@qlover/oauth-wrapper 0.2.0

package/dist/core.js

@@ -0,0 +1,250 @@
+// src/core/schema/OAuthAuthorizeSchema.ts
+import { z } from "zod";
+function isOAuthRedirectUri(value) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return false;
+  }
+  try {
+    const parsed = new URL(trimmed);
+    return Boolean(parsed.protocol && parsed.protocol.endsWith(":"));
+  } catch {
+    return /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed);
+  }
+}
+var oauthRedirectUriSchema = z.string().min(1).refine(isOAuthRedirectUri, { message: "Invalid redirect URI" });
+var OAuthClientRowSchema = z.object({
+  id: z.number(),
+  client_id: z.string(),
+  client_secret_hash: z.string().nullable().optional(),
+  client_name: z.string(),
+  client_uri: z.string().nullable().optional(),
+  logo_uri: z.string().nullable().optional(),
+  redirect_uris: z.array(z.string()),
+  grant_types: z.array(z.string()),
+  scopes: z.array(z.string()),
+  confidential: z.boolean(),
+  owner_user_id: z.number(),
+  created_at: z.string(),
+  updated_at: z.string()
+});
+var OAuthClientListItemSchema = z.object({
+  client_id: z.string(),
+  client_name: z.string(),
+  client_uri: z.string().nullable().optional(),
+  logo_uri: z.string().nullable().optional(),
+  redirect_uris: z.array(z.string()),
+  confidential: z.boolean(),
+  created_at: z.string(),
+  updated_at: z.string()
+});
+var OAuthClientDetailSchema = z.object({
+  client_id: z.string(),
+  client_name: z.string(),
+  client_uri: z.string().nullable().optional(),
+  logo_uri: z.string().nullable().optional(),
+  redirect_uris: z.array(z.string()),
+  grant_types: z.array(z.string()),
+  scopes: z.array(z.string()),
+  confidential: z.boolean(),
+  created_at: z.string(),
+  updated_at: z.string()
+});
+var OAuthClientCreateSchema = z.object({
+  client_name: z.string().min(1).max(100),
+  client_uri: z.string().url().optional().or(z.literal("")),
+  redirect_uris: z.array(oauthRedirectUriSchema).min(1),
+  /** `true` = confidential (client_secret); `false` = public (PKCE required). */
+  confidential: z.boolean().default(true)
+});
+var OAuthClientUpdateSchema = z.object({
+  client_name: z.string().min(1).max(100),
+  client_uri: z.string().url().optional().or(z.literal("")),
+  redirect_uris: z.array(oauthRedirectUriSchema).min(1)
+});
+var OAuthClientCreateResponseSchema = z.object({
+  client_id: z.string(),
+  client_secret: z.string().optional(),
+  confidential: z.boolean(),
+  client_name: z.string(),
+  client_uri: z.string().nullable().optional(),
+  redirect_uris: z.array(z.string()),
+  created_at: z.string()
+});
+var OAuthClientSecretRotateResponseSchema = z.object({
+  client_id: z.string(),
+  client_secret: z.string()
+});
+var OAuthAuthorizeQuerySchema = z.object({
+  response_type: z.literal("code"),
+  client_id: z.string().min(1),
+  redirect_uri: oauthRedirectUriSchema,
+  scope: z.string().optional(),
+  state: z.string().optional(),
+  code_challenge: z.string().min(43).max(128).optional(),
+  code_challenge_method: z.literal("S256").optional()
+});
+var OAuthConsentBodySchema = z.object({
+  action: z.enum(["allow", "deny"]),
+  client_id: z.string().min(1),
+  redirect_uri: oauthRedirectUriSchema,
+  scope: z.string().optional(),
+  state: z.string().optional(),
+  trust: z.boolean().optional(),
+  code_challenge: z.string().min(43).max(128).optional(),
+  code_challenge_method: z.literal("S256").optional()
+});
+var OAuthAuthorizationCodeRowSchema = z.object({
+  code: z.string(),
+  client_id: z.string(),
+  user_id: z.number(),
+  redirect_uri: z.string(),
+  scope: z.string().nullable().optional(),
+  code_challenge: z.string().nullable().optional(),
+  code_challenge_method: z.string().nullable().optional(),
+  expires_at: z.string(),
+  used: z.boolean(),
+  created_at: z.string()
+});
+
+// src/core/schema/OAuthClientSchema.ts
+import { z as z2 } from "zod";
+var OAuthUserCredentialsSchema = z2.object({
+  user_id: z2.number(),
+  provider_refresh_token: z2.string().nullable().optional(),
+  provider_session_token: z2.string().nullable().optional(),
+  updated_at: z2.string()
+});
+var OAuthRefreshTokenSchema = z2.object({
+  id: z2.number(),
+  refresh_token: z2.string(),
+  client_id: z2.string(),
+  user_id: z2.number(),
+  expires_at: z2.string(),
+  revoked: z2.boolean(),
+  created_at: z2.string()
+});
+var OAuthTokenResponseSchema = z2.object({
+  access_token: z2.string(),
+  token_type: z2.literal("Bearer"),
+  expires_in: z2.number(),
+  refresh_token: z2.string().optional(),
+  scope: z2.string().optional()
+});
+
+// src/core/schema/OAuthUserInfoSchema.ts
+import { z as z3 } from "zod";
+var OAuthUserInfoResponseSchema = z3.object({
+  sub: z3.string(),
+  email: z3.string().email(),
+  name: z3.string(),
+  roles: z3.array(z3.string()).optional()
+});
+var OAuthUserInfoErrorResponseSchema = z3.object({
+  error: z3.literal("invalid_token"),
+  error_id: z3.string().optional()
+});
+
+// src/core/schema/OAuthTokenSchema.ts
+import { z as z4 } from "zod";
+var OAuthTokenAuthorizationCodeSchema = z4.object({
+  grant_type: z4.literal("authorization_code"),
+  code: z4.string().min(1),
+  redirect_uri: z4.string().min(1),
+  client_id: z4.string().min(1),
+  client_secret: z4.string().min(1).optional(),
+  code_verifier: z4.string().min(43).max(128).optional()
+});
+var OAuthTokenRefreshSchema = z4.object({
+  grant_type: z4.literal("refresh_token"),
+  refresh_token: z4.string().min(1),
+  client_id: z4.string().min(1),
+  client_secret: z4.string().min(1).optional()
+});
+var OAuthTokenRequestSchema = z4.discriminatedUnion("grant_type", [
+  OAuthTokenAuthorizationCodeSchema,
+  OAuthTokenRefreshSchema
+]);
+var OAuthTokenErrorResponseSchema = z4.object({
+  error: z4.string(),
+  error_id: z4.string().optional(),
+  error_description: z4.string().optional()
+});
+var OAuthTokenRevokeSchema = z4.object({
+  token: z4.string().min(1),
+  token_type_hint: z4.enum(["access_token", "refresh_token"]).optional(),
+  client_id: z4.string().min(1),
+  client_secret: z4.string().min(1).optional()
+});
+
+// src/core/config.ts
+var OAuthRfcCodes = {
+  INVALID_REQUEST: "invalid_request",
+  INVALID_CLIENT: "invalid_client",
+  INVALID_GRANT: "invalid_grant",
+  INVALID_TOKEN: "invalid_token",
+  UNAUTHORIZED_CLIENT: "unauthorized_client",
+  INVALID_SCOPE: "invalid_scope",
+  ACCESS_DENIED: "access_denied",
+  UNSUPPORTED_RESPONSE_TYPE: "unsupported_response_type",
+  UNSUPPORTED_GRANT_TYPE: "unsupported_grant_type",
+  OAUTH_ERROR: "oauth_error"
+};
+
+// src/core/utils/pkce.ts
+var PKCE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+function generatePkceVerifier(length = 64) {
+  const size = Math.min(128, Math.max(43, length));
+  const values = new Uint8Array(size);
+  crypto.getRandomValues(values);
+  let result = "";
+  for (let i = 0; i < size; i++) {
+    result += PKCE_CHARSET[values[i] % PKCE_CHARSET.length];
+  }
+  return result;
+}
+function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function computePkceS256Challenge(verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(digest);
+}
+function randomOAuthState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+export {
+  OAuthAuthorizationCodeRowSchema,
+  OAuthAuthorizeQuerySchema,
+  OAuthClientCreateResponseSchema,
+  OAuthClientCreateSchema,
+  OAuthClientDetailSchema,
+  OAuthClientListItemSchema,
+  OAuthClientRowSchema,
+  OAuthClientSecretRotateResponseSchema,
+  OAuthClientUpdateSchema,
+  OAuthConsentBodySchema,
+  OAuthRefreshTokenSchema,
+  OAuthRfcCodes,
+  OAuthTokenAuthorizationCodeSchema,
+  OAuthTokenErrorResponseSchema,
+  OAuthTokenRefreshSchema,
+  OAuthTokenRequestSchema,
+  OAuthTokenResponseSchema,
+  OAuthTokenRevokeSchema,
+  OAuthUserCredentialsSchema,
+  OAuthUserInfoErrorResponseSchema,
+  OAuthUserInfoResponseSchema,
+  computePkceS256Challenge,
+  generatePkceVerifier,
+  isOAuthRedirectUri,
+  randomOAuthState
+};