@plumix/core 0.1.0

package/dist/auth/oauth/consumer.js

@@ -0,0 +1,136 @@
+import { resolveEnvInput } from "../../runtime/env-input.js";
+import { OAuthError } from "./errors.js";
+import { computeS256Challenge, generateCodeVerifier } from "./pkce.js";
+import { issueOAuthState } from "./state.js";
+/**
+ * Mint a PKCE verifier + state, persist them under `oauth_state`, and
+ * return the authorize URL. State is what the provider echoes back; it's
+ * the only way the callback ties the response to a verifier we can replay.
+ */
+export async function buildAuthorizeUrl(input) {
+    const { provider } = input;
+    const client = resolveEnvInput(provider.client, input.env);
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await computeS256Challenge(codeVerifier);
+    const { state } = await issueOAuthState(input.db, {
+        provider: input.providerKey,
+        codeVerifier,
+    });
+    const url = new URL(provider.authorizeUrl);
+    url.searchParams.set("client_id", client.clientId);
+    url.searchParams.set("redirect_uri", input.redirectUri);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("scope", provider.scopes.join(" "));
+    url.searchParams.set("state", state);
+    url.searchParams.set("code_challenge", codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    provider.decorateAuthorizeUrl?.(url);
+    return { url: url.toString(), state };
+}
+/**
+ * Exchange the authorization code for tokens, then fetch the user's
+ * profile. Returns a normalised OAuthProfile or throws OAuthError on any
+ * step failure — the route layer maps codes to user-facing messages.
+ */
+export async function exchangeAndFetchProfile(input) {
+    const { provider } = input;
+    const tokens = await exchangeCode(input);
+    const profile = await fetchProfile(provider, tokens.access_token);
+    let { email, emailVerified } = profile;
+    if (!email && provider.fetchVerifiedEmail) {
+        const fallback = await provider.fetchVerifiedEmail(tokens.access_token);
+        if (fallback) {
+            email = fallback.email;
+            emailVerified = fallback.verified;
+        }
+    }
+    if (!email) {
+        throw OAuthError.emailMissing();
+    }
+    return {
+        providerAccountId: profile.providerAccountId,
+        // Trim before lowercasing — a provider returning whitespace-padded
+        // values (or `email: " alice@example.com "`) would otherwise miss
+        // the `users.email` lookup at lookup time, fall into the signup
+        // path, hit the UNIQUE constraint at insert, and surface as a
+        // confusing OAuthError. Mirrors the normalisation magic-link does
+        // at `request.ts` and cfAccess at `extractEmail`.
+        email: email.trim().toLowerCase(),
+        emailVerified,
+        name: profile.name,
+        avatarUrl: profile.avatarUrl,
+    };
+}
+async function exchangeCode(input) {
+    const { provider } = input;
+    const client = resolveEnvInput(provider.client, input.env);
+    // RFC 6749 §2.3.1 / Copenhagen Book: client credentials go in the
+    // Authorization header (HTTP Basic). client_id stays in the body for
+    // providers (like Google) whose docs require it on the form too —
+    // harmless when also present in the header.
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: input.code,
+        redirect_uri: input.redirectUri,
+        client_id: client.clientId,
+        code_verifier: input.codeVerifier,
+    });
+    const basic = btoa(`${client.clientId}:${client.clientSecret}`);
+    let response;
+    try {
+        response = await fetch(provider.tokenUrl, {
+            method: "POST",
+            headers: {
+                Authorization: `Basic ${basic}`,
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
+            body,
+        });
+    }
+    catch {
+        throw OAuthError.codeExchangeFailed({ reason: "network error" });
+    }
+    if (!response.ok) {
+        throw OAuthError.codeExchangeFailed({
+            reason: `status ${response.status}`,
+        });
+    }
+    let json;
+    try {
+        json = await response.json();
+    }
+    catch {
+        throw OAuthError.codeExchangeFailed({ reason: "non-json response" });
+    }
+    if (!json ||
+        typeof json !== "object" ||
+        !("access_token" in json) ||
+        typeof json.access_token !== "string") {
+        throw OAuthError.codeExchangeFailed({ reason: "missing access_token" });
+    }
+    return json;
+}
+async function fetchProfile(provider, accessToken) {
+    let response;
+    try {
+        response = await fetch(provider.userInfoUrl, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/json",
+                "User-Agent": "plumix",
+            },
+        });
+    }
+    catch {
+        throw OAuthError.profileFetchFailed({ reason: "network error" });
+    }
+    if (!response.ok) {
+        throw OAuthError.profileFetchFailed({
+            reason: `status ${response.status}`,
+        });
+    }
+    const raw = await response.json();
+    return provider.parseProfile(raw);
+}
+//# sourceMappingURL=consumer.js.map

package/dist/auth/oauth/consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer.js","sourceRoot":"","sources":["../../../src/auth/oauth/consumer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAgB7C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAE/D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE;QAChD,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,YAAY;KACb,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,CAAC,CAAC;IAErC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAiBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAElE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YACvB,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACpC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,UAAU,CAAC,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,8DAA8D;QAC9D,kEAAkE;QAClE,kDAAkD;QAClD,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACjC,aAAa;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,4CAA4C;IAC5C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,KAAK,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAEhE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,KAAK,EAAE;gBAC/B,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,UAAU,CAAC,kBAAkB,CAAC;YAClC,MAAM,EAAE,UAAU,QAAQ,CAAC,MAAM,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IACE,CAAC,IAAI;QACL,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EACrC,CAAC;QACD,MAAM,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAqB,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAA6B,EAC7B,WAAmB;IAEnB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE;YAC3C,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,QAAQ;aACvB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,UAAU,CAAC,kBAAkB,CAAC;YAClC,MAAM,EAAE,UAAU,QAAQ,CAAC,MAAM,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC"}

package/dist/auth/oauth/errors.d.ts

@@ -0,0 +1,22 @@
+export declare const OAUTH_ERROR_CODES: readonly ["provider_not_configured", "state_invalid", "state_expired", "code_exchange_failed", "profile_fetch_failed", "email_missing", "email_unverified", "domain_not_allowed", "account_disabled", "link_broken", "registration_closed"];
+export type OAuthErrorCode = (typeof OAUTH_ERROR_CODES)[number];
+export declare class OAuthError extends Error {
+    readonly code: OAuthErrorCode;
+    private constructor();
+    static providerNotConfigured(): OAuthError;
+    static stateInvalid(): OAuthError;
+    static stateExpired(): OAuthError;
+    static codeExchangeFailed(ctx: {
+        reason: string;
+    }): OAuthError;
+    static profileFetchFailed(ctx: {
+        reason: string;
+    }): OAuthError;
+    static emailMissing(): OAuthError;
+    static emailUnverified(): OAuthError;
+    static domainNotAllowed(): OAuthError;
+    static accountDisabled(): OAuthError;
+    static linkBroken(): OAuthError;
+    static registrationClosed(): OAuthError;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/oauth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,6OAYpB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,qBAAa,UAAW,SAAQ,KAAK;IAKnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B,OAAO;IAKP,MAAM,CAAC,qBAAqB,IAAI,UAAU;IAI1C,MAAM,CAAC,YAAY,IAAI,UAAU;IAIjC,MAAM,CAAC,YAAY,IAAI,UAAU;IAIjC,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU;IAI9D,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU;IAI9D,MAAM,CAAC,YAAY,IAAI,UAAU;IAIjC,MAAM,CAAC,eAAe,IAAI,UAAU;IAIpC,MAAM,CAAC,gBAAgB,IAAI,UAAU;IAIrC,MAAM,CAAC,eAAe,IAAI,UAAU;IAIpC,MAAM,CAAC,UAAU,IAAI,UAAU;IAI/B,MAAM,CAAC,kBAAkB,IAAI,UAAU;CAGxC"}

package/dist/auth/oauth/errors.js

@@ -0,0 +1,57 @@
+export const OAUTH_ERROR_CODES = [
+    "provider_not_configured",
+    "state_invalid",
+    "state_expired",
+    "code_exchange_failed",
+    "profile_fetch_failed",
+    "email_missing",
+    "email_unverified",
+    "domain_not_allowed",
+    "account_disabled",
+    "link_broken",
+    "registration_closed",
+];
+export class OAuthError extends Error {
+    static {
+        OAuthError.prototype.name = "OAuthError";
+    }
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+    static providerNotConfigured() {
+        return new OAuthError("provider_not_configured", "provider_not_configured");
+    }
+    static stateInvalid() {
+        return new OAuthError("state_invalid", "state_invalid");
+    }
+    static stateExpired() {
+        return new OAuthError("state_expired", "state_expired");
+    }
+    static codeExchangeFailed(ctx) {
+        return new OAuthError("code_exchange_failed", ctx.reason);
+    }
+    static profileFetchFailed(ctx) {
+        return new OAuthError("profile_fetch_failed", ctx.reason);
+    }
+    static emailMissing() {
+        return new OAuthError("email_missing", "email_missing");
+    }
+    static emailUnverified() {
+        return new OAuthError("email_unverified", "email_unverified");
+    }
+    static domainNotAllowed() {
+        return new OAuthError("domain_not_allowed", "domain_not_allowed");
+    }
+    static accountDisabled() {
+        return new OAuthError("account_disabled", "account_disabled");
+    }
+    static linkBroken() {
+        return new OAuthError("link_broken", "link_broken");
+    }
+    static registrationClosed() {
+        return new OAuthError("registration_closed", "registration_closed");
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/oauth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/auth/oauth/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,yBAAyB;IACzB,eAAe;IACf,eAAe;IACf,sBAAsB;IACtB,sBAAsB;IACtB,eAAe;IACf,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,aAAa;IACb,qBAAqB;CACb,CAAC;AAIX,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC;QACE,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3C,CAAC;IAEQ,IAAI,CAAiB;IAE9B,YAAoB,IAAoB,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,qBAAqB;QAC1B,OAAO,IAAI,UAAU,CAAC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAuB;QAC/C,OAAO,IAAI,UAAU,CAAC,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAuB;QAC/C,OAAO,IAAI,UAAU,CAAC,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,eAAe;QACpB,OAAO,IAAI,UAAU,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,gBAAgB;QACrB,OAAO,IAAI,UAAU,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,eAAe;QACpB,OAAO,IAAI,UAAU,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,UAAU;QACf,OAAO,IAAI,UAAU,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,CAAC,kBAAkB;QACvB,OAAO,IAAI,UAAU,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IACtE,CAAC;CACF"}

package/dist/auth/oauth/index.d.ts

@@ -0,0 +1,7 @@
+export { OAUTH_ERROR_CODES, OAuthError } from "./errors.js";
+export type { OAuthErrorCode } from "./errors.js";
+export { handleOAuthCallback, handleOAuthStart } from "./routes.js";
+export { github, google } from "./providers/index.js";
+export { OAUTH_PROVIDER_KEY_PATTERN } from "./types.js";
+export type { OAuthClientConfig, OAuthProfile, OAuthProviderClient, OAuthProviderFactory, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC"}

package/dist/auth/oauth/index.js

@@ -0,0 +1,22 @@
+// Public OAuth surface.
+//
+// Built-in provider factories (`github`, `google`) ship from this barrel
+// alongside the public types so a user wiring up `auth({ oauth: ... })`
+// has everything from one import:
+//
+//   import { auth, github, google } from "@plumix/core";
+//
+// User-defined providers live in user code — they implement
+// `OAuthProviderClient` (often via a factory matching the
+// `OAuthProviderFactory` signature) and pass the result into the same
+// `oauth.providers` map. Adding a third built-in or a custom provider
+// follows the same path; no privileged registry, no const enum.
+//
+// Internals (PKCE, state store, consumer, signup, route handlers, the
+// path parser) are imported directly by the dispatcher and tests; they
+// don't leave the package.
+export { OAUTH_ERROR_CODES, OAuthError } from "./errors.js";
+export { handleOAuthCallback, handleOAuthStart } from "./routes.js";
+export { github, google } from "./providers/index.js";
+export { OAUTH_PROVIDER_KEY_PATTERN } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/oauth/index.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,kCAAkC;AAClC,EAAE;AACF,yDAAyD;AACzD,EAAE;AACF,4DAA4D;AAC5D,0DAA0D;AAC1D,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,2BAA2B;AAE3B,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC"}

package/dist/auth/oauth/match.d.ts

@@ -0,0 +1,19 @@
+interface OAuthRouteParams {
+    readonly providerKey: string;
+}
+/**
+ * Match `/_plumix/auth/oauth/<key>/(start|callback)`. The shape check
+ * (alphanum + `_-`) happens here; existence check ("is this a configured
+ * provider?") happens in the handler. A path that doesn't match the
+ * shape returns null → 404 from the dispatcher.
+ *
+ * Kept apart from the OAuth handlers so the dispatcher can match the path
+ * eagerly without pulling the (heavy) consumer/arctic graph onto the
+ * public render cold-start path; the handlers load on first OAuth request.
+ */
+export declare function parseOAuthPath(pathname: string): {
+    params: OAuthRouteParams;
+    tail: "start" | "callback";
+} | null;
+export {};
+//# sourceMappingURL=match.d.ts.map

package/dist/auth/oauth/match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/match.ts"],"names":[],"mappings":"AAEA,UAAU,gBAAgB;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,GACf;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAA;CAAE,GAAG,IAAI,CAWjE"}

package/dist/auth/oauth/match.js

@@ -0,0 +1,28 @@
+import { OAUTH_PROVIDER_KEY_PATTERN } from "./types.js";
+/**
+ * Match `/_plumix/auth/oauth/<key>/(start|callback)`. The shape check
+ * (alphanum + `_-`) happens here; existence check ("is this a configured
+ * provider?") happens in the handler. A path that doesn't match the
+ * shape returns null → 404 from the dispatcher.
+ *
+ * Kept apart from the OAuth handlers so the dispatcher can match the path
+ * eagerly without pulling the (heavy) consumer/arctic graph onto the
+ * public render cold-start path; the handlers load on first OAuth request.
+ */
+export function parseOAuthPath(pathname) {
+    const prefix = "/_plumix/auth/oauth/";
+    if (!pathname.startsWith(prefix))
+        return null;
+    const rest = pathname.slice(prefix.length);
+    const slash = rest.indexOf("/");
+    if (slash < 0)
+        return null;
+    const providerKey = rest.slice(0, slash);
+    const tail = rest.slice(slash + 1);
+    if (!OAUTH_PROVIDER_KEY_PATTERN.test(providerKey))
+        return null;
+    if (tail !== "start" && tail !== "callback")
+        return null;
+    return { params: { providerKey }, tail };
+}
+//# sourceMappingURL=match.js.map

package/dist/auth/oauth/match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.js","sourceRoot":"","sources":["../../../src/auth/oauth/match.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAMxD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB;IAEhB,MAAM,MAAM,GAAG,sBAAsB,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC"}

package/dist/auth/oauth/pkce.d.ts

@@ -0,0 +1,3 @@
+export declare function generateCodeVerifier(): string;
+export declare function computeS256Challenge(verifier: string): Promise<string>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/auth/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/pkce.ts"],"names":[],"mappings":"AAKA,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5E"}

package/dist/auth/oauth/pkce.js

@@ -0,0 +1,13 @@
+import { encodeBase64urlNoPadding } from "@oslojs/encoding";
+const VERIFIER_BYTES = 32;
+const ENCODER = new TextEncoder();
+export function generateCodeVerifier() {
+    const bytes = new Uint8Array(VERIFIER_BYTES);
+    crypto.getRandomValues(bytes);
+    return encodeBase64urlNoPadding(bytes);
+}
+export async function computeS256Challenge(verifier) {
+    const digest = await crypto.subtle.digest("SHA-256", ENCODER.encode(verifier));
+    return encodeBase64urlNoPadding(new Uint8Array(digest));
+}
+//# sourceMappingURL=pkce.js.map

package/dist/auth/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/auth/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CACzB,CAAC;IACF,OAAO,wBAAwB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/auth/oauth/providers/github.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthProviderFactory } from "../types.js";
+export declare const github: OAuthProviderFactory;
+//# sourceMappingURL=github.d.ts.map

package/dist/auth/oauth/providers/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAuB,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAgB7E,eAAO,MAAM,MAAM,EAAE,oBAmCnB,CAAC"}

package/dist/auth/oauth/providers/github.js

@@ -0,0 +1,39 @@
+export const github = (client) => ({
+    label: "GitHub",
+    authorizeUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    userInfoUrl: "https://api.github.com/user",
+    scopes: ["read:user", "user:email"],
+    client,
+    parseProfile(raw) {
+        const p = raw;
+        return {
+            providerAccountId: String(p.id),
+            // GitHub's /user only exposes `email` when the user has marked one
+            // public, and GitHub only allows publicising verified addresses —
+            // so if `email` is non-null here, treat it as verified.
+            email: p.email,
+            emailVerified: p.email !== null,
+            name: p.name ?? p.login,
+            avatarUrl: p.avatar_url,
+        };
+    },
+    async fetchVerifiedEmail(accessToken) {
+        const response = await fetch("https://api.github.com/user/emails", {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/vnd.github+json",
+                "X-GitHub-Api-Version": "2022-11-28",
+                "User-Agent": "plumix",
+            },
+        });
+        if (!response.ok)
+            return null;
+        const list = (await response.json());
+        const primary = list.find((e) => e.primary) ?? list[0];
+        if (!primary)
+            return null;
+        return { email: primary.email, verified: primary.verified };
+    },
+});
+//# sourceMappingURL=github.js.map

package/dist/auth/oauth/providers/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/github.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,MAAM,GAAyB,CAAC,MAAM,EAAuB,EAAE,CAAC,CAAC;IAC5E,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,0CAA0C;IACxD,QAAQ,EAAE,6CAA6C;IACvD,WAAW,EAAE,6BAA6B;IAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;IACnC,MAAM;IACN,YAAY,CAAC,GAAG;QACd,MAAM,CAAC,GAAG,GAAoB,CAAC;QAC/B,OAAO;YACL,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,mEAAmE;YACnE,kEAAkE;YAClE,wDAAwD;YACxD,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,aAAa,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI;YAC/B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,WAAW;QAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oCAAoC,EAAE;YACjE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,6BAA6B;gBACrC,sBAAsB,EAAE,YAAY;gBACpC,YAAY,EAAE,QAAQ;aACvB;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC9D,CAAC;CACF,CAAC,CAAC"}

package/dist/auth/oauth/providers/google.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthProviderFactory } from "../types.js";
+export declare const google: OAuthProviderFactory;
+//# sourceMappingURL=google.d.ts.map

package/dist/auth/oauth/providers/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/google.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAuB,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAU7E,eAAO,MAAM,MAAM,EAAE,oBAwBnB,CAAC"}

package/dist/auth/oauth/providers/google.js

@@ -0,0 +1,26 @@
+export const google = (client) => ({
+    label: "Google",
+    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
+    scopes: ["openid", "email", "profile"],
+    client,
+    parseProfile(raw) {
+        const p = raw;
+        return {
+            providerAccountId: p.sub,
+            email: p.email,
+            emailVerified: Boolean(p.email_verified),
+            name: p.name,
+            avatarUrl: p.picture,
+        };
+    },
+    decorateAuthorizeUrl(url) {
+        // Google needs `access_type=offline` + `prompt=consent` to surface
+        // `email_verified` on the userinfo endpoint for accounts that
+        // aren't currently signed in. Harmless for repeat sign-ins.
+        url.searchParams.set("access_type", "offline");
+        url.searchParams.set("prompt", "consent");
+    },
+});
+//# sourceMappingURL=google.js.map

package/dist/auth/oauth/providers/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/google.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,MAAM,GAAyB,CAAC,MAAM,EAAuB,EAAE,CAAC,CAAC;IAC5E,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,8CAA8C;IAC5D,QAAQ,EAAE,qCAAqC;IAC/C,WAAW,EAAE,kDAAkD;IAC/D,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;IACtC,MAAM;IACN,YAAY,CAAC,GAAG;QACd,MAAM,CAAC,GAAG,GAAoB,CAAC;QAC/B,OAAO;YACL,iBAAiB,EAAE,CAAC,CAAC,GAAG;YACxB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,OAAO;SACrB,CAAC;IACJ,CAAC;IACD,oBAAoB,CAAC,GAAG;QACtB,mEAAmE;QACnE,8DAA8D;QAC9D,4DAA4D;QAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;CACF,CAAC,CAAC"}

package/dist/auth/oauth/providers/index.d.ts

@@ -0,0 +1,3 @@
+export { github } from "./github.js";
+export { google } from "./google.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/oauth/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/auth/oauth/providers/index.js

@@ -0,0 +1,3 @@
+export { github } from "./github.js";
+export { google } from "./google.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/oauth/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/auth/oauth/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/auth/oauth/routes.d.ts

@@ -0,0 +1,5 @@
+import type { AppContext } from "../../context/app.js";
+import type { PlumixApp } from "../../runtime/app.js";
+export declare function handleOAuthStart(ctx: AppContext, app: PlumixApp, providerKey: string): Promise<Response>;
+export declare function handleOAuthCallback(ctx: AppContext, app: PlumixApp, providerKey: string): Promise<Response>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/auth/oauth/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAsBtD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAgCnB;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAgEnB"}

package/dist/auth/oauth/routes.js

@@ -0,0 +1,134 @@
+import { withBasePath } from "../../base-path.js";
+import { users } from "../../db/schema/users.js";
+import { loginErrorRedirect, redirectTo } from "../../runtime/http.js";
+import { mintSessionAndCookie } from "../sign-in.js";
+import { buildAuthorizeUrl, exchangeAndFetchProfile } from "./consumer.js";
+import { OAuthError } from "./errors.js";
+import { resolveOAuthUser } from "./signup.js";
+import { consumeOAuthState } from "./state.js";
+const ADMIN_PATH = "/_plumix/admin";
+const LOGIN_PATH = "/_plumix/admin/login";
+const BOOTSTRAP_PATH = "/_plumix/admin/bootstrap";
+// Defensive bound on `code` from the provider's redirect. GitHub's codes
+// are ~20 chars; Google's a few hundred. 4 KiB is generous for any
+// current provider while bounding URL/body amplification on a malformed
+// callback.
+const MAX_CODE_LENGTH = 4096;
+export async function handleOAuthStart(ctx, app, providerKey) {
+    const provider = pickProvider(app, providerKey);
+    if (!provider)
+        return loginError(app.basePath, "provider_not_configured");
+    // Block OAuth on a fresh deploy when the operator left bootstrap on
+    // the passkey rail. An OAuth signup before any user exists would
+    // either fail with a confusing domain_not_allowed (no rows) or — if
+    // domains were pre-seeded — mint a non-admin who can't do anything.
+    // Send to /bootstrap. With `bootstrapVia: "first-method-wins"` the
+    // OAuth flow is the bootstrap; let it through.
+    if (!ctx.bootstrapAllowed) {
+        const userCount = await ctx.db.$count(users);
+        if (userCount === 0) {
+            return redirectTo(withBasePath(BOOTSTRAP_PATH, app.basePath));
+        }
+    }
+    const redirectUri = oauthCallbackUrl(app, providerKey);
+    try {
+        const { url } = await buildAuthorizeUrl({
+            db: ctx.db,
+            providerKey,
+            provider,
+            redirectUri,
+            env: ctx.env,
+        });
+        return redirectTo(url);
+    }
+    catch (error) {
+        ctx.logger.error("oauth_start_failed", { error, provider: providerKey });
+        return loginError(app.basePath, "code_exchange_failed");
+    }
+}
+export async function handleOAuthCallback(ctx, app, providerKey) {
+    const provider = pickProvider(app, providerKey);
+    if (!provider)
+        return loginError(app.basePath, "provider_not_configured");
+    const url = new URL(ctx.request.url);
+    const state = url.searchParams.get("state");
+    // Provider-side denial (user clicked Cancel, scope rejected, etc.)
+    // arrives as `?error=...`. The state row would otherwise sit until
+    // TTL; consume it here so the slot is freed immediately.
+    if (url.searchParams.has("error")) {
+        if (state)
+            await consumeOAuthState(ctx.db, state);
+        return loginError(app.basePath, "state_invalid");
+    }
+    const code = url.searchParams.get("code");
+    if (!code || !state)
+        return loginError(app.basePath, "state_invalid");
+    if (code.length > MAX_CODE_LENGTH)
+        return loginError(app.basePath, "state_invalid");
+    const stored = await consumeOAuthState(ctx.db, state);
+    if (!stored)
+        return loginError(app.basePath, "state_expired");
+    if (stored.provider !== providerKey)
+        return loginError(app.basePath, "state_invalid");
+    const redirectUri = oauthCallbackUrl(app, providerKey);
+    try {
+        const profile = await exchangeAndFetchProfile({
+            provider,
+            code,
+            redirectUri,
+            codeVerifier: stored.codeVerifier,
+            env: ctx.env,
+        });
+        const { user, created } = await resolveOAuthUser(ctx.db, {
+            provider: providerKey,
+            profile,
+            bootstrapAllowed: ctx.bootstrapAllowed,
+        });
+        const { cookieHeader } = await mintSessionAndCookie(ctx, app, user.id);
+        await ctx.hooks.doAction("user:signed_in", user, {
+            method: "oauth",
+            provider: providerKey,
+            firstSignIn: created,
+        });
+        return redirectTo(withBasePath(ADMIN_PATH, app.basePath), {
+            "set-cookie": cookieHeader,
+        });
+    }
+    catch (error) {
+        if (error instanceof OAuthError) {
+            ctx.logger.warn("oauth_callback_rejected", {
+                provider: providerKey,
+                code: error.code,
+            });
+            return loginError(app.basePath, error.code);
+        }
+        ctx.logger.error("oauth_callback_failed", { error, provider: providerKey });
+        return loginError(app.basePath, "code_exchange_failed");
+    }
+}
+function pickProvider(app, key) {
+    // `OAUTH_PROVIDER_KEY_PATTERN` rejects most prototype-chain keys at the
+    // path layer (`__proto__`, `hasOwnProperty`, …), but `constructor`
+    // matches the regex. `Object.hasOwn` keeps the lookup confined to the
+    // operator's `auth.oauth.providers` object instead of walking the
+    // prototype chain.
+    const providers = app.config.auth.oauth?.providers;
+    if (!providers || !Object.hasOwn(providers, key))
+        return null;
+    return providers[key] ?? null;
+}
+// `app.origin` is the canonical site origin from passkey config — pinning
+// the callback URL there means the value the provider sees at authorize
+// time is identical at token-exchange time even if a load balancer or
+// custom adapter rewrites Host on the way in. (Cloudflare Workers binds
+// `request.url` to the connection hostname, but other adapters may not.)
+function oauthCallbackUrl(app, providerKey) {
+    const path = `/_plumix/auth/oauth/${providerKey}/callback`;
+    return `${app.origin}${withBasePath(path, app.basePath)}`;
+}
+function loginError(basePath, code) {
+    // Relative location — keeps the same scheme/host/port the browser
+    // already used to reach us, no need to know the canonical origin.
+    return loginErrorRedirect(withBasePath(LOGIN_PATH, basePath), "oauth_error", code);
+}
+//# sourceMappingURL=routes.js.map

package/dist/auth/oauth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/auth/oauth/routes.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAC1C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,YAAY;AACZ,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAe,EACf,GAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IAE1E,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,oEAAoE;IACpE,mEAAmE;IACnE,+CAA+C;IAC/C,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;YACtC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,WAAW;YACX,QAAQ;YACR,WAAW;YACX,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAe,EACf,GAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IAE1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE5C,mEAAmE;IACnE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,IAAI,KAAK;YAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe;QAC/B,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;QACjC,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;YAC5C,QAAQ;YACR,IAAI;YACJ,WAAW;YACX,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE;YACvD,QAAQ,EAAE,WAAW;YACrB,OAAO;YACP,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;SACvC,CAAC,CAAC;QAEH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvE,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;YACxD,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBACzC,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;YACH,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5E,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAc,EAAE,GAAW;IAC/C,wEAAwE;IACxE,mEAAmE;IACnE,sEAAsE;IACtE,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC;IACnD,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,GAAc,EAAE,WAAmB;IAC3D,MAAM,IAAI,GAAG,uBAAuB,WAAW,WAAW,CAAC;IAC3D,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,IAAoB;IACxD,kEAAkE;IAClE,kEAAkE;IAClE,OAAO,kBAAkB,CACvB,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,EAClC,aAAa,EACb,IAAI,CACL,CAAC;AACJ,CAAC"}