@rebasepro/server-core 0.0.1-canary.09e5ec5

package/src/auth/bitbucket-oauth.ts

@@ -0,0 +1,82 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a Bitbucket OAuth Provider integration (OAuth 2.0 consumer).
+ */
+export function createBitbucketProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "bitbucket",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
+
+                const tokenResponse = await fetch("https://bitbucket.org/site/oauth2/access_token", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        "Authorization": `Basic ${basicAuth}`
+                    },
+                    body: new URLSearchParams({
+                        grant_type: "authorization_code",
+                        code: payload.code,
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Bitbucket access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string };
+                const accessToken = tokenData.access_token;
+
+                const profileResponse = await fetch("https://api.bitbucket.org/2.0/user", {
+                    headers: { "Authorization": `Bearer ${accessToken}` }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get Bitbucket user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const p = await profileResponse.json() as {
+                    uuid: string; display_name?: string; username?: string;
+                    links?: { avatar?: { href?: string } };
+                };
+
+                // Bitbucket doesn't return email in user profile — fetch from /emails endpoint
+                const emailsResponse = await fetch("https://api.bitbucket.org/2.0/user/emails", {
+                    headers: { "Authorization": `Bearer ${accessToken}` }
+                });
+
+                let email: string | null = null;
+                if (emailsResponse.ok) {
+                    const emailData = await emailsResponse.json() as {
+                        values: Array<{ email: string; is_primary: boolean; is_confirmed: boolean }>;
+                    };
+                    const primary = emailData.values.find(e => e.is_primary && e.is_confirmed)
+                        || emailData.values.find(e => e.is_confirmed);
+                    email = primary?.email || null;
+                }
+
+                if (!email) { console.error("Bitbucket user has no verified email"); return null; }
+
+                return {
+                    providerId: p.uuid,
+                    email,
+                    displayName: p.display_name || p.username || null,
+                    photoUrl: p.links?.avatar?.href || null
+                };
+            } catch (error) {
+                console.error("Bitbucket OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/discord-oauth.ts

@@ -0,0 +1,83 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a Discord OAuth2 Provider integration.
+ *
+ * Uses the authorization code flow. Requires the "identify" and "email"
+ * scopes to retrieve the user's email and profile information.
+ */
+export function createDiscordProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "discord",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                // Exchange code for access token
+                const tokenResponse = await fetch("https://discord.com/api/v10/oauth2/token", {
+                    method: "POST",
+                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                    body: new URLSearchParams({
+                        client_id: config.clientId,
+                        client_secret: config.clientSecret,
+                        grant_type: "authorization_code",
+                        code: payload.code,
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Discord access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string };
+                const accessToken = tokenData.access_token;
+
+                // Fetch user profile
+                const profileResponse = await fetch("https://discord.com/api/v10/users/@me", {
+                    headers: { "Authorization": `Bearer ${accessToken}` }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get Discord user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const profileData = await profileResponse.json() as {
+                    id: string;
+                    username: string;
+                    global_name?: string | null;
+                    avatar?: string | null;
+                    email?: string | null;
+                    verified?: boolean;
+                };
+
+                if (!profileData.email) {
+                    console.error("Discord user has no email (email scope may not have been granted)");
+                    return null;
+                }
+
+                // Build avatar URL
+                let photoUrl: string | null = null;
+                if (profileData.avatar) {
+                    const ext = profileData.avatar.startsWith("a_") ? "gif" : "png";
+                    photoUrl = `https://cdn.discordapp.com/avatars/${profileData.id}/${profileData.avatar}.${ext}?size=256`;
+                }
+
+                return {
+                    providerId: profileData.id,
+                    email: profileData.email,
+                    displayName: profileData.global_name || profileData.username || null,
+                    photoUrl
+                };
+            } catch (error) {
+                console.error("Discord OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/facebook-oauth.ts

@@ -0,0 +1,72 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a Facebook / Meta OAuth Provider integration.
+ *
+ * Uses the authorization code flow to exchange a code for an access token,
+ * then fetches user profile from the Facebook Graph API.
+ */
+export function createFacebookProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "facebook",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                // Exchange code for access token
+                const tokenUrl = new URL("https://graph.facebook.com/v19.0/oauth/access_token");
+                tokenUrl.searchParams.set("client_id", config.clientId);
+                tokenUrl.searchParams.set("client_secret", config.clientSecret);
+                tokenUrl.searchParams.set("redirect_uri", payload.redirectUri);
+                tokenUrl.searchParams.set("code", payload.code);
+
+                const tokenResponse = await fetch(tokenUrl.toString());
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Facebook access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string };
+                const accessToken = tokenData.access_token;
+
+                // Fetch user profile with email and profile picture
+                const profileUrl = new URL("https://graph.facebook.com/v19.0/me");
+                profileUrl.searchParams.set("fields", "id,name,email,picture.type(large)");
+                profileUrl.searchParams.set("access_token", accessToken);
+
+                const profileResponse = await fetch(profileUrl.toString());
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get Facebook user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const profileData = await profileResponse.json() as {
+                    id: string;
+                    name?: string;
+                    email?: string;
+                    picture?: { data?: { url?: string } };
+                };
+
+                if (!profileData.email) {
+                    console.error("Facebook user has no email (email permission may not have been granted)");
+                    return null;
+                }
+
+                return {
+                    providerId: profileData.id,
+                    email: profileData.email,
+                    displayName: profileData.name || null,
+                    photoUrl: profileData.picture?.data?.url || null
+                };
+            } catch (error) {
+                console.error("Facebook OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/github-oauth.ts

@@ -0,0 +1,110 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a GitHub OAuth Provider integration.
+ *
+ * Flow: Frontend receives an authorization `code` via the GitHub OAuth redirect.
+ * This provider exchanges the code for an access token, then fetches the user's
+ * profile and primary email from the GitHub API.
+ */
+export function createGitHubProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "github",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                // Exchange code for access token
+                const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        "Accept": "application/json"
+                    },
+                    body: JSON.stringify({
+                        client_id: config.clientId,
+                        client_secret: config.clientSecret,
+                        code: payload.code,
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get GitHub access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token?: string; error?: string };
+                if (tokenData.error || !tokenData.access_token) {
+                    console.error("GitHub token exchange error:", tokenData.error);
+                    return null;
+                }
+
+                const accessToken = tokenData.access_token;
+
+                // Fetch user profile
+                const profileResponse = await fetch("https://api.github.com/user", {
+                    headers: {
+                        "Authorization": `Bearer ${accessToken}`,
+                        "Accept": "application/vnd.github+json",
+                        "User-Agent": "Rebase-Auth"
+                    }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get GitHub user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const profileData = await profileResponse.json() as {
+                    id: number;
+                    login: string;
+                    name?: string | null;
+                    avatar_url?: string | null;
+                    email?: string | null;
+                };
+
+                // GitHub may not return email in profile if it's private.
+                // Fetch from /user/emails endpoint instead.
+                let email = profileData.email;
+                if (!email) {
+                    const emailsResponse = await fetch("https://api.github.com/user/emails", {
+                        headers: {
+                            "Authorization": `Bearer ${accessToken}`,
+                            "Accept": "application/vnd.github+json",
+                            "User-Agent": "Rebase-Auth"
+                        }
+                    });
+
+                    if (emailsResponse.ok) {
+                        const emails = await emailsResponse.json() as Array<{
+                            email: string;
+                            primary: boolean;
+                            verified: boolean;
+                        }>;
+                        const primary = emails.find(e => e.primary && e.verified) || emails.find(e => e.verified);
+                        email = primary?.email || null;
+                    }
+                }
+
+                if (!email) {
+                    console.error("GitHub user has no verified email");
+                    return null;
+                }
+
+                return {
+                    providerId: String(profileData.id),
+                    email,
+                    displayName: profileData.name || profileData.login || null,
+                    photoUrl: profileData.avatar_url || null
+                };
+            } catch (error) {
+                console.error("GitHub OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/gitlab-oauth.ts

@@ -0,0 +1,70 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a GitLab OAuth Provider integration.
+ * Works with both GitLab.com and self-hosted instances.
+ */
+export function createGitLabProvider(config: {
+    clientId: string;
+    clientSecret: string;
+    baseUrl?: string;
+}): OAuthProvider<{ code: string; redirectUri: string }> {
+    const gitlabUrl = (config.baseUrl || "https://gitlab.com").replace(/\/$/, "");
+
+    return {
+        id: "gitlab",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const tokenResponse = await fetch(`${gitlabUrl}/oauth/token`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({
+                        client_id: config.clientId,
+                        client_secret: config.clientSecret,
+                        code: payload.code,
+                        grant_type: "authorization_code",
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get GitLab access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string };
+
+                const profileResponse = await fetch(`${gitlabUrl}/api/v4/user`, {
+                    headers: { "Authorization": `Bearer ${tokenData.access_token}` }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get GitLab user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const p = await profileResponse.json() as {
+                    id: number; username: string; name?: string;
+                    email: string; avatar_url?: string | null;
+                };
+
+                if (!p.email) { console.error("GitLab user has no email"); return null; }
+
+                return {
+                    providerId: String(p.id),
+                    email: p.email,
+                    displayName: p.name || p.username || null,
+                    photoUrl: p.avatar_url || null
+                };
+            } catch (error) {
+                console.error("GitLab OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/google-oauth.ts

@@ -0,0 +1,48 @@
+import { OAuth2Client } from "google-auth-library/build/src/index.js";
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+export interface GoogleUserInfo {
+    googleId: string;
+    email: string;
+    displayName: string | null;
+    photoUrl: string | null;
+    emailVerified: boolean;
+}
+
+/**
+ * Creates a Google OAuth Provider integration
+ */
+export function createGoogleProvider(clientId: string): OAuthProvider<{ idToken: string }> {
+    const googleClient = new OAuth2Client(clientId);
+
+    return {
+        id: "google",
+        schema: z.object({
+            idToken: z.string().min(1, "ID token is required")
+        }),
+        verify: async (payload: { idToken: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const ticket = await googleClient.verifyIdToken({
+                    idToken: payload.idToken,
+                    audience: clientId
+                });
+
+                const content = ticket.getPayload();
+                if (!content) {
+                    return null;
+                }
+
+                return {
+                    providerId: content.sub,
+                    email: content.email || "",
+                    displayName: content.name || null,
+                    photoUrl: content.picture || null
+                };
+            } catch (error) {
+                console.error("Failed to verify Google ID token:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/index.ts

@@ -0,0 +1,34 @@
+// Auth module exports
+export * from "./interfaces";
+
+export { configureJwt, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry } from "./jwt";
+export type { JwtConfig, AccessTokenPayload } from "./jwt";
+
+export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
+export type { PasswordValidationResult } from "./password";
+
+// OAuth Providers
+export { createGoogleProvider } from "./google-oauth";
+export { createLinkedinProvider } from "./linkedin-oauth";
+export { createGitHubProvider } from "./github-oauth";
+export { createMicrosoftProvider } from "./microsoft-oauth";
+export { createAppleProvider } from "./apple-oauth";
+export { createFacebookProvider } from "./facebook-oauth";
+export { createTwitterProvider } from "./twitter-oauth";
+export { createDiscordProvider } from "./discord-oauth";
+export { createGitLabProvider } from "./gitlab-oauth";
+export { createBitbucketProvider } from "./bitbucket-oauth";
+export { createSlackProvider } from "./slack-oauth";
+export { createSpotifyProvider } from "./spotify-oauth";
+
+export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware } from "./middleware";
+export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
+
+
+export { createAuthRoutes } from "./routes";
+export type { AuthModuleConfig } from "./routes";
+
+export { createAdminRoutes } from "./admin-routes";
+
+
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter } from "./rate-limiter";