@shware/security 1.3.1 → 1.3.3

package/dist/auth/types.d.ts

@@ -1,16 +1,11 @@
 import { Principal } from '../core/index.js';
-import { UserInfo, OAuth2Token, OAuth2ClientConfig, PkceParameters } from '../oauth2/types.js';
+import { UserInfo, OAuth2Token, OAuth2ClientConfig } from '../oauth2/types.js';
 import { Session, KVRepository, SessionRepository } from '../session/types.js';
 import { CookieOptions } from '../utils/http.js';
 import 'cookie';
 
 type LoggedHandler = (principal: Principal) => Promise<void>;
 type OAuth2AuthorizedHandler = (request: Request, registrationId: string, userInfo: UserInfo, token: OAuth2Token) => Promise<Principal>;
-interface OAuth2State extends PkceParameters {
-    state: string;
-    nonce: string;
-    registrationId: string;
-}
 interface AuthConfig {
     timing?: boolean;
     kvRepository: KVRepository;
@@ -26,9 +21,11 @@ interface AuthService {
     logout: (request: Request) => Promise<Response>;
     logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
     oauth2State: (request: Request) => Promise<Response>;
+    oauth2Nonce: (request: Request) => Promise<Response>;
     oauth2Authorization: (request: Request) => Promise<Response>;
     loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
     loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
+    loginOAuth2Onetap: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
     kick: (principal: Principal) => Promise<void>;
     isAuthenticated: (request: Request) => Promise<boolean>;
     getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
@@ -37,4 +34,4 @@ interface AuthService {
     cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 
-export type { AuthConfig, AuthService, LoggedHandler, OAuth2AuthorizedHandler, OAuth2State };
+export type { AuthConfig, AuthService, LoggedHandler, OAuth2AuthorizedHandler };

package/dist/index.d.cts

@@ -7,7 +7,7 @@ export { Principal } from './core/index.cjs';
 export { KVRepository, Namespace, Session, SessionRepository } from './session/types.cjs';
 export { OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from './oauth2/types.cjs';
 export { AuthConfig, AuthService } from './auth/types.cjs';
-import 'zod';
+import 'zod/v4';
 import './session/map-session.cjs';
 import 'ioredis';
 import './utils/http.cjs';

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export { Principal } from './core/index.js';
 export { KVRepository, Namespace, Session, SessionRepository } from './session/types.js';
 export { OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from './oauth2/types.js';
 export { AuthConfig, AuthService } from './auth/types.js';
-import 'zod';
+import 'zod/v4';
 import './session/map-session.js';
 import 'ioredis';
 import './utils/http.js';

package/dist/oauth2/client.cjs

@@ -34,14 +34,14 @@ __export(client_exports, {
   oauth2RedirectQuerySchema: () => oauth2RedirectQuerySchema
 });
 module.exports = __toCommonJS(client_exports);
-var import_zod = require("zod");
+var import_v4 = require("zod/v4");
 var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
-var oauth2RedirectQuerySchema = import_zod.z.object({
-  code: import_zod.z.string().optional(),
-  state: import_zod.z.string().optional(),
-  error: import_zod.z.string().optional(),
-  error_description: import_zod.z.string().optional(),
-  error_uri: import_zod.z.string().optional()
+var oauth2RedirectQuerySchema = import_v4.z.object({
+  code: import_v4.z.string().optional(),
+  state: import_v4.z.string().optional(),
+  error: import_v4.z.string().optional(),
+  error_description: import_v4.z.string().optional(),
+  error_uri: import_v4.z.string().optional()
 });
 var OAuth2Client = class {
   config;

package/dist/oauth2/client.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod';\nimport invariant from 'tiny-invariant';\nimport {\n  NativeCredentials,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string().optional(),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredentials;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAkB;AAClB,4BAAsB;AASf,IAAM,4BAA4B,aAAE,OAAO;AAAA,EAChD,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,aAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,8BAAAA,SAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,8BAAAA,SAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIQ;AACN,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAGG;AACD,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,EACF,GAGyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,8BAAAA,SAAU,SAAS,mBAAmB,6CAA6C;AACnF,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAEhD,WAAO,SAAS,kBAAkB;AAAA,MAChC;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,MAC1E;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":["invariant"]}
+{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport invariant from 'tiny-invariant';\nimport {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string().optional(),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAAkB;AAClB,4BAAsB;AASf,IAAM,4BAA4B,YAAE,OAAO;AAAA,EAChD,MAAM,YAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,YAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,YAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,YAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,YAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,8BAAAA,SAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,8BAAAA,SAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIQ;AACN,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAGG;AACD,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,EACF,GAGyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,8BAAAA,SAAU,SAAS,mBAAmB,6CAA6C;AACnF,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAEhD,WAAO,SAAS,kBAAkB;AAAA,MAChC;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,MAC1E;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":["invariant"]}

package/dist/oauth2/client.d.cts

@@ -1,5 +1,5 @@
-import { OAuth2ClientConfig, Registration, Provider, PkceParameters, OAuth2Token, OidcToken, UserInfo, NativeCredentials } from './types.cjs';
-import { z } from 'zod';
+import { OAuth2ClientConfig, Registration, Provider, PkceParameters, OAuth2Token, OidcToken, UserInfo, NativeCredential } from './types.cjs';
+import { z } from 'zod/v4';
 
 declare const oauth2RedirectQuerySchema: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
@@ -7,19 +7,7 @@ declare const oauth2RedirectQuerySchema: z.ZodObject<{
     error: z.ZodOptional<z.ZodString>;
     error_description: z.ZodOptional<z.ZodString>;
     error_uri: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    code?: string | undefined;
-    state?: string | undefined;
-    error?: string | undefined;
-    error_description?: string | undefined;
-    error_uri?: string | undefined;
-}, {
-    code?: string | undefined;
-    state?: string | undefined;
-    error?: string | undefined;
-    error_description?: string | undefined;
-    error_uri?: string | undefined;
-}>;
+}, z.core.$strip>;
 declare class OAuth2Client {
     private config;
     constructor(config: OAuth2ClientConfig);
@@ -51,7 +39,7 @@ declare class OAuth2Client {
     revokeToken(registrationId: string, token: string): Promise<void>;
     loginOAuth2Native({ registrationId, credentials, pkce, }: {
         registrationId: string;
-        credentials: NativeCredentials;
+        credentials: NativeCredential;
         pkce?: PkceParameters;
     }): Promise<{
         token: OAuth2Token;

package/dist/oauth2/client.d.ts

@@ -1,5 +1,5 @@
-import { OAuth2ClientConfig, Registration, Provider, PkceParameters, OAuth2Token, OidcToken, UserInfo, NativeCredentials } from './types.js';
-import { z } from 'zod';
+import { OAuth2ClientConfig, Registration, Provider, PkceParameters, OAuth2Token, OidcToken, UserInfo, NativeCredential } from './types.js';
+import { z } from 'zod/v4';
 
 declare const oauth2RedirectQuerySchema: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
@@ -7,19 +7,7 @@ declare const oauth2RedirectQuerySchema: z.ZodObject<{
     error: z.ZodOptional<z.ZodString>;
     error_description: z.ZodOptional<z.ZodString>;
     error_uri: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    code?: string | undefined;
-    state?: string | undefined;
-    error?: string | undefined;
-    error_description?: string | undefined;
-    error_uri?: string | undefined;
-}, {
-    code?: string | undefined;
-    state?: string | undefined;
-    error?: string | undefined;
-    error_description?: string | undefined;
-    error_uri?: string | undefined;
-}>;
+}, z.core.$strip>;
 declare class OAuth2Client {
     private config;
     constructor(config: OAuth2ClientConfig);
@@ -51,7 +39,7 @@ declare class OAuth2Client {
     revokeToken(registrationId: string, token: string): Promise<void>;
     loginOAuth2Native({ registrationId, credentials, pkce, }: {
         registrationId: string;
-        credentials: NativeCredentials;
+        credentials: NativeCredential;
         pkce?: PkceParameters;
     }): Promise<{
         token: OAuth2Token;

package/dist/oauth2/client.mjs

@@ -1,5 +1,5 @@
 // src/oauth2/client.ts
-import { z } from "zod";
+import { z } from "zod/v4";
 import invariant from "tiny-invariant";
 var oauth2RedirectQuerySchema = z.object({
   code: z.string().optional(),

package/dist/oauth2/client.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod';\nimport invariant from 'tiny-invariant';\nimport {\n  NativeCredentials,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string().optional(),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredentials;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAClB,OAAO,eAAe;AASf,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,cAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,cAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIQ;AACN,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAGG;AACD,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,EACF,GAGyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,cAAU,SAAS,mBAAmB,6CAA6C;AACnF,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAEhD,WAAO,SAAS,kBAAkB;AAAA,MAChC;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,MAC1E;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}
+{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport invariant from 'tiny-invariant';\nimport {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string().optional(),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAClB,OAAO,eAAe;AASf,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,cAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,cAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIQ;AACN,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAGG;AACD,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,EACF,GAGyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,cAAU,SAAS,mBAAmB,6CAA6C;AACnF,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAEhD,WAAO,SAAS,kBAAkB;AAAA,MAChC;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,MAC1E;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/oauth2/provider/apple.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { NativeCredentials, LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredentials extends NativeCredentials {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAG1E,SAAS,sBAAgC;AAC9C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,OAAO,GAA4B;AACjF,gCAAAA,SAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,WAAW,UAAM,yCAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,oBAAoB;","names":["invariant"]}
+{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { NativeCredential, LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAG1E,SAAS,sBAAgC;AAC9C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,OAAO,GAA4B;AACjF,gCAAAA,SAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,WAAW,UAAM,yCAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,oBAAoB;","names":["invariant"]}

package/dist/oauth2/provider/apple.d.cts

@@ -1,4 +1,4 @@
-import { Provider, OAuth2Token, NativeCredentials } from '../types.cjs';
+import { Provider, OAuth2Token, NativeCredential } from '../types.cjs';
 
 declare function createAppleProvider(): Provider;
 declare const apple: Provider;
@@ -17,6 +17,8 @@ interface AppleUserInfo {
         };
         email: string;
     };
+    nonce?: string;
+    nonce_supported?: boolean;
 }
 interface AppleToken extends OAuth2Token {
     access_token: string;
@@ -25,7 +27,7 @@ interface AppleToken extends OAuth2Token {
     refresh_token: string;
     id_token: string;
 }
-interface AppleNativeCredentials extends NativeCredentials {
+interface AppleNativeCredential extends NativeCredential {
     state: string;
     code: string;
     id_token: string;
@@ -36,4 +38,4 @@ interface AppleErrorResponse {
     error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
 }
 
-export { type AppleErrorResponse, type AppleNativeCredentials, type AppleToken, type AppleUserInfo, apple, createAppleProvider };
+export { type AppleErrorResponse, type AppleNativeCredential, type AppleToken, type AppleUserInfo, apple, createAppleProvider };

package/dist/oauth2/provider/apple.d.ts

@@ -1,4 +1,4 @@
-import { Provider, OAuth2Token, NativeCredentials } from '../types.js';
+import { Provider, OAuth2Token, NativeCredential } from '../types.js';
 
 declare function createAppleProvider(): Provider;
 declare const apple: Provider;
@@ -17,6 +17,8 @@ interface AppleUserInfo {
         };
         email: string;
     };
+    nonce?: string;
+    nonce_supported?: boolean;
 }
 interface AppleToken extends OAuth2Token {
     access_token: string;
@@ -25,7 +27,7 @@ interface AppleToken extends OAuth2Token {
     refresh_token: string;
     id_token: string;
 }
-interface AppleNativeCredentials extends NativeCredentials {
+interface AppleNativeCredential extends NativeCredential {
     state: string;
     code: string;
     id_token: string;
@@ -36,4 +38,4 @@ interface AppleErrorResponse {
     error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
 }
 
-export { type AppleErrorResponse, type AppleNativeCredentials, type AppleToken, type AppleUserInfo, apple, createAppleProvider };
+export { type AppleErrorResponse, type AppleNativeCredential, type AppleToken, type AppleUserInfo, apple, createAppleProvider };

package/dist/oauth2/provider/apple.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { NativeCredentials, LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredentials extends NativeCredentials {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB,2BAA2B,qBAAqB;AAG1E,SAAS,sBAAgC;AAC9C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gBAAU,UAAU,sBAAsB;AAC1C,gBAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,MAAM,cAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,OAAO,GAA4B;AACjF,gBAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,WAAW,MAAM,0BAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,oBAAoB;","names":[]}
+{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { NativeCredential, LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB,2BAA2B,qBAAqB;AAG1E,SAAS,sBAAgC;AAC9C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gBAAU,UAAU,sBAAsB;AAC1C,gBAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,MAAM,cAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,OAAO,GAA4B;AACjF,gBAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,WAAW,MAAM,0BAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,oBAAoB;","names":[]}

package/dist/oauth2/provider/facebook.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, this.jwkSetUri);\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: true,\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const url = new URL(this.userInfoUri);\n      const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n      url.searchParams.append('access_token', access_token);\n      url.searchParams.append('fields', fields.join(','));\n      const headers = { Accept: 'application/json' };\n      const response = await fetch(url.href, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as FacebookUserInfo;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name,\n          email: data.email,\n          picture: data.picture.data.url,\n          email_verified: data.email_verified,\n        },\n      };\n    },\n    async loginOAuth2Native({ credentials }: LoginOAuth2NativeParams) {\n      if (credentials.id_token || credentials.access_token) {\n        const userInfo = await this.getUserInfo(credentials as unknown as OAuth2Token);\n        const token: OAuth2Token = {\n          token_type: 'bearer',\n          access_token: credentials.access_token ?? '',\n          id_token: credentials.id_token,\n        };\n        return { token, userInfo };\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredentials =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAM1E,SAAS,yBAAmC;AACjD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,WAAW,OAAO;AAAA,IACjC,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;AAAA,MACzE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,UAAU,aAAa,GAAG;AAC5C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,UAAI,UAAU;AACZ,cAAMC,QAAO,UAAM,6BAAsC,UAAU,KAAK,SAAS;AACjF,eAAO;AAAA,UACL,MAAAA;AAAA,UACA,QAAQ;AAAA,YACN,KAAKA,MAAK;AAAA,YACV,MAAMA,MAAK;AAAA,YACX,SAASA,MAAK;AAAA,YACd,OAAOA,MAAK;AAAA,YACZ,gBAAgB;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AACA,gCAAAD,SAAU,cAAc,0BAA0B;AAClD,gCAAAA,SAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,YAAM,SAAS,CAAC,MAAM,QAAQ,SAAS,gCAAgC;AACvE,UAAI,aAAa,OAAO,gBAAgB,YAAY;AACpD,UAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;AAClD,YAAM,UAAU,EAAE,QAAQ,mBAAmB;AAC7C,YAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,QAAQ,CAAC;AAClD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,yBAAY,SAAS,QAAQ,mBAAmB,2BAA2B;AAAA,MACvF;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,SAAS,KAAK,QAAQ,KAAK;AAAA,UAC3B,gBAAgB,KAAK;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,YAAY,GAA4B;AAChE,UAAI,YAAY,YAAY,YAAY,cAAc;AACpD,cAAM,WAAW,MAAM,KAAK,YAAY,WAAqC;AAC7E,cAAM,QAAqB;AAAA,UACzB,YAAY;AAAA,UACZ,cAAc,YAAY,gBAAgB;AAAA,UAC1C,UAAU,YAAY;AAAA,QACxB;AACA,eAAO,EAAE,OAAO,SAAS;AAAA,MAC3B,OAAO;AACL,cAAM,IAAI,yBAAY,KAAK,mBAAmB,sCAAsC;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,WAAW,uBAAuB;","names":["invariant","data"]}
+{"version":3,"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, this.jwkSetUri);\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: true,\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const url = new URL(this.userInfoUri);\n      const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n      url.searchParams.append('access_token', access_token);\n      url.searchParams.append('fields', fields.join(','));\n      const headers = { Accept: 'application/json' };\n      const response = await fetch(url.href, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as FacebookUserInfo;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name,\n          email: data.email,\n          picture: data.picture.data.url,\n          email_verified: data.email_verified,\n        },\n      };\n    },\n    async loginOAuth2Native({ credentials }: LoginOAuth2NativeParams) {\n      if (credentials.id_token || credentials.access_token) {\n        const userInfo = await this.getUserInfo(credentials as unknown as OAuth2Token);\n        const token: OAuth2Token = {\n          token_type: 'bearer',\n          access_token: credentials.access_token ?? '',\n          id_token: credentials.id_token,\n        };\n        return { token, userInfo };\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n  nonce?: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredential =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAM1E,SAAS,yBAAmC;AACjD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,WAAW,OAAO;AAAA,IACjC,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;AAAA,MACzE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,UAAU,aAAa,GAAG;AAC5C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,UAAI,UAAU;AACZ,cAAMC,QAAO,UAAM,6BAAsC,UAAU,KAAK,SAAS;AACjF,eAAO;AAAA,UACL,MAAAA;AAAA,UACA,QAAQ;AAAA,YACN,KAAKA,MAAK;AAAA,YACV,MAAMA,MAAK;AAAA,YACX,SAASA,MAAK;AAAA,YACd,OAAOA,MAAK;AAAA,YACZ,gBAAgB;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AACA,gCAAAD,SAAU,cAAc,0BAA0B;AAClD,gCAAAA,SAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,YAAM,SAAS,CAAC,MAAM,QAAQ,SAAS,gCAAgC;AACvE,UAAI,aAAa,OAAO,gBAAgB,YAAY;AACpD,UAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;AAClD,YAAM,UAAU,EAAE,QAAQ,mBAAmB;AAC7C,YAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,QAAQ,CAAC;AAClD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,yBAAY,SAAS,QAAQ,mBAAmB,2BAA2B;AAAA,MACvF;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,SAAS,KAAK,QAAQ,KAAK;AAAA,UAC3B,gBAAgB,KAAK;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,YAAY,GAA4B;AAChE,UAAI,YAAY,YAAY,YAAY,cAAc;AACpD,cAAM,WAAW,MAAM,KAAK,YAAY,WAAqC;AAC7E,cAAM,QAAqB;AAAA,UACzB,YAAY;AAAA,UACZ,cAAc,YAAY,gBAAgB;AAAA,UAC1C,UAAU,YAAY;AAAA,QACxB;AACA,eAAO,EAAE,OAAO,SAAS;AAAA,MAC3B,OAAO;AACL,cAAM,IAAI,yBAAY,KAAK,mBAAmB,sCAAsC;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,WAAW,uBAAuB;","names":["invariant","data"]}

package/dist/oauth2/provider/facebook.d.cts

@@ -11,6 +11,7 @@ interface FacebookDecodedIdToken {
     name: string;
     email: string;
     picture: string;
+    nonce?: string;
 }
 interface FacebookUserInfo {
     id: string;
@@ -32,7 +33,7 @@ interface FacebookToken extends OAuth2Token {
     expires_in: number;
     id_token?: string;
 }
-type FacebookAppCredentials = {
+type FacebookAppCredential = {
     state: string;
     id_token: string;
 } | {
@@ -40,4 +41,4 @@ type FacebookAppCredentials = {
     access_token: string;
 };
 
-export { type FacebookAppCredentials, type FacebookDecodedIdToken, type FacebookToken, type FacebookUserInfo, createFacebookProvider, facebook };
+export { type FacebookAppCredential, type FacebookDecodedIdToken, type FacebookToken, type FacebookUserInfo, createFacebookProvider, facebook };

package/dist/oauth2/provider/facebook.d.ts

@@ -11,6 +11,7 @@ interface FacebookDecodedIdToken {
     name: string;
     email: string;
     picture: string;
+    nonce?: string;
 }
 interface FacebookUserInfo {
     id: string;
@@ -32,7 +33,7 @@ interface FacebookToken extends OAuth2Token {
     expires_in: number;
     id_token?: string;
 }
-type FacebookAppCredentials = {
+type FacebookAppCredential = {
     state: string;
     id_token: string;
 } | {
@@ -40,4 +41,4 @@ type FacebookAppCredentials = {
     access_token: string;
 };
 
-export { type FacebookAppCredentials, type FacebookDecodedIdToken, type FacebookToken, type FacebookUserInfo, createFacebookProvider, facebook };
+export { type FacebookAppCredential, type FacebookDecodedIdToken, type FacebookToken, type FacebookUserInfo, createFacebookProvider, facebook };

package/dist/oauth2/provider/facebook.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, this.jwkSetUri);\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: true,\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const url = new URL(this.userInfoUri);\n      const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n      url.searchParams.append('access_token', access_token);\n      url.searchParams.append('fields', fields.join(','));\n      const headers = { Accept: 'application/json' };\n      const response = await fetch(url.href, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as FacebookUserInfo;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name,\n          email: data.email,\n          picture: data.picture.data.url,\n          email_verified: data.email_verified,\n        },\n      };\n    },\n    async loginOAuth2Native({ credentials }: LoginOAuth2NativeParams) {\n      if (credentials.id_token || credentials.access_token) {\n        const userInfo = await this.getUserInfo(credentials as unknown as OAuth2Token);\n        const token: OAuth2Token = {\n          token_type: 'bearer',\n          access_token: credentials.access_token ?? '',\n          id_token: credentials.id_token,\n        };\n        return { token, userInfo };\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredentials =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB,2BAA2B,qBAAqB;AAM1E,SAAS,yBAAmC;AACjD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,WAAW,OAAO;AAAA,IACjC,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;AAAA,MACzE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,UAAU,aAAa,GAAG;AAC5C,gBAAU,KAAK,WAAW,uBAAuB;AACjD,UAAI,UAAU;AACZ,cAAMA,QAAO,MAAM,cAAsC,UAAU,KAAK,SAAS;AACjF,eAAO;AAAA,UACL,MAAAA;AAAA,UACA,QAAQ;AAAA,YACN,KAAKA,MAAK;AAAA,YACV,MAAMA,MAAK;AAAA,YACX,SAASA,MAAK;AAAA,YACd,OAAOA,MAAK;AAAA,YACZ,gBAAgB;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AACA,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,YAAM,SAAS,CAAC,MAAM,QAAQ,SAAS,gCAAgC;AACvE,UAAI,aAAa,OAAO,gBAAgB,YAAY;AACpD,UAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;AAClD,YAAM,UAAU,EAAE,QAAQ,mBAAmB;AAC7C,YAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,QAAQ,CAAC;AAClD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;AAAA,MACvF;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,SAAS,KAAK,QAAQ,KAAK;AAAA,UAC3B,gBAAgB,KAAK;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,YAAY,GAA4B;AAChE,UAAI,YAAY,YAAY,YAAY,cAAc;AACpD,cAAM,WAAW,MAAM,KAAK,YAAY,WAAqC;AAC7E,cAAM,QAAqB;AAAA,UACzB,YAAY;AAAA,UACZ,cAAc,YAAY,gBAAgB;AAAA,UAC1C,UAAU,YAAY;AAAA,QACxB;AACA,eAAO,EAAE,OAAO,SAAS;AAAA,MAC3B,OAAO;AACL,cAAM,IAAI,YAAY,KAAK,mBAAmB,sCAAsC;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,WAAW,uBAAuB;","names":["data"]}
+{"version":3,"sources":["../../../src/oauth2/provider/facebook.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/**\n * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/\n * ref: https://developers.facebook.com/tools/explorer\n * */\nexport function createFacebookProvider(): Provider {\n  return {\n    authorizationUri: 'https://www.facebook.com/v21.0/dialog/oauth',\n    tokenUri: 'https://graph.facebook.com/v19.0/oauth/access_token',\n    userInfoUri: 'https://graph.facebook.com/me',\n    jwkSetUri: 'https://limited.facebook.com/.well-known/oauth/openid/jwks/',\n    userNameAttribute: 'id',\n    defaultScope: ['profile', 'email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as FacebookErrorResponse;\n        throw new OAuth2Error(response.status, 'invalid_request', error.message);\n      }\n      return (await response.json()) as FacebookToken;\n    },\n    async getUserInfo({ id_token, access_token }) {\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      if (id_token) {\n        const data = await verifyIdToken<FacebookDecodedIdToken>(id_token, this.jwkSetUri);\n        return {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: true,\n          },\n        };\n      }\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const url = new URL(this.userInfoUri);\n      const fields = ['id', 'name', 'email', 'picture.width(320).height(320)'];\n      url.searchParams.append('access_token', access_token);\n      url.searchParams.append('fields', fields.join(','));\n      const headers = { Accept: 'application/json' };\n      const response = await fetch(url.href, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as FacebookUserInfo;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name,\n          email: data.email,\n          picture: data.picture.data.url,\n          email_verified: data.email_verified,\n        },\n      };\n    },\n    async loginOAuth2Native({ credentials }: LoginOAuth2NativeParams) {\n      if (credentials.id_token || credentials.access_token) {\n        const userInfo = await this.getUserInfo(credentials as unknown as OAuth2Token);\n        const token: OAuth2Token = {\n          token_type: 'bearer',\n          access_token: credentials.access_token ?? '',\n          id_token: credentials.id_token,\n        };\n        return { token, userInfo };\n      } else {\n        throw new OAuth2Error(400, 'invalid_request', 'id_token or access_token is required');\n      }\n    },\n  };\n}\n\nexport const facebook = createFacebookProvider();\n\nexport interface FacebookDecodedIdToken {\n  sub: string;\n  name: string;\n  email: string;\n  picture: string;\n  nonce?: string;\n}\n\nexport interface FacebookUserInfo {\n  id: string;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  picture: {\n    data: {\n      url: string;\n      width: number;\n      height: number;\n      is_silhouette: boolean;\n    };\n  };\n}\n\nexport interface FacebookToken extends OAuth2Token {\n  access_token: string;\n  token_type: 'bearer';\n  expires_in: number;\n  id_token?: string;\n}\n\nexport type FacebookAppCredential =\n  | { state: string; id_token: string } // platform=ios and tracking=limited\n  | { state: string; access_token: string }; // tracking=enabled\n\ninterface FacebookErrorResponse {\n  error: {\n    message: string;\n    type: 'OAuthException';\n    code: number;\n    error_subcode: number;\n    fbtrace_id: string;\n  };\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB,2BAA2B,qBAAqB;AAM1E,SAAS,yBAAmC;AACjD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,WAAW,OAAO;AAAA,IACjC,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,MAAM,OAAO;AAAA,MACzE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,UAAU,aAAa,GAAG;AAC5C,gBAAU,KAAK,WAAW,uBAAuB;AACjD,UAAI,UAAU;AACZ,cAAMA,QAAO,MAAM,cAAsC,UAAU,KAAK,SAAS;AACjF,eAAO;AAAA,UACL,MAAAA;AAAA,UACA,QAAQ;AAAA,YACN,KAAKA,MAAK;AAAA,YACV,MAAMA,MAAK;AAAA,YACX,SAASA,MAAK;AAAA,YACd,OAAOA,MAAK;AAAA,YACZ,gBAAgB;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AACA,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,YAAM,SAAS,CAAC,MAAM,QAAQ,SAAS,gCAAgC;AACvE,UAAI,aAAa,OAAO,gBAAgB,YAAY;AACpD,UAAI,aAAa,OAAO,UAAU,OAAO,KAAK,GAAG,CAAC;AAClD,YAAM,UAAU,EAAE,QAAQ,mBAAmB;AAC7C,YAAM,WAAW,MAAM,MAAM,IAAI,MAAM,EAAE,QAAQ,CAAC;AAClD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;AAAA,MACvF;AACA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,SAAS,KAAK,QAAQ,KAAK;AAAA,UAC3B,gBAAgB,KAAK;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,YAAY,GAA4B;AAChE,UAAI,YAAY,YAAY,YAAY,cAAc;AACpD,cAAM,WAAW,MAAM,KAAK,YAAY,WAAqC;AAC7E,cAAM,QAAqB;AAAA,UACzB,YAAY;AAAA,UACZ,cAAc,YAAY,gBAAgB;AAAA,UAC1C,UAAU,YAAY;AAAA,QACxB;AACA,eAAO,EAAE,OAAO,SAAS;AAAA,MAC3B,OAAO;AACL,cAAM,IAAI,YAAY,KAAK,mBAAmB,sCAAsC;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,WAAW,uBAAuB;","names":["data"]}

package/dist/oauth2/provider/google.cjs

@@ -95,6 +95,34 @@ function createGoogleProvider() {
       const token = await response.json();
       const userInfo = await this.getUserInfo(token);
       return { token, userInfo };
+    },
+    async getTokenInfo(id_token) {
+      (0, import_tiny_invariant.default)(id_token, "id_token is required");
+      (0, import_tiny_invariant.default)(this.jwkSetUri, "jwkSetUri is required");
+      const data = await (0, import_common.verifyIdToken)(id_token, this.jwkSetUri);
+      return {
+        token: {
+          id_token,
+          access_token: "",
+          token_type: "",
+          expires_in: 0,
+          refresh_token: "",
+          scope: ""
+        },
+        userInfo: {
+          data,
+          claims: {
+            sub: data.sub,
+            name: data.name,
+            picture: data.picture,
+            email: data.email,
+            email_verified: data.email_verified,
+            given_name: data.given_name,
+            family_name: data.family_name,
+            locale: data.locale
+          }
+        }
+      };
     }
   };
 }

package/dist/oauth2/provider/google.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\nexport function createGoogleProvider(): Provider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          picture: data.picture,\n          email: data.email,\n          email_verified: data.email_verified,\n          given_name: data.given_name,\n          family_name: data.family_name,\n          locale: data.locale,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport type GoogleAppCredentials = {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n};\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAE1E,SAAS,uBAAiC;AAC/C,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,WAAW;AAAA;AAAA,IAEX,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,QAAQ;AAC7B,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA8B,UAAU,KAAK,SAAS;AACzE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,SAAS,KAAK;AAAA,UACd,OAAO,KAAK;AAAA,UACZ,gBAAgB,KAAK;AAAA,UACrB,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,OAAO,GAA4B;AACjF,gCAAAA,SAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,WAAW,UAAM,yCAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,SAAS,qBAAqB;","names":["invariant"]}
+{"version":3,"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { LoginOAuth2NativeParams, NativeCredential, OAuth2Token, OneTapProvider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          picture: data.picture,\n          email: data.email,\n          email_verified: data.email_verified,\n          given_name: data.given_name,\n          family_name: data.family_name,\n          locale: data.locale,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: {\n          data,\n          claims: {\n            sub: data.sub,\n            name: data.name,\n            picture: data.picture,\n            email: data.email,\n            email_verified: data.email_verified,\n            given_name: data.given_name,\n            family_name: data.family_name,\n            locale: data.locale,\n          },\n        },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAE1E,SAAS,uBAAuC;AACrD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,WAAW;AAAA;AAAA,IAEX,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,QAAQ;AAC7B,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA8B,UAAU,KAAK,SAAS;AACzE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,SAAS,KAAK;AAAA,UACd,OAAO,KAAK;AAAA,UACZ,gBAAgB,KAAK;AAAA,UACrB,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,OAAO,GAA4B;AACjF,gCAAAA,SAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,WAAW,UAAM,yCAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,IACA,MAAM,aAAa,UAAkB;AACnC,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA8B,UAAU,KAAK,SAAS;AACzE,aAAO;AAAA,QACL,OAAO;AAAA,UACL;AAAA,UACA,cAAc;AAAA,UACd,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,eAAe;AAAA,UACf,OAAO;AAAA,QACT;AAAA,QACA,UAAU;AAAA,UACR;AAAA,UACA,QAAQ;AAAA,YACN,KAAK,KAAK;AAAA,YACV,MAAM,KAAK;AAAA,YACX,SAAS,KAAK;AAAA,YACd,OAAO,KAAK;AAAA,YACZ,gBAAgB,KAAK;AAAA,YACrB,YAAY,KAAK;AAAA,YACjB,aAAa,KAAK;AAAA,YAClB,QAAQ,KAAK;AAAA,UACf;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,SAAS,qBAAqB;","names":["invariant"]}

package/dist/oauth2/provider/google.d.cts

@@ -1,7 +1,7 @@
-import { Provider, OAuth2Token } from '../types.cjs';
+import { OneTapProvider, OAuth2Token, NativeCredential } from '../types.cjs';
 
-declare function createGoogleProvider(): Provider;
-declare const google: Provider;
+declare function createGoogleProvider(): OneTapProvider;
+declare const google: OneTapProvider;
 interface GoogleUserInfo {
     aud: string;
     azp: string;
@@ -19,6 +19,7 @@ interface GoogleUserInfo {
     nbf?: number;
     picture: string;
     sub: string;
+    nonce?: string;
 }
 interface GoogleToken extends OAuth2Token {
     access_token: string;
@@ -28,15 +29,15 @@ interface GoogleToken extends OAuth2Token {
     id_token: string;
     scope: string;
 }
-type GoogleAppCredentials = {
+interface GoogleAppCredential extends NativeCredential {
     state: string;
     code: string;
     client_id: string;
     redirect_uri: string;
-};
+}
 interface GoogleErrorResponse {
     error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'access_denied' | 'server_error';
     error_description: string;
 }
 
-export { type GoogleAppCredentials, type GoogleErrorResponse, type GoogleToken, type GoogleUserInfo, createGoogleProvider, google };
+export { type GoogleAppCredential, type GoogleErrorResponse, type GoogleToken, type GoogleUserInfo, createGoogleProvider, google };

package/dist/oauth2/provider/google.d.ts

@@ -1,7 +1,7 @@
-import { Provider, OAuth2Token } from '../types.js';
+import { OneTapProvider, OAuth2Token, NativeCredential } from '../types.js';
 
-declare function createGoogleProvider(): Provider;
-declare const google: Provider;
+declare function createGoogleProvider(): OneTapProvider;
+declare const google: OneTapProvider;
 interface GoogleUserInfo {
     aud: string;
     azp: string;
@@ -19,6 +19,7 @@ interface GoogleUserInfo {
     nbf?: number;
     picture: string;
     sub: string;
+    nonce?: string;
 }
 interface GoogleToken extends OAuth2Token {
     access_token: string;
@@ -28,15 +29,15 @@ interface GoogleToken extends OAuth2Token {
     id_token: string;
     scope: string;
 }
-type GoogleAppCredentials = {
+interface GoogleAppCredential extends NativeCredential {
     state: string;
     code: string;
     client_id: string;
     redirect_uri: string;
-};
+}
 interface GoogleErrorResponse {
     error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'access_denied' | 'server_error';
     error_description: string;
 }
 
-export { type GoogleAppCredentials, type GoogleErrorResponse, type GoogleToken, type GoogleUserInfo, createGoogleProvider, google };
+export { type GoogleAppCredential, type GoogleErrorResponse, type GoogleToken, type GoogleUserInfo, createGoogleProvider, google };