@mulverse/mulguard-core 1.0.0

package/src/providers/gitlab.ts

@@ -0,0 +1,140 @@
+/**
+ * <div class="provider" style={{backgroundColor: "#000", display: "flex", justifyContent: "space-between", color: "#fff", padding: 16}}>
+ * <span>Built-in <b>GitLab</b> integration.</span>
+ * <a href="https://gitlab.com">
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/gitlab.svg" height="48" width="48"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/gitlab
+ */
+import type { OAuthConfig, OAuthUserConfig } from "./index.js"
+
+export interface GitLabProfile extends Record<string, any> {
+  id: number
+  username: string
+  email: string
+  name: string
+  state: string
+  avatar_url: string
+  web_url: string
+  created_at: string
+  bio: string
+  location?: string
+  public_email: string
+  skype: string
+  linkedin: string
+  twitter: string
+  website_url: string
+  organization: string
+  job_title: string
+  pronouns: string
+  bot: boolean
+  work_information?: string
+  followers: number
+  following: number
+  local_time: string
+  last_sign_in_at: string
+  confirmed_at: string
+  theme_id: number
+  last_activity_on: string
+  color_scheme_id: number
+  projects_limit: number
+  current_sign_in_at: string
+  identities: Array<{
+    provider: string
+    extern_uid: string
+  }>
+  can_create_group: boolean
+  can_create_project: boolean
+  two_factor_enabled: boolean
+  external: boolean
+  private_profile: boolean
+  commit_email: string
+  shared_runners_minutes_limit: number
+  extra_shared_runners_minutes_limit: number
+}
+
+/**
+ * Add GitLab login to your page.
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/gitlab
+ * ```
+ *
+ * #### Configuration
+ *```ts
+ * import { Auth } from "@auth/core"
+ * import GitLab from "@auth/core/providers/gitlab"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     GitLab({ clientId: GITLAB_CLIENT_ID, clientSecret: GITLAB_CLIENT_SECRET }),
+ *   ],
+ * })
+ * ```
+ *
+ * ### Resources
+ *
+ *  - [GitLab OAuth documentation](https://docs.gitlab.com/ee/api/oauth2.html)
+ *
+ * ### Notes
+ *
+ * By default, Auth.js assumes that the GitLab provider is
+ * based on the [OAuth 2](https://www.rfc-editor.org/rfc/rfc6749.html) specification.
+ *
+ * :::tip
+ * Enable the `read_user` option in scope if you want to save the users email address on sign up.
+ * :::
+ *
+ * :::tip
+ *
+ * The GitLab provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/gitlab.ts).
+ * To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::
+ *
+ * :::info **Disclaimer**
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ *
+ * :::
+ */
+export default function GitLab<P extends GitLabProfile>(
+  options: OAuthUserConfig<P> & {
+    /**
+     * @default "https://gitlab.com"
+     */
+    baseUrl?: URL | string
+  }
+): OAuthConfig<P> {
+  const baseUrl = options.baseUrl ?? "https://gitlab.com"
+  const url = new URL(baseUrl.toString())
+
+  return {
+    id: "gitlab",
+    name: "GitLab",
+    type: "oauth",
+    authorization: `${url}oauth/authorize?scope=read_user`,
+    token: `${url}oauth/token`,
+    userinfo: `${url}api/v4/user`,
+    profile(profile) {
+      return {
+        id: profile.sub?.toString() ?? profile.id?.toString(),
+        name: profile.name ?? profile.username,
+        email: profile.email,
+        image: profile.avatar_url,
+      }
+    },
+    style: { bg: "#FC6D26", text: "#fff" },
+    options,
+  }
+}

package/src/providers/google.ts

@@ -0,0 +1,152 @@
+/**
+ * <div class="provider" style={{backgroundColor: "#000", display: "flex", justifyContent: "space-between", color: "#fff", padding: 16}}>
+ * <span>Built-in <b>Google</b> integration.</span>
+ * <a href="https://google.com">
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/google.svg" height="48" width="48"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/google
+ */
+import type { OAuthConfig, OAuthUserConfig } from "./index.js"
+
+export interface GoogleProfile extends Record<string, any> {
+  aud: string
+  azp: string
+  email: string
+  email_verified: boolean
+  exp: number
+  family_name?: string
+  given_name: string
+  hd?: string
+  iat: number
+  iss: string
+  jti?: string
+  locale?: string
+  name: string
+  nbf?: number
+  picture: string
+  sub: string
+}
+
+/**
+ * Add Google login to your page.
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/google
+ * ```
+ *
+ * #### Configuration
+ *```ts
+ * import { Auth } from "@auth/core"
+ * import Google from "@auth/core/providers/google"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     Google({ clientId: GOOGLE_CLIENT_ID, clientSecret: GOOGLE_CLIENT_SECRET }),
+ *   ],
+ * })
+ * ```
+ *
+ * ### Resources
+ *
+ *  - [Google OAuth documentation](https://developers.google.com/identity/protocols/oauth2)
+ *  - [Google OAuth Configuration](https://console.developers.google.com/apis/credentials)
+ *
+ * ### Notes
+ *
+ * By default, Auth.js assumes that the Google provider is
+ * based on the [Open ID Connect](https://openid.net/specs/openid-connect-core-1_0.html) specification.
+ *
+ *
+ * The "Authorized redirect URIs" used when creating the credentials must include your full domain and end in the callback path. For example;
+ *
+ * - For production: `https://{YOUR_DOMAIN}/api/auth/callback/google`
+ * - For development: `http://localhost:3000/api/auth/callback/google`
+ *
+ * :::warning
+ * Google only provides Refresh Token to an application the first time a user signs in.
+ *
+ * To force Google to re-issue a Refresh Token, the user needs to remove the application from their account and sign in again:
+ * https://myaccount.google.com/permissions
+ *
+ * Alternatively, you can also pass options in the `params` object of `authorization` which will force the Refresh Token to always be provided on sign in, however this will ask all users to confirm if they wish to grant your application access every time they sign in.
+ *
+ * If you need access to the RefreshToken or AccessToken for a Google account and you are not using a database to persist user accounts, this may be something you need to do.
+ *
+ * ```ts
+ * const options = {
+ *   providers: [
+ *     Google({
+ *       clientId: process.env.GOOGLE_ID,
+ *       clientSecret: process.env.GOOGLE_SECRET,
+ *       authorization: {
+ *         params: {
+ *           prompt: "consent",
+ *           access_type: "offline",
+ *           response_type: "code"
+ *         }
+ *       }
+ *     })
+ *   ],
+ * }
+ * ```
+ *
+ * :::
+ *
+ * :::tip
+ * Google also returns a `email_verified` boolean property in the OAuth profile.
+ *
+ * You can use this property to restrict access to people with verified accounts at a particular domain.
+ *
+ * ```ts
+ * const options = {
+ *   ...
+ *   callbacks: {
+ *     async signIn({ account, profile }) {
+ *       if (account.provider === "google") {
+ *         return profile.email_verified && profile.email.endsWith("@example.com")
+ *       }
+ *       return true // Do different verification for other providers that don't have `email_verified`
+ *     },
+ *   }
+ *   ...
+ * }
+ * ```
+ *
+ * :::
+ * :::tip
+ *
+ * The Google provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/google.ts).
+ * To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::
+ *
+ * :::info **Disclaimer**
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ *
+ * :::
+ */
+export default function Google<P extends GoogleProfile>(
+  options: OAuthUserConfig<P>
+): OAuthConfig<P> {
+  return {
+    id: "google",
+    name: "Google",
+    type: "oidc",
+    issuer: "https://accounts.google.com",
+    style: {
+      brandColor: "#1a73e8",
+    },
+    options,
+  }
+}

package/src/providers/hubspot.ts

@@ -0,0 +1,117 @@
+/**
+ * <div class="provider" style={{backgroundColor: "#000", display: "flex", justifyContent: "space-between", color: "#fff", padding: 16}}>
+ * <span>Built-in <b>HubSpot</b> integration.</span>
+ * <a href="https://hubspot.com">
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/hubspot.svg" height="48" width="48"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/hubspot
+ */
+import type { OAuthConfig, OAuthUserConfig } from "./index.js"
+
+interface HubSpotProfile extends Record<string, any> {
+  // https://legacydocs.hubspot.com/docs/methods/oauth2/get-access-token-information
+  user: string
+  user_id: string
+  hub_domain: string
+  hub_id: string
+}
+
+/**
+ * Add HubSpot login to your page.
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/hubspot
+ * ```
+ *
+ * #### Configuration
+ *```ts
+ * import { Auth } from "@auth/core"
+ * import HubSpot from "@auth/core/providers/hubspot"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     HubSpot({
+ *       clientId: HUBSPOT_CLIENT_ID,
+ *       clientSecret: HUBSPOT_CLIENT_SECRET,
+ *     }),
+ *   ],
+ * })
+ * ```
+ *
+ * ### Resources
+ *
+ *  - [HubSpot OAuth documentation](https://developers.hubspot.com/docs/api/oauth-quickstart-guide)
+ *
+ * ### Notes
+ *
+ * By default, Auth.js assumes that the HubSpot provider is
+ * based on the [OAuth 2](https://www.rfc-editor.org/rfc/rfc6749.html) specification.
+ *
+ * You need to have an APP in your Developer Account as described at https://developers.hubspot.com/docs/api/developer-tools-overview
+ * :::note
+ * HubSpot returns a limited amount of information on the token holder (see [docs](https://legacydocs.hubspot.com/docs/methods/oauth2/get-access-token-information)). One other issue is that the name and profile photo cannot be fetched through API as discussed [here](https://community.hubspot.com/t5/APIs-Integrations/Profile-photo-is-not-retrieved-with-User-API/m-p/325521).
+ * :::
+ * :::tip
+ *
+ * The HubSpot provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/hubspot.ts).
+ * To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::
+ *
+ * :::info **Disclaimer**
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ *
+ * :::
+ */
+export default function HubSpot<P extends HubSpotProfile>(
+  options: OAuthUserConfig<P>
+): OAuthConfig<P> {
+  return {
+    id: "hubspot",
+    name: "HubSpot",
+    type: "oauth",
+    authorization: {
+      url: "https://app.hubspot.com/oauth/authorize",
+      params: { scope: "oauth", client_id: options.clientId },
+    },
+    client: {
+      token_endpoint_auth_method: "client_secret_post",
+    },
+    token: "https://api.hubapi.com/oauth/v1/token",
+    userinfo: {
+      url: "https://api.hubapi.com/oauth/v1/access-tokens",
+      async request({ tokens, provider }) {
+        const url = `${provider.userinfo?.url}/${tokens.access_token}`
+
+        return await fetch(url, {
+          headers: { "Content-Type": "application/json" },
+          method: "GET",
+        }).then(async (res) => await res.json())
+      },
+    },
+    profile(profile) {
+      return {
+        id: profile.user_id,
+        name: profile.user,
+        email: profile.user,
+
+        // TODO: get image from profile once it's available
+        // Details available https://community.hubspot.com/t5/APIs-Integrations/Profile-photo-is-not-retrieved-with-User-API/m-p/325521
+        image: null,
+      }
+    },
+    style: { bg: "#ff7a59", text: "#fff" },
+    options,
+  }
+}

package/src/providers/huggingface.ts

@@ -0,0 +1,234 @@
+/**
+ * <div class="provider" style={{backgroundColor: "#fff", display: "flex", justifyContent: "space-between", color: "#000", padding: 16}}>
+ * <span>Built-in <b>Hugging Face</b> integration.</span>
+ * <a href="https://huggingface.co">
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/providers/huggingface.svg" height="48" width="48"/>
+ * </a>
+ * </div>
+ *
+ * @module providers/huggingface
+ */
+
+import type { OIDCConfig, OIDCUserConfig } from "./index.js"
+
+export interface HuggingfaceProfile {
+  /**
+   * Unique identifier for the user.
+   */
+  sub: string
+  /**
+   * Full name of the user.
+   *
+   * Needs 'profile' scope
+   */
+  name?: string
+  /**
+   * Username of the user.
+   *
+   * Need 'profile' scope
+   */
+  preferred_username?: string
+  /**
+   * URL of the user's avatar.
+   *
+   * Need 'profile' scope
+   */
+  profile?: string
+  /**
+   * URL of the user's profile picture.
+   *
+   * Need 'profile' scope
+   */
+  picture?: string
+  /**
+   * Need 'profile' scope
+   *
+   * Website of the user.
+   */
+  website?: string
+  /**
+   * Need 'email' scope
+   *
+   * Email address of the user.
+   */
+  email?: string
+  /**
+   * Need 'email' scope
+   *
+   * Whether the user's email address is verified. Should always be true, Hugging Face enforces
+   * email verification for users to grant access to OAuth apps.
+   */
+  email_verified?: boolean
+  /**
+   * Whether the user has a paid subscription.
+   */
+  isPro: boolean
+  /**
+   * Whether the user has a payment method set up.
+   *
+   * Needs the `read-billing` scope.
+   */
+  canPay?: boolean
+  /**
+   * List of the user's organizations.
+   */
+  orgs: Array<{
+    /**
+     * Unique identifier for the organization.
+     */
+    sub: string
+    /**
+     * Name of the organization.
+     */
+    name: string
+    /**
+     * URL of the organization's avatar.
+     */
+    picture: string
+    /**
+     * Username of the organization.
+     */
+    preferred_username: string
+    /**
+     * Whether the organization has a paid enterprise subscription.
+     */
+    isEnterprise: boolean
+    /**
+     * Whether the organization has a payment method set up.
+     *
+     * Access to the organization needs to be granted to the oauth app for this field to be present.
+     */
+    canPay?: boolean
+    /**
+     * The role of the user in the organization.
+     *
+     * Access to the organization needs to be granted to the oauth app for this field to be present.
+     */
+    roleInOrg?: "admin" | "write" | "read" | "contributor"
+    /**
+     * User needs to re-authenticate to access the organization.
+     *
+     * Access to the organization needs to be granted to the oauth app for this field to be present.
+     */
+    pendingSSO?: boolean
+    /**
+     * User needs to enable MFA to access the organization.
+     *
+     * Access to the organization needs to be granted to the oauth app for this field to be present.
+     */
+    missingMFA?: boolean
+    /**
+     * Resource groups are a feature of enterprise organizations.
+     *
+     * They allow granular access control to resources within the organization.
+     *
+     * Access to the organization needs to be granted to the oauth app for this field to be present.
+     */
+    resourceGroups?: Array<{
+      /**
+       * Unique identifier for the resource group.
+       */
+      sub: string
+      name: string
+      /**
+       * The role of the user in the resource group.
+       */
+      role: "read" | "write" | "admin" | "contributor"
+    }>
+  }>
+}
+
+/**
+ * Add HuggingFace login to your page.
+ *
+ * ### Setup
+ *
+ * #### Callback URL
+ * ```
+ * https://example.com/api/auth/callback/huggingface
+ * ```
+ *
+ * #### Configuration
+ *```ts
+ * import { Auth } from "@auth/core"
+ * import HuggingFace from "@auth/core/providers/huggingface"
+ *
+ * const request = new Request(origin)
+ * const response = await Auth(request, {
+ *   providers: [
+ *     HuggingFace({
+ *       clientId: HUGGINGFACE_CLIENT_ID,
+ *       clientSecret: HUGGINGFACE_CLIENT_SECRET,
+ *       authorization: {
+ *        params: {
+ *          scope: "openid profile email", // specify the scopes you need
+ *          //  orgIds: "unique_org_id" // If your oauth app needs access to a specific organization of the user
+ *        }
+ *       },
+ *     }),
+ *   ],
+ * })
+ * ```
+ *
+ * The following scopes are available:
+ *
+ * - `openid`: Grants access to the user's OpenID Connect profile.
+ * - `profile`: Grants access to the user's profile information.
+ * - `email`: Grants access to the user's email address.
+ * - `read-repos`: Grants read access to the user's repositories.
+ * - `write-repos`: Grants write access to the user's repositories.
+ * - `manage-repos`: Can create/delete repositories on behalf of the user.
+ * - `write-discussions`: Can post on the user's behalf.
+ * - `read-billing`: Know if the user has a payment method set up.
+ * - `inference-api`: Can make calls to Inference providers on behalf of the user.
+ * - `webhooks`: Can manage webhooks on behalf of the user.
+ *
+ * You need to enable them first in your OAuth app settings.
+ *
+ * /!\ By default, the `profile` and `email` scopes are enabled in NextAuth. So you need to enable
+ * the `email` scope in your OAuth app settings or you will get a scope error.
+ *
+ * ### Resources
+ *
+ *  - [Hugging Face OAuth documentation](https://huggingface.co/docs/hub/en/oauth#creating-an-oauth-app)
+ *  - [Create an OAuth application](https://huggingface.co/settings/applications/new)
+ *
+ * ### Notes
+ *
+ * By default, Auth.js assumes that the Hugging Face provider is
+ * based on the [OIDC](https://openid.net/specs/openid-connect-core-1_0.html) specification.
+ *
+ * :::tip
+ *
+ * The HuggingFace provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/huggingface.ts).
+ * To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers).
+ *
+ * :::
+ *
+ * :::info **Disclaimer**
+ *
+ * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue).
+ *
+ * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from
+ * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec,
+ * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions).
+ *
+ * :::
+ */
+export default function Huggingface(
+  options: OIDCUserConfig<HuggingfaceProfile>
+): OIDCConfig<HuggingfaceProfile> {
+  return {
+    id: "huggingface",
+    name: "Hugging Face",
+    type: "oidc",
+    issuer: "https://huggingface.co",
+    checks: ["state", "pkce"],
+
+    style: {
+      bg: "#FFD21E",
+      text: "#000",
+    },
+    options,
+  }
+}