@shware/security 0.4.3

package/dist/oauth2/provider/common.cjs

@@ -0,0 +1,159 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth2/provider/common.ts
+var common_exports = {};
+__export(common_exports, {
+  createAuthorizationUri: () => createAuthorizationUri,
+  exchangeAuthorizationCode: () => exchangeAuthorizationCode,
+  proxyAgent: () => proxyAgent,
+  refreshAccessToken: () => refreshAccessToken,
+  revokeToken: () => revokeToken,
+  verifyIdToken: () => verifyIdToken
+});
+module.exports = __toCommonJS(common_exports);
+var import_crypto = require("crypto");
+var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
+var import_undici = require("undici");
+var import_error = require("../error.cjs");
+function createAuthorizationUri(options) {
+  const url = new URL(options.authorizationUri);
+  url.searchParams.append("response_type", "code");
+  url.searchParams.append("client_id", options.clientId);
+  url.searchParams.append("state", options.state);
+  url.searchParams.append("scope", options.scope.join(" "));
+  url.searchParams.append("redirect_uri", options.redirectUri);
+  if (options.codeVerifier) {
+    const codeChallenge = (0, import_crypto.createHash)("sha256").update(options.codeVerifier).digest().toString("base64url");
+    url.searchParams.append("code_challenge_method", "S256");
+    url.searchParams.append("code_challenge", codeChallenge);
+  }
+  return url;
+}
+var proxyAgent = new import_undici.ProxyAgent("http://localhost:7890");
+async function exchangeAuthorizationCode(params) {
+  const body = new URLSearchParams();
+  body.append("code", params.code);
+  body.append("redirect_uri", params.redirectUri);
+  body.append("grant_type", "authorization_code");
+  if (params.codeVerifier) body.append("code_verifier", params.codeVerifier);
+  const headers = {
+    Accept: "application/json",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (params.authentication === "basic") {
+    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
+    headers.Authorization = `Basic ${token}`;
+  } else {
+    body.append("client_id", params.clientId);
+    body.append("client_secret", params.clientSecret);
+  }
+  return (0, import_undici.fetch)(params.tokenUri, { method: "POST", headers, body, dispatcher: proxyAgent });
+}
+async function refreshAccessToken(params) {
+  const body = new URLSearchParams();
+  body.append("grant_type", "refresh_token");
+  body.append("refresh_token", params.refreshToken);
+  const headers = {
+    Accept: "application/json",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (params.authentication === "basic") {
+    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
+    headers.Authorization = `Basic ${token}`;
+  } else {
+    body.append("client_id", params.clientId);
+    body.append("client_secret", params.clientSecret);
+  }
+  const response = await (0, import_undici.fetch)(params.tokenUri, { method: "POST", headers, body });
+  if (!response.ok) {
+    const error = await response.json();
+    console.error("Refresh token error:", error);
+    throw new import_error.OAuth2Error(response.status, "invalid_request", "Failed to refresh token");
+  }
+  return await response.json();
+}
+async function revokeToken(params) {
+  const body = new URLSearchParams();
+  body.append("token", params.token);
+  const headers = {
+    Accept: "application/json",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (params.authentication === "basic") {
+    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
+    headers.Authorization = `Basic ${token}`;
+  } else {
+    body.append("client_id", params.clientId);
+    body.append("client_secret", params.clientSecret);
+  }
+  const response = await (0, import_undici.fetch)(params.tokenRevokeUri, { method: "POST", headers, body });
+  if (!response.ok) {
+    const error = await response.json();
+    console.error("Refresh token error:", error);
+    throw new import_error.OAuth2Error(response.status, "invalid_request", "Failed to revoke token");
+  }
+}
+var cache = /* @__PURE__ */ new Map();
+async function getJWK(kid, jwkSetUri) {
+  let jwkSet;
+  if (cache.has(jwkSetUri)) {
+    jwkSet = cache.get(jwkSetUri);
+  } else {
+    const response = await (0, import_undici.fetch)(jwkSetUri);
+    if (!response.ok) throw new import_error.OAuth2Error(response.status, "server_error", "Failed to fetch JWK");
+    jwkSet = await response.json();
+    cache.set(jwkSetUri, jwkSet);
+  }
+  const jwk = jwkSet.keys.find((key) => key.kid === kid);
+  if (!jwk) throw new import_error.OAuth2Error(400, "invalid_request", `JWK not found for kid: ${kid}`);
+  return jwk;
+}
+async function verifyIdToken(idToken, jwkSetUri) {
+  const header = import_jsonwebtoken.default.decode(idToken, { complete: true });
+  if (!header?.header.kid) {
+    throw new import_error.OAuth2Error(400, "invalid_request", "kid not found in id_token header");
+  }
+  try {
+    const key = await getJWK(header.header.kid, jwkSetUri);
+    return import_jsonwebtoken.default.verify(idToken, { key, format: "jwk" });
+  } catch (e) {
+    throw new import_error.OAuth2Error(400, "invalid_request", "Failed to verify id_token");
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createAuthorizationUri,
+  exchangeAuthorizationCode,
+  proxyAgent,
+  refreshAccessToken,
+  revokeToken,
+  verifyIdToken
+});
+//# sourceMappingURL=common.cjs.map

package/dist/oauth2/provider/common.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createHash } from 'crypto';\nimport jwt from 'jsonwebtoken';\nimport { fetch, ProxyAgent } from 'undici';\nimport { OAuth2Error } from '../error';\nimport { CodeExchangeParams, OAuth2Token } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  codeVerifier?: string;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.codeVerifier) {\n    const codeChallenge = createHash('sha256')\n      .update(options.codeVerifier)\n      .digest()\n      .toString('base64url');\n    url.searchParams.append('code_challenge_method', 'S256');\n    url.searchParams.append('code_challenge', codeChallenge);\n  }\n  return url;\n}\n\ninterface Params extends CodeExchangeParams {\n  tokenUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport const proxyAgent = new ProxyAgent('http://localhost:7890');\nexport async function exchangeAuthorizationCode(params: Params) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.codeVerifier) body.append('code_verifier', params.codeVerifier);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body, dispatcher: proxyAgent });\n}\n\ninterface RefreshTokenParams {\n  tokenUri: string;\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function refreshAccessToken(params: RefreshTokenParams) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to refresh token');\n  }\n  return (await response.json()) as OAuth2Token;\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\ninterface JWKSet {\n  keys: { kty: string; kid: string; use: string; alg: string; n: string; e: string }[];\n}\n\nconst cache = new Map<string, JWKSet>();\n\nasync function getJWK(kid: string, jwkSetUri: string) {\n  let jwkSet: JWKSet;\n  if (cache.has(jwkSetUri)) {\n    jwkSet = cache.get(jwkSetUri)!;\n  } else {\n    const response = await fetch(jwkSetUri);\n    if (!response.ok) throw new OAuth2Error(response.status, 'server_error', 'Failed to fetch JWK');\n    jwkSet = (await response.json()) as JWKSet;\n    cache.set(jwkSetUri, jwkSet);\n  }\n\n  const jwk = jwkSet.keys.find((key) => key.kid === kid);\n  if (!jwk) throw new OAuth2Error(400, 'invalid_request', `JWK not found for kid: ${kid}`);\n  return jwk;\n}\n\nexport async function verifyIdToken<T>(idToken: string, jwkSetUri: string) {\n  const header = jwt.decode(idToken, { complete: true });\n  if (!header?.header.kid) {\n    throw new OAuth2Error(400, 'invalid_request', 'kid not found in id_token header');\n  }\n  try {\n    const key = await getJWK(header.header.kid, jwkSetUri);\n    return jwt.verify(idToken, { key, format: 'jwk' }) as T;\n  } catch (e) {\n    throw new OAuth2Error(400, 'invalid_request', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAA2B;AAC3B,0BAAgB;AAChB,oBAAkC;AAClC,mBAA4B;AAGrB,SAAS,uBAAuB,SAOpC;AACD,QAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;AAC5C,MAAI,aAAa,OAAO,iBAAiB,MAAM;AAC/C,MAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;AACrD,MAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;AAC9C,MAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;AACxD,MAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;AAC3D,MAAI,QAAQ,cAAc;AACxB,UAAM,oBAAgB,0BAAW,QAAQ,EACtC,OAAO,QAAQ,YAAY,EAC3B,OAAO,EACP,SAAS,WAAW;AACvB,QAAI,aAAa,OAAO,yBAAyB,MAAM;AACvD,QAAI,aAAa,OAAO,kBAAkB,aAAa;AAAA,EACzD;AACA,SAAO;AACT;AAOO,IAAM,aAAa,IAAI,yBAAW,uBAAuB;AAChE,eAAsB,0BAA0B,QAAgB;AAC9D,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,QAAQ,OAAO,IAAI;AAC/B,OAAK,OAAO,gBAAgB,OAAO,WAAW;AAC9C,OAAK,OAAO,cAAc,oBAAoB;AAC9C,MAAI,OAAO,aAAc,MAAK,OAAO,iBAAiB,OAAO,YAAY;AAEzE,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AACA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,aAAO,qBAAM,OAAO,UAAU,EAAE,QAAQ,QAAQ,SAAS,MAAM,YAAY,WAAW,CAAC;AACzF;AAUA,eAAsB,mBAAmB,QAA4B;AACnE,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,cAAc,eAAe;AACzC,OAAK,OAAO,iBAAiB,OAAO,YAAY;AAEhD,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AAEA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,QAAM,WAAW,UAAM,qBAAM,OAAO,UAAU,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,YAAQ,MAAM,wBAAwB,KAAK;AAC3C,UAAM,IAAI,yBAAY,SAAS,QAAQ,mBAAmB,yBAAyB;AAAA,EACrF;AACA,SAAQ,MAAM,SAAS,KAAK;AAC9B;AAUA,eAAsB,YAAY,QAA2B;AAC3D,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,SAAS,OAAO,KAAK;AACjC,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AAEA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,QAAM,WAAW,UAAM,qBAAM,OAAO,gBAAgB,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AACrF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,YAAQ,MAAM,wBAAwB,KAAK;AAC3C,UAAM,IAAI,yBAAY,SAAS,QAAQ,mBAAmB,wBAAwB;AAAA,EACpF;AACF;AAMA,IAAM,QAAQ,oBAAI,IAAoB;AAEtC,eAAe,OAAO,KAAa,WAAmB;AACpD,MAAI;AACJ,MAAI,MAAM,IAAI,SAAS,GAAG;AACxB,aAAS,MAAM,IAAI,SAAS;AAAA,EAC9B,OAAO;AACL,UAAM,WAAW,UAAM,qBAAM,SAAS;AACtC,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,yBAAY,SAAS,QAAQ,gBAAgB,qBAAqB;AAC9F,aAAU,MAAM,SAAS,KAAK;AAC9B,UAAM,IAAI,WAAW,MAAM;AAAA,EAC7B;AAEA,QAAM,MAAM,OAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,GAAG;AACrD,MAAI,CAAC,IAAK,OAAM,IAAI,yBAAY,KAAK,mBAAmB,0BAA0B,GAAG,EAAE;AACvF,SAAO;AACT;AAEA,eAAsB,cAAiB,SAAiB,WAAmB;AACzE,QAAM,SAAS,oBAAAA,QAAI,OAAO,SAAS,EAAE,UAAU,KAAK,CAAC;AACrD,MAAI,CAAC,QAAQ,OAAO,KAAK;AACvB,UAAM,IAAI,yBAAY,KAAK,mBAAmB,kCAAkC;AAAA,EAClF;AACA,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,OAAO,OAAO,KAAK,SAAS;AACrD,WAAO,oBAAAA,QAAI,OAAO,SAAS,EAAE,KAAK,QAAQ,MAAM,CAAC;AAAA,EACnD,SAAS,GAAG;AACV,UAAM,IAAI,yBAAY,KAAK,mBAAmB,2BAA2B;AAAA,EAC3E;AACF;","names":["jwt"]}

package/dist/oauth2/provider/common.d.cts

@@ -0,0 +1,38 @@
+import * as undici from 'undici';
+import { ProxyAgent } from 'undici';
+import * as url from 'url';
+import { CodeExchangeParams, OAuth2Token } from '../types.cjs';
+
+declare function createAuthorizationUri(options: {
+    state: string;
+    scope: string[];
+    clientId: string;
+    redirectUri: string;
+    authorizationUri: string;
+    codeVerifier?: string;
+}): url.URL;
+interface Params extends CodeExchangeParams {
+    tokenUri: string;
+    authentication?: 'basic' | 'post';
+}
+declare const proxyAgent: ProxyAgent;
+declare function exchangeAuthorizationCode(params: Params): Promise<undici.Response>;
+interface RefreshTokenParams {
+    tokenUri: string;
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+    authentication?: 'basic' | 'post';
+}
+declare function refreshAccessToken(params: RefreshTokenParams): Promise<OAuth2Token>;
+interface RevokeTokenParams {
+    token: string;
+    clientId: string;
+    clientSecret: string;
+    tokenRevokeUri: string;
+    authentication?: 'basic' | 'post';
+}
+declare function revokeToken(params: RevokeTokenParams): Promise<void>;
+declare function verifyIdToken<T>(idToken: string, jwkSetUri: string): Promise<T>;
+
+export { createAuthorizationUri, exchangeAuthorizationCode, proxyAgent, refreshAccessToken, revokeToken, verifyIdToken };

package/dist/oauth2/provider/common.d.ts

@@ -0,0 +1,38 @@
+import * as undici from 'undici';
+import { ProxyAgent } from 'undici';
+import * as url from 'url';
+import { CodeExchangeParams, OAuth2Token } from '../types.js';
+
+declare function createAuthorizationUri(options: {
+    state: string;
+    scope: string[];
+    clientId: string;
+    redirectUri: string;
+    authorizationUri: string;
+    codeVerifier?: string;
+}): url.URL;
+interface Params extends CodeExchangeParams {
+    tokenUri: string;
+    authentication?: 'basic' | 'post';
+}
+declare const proxyAgent: ProxyAgent;
+declare function exchangeAuthorizationCode(params: Params): Promise<undici.Response>;
+interface RefreshTokenParams {
+    tokenUri: string;
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+    authentication?: 'basic' | 'post';
+}
+declare function refreshAccessToken(params: RefreshTokenParams): Promise<OAuth2Token>;
+interface RevokeTokenParams {
+    token: string;
+    clientId: string;
+    clientSecret: string;
+    tokenRevokeUri: string;
+    authentication?: 'basic' | 'post';
+}
+declare function revokeToken(params: RevokeTokenParams): Promise<void>;
+declare function verifyIdToken<T>(idToken: string, jwkSetUri: string): Promise<T>;
+
+export { createAuthorizationUri, exchangeAuthorizationCode, proxyAgent, refreshAccessToken, revokeToken, verifyIdToken };

package/dist/oauth2/provider/common.mjs

@@ -0,0 +1,119 @@
+// src/oauth2/provider/common.ts
+import { createHash } from "crypto";
+import jwt from "jsonwebtoken";
+import { fetch, ProxyAgent } from "undici";
+import { OAuth2Error } from "../error.mjs";
+function createAuthorizationUri(options) {
+  const url = new URL(options.authorizationUri);
+  url.searchParams.append("response_type", "code");
+  url.searchParams.append("client_id", options.clientId);
+  url.searchParams.append("state", options.state);
+  url.searchParams.append("scope", options.scope.join(" "));
+  url.searchParams.append("redirect_uri", options.redirectUri);
+  if (options.codeVerifier) {
+    const codeChallenge = createHash("sha256").update(options.codeVerifier).digest().toString("base64url");
+    url.searchParams.append("code_challenge_method", "S256");
+    url.searchParams.append("code_challenge", codeChallenge);
+  }
+  return url;
+}
+var proxyAgent = new ProxyAgent("http://localhost:7890");
+async function exchangeAuthorizationCode(params) {
+  const body = new URLSearchParams();
+  body.append("code", params.code);
+  body.append("redirect_uri", params.redirectUri);
+  body.append("grant_type", "authorization_code");
+  if (params.codeVerifier) body.append("code_verifier", params.codeVerifier);
+  const headers = {
+    Accept: "application/json",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (params.authentication === "basic") {
+    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
+    headers.Authorization = `Basic ${token}`;
+  } else {
+    body.append("client_id", params.clientId);
+    body.append("client_secret", params.clientSecret);
+  }
+  return fetch(params.tokenUri, { method: "POST", headers, body, dispatcher: proxyAgent });
+}
+async function refreshAccessToken(params) {
+  const body = new URLSearchParams();
+  body.append("grant_type", "refresh_token");
+  body.append("refresh_token", params.refreshToken);
+  const headers = {
+    Accept: "application/json",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (params.authentication === "basic") {
+    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
+    headers.Authorization = `Basic ${token}`;
+  } else {
+    body.append("client_id", params.clientId);
+    body.append("client_secret", params.clientSecret);
+  }
+  const response = await fetch(params.tokenUri, { method: "POST", headers, body });
+  if (!response.ok) {
+    const error = await response.json();
+    console.error("Refresh token error:", error);
+    throw new OAuth2Error(response.status, "invalid_request", "Failed to refresh token");
+  }
+  return await response.json();
+}
+async function revokeToken(params) {
+  const body = new URLSearchParams();
+  body.append("token", params.token);
+  const headers = {
+    Accept: "application/json",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (params.authentication === "basic") {
+    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
+    headers.Authorization = `Basic ${token}`;
+  } else {
+    body.append("client_id", params.clientId);
+    body.append("client_secret", params.clientSecret);
+  }
+  const response = await fetch(params.tokenRevokeUri, { method: "POST", headers, body });
+  if (!response.ok) {
+    const error = await response.json();
+    console.error("Refresh token error:", error);
+    throw new OAuth2Error(response.status, "invalid_request", "Failed to revoke token");
+  }
+}
+var cache = /* @__PURE__ */ new Map();
+async function getJWK(kid, jwkSetUri) {
+  let jwkSet;
+  if (cache.has(jwkSetUri)) {
+    jwkSet = cache.get(jwkSetUri);
+  } else {
+    const response = await fetch(jwkSetUri);
+    if (!response.ok) throw new OAuth2Error(response.status, "server_error", "Failed to fetch JWK");
+    jwkSet = await response.json();
+    cache.set(jwkSetUri, jwkSet);
+  }
+  const jwk = jwkSet.keys.find((key) => key.kid === kid);
+  if (!jwk) throw new OAuth2Error(400, "invalid_request", `JWK not found for kid: ${kid}`);
+  return jwk;
+}
+async function verifyIdToken(idToken, jwkSetUri) {
+  const header = jwt.decode(idToken, { complete: true });
+  if (!header?.header.kid) {
+    throw new OAuth2Error(400, "invalid_request", "kid not found in id_token header");
+  }
+  try {
+    const key = await getJWK(header.header.kid, jwkSetUri);
+    return jwt.verify(idToken, { key, format: "jwk" });
+  } catch (e) {
+    throw new OAuth2Error(400, "invalid_request", "Failed to verify id_token");
+  }
+}
+export {
+  createAuthorizationUri,
+  exchangeAuthorizationCode,
+  proxyAgent,
+  refreshAccessToken,
+  revokeToken,
+  verifyIdToken
+};
+//# sourceMappingURL=common.mjs.map

package/dist/oauth2/provider/common.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createHash } from 'crypto';\nimport jwt from 'jsonwebtoken';\nimport { fetch, ProxyAgent } from 'undici';\nimport { OAuth2Error } from '../error';\nimport { CodeExchangeParams, OAuth2Token } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  codeVerifier?: string;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.codeVerifier) {\n    const codeChallenge = createHash('sha256')\n      .update(options.codeVerifier)\n      .digest()\n      .toString('base64url');\n    url.searchParams.append('code_challenge_method', 'S256');\n    url.searchParams.append('code_challenge', codeChallenge);\n  }\n  return url;\n}\n\ninterface Params extends CodeExchangeParams {\n  tokenUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport const proxyAgent = new ProxyAgent('http://localhost:7890');\nexport async function exchangeAuthorizationCode(params: Params) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.codeVerifier) body.append('code_verifier', params.codeVerifier);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body, dispatcher: proxyAgent });\n}\n\ninterface RefreshTokenParams {\n  tokenUri: string;\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function refreshAccessToken(params: RefreshTokenParams) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to refresh token');\n  }\n  return (await response.json()) as OAuth2Token;\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\ninterface JWKSet {\n  keys: { kty: string; kid: string; use: string; alg: string; n: string; e: string }[];\n}\n\nconst cache = new Map<string, JWKSet>();\n\nasync function getJWK(kid: string, jwkSetUri: string) {\n  let jwkSet: JWKSet;\n  if (cache.has(jwkSetUri)) {\n    jwkSet = cache.get(jwkSetUri)!;\n  } else {\n    const response = await fetch(jwkSetUri);\n    if (!response.ok) throw new OAuth2Error(response.status, 'server_error', 'Failed to fetch JWK');\n    jwkSet = (await response.json()) as JWKSet;\n    cache.set(jwkSetUri, jwkSet);\n  }\n\n  const jwk = jwkSet.keys.find((key) => key.kid === kid);\n  if (!jwk) throw new OAuth2Error(400, 'invalid_request', `JWK not found for kid: ${kid}`);\n  return jwk;\n}\n\nexport async function verifyIdToken<T>(idToken: string, jwkSetUri: string) {\n  const header = jwt.decode(idToken, { complete: true });\n  if (!header?.header.kid) {\n    throw new OAuth2Error(400, 'invalid_request', 'kid not found in id_token header');\n  }\n  try {\n    const key = await getJWK(header.header.kid, jwkSetUri);\n    return jwt.verify(idToken, { key, format: 'jwk' }) as T;\n  } catch (e) {\n    throw new OAuth2Error(400, 'invalid_request', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,OAAO,SAAS;AAChB,SAAS,OAAO,kBAAkB;AAClC,SAAS,mBAAmB;AAGrB,SAAS,uBAAuB,SAOpC;AACD,QAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;AAC5C,MAAI,aAAa,OAAO,iBAAiB,MAAM;AAC/C,MAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;AACrD,MAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;AAC9C,MAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;AACxD,MAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;AAC3D,MAAI,QAAQ,cAAc;AACxB,UAAM,gBAAgB,WAAW,QAAQ,EACtC,OAAO,QAAQ,YAAY,EAC3B,OAAO,EACP,SAAS,WAAW;AACvB,QAAI,aAAa,OAAO,yBAAyB,MAAM;AACvD,QAAI,aAAa,OAAO,kBAAkB,aAAa;AAAA,EACzD;AACA,SAAO;AACT;AAOO,IAAM,aAAa,IAAI,WAAW,uBAAuB;AAChE,eAAsB,0BAA0B,QAAgB;AAC9D,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,QAAQ,OAAO,IAAI;AAC/B,OAAK,OAAO,gBAAgB,OAAO,WAAW;AAC9C,OAAK,OAAO,cAAc,oBAAoB;AAC9C,MAAI,OAAO,aAAc,MAAK,OAAO,iBAAiB,OAAO,YAAY;AAEzE,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AACA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,SAAO,MAAM,OAAO,UAAU,EAAE,QAAQ,QAAQ,SAAS,MAAM,YAAY,WAAW,CAAC;AACzF;AAUA,eAAsB,mBAAmB,QAA4B;AACnE,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,cAAc,eAAe;AACzC,OAAK,OAAO,iBAAiB,OAAO,YAAY;AAEhD,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AAEA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,QAAM,WAAW,MAAM,MAAM,OAAO,UAAU,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AAC/E,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,YAAQ,MAAM,wBAAwB,KAAK;AAC3C,UAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,yBAAyB;AAAA,EACrF;AACA,SAAQ,MAAM,SAAS,KAAK;AAC9B;AAUA,eAAsB,YAAY,QAA2B;AAC3D,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,SAAS,OAAO,KAAK;AACjC,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AAEA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,QAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AACrF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,YAAQ,MAAM,wBAAwB,KAAK;AAC3C,UAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;AAAA,EACpF;AACF;AAMA,IAAM,QAAQ,oBAAI,IAAoB;AAEtC,eAAe,OAAO,KAAa,WAAmB;AACpD,MAAI;AACJ,MAAI,MAAM,IAAI,SAAS,GAAG;AACxB,aAAS,MAAM,IAAI,SAAS;AAAA,EAC9B,OAAO;AACL,UAAM,WAAW,MAAM,MAAM,SAAS;AACtC,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,YAAY,SAAS,QAAQ,gBAAgB,qBAAqB;AAC9F,aAAU,MAAM,SAAS,KAAK;AAC9B,UAAM,IAAI,WAAW,MAAM;AAAA,EAC7B;AAEA,QAAM,MAAM,OAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,GAAG;AACrD,MAAI,CAAC,IAAK,OAAM,IAAI,YAAY,KAAK,mBAAmB,0BAA0B,GAAG,EAAE;AACvF,SAAO;AACT;AAEA,eAAsB,cAAiB,SAAiB,WAAmB;AACzE,QAAM,SAAS,IAAI,OAAO,SAAS,EAAE,UAAU,KAAK,CAAC;AACrD,MAAI,CAAC,QAAQ,OAAO,KAAK;AACvB,UAAM,IAAI,YAAY,KAAK,mBAAmB,kCAAkC;AAAA,EAClF;AACA,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,OAAO,OAAO,KAAK,SAAS;AACrD,WAAO,IAAI,OAAO,SAAS,EAAE,KAAK,QAAQ,MAAM,CAAC;AAAA,EACnD,SAAS,GAAG;AACV,UAAM,IAAI,YAAY,KAAK,mBAAmB,2BAA2B;AAAA,EAC3E;AACF;","names":[]}

package/dist/oauth2/provider/facebook.cjs

@@ -0,0 +1,106 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth2/provider/facebook.ts
+var facebook_exports = {};
+__export(facebook_exports, {
+  facebook: () => facebook
+});
+module.exports = __toCommonJS(facebook_exports);
+var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
+var import_error = require("../error.cjs");
+var import_common = require("./common.cjs");
+function facebook() {
+  return {
+    authorizationUri: "https://www.facebook.com/v21.0/dialog/oauth",
+    tokenUri: "https://graph.facebook.com/v19.0/oauth/access_token",
+    userInfoUri: "https://graph.facebook.com/me",
+    jwkSetUri: "https://limited.facebook.com/.well-known/oauth/openid/jwks/",
+    userNameAttribute: "id",
+    defaultScope: ["profile", "email"],
+    createAuthorizationUri({ codeVerifier, ...params }) {
+      return (0, import_common.createAuthorizationUri)({
+        ...params,
+        scope: params.scope ?? this.defaultScope,
+        authorizationUri: this.authorizationUri
+      });
+    },
+    async exchangeAuthorizationCode({ codeVerifier, ...params }) {
+      const response = await (0, import_common.exchangeAuthorizationCode)({ ...params, tokenUri: this.tokenUri });
+      if (!response.ok) {
+        const { error } = await response.json();
+        throw new import_error.OAuth2Error(response.status, "invalid_request", error.message);
+      }
+      return await response.json();
+    },
+    async getUserInfo({ id_token, access_token }) {
+      (0, import_tiny_invariant.default)(this.jwkSetUri, "jwkSetUri is required");
+      if (id_token) {
+        const data2 = await (0, import_common.verifyIdToken)(id_token, this.jwkSetUri);
+        return {
+          data: data2,
+          claims: {
+            sub: data2.sub,
+            name: data2.name,
+            picture: data2.picture,
+            email: data2.email,
+            email_verified: true
+          }
+        };
+      }
+      (0, import_tiny_invariant.default)(access_token, "access_token is required");
+      (0, import_tiny_invariant.default)(this.userInfoUri, "userInfoUri is required");
+      const url = new URL(this.userInfoUri);
+      const fields = ["id", "name", "email", "picture.width(320).height(320)"];
+      url.searchParams.append("access_token", access_token);
+      url.searchParams.append("fields", fields.join(","));
+      const headers = { Accept: "application/json" };
+      const response = await fetch(url.href, { headers });
+      if (!response.ok) {
+        throw new import_error.OAuth2Error(response.status, "invalid_request", "Failed to fetch user info");
+      }
+      const data = await response.json();
+      return {
+        data,
+        claims: {
+          sub: data.id,
+          name: data.name,
+          email: data.email,
+          picture: data.picture.data.url,
+          email_verified: data.email_verified
+        }
+      };
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  facebook
+});
+//# sourceMappingURL=facebook.cjs.map

package/dist/oauth2/provider/facebook.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function facebook(): Provider<FacebookUserInfo | FacebookDecodedIdToken> {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    createAuthorizationUri({ codeVerifier, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ codeVerifier, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookOAuth2Token;\n    },\n    async getUserInfo({ id_token, access_token }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, this.jwkSetUri);\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: true,\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const url = new URL(this.userInfoUri);\n      const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n      url.searchParams.append('access_token', access_token);\n      url.searchParams.append('fields', fields.join(','));\n      const headers = { Accept: 'application/json' };\n      const response = await fetch(url.href, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as FacebookUserInfo;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name,\n          email: data.email,\n          picture: data.picture.data.url,\n          email_verified: data.email_verified,\n        },\n      };\n    },\n  };\n}\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\ninterface FacebookOAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n}\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAM1E,SAAS,WAAgE;AAC9E,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,WAAW,OAAO;AAAA,IACjC,uBAAuB,EAAE,cAAc,GAAG,OAAO,GAAG;AAClD,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,cAAc,GAAG,OAAO,GAAG;AAC3D,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;AAAA,MACzE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,UAAU,aAAa,GAAG;AAC5C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,UAAI,UAAU;AACZ,cAAMC,QAAO,UAAM,6BAAsC,UAAU,KAAK,SAAS;AACjF,eAAO;AAAA,UACL,MAAAA;AAAA,UACA,QAAQ;AAAA,YACN,KAAKA,MAAK;AAAA,YACV,MAAMA,MAAK;AAAA,YACX,SAASA,MAAK;AAAA,YACd,OAAOA,MAAK;AAAA,YACZ,gBAAgB;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AACA,gCAAAD,SAAU,cAAc,0BAA0B;AAClD,gCAAAA,SAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,YAAM,SAAS,CAAC,MAAM,QAAQ,SAAS,gCAAgC;AACvE,UAAI,aAAa,OAAO,gBAAgB,YAAY;AACpD,UAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;AAClD,YAAM,UAAU,EAAE,QAAQ,mBAAmB;AAC7C,YAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,QAAQ,CAAC;AAClD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,yBAAY,SAAS,QAAQ,mBAAmB,2BAA2B;AAAA,MACvF;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,SAAS,KAAK,QAAQ,KAAK;AAAA,UAC3B,gBAAgB,KAAK;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["invariant","data"]}

package/dist/oauth2/provider/facebook.d.cts

@@ -0,0 +1,29 @@
+import { Provider } from '../types.cjs';
+
+/**
+ * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/
+ * ref: https://developers.facebook.com/tools/explorer
+ * */
+declare function facebook(): Provider<FacebookUserInfo | FacebookDecodedIdToken>;
+interface FacebookDecodedIdToken {
+    sub: string;
+    name: string;
+    email: string;
+    picture: string;
+}
+interface FacebookUserInfo {
+    id: string;
+    name: string;
+    email: string;
+    email_verified: boolean;
+    picture: {
+        data: {
+            url: string;
+            width: number;
+            height: number;
+            is_silhouette: boolean;
+        };
+    };
+}
+
+export { type FacebookDecodedIdToken, type FacebookUserInfo, facebook };

package/dist/oauth2/provider/facebook.d.ts

@@ -0,0 +1,29 @@
+import { Provider } from '../types.js';
+
+/**
+ * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/
+ * ref: https://developers.facebook.com/tools/explorer
+ * */
+declare function facebook(): Provider<FacebookUserInfo | FacebookDecodedIdToken>;
+interface FacebookDecodedIdToken {
+    sub: string;
+    name: string;
+    email: string;
+    picture: string;
+}
+interface FacebookUserInfo {
+    id: string;
+    name: string;
+    email: string;
+    email_verified: boolean;
+    picture: {
+        data: {
+            url: string;
+            width: number;
+            height: number;
+            is_silhouette: boolean;
+        };
+    };
+}
+
+export { type FacebookDecodedIdToken, type FacebookUserInfo, facebook };

package/dist/oauth2/provider/facebook.mjs

@@ -0,0 +1,71 @@
+// src/oauth2/provider/facebook.ts
+import invariant from "tiny-invariant";
+import { OAuth2Error } from "../error.mjs";
+import { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from "./common.mjs";
+function facebook() {
+  return {
+    authorizationUri: "https://www.facebook.com/v21.0/dialog/oauth",
+    tokenUri: "https://graph.facebook.com/v19.0/oauth/access_token",
+    userInfoUri: "https://graph.facebook.com/me",
+    jwkSetUri: "https://limited.facebook.com/.well-known/oauth/openid/jwks/",
+    userNameAttribute: "id",
+    defaultScope: ["profile", "email"],
+    createAuthorizationUri({ codeVerifier, ...params }) {
+      return createAuthorizationUri({
+        ...params,
+        scope: params.scope ?? this.defaultScope,
+        authorizationUri: this.authorizationUri
+      });
+    },
+    async exchangeAuthorizationCode({ codeVerifier, ...params }) {
+      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });
+      if (!response.ok) {
+        const { error } = await response.json();
+        throw new OAuth2Error(response.status, "invalid_request", error.message);
+      }
+      return await response.json();
+    },
+    async getUserInfo({ id_token, access_token }) {
+      invariant(this.jwkSetUri, "jwkSetUri is required");
+      if (id_token) {
+        const data2 = await verifyIdToken(id_token, this.jwkSetUri);
+        return {
+          data: data2,
+          claims: {
+            sub: data2.sub,
+            name: data2.name,
+            picture: data2.picture,
+            email: data2.email,
+            email_verified: true
+          }
+        };
+      }
+      invariant(access_token, "access_token is required");
+      invariant(this.userInfoUri, "userInfoUri is required");
+      const url = new URL(this.userInfoUri);
+      const fields = ["id", "name", "email", "picture.width(320).height(320)"];
+      url.searchParams.append("access_token", access_token);
+      url.searchParams.append("fields", fields.join(","));
+      const headers = { Accept: "application/json" };
+      const response = await fetch(url.href, { headers });
+      if (!response.ok) {
+        throw new OAuth2Error(response.status, "invalid_request", "Failed to fetch user info");
+      }
+      const data = await response.json();
+      return {
+        data,
+        claims: {
+          sub: data.id,
+          name: data.name,
+          email: data.email,
+          picture: data.picture.data.url,
+          email_verified: data.email_verified
+        }
+      };
+    }
+  };
+}
+export {
+  facebook
+};
+//# sourceMappingURL=facebook.mjs.map