@mulverse/mulguard-core 1.0.0

package/src/providers/frontegg.ts

@@ -0,0 +1,111 @@
+/**
+ * <div style={{display: "flex", justifyContent: "space-between", alignItems: "center"}}>
+ * <span style={{fontSize: "1.35rem" }}>
+ *  Built-in sign in with <b>Frontegg</b> integration.
+ * </span>
+ * <a href="https://frontegg.com" style={{backgroundColor: "black", padding: "12px", borderRadius: "100%" }}>
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/frontegg.svg" width="24"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/frontegg
+ */
+
+import type { OIDCConfig, OIDCUserConfig } from "./index.js"
+
+/** The returned user profile from Frontegg when using the profile callback. [Reference](https://docs.frontegg.com/docs/admin-portal-profile). */
+export interface FronteggProfile {
+  /** The user's unique Frontegg ID */
+  sub: string
+  /** The user's name */
+  name: string
+  /** The user's email */
+  email: string
+  /** A boolean indicating if the user's email is verified */
+  email_verified: boolean
+  /** The user's picture */
+  profilePictureUrl: string
+  /** The user's roles */
+  roles: string[]
+  /** The user's custom attributes */
+  [claim: string]: unknown
+}
+
+/**
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/frontegg
+ * ```
+ *
+ * #### Configuration
+ * ```ts
+ * import { Auth } from "@auth/core"
+ * import Frontegg from "@auth/core/providers/frontegg"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     Frontegg({
+ *       clientId: AUTH_FRONTEGG_ID,
+ *       clientSecret: AUTH_FRONTEGG_SECRET,
+ *       issuer: AUTH_FRONTEGG_ISSUER
+ *     }),
+ *   ],
+ * })
+ * ```
+ *
+ * ### Configuring Frontegg
+ *
+ * Follow these steps:
+ *
+ * Log into the [Frontegg portal](https://portal.frontegg.com)
+ *
+ * Authentication > Login method > Hosted login > Add your callback url here
+ *
+ * Then, create a `.env.local` file in the project root add the following entries:
+ *
+ * Get the following from the Frontegg's portal:
+ * ```
+ * AUTH_FRONTEGG_ID="<Client ID>" # Environments > Your environment > Env settings
+ * AUTH_FRONTEGG_SECRET="<API KEY>" # Environments > Your environment > Env settings
+ * AUTH_FRONTEGG_ISSUER="<https://[YOUR_SUBDOMAIN].frontegg.com>" # Environments > Your environment > Env settings > Domains > Domain name
+ * ```
+ *
+ * ### Resources
+ *
+ * - [Frontegg Docs](https://docs.frontegg.com/docs/how-to-use-our-docs)
+ *
+ * ### Notes
+ *
+ * The Frontegg provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/frontegg.ts). To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::info
+ * By default, Auth.js assumes that the Frontegg provider is based on the [OIDC](https://openid.net/specs/openid-connect-core-1_0.html) spec
+ * :::
+ *
+ * ## Help
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ */
+export default function Frontegg(
+  options: OIDCUserConfig<FronteggProfile>
+): OIDCConfig<FronteggProfile> {
+  return {
+    id: "frontegg",
+    name: "Frontegg",
+    type: "oidc",
+    authorization: `${options.issuer}/oauth/authorize`,
+    token: `${options.issuer}/oauth/token`,
+    userinfo: `${options.issuer}/identity/resources/users/v2/me`,
+    wellKnown: `${options.issuer}/oauth/.well-known/openid-configuration`,
+    issuer: options.issuer,
+    options,
+  }
+}

package/src/providers/fusionauth.ts

@@ -0,0 +1,336 @@
+/**
+ * <div class="provider" style={{backgroundColor: "#000", display: "flex", justifyContent: "space-between", color: "#fff", padding: 16}}>
+ * <span>Built-in <b>FusionAuth</b> integration.</span>
+ * <a href="https://fusionauth.com">
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/fushionauth.svg" height="48" width="48"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/fusionauth
+ */
+import type { OAuthConfig, OAuthUserConfig } from "./oauth.js"
+
+/**
+ * This is the default openid signature returned from FusionAuth
+ * it can be customized using [lambda functions](https://fusionauth.io/docs/v1/tech/lambdas)
+ */
+export interface FusionAuthProfile extends Record<string, any> {
+  aud: string
+  exp: number
+  iat: number
+  iss: string
+  sub: string
+  jti: string
+  authenticationType: string
+  email: string
+  email_verified: boolean
+  preferred_username?: string
+  name?: string
+  given_name?: string
+  middle_name?: string
+  family_name?: string
+  at_hash: string
+  c_hash: string
+  scope: string
+  sid: string
+  picture?: string
+}
+
+/**
+ * Add FusionAuth login to your page.
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/fusionauth
+ * ```
+ *
+ * #### Configuration
+ *```ts
+ * import { Auth } from "@auth/core"
+ * import FusionAuth from "@auth/core/providers/fusionauth"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     FusionAuth({
+ *       clientId: FUSIONAUTH_CLIENT_ID,
+ *       clientSecret: FUSIONAUTH_CLIENT_SECRET,
+ *       tenantId: FUSIONAUTH_TENANT_ID,
+ *       issuer: FUSIONAUTH_ISSUER,
+ *     }),
+ *   ],
+ * })
+ * ```
+ * :::warning
+ * If you're using multi-tenancy, you need to pass in the tenantId option to apply the proper theme.
+ * :::
+ *
+ * ### Resources
+ *
+ *  - [FusionAuth OAuth documentation](https://fusionauth.io/docs/lifecycle/authenticate-users/oauth/)
+ *
+ * ### Notes
+ *
+ * By default, Auth.js assumes that the FusionAuth provider is
+ * based on the [OAuth 2](https://www.rfc-editor.org/rfc/rfc6749.html) specification.
+ *
+ * ## Configuration
+ * :::tip
+ * An application can be created at https://your-fusionauth-server-url/admin/application.
+ *
+ * For more information, follow the [FusionAuth 5-minute setup guide](https://fusionauth.io/docs/v1/tech/5-minute-setup-guide).
+ * :::
+ *
+ * In the OAuth settings for your application, configure the following.
+ *
+ * - Redirect URL
+ *   - https://localhost:3000/api/auth/callback/fusionauth
+ * - Enabled grants
+ *   - Make sure _Authorization Code_ is enabled.
+ *
+ * If using JSON Web Tokens, you need to make sure the signing algorithm is RS256, you can create an RS256 key pair by
+ * going to Settings, Key Master, generate RSA and choosing SHA-256 as algorithm. After that, go to the JWT settings of
+ * your application and select this key as Access Token signing key and Id Token signing key.
+ * :::tip
+ *
+ * The FusionAuth provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/fusionauth.ts).
+ * To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::
+ *
+ * :::info **Disclaimer**
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ *
+ * :::
+ * 
+ * 
+ * It is highly recommended to follow this example call when using the provider in Next.js
+ *  so that you can access both the access_token and id_token on the server.
+ * 
+ * ```ts
+ * /// <reference types="next-auth" />
+import NextAuth from 'next-auth';
+export const { handlers, auth, signIn, signOut } = NextAuth({
+  providers: [
+    {
+      id: 'fusionauth',
+      name: 'FusionAuth',
+      type: 'oidc',
+      issuer: process.env.AUTH_FUSIONAUTH_ISSUER!,
+      clientId: process.env.AUTH_FUSIONAUTH_CLIENT_ID!,
+      clientSecret: process.env.AUTH_FUSIONAUTH_CLIENT_SECRET!,
+      authorization: {
+        params: {
+          scope: 'offline_access email openid profile',
+          tenantId: process.env.AUTH_FUSIONAUTH_TENANT_ID!,
+        },
+      },
+      userinfo: `${process.env.AUTH_FUSIONAUTH_ISSUER}/oauth2/userinfo`,
+      // This is due to a known processing issue
+      // TODO: https://github.com/nextauthjs/next-auth/issues/8745#issuecomment-1907799026
+      token: {
+        url: `${process.env.AUTH_FUSIONAUTH_ISSUER}/oauth2/token`,
+        conform: async (response: Response) => {
+          if (response.status === 401) return response;
+
+          const newHeaders = Array.from(response.headers.entries())
+            .filter(([key]) => key.toLowerCase() !== 'www-authenticate')
+            .reduce(
+              (headers, [key, value]) => (headers.append(key, value), headers),
+              new Headers()
+            );
+
+          return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: newHeaders,
+          });
+        },
+      },
+    },
+  ],
+  session: {
+    strategy: 'jwt',
+  },
+  // Required to get the account object in the session and enable
+  // the ability to call API's externally that rely on JWT tokens.
+  callbacks: {
+    async jwt(params) {
+      const { token, user, account } = params;
+      if (account) {
+        // First-time login, save the `access_token`, its expiry and the `refresh_token`
+        return {
+          ...token,
+          ...account,
+        };
+      } else if (
+        token.expires_at &&
+        Date.now() < (token.expires_at as number) * 1000
+      ) {
+        // Subsequent logins, but the `access_token` is still valid
+        return token;
+      } else {
+        // Subsequent logins, but the `access_token` has expired, try to refresh it
+        if (!token.refresh_token) throw new TypeError('Missing refresh_token');
+
+        try {
+          const refreshResponse = await fetch(
+            `${process.env.AUTH_FUSIONAUTH_ISSUER}/oauth2/token`,
+            {
+              method: 'POST',
+              headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+              },
+              body: new URLSearchParams({
+                client_id: process.env.AUTH_FUSIONAUTH_CLIENT_ID!,
+                client_secret: process.env.AUTH_FUSIONAUTH_CLIENT_SECRET!,
+                grant_type: 'refresh_token',
+                refresh_token: token.refresh_token as string,
+              }),
+            }
+          );
+
+          if (!refreshResponse.ok) {
+            throw new Error('Failed to refresh token');
+          }
+
+          const tokensOrError = await refreshResponse.json();
+
+          if (!refreshResponse.ok) throw tokensOrError;
+
+          const newTokens = tokensOrError as {
+            access_token: string;
+            expires_in: number;
+            refresh_token?: string;
+          };
+
+          return {
+            ...token,
+            access_token: newTokens.access_token,
+            expires_at: Math.floor(Date.now() / 1000 + newTokens.expires_in),
+            // Some providers only issue refresh tokens once, so preserve if we did not get a new one
+            refresh_token: newTokens.refresh_token
+              ? newTokens.refresh_token
+              : token.refresh_token,
+          };
+        } catch (error) {
+          console.error('Error refreshing access_token', error);
+          // If we fail to refresh the token, return an error so we can handle it on the page
+          token.error = 'RefreshTokenError';
+          return token;
+        }
+      }
+    },
+    async session(params) {
+      const { session, token } = params;
+      return { ...session, ...token };
+    },
+  },
+});
+
+declare module 'next-auth' {
+  interface Session {
+    access_token: string;
+    expires_in: number;
+    id_token?: string;
+    expires_at: number;
+    refresh_token?: string;
+    refresh_token_id?: string;
+    error?: 'RefreshTokenError';
+    scope: string;
+    token_type: string;
+    userId: string;
+    provider: string;
+    type: string;
+    providerAccountId: string;
+  }
+}
+
+declare module 'next-auth' {
+  interface JWT {
+    access_token: string;
+    expires_in: number;
+    id_token?: string;
+    expires_at: number;
+    refresh_token?: string;
+    refresh_token_id?: string;
+    error?: 'RefreshTokenError';
+    scope: string;
+    token_type: string;
+    userId: string;
+    provider: string;
+    type: string;
+    providerAccountId: string;
+  }
+}
+```
+ * 
+ * 
+ * 
+ */
+export default function FusionAuth<P extends FusionAuthProfile>(
+  // tenantId only needed if there is more than one tenant configured on the server
+  options: OAuthUserConfig<P> & { tenantId?: string }
+): OAuthConfig<P> {
+  return {
+    id: "fusionauth",
+    name: "FusionAuth",
+    type: "oidc",
+    issuer: options.issuer,
+    clientId: options.clientId,
+    clientSecret: options.clientSecret,
+    wellKnown: options?.tenantId
+      ? `${options.issuer}/.well-known/openid-configuration?tenantId=${options.tenantId}`
+      : `${options.issuer}/.well-known/openid-configuration`,
+    authorization: {
+      params: {
+        scope: "openid offline_access email profile",
+        ...(options?.tenantId && { tenantId: options.tenantId }),
+      },
+    },
+    userinfo: `${options.issuer}/oauth2/userinfo`,
+    // This is due to a known processing issue
+    // TODO: https://github.com/nextauthjs/next-auth/issues/8745#issuecomment-1907799026
+    token: {
+      url: `${options.issuer}/oauth2/token`,
+      conform: async (response: Response) => {
+        if (response.status === 401) return response
+
+        const newHeaders = Array.from(response.headers.entries())
+          .filter(([key]) => key.toLowerCase() !== "www-authenticate")
+          .reduce(
+            (headers, [key, value]) => (headers.append(key, value), headers),
+            new Headers()
+          )
+
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers: newHeaders,
+        })
+      },
+    },
+    checks: ["pkce", "state"],
+    profile(profile) {
+      return {
+        id: profile.sub,
+        email: profile.email,
+        name:
+          profile.name ??
+          profile.preferred_username ??
+          [profile.given_name, profile.middle_name, profile.family_name]
+            .filter((x) => x)
+            .join(" "),
+        image: profile.picture,
+      }
+    },
+    options,
+  }
+}

package/src/providers/github.ts

@@ -0,0 +1,187 @@
+/**
+ * <div class="provider" style={{backgroundColor: "#24292f", display: "flex", justifyContent: "space-between", color: "#fff", padding: 16}}>
+ * <span>Built-in <b>GitHub</b> integration.</span>
+ * <a href="https://github.com">
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/github.svg" height="48" width="48"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/github
+ */
+
+import type { OAuthConfig, OAuthUserConfig } from "./index.js"
+
+export interface GitHubEmail {
+  email: string
+  primary: boolean
+  verified: boolean
+  visibility: "public" | "private"
+}
+
+/** @see [Get the authenticated user](https://docs.github.com/en/rest/users/users#get-the-authenticated-user) */
+export interface GitHubProfile {
+  login: string
+  id: number
+  node_id: string
+  avatar_url: string
+  gravatar_id: string | null
+  url: string
+  html_url: string
+  followers_url: string
+  following_url: string
+  gists_url: string
+  starred_url: string
+  subscriptions_url: string
+  organizations_url: string
+  repos_url: string
+  events_url: string
+  received_events_url: string
+  type: string
+  site_admin: boolean
+  name: string | null
+  company: string | null
+  blog: string | null
+  location: string | null
+  email: string | null
+  hireable: boolean | null
+  bio: string | null
+  twitter_username?: string | null
+  public_repos: number
+  public_gists: number
+  followers: number
+  following: number
+  created_at: string
+  updated_at: string
+  private_gists?: number
+  total_private_repos?: number
+  owned_private_repos?: number
+  disk_usage?: number
+  suspended_at?: string | null
+  collaborators?: number
+  two_factor_authentication: boolean
+  plan?: {
+    collaborators: number
+    name: string
+    space: number
+    private_repos: number
+  }
+  [claim: string]: unknown
+}
+
+/**
+ * Add GitHub login to your page and make requests to [GitHub APIs](https://docs.github.com/en/rest).
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/github
+ * ```
+ *
+ * #### Configuration
+ * ```ts
+ * import { Auth } from "@auth/core"
+ * import GitHub from "@auth/core/providers/github"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     GitHub({ clientId: GITHUB_CLIENT_ID, clientSecret: GITHUB_CLIENT_SECRET }),
+ *   ],
+ * })
+ * ```
+ *
+ * ### Resources
+ *
+ * - [GitHub - Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
+ * - [GitHub - Authorizing OAuth Apps](https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps)
+ * - [GitHub - Configure your GitHub OAuth Apps](https://github.com/settings/developers)
+ * - [Learn more about OAuth](https://authjs.dev/concepts/oauth)
+ * - [Source code](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/github.ts)
+ *
+ * ### Notes
+ *
+ * By default, Auth.js assumes that the GitHub provider is
+ * based on the [OAuth 2](https://www.rfc-editor.org/rfc/rfc6749.html) specification.
+ *
+ * :::tip
+ *
+ * The GitHub provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/github.ts).
+ * To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::
+ *
+ * :::info **Disclaimer**
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ *
+ * :::
+ */
+export default function GitHub(
+  config: OAuthUserConfig<GitHubProfile> & {
+    /** Configuration for usage with [GitHub Enterprise Server](https://docs.github.com/en/enterprise-server/get-started). */
+    enterprise?: {
+      /** The base URL of your GitHub Enterprise Server instance. */
+      baseUrl?: string
+    }
+  }
+): OAuthConfig<GitHubProfile> {
+  const baseUrl = config?.enterprise?.baseUrl ?? "https://github.com"
+  const apiBaseUrl = config?.enterprise?.baseUrl
+    ? `${config?.enterprise?.baseUrl}/api/v3`
+    : "https://api.github.com"
+
+  return {
+    id: "github",
+    name: "GitHub",
+    type: "oauth",
+    authorization: {
+      url: `${baseUrl}/login/oauth/authorize`,
+      params: { scope: "read:user user:email" },
+    },
+    token: `${baseUrl}/login/oauth/access_token`,
+    userinfo: {
+      url: `${apiBaseUrl}/user`,
+      async request({ tokens, provider }) {
+        const profile = await fetch(provider.userinfo?.url as URL, {
+          headers: {
+            Authorization: `Bearer ${tokens.access_token}`,
+            "User-Agent": "authjs",
+          },
+        }).then(async (res) => await res.json())
+
+        if (!profile.email) {
+          // If the user does not have a public email, get another via the GitHub API
+          // See https://docs.github.com/en/rest/users/emails#list-public-email-addresses-for-the-authenticated-user
+          const res = await fetch(`${apiBaseUrl}/user/emails`, {
+            headers: {
+              Authorization: `Bearer ${tokens.access_token}`,
+              "User-Agent": "authjs",
+            },
+          })
+
+          if (res.ok) {
+            const emails: GitHubEmail[] = await res.json()
+            profile.email = (emails.find((e) => e.primary) ?? emails[0]).email
+          }
+        }
+
+        return profile
+      },
+    },
+    profile(profile) {
+      return {
+        id: profile.id.toString(),
+        name: profile.name ?? profile.login,
+        email: profile.email,
+        image: profile.avatar_url,
+      }
+    },
+    style: { bg: "#24292f", text: "#fff" },
+    options: config,
+  }
+}