@syncello/auth 2.5.1 → 3.1.0

package/README.md

@@ -18,12 +18,7 @@ Authentication library for Hono + Drizzle + Cloudflare Workers.
 ## Installation
 
 ```bash
-npm install @syncello/auth --registry=https://npm.pkg.github.com
-```
-
-Configure `.npmrc`:
-```
-@syncello:registry=https://npm.pkg.github.com
+npm install @syncello/auth
 ```
 
 ## Quick Start

package/dist/index.cjs

@@ -898,16 +898,16 @@ function createDeviceToken() {
   };
 }
 async function validateTrustedDevice(db, userTrustedDevicesTable, userId, tokenHash) {
-  const { eq: eq31, and: and14, gt: gt6 } = await import("drizzle-orm");
+  const { eq: eq33, and: and14, gt: gt6 } = await import("drizzle-orm");
   const [device] = await db.select().from(userTrustedDevicesTable).where(
     and14(
-      eq31(userTrustedDevicesTable.userId, userId),
-      eq31(userTrustedDevicesTable.tokenHash, tokenHash),
+      eq33(userTrustedDevicesTable.userId, userId),
+      eq33(userTrustedDevicesTable.tokenHash, tokenHash),
       gt6(userTrustedDevicesTable.expiresAt, Date.now())
     )
   ).limit(1);
   if (device) {
-    await db.update(userTrustedDevicesTable).set({ lastUsedAt: Date.now() }).where(eq31(userTrustedDevicesTable.id, device.id));
+    await db.update(userTrustedDevicesTable).set({ lastUsedAt: Date.now() }).where(eq33(userTrustedDevicesTable.id, device.id));
     return true;
   }
   return false;
@@ -1829,7 +1829,7 @@ var requireVerifiedEmail = (0, import_factory5.createMiddleware)(
 );
 
 // src/routes/index.ts
-var import_zod_openapi37 = require("@hono/zod-openapi");
+var import_zod_openapi42 = require("@hono/zod-openapi");
 
 // src/routes/signup.ts
 var import_zod_openapi2 = require("@hono/zod-openapi");
@@ -3207,19 +3207,19 @@ var signupRequestSchema = import_zod_openapi.z.object({
 var loginRequestSchema = import_zod_openapi.z.object({
   email: import_zod_openapi.z.string().email().openapi({ example: "user@example.com" }),
   password: import_zod_openapi.z.string().min(1).openapi({ example: "SecurePass123!" }),
-  turnstileToken: import_zod_openapi.z.string().min(1).openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
+  turnstileToken: import_zod_openapi.z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
 }).openapi("LoginRequest");
 var verifyEmailRequestSchema = import_zod_openapi.z.object({
   token: import_zod_openapi.z.string().min(1).openapi({ example: "verification-token-abc123" })
 }).openapi("VerifyEmailRequest");
 var forgotPasswordRequestSchema = import_zod_openapi.z.object({
   email: import_zod_openapi.z.string().email().openapi({ example: "user@example.com" }),
-  turnstileToken: import_zod_openapi.z.string().min(1).openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
+  turnstileToken: import_zod_openapi.z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
 }).openapi("ForgotPasswordRequest");
 var resetPasswordRequestSchema = import_zod_openapi.z.object({
   token: import_zod_openapi.z.string().min(1).openapi({ example: "reset-token-xyz789" }),
   password: import_zod_openapi.z.string().min(8).openapi({ example: "NewSecurePass456!" }),
-  turnstileToken: import_zod_openapi.z.string().min(1).openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
+  turnstileToken: import_zod_openapi.z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
 }).openapi("ResetPasswordRequest");
 var changePasswordRequestSchema = import_zod_openapi.z.object({
   currentPassword: import_zod_openapi.z.string().min(1).openapi({ example: "OldPassword123!" }),
@@ -5498,11 +5498,8 @@ var challengeResendHandler = async (c) => {
 var twoFa = new import_zod_openapi36.OpenAPIHono();
 twoFa.use("*", csrf);
 twoFa.use("/status", requireAuth);
-twoFa.openapi(statusRoute, statusHandler);
 twoFa.use("/totp/setup", requireAuth);
-twoFa.openapi(totpSetupRoute, totpSetupHandler);
 twoFa.use("/totp/verify", requireAuth);
-twoFa.openapi(totpVerifyRoute, totpVerifyHandler);
 twoFa.use(
   "/totp/disable",
   requireAuth,
@@ -5514,11 +5511,8 @@ twoFa.use(
     // 5 attempts per 15 minutes
   })
 );
-twoFa.openapi(totpDisableRoute, totpDisableHandler);
 twoFa.use("/email/setup", requireAuth);
-twoFa.openapi(emailSetupRoute, emailSetupHandler);
 twoFa.use("/email/verify", requireAuth);
-twoFa.openapi(emailVerifyRoute, emailVerifyHandler);
 twoFa.use(
   "/email/send-code",
   requireAuth,
@@ -5530,7 +5524,6 @@ twoFa.use(
     // 3 per 5 minutes
   })
 );
-twoFa.openapi(emailSendCodeRoute, emailSendCodeHandler);
 twoFa.use(
   "/email/disable",
   requireAuth,
@@ -5542,11 +5535,8 @@ twoFa.use(
     // 5 attempts per 15 minutes
   })
 );
-twoFa.openapi(emailDisableRoute, emailDisableHandler);
 twoFa.use("/trusted-devices", requireAuth);
-twoFa.openapi(trustedDevicesGetRoute, trustedDevicesGetHandler);
 twoFa.use("/trusted-devices/:id", requireAuth);
-twoFa.openapi(trustedDevicesDeleteRoute, trustedDevicesDeleteHandler);
 twoFa.use(
   "/backup-codes/regenerate",
   requireAuth,
@@ -5558,7 +5548,6 @@ twoFa.use(
     // 3 per hour per user
   })
 );
-twoFa.openapi(backupCodesRegenerateRoute, backupCodesRegenerateHandler);
 twoFa.use(
   "/challenge",
   rateLimit({
@@ -5569,7 +5558,6 @@ twoFa.use(
     // 10 per 5 min per IP
   })
 );
-twoFa.openapi(challengeRoute, challengeHandler);
 twoFa.use(
   "/challenge/resend",
   rateLimit({
@@ -5580,40 +5568,423 @@ twoFa.use(
     // 3 per 5 min per IP
   })
 );
-twoFa.openapi(challengeResendRoute, challengeResendHandler);
-var fa_default = twoFa;
+var twoFaRoutes = twoFa.openapi(statusRoute, statusHandler).openapi(totpSetupRoute, totpSetupHandler).openapi(totpVerifyRoute, totpVerifyHandler).openapi(totpDisableRoute, totpDisableHandler).openapi(emailSetupRoute, emailSetupHandler).openapi(emailVerifyRoute, emailVerifyHandler).openapi(emailSendCodeRoute, emailSendCodeHandler).openapi(emailDisableRoute, emailDisableHandler).openapi(trustedDevicesGetRoute, trustedDevicesGetHandler).openapi(trustedDevicesDeleteRoute, trustedDevicesDeleteHandler).openapi(backupCodesRegenerateRoute, backupCodesRegenerateHandler).openapi(challengeRoute, challengeHandler).openapi(challengeResendRoute, challengeResendHandler);
+var fa_default = twoFaRoutes;
+
+// src/routes/oauth/index.ts
+var import_zod_openapi41 = require("@hono/zod-openapi");
+
+// src/routes/oauth/authorize.ts
+var import_zod_openapi38 = require("@hono/zod-openapi");
+
+// src/routes/oauth/providers.ts
+var PROVIDERS = {
+  google: {
+    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userinfoUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    scopes: ["email"],
+    emailExtractor: (data) => data.email || null,
+    userIdExtractor: (data) => data.id || null
+  },
+  microsoft: {
+    authorizeUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+    tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+    userinfoUrl: "https://graph.microsoft.com/v1.0/me",
+    scopes: ["openid", "email", "User.Read"],
+    emailExtractor: (data) => data.mail || data.userPrincipalName || null,
+    userIdExtractor: (data) => data.id || null
+  }
+};
+function getProviderCredentials(provider, env) {
+  if (provider === "google" && env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET) {
+    return { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET };
+  }
+  if (provider === "microsoft" && env.MICROSOFT_CLIENT_ID && env.MICROSOFT_CLIENT_SECRET) {
+    return { clientId: env.MICROSOFT_CLIENT_ID, clientSecret: env.MICROSOFT_CLIENT_SECRET };
+  }
+  return null;
+}
+
+// src/routes/oauth/schemas.ts
+var import_zod_openapi37 = require("@hono/zod-openapi");
+var oauthProviderParamSchema = import_zod_openapi37.z.object({
+  provider: import_zod_openapi37.z.enum(["google", "microsoft"]).openapi({ example: "google" })
+});
+var oauthAuthorizeQuerySchema = import_zod_openapi37.z.object({
+  redirect: import_zod_openapi37.z.string().optional().openapi({ example: "/dashboard" }),
+  invitationToken: import_zod_openapi37.z.string().optional().openapi({ example: "token123" }),
+  code_challenge: import_zod_openapi37.z.string().min(43).max(128).optional().openapi({ example: "E9Mrozoa2owUednMY..." }),
+  code_challenge_method: import_zod_openapi37.z.enum(["S256"]).optional().openapi({ example: "S256" }),
+  redirect_uri: import_zod_openapi37.z.string().url().optional().openapi({ example: "myapp://oauth-callback" })
+}).openapi("OAuthAuthorizeQuery");
+var oauthCallbackQuerySchema = import_zod_openapi37.z.object({
+  code: import_zod_openapi37.z.string().optional(),
+  state: import_zod_openapi37.z.string().optional(),
+  error: import_zod_openapi37.z.string().optional()
+});
+var oauthCompleteRequestSchema = import_zod_openapi37.z.object({
+  code: import_zod_openapi37.z.string().uuid("Invalid code format").openapi({ example: "a1b2c3d4-..." })
+}).openapi("OAuthCompleteRequest");
+var oauthCompleteResponseSchema = import_zod_openapi37.z.object({
+  message: import_zod_openapi37.z.string().openapi({ example: "Login successful" }),
+  redirect: import_zod_openapi37.z.string().openapi({ example: "/" }),
+  user: import_zod_openapi37.z.object({
+    id: import_zod_openapi37.z.string().uuid(),
+    email: import_zod_openapi37.z.string().email(),
+    emailVerified: import_zod_openapi37.z.boolean()
+  })
+}).openapi("OAuthCompleteResponse");
+var errorResponseSchema4 = import_zod_openapi37.z.object({
+  type: import_zod_openapi37.z.string().url(),
+  title: import_zod_openapi37.z.string(),
+  status: import_zod_openapi37.z.number().int(),
+  detail: import_zod_openapi37.z.string().optional()
+}).openapi("ErrorResponse");
+
+// src/routes/oauth/authorize.ts
+var authorizeRoute = (0, import_zod_openapi38.createRoute)({
+  method: "get",
+  path: "/{provider}/authorize",
+  tags: ["OAuth"],
+  summary: "Start OAuth login flow",
+  description: "Generates a CSRF state token and redirects the user to the OAuth provider.",
+  request: {
+    params: oauthProviderParamSchema,
+    query: oauthAuthorizeQuerySchema
+  },
+  responses: {
+    302: { description: "Redirect to OAuth provider or error page" }
+  }
+});
+var authorizeHandler = async (c) => {
+  const { provider } = c.req.valid("param");
+  const {
+    redirect: loginRedirect,
+    invitationToken,
+    code_challenge,
+    code_challenge_method,
+    redirect_uri: mobileRedirectUri
+  } = c.req.valid("query");
+  const providerConfig = PROVIDERS[provider];
+  if (!providerConfig) {
+    return c.redirect(`${c.env.APP_URL}/login?error=oauth_invalid_provider`);
+  }
+  const credentials = getProviderCredentials(provider, c.env);
+  if (!credentials) {
+    logError(new Error(`OAuth credentials not configured for ${provider}`), {
+      context: "oauth_authorize",
+      provider
+    });
+    return c.redirect(`${c.env.APP_URL}/login?error=oauth_not_configured`);
+  }
+  if (code_challenge && !code_challenge_method || !code_challenge && code_challenge_method) {
+    return c.redirect(`${c.env.APP_URL}/login?error=oauth_invalid_pkce`);
+  }
+  const state = crypto.randomUUID();
+  await c.env.OAUTH_STATES.put(
+    `oauth:state:${state}`,
+    JSON.stringify({
+      provider,
+      invitationToken: invitationToken || null,
+      redirect: loginRedirect || null,
+      codeChallenge: code_challenge || null,
+      codeChallengeMethod: code_challenge_method || null,
+      mobileRedirectUri: mobileRedirectUri || null
+    }),
+    { expirationTtl: 600 }
+    // 10 minutes
+  );
+  const redirectUri = new URL(`/v1/auth/oauth/${provider}/callback`, c.req.url).toString();
+  const authUrl = new URL(providerConfig.authorizeUrl);
+  authUrl.searchParams.set("client_id", credentials.clientId);
+  authUrl.searchParams.set("redirect_uri", redirectUri);
+  authUrl.searchParams.set("response_type", "code");
+  if (providerConfig.scopes.length > 0) {
+    authUrl.searchParams.set("scope", providerConfig.scopes.join(" "));
+  }
+  authUrl.searchParams.set("state", state);
+  if (provider === "google") {
+    authUrl.searchParams.set("prompt", "select_account");
+  }
+  logger_default.info("OAuth authorize initiated", { provider, hasPkce: !!code_challenge });
+  return c.redirect(authUrl.toString());
+};
+
+// src/routes/oauth/callback.ts
+var import_zod_openapi39 = require("@hono/zod-openapi");
+var import_drizzle_orm32 = require("drizzle-orm");
+var callbackRoute = (0, import_zod_openapi39.createRoute)({
+  method: "get",
+  path: "/{provider}/callback",
+  tags: ["OAuth"],
+  summary: "OAuth provider callback",
+  description: "Handles the redirect from an OAuth provider. Validates CSRF state, exchanges the code for a token, and either starts a login or signup flow.",
+  request: {
+    params: oauthProviderParamSchema,
+    query: oauthCallbackQuerySchema
+  },
+  responses: {
+    302: { description: "Redirect to app with login code or signup token" }
+  }
+});
+var callbackHandler = async (c) => {
+  const { provider } = c.req.valid("param");
+  const { code, state, error } = c.req.valid("query");
+  const appUrl = c.env.APP_URL;
+  if (error) {
+    logger_default.info("OAuth provider returned error", { provider, error });
+    const errorType = error === "access_denied" || error === "consent_required" ? "oauth_cancelled" : "oauth_failed";
+    return c.redirect(`${appUrl}/login?error=${errorType}`);
+  }
+  if (!code || !state) {
+    logger_default.warn("Missing code or state in OAuth callback", { provider });
+    return c.redirect(`${appUrl}/login?error=oauth_failed`);
+  }
+  const storedState = await c.env.OAUTH_STATES.get(`oauth:state:${state}`);
+  if (!storedState) {
+    logSecurityEvent("oauth_csrf_attempt", "high", { state, provider });
+    return c.redirect(`${appUrl}/login?error=oauth_expired`);
+  }
+  let stateData;
+  try {
+    stateData = JSON.parse(storedState);
+  } catch (err) {
+    logError(err, { context: "oauth_state_parse", provider });
+    return c.redirect(`${appUrl}/login?error=oauth_failed`);
+  }
+  if (stateData.provider !== provider) {
+    logSecurityEvent("oauth_csrf_attempt", "high", { state, provider });
+    return c.redirect(`${appUrl}/login?error=oauth_expired`);
+  }
+  await c.env.OAUTH_STATES.delete(`oauth:state:${state}`);
+  const {
+    provider: _stateProvider,
+    invitationToken,
+    redirect: loginRedirect,
+    codeChallenge,
+    codeChallengeMethod,
+    mobileRedirectUri
+  } = stateData;
+  const codeVerifier = c.req.query("code_verifier");
+  if (codeChallenge && codeChallengeMethod === "S256") {
+    if (!codeVerifier) {
+      logger_default.warn("OAuth PKCE: missing code_verifier", { provider });
+      return c.redirect(`${appUrl}/login?error=oauth_pkce_missing`);
+    }
+    const pkceValid = await verifyCodeChallenge(codeVerifier, codeChallenge);
+    if (!pkceValid) {
+      logger_default.warn("OAuth PKCE: invalid code_verifier", { provider });
+      return c.redirect(`${appUrl}/login?error=oauth_pkce_invalid`);
+    }
+  }
+  const providerConfig = PROVIDERS[provider];
+  if (!providerConfig) {
+    return c.redirect(`${appUrl}/login?error=oauth_failed`);
+  }
+  const credentials = getProviderCredentials(provider, c.env);
+  if (!credentials) {
+    return c.redirect(`${appUrl}/login?error=oauth_not_configured`);
+  }
+  const redirectUri = new URL(`/v1/auth/oauth/${provider}/callback`, c.req.url).toString();
+  try {
+    const tokenResponse = await fetch(providerConfig.tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: credentials.clientId,
+        client_secret: credentials.clientSecret
+      }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!tokenResponse.ok) {
+      const body = await tokenResponse.text();
+      logError(new Error(`OAuth token exchange failed: ${tokenResponse.status} ${body}`), {
+        context: "oauth_token_exchange",
+        provider
+      });
+      return c.redirect(`${appUrl}/login?error=oauth_failed`);
+    }
+    const tokenData = await tokenResponse.json();
+    if (!tokenData.access_token) {
+      logError(new Error("No access_token in OAuth response"), {
+        context: "oauth_token_exchange",
+        provider
+      });
+      return c.redirect(`${appUrl}/login?error=oauth_failed`);
+    }
+    const userinfoResponse = await fetch(providerConfig.userinfoUrl, {
+      headers: { Authorization: `Bearer ${tokenData.access_token}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!userinfoResponse.ok) {
+      logError(new Error(`OAuth userinfo failed: ${userinfoResponse.status}`), {
+        context: "oauth_userinfo",
+        provider
+      });
+      return c.redirect(`${appUrl}/login?error=oauth_failed`);
+    }
+    const userInfo = await userinfoResponse.json();
+    const email = providerConfig.emailExtractor(userInfo)?.toLowerCase();
+    const providerUserId = providerConfig.userIdExtractor(userInfo);
+    if (!email) {
+      logger_default.warn("No email returned from OAuth provider", { provider });
+      return c.redirect(`${appUrl}/login?error=oauth_no_email`);
+    }
+    if (!providerUserId) {
+      logger_default.warn("No user ID returned from OAuth provider", { provider });
+      return c.redirect(`${appUrl}/login?error=oauth_failed`);
+    }
+    const { db, schema } = getAuthContext(c);
+    const [existingUser] = await db.select({ id: schema.users.id, email: schema.users.email }).from(schema.users).where((0, import_drizzle_orm32.eq)(schema.users.email, email)).limit(1);
+    if (existingUser) {
+      const loginCode = crypto.randomUUID();
+      await c.env.OAUTH_STATES.put(
+        `oauth:login:${loginCode}`,
+        JSON.stringify({
+          userId: existingUser.id,
+          email: existingUser.email,
+          provider,
+          providerUserId,
+          redirect: loginRedirect,
+          invitationToken
+        }),
+        { expirationTtl: 60 }
+      );
+      logSecurityEvent("oauth_login_initiated", "low", {
+        userId: existingUser.id,
+        email: existingUser.email,
+        provider
+      });
+      if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
+        const mobileUrl = new URL(mobileRedirectUri);
+        mobileUrl.searchParams.set("code", loginCode);
+        mobileUrl.searchParams.set("action", "login");
+        return c.redirect(mobileUrl.toString());
+      }
+      return c.redirect(`${appUrl}/auth/callback?code=${loginCode}&action=login`);
+    } else {
+      const signupToken = crypto.randomUUID();
+      await c.env.OAUTH_STATES.put(
+        `oauth:signup:${signupToken}`,
+        JSON.stringify({ email, provider, providerUserId, invitationToken }),
+        { expirationTtl: 600 }
+      );
+      logger_default.info("OAuth signup initiated", { provider, email });
+      if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
+        const mobileUrl = new URL(mobileRedirectUri);
+        mobileUrl.searchParams.set("oauth_token", signupToken);
+        mobileUrl.searchParams.set("email", email);
+        if (invitationToken) {
+          mobileUrl.searchParams.set("invitation", invitationToken);
+        }
+        return c.redirect(mobileUrl.toString());
+      }
+      let signupUrl = `${appUrl}/signup?oauth_token=${signupToken}&email=${encodeURIComponent(email)}`;
+      if (invitationToken) signupUrl += `&invitation=${invitationToken}`;
+      return c.redirect(signupUrl);
+    }
+  } catch (err) {
+    logError(err, { context: "oauth_callback", provider });
+    return c.redirect(`${appUrl}/login?error=oauth_failed`);
+  }
+};
+
+// src/routes/oauth/complete.ts
+var import_zod_openapi40 = require("@hono/zod-openapi");
+var import_drizzle_orm33 = require("drizzle-orm");
+var completeRoute = (0, import_zod_openapi40.createRoute)({
+  method: "post",
+  path: "/complete",
+  tags: ["OAuth"],
+  summary: "Complete OAuth login",
+  description: "Exchanges a one-time login code (from the OAuth callback) for a session cookie. Called by the /auth/callback frontend page.",
+  request: {
+    body: {
+      content: { "application/json": { schema: oauthCompleteRequestSchema } },
+      required: true
+    }
+  },
+  responses: {
+    200: {
+      description: "Session created successfully",
+      content: { "application/json": { schema: oauthCompleteResponseSchema } }
+    },
+    401: {
+      description: "Invalid or expired login code",
+      content: { "application/json": { schema: errorResponseSchema4 } }
+    }
+  }
+});
+var completeMiddleware = [
+  rateLimit({
+    identifier: (c) => c.req.header("cf-connecting-ip") || "unknown",
+    action: "oauth_complete",
+    maxAttempts: 10,
+    windowMs: 9e5
+    // 15 minutes
+  })
+];
+var completeHandler = async (c) => {
+  const { code } = c.req.valid("json");
+  const stored = await c.env.OAUTH_STATES.get(`oauth:login:${code}`);
+  if (!stored) {
+    return problems.unauthorized(c, "Invalid or expired login code");
+  }
+  await c.env.OAUTH_STATES.delete(`oauth:login:${code}`);
+  const {
+    userId,
+    email,
+    provider,
+    providerUserId,
+    redirect: storedRedirect
+  } = JSON.parse(stored);
+  const { db, schema } = getAuthContext(c);
+  await db.update(schema.users).set({ emailVerified: true }).where((0, import_drizzle_orm33.eq)(schema.users.id, userId));
+  await db.insert(schema.oauthAccounts).values({ userId, provider, providerUserId, email }).onConflictDoNothing();
+  const fingerprint = await generateFingerprint(c.req.raw);
+  const ipAddress = getClientIp(c.req.raw);
+  const sessionId = await createSession(db, { sessions: schema.sessions }, userId, fingerprint, ipAddress);
+  const redirect = storedRedirect?.startsWith("/") && !storedRedirect.startsWith("//") ? storedRedirect : "/";
+  logger_default.info("OAuth login completed", { userId, provider, sessionId: sessionId.slice(0, 8) });
+  logSecurityEvent("oauth_login_success", "low", {
+    userId,
+    email,
+    provider,
+    ip: c.req.header("cf-connecting-ip")
+  });
+  return c.json(
+    { message: "Login successful", redirect, user: { id: userId, email, emailVerified: true } },
+    200,
+    { "Set-Cookie": setSessionCookie(sessionId, c.env) }
+  );
+};
+
+// src/routes/oauth/index.ts
+var oauth = new import_zod_openapi41.OpenAPIHono();
+oauth.use("/complete", ...completeMiddleware);
+var oauthRoutes = oauth.openapi(authorizeRoute, authorizeHandler).openapi(callbackRoute, callbackHandler).openapi(completeRoute, completeHandler);
+var oauth_default = oauthRoutes;
 
 // src/routes/index.ts
-var auth = new import_zod_openapi37.OpenAPIHono();
+var auth = new import_zod_openapi42.OpenAPIHono();
 auth.use("*", csrf);
 auth.use("/signup", ...signupMiddleware);
-auth.openapi(signupRoute, signupHandler);
 auth.use("/login", ...loginMiddleware);
-auth.openapi(loginRoute, loginHandler);
-auth.openapi(logoutRoute, logoutHandler);
 auth.use("/me", ...meMiddleware);
-auth.openapi(meRoute, meHandler);
-auth.openapi(verifyEmailRoute, verifyEmailHandler);
 auth.use("/forgot-password", ...forgotPasswordMiddleware);
-auth.openapi(forgotPasswordRoute, forgotPasswordHandler);
 auth.use("/reset-password", ...resetPasswordMiddleware);
-auth.openapi(resetPasswordRoute, resetPasswordHandler);
 auth.use("/change-password", ...changePasswordMiddleware);
-auth.openapi(changePasswordRoute, changePasswordHandler);
 auth.use("/heartbeat", ...heartbeatMiddleware);
-auth.openapi(heartbeatRoute, heartbeatHandler);
 auth.use("/change-email", ...changeEmailMiddleware);
-auth.openapi(changeEmailRoute, changeEmailHandler);
-auth.openapi(confirmEmailChangeRoute, confirmEmailChangeHandler);
-auth.openapi(cancelEmailChangeRoute, cancelEmailChangeHandler);
 auth.use("/account", ...deleteAccountMiddleware);
-auth.openapi(deleteAccountRoute, deleteAccountHandler);
 auth.use("/refresh", ...refreshMiddleware);
-auth.openapi(refreshRoute, refreshHandler);
 auth.use("/resend-verification", ...resendVerificationMiddleware);
-auth.openapi(resendVerificationRoute, resendVerificationHandler);
-auth.route("/2fa", fa_default);
-var routes_default = auth;
+var authRoutes = auth.openapi(signupRoute, signupHandler).openapi(loginRoute, loginHandler).openapi(logoutRoute, logoutHandler).openapi(meRoute, meHandler).openapi(verifyEmailRoute, verifyEmailHandler).openapi(forgotPasswordRoute, forgotPasswordHandler).openapi(resetPasswordRoute, resetPasswordHandler).openapi(changePasswordRoute, changePasswordHandler).openapi(heartbeatRoute, heartbeatHandler).openapi(changeEmailRoute, changeEmailHandler).openapi(confirmEmailChangeRoute, confirmEmailChangeHandler).openapi(cancelEmailChangeRoute, cancelEmailChangeHandler).openapi(deleteAccountRoute, deleteAccountHandler).openapi(refreshRoute, refreshHandler).openapi(resendVerificationRoute, resendVerificationHandler).route("/2fa", fa_default).route("/oauth", oauth_default);
+var routes_default = authRoutes;
 
 // src/lib/email/webhook-verifier.ts
 var import_svix = require("svix");