@shware/security 0.4.9 → 1.0.0

package/dist/oauth2/provider/github.d.ts

@@ -1,6 +1,7 @@
-import { Provider } from '../types.js';
+import { Provider, OAuth2Token } from '../types.js';
 
-declare function github(): Provider<GithubUserInfo>;
+declare function createGithubProvider(): Provider;
+declare const github: Provider;
 interface GithubUserInfo {
     login: string;
     id: string;
@@ -47,5 +48,12 @@ interface GithubUserInfo {
         collaborators: string;
     };
 }
+interface GithubToken extends OAuth2Token {
+    access_token: string;
+    token_type: string;
+    scope: string;
+    expires_in: number;
+    refresh_token: string;
+}
 
-export { type GithubUserInfo, github };
+export { type GithubToken, type GithubUserInfo, createGithubProvider, github };

package/dist/oauth2/provider/github.mjs

@@ -2,21 +2,21 @@
 import invariant from "tiny-invariant";
 import { OAuth2Error } from "../error.mjs";
 import { createAuthorizationUri, exchangeAuthorizationCode } from "./common.mjs";
-function github() {
+function createGithubProvider() {
   return {
     authorizationUri: "https://github.com/login/oauth/authorize",
     tokenUri: "https://github.com/login/oauth/access_token",
     userInfoUri: "https://api.github.com/user",
     userNameAttribute: "id",
     defaultScope: ["user:email"],
-    createAuthorizationUri({ codeVerifier, ...params }) {
+    createAuthorizationUri({ pkce, ...params }) {
       return createAuthorizationUri({
         ...params,
         scope: params.scope ?? this.defaultScope,
         authorizationUri: this.authorizationUri
       });
     },
-    async exchangeAuthorizationCode({ codeVerifier, ...params }) {
+    async exchangeAuthorizationCode({ pkce, ...params }) {
       const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });
       if (!response.ok) {
         const { error, error_description } = await response.json();
@@ -60,7 +60,9 @@ function github() {
     }
   };
 }
+var github = createGithubProvider();
 export {
+  createGithubProvider,
   github
 };
 //# sourceMappingURL=github.mjs.map

package/dist/oauth2/provider/github.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\nexport function github(): Provider<GithubUserInfo> {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ codeVerifier, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ codeVerifier, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GithubOAuth2Token;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        throw new OAuth2Error(\n          emailResponse.status,\n          'invalid_request',\n          'Failed to fetch user email'\n        );\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified || false;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport interface GithubUserInfo {\n  login: string;\n  id: string;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\ninterface GithubOAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB,iCAAiC;AAE3D,SAAS,SAAmC;AACjD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,cAAc,CAAC,YAAY;AAAA,IAC3B,uBAAuB,EAAE,cAAc,GAAG,OAAO,GAAG;AAClD,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,cAAc,GAAG,OAAO,GAAG;AAC3D,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AACrD,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AACtF,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;AAAA,MACvF;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,YAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;AACnF,UAAI,CAAC,cAAc,IAAI;AACrB,cAAM,IAAI;AAAA,UACR,cAAc;AAAA,UACd;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAU,MAAM,cAAc,KAAK;AACzC,WAAK,QAAQ,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,GAAG,SAAS,KAAK;AAClE,YAAM,iBAAiB,OAAO,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,KAAK,GAAG,YAAY;AACvF,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK,QAAQ,KAAK;AAAA,UACxB;AAAA,UACA,OAAO,KAAK;AAAA,UACZ,SAAS,KAAK;AAAA,UACd,SAAS,KAAK;AAAA,UACd,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\nexport function createGithubProvider(): Provider {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GithubToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        throw new OAuth2Error(\n          emailResponse.status,\n          'invalid_request',\n          'Failed to fetch user email'\n        );\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified || false;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport const github = createGithubProvider();\n\nexport interface GithubUserInfo {\n  login: string;\n  id: string;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\nexport interface GithubToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB,iCAAiC;AAE3D,SAAS,uBAAiC;AAC/C,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,cAAc,CAAC,YAAY;AAAA,IAC3B,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AACrD,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AACtF,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;AAAA,MACvF;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,YAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;AACnF,UAAI,CAAC,cAAc,IAAI;AACrB,cAAM,IAAI;AAAA,UACR,cAAc;AAAA,UACd;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,SAAU,MAAM,cAAc,KAAK;AACzC,WAAK,QAAQ,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,GAAG,SAAS,KAAK;AAClE,YAAM,iBAAiB,OAAO,KAAK,CAAC,UAAU,MAAM,UAAU,KAAK,KAAK,GAAG,YAAY;AACvF,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK,QAAQ,KAAK;AAAA,UACxB;AAAA,UACA,OAAO,KAAK;AAAA,UACZ,SAAS,KAAK;AAAA,UACd,SAAS,KAAK;AAAA,UACd,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,SAAS,qBAAqB;","names":[]}

package/dist/oauth2/provider/google.cjs

@@ -30,13 +30,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/oauth2/provider/google.ts
 var google_exports = {};
 __export(google_exports, {
+  createGoogleProvider: () => createGoogleProvider,
   google: () => google
 });
 module.exports = __toCommonJS(google_exports);
 var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
 var import_error = require("../error.cjs");
 var import_common = require("./common.cjs");
-function google() {
+function createGoogleProvider() {
   return {
     authorizationUri: "https://accounts.google.com/o/oauth2/v2/auth",
     tokenUri: "https://oauth2.googleapis.com/token",
@@ -81,11 +82,26 @@ function google() {
           locale: data.locale
         }
       };
+    },
+    async loginOAuth2Native({ pkce, credentials, ...params }) {
+      (0, import_tiny_invariant.default)(credentials.code, "code is required");
+      const { code } = credentials;
+      const { tokenUri } = this;
+      const response = await (0, import_common.exchangeAuthorizationCode)({ code, tokenUri, ...params });
+      if (!response.ok) {
+        const { error, error_description } = await response.json();
+        throw new import_error.OAuth2Error(response.status, error, error_description);
+      }
+      const token = await response.json();
+      const userInfo = await this.getUserInfo(token);
+      return { token, userInfo };
     }
   };
 }
+var google = createGoogleProvider();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  createGoogleProvider,
   google
 });
 //# sourceMappingURL=google.cjs.map

package/dist/oauth2/provider/google.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\nexport function google(): Provider<GoogleUserInfo> {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleOAuth2Token;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          picture: data.picture,\n          email: data.email,\n          email_verified: data.email_verified,\n          given_name: data.given_name,\n          family_name: data.family_name,\n          locale: data.locale,\n        },\n      };\n    },\n  };\n}\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n}\n\nexport interface GoogleOAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAE1E,SAAS,SAAmC;AACjD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,WAAW;AAAA;AAAA,IAEX,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,QAAQ;AAC7B,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA8B,UAAU,KAAK,SAAS;AACzE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,SAAS,KAAK;AAAA,UACd,OAAO,KAAK;AAAA,UACZ,gBAAgB,KAAK;AAAA,UACrB,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["invariant"]}
+{"version":3,"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\nexport function createGoogleProvider(): Provider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          picture: data.picture,\n          email: data.email,\n          email_verified: data.email_verified,\n          given_name: data.given_name,\n          family_name: data.family_name,\n          locale: data.locale,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport type GoogleAppCredentials = {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n};\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAE1E,SAAS,uBAAiC;AAC/C,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,WAAW;AAAA;AAAA,IAEX,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,QAAQ;AAC7B,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA8B,UAAU,KAAK,SAAS;AACzE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,SAAS,KAAK;AAAA,UACd,OAAO,KAAK;AAAA,UACZ,gBAAgB,KAAK;AAAA,UACrB,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,OAAO,GAA4B;AACjF,gCAAAA,SAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,WAAW,UAAM,yCAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,SAAS,qBAAqB;","names":["invariant"]}

package/dist/oauth2/provider/google.d.cts

@@ -1,6 +1,7 @@
-import { Provider } from '../types.cjs';
+import { Provider, OAuth2Token } from '../types.cjs';
 
-declare function google(): Provider<GoogleUserInfo>;
+declare function createGoogleProvider(): Provider;
+declare const google: Provider;
 interface GoogleUserInfo {
     aud: string;
     azp: string;
@@ -19,7 +20,7 @@ interface GoogleUserInfo {
     picture: string;
     sub: string;
 }
-interface GoogleOAuth2Token {
+interface GoogleToken extends OAuth2Token {
     access_token: string;
     token_type: string;
     expires_in: number;
@@ -27,9 +28,15 @@ interface GoogleOAuth2Token {
     id_token: string;
     scope: string;
 }
+type GoogleAppCredentials = {
+    state: string;
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+};
 interface GoogleErrorResponse {
     error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'access_denied' | 'server_error';
     error_description: string;
 }
 
-export { type GoogleErrorResponse, type GoogleOAuth2Token, type GoogleUserInfo, google };
+export { type GoogleAppCredentials, type GoogleErrorResponse, type GoogleToken, type GoogleUserInfo, createGoogleProvider, google };

package/dist/oauth2/provider/google.d.ts

@@ -1,6 +1,7 @@
-import { Provider } from '../types.js';
+import { Provider, OAuth2Token } from '../types.js';
 
-declare function google(): Provider<GoogleUserInfo>;
+declare function createGoogleProvider(): Provider;
+declare const google: Provider;
 interface GoogleUserInfo {
     aud: string;
     azp: string;
@@ -19,7 +20,7 @@ interface GoogleUserInfo {
     picture: string;
     sub: string;
 }
-interface GoogleOAuth2Token {
+interface GoogleToken extends OAuth2Token {
     access_token: string;
     token_type: string;
     expires_in: number;
@@ -27,9 +28,15 @@ interface GoogleOAuth2Token {
     id_token: string;
     scope: string;
 }
+type GoogleAppCredentials = {
+    state: string;
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+};
 interface GoogleErrorResponse {
     error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'access_denied' | 'server_error';
     error_description: string;
 }
 
-export { type GoogleErrorResponse, type GoogleOAuth2Token, type GoogleUserInfo, google };
+export { type GoogleAppCredentials, type GoogleErrorResponse, type GoogleToken, type GoogleUserInfo, createGoogleProvider, google };

package/dist/oauth2/provider/google.mjs

@@ -2,7 +2,7 @@
 import invariant from "tiny-invariant";
 import { OAuth2Error } from "../error.mjs";
 import { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from "./common.mjs";
-function google() {
+function createGoogleProvider() {
   return {
     authorizationUri: "https://accounts.google.com/o/oauth2/v2/auth",
     tokenUri: "https://oauth2.googleapis.com/token",
@@ -47,10 +47,25 @@ function google() {
           locale: data.locale
         }
       };
+    },
+    async loginOAuth2Native({ pkce, credentials, ...params }) {
+      invariant(credentials.code, "code is required");
+      const { code } = credentials;
+      const { tokenUri } = this;
+      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });
+      if (!response.ok) {
+        const { error, error_description } = await response.json();
+        throw new OAuth2Error(response.status, error, error_description);
+      }
+      const token = await response.json();
+      const userInfo = await this.getUserInfo(token);
+      return { token, userInfo };
     }
   };
 }
+var google = createGoogleProvider();
 export {
+  createGoogleProvider,
   google
 };
 //# sourceMappingURL=google.mjs.map

package/dist/oauth2/provider/google.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\nexport function google(): Provider<GoogleUserInfo> {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleOAuth2Token;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          picture: data.picture,\n          email: data.email,\n          email_verified: data.email_verified,\n          given_name: data.given_name,\n          family_name: data.family_name,\n          locale: data.locale,\n        },\n      };\n    },\n  };\n}\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n}\n\nexport interface GoogleOAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB,2BAA2B,qBAAqB;AAE1E,SAAS,SAAmC;AACjD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,WAAW;AAAA;AAAA,IAEX,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,QAAQ;AAC7B,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gBAAU,UAAU,sBAAsB;AAC1C,gBAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,MAAM,cAA8B,UAAU,KAAK,SAAS;AACzE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,SAAS,KAAK;AAAA,UACd,OAAO,KAAK;AAAA,UACZ,gBAAgB,KAAK;AAAA,UACrB,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\nexport function createGoogleProvider(): Provider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          picture: data.picture,\n          email: data.email,\n          email_verified: data.email_verified,\n          given_name: data.given_name,\n          family_name: data.family_name,\n          locale: data.locale,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport type GoogleAppCredentials = {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n};\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB,2BAA2B,qBAAqB;AAE1E,SAAS,uBAAiC;AAC/C,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,WAAW;AAAA;AAAA,IAEX,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,QAAQ;AAC7B,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gBAAU,UAAU,sBAAsB;AAC1C,gBAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,MAAM,cAA8B,UAAU,KAAK,SAAS;AACzE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,SAAS,KAAK;AAAA,UACd,OAAO,KAAK;AAAA,UACZ,gBAAgB,KAAK;AAAA,UACrB,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,OAAO,GAA4B;AACjF,gBAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,WAAW,MAAM,0BAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,SAAS,qBAAqB;","names":[]}

package/dist/oauth2/provider/x.cjs

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/oauth2/provider/x.ts
 var x_exports = {};
 __export(x_exports, {
+  createXProvider: () => createXProvider,
   x: () => x
 });
 module.exports = __toCommonJS(x_exports);
@@ -45,7 +46,7 @@ var defaultUserFields = [
   "location",
   "verified"
 ];
-function x(options) {
+function createXProvider(options) {
   return {
     authorizationUri: "https://x.com/i/oauth2/authorize",
     tokenUri: "https://api.x.com/2/oauth2/token",
@@ -54,7 +55,7 @@ function x(options) {
     userInfoUri: "https://api.x.com/2/users/me",
     defaultScope: ["users.read", "tweet.read", "offline.access"],
     createAuthorizationUri(params) {
-      if (!params.codeVerifier) throw new Error("codeVerifier is required for x");
+      if (!params.pkce) throw new Error("pkce is required for x");
       return (0, import_common.createAuthorizationUri)({
         ...params,
         scope: params.scope ?? this.defaultScope,
@@ -62,7 +63,7 @@ function x(options) {
       });
     },
     async exchangeAuthorizationCode(params) {
-      if (!params.codeVerifier) throw new Error("codeVerifier is required for x");
+      if (!params.pkce) throw new Error("pkce is required for x");
       const response = await (0, import_common.exchangeAuthorizationCode)({
         ...params,
         tokenUri: this.tokenUri,
@@ -106,7 +107,16 @@ function x(options) {
       };
     },
     async refreshAccessToken(params) {
-      return (0, import_common.refreshAccessToken)({ ...params, tokenUri: this.tokenUri, authentication: "basic" });
+      const response = await (0, import_common.refreshAccessToken)({
+        ...params,
+        tokenUri: this.tokenUri,
+        authentication: "basic"
+      });
+      if (!response.ok) {
+        const { error, error_description } = await response.json();
+        throw new import_error.OAuth2Error(response.status, error, error_description);
+      }
+      return await response.json();
     },
     async revokeToken(params) {
       (0, import_tiny_invariant.default)(this.tokenRevokeUri, "tokenRevokeUri is required");
@@ -118,8 +128,10 @@ function x(options) {
     }
   };
 }
+var x = createXProvider();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  createXProvider,
   x
 });
 //# sourceMappingURL=x.cjs.map

package/dist/oauth2/provider/x.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function x(options?: XOptions): Provider<XUserInfo> {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.codeVerifier) throw new Error('codeVerifier is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.codeVerifier) throw new Error('codeVerifier is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XOAuth2Token;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      return refreshAccessToken({ ...params, tokenUri: this.tokenUri, authentication: 'basic' });\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\ntype XOAuth2Token = {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n};\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAKO;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,EAAE,SAAyC;AACzD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,aAAc,OAAM,IAAI,MAAM,gCAAgC;AAC1E,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,aAAc,OAAM,IAAI,MAAM,gCAAgC;AAC1E,YAAM,WAAW,UAAM,yCAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gCAAAA,SAAU,cAAc,0BAA0B;AAClD,gCAAAA,SAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,iBAAO,kCAAmB,EAAE,GAAG,QAAQ,UAAU,KAAK,UAAU,gBAAgB,QAAQ,CAAC;AAAA,IAC3F;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gCAAAA,SAAU,KAAK,gBAAgB,4BAA4B;AAC3D,iBAAO,2BAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["invariant"]}
+{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAKO;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,SAA8B;AAC5D,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,YAAM,WAAW,UAAM,yCAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gCAAAA,SAAU,cAAc,0BAA0B;AAClD,gCAAAA,SAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,YAAM,WAAW,UAAM,kCAAmB;AAAA,QACxC,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gCAAAA,SAAU,KAAK,gBAAgB,4BAA4B;AAC3D,iBAAO,2BAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,IAAI,gBAAgB;","names":["invariant"]}

package/dist/oauth2/provider/x.d.cts

@@ -1,9 +1,10 @@
-import { Provider } from '../types.cjs';
+import { Provider, OAuth2Token } from '../types.cjs';
 
 interface XOptions {
     userFields?: UserField[];
 }
-declare function x(options?: XOptions): Provider<XUserInfo>;
+declare function createXProvider(options?: XOptions): Provider;
+declare const x: Provider;
 type UserField = 'affiliation' | 'connection_status' | 'created_at' | 'description' | 'entities' | 'id' | 'is_identity_verified' | 'location' | 'most_recent_tweet_id' | 'name' | 'parody' | 'pinned_tweet_id' | 'profile_banner_url' | 'profile_image_url' | 'protected' | 'public_metrics' | 'receives_your_dm' | 'subscription' | 'subscription_type' | 'url' | 'username' | 'verified' | 'verified_followers_count' | 'verified_type' | 'withheld';
 interface XUser {
     id: string;
@@ -56,5 +57,12 @@ type MentionEntity = {
     end: string;
     username: string;
 };
+interface XToken extends OAuth2Token {
+    token_type: string;
+    expires_in: number;
+    access_token: string;
+    scope: string;
+    refresh_token: string;
+}
 
-export { type XOptions, type XUser, type XUserInfo, x };
+export { type XOptions, type XToken, type XUser, type XUserInfo, createXProvider, x };

package/dist/oauth2/provider/x.d.ts

@@ -1,9 +1,10 @@
-import { Provider } from '../types.js';
+import { Provider, OAuth2Token } from '../types.js';
 
 interface XOptions {
     userFields?: UserField[];
 }
-declare function x(options?: XOptions): Provider<XUserInfo>;
+declare function createXProvider(options?: XOptions): Provider;
+declare const x: Provider;
 type UserField = 'affiliation' | 'connection_status' | 'created_at' | 'description' | 'entities' | 'id' | 'is_identity_verified' | 'location' | 'most_recent_tweet_id' | 'name' | 'parody' | 'pinned_tweet_id' | 'profile_banner_url' | 'profile_image_url' | 'protected' | 'public_metrics' | 'receives_your_dm' | 'subscription' | 'subscription_type' | 'url' | 'username' | 'verified' | 'verified_followers_count' | 'verified_type' | 'withheld';
 interface XUser {
     id: string;
@@ -56,5 +57,12 @@ type MentionEntity = {
     end: string;
     username: string;
 };
+interface XToken extends OAuth2Token {
+    token_type: string;
+    expires_in: number;
+    access_token: string;
+    scope: string;
+    refresh_token: string;
+}
 
-export { type XOptions, type XUser, type XUserInfo, x };
+export { type XOptions, type XToken, type XUser, type XUserInfo, createXProvider, x };

package/dist/oauth2/provider/x.mjs

@@ -16,7 +16,7 @@ var defaultUserFields = [
   "location",
   "verified"
 ];
-function x(options) {
+function createXProvider(options) {
   return {
     authorizationUri: "https://x.com/i/oauth2/authorize",
     tokenUri: "https://api.x.com/2/oauth2/token",
@@ -25,7 +25,7 @@ function x(options) {
     userInfoUri: "https://api.x.com/2/users/me",
     defaultScope: ["users.read", "tweet.read", "offline.access"],
     createAuthorizationUri(params) {
-      if (!params.codeVerifier) throw new Error("codeVerifier is required for x");
+      if (!params.pkce) throw new Error("pkce is required for x");
       return createAuthorizationUri({
         ...params,
         scope: params.scope ?? this.defaultScope,
@@ -33,7 +33,7 @@ function x(options) {
       });
     },
     async exchangeAuthorizationCode(params) {
-      if (!params.codeVerifier) throw new Error("codeVerifier is required for x");
+      if (!params.pkce) throw new Error("pkce is required for x");
       const response = await exchangeAuthorizationCode({
         ...params,
         tokenUri: this.tokenUri,
@@ -77,7 +77,16 @@ function x(options) {
       };
     },
     async refreshAccessToken(params) {
-      return refreshAccessToken({ ...params, tokenUri: this.tokenUri, authentication: "basic" });
+      const response = await refreshAccessToken({
+        ...params,
+        tokenUri: this.tokenUri,
+        authentication: "basic"
+      });
+      if (!response.ok) {
+        const { error, error_description } = await response.json();
+        throw new OAuth2Error(response.status, error, error_description);
+      }
+      return await response.json();
     },
     async revokeToken(params) {
       invariant(this.tokenRevokeUri, "tokenRevokeUri is required");
@@ -89,7 +98,9 @@ function x(options) {
     }
   };
 }
+var x = createXProvider();
 export {
+  createXProvider,
   x
 };
 //# sourceMappingURL=x.mjs.map

package/dist/oauth2/provider/x.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function x(options?: XOptions): Provider<XUserInfo> {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.codeVerifier) throw new Error('codeVerifier is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.codeVerifier) throw new Error('codeVerifier is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XOAuth2Token;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      return refreshAccessToken({ ...params, tokenUri: this.tokenUri, authentication: 'basic' });\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\ntype XOAuth2Token = {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n};\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,EAAE,SAAyC;AACzD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,aAAc,OAAM,IAAI,MAAM,gCAAgC;AAC1E,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,aAAc,OAAM,IAAI,MAAM,gCAAgC;AAC1E,YAAM,WAAW,MAAM,0BAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,aAAO,mBAAmB,EAAE,GAAG,QAAQ,UAAU,KAAK,UAAU,gBAAgB,QAAQ,CAAC;AAAA,IAC3F;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gBAAU,KAAK,gBAAgB,4BAA4B;AAC3D,aAAO,YAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,SAA8B;AAC5D,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,YAAM,WAAW,MAAM,0BAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,YAAM,WAAW,MAAM,mBAAmB;AAAA,QACxC,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gBAAU,KAAK,gBAAgB,4BAA4B;AAC3D,aAAO,YAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,IAAI,gBAAgB;","names":[]}

package/dist/oauth2/types.cjs

@@ -3,6 +3,10 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -15,5 +19,21 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 
 // src/oauth2/types.ts
 var types_exports = {};
+__export(types_exports, {
+  OidcScopes: () => OidcScopes
+});
 module.exports = __toCommonJS(types_exports);
+var OidcScopes = /* @__PURE__ */ ((OidcScopes2) => {
+  OidcScopes2["openid"] = "openid";
+  OidcScopes2["profile"] = "profile";
+  OidcScopes2["email"] = "email";
+  OidcScopes2["phone"] = "phone";
+  OidcScopes2["address"] = "address";
+  OidcScopes2["offline_access"] = "offline_access";
+  return OidcScopes2;
+})(OidcScopes || {});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OidcScopes
+});
 //# sourceMappingURL=types.cjs.map

package/dist/oauth2/types.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/types.ts"],"sourcesContent":["export interface OAuth2AuthorizationRequest {\n  state: string;\n  codeVerifier: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  codeVerifier?: string;\n}\n\nexport interface CodeExchangeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  codeVerifier?: string;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface OAuth2Token {\n  access_token?: string;\n  token_type?: 'Bearer' | 'bearer' | string;\n  expires_in?: number;\n  refresh_token?: string;\n  id_token?: string;\n  scope?: string;\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | string;\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T extends Record<string, any> = Record<string, any>> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider<T extends Record<string, any> = Record<string, any>> {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  tokenRevokeUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: CodeExchangeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo<T>>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration: { [name: string]: Registration | undefined };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
+{"version":3,"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredentials;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredentials = {\n  state: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport enum OidcScopes {\n  openid = 'openid',\n  profile = 'profile',\n  email = 'email',\n  phone = 'phone',\n  address = 'address',\n  offline_access = 'offline_access',\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | string;\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  tokenRevokeUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration: { [name: string]: Registration | undefined };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAuGO,IAAK,aAAL,kBAAKA,gBAAL;AACL,EAAAA,YAAA,YAAS;AACT,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,oBAAiB;AANP,SAAAA;AAAA,GAAA;","names":["OidcScopes"]}