types.js"
+import { isAuthAction } from "./actions.js"
+import type { AuthConfig } from "../../index.js"
+
+const { parse: parseCookie, serialize: serializeCookie } = cookie
+
+async function getBody(req: Request): Promise<Record<string, any> | undefined> {
+  if (!("body" in req) || !req.body || req.method !== "POST") return
+
+  const contentType = req.headers.get("content-type")
+  if (contentType?.includes("application/json")) {
+    return await req.json()
+  } else if (contentType?.includes("application/x-www-form-urlencoded")) {
+    const params = new URLSearchParams(await req.text())
+    return Object.fromEntries(params)
+  }
+}
+
+export async function toInternalRequest(
+  req: Request,
+  config: AuthConfig
+): Promise<RequestInternal | undefined> {
+  try {
+    if (req.method !== "GET" && req.method !== "POST")
+      throw new UnknownAction("Only GET and POST requests are supported")
+
+    // Defaults are usually set in the `init` function, but this is needed below
+    config.basePath ??= "/auth"
+
+    const url = new URL(req.url)
+
+    const { action, providerId } = parseActionAndProviderId(
+      url.pathname,
+      config.basePath
+    )
+
+    return {
+      url,
+      action,
+      providerId,
+      method: req.method,
+      headers: Object.fromEntries(req.headers),
+      body: req.body ? await getBody(req) : undefined,
+      cookies: parseCookie(req.headers.get("cookie") ?? "") ?? {},
+      error: url.searchParams.get("error") ?? undefined,
+      query: Object.fromEntries(url.searchParams),
+    }
+  } catch (e) {
+    const logger = setLogger(config)
+    logger.error(e as Error)
+    logger.debug("request", req)
+  }
+}
+
+export function toRequest(request: RequestInternal): Request {
+  return new Request(request.url, {
+    headers: request.headers,
+    method: request.method,
+    body:
+      request.method === "POST"
+        ? JSON.stringify(request.body ?? {})
+        : undefined,
+  })
+}
+
+export function toResponse(res: ResponseInternal): Response {
+  const headers = new Headers(res.headers)
+
+  res.cookies?.forEach((cookie) => {
+    const { name, value, options } = cookie
+    const cookieHeader = serializeCookie(name, value, options)
+    if (headers.has("Set-Cookie")) headers.append("Set-Cookie", cookieHeader)
+    else headers.set("Set-Cookie", cookieHeader)
+  })
+
+  let body = res.body
+
+  if (headers.get("content-type") === "application/json")
+    body = JSON.stringify(res.body)
+  else if (headers.get("content-type") === "application/x-www-form-urlencoded")
+    body = new URLSearchParams(res.body).toString()
+
+  const status = res.redirect ? 302 : (res.status ?? 200)
+  const response = new Response(body, { headers, status })
+
+  if (res.redirect) response.headers.set("Location", res.redirect)
+
+  return response
+}
+
+/** Web compatible method to create a hash, using SHA256 */
+export async function createHash(message: string) {
+  const data = new TextEncoder().encode(message)
+  const hash = await crypto.subtle.digest("SHA-256", data)
+  return Array.from(new Uint8Array(hash))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("")
+    .toString()
+}
+
+/** Web compatible method to create a random string of a given length */
+export function randomString(size: number) {
+  const i2hex = (i: number) => ("0" + i.toString(16)).slice(-2)
+  const r = (a: string, i: number): string => a + i2hex(i)
+  const bytes = crypto.getRandomValues(new Uint8Array(size))
+  return Array.from(bytes).reduce(r, "")
+}
+
+/** @internal Parse the action and provider id from a URL pathname. */
+export function parseActionAndProviderId(
+  pathname: string,
+  base: string
+): {
+  action: AuthAction
+  providerId?: string
+} {
+  const a = pathname.match(new RegExp(`^${base}(.+)`))
+
+  if (a === null) throw new UnknownAction(`Cannot parse action at ${pathname}`)
+
+  const actionAndProviderId = a.at(-1)!
+
+  const b = actionAndProviderId.replace(/^\//, "").split("/").filter(Boolean)
+
+  if (b.length !== 1 && b.length !== 2)
+    throw new UnknownAction(`Cannot parse action at ${pathname}`)
+
+  const [action, providerId] = b
+
+  if (!isAuthAction(action))
+    throw new UnknownAction(`Cannot parse action at ${pathname}`)
+
+  if (
+    providerId &&
+    !["signin", "callback", "webauthn-options"].includes(action)
+  )
+    throw new UnknownAction(`Cannot parse action at ${pathname}`)
+
+  return {
+    action,
+    providerId: providerId == "undefined" ? undefined : providerId,
+  }
+}