@oharness/engine 0.1.0

package/dist/auth/oauth.js

@@ -0,0 +1,327 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { parseJson } from "../util/json.js";
+/** RFC 7636 S256 challenge. */
+export function createPkce() {
+    const verifier = base64Url(randomBytes(32));
+    const challenge = base64Url(createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+function base64Url(buffer) {
+    return buffer.toString("base64url");
+}
+export async function exchangeToken(opts) {
+    const body = new URLSearchParams({ client_id: opts.clientId, ...opts.params });
+    const headers = {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json",
+        ...opts.headers,
+    };
+    const mode = opts.clientAuth ?? (opts.clientSecret ? "post" : "none");
+    if (opts.clientSecret && mode === "post")
+        body.set("client_secret", opts.clientSecret);
+    if (opts.clientSecret && mode === "basic") {
+        const basic = Buffer.from(`${opts.clientId}:${opts.clientSecret}`).toString("base64");
+        headers["authorization"] = `Basic ${basic}`;
+    }
+    const response = await fetch(opts.tokenUrl, { method: "POST", headers, body });
+    const text = await response.text();
+    const parsed = parseJson(text);
+    if (!response.ok) {
+        const detail = parsed.ok
+            ? (parsed.value.error_description ?? parsed.value.error ?? text)
+            : text;
+        throw new Error(`token endpoint returned ${response.status}: ${String(detail).slice(0, 300)}`);
+    }
+    if (!parsed.ok)
+        throw new Error(`token endpoint returned non-JSON: ${text.slice(0, 200)}`);
+    if (!parsed.value.access_token)
+        throw new Error("token endpoint returned no access_token");
+    return parsed.value;
+}
+export function toCredential(token, previousRefresh) {
+    return { type: "oauth", ...credentialFields(token, previousRefresh) };
+}
+/** The credential body without the `type` discriminant, for spreading into results. */
+export function credentialFields(token, previousRefresh) {
+    return {
+        access: token.access_token,
+        // Some providers omit refresh_token on refresh and expect you to keep the
+        // original — dropping it here would silently end the session at expiry.
+        refresh: token.refresh_token ?? previousRefresh ?? "",
+        expires: token.expires_in ? Date.now() + token.expires_in * 1_000 : 0,
+    };
+}
+export async function refreshCredential(credential, opts) {
+    if (!credential.refresh)
+        return undefined;
+    const token = await exchangeToken({
+        ...opts,
+        params: {
+            grant_type: "refresh_token",
+            refresh_token: credential.refresh,
+            ...(opts.scope ? { scope: opts.scope } : {}),
+            ...opts.tokenParams,
+        },
+    });
+    return {
+        ...toCredential(token, credential.refresh),
+        ...(credential.accountId ? { accountId: credential.accountId } : {}),
+        ...(credential.baseUrl ? { baseUrl: credential.baseUrl } : {}),
+        ...(credential.metadata ? { metadata: credential.metadata } : {}),
+    };
+}
+/**
+ * Start a device flow. The returned `callback()` polls until the user finishes
+ * authorizing in their browser.
+ */
+export async function startDeviceFlow(opts) {
+    const response = await fetch(opts.deviceCodeUrl, {
+        method: "POST",
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+            ...opts.headers,
+        },
+        body: new URLSearchParams({
+            client_id: opts.clientId,
+            ...(opts.scope ? { scope: opts.scope } : {}),
+        }),
+    });
+    const text = await response.text();
+    const parsed = parseJson(text);
+    if (!response.ok || !parsed.ok) {
+        throw new Error(`device code request failed (${response.status}): ${text.slice(0, 200)}`);
+    }
+    const device = parsed.value;
+    // Servers advertise a minimum poll interval; going faster earns slow_down.
+    let intervalMs = Math.max(1, device.interval ?? 5) * 1_000;
+    const maxAttempts = opts.maxAttempts ?? Math.ceil((device.expires_in ?? 900) / (intervalMs / 1_000));
+    return {
+        method: "auto",
+        url: device.verification_uri_complete ?? device.verification_uri,
+        instructions: `Open ${device.verification_uri} and enter the code: ${device.user_code}`,
+        async callback() {
+            for (let attempt = 0; attempt < maxAttempts; attempt++) {
+                await sleep(intervalMs);
+                const poll = await fetch(opts.tokenUrl, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/x-www-form-urlencoded",
+                        accept: "application/json",
+                        ...opts.headers,
+                    },
+                    body: new URLSearchParams({
+                        client_id: opts.clientId,
+                        device_code: device.device_code,
+                        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    }),
+                });
+                const body = parseJson(await poll.text());
+                if (!body.ok)
+                    continue;
+                if (body.value.access_token) {
+                    return { type: "success", ...credentialFields(body.value) };
+                }
+                switch (body.value.error) {
+                    case "authorization_pending":
+                        continue;
+                    case "slow_down":
+                        intervalMs += 5_000;
+                        continue;
+                    case "expired_token":
+                        return { type: "failed", error: "the device code expired before you authorized" };
+                    case "access_denied":
+                        return { type: "failed", error: "authorization was denied" };
+                    default:
+                        return { type: "failed", error: body.value.error ?? "unknown error" };
+                }
+            }
+            return { type: "failed", error: "timed out waiting for authorization" };
+        },
+    };
+}
+/**
+ * Authorization-code + PKCE where the user pastes the code back.
+ *
+ * Used when we cannot listen on a loopback port (remote shells, containers),
+ * which is common enough that it is worth having as the simpler default.
+ */
+export function startAuthCodeFlow(opts) {
+    const pkce = createPkce();
+    const state = base64Url(randomBytes(16));
+    const url = new URL(opts.authorizeUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", opts.clientId);
+    url.searchParams.set("redirect_uri", opts.redirectUri);
+    url.searchParams.set("code_challenge", pkce.challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", state);
+    if (opts.scope)
+        url.searchParams.set("scope", opts.scope);
+    for (const [key, value] of Object.entries(opts.extraParams ?? {})) {
+        url.searchParams.set(key, value);
+    }
+    return {
+        method: "code",
+        url: url.toString(),
+        instructions: "Authorize in the browser, then paste the code you are given.",
+        async callback(code) {
+            try {
+                // Some providers append the state to the code as `code#state`.
+                const [rawCode, returnedState] = code.trim().split("#");
+                if (returnedState && returnedState !== state) {
+                    return { type: "failed", error: "state mismatch — restart the login" };
+                }
+                const token = await exchangeToken({
+                    tokenUrl: opts.tokenUrl,
+                    clientId: opts.clientId,
+                    clientSecret: opts.clientSecret,
+                    headers: opts.headers,
+                    params: {
+                        grant_type: "authorization_code",
+                        code: rawCode,
+                        redirect_uri: opts.redirectUri,
+                        code_verifier: pkce.verifier,
+                        state,
+                        ...opts.tokenParams,
+                    },
+                });
+                return { type: "success", ...credentialFields(token) };
+            }
+            catch (err) {
+                return { type: "failed", error: err instanceof Error ? err.message : String(err) };
+            }
+        },
+    };
+}
+/**
+ * Authorization-code + PKCE with a loopback listener, so the browser redirect
+ * completes the flow without the user copying anything.
+ *
+ * `prepare` exists for dynamic client registration: the redirect URI has to be
+ * named when the client is registered, and its port is not known until the
+ * listener is up. So the port is claimed first, the caller gets a chance to go
+ * register against it, and only then is the browser sent anywhere.
+ */
+export async function startLoopbackFlow(opts) {
+    const pkce = createPkce();
+    const state = base64Url(randomBytes(16));
+    const { server, port, waitForCode } = await listenForCode(state);
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    let resolved = opts;
+    if (opts.prepare) {
+        try {
+            resolved = { ...opts, ...(await opts.prepare(redirectUri)) };
+        }
+        catch (err) {
+            server.close();
+            throw err;
+        }
+    }
+    if (!resolved.clientId) {
+        server.close();
+        throw new Error("no client id: registration did not produce one");
+    }
+    const url = new URL(resolved.authorizeUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", resolved.clientId);
+    url.searchParams.set("redirect_uri", redirectUri);
+    url.searchParams.set("code_challenge", pkce.challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", state);
+    if (resolved.scope)
+        url.searchParams.set("scope", resolved.scope);
+    for (const [key, value] of Object.entries(resolved.extraParams ?? {})) {
+        url.searchParams.set(key, value);
+    }
+    return {
+        method: "auto",
+        url: url.toString(),
+        instructions: "Complete the login in your browser; this will continue automatically.",
+        async callback() {
+            try {
+                const code = await waitForCode;
+                const token = await exchangeToken({
+                    tokenUrl: resolved.tokenUrl,
+                    clientId: resolved.clientId,
+                    clientSecret: resolved.clientSecret,
+                    headers: resolved.headers,
+                    params: {
+                        grant_type: "authorization_code",
+                        code,
+                        redirect_uri: redirectUri,
+                        code_verifier: pkce.verifier,
+                        ...resolved.tokenParams,
+                    },
+                });
+                return { type: "success", ...credentialFields(token) };
+            }
+            catch (err) {
+                return { type: "failed", error: err instanceof Error ? err.message : String(err) };
+            }
+            finally {
+                server.close();
+            }
+        },
+    };
+}
+async function listenForCode(expectedState) {
+    let resolveCode;
+    let rejectCode;
+    const waitForCode = new Promise((resolve, reject) => {
+        resolveCode = resolve;
+        rejectCode = reject;
+    });
+    const server = createServer((req, res) => {
+        const requestUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+        const code = requestUrl.searchParams.get("code");
+        const state = requestUrl.searchParams.get("state");
+        const error = requestUrl.searchParams.get("error");
+        const reply = (status, message) => {
+            res.writeHead(status, { "content-type": "text/html; charset=utf-8" });
+            res.end(`<!doctype html><meta charset="utf-8"><title>OHarness</title>
+<body style="font-family:system-ui;padding:3rem;max-width:32rem">
+<h1>${status === 200 ? "Signed in" : "Login failed"}</h1><p>${message}</p></body>`);
+        };
+        if (error) {
+            reply(400, `The provider returned: ${escapeHtml(error)}`);
+            rejectCode(new Error(`authorization failed: ${error}`));
+            return;
+        }
+        if (state !== expectedState) {
+            reply(400, "State mismatch — the login may have been tampered with. Please retry.");
+            rejectCode(new Error("state mismatch"));
+            return;
+        }
+        if (!code) {
+            reply(400, "No authorization code was returned.");
+            return;
+        }
+        reply(200, "You can close this tab and return to the terminal.");
+        resolveCode(code);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        // Port 0 lets the OS pick a free port; 127.0.0.1 keeps it off the network.
+        server.listen(0, "127.0.0.1", resolve);
+    });
+    const address = server.address();
+    // Don't leave a listener open forever if the user abandons the browser.
+    // Unref'd: an abandoned login should not be the reason a process refuses to
+    // exit for the next five minutes.
+    const timeout = setTimeout(() => {
+        rejectCode(new Error("timed out waiting for the browser redirect"));
+        server.close();
+    }, 5 * 60_000);
+    timeout.unref?.();
+    waitForCode.finally(() => clearTimeout(timeout)).catch(() => { });
+    return { server, port: address.port, waitForCode };
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (ch) => ch === "&" ? "&amp;" : ch === "<" ? "&lt;" : ch === ">" ? "&gt;" : ch === '"' ? "&quot;" : "&#39;");
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAY5C,+BAA+B;AAC/B,MAAM,UAAU,UAAU;IACxB,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAwBD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,mCAAmC;QACnD,MAAM,EAAE,kBAAkB;QAC1B,GAAG,IAAI,CAAC,OAAO;KAChB,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,KAAK,MAAM;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvF,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtF,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAiE,IAAI,CAAC,CAAC;IAE/F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE;YACtB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE3F,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAoB,EAAE,eAAwB;IACzE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAC9B,KAAoB,EACpB,eAAwB;IAExB,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,YAAY;QAC1B,0EAA0E;QAC1E,wEAAwE;QACxE,OAAO,EAAE,KAAK,CAAC,aAAa,IAAI,eAAe,IAAI,EAAE;QACrD,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAA2B,EAC3B,IAIC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC;QAChC,GAAG,IAAI;QACP,MAAM,EAAE;YACN,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,UAAU,CAAC,OAAO;YACjC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,IAAI,CAAC,WAAW;SACpB;KACF,CAAC,CAAC;IACH,OAAO;QACL,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;QAC1C,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAyBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAuB;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;QAC/C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,GAAG,IAAI,CAAC,OAAO;SAChB;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAqB,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC5B,2EAA2E;IAC3E,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;IAC3D,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC;IAEnF,OAAO;QACL,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,MAAM,CAAC,yBAAyB,IAAI,MAAM,CAAC,gBAAgB;QAChE,YAAY,EAAE,QAAQ,MAAM,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,SAAS,EAAE;QACvF,KAAK,CAAC,QAAQ;YACZ,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;gBACvD,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;gBAExB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;oBACtC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,MAAM,EAAE,kBAAkB;wBAC1B,GAAG,IAAI,CAAC,OAAO;qBAChB;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC;wBACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;wBACxB,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,UAAU,EAAE,8CAA8C;qBAC3D,CAAC;iBACH,CAAC,CAAC;gBAEH,MAAM,IAAI,GAAG,SAAS,CAAqC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9E,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,SAAS;gBAEvB,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC5B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9D,CAAC;gBAED,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;oBACzB,KAAK,uBAAuB;wBAC1B,SAAS;oBACX,KAAK,WAAW;wBACd,UAAU,IAAI,KAAK,CAAC;wBACpB,SAAS;oBACX,KAAK,eAAe;wBAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;oBACpF,KAAK,eAAe;wBAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;oBAC/D;wBACE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC1E,CAAC;YACH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC1E,CAAC;KACF,CAAC;AACJ,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAmD;IAEnD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;QACnB,YAAY,EAAE,8DAA8D;QAC5E,KAAK,CAAC,QAAQ,CAAC,IAAY;YACzB,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxD,IAAI,aAAa,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;oBAC7C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;gBACzE,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC;oBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE;wBACN,UAAU,EAAE,oBAAoB;wBAChC,IAAI,EAAE,OAAQ;wBACd,YAAY,EAAE,IAAI,CAAC,WAAW;wBAC9B,aAAa,EAAE,IAAI,CAAC,QAAQ;wBAC5B,KAAK;wBACL,GAAG,IAAI,CAAC,WAAW;qBACpB;iBACF,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACrF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAEC;IAED,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;IAExD,IAAI,QAAQ,GAAwB,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;QACnB,YAAY,EAAE,uEAAuE;QACrF,KAAK,CAAC,QAAQ;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC;oBAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE;wBACN,UAAU,EAAE,oBAAoB;wBAChC,IAAI;wBACJ,YAAY,EAAE,WAAW;wBACzB,aAAa,EAAE,IAAI,CAAC,QAAQ;wBAC5B,GAAG,QAAQ,CAAC,WAAW;qBACxB;iBACF,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACrF,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,aAAqB;IAKhD,IAAI,WAAmC,CAAC;IACxC,IAAI,UAAgC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,WAAW,GAAG,OAAO,CAAC;QACtB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEnD,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE;YAChD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACtE,GAAG,CAAC,GAAG,CAAC;;MAER,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,OAAO,aAAa,CAAC,CAAC;QAChF,CAAC,CAAC;QAEF,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,EAAE,0BAA0B,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1D,UAAU,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,KAAK,CAAC,GAAG,EAAE,uEAAuE,CAAC,CAAC;YACpF,UAAU,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,KAAK,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;QACjE,WAAW,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,2EAA2E;QAC3E,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAEhD,wEAAwE;IACxE,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE;QACH,UAAU,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,EACD,CAAC,GAAG,MAAM,CACX,CAAC;IACF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEjE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CACtC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CACnG,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/auth/providers/account.d.ts

@@ -0,0 +1,59 @@
+import type { CallbackResult, OAuthCredential, OAuthMethod } from "../types.ts";
+/** Whether this build knows an account project to talk to at all. */
+export declare function accountsConfigured(): boolean;
+export declare function supabaseUrl(): string;
+export declare function siteUrl(): string;
+/**
+ * Signing in by sending the user to the site, in their own browser.
+ *
+ * The emailed code below works from anywhere, which is why it is still here —
+ * a terminal over SSH has no browser to open. But on a machine that does have
+ * one, sending them to the site's own login is strictly better: it is the page
+ * that offers a password and Google, it is the page that knows how to sign
+ * someone *up*, and neither of those has to be reimplemented here to stay
+ * working.
+ *
+ * What comes back is a sealed code on a loopback redirect, traded for the
+ * session over HTTPS. The frontend owns the loopback listener because it is
+ * the one already running a local server; this pair of functions is the part
+ * that belongs to the account rather than to any one frontend.
+ */
+export declare function browserSignInUrl(opts: {
+    /** The frontend's own nonce, echoed back so it can recognise its flow. */
+    state: string;
+    /** Loopback address the browser is sent back to. */
+    redirectUri: string;
+    /** Language for the login page, if the frontend knows one. */
+    locale?: string;
+}): string;
+/** Trade a sealed handoff code for the session it stands for. */
+export declare function exchangeHandoff(code: string, state: string): Promise<CallbackResult>;
+/** Every Supabase auth call carries the anon key as well as any bearer token. */
+export declare function supabaseHeaders(): Record<string, string>;
+export interface GoTrueSession {
+    access_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+    error?: string;
+    error_description?: string;
+    msg?: string;
+    message?: string;
+}
+/** The emailed-code sign-in, as an OAuth method a provider can declare. */
+export declare function accountSignIn(label: string): OAuthMethod;
+/** Exchange the emailed code for a session. */
+export declare function verifyOtp(email: string, code: string): Promise<CallbackResult>;
+/** Trade a refresh token for a fresh session, or nothing if it is still good. */
+export declare function refreshSession(credential: OAuthCredential): Promise<OAuthCredential | undefined>;
+export declare function toCredential(session: GoTrueSession, previous?: OAuthCredential): OAuthCredential;
+/**
+ * GoTrue reports failures under several field names depending on the version
+ * and the error class. Probing them beats showing a bare status code, which is
+ * what "sign-in failed (400)" leaves the user debugging.
+ */
+export declare function failureDetail(response: Response): Promise<string>;
+/** The bearer shape both account-backed providers resolve to. */
+export declare function bearer(token: string, source: string): {
+    headers: Record<string, string>;
+    source: string;
+};