@starklabs/forge 1.3.25-builtin-configs.0 → 2.0.0

package/dist/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC"}

package/dist/http/middleware/ErrorHandler.d.ts

@@ -0,0 +1,15 @@
+import type { ErrorRequestHandler, RequestHandler } from "express";
+import type { ForgeConfig } from "../../config/ForgeConfig.js";
+import { ErrorTranslator } from "../../errors/index.js";
+import type { Logger } from "../../utils/Logger.js";
+/** Last two middlewares of the stack: 404 for unknown routes and the central error handler. */
+export declare class ErrorHandler {
+    private readonly config;
+    private readonly logger;
+    private readonly translator;
+    constructor(config: ForgeConfig, logger: Logger, translator?: ErrorTranslator);
+    notFound(): RequestHandler;
+    handler(): ErrorRequestHandler;
+    private log;
+}
+//# sourceMappingURL=ErrorHandler.d.ts.map

package/dist/http/middleware/ErrorHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ErrorHandler.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/ErrorHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAuB,eAAe,EAAkC,MAAM,uBAAuB,CAAC;AAC7G,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEpD,+FAA+F;AAC/F,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAH7B,YACmB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,eAAuC,EAClE;IAEJ,QAAQ,IAAI,cAAc,CAUzB;IAED,OAAO,IAAI,mBAAmB,CAsB7B;IAED,OAAO,CAAC,GAAG;CAYZ"}

package/dist/http/middleware/ErrorHandler.js

@@ -0,0 +1,56 @@
+import { AppError, ErrorCode, ErrorTranslator, NotFoundError, ValidationError } from "../../errors/index.js";
+/** Last two middlewares of the stack: 404 for unknown routes and the central error handler. */
+export class ErrorHandler {
+    config;
+    logger;
+    translator;
+    constructor(config, logger, translator = new ErrorTranslator()) {
+        this.config = config;
+        this.logger = logger;
+        this.translator = translator;
+    }
+    notFound() {
+        return (req, _res, next) => {
+            next(new NotFoundError({
+                message: `Route not found: ${req.method} ${req.originalUrl.split("?")[0]}`,
+                code: ErrorCode.ROUTE_NOT_FOUND,
+                hint: `API routes live under ${this.config.apiPrefix}.`,
+            }));
+        };
+    }
+    handler() {
+        return (error, req, res, next) => {
+            if (res.headersSent)
+                return next(error);
+            const appError = this.translator.translate(error);
+            this.log(appError, error, req.requestId, req.method, req.originalUrl);
+            for (const [name, value] of Object.entries(appError.headers ?? {}))
+                res.setHeader(name, value);
+            // Never leak internals of unexpected failures.
+            const safeMessage = appError.isOperational || this.config.exposeErrorDetails ? appError.message : "Something went wrong.";
+            res.status(appError.statusCode).json({
+                success: false,
+                message: safeMessage,
+                code: appError.code,
+                ...(appError instanceof ValidationError && appError.issues.length > 0 ? { issues: appError.issues } : {}),
+                ...(this.config.exposeErrorDetails && appError.hint ? { hint: appError.hint } : {}),
+                ...(this.config.exposeErrorDetails && appError.details ? { details: appError.details } : {}),
+                ...(req.requestId ? { requestId: req.requestId } : {}),
+            });
+        };
+    }
+    log(appError, original, requestId, method, url) {
+        const meta = { requestId, code: appError.code, status: appError.statusCode };
+        const line = `${method} ${url.split("?")[0]} → ${appError.statusCode} ${appError.code}`;
+        if (appError.statusCode >= 500) {
+            this.logger.error(`${line}: ${appError.message}`, {
+                ...meta,
+                stack: appError.cause?.stack ?? original?.stack,
+            });
+        }
+        else {
+            this.logger.debug(line, meta);
+        }
+    }
+}
+//# sourceMappingURL=ErrorHandler.js.map

package/dist/http/middleware/ErrorHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ErrorHandler.js","sourceRoot":"","sources":["../../../src/http/middleware/ErrorHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7G,+FAA+F;AAC/F,MAAM,OAAO,YAAY;IAEJ,MAAM;IACN,MAAM;IACN,UAAU;IAH7B,YACmB,MAAmB,EACnB,MAAc,EACd,UAAU,GAAoB,IAAI,eAAe,EAAE;sBAFnD,MAAM;sBACN,MAAM;0BACN,UAAU;IAC1B,CAAC;IAEJ,QAAQ;QACN,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CACF,IAAI,aAAa,CAAC;gBAChB,OAAO,EAAE,oBAAoB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1E,IAAI,EAAE,SAAS,CAAC,eAAe;gBAC/B,IAAI,EAAE,yBAAyB,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG;aACxD,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC/B,IAAI,GAAG,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAEtE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAE/F,+CAA+C;YAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAE1H,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBACnC,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,GAAG,CAAC,QAAQ,YAAY,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAEO,GAAG,CAAC,QAAkB,EAAE,QAAiB,EAAE,SAA6B,EAAE,MAAc,EAAE,GAAW;QAC3G,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxF,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,QAAQ,CAAC,OAAO,EAAE,EAAE;gBAChD,GAAG,IAAI;gBACP,KAAK,EAAG,QAAQ,CAAC,KAA2B,EAAE,KAAK,IAAK,QAA8B,EAAE,KAAK;aAC9F,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;CACF"}

package/dist/http/middleware/InputSanitizer.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from "express";
+/** Strips `$operators`, dotted keys and prototype-pollution keys from body, query and params. */
+export declare const inputSanitizer: () => RequestHandler;
+//# sourceMappingURL=InputSanitizer.d.ts.map

package/dist/http/middleware/InputSanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InputSanitizer.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/InputSanitizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,iGAAiG;AACjG,eAAO,MAAM,cAAc,QAAO,cAKjC,CAAC"}

package/dist/http/middleware/InputSanitizer.js

@@ -0,0 +1,9 @@
+import { stripDangerousKeys } from "../../utils/sanitizeInput.js";
+/** Strips `$operators`, dotted keys and prototype-pollution keys from body, query and params. */
+export const inputSanitizer = () => (req, _res, next) => {
+    stripDangerousKeys(req.body);
+    stripDangerousKeys(req.query);
+    stripDangerousKeys(req.params);
+    next();
+};
+//# sourceMappingURL=InputSanitizer.js.map

package/dist/http/middleware/InputSanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InputSanitizer.js","sourceRoot":"","sources":["../../../src/http/middleware/InputSanitizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG,GAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACtE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,EAAE,CAAC;AACT,CAAC,CAAC"}

package/dist/http/middleware/OriginGuard.d.ts

@@ -0,0 +1,11 @@
+import type { RequestHandler } from "express";
+/**
+ * CSRF defence for cookie-based sessions.
+ *
+ * Because auth cookies may be `SameSite=None` (needed by cross-site SPAs), a
+ * state-changing request must come from an allowed origin. Browsers always
+ * send `Origin` on such requests; non-browser clients (curl, mobile apps)
+ * send none and are not subject to CSRF.
+ */
+export declare const originGuard: (allowedOrigins: readonly string[]) => RequestHandler;
+//# sourceMappingURL=OriginGuard.d.ts.map

package/dist/http/middleware/OriginGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OriginGuard.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/OriginGuard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAK9C;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,mBAAoB,SAAS,MAAM,EAAE,KAAG,cAgB/D,CAAC"}

package/dist/http/middleware/OriginGuard.js

@@ -0,0 +1,26 @@
+import { ErrorCode, ForbiddenError } from "../../errors/index.js";
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/**
+ * CSRF defence for cookie-based sessions.
+ *
+ * Because auth cookies may be `SameSite=None` (needed by cross-site SPAs), a
+ * state-changing request must come from an allowed origin. Browsers always
+ * send `Origin` on such requests; non-browser clients (curl, mobile apps)
+ * send none and are not subject to CSRF.
+ */
+export const originGuard = (allowedOrigins) => {
+    const allowed = new Set(allowedOrigins.map((o) => o.replace(/\/+$/, "")));
+    return (req, _res, next) => {
+        if (allowed.size === 0 || SAFE_METHODS.has(req.method))
+            return next();
+        const origin = req.get("origin");
+        if (!origin || allowed.has(origin.replace(/\/+$/, "")))
+            return next();
+        next(new ForbiddenError({
+            message: "Request origin is not allowed.",
+            code: ErrorCode.CSRF_ORIGIN_REJECTED,
+            hint: "Add the front-end origin to 'frontendURL' / 'frontendURLs'.",
+        }));
+    };
+};
+//# sourceMappingURL=OriginGuard.js.map

package/dist/http/middleware/OriginGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OriginGuard.js","sourceRoot":"","sources":["../../../src/http/middleware/OriginGuard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAElE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,cAAiC,EAAkB,EAAE;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAEtE,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAEtE,IAAI,CACF,IAAI,cAAc,CAAC;YACjB,OAAO,EAAE,gCAAgC;YACzC,IAAI,EAAE,SAAS,CAAC,oBAAoB;YACpC,IAAI,EAAE,6DAA6D;SACpE,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/http/middleware/RateLimiters.d.ts

@@ -0,0 +1,15 @@
+import type { RequestHandler } from "express";
+import type { ForgeConfig } from "../../config/ForgeConfig.js";
+/** Builds the global and the stricter authentication rate limiters. */
+export declare class RateLimiters {
+    private readonly config;
+    private globalLimiter;
+    private authLimiter;
+    constructor(config: ForgeConfig);
+    /** Limits every request from one IP. */
+    global(): RequestHandler;
+    /** Brute-force protection for sign-up, login, OTP and password-reset endpoints. */
+    auth(): RequestHandler;
+    private create;
+}
+//# sourceMappingURL=RateLimiters.d.ts.map

package/dist/http/middleware/RateLimiters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiters.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/RateLimiters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAG/D,uEAAuE;AACvE,qBAAa,YAAY;IAMX,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,WAAW,CAA6B;IAEhD,YAA6B,MAAM,EAAE,WAAW,EAAI;IAEpD,wCAAwC;IACxC,MAAM,IAAI,cAAc,CAEvB;IAED,mFAAmF;IACnF,IAAI,IAAI,cAAc,CAErB;IAED,OAAO,CAAC,MAAM;CAcf"}

package/dist/http/middleware/RateLimiters.js

@@ -0,0 +1,36 @@
+import { ipKeyGenerator, rateLimit } from "express-rate-limit";
+import { TooManyRequestsError } from "../../errors/index.js";
+/** Builds the global and the stricter authentication rate limiters. */
+export class RateLimiters {
+    config;
+    // One instance per scope: every credential endpoint must draw from the *same* per-IP budget,
+    // otherwise an attacker would get a fresh allowance on each route.
+    globalLimiter;
+    authLimiter;
+    constructor(config) {
+        this.config = config;
+    }
+    /** Limits every request from one IP. */
+    global() {
+        return (this.globalLimiter ??= this.create(this.config.rateLimit.max, "global"));
+    }
+    /** Brute-force protection for sign-up, login, OTP and password-reset endpoints. */
+    auth() {
+        return (this.authLimiter ??= this.create(this.config.rateLimit.authMax, "auth"));
+    }
+    create(limit, scope) {
+        const { window, message, store } = this.config.rateLimit;
+        return rateLimit({
+            windowMs: Math.max(1, window.toMs()),
+            limit,
+            standardHeaders: "draft-7",
+            legacyHeaders: false,
+            ...(store ? { store } : {}),
+            // Separate counters per scope even when they share a store.
+            // IPv6 clients are grouped by /56 so one user cannot dodge the limit by rotating addresses.
+            keyGenerator: (req) => `${scope}:${ipKeyGenerator(req.ip ?? "unknown")}`,
+            handler: (_req, _res, next) => next(new TooManyRequestsError({ message })),
+        });
+    }
+}
+//# sourceMappingURL=RateLimiters.js.map

package/dist/http/middleware/RateLimiters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiters.js","sourceRoot":"","sources":["../../../src/http/middleware/RateLimiters.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,uEAAuE;AACvE,MAAM,OAAO,YAAY;IAMM,MAAM;IALnC,6FAA6F;IAC7F,mEAAmE;IAC3D,aAAa,CAA6B;IAC1C,WAAW,CAA6B;IAEhD,YAA6B,MAAmB;sBAAnB,MAAM;IAAgB,CAAC;IAEpD,wCAAwC;IACxC,MAAM;QACJ,OAAO,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,mFAAmF;IACnF,IAAI;QACF,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACnF,CAAC;IAEO,MAAM,CAAC,KAAa,EAAE,KAAa;QACzC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACzD,OAAO,SAAS,CAAC;YACf,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,KAAK;YACL,eAAe,EAAE,SAAS;YAC1B,aAAa,EAAE,KAAK;YACpB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,4DAA4D;YAC5D,4FAA4F;YAC5F,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE;YACxE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/http/middleware/RequestContext.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from "express";
+/** Gives each request an id (reusing a well-formed `x-request-id`) and echoes it back. */
+export declare const requestContext: () => RequestHandler;
+//# sourceMappingURL=RequestContext.d.ts.map

package/dist/http/middleware/RequestContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestContext.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/RequestContext.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAI9C,0FAA0F;AAC1F,eAAO,MAAM,cAAc,QAAO,cAKjC,CAAC"}

package/dist/http/middleware/RequestContext.js

@@ -0,0 +1,10 @@
+import { randomUUID } from "node:crypto";
+const SAFE_ID = /^[\w-]{8,64}$/;
+/** Gives each request an id (reusing a well-formed `x-request-id`) and echoes it back. */
+export const requestContext = () => (req, res, next) => {
+    const incoming = req.get("x-request-id");
+    req.requestId = incoming && SAFE_ID.test(incoming) ? incoming : randomUUID();
+    res.setHeader("x-request-id", req.requestId);
+    next();
+};
+//# sourceMappingURL=RequestContext.js.map

package/dist/http/middleware/RequestContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestContext.js","sourceRoot":"","sources":["../../../src/http/middleware/RequestContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,GAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,GAAG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAC7E,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,EAAE,CAAC;AACT,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+import { Forge } from "./core/Forge.js";
+import type { Collection } from "./types/Collection.js";
+import type { Route } from "./types/Route.js";
+export { Forge } from "./core/Forge.js";
+export { FeatureModule, type HandlerFn } from "./core/FeatureModule.js";
+export type { Services } from "./core/Services.js";
+export type { ForgeDependencies } from "./core/ServiceFactory.js";
+export { RouteContext } from "./core/RouteContext.js";
+export { ForgeConfig, Duration } from "./config/index.js";
+export type { ForgeOptions, AuthConfig, AuthMode, DurationType, OtpOptions, CookieOptions } from "./config/index.js";
+export * from "./errors/index.js";
+export type { Repository, DataSource, Doc, Filter, ModelDefinition } from "./data/Repository.js";
+export { MongooseDataSource } from "./data/MongooseDataSource.js";
+export { OAuthProvider, GoogleProvider, GitHubProvider, OAuthProviderRegistry } from "./oauth/index.js";
+export type { OAuthClientOptions, OAuthProfile, OAuthProviderConfig, OAuthProviderEntry, TokenSet, AuthorizationParams } from "./oauth/index.js";
+export type { OAuthOptions, AccountLinking, MagicLinkOptions, MfaOptions } from "./config/ForgeOptions.js";
+export type { EmailProvider, OutgoingEmail } from "./email/EmailProvider.js";
+export type { StorageProvider, IncomingFile } from "./upload/StorageProvider.js";
+export { generateJWTSecret, generateMasterKey } from "./security/CryptoVault.js";
+export { Totp, base32 } from "./security/Totp.js";
+export { PasswordHasher } from "./security/PasswordHasher.js";
+export { default as fields } from "./fields/unified.fields.js";
+export { default as mongooseFields } from "./fields/mongoose.fields.js";
+export { default as zodFields } from "./fields/zod.fields.js";
+export type { Collection, CollectionType, Route } from "./types/Collection.js";
+export type { RouteMethod, AccessLevel, AuthRole } from "./types/Route.js";
+export type { Upload, UploadType, UploadProvider } from "./types/upload.js";
+export type { Action, ActionContext, CustomAction, EmailAction } from "./types/ActionHandler.js";
+export type { StoreFile } from "./types/StoreFile.js";
+export type { AuthenticatedUser } from "./types/AuthenticatedUser.js";
+export type { EmailTemplate } from "./types/email.js";
+/** Identity helper that gives you autocomplete when declaring a collection. */
+export declare const collection: (object: Collection) => Collection;
+/** Identity helper that gives you autocomplete when declaring routes. */
+export declare const defineRoutes: (routes: Route[]) => Route[];
+/**
+ * @deprecated Use `new Forge({...})` and `await forge.start()`.
+ * Kept so 1.x code (`new StarkForge({...}); startServer();`) keeps working.
+ */
+export declare class StarkForge extends Forge {
+}
+/** @deprecated Use `forge.start()`. Starts the most recently created Forge instance. */
+export declare const startServer: () => Promise<void>;
+export default Forge;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGrH,cAAc,mBAAmB,CAAC;AAGlC,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxG,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjJ,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG3G,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC7E,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGjF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAG9D,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC/E,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3E,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC5E,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACjG,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,WAAY,UAAU,KAAG,UAAoB,CAAC;AAErE,yEAAyE;AACzE,eAAO,MAAM,YAAY,WAAY,KAAK,EAAE,KAAG,KAAK,EAAY,CAAC;AAEjE;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC,wFAAwF;AACxF,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,IAAI,CAGhD,CAAC;eAEa,KAAK"}

package/dist/index.js

@@ -0,0 +1,38 @@
+import { Forge } from "./core/Forge.js";
+// ── Framework ────────────────────────────────────────────────────────────────
+export { Forge } from "./core/Forge.js";
+export { FeatureModule } from "./core/FeatureModule.js";
+export { RouteContext } from "./core/RouteContext.js";
+// ── Configuration ────────────────────────────────────────────────────────────
+export { ForgeConfig, Duration } from "./config/index.js";
+// ── Errors ───────────────────────────────────────────────────────────────────
+export * from "./errors/index.js";
+export { MongooseDataSource } from "./data/MongooseDataSource.js";
+// ── Social sign-in ───────────────────────────────────────────────────────────
+export { OAuthProvider, GoogleProvider, GitHubProvider, OAuthProviderRegistry } from "./oauth/index.js";
+// ── Security helpers ─────────────────────────────────────────────────────────
+export { generateJWTSecret, generateMasterKey } from "./security/CryptoVault.js";
+export { Totp, base32 } from "./security/Totp.js";
+export { PasswordHasher } from "./security/PasswordHasher.js";
+// ── Field helpers ────────────────────────────────────────────────────────────
+export { default as fields } from "./fields/unified.fields.js";
+export { default as mongooseFields } from "./fields/mongoose.fields.js";
+export { default as zodFields } from "./fields/zod.fields.js";
+/** Identity helper that gives you autocomplete when declaring a collection. */
+export const collection = (object) => object;
+/** Identity helper that gives you autocomplete when declaring routes. */
+export const defineRoutes = (routes) => routes;
+/**
+ * @deprecated Use `new Forge({...})` and `await forge.start()`.
+ * Kept so 1.x code (`new StarkForge({...}); startServer();`) keeps working.
+ */
+export class StarkForge extends Forge {
+}
+/** @deprecated Use `forge.start()`. Starts the most recently created Forge instance. */
+export const startServer = async () => {
+    if (!Forge.lastCreated)
+        throw new Error("Create a Forge instance first: new Forge({...}).");
+    await Forge.lastCreated.start();
+};
+export default Forge;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAIxC,gFAAgF;AAChF,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAkB,MAAM,yBAAyB,CAAC;AAGxE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,gFAAgF;AAChF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG1D,gFAAgF;AAChF,cAAc,mBAAmB,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,gFAAgF;AAChF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAQxG,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,gFAAgF;AAChF,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAW9D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAkB,EAAc,EAAE,CAAC,MAAM,CAAC;AAErE,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAe,EAAW,EAAE,CAAC,MAAM,CAAC;AAEjE;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,wFAAwF;AACxF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;IACnD,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC5F,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;AAClC,CAAC,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/oauth/GitHubProvider.d.ts

@@ -0,0 +1,19 @@
+import { OAuthProvider, type OAuthProfile, type TokenSet } from "./OAuthProvider.js";
+/**
+ * "Sign in with GitHub".
+ * Register an OAuth App at https://github.com/settings/developers with
+ * `<backendURL>/auth/oauth/github/callback` as the callback URL.
+ *
+ * A GitHub account can hide its e-mail, so the user's e-mail list is read
+ * (scope `user:email`) and only a *verified* address is trusted.
+ */
+export declare class GitHubProvider extends OAuthProvider {
+    readonly name: string;
+    readonly displayName = "GitHub";
+    protected readonly authorizationEndpoint = "https://github.com/login/oauth/authorize";
+    protected readonly tokenEndpoint = "https://github.com/login/oauth/access_token";
+    protected readonly defaultScopes: readonly ["read:user", "user:email"];
+    private readonly apiBase;
+    fetchProfile(tokens: TokenSet): Promise<OAuthProfile>;
+}
+//# sourceMappingURL=GitHubProvider.d.ts.map

package/dist/oauth/GitHubProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubProvider.d.ts","sourceRoot":"","sources":["../../src/oauth/GitHubProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAUrF;;;;;;;GAOG;AACH,qBAAa,cAAe,SAAQ,aAAa;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAY;IACjC,QAAQ,CAAC,WAAW,YAAY;IAChC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,8CAA8C;IACtF,SAAS,CAAC,QAAQ,CAAC,aAAa,iDAAiD;IACjF,SAAS,CAAC,QAAQ,CAAC,aAAa,YAAI,WAAW,EAAE,YAAY,EAAW;IACxE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IAE9C,YAAY,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAsB1D;CACF"}

package/dist/oauth/GitHubProvider.js

@@ -0,0 +1,38 @@
+import { OAuthProvider } from "./OAuthProvider.js";
+const API_HEADERS = { "user-agent": "forge-oauth", "x-github-api-version": "2022-11-28", accept: "application/vnd.github+json" };
+/**
+ * "Sign in with GitHub".
+ * Register an OAuth App at https://github.com/settings/developers with
+ * `<backendURL>/auth/oauth/github/callback` as the callback URL.
+ *
+ * A GitHub account can hide its e-mail, so the user's e-mail list is read
+ * (scope `user:email`) and only a *verified* address is trusted.
+ */
+export class GitHubProvider extends OAuthProvider {
+    name = "github";
+    displayName = "GitHub";
+    authorizationEndpoint = "https://github.com/login/oauth/authorize";
+    tokenEndpoint = "https://github.com/login/oauth/access_token";
+    defaultScopes = ["read:user", "user:email"];
+    apiBase = "https://api.github.com";
+    async fetchProfile(tokens) {
+        const [userRes, emailsRes] = await Promise.all([
+            this.getJson(`${this.apiBase}/user`, tokens, API_HEADERS),
+            this.getJson(`${this.apiBase}/user/emails`, tokens, API_HEADERS),
+        ]);
+        const user = this.asRecord(userRes.body);
+        if (!userRes.ok || (typeof user.id !== "number" && typeof user.id !== "string"))
+            throw this.failure("profile request", userRes.status);
+        const emails = (emailsRes.ok && Array.isArray(emailsRes.body) ? emailsRes.body : []).filter((e) => typeof e === "object" && e !== null && typeof e.email === "string");
+        const verified = emails.find((e) => e.primary && e.verified) ?? emails.find((e) => e.verified);
+        const fallback = emails.find((e) => e.primary) ?? emails[0];
+        return {
+            providerUserId: String(user.id),
+            email: verified?.email ?? fallback?.email ?? (typeof user.email === "string" ? user.email : undefined),
+            emailVerified: Boolean(verified),
+            name: typeof user.name === "string" && user.name ? user.name : typeof user.login === "string" ? user.login : undefined,
+            avatarUrl: typeof user.avatar_url === "string" ? user.avatar_url : undefined,
+        };
+    }
+}
+//# sourceMappingURL=GitHubProvider.js.map

package/dist/oauth/GitHubProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubProvider.js","sourceRoot":"","sources":["../../src/oauth/GitHubProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoC,MAAM,oBAAoB,CAAC;AAQrF,MAAM,WAAW,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;AAEjI;;;;;;;GAOG;AACH,MAAM,OAAO,cAAe,SAAQ,aAAa;IACtC,IAAI,GAAW,QAAQ,CAAC;IACxB,WAAW,GAAG,QAAQ,CAAC;IACb,qBAAqB,GAAG,0CAA0C,CAAC;IACnE,aAAa,GAAG,6CAA6C,CAAC;IAC9D,aAAa,GAAG,CAAC,WAAW,EAAE,YAAY,CAAU,CAAC;IACvD,OAAO,GAAG,wBAAwB,CAAC;IAEpD,KAAK,CAAC,YAAY,CAAC,MAAgB;QACjC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC;SACjE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAEvI,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACzF,CAAC,CAAC,EAAoB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAQ,CAAiB,CAAC,KAAK,KAAK,QAAQ,CAC7G,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QAE5D,OAAO;YACL,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACtG,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC;YAChC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACtH,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAC7E,CAAC;IACJ,CAAC;CACF"}

package/dist/oauth/GoogleProvider.d.ts

@@ -0,0 +1,16 @@
+import { OAuthProvider, type OAuthProfile, type TokenSet } from "./OAuthProvider.js";
+/**
+ * "Sign in with Google" (OpenID Connect).
+ * Create credentials at https://console.cloud.google.com/apis/credentials and add
+ * `<backendURL>/auth/oauth/google/callback` as an authorised redirect URI.
+ */
+export declare class GoogleProvider extends OAuthProvider {
+    readonly name: string;
+    readonly displayName = "Google";
+    protected readonly authorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
+    protected readonly tokenEndpoint = "https://oauth2.googleapis.com/token";
+    protected readonly defaultScopes: readonly ["openid", "email", "profile"];
+    private readonly userInfoEndpoint;
+    fetchProfile(tokens: TokenSet): Promise<OAuthProfile>;
+}
+//# sourceMappingURL=GoogleProvider.d.ts.map

package/dist/oauth/GoogleProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleProvider.d.ts","sourceRoot":"","sources":["../../src/oauth/GoogleProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAErF;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,aAAa;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAY;IACjC,QAAQ,CAAC,WAAW,YAAY;IAChC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,kDAAkD;IAC1F,SAAS,CAAC,QAAQ,CAAC,aAAa,yCAAyC;IACzE,SAAS,CAAC,QAAQ,CAAC,aAAa,YAAI,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAW;IAC3E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsD;IAEjF,YAAY,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAa1D;CACF"}

package/dist/oauth/GoogleProvider.js

@@ -0,0 +1,29 @@
+import { OAuthProvider } from "./OAuthProvider.js";
+/**
+ * "Sign in with Google" (OpenID Connect).
+ * Create credentials at https://console.cloud.google.com/apis/credentials and add
+ * `<backendURL>/auth/oauth/google/callback` as an authorised redirect URI.
+ */
+export class GoogleProvider extends OAuthProvider {
+    name = "google";
+    displayName = "Google";
+    authorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
+    tokenEndpoint = "https://oauth2.googleapis.com/token";
+    defaultScopes = ["openid", "email", "profile"];
+    userInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo";
+    async fetchProfile(tokens) {
+        const res = await this.getJson(this.userInfoEndpoint, tokens);
+        const info = this.asRecord(res.body);
+        if (!res.ok || typeof info.sub !== "string" || !info.sub)
+            throw this.failure("profile request", res.status);
+        return {
+            providerUserId: info.sub,
+            email: typeof info.email === "string" ? info.email : undefined,
+            // Google reports a boolean, but older responses used the string "true".
+            emailVerified: info.email_verified === true || info.email_verified === "true",
+            name: typeof info.name === "string" ? info.name : undefined,
+            avatarUrl: typeof info.picture === "string" ? info.picture : undefined,
+        };
+    }
+}
+//# sourceMappingURL=GoogleProvider.js.map

package/dist/oauth/GoogleProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleProvider.js","sourceRoot":"","sources":["../../src/oauth/GoogleProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoC,MAAM,oBAAoB,CAAC;AAErF;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,aAAa;IACtC,IAAI,GAAW,QAAQ,CAAC;IACxB,WAAW,GAAG,QAAQ,CAAC;IACb,qBAAqB,GAAG,8CAA8C,CAAC;IACvE,aAAa,GAAG,qCAAqC,CAAC;IACtD,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;IAC1D,gBAAgB,GAAG,kDAAkD,CAAC;IAEvF,KAAK,CAAC,YAAY,CAAC,MAAgB;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAE5G,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,GAAG;YACxB,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAC9D,wEAAwE;YACxE,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,MAAM;YAC7E,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC3D,SAAS,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC;IACJ,CAAC;CACF"}

package/dist/oauth/OAuthController.d.ts

@@ -0,0 +1,21 @@
+import type { Request, Response } from "express";
+import type { RouteContext } from "../core/RouteContext.js";
+import type { Services } from "../core/Services.js";
+import type { OAuthService } from "./OAuthService.js";
+/** HTTP adapter for {@link OAuthService}: three routes - list providers, start, callback. */
+export declare class OAuthController {
+    private readonly services;
+    private readonly oauth;
+    private readonly translator;
+    constructor(services: Services, oauth: () => OAuthService);
+    private get settings();
+    /** `GET /auth/oauth/providers`: lets the front-end render the right buttons. */
+    oauthProviders: (_req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    /** `GET /auth/oauth/:provider`: remember the state in a cookie, then send the browser to the provider. */
+    oauthStart: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    /** `GET /auth/oauth/:provider/callback`: the provider sends the browser back here. */
+    oauthCallback: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    private callbackUrl;
+    private successTarget;
+}
+//# sourceMappingURL=OAuthController.d.ts.map

package/dist/oauth/OAuthController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthController.d.ts","sourceRoot":"","sources":["../../src/oauth/OAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtD,6FAA6F;AAC7F,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IAEpD,YACmB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,MAAM,YAAY,EACxC;IAEJ,OAAO,KAAK,QAAQ,GAEnB;IAED,gFAAgF;IAChF,cAAc,SAAgB,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAMrF;IAEF,0GAA0G;IAC1G,UAAU,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;IAEF,sFAAsF;IACtF,aAAa,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CA8CnF;IAEF,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,aAAa;CAMtB"}

package/dist/oauth/OAuthController.js

@@ -0,0 +1,89 @@
+import { AppError, ErrorTranslator } from "../errors/index.js";
+import { OAUTH_STATE_COOKIE } from "../auth/CookieWriter.js";
+import { safeReturnPath } from "./returnPath.js";
+/** HTTP adapter for {@link OAuthService}: three routes - list providers, start, callback. */
+export class OAuthController {
+    services;
+    oauth;
+    translator = new ErrorTranslator();
+    constructor(services, oauth) {
+        this.services = services;
+        this.oauth = oauth;
+    }
+    get settings() {
+        return this.services.config.auth.oauth;
+    }
+    /** `GET /auth/oauth/providers`: lets the front-end render the right buttons. */
+    oauthProviders = async (_req, res, ctx) => {
+        const base = `${this.services.config.apiPrefix}/${ctx.collection.route}/oauth`;
+        this.services.responses.success(res, {
+            message: "Sign-in providers fetched successfully.",
+            data: this.services.oauth.list().map((p) => ({ name: p.name, displayName: p.displayName, url: `${base}/${p.name}` })),
+        });
+    };
+    /** `GET /auth/oauth/:provider`: remember the state in a cookie, then send the browser to the provider. */
+    oauthStart = async (req, res, ctx) => {
+        const name = String(req.params.provider);
+        const { url, stateToken } = this.oauth().begin(name, this.callbackUrl(ctx, name), safeReturnPath(req.query.returnTo));
+        this.services.cookies.setOAuthState(res, stateToken, this.settings.stateAge.toMs());
+        res.setHeader("Cache-Control", "no-store");
+        res.redirect(302, url);
+    };
+    /** `GET /auth/oauth/:provider/callback`: the provider sends the browser back here. */
+    oauthCallback = async (req, res, ctx) => {
+        const name = String(req.params.provider);
+        const cookies = req.cookies;
+        const stateToken = cookies?.[OAUTH_STATE_COOKIE];
+        res.setHeader("Cache-Control", "no-store");
+        try {
+            const outcome = await this.oauth().complete({
+                provider: name,
+                code: req.query.code,
+                state: req.query.state,
+                error: req.query.error,
+                stateToken: typeof stateToken === "string" ? stateToken : undefined,
+                redirectUri: this.callbackUrl(ctx, name),
+            }, req);
+            // The state is single-use: whatever happens next, this browser starts fresh.
+            this.services.cookies.clearOAuthState(res);
+            const target = this.successTarget(outcome.returnTo);
+            if (target) {
+                this.services.sessionResponder.establish(res, outcome.tokens);
+                res.redirect(302, target);
+                return;
+            }
+            this.services.sessionResponder.send(res, {
+                user: outcome.user,
+                tokens: outcome.tokens,
+                created: outcome.created,
+                message: `Signed in with ${this.services.oauth.get(name).displayName}.`,
+                hiddenFields: ctx.route.config?.hiddenFields,
+            });
+        }
+        catch (error) {
+            this.services.cookies.clearOAuthState(res);
+            const failureRedirect = this.settings?.failureRedirect;
+            if (!failureRedirect)
+                throw error;
+            // Redirect mode: the browser cannot show a JSON error, so hand the front-end a short code.
+            const appError = this.translator.translate(error);
+            if (appError.statusCode >= 500)
+                this.services.logger.error(`OAuth callback failed: ${appError.message}`, { code: appError.code });
+            const url = new URL(failureRedirect);
+            url.searchParams.set("error", appError.code);
+            res.redirect(302, url.toString());
+        }
+    };
+    callbackUrl(ctx, provider) {
+        const base = this.services.config.backendURL.replace(/\/+$/, "");
+        return `${base}/${ctx.collection.route}/oauth/${encodeURIComponent(provider)}/callback`;
+    }
+    successTarget(returnTo) {
+        const base = this.settings?.successRedirect;
+        if (!base)
+            return undefined;
+        // `returnTo` was validated as a plain path, so this can only stay on the configured front-end.
+        return returnTo ? new URL(returnTo, base).toString() : base;
+    }
+}
+//# sourceMappingURL=OAuthController.js.map

package/dist/oauth/OAuthController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthController.js","sourceRoot":"","sources":["../../src/oauth/OAuthController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAI7D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,6FAA6F;AAC7F,MAAM,OAAO,eAAe;IAIP,QAAQ;IACR,KAAK;IAJP,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEpD,YACmB,QAAkB,EAClB,KAAyB;wBADzB,QAAQ;qBACR,KAAK;IACrB,CAAC;IAEJ,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,gFAAgF;IAChF,cAAc,GAAG,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACxF,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;YACnC,OAAO,EAAE,yCAAyC;YAClD,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACtH,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,0GAA0G;IAC1G,UAAU,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEtH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,QAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,sFAAsF;IACtF,aAAa,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACtF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,OAA8C,CAAC;QACnE,MAAM,UAAU,GAAG,OAAO,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,CACzC;gBACE,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK;gBACtB,UAAU,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBACnE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC;aACzC,EACD,GAAG,CACJ,CAAC;YACF,6EAA6E;YAC7E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC9D,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE;gBACvC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,kBAAkB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG;gBACvE,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY;aAC7C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC;YACvD,IAAI,CAAC,eAAe;gBAAE,MAAM,KAAK,CAAC;YAElC,2FAA2F;YAC3F,MAAM,QAAQ,GAAa,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAClI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7C,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IAEM,WAAW,CAAC,GAAiB,EAAE,QAAgB;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC1F,CAAC;IAEO,aAAa,CAAC,QAA4B;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,+FAA+F;QAC/F,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF"}