@qlover/oauth-wrapper 0.2.0

package/dist/core.cjs

@@ -0,0 +1,301 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core/index.ts
+var core_exports = {};
+__export(core_exports, {
+  OAuthAuthorizationCodeRowSchema: () => OAuthAuthorizationCodeRowSchema,
+  OAuthAuthorizeQuerySchema: () => OAuthAuthorizeQuerySchema,
+  OAuthClientCreateResponseSchema: () => OAuthClientCreateResponseSchema,
+  OAuthClientCreateSchema: () => OAuthClientCreateSchema,
+  OAuthClientDetailSchema: () => OAuthClientDetailSchema,
+  OAuthClientListItemSchema: () => OAuthClientListItemSchema,
+  OAuthClientRowSchema: () => OAuthClientRowSchema,
+  OAuthClientSecretRotateResponseSchema: () => OAuthClientSecretRotateResponseSchema,
+  OAuthClientUpdateSchema: () => OAuthClientUpdateSchema,
+  OAuthConsentBodySchema: () => OAuthConsentBodySchema,
+  OAuthRefreshTokenSchema: () => OAuthRefreshTokenSchema,
+  OAuthRfcCodes: () => OAuthRfcCodes,
+  OAuthTokenAuthorizationCodeSchema: () => OAuthTokenAuthorizationCodeSchema,
+  OAuthTokenErrorResponseSchema: () => OAuthTokenErrorResponseSchema,
+  OAuthTokenRefreshSchema: () => OAuthTokenRefreshSchema,
+  OAuthTokenRequestSchema: () => OAuthTokenRequestSchema,
+  OAuthTokenResponseSchema: () => OAuthTokenResponseSchema,
+  OAuthTokenRevokeSchema: () => OAuthTokenRevokeSchema,
+  OAuthUserCredentialsSchema: () => OAuthUserCredentialsSchema,
+  OAuthUserInfoErrorResponseSchema: () => OAuthUserInfoErrorResponseSchema,
+  OAuthUserInfoResponseSchema: () => OAuthUserInfoResponseSchema,
+  computePkceS256Challenge: () => computePkceS256Challenge,
+  generatePkceVerifier: () => generatePkceVerifier,
+  isOAuthRedirectUri: () => isOAuthRedirectUri,
+  randomOAuthState: () => randomOAuthState
+});
+module.exports = __toCommonJS(core_exports);
+
+// src/core/schema/OAuthAuthorizeSchema.ts
+var import_zod = require("zod");
+function isOAuthRedirectUri(value) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return false;
+  }
+  try {
+    const parsed = new URL(trimmed);
+    return Boolean(parsed.protocol && parsed.protocol.endsWith(":"));
+  } catch {
+    return /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed);
+  }
+}
+var oauthRedirectUriSchema = import_zod.z.string().min(1).refine(isOAuthRedirectUri, { message: "Invalid redirect URI" });
+var OAuthClientRowSchema = import_zod.z.object({
+  id: import_zod.z.number(),
+  client_id: import_zod.z.string(),
+  client_secret_hash: import_zod.z.string().nullable().optional(),
+  client_name: import_zod.z.string(),
+  client_uri: import_zod.z.string().nullable().optional(),
+  logo_uri: import_zod.z.string().nullable().optional(),
+  redirect_uris: import_zod.z.array(import_zod.z.string()),
+  grant_types: import_zod.z.array(import_zod.z.string()),
+  scopes: import_zod.z.array(import_zod.z.string()),
+  confidential: import_zod.z.boolean(),
+  owner_user_id: import_zod.z.number(),
+  created_at: import_zod.z.string(),
+  updated_at: import_zod.z.string()
+});
+var OAuthClientListItemSchema = import_zod.z.object({
+  client_id: import_zod.z.string(),
+  client_name: import_zod.z.string(),
+  client_uri: import_zod.z.string().nullable().optional(),
+  logo_uri: import_zod.z.string().nullable().optional(),
+  redirect_uris: import_zod.z.array(import_zod.z.string()),
+  confidential: import_zod.z.boolean(),
+  created_at: import_zod.z.string(),
+  updated_at: import_zod.z.string()
+});
+var OAuthClientDetailSchema = import_zod.z.object({
+  client_id: import_zod.z.string(),
+  client_name: import_zod.z.string(),
+  client_uri: import_zod.z.string().nullable().optional(),
+  logo_uri: import_zod.z.string().nullable().optional(),
+  redirect_uris: import_zod.z.array(import_zod.z.string()),
+  grant_types: import_zod.z.array(import_zod.z.string()),
+  scopes: import_zod.z.array(import_zod.z.string()),
+  confidential: import_zod.z.boolean(),
+  created_at: import_zod.z.string(),
+  updated_at: import_zod.z.string()
+});
+var OAuthClientCreateSchema = import_zod.z.object({
+  client_name: import_zod.z.string().min(1).max(100),
+  client_uri: import_zod.z.string().url().optional().or(import_zod.z.literal("")),
+  redirect_uris: import_zod.z.array(oauthRedirectUriSchema).min(1),
+  /** `true` = confidential (client_secret); `false` = public (PKCE required). */
+  confidential: import_zod.z.boolean().default(true)
+});
+var OAuthClientUpdateSchema = import_zod.z.object({
+  client_name: import_zod.z.string().min(1).max(100),
+  client_uri: import_zod.z.string().url().optional().or(import_zod.z.literal("")),
+  redirect_uris: import_zod.z.array(oauthRedirectUriSchema).min(1)
+});
+var OAuthClientCreateResponseSchema = import_zod.z.object({
+  client_id: import_zod.z.string(),
+  client_secret: import_zod.z.string().optional(),
+  confidential: import_zod.z.boolean(),
+  client_name: import_zod.z.string(),
+  client_uri: import_zod.z.string().nullable().optional(),
+  redirect_uris: import_zod.z.array(import_zod.z.string()),
+  created_at: import_zod.z.string()
+});
+var OAuthClientSecretRotateResponseSchema = import_zod.z.object({
+  client_id: import_zod.z.string(),
+  client_secret: import_zod.z.string()
+});
+var OAuthAuthorizeQuerySchema = import_zod.z.object({
+  response_type: import_zod.z.literal("code"),
+  client_id: import_zod.z.string().min(1),
+  redirect_uri: oauthRedirectUriSchema,
+  scope: import_zod.z.string().optional(),
+  state: import_zod.z.string().optional(),
+  code_challenge: import_zod.z.string().min(43).max(128).optional(),
+  code_challenge_method: import_zod.z.literal("S256").optional()
+});
+var OAuthConsentBodySchema = import_zod.z.object({
+  action: import_zod.z.enum(["allow", "deny"]),
+  client_id: import_zod.z.string().min(1),
+  redirect_uri: oauthRedirectUriSchema,
+  scope: import_zod.z.string().optional(),
+  state: import_zod.z.string().optional(),
+  trust: import_zod.z.boolean().optional(),
+  code_challenge: import_zod.z.string().min(43).max(128).optional(),
+  code_challenge_method: import_zod.z.literal("S256").optional()
+});
+var OAuthAuthorizationCodeRowSchema = import_zod.z.object({
+  code: import_zod.z.string(),
+  client_id: import_zod.z.string(),
+  user_id: import_zod.z.number(),
+  redirect_uri: import_zod.z.string(),
+  scope: import_zod.z.string().nullable().optional(),
+  code_challenge: import_zod.z.string().nullable().optional(),
+  code_challenge_method: import_zod.z.string().nullable().optional(),
+  expires_at: import_zod.z.string(),
+  used: import_zod.z.boolean(),
+  created_at: import_zod.z.string()
+});
+
+// src/core/schema/OAuthClientSchema.ts
+var import_zod2 = require("zod");
+var OAuthUserCredentialsSchema = import_zod2.z.object({
+  user_id: import_zod2.z.number(),
+  provider_refresh_token: import_zod2.z.string().nullable().optional(),
+  provider_session_token: import_zod2.z.string().nullable().optional(),
+  updated_at: import_zod2.z.string()
+});
+var OAuthRefreshTokenSchema = import_zod2.z.object({
+  id: import_zod2.z.number(),
+  refresh_token: import_zod2.z.string(),
+  client_id: import_zod2.z.string(),
+  user_id: import_zod2.z.number(),
+  expires_at: import_zod2.z.string(),
+  revoked: import_zod2.z.boolean(),
+  created_at: import_zod2.z.string()
+});
+var OAuthTokenResponseSchema = import_zod2.z.object({
+  access_token: import_zod2.z.string(),
+  token_type: import_zod2.z.literal("Bearer"),
+  expires_in: import_zod2.z.number(),
+  refresh_token: import_zod2.z.string().optional(),
+  scope: import_zod2.z.string().optional()
+});
+
+// src/core/schema/OAuthUserInfoSchema.ts
+var import_zod3 = require("zod");
+var OAuthUserInfoResponseSchema = import_zod3.z.object({
+  sub: import_zod3.z.string(),
+  email: import_zod3.z.string().email(),
+  name: import_zod3.z.string(),
+  roles: import_zod3.z.array(import_zod3.z.string()).optional()
+});
+var OAuthUserInfoErrorResponseSchema = import_zod3.z.object({
+  error: import_zod3.z.literal("invalid_token"),
+  error_id: import_zod3.z.string().optional()
+});
+
+// src/core/schema/OAuthTokenSchema.ts
+var import_zod4 = require("zod");
+var OAuthTokenAuthorizationCodeSchema = import_zod4.z.object({
+  grant_type: import_zod4.z.literal("authorization_code"),
+  code: import_zod4.z.string().min(1),
+  redirect_uri: import_zod4.z.string().min(1),
+  client_id: import_zod4.z.string().min(1),
+  client_secret: import_zod4.z.string().min(1).optional(),
+  code_verifier: import_zod4.z.string().min(43).max(128).optional()
+});
+var OAuthTokenRefreshSchema = import_zod4.z.object({
+  grant_type: import_zod4.z.literal("refresh_token"),
+  refresh_token: import_zod4.z.string().min(1),
+  client_id: import_zod4.z.string().min(1),
+  client_secret: import_zod4.z.string().min(1).optional()
+});
+var OAuthTokenRequestSchema = import_zod4.z.discriminatedUnion("grant_type", [
+  OAuthTokenAuthorizationCodeSchema,
+  OAuthTokenRefreshSchema
+]);
+var OAuthTokenErrorResponseSchema = import_zod4.z.object({
+  error: import_zod4.z.string(),
+  error_id: import_zod4.z.string().optional(),
+  error_description: import_zod4.z.string().optional()
+});
+var OAuthTokenRevokeSchema = import_zod4.z.object({
+  token: import_zod4.z.string().min(1),
+  token_type_hint: import_zod4.z.enum(["access_token", "refresh_token"]).optional(),
+  client_id: import_zod4.z.string().min(1),
+  client_secret: import_zod4.z.string().min(1).optional()
+});
+
+// src/core/config.ts
+var OAuthRfcCodes = {
+  INVALID_REQUEST: "invalid_request",
+  INVALID_CLIENT: "invalid_client",
+  INVALID_GRANT: "invalid_grant",
+  INVALID_TOKEN: "invalid_token",
+  UNAUTHORIZED_CLIENT: "unauthorized_client",
+  INVALID_SCOPE: "invalid_scope",
+  ACCESS_DENIED: "access_denied",
+  UNSUPPORTED_RESPONSE_TYPE: "unsupported_response_type",
+  UNSUPPORTED_GRANT_TYPE: "unsupported_grant_type",
+  OAUTH_ERROR: "oauth_error"
+};
+
+// src/core/utils/pkce.ts
+var PKCE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+function generatePkceVerifier(length = 64) {
+  const size = Math.min(128, Math.max(43, length));
+  const values = new Uint8Array(size);
+  crypto.getRandomValues(values);
+  let result = "";
+  for (let i = 0; i < size; i++) {
+    result += PKCE_CHARSET[values[i] % PKCE_CHARSET.length];
+  }
+  return result;
+}
+function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function computePkceS256Challenge(verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(digest);
+}
+function randomOAuthState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OAuthAuthorizationCodeRowSchema,
+  OAuthAuthorizeQuerySchema,
+  OAuthClientCreateResponseSchema,
+  OAuthClientCreateSchema,
+  OAuthClientDetailSchema,
+  OAuthClientListItemSchema,
+  OAuthClientRowSchema,
+  OAuthClientSecretRotateResponseSchema,
+  OAuthClientUpdateSchema,
+  OAuthConsentBodySchema,
+  OAuthRefreshTokenSchema,
+  OAuthRfcCodes,
+  OAuthTokenAuthorizationCodeSchema,
+  OAuthTokenErrorResponseSchema,
+  OAuthTokenRefreshSchema,
+  OAuthTokenRequestSchema,
+  OAuthTokenResponseSchema,
+  OAuthTokenRevokeSchema,
+  OAuthUserCredentialsSchema,
+  OAuthUserInfoErrorResponseSchema,
+  OAuthUserInfoResponseSchema,
+  computePkceS256Challenge,
+  generatePkceVerifier,
+  isOAuthRedirectUri,
+  randomOAuthState
+});