@revojs/auth 0.2.3 → 0.2.5

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { type Route } from "@revojs/server";
 import { type Scope } from "revojs";
-import type { Awaitable } from "revojs/shared";
+import { type Awaitable } from "revojs/shared";
 import { type InferInput } from "valibot";
 export type Principal = InferInput<typeof principalSchema>;
 export type PasswordMethod = InferInput<typeof passwordMethodSchema>;
@@ -39,6 +39,7 @@ export interface ProviderUserInfo {
 export interface AuthProviderOptions {
     issuer: string;
     scope: string;
+    pkce: boolean;
     clientKey: string;
     clientSecret: string;
     authorize: ProviderEndpoint;
@@ -60,16 +61,18 @@ export declare function getSession<T>(scope: Scope): Promise<T | undefined>;
 export declare function setSession<T>(scope: Scope, session: T): Promise<void>;
 export declare function clearSession(scope: Scope): void;
 export declare function defineAuthProvider(provider: AuthProvider): Route;
+export declare const AUTHORIZE_HOOK: import("revojs").Descriptor<(method: Method) => Awaitable<boolean>>;
 export declare const GET_PRINCIPAL_HOOK: import("revojs").Descriptor<(method: Method) => Awaitable<Principal | undefined>>;
 export declare const CREATE_PRINCIPAL_HOOK: import("revojs").Descriptor<(method: Method) => Awaitable<Principal | undefined>>;
 export declare const CREATE_SESSION_HOOK: import("revojs").Descriptor<(principal: Principal) => Awaitable<unknown>>;
 export declare const DELETE_SESSION_HOOK: import("revojs").Descriptor<(session: any) => Awaitable<unknown>>;
-export declare const registerAuthHooks: (scope: Scope, hooks: import("revojs").Hooks<{
+export declare const registerAuthHooks: (scope: Scope, hooks: Partial<import("revojs").Hooks<{
+    authorize: import("revojs").Descriptor<(method: Method) => Awaitable<boolean>>;
     getPrincipal: import("revojs").Descriptor<(method: Method) => Awaitable<Principal | undefined>>;
     createPrincipal: import("revojs").Descriptor<(method: Method) => Awaitable<Principal | undefined>>;
     createSession: import("revojs").Descriptor<(principal: Principal) => Awaitable<unknown>>;
     deleteSession: import("revojs").Descriptor<(session: any) => Awaitable<unknown>>;
-}>) => void;
+}>>) => void;
 export declare const principalSchema: import("valibot").ObjectSchema<{
     readonly sub: import("valibot").StringSchema<undefined>;
     readonly email: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
@@ -91,6 +94,7 @@ export declare const passkeyMethodSchema: import("valibot").ObjectSchema<{
 export declare const providerMethodSchema: import("valibot").ObjectSchema<{
     readonly type: import("valibot").LiteralSchema<"PROVIDER", undefined>;
     readonly issuer: import("valibot").StringSchema<undefined>;
+    readonly accessToken: import("valibot").StringSchema<undefined>;
     readonly principal: import("valibot").ObjectSchema<{
         readonly sub: import("valibot").StringSchema<undefined>;
         readonly email: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
@@ -111,6 +115,7 @@ export declare const methodSchema: import("valibot").UnionSchema<[import("valibo
 }, undefined>, import("valibot").ObjectSchema<{
     readonly type: import("valibot").LiteralSchema<"PROVIDER", undefined>;
     readonly issuer: import("valibot").StringSchema<undefined>;
+    readonly accessToken: import("valibot").StringSchema<undefined>;
     readonly principal: import("valibot").ObjectSchema<{
         readonly sub: import("valibot").StringSchema<undefined>;
         readonly email: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;

package/dist/index.js

@@ -1,7 +1,8 @@
-import options from "#config/auth";
+import config from "#config/auth";
 import { isClient, isServer } from "#variables";
-import { deleteCookie, fetch, sendRedirect, setCookie, useCookies, useHeaders, useQuery, useUrl, withQuery } from "@revojs/server";
-import { createRegisterHooks, defineHook, dispatchHookSingle, useVariables } from "revojs";
+import { deleteCookie, fetch, sendForbidden, sendRedirect, setCookie, useCookies, useHeaders, useQuery, useUrl, withQuery } from "@revojs/server";
+import { createRegisterHooks, defineHook, dispatchHook, dispatchHookSingle, useVariables } from "revojs";
+import { mergeObjects } from "revojs/shared";
 import { boolean, literal, nullish, number, object, optional, parse, pipe, string, transform, union } from "valibot";
 //#region src/index.ts
 function useAuth(scope) {
@@ -48,7 +49,7 @@ async function getCryptoKey(scope) {
 	}, false, ["sign", "verify"]);
 }
 async function getSession(scope) {
-	const session = useCookies(scope)[options.session.name];
+	const session = useCookies(scope)[config.session.name];
 	if (session) {
 		const index = session.lastIndexOf(".");
 		if (index > 0) try {
@@ -60,67 +61,107 @@ async function getSession(scope) {
 async function setSession(scope, session) {
 	const value = encoder.encode(JSON.stringify(session));
 	const cookie = value.toBase64(BASE64_SIGN) + "." + new Uint8Array(await crypto.subtle.sign("HMAC", await getCryptoKey(scope), value)).toBase64(BASE64_SIGN);
-	setCookie(scope, options.session.name, cookie, options.session.cookie);
+	setCookie(scope, config.session.name, cookie, config.session.cookie);
 }
 function clearSession(scope) {
-	deleteCookie(scope, options.session.name, options.session.cookie);
+	deleteCookie(scope, config.session.name, config.session.cookie);
 }
 function defineAuthProvider(provider) {
 	return { async fetch(scope) {
-		const options = provider.setup(scope);
-		const { origin } = useUrl(scope);
-		const { code, state, redirect } = useQuery(scope);
-		const target = state ?? redirect ?? "/";
+		const defaults = provider.setup(scope);
+		const options = mergeObjects(config.providers?.[defaults.issuer] ?? {}, defaults);
+		const { origin, protocol } = useUrl(scope);
+		const { code, state, redirect, error } = useQuery(scope);
+		const secure = protocol === "https:";
+		const cookieName = `${secure ? "__Host-revojs-oauth" : "revojs-oauth"}-${options.issuer}`;
 		const redirectUri = `${origin}/auth/provider/${options.issuer}`;
-		const successPath = target.startsWith("/") && !target.startsWith("//") ? target : "/";
-		if (code) {
+		if (code || state || error) {
+			const cookie = useCookies(scope)[cookieName];
+			deleteCookie(scope, cookieName, {
+				path: "/",
+				secure
+			});
+			let flow;
+			try {
+				flow = parse(oauthFlowSchema, JSON.parse(cookie));
+			} catch {
+				return sendForbidden(scope);
+			}
+			if (error || !code || !state || state !== flow.state || !flow.redirect.startsWith("/") || !URL.canParse(flow.redirect, origin) || new URL(flow.redirect, origin).origin !== origin || options.pkce && !flow.verifier) return sendForbidden(scope);
+			const body = new URLSearchParams({
+				grant_type: "authorization_code",
+				client_id: options.clientKey,
+				client_secret: options.clientSecret,
+				redirect_uri: redirectUri,
+				code,
+				...options.token.parameters
+			});
+			if (options.pkce) body.set("code_verifier", flow.verifier);
 			const token = await fetch(scope, options.token.url, {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/x-www-form-urlencoded",
 					...options.token.headers
 				},
-				body: new URLSearchParams({
-					grant_type: "authorization_code",
-					client_id: options.clientKey,
-					client_secret: options.clientSecret,
-					redirect_uri: redirectUri,
-					code,
-					...options.token.parameters
-				})
+				body
 			});
 			const method = {
 				type: "PROVIDER",
 				issuer: options.issuer,
+				accessToken: token.access_token,
 				principal: (options.toPrincipal ?? ((user) => parse(userInfoSchema, user)))(await fetch(scope, options.userInfo.url, { headers: {
 					Authorization: `Bearer ${token.access_token}`,
 					...options.userInfo.headers
 				} }))
 			};
+			if ((await dispatchHook(scope, AUTHORIZE_HOOK, method)).includes(false)) return sendForbidden(scope);
 			const principal = await dispatchHookSingle(scope, GET_PRINCIPAL_HOOK, method) ?? await dispatchHookSingle(scope, CREATE_PRINCIPAL_HOOK, method);
 			if (principal) {
 				const session = await dispatchHookSingle(scope, CREATE_SESSION_HOOK, principal);
 				if (session) {
 					await setSession(scope, session);
-					return sendRedirect(scope, successPath);
+					return sendRedirect(scope, flow.redirect);
 				}
 			}
+			return sendForbidden(scope);
 		}
-		return sendRedirect(scope, withQuery(scope, options.authorize.url, {
+		const verifier = options.pkce ? crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)).toBase64(BASE64_SIGN) : "";
+		const redirectUrl = redirect && URL.canParse(redirect, origin) ? new URL(redirect, origin) : null;
+		const flow = {
+			state: crypto.randomUUID(),
+			redirect: redirect?.startsWith("/") && redirectUrl?.origin === origin ? redirect : "/",
+			verifier
+		};
+		const parameters = new URLSearchParams({
 			response_type: "code",
 			client_id: options.clientKey,
 			redirect_uri: redirectUri,
 			scope: options.scope,
-			state: successPath,
-			...options.authorize.parameters
-		}));
+			...options.authorize.parameters,
+			state: flow.state
+		});
+		if (verifier) {
+			const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
+			parameters.set("code_challenge", new Uint8Array(digest).toBase64(BASE64_SIGN));
+			parameters.set("code_challenge_method", "S256");
+		}
+		setCookie(scope, cookieName, JSON.stringify(flow), {
+			path: "/",
+			secure,
+			httpOnly: true,
+			sameSite: "Lax",
+			maxAge: 600
+		});
+		return sendRedirect(scope, withQuery(scope, options.authorize.url, parameters));
 	} };
 }
+var AUTHORIZE_HOOK = defineHook("AUTHORIZE_HOOK");
 var GET_PRINCIPAL_HOOK = defineHook("GET_PRINCIPAL_HOOK");
 var CREATE_PRINCIPAL_HOOK = defineHook("CREATE_PRINCIPAL_HOOK");
 var CREATE_SESSION_HOOK = defineHook("CREATE_SESSION_HOOK");
 var DELETE_SESSION_HOOK = defineHook("DELETE_SESSION_HOOK");
 var registerAuthHooks = createRegisterHooks({
+	authorize: AUTHORIZE_HOOK,
 	getPrincipal: GET_PRINCIPAL_HOOK,
 	createPrincipal: CREATE_PRINCIPAL_HOOK,
 	createSession: CREATE_SESSION_HOOK,
@@ -145,6 +186,7 @@ var passkeyMethodSchema = object({ type: literal("PASSKEY") });
 var providerMethodSchema = object({
 	type: literal("PROVIDER"),
 	issuer: string(),
+	accessToken: string(),
 	principal: principalSchema
 });
 var methodSchema = union([
@@ -155,6 +197,11 @@ var methodSchema = union([
 var nullableStringSchema = nullish(string());
 var nullableIdentifierSchema = nullish(union([string(), number()]));
 var nullableBooleanSchema = nullish(boolean());
+var oauthFlowSchema = object({
+	state: string(),
+	redirect: string(),
+	verifier: string()
+});
 var userInfoSchema = pipe(object({
 	sub: nullableIdentifierSchema,
 	id: nullableIdentifierSchema,
@@ -187,4 +234,4 @@ var BASE64_VERIFY = { alphabet: "base64url" };
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 //#endregion
-export { CREATE_PRINCIPAL_HOOK, CREATE_SESSION_HOOK, DELETE_SESSION_HOOK, GET_PRINCIPAL_HOOK, clearSession, defineAuthProvider, getCryptoKey, getSession, methodSchema, passkeyMethodSchema, passwordMethodSchema, principalSchema, providerMethodSchema, registerAuthHooks, requireSession, setSession, useAuth };
+export { AUTHORIZE_HOOK, CREATE_PRINCIPAL_HOOK, CREATE_SESSION_HOOK, DELETE_SESSION_HOOK, GET_PRINCIPAL_HOOK, clearSession, defineAuthProvider, getCryptoKey, getSession, methodSchema, passkeyMethodSchema, passwordMethodSchema, principalSchema, providerMethodSchema, registerAuthHooks, requireSession, setSession, useAuth };

package/dist/module/index.d.ts

@@ -1,10 +1,13 @@
 import type { CookieOptions } from "@revojs/server";
+import type { AuthProviderOptions, Providers } from "@revojs/auth";
+import type { Mergeable } from "revojs/shared";
 export interface SessionOptions {
     name: string;
     cookie: CookieOptions;
 }
 export interface AuthConfig {
     session: SessionOptions;
+    providers?: Partial<Record<Providers | (string & {}), Mergeable<Pick<AuthProviderOptions, "scope" | "pkce" | "authorize" | "token" | "userInfo">>>>;
 }
 declare const _default: import("revojs/module").Module<"auth", AuthConfig, []>;
 export default _default;

package/dist/routes/auth/provider/apple/get.js

@@ -8,6 +8,7 @@ var get_default = defineAuthProvider({ setup(scope) {
 	return {
 		issuer: "apple",
 		scope: "name email",
+		pkce: false,
 		clientKey: appleClientKey,
 		clientSecret: appleClientSecret,
 		authorize: {

package/dist/routes/auth/provider/github/get.js

@@ -8,6 +8,7 @@ var get_default = defineAuthProvider({ setup(scope) {
 	return {
 		issuer: "github",
 		scope: "read:user user:email",
+		pkce: true,
 		clientKey: githubClientKey,
 		clientSecret: githubClientSecret,
 		authorize: { url: "https://github.com/login/oauth/authorize" },

package/dist/routes/auth/provider/google/get.js

@@ -8,6 +8,7 @@ var get_default = defineAuthProvider({ setup(scope) {
 	return {
 		issuer: "google",
 		scope: "email profile",
+		pkce: true,
 		clientKey: googleClientKey,
 		clientSecret: googleClientSecret,
 		authorize: { url: "https://accounts.google.com/o/oauth2/v2/auth" },

package/dist/routes/auth/provider/microsoft/get.js

@@ -8,6 +8,7 @@ var get_default = defineAuthProvider({ setup(scope) {
 	return {
 		issuer: "microsoft",
 		scope: "openid email profile",
+		pkce: true,
 		clientKey: microsoftClientKey,
 		clientSecret: microsoftClientSecret,
 		authorize: { url: `https://login.microsoftonline.com/${microsoftTenant ?? "common"}/oauth2/v2.0/authorize` },

package/dist/routes/auth/sessions/post.js

@@ -1,10 +1,11 @@
-import { CREATE_PRINCIPAL_HOOK, CREATE_SESSION_HOOK, GET_PRINCIPAL_HOOK, passkeyMethodSchema, passwordMethodSchema, setSession } from "../../../index.js";
-import { defineRoute, sendNotFound, sendOk, useBody } from "@revojs/server";
-import { dispatchHookSingle } from "revojs";
+import { AUTHORIZE_HOOK, CREATE_PRINCIPAL_HOOK, CREATE_SESSION_HOOK, GET_PRINCIPAL_HOOK, passkeyMethodSchema, passwordMethodSchema, setSession } from "../../../index.js";
+import { defineRoute, sendForbidden, sendNotFound, sendOk, useBody } from "@revojs/server";
+import { dispatchHook, dispatchHookSingle } from "revojs";
 import { union } from "valibot";
 //#region src/routes/auth/sessions/post.ts
 var post_default = defineRoute({ async fetch(scope) {
 	const method = await useBody(scope, union([passwordMethodSchema, passkeyMethodSchema]));
+	if ((await dispatchHook(scope, AUTHORIZE_HOOK, method)).includes(false)) return sendForbidden(scope);
 	const principal = await dispatchHookSingle(scope, GET_PRINCIPAL_HOOK, method) ?? (method.type !== "PASSWORD" || method.register ? await dispatchHookSingle(scope, CREATE_PRINCIPAL_HOOK, method) : void 0);
 	if (principal) {
 		const session = await dispatchHookSingle(scope, CREATE_SESSION_HOOK, principal);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@revojs/auth",
-    "version": "0.2.3",
+    "version": "0.2.5",
     "license": "MIT",
     "repository": {
         "type": "git",