@syncello/auth 2.5.1 → 3.2.0

package/dist/index.js

@@ -507,16 +507,16 @@ function createDeviceToken() {
   };
 }
 async function validateTrustedDevice(db, userTrustedDevicesTable, userId, tokenHash) {
-  const { eq: eq31, and: and14, gt: gt6 } = await import("drizzle-orm");
+  const { eq: eq33, and: and14, gt: gt6 } = await import("drizzle-orm");
   const [device] = await db.select().from(userTrustedDevicesTable).where(
     and14(
-      eq31(userTrustedDevicesTable.userId, userId),
-      eq31(userTrustedDevicesTable.tokenHash, tokenHash),
+      eq33(userTrustedDevicesTable.userId, userId),
+      eq33(userTrustedDevicesTable.tokenHash, tokenHash),
       gt6(userTrustedDevicesTable.expiresAt, Date.now())
     )
   ).limit(1);
   if (device) {
-    await db.update(userTrustedDevicesTable).set({ lastUsedAt: Date.now() }).where(eq31(userTrustedDevicesTable.id, device.id));
+    await db.update(userTrustedDevicesTable).set({ lastUsedAt: Date.now() }).where(eq33(userTrustedDevicesTable.id, device.id));
     return true;
   }
   return false;
@@ -1438,7 +1438,7 @@ var requireVerifiedEmail = createMiddleware4(
 );
 
 // src/routes/index.ts
-import { OpenAPIHono as OpenAPIHono2 } from "@hono/zod-openapi";
+import { OpenAPIHono as OpenAPIHono3 } from "@hono/zod-openapi";
 
 // src/routes/signup.ts
 import { createRoute } from "@hono/zod-openapi";
@@ -2181,13 +2181,92 @@ var ResendAdapter = class {
   }
 };
 
+// src/lib/email/adapters/cloudflare-adapter.ts
+var CloudflareEmailAdapter = class {
+  constructor(binding, options) {
+    this.binding = binding;
+    this.options = options;
+  }
+  binding;
+  options;
+  providerName = "cloudflare";
+  async send(options) {
+    if (this.options.dryRun) {
+      logger_default.info("Cloudflare: Dry-run, email not sent", {
+        provider: this.providerName,
+        to: options.to,
+        from: options.from,
+        subject: options.subject
+      });
+      return { success: true, emailId: "dry-run" };
+    }
+    try {
+      logger_default.info("Cloudflare: Sending email", {
+        provider: this.providerName,
+        to: options.to,
+        subject: options.subject
+      });
+      const result = await this.binding.send({
+        to: options.to,
+        from: options.from,
+        subject: options.subject,
+        html: options.html,
+        text: options.text,
+        headers: options.tags ? Object.fromEntries(
+          Object.entries(options.tags).map(([name, value]) => [`X-Tag-${name}`, value])
+        ) : void 0
+      });
+      logger_default.info("Cloudflare: Email sent successfully", {
+        provider: this.providerName,
+        emailId: result.messageId,
+        to: options.to
+      });
+      return { success: true, emailId: result.messageId };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      const code = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : void 0;
+      const errorText = code ? `${code}: ${message}` : message;
+      if (code === "E_RECIPIENT_SUPPRESSED") {
+        logger_default.warn("Cloudflare: Recipient is on the suppression list", {
+          provider: this.providerName,
+          to: options.to
+        });
+      } else {
+        logger_default.error("Cloudflare send error", {
+          provider: this.providerName,
+          error: errorText,
+          to: options.to,
+          subject: options.subject
+        });
+      }
+      return { success: false, error: errorText };
+    }
+  }
+};
+
 // src/lib/email/adapters/factory.ts
 function createEmailAdapter(env) {
-  logger_default.info("Creating email adapter", { provider: "resend" });
-  if (!env.RESEND_API_KEY) {
-    throw new Error("RESEND_API_KEY is required");
+  const provider = env.EMAIL_PROVIDER ?? "resend";
+  logger_default.info("Creating email adapter", { provider });
+  switch (provider) {
+    case "resend":
+      if (!env.RESEND_API_KEY) {
+        throw new Error("RESEND_API_KEY is required");
+      }
+      return new ResendAdapter(env.RESEND_API_KEY);
+    case "cloudflare": {
+      if (!env.EMAIL) {
+        throw new Error(
+          'EMAIL send_email binding is required when EMAIL_PROVIDER=cloudflare - add [[send_email]] name = "EMAIL" to wrangler.toml'
+        );
+      }
+      const environment = env.ENVIRONMENT?.toLowerCase();
+      const dryRun = environment !== "production" && environment !== "staging";
+      return new CloudflareEmailAdapter(env.EMAIL, { dryRun });
+    }
+    default:
+      throw new Error(`Unknown EMAIL_PROVIDER: ${String(provider)}`);
   }
-  return new ResendAdapter(env.RESEND_API_KEY);
 }
 
 // src/lib/email/email-service.ts
@@ -2195,6 +2274,9 @@ var EmailService = class {
   adapter;
   env;
   get fromAddress() {
+    if (this.env.EMAIL_FROM) {
+      return this.env.EMAIL_FROM;
+    }
     const appName = this.env.APP_NAME ?? "Your App";
     const appUrl = this.env.APP_URL ?? "";
     let domain = "example.com";
@@ -2816,19 +2898,19 @@ var signupRequestSchema = z.object({
 var loginRequestSchema = z.object({
   email: z.string().email().openapi({ example: "user@example.com" }),
   password: z.string().min(1).openapi({ example: "SecurePass123!" }),
-  turnstileToken: z.string().min(1).openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
+  turnstileToken: z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
 }).openapi("LoginRequest");
 var verifyEmailRequestSchema = z.object({
   token: z.string().min(1).openapi({ example: "verification-token-abc123" })
 }).openapi("VerifyEmailRequest");
 var forgotPasswordRequestSchema = z.object({
   email: z.string().email().openapi({ example: "user@example.com" }),
-  turnstileToken: z.string().min(1).openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
+  turnstileToken: z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
 }).openapi("ForgotPasswordRequest");
 var resetPasswordRequestSchema = z.object({
   token: z.string().min(1).openapi({ example: "reset-token-xyz789" }),
   password: z.string().min(8).openapi({ example: "NewSecurePass456!" }),
-  turnstileToken: z.string().min(1).openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
+  turnstileToken: z.string().optional().openapi({ example: "XXXX.DUMMY.TOKEN.XXXX" })
 }).openapi("ResetPasswordRequest");
 var changePasswordRequestSchema = z.object({
   currentPassword: z.string().min(1).openapi({ example: "OldPassword123!" }),
@@ -3051,7 +3133,8 @@ var signupHandler = async (c) => {
       verificationUrl,
       firstName: newUser.name || void 0
     },
-    database
+    database,
+    schema.users
   );
   const fingerprint = await generateFingerprint(c.req.raw);
   const ipAddress = getClientIp(c.req.raw);
@@ -3525,7 +3608,7 @@ var forgotPasswordRoute = createRoute6({
 });
 var forgotPasswordHandler = async (c) => {
   const { email, turnstileToken } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -3536,7 +3619,11 @@ var forgotPasswordHandler = async (c) => {
   if (!turnstileValid) {
     return problems.badRequest(c, "Invalid captcha");
   }
-  const resetResult = await createPasswordResetToken(database, email);
+  const resetResult = await createPasswordResetToken(
+    database,
+    { users: schema.users, passwordResetTokens: schema.passwordResetTokens },
+    email
+  );
   if (!resetResult) {
     return c.json({ success: true });
   }
@@ -3548,7 +3635,8 @@ var forgotPasswordHandler = async (c) => {
       token: resetResult.token,
       resetUrl
     },
-    database
+    database,
+    schema.users
   );
   logSecurityEvent("password_reset_requested", "medium", { userId: resetResult.userId });
   return c.json({ success: true });
@@ -3690,7 +3778,7 @@ var changePasswordHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c, "Not authenticated");
   const { currentPassword, newPassword } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const passwordValidation = validatePassword(newPassword);
   if (!passwordValidation.valid) {
@@ -3707,7 +3795,8 @@ var changePasswordHandler = async (c) => {
     newPassword,
     currentSessionId,
     pepper: env.PASSWORD_PEPPER_V1,
-    db: database
+    db: database,
+    tables: { users: schema.users, sessions: schema.sessions }
   });
   if (!result.success) {
     return problems.badRequest(c, result.error || "Failed to change password");
@@ -3786,7 +3875,7 @@ var changeEmailHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c, "Not authenticated");
   const { password, newEmail } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const appUrl = env.APP_URL || "http://localhost:5173";
   const result = await requestEmailChange({
@@ -3794,7 +3883,8 @@ var changeEmailHandler = async (c) => {
     password,
     newEmail,
     pepper: env.PASSWORD_PEPPER_V1,
-    db: database
+    db: database,
+    tables: { users: schema.users, emailChangeTokens: schema.emailChangeTokens }
   });
   if (!result.success) {
     if (result.error === "Incorrect password") {
@@ -3806,7 +3896,8 @@ var changeEmailHandler = async (c) => {
   const confirmUrl = `${appUrl}/confirm-email-change?token=${result.confirmToken}`;
   const confirmResult = await emailService.sendEmailChangeConfirmation(
     { newEmail, confirmUrl },
-    database
+    database,
+    schema.users
   );
   if (!confirmResult.success) {
     return problems.badRequest(
@@ -3817,7 +3908,8 @@ var changeEmailHandler = async (c) => {
   const cancelUrl = `${appUrl}/cancel-email-change?token=${result.cancelToken}`;
   await emailService.sendEmailChangeNotification(
     { oldEmail: result.oldEmail, newEmail, cancelUrl },
-    database
+    database,
+    schema.users
   );
   logSecurityEvent("email_change_requested", "medium", { userId });
   return c.json({ success: true });
@@ -3858,8 +3950,12 @@ var confirmEmailChangeRoute = createRoute11({
 });
 var confirmEmailChangeHandler = async (c) => {
   const { token } = c.req.valid("json");
-  const database = c.get("db");
-  const result = await confirmEmailChange({ token, db: database });
+  const { db: database, schema } = getAuthContext(c);
+  const result = await confirmEmailChange({
+    token,
+    db: database,
+    tables: { users: schema.users, emailChangeTokens: schema.emailChangeTokens }
+  });
   if (!result.success) {
     return problems.badRequest(c, result.error || "Invalid or expired token");
   }
@@ -3900,8 +3996,12 @@ var cancelEmailChangeRoute = createRoute12({
 });
 var cancelEmailChangeHandler = async (c) => {
   const { token } = c.req.valid("json");
-  const database = c.get("db");
-  const result = await cancelEmailChange({ token, db: database });
+  const { db: database, schema } = getAuthContext(c);
+  const result = await cancelEmailChange({
+    token,
+    db: database,
+    tables: { emailChangeTokens: schema.emailChangeTokens }
+  });
   if (!result.success) {
     return problems.badRequest(c, result.error || "Invalid or expired token");
   }
@@ -4040,7 +4140,7 @@ var refreshHandler = async (c) => {
   if (!session) {
     return problems.unauthorized(c, "Invalid or expired refresh token");
   }
-  await deleteSession(db, session.id);
+  await deleteSession(db, { sessions: schema.sessions }, session.id);
   const newSessionId = await createSession(
     db,
     { sessions: schema.sessions },
@@ -4131,7 +4231,8 @@ var resendVerificationHandler = async (c) => {
       verificationUrl,
       firstName: user.name || void 0
     },
-    db
+    db,
+    schema.users
   );
   logger_default.info("Verification email resent", { userId: user.id, email: user.email });
   return c.json({
@@ -4457,7 +4558,8 @@ var totpVerifyHandler = async (c) => {
     const firstName = user.name?.split(" ")[0] || null;
     await emailService.send2faEnabledEmail(
       { email: user.email, firstName, method: "totp" },
-      db
+      db,
+      schema.users
     );
   }
   logSecurityEvent("2fa_totp_enrolled", "high", { userId });
@@ -4514,12 +4616,12 @@ var totpDisableHandler = async (c) => {
   if (remaining.length === 0) {
     await db.delete(schema.userBackupCodes).where(eq22(schema.userBackupCodes.userId, userId));
     await db.delete(schema.userTrustedDevices).where(eq22(schema.userTrustedDevices.userId, userId));
-    await invalidateAllUserSessions(db, userId);
+    await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
     const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq22(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env);
       const firstName = user.name?.split(" ")[0] || null;
-      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db);
+      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db, schema.users);
     }
     logSecurityEvent("2fa_disabled", "critical", { userId, lastMethod: "totp" });
     return c.json({ success: true, sessionInvalidated: true });
@@ -4575,7 +4677,7 @@ var emailSetupHandler = async (c) => {
   await env.OAUTH_STATES.put(`email_2fa_setup:${userId}`, codeHash, { expirationTtl: 300 });
   const emailService = new EmailService(env);
   const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db);
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
   logSecurityEvent("2fa_email_setup_initiated", "low", { userId });
   return c.json({ success: true });
 };
@@ -4656,7 +4758,8 @@ var emailVerifyHandler = async (c) => {
     const firstName = user.name?.split(" ")[0] || null;
     await emailService.send2faEnabledEmail(
       { email: user.email, firstName, method: "email" },
-      db
+      db,
+      schema.users
     );
   }
   logSecurityEvent("2fa_email_enrolled", "high", { userId });
@@ -4710,7 +4813,8 @@ var emailSendCodeHandler = async (c) => {
   const firstName = user.name?.split(" ")[0] || null;
   const emailResult = await emailService.send2faCodeEmail(
     { email: user.email, firstName, code },
-    db
+    db,
+    schema.users
   );
   if (!emailResult.success) {
     return problems.badRequest(
@@ -4772,12 +4876,12 @@ var emailDisableHandler = async (c) => {
   if (remaining.length === 0) {
     await db.delete(schema.userBackupCodes).where(eq26(schema.userBackupCodes.userId, userId));
     await db.delete(schema.userTrustedDevices).where(eq26(schema.userTrustedDevices.userId, userId));
-    await invalidateAllUserSessions(db, userId);
+    await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
     const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where(eq26(schema.users.id, userId)).limit(1);
     if (user) {
       const emailService = new EmailService(env);
       const firstName = user.name?.split(" ")[0] || null;
-      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db);
+      await emailService.send2faDisabledEmail({ email: user.email, firstName }, db, schema.users);
     }
     logSecurityEvent("2fa_disabled", "critical", { userId, lastMethod: "email" });
     return c.json({ success: true, sessionInvalidated: true });
@@ -5098,7 +5202,7 @@ var challengeResendHandler = async (c) => {
   });
   const emailService = new EmailService(c.env);
   const firstName = user.name?.split(" ")[0] || null;
-  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db);
+  await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
   logger_default.info("Email 2FA code resent", { userId: payload.userId });
   return c.json({ success: true });
 };
@@ -5107,11 +5211,8 @@ var challengeResendHandler = async (c) => {
 var twoFa = new OpenAPIHono();
 twoFa.use("*", csrf);
 twoFa.use("/status", requireAuth);
-twoFa.openapi(statusRoute, statusHandler);
 twoFa.use("/totp/setup", requireAuth);
-twoFa.openapi(totpSetupRoute, totpSetupHandler);
 twoFa.use("/totp/verify", requireAuth);
-twoFa.openapi(totpVerifyRoute, totpVerifyHandler);
 twoFa.use(
   "/totp/disable",
   requireAuth,
@@ -5123,11 +5224,8 @@ twoFa.use(
     // 5 attempts per 15 minutes
   })
 );
-twoFa.openapi(totpDisableRoute, totpDisableHandler);
 twoFa.use("/email/setup", requireAuth);
-twoFa.openapi(emailSetupRoute, emailSetupHandler);
 twoFa.use("/email/verify", requireAuth);
-twoFa.openapi(emailVerifyRoute, emailVerifyHandler);
 twoFa.use(
   "/email/send-code",
   requireAuth,
@@ -5139,7 +5237,6 @@ twoFa.use(
     // 3 per 5 minutes
   })
 );
-twoFa.openapi(emailSendCodeRoute, emailSendCodeHandler);
 twoFa.use(
   "/email/disable",
   requireAuth,
@@ -5151,11 +5248,8 @@ twoFa.use(
     // 5 attempts per 15 minutes
   })
 );
-twoFa.openapi(emailDisableRoute, emailDisableHandler);
 twoFa.use("/trusted-devices", requireAuth);
-twoFa.openapi(trustedDevicesGetRoute, trustedDevicesGetHandler);
 twoFa.use("/trusted-devices/:id", requireAuth);
-twoFa.openapi(trustedDevicesDeleteRoute, trustedDevicesDeleteHandler);
 twoFa.use(
   "/backup-codes/regenerate",
   requireAuth,
@@ -5167,7 +5261,6 @@ twoFa.use(
     // 3 per hour per user
   })
 );
-twoFa.openapi(backupCodesRegenerateRoute, backupCodesRegenerateHandler);
 twoFa.use(
   "/challenge",
   rateLimit({
@@ -5178,7 +5271,6 @@ twoFa.use(
     // 10 per 5 min per IP
   })
 );
-twoFa.openapi(challengeRoute, challengeHandler);
 twoFa.use(
   "/challenge/resend",
   rateLimit({
@@ -5189,40 +5281,423 @@ twoFa.use(
     // 3 per 5 min per IP
   })
 );
-twoFa.openapi(challengeResendRoute, challengeResendHandler);
-var fa_default = twoFa;
+var twoFaRoutes = twoFa.openapi(statusRoute, statusHandler).openapi(totpSetupRoute, totpSetupHandler).openapi(totpVerifyRoute, totpVerifyHandler).openapi(totpDisableRoute, totpDisableHandler).openapi(emailSetupRoute, emailSetupHandler).openapi(emailVerifyRoute, emailVerifyHandler).openapi(emailSendCodeRoute, emailSendCodeHandler).openapi(emailDisableRoute, emailDisableHandler).openapi(trustedDevicesGetRoute, trustedDevicesGetHandler).openapi(trustedDevicesDeleteRoute, trustedDevicesDeleteHandler).openapi(backupCodesRegenerateRoute, backupCodesRegenerateHandler).openapi(challengeRoute, challengeHandler).openapi(challengeResendRoute, challengeResendHandler);
+var fa_default = twoFaRoutes;
+
+// src/routes/oauth/index.ts
+import { OpenAPIHono as OpenAPIHono2 } from "@hono/zod-openapi";
+
+// src/routes/oauth/authorize.ts
+import { createRoute as createRoute28 } from "@hono/zod-openapi";
+
+// src/routes/oauth/providers.ts
+var PROVIDERS = {
+  google: {
+    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userinfoUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    scopes: ["email"],
+    emailExtractor: (data) => data.email || null,
+    userIdExtractor: (data) => data.id || null
+  },
+  microsoft: {
+    authorizeUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+    tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+    userinfoUrl: "https://graph.microsoft.com/v1.0/me",
+    scopes: ["openid", "email", "User.Read"],
+    emailExtractor: (data) => data.mail || data.userPrincipalName || null,
+    userIdExtractor: (data) => data.id || null
+  }
+};
+function getProviderCredentials(provider, env) {
+  if (provider === "google" && env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET) {
+    return { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET };
+  }
+  if (provider === "microsoft" && env.MICROSOFT_CLIENT_ID && env.MICROSOFT_CLIENT_SECRET) {
+    return { clientId: env.MICROSOFT_CLIENT_ID, clientSecret: env.MICROSOFT_CLIENT_SECRET };
+  }
+  return null;
+}
+
+// src/routes/oauth/schemas.ts
+import { z as z10 } from "@hono/zod-openapi";
+var oauthProviderParamSchema = z10.object({
+  provider: z10.enum(["google", "microsoft"]).openapi({ example: "google" })
+});
+var oauthAuthorizeQuerySchema = z10.object({
+  redirect: z10.string().optional().openapi({ example: "/dashboard" }),
+  invitationToken: z10.string().optional().openapi({ example: "token123" }),
+  code_challenge: z10.string().min(43).max(128).optional().openapi({ example: "E9Mrozoa2owUednMY..." }),
+  code_challenge_method: z10.enum(["S256"]).optional().openapi({ example: "S256" }),
+  redirect_uri: z10.string().url().optional().openapi({ example: "myapp://oauth-callback" })
+}).openapi("OAuthAuthorizeQuery");
+var oauthCallbackQuerySchema = z10.object({
+  code: z10.string().optional(),
+  state: z10.string().optional(),
+  error: z10.string().optional()
+});
+var oauthCompleteRequestSchema = z10.object({
+  code: z10.string().uuid("Invalid code format").openapi({ example: "a1b2c3d4-..." })
+}).openapi("OAuthCompleteRequest");
+var oauthCompleteResponseSchema = z10.object({
+  message: z10.string().openapi({ example: "Login successful" }),
+  redirect: z10.string().openapi({ example: "/" }),
+  user: z10.object({
+    id: z10.string().uuid(),
+    email: z10.string().email(),
+    emailVerified: z10.boolean()
+  })
+}).openapi("OAuthCompleteResponse");
+var errorResponseSchema4 = z10.object({
+  type: z10.string().url(),
+  title: z10.string(),
+  status: z10.number().int(),
+  detail: z10.string().optional()
+}).openapi("ErrorResponse");
+
+// src/routes/oauth/authorize.ts
+var authorizeRoute = createRoute28({
+  method: "get",
+  path: "/{provider}/authorize",
+  tags: ["OAuth"],
+  summary: "Start OAuth login flow",
+  description: "Generates a CSRF state token and redirects the user to the OAuth provider.",
+  request: {
+    params: oauthProviderParamSchema,
+    query: oauthAuthorizeQuerySchema
+  },
+  responses: {
+    302: { description: "Redirect to OAuth provider or error page" }
+  }
+});
+var authorizeHandler = async (c) => {
+  const { provider } = c.req.valid("param");
+  const {
+    redirect: loginRedirect,
+    invitationToken,
+    code_challenge,
+    code_challenge_method,
+    redirect_uri: mobileRedirectUri
+  } = c.req.valid("query");
+  const providerConfig = PROVIDERS[provider];
+  if (!providerConfig) {
+    return c.redirect(`${c.env.APP_URL}/login?error=oauth_invalid_provider`);
+  }
+  const credentials = getProviderCredentials(provider, c.env);
+  if (!credentials) {
+    logError(new Error(`OAuth credentials not configured for ${provider}`), {
+      context: "oauth_authorize",
+      provider
+    });
+    return c.redirect(`${c.env.APP_URL}/login?error=oauth_not_configured`);
+  }
+  if (code_challenge && !code_challenge_method || !code_challenge && code_challenge_method) {
+    return c.redirect(`${c.env.APP_URL}/login?error=oauth_invalid_pkce`);
+  }
+  const state = crypto.randomUUID();
+  await c.env.OAUTH_STATES.put(
+    `oauth:state:${state}`,
+    JSON.stringify({
+      provider,
+      invitationToken: invitationToken || null,
+      redirect: loginRedirect || null,
+      codeChallenge: code_challenge || null,
+      codeChallengeMethod: code_challenge_method || null,
+      mobileRedirectUri: mobileRedirectUri || null
+    }),
+    { expirationTtl: 600 }
+    // 10 minutes
+  );
+  const redirectUri = new URL(`/v1/auth/oauth/${provider}/callback`, c.req.url).toString();
+  const authUrl = new URL(providerConfig.authorizeUrl);
+  authUrl.searchParams.set("client_id", credentials.clientId);
+  authUrl.searchParams.set("redirect_uri", redirectUri);
+  authUrl.searchParams.set("response_type", "code");
+  if (providerConfig.scopes.length > 0) {
+    authUrl.searchParams.set("scope", providerConfig.scopes.join(" "));
+  }
+  authUrl.searchParams.set("state", state);
+  if (provider === "google") {
+    authUrl.searchParams.set("prompt", "select_account");
+  }
+  logger_default.info("OAuth authorize initiated", { provider, hasPkce: !!code_challenge });
+  return c.redirect(authUrl.toString());
+};
+
+// src/routes/oauth/callback.ts
+import { createRoute as createRoute29 } from "@hono/zod-openapi";
+import { eq as eq31 } from "drizzle-orm";
+var callbackRoute = createRoute29({
+  method: "get",
+  path: "/{provider}/callback",
+  tags: ["OAuth"],
+  summary: "OAuth provider callback",
+  description: "Handles the redirect from an OAuth provider. Validates CSRF state, exchanges the code for a token, and either starts a login or signup flow.",
+  request: {
+    params: oauthProviderParamSchema,
+    query: oauthCallbackQuerySchema
+  },
+  responses: {
+    302: { description: "Redirect to app with login code or signup token" }
+  }
+});
+var callbackHandler = async (c) => {
+  const { provider } = c.req.valid("param");
+  const { code, state, error } = c.req.valid("query");
+  const appUrl = c.env.APP_URL;
+  if (error) {
+    logger_default.info("OAuth provider returned error", { provider, error });
+    const errorType = error === "access_denied" || error === "consent_required" ? "oauth_cancelled" : "oauth_failed";
+    return c.redirect(`${appUrl}/login?error=${errorType}`);
+  }
+  if (!code || !state) {
+    logger_default.warn("Missing code or state in OAuth callback", { provider });
+    return c.redirect(`${appUrl}/login?error=oauth_failed`);
+  }
+  const storedState = await c.env.OAUTH_STATES.get(`oauth:state:${state}`);
+  if (!storedState) {
+    logSecurityEvent("oauth_csrf_attempt", "high", { state, provider });
+    return c.redirect(`${appUrl}/login?error=oauth_expired`);
+  }
+  let stateData;
+  try {
+    stateData = JSON.parse(storedState);
+  } catch (err) {
+    logError(err, { context: "oauth_state_parse", provider });
+    return c.redirect(`${appUrl}/login?error=oauth_failed`);
+  }
+  if (stateData.provider !== provider) {
+    logSecurityEvent("oauth_csrf_attempt", "high", { state, provider });
+    return c.redirect(`${appUrl}/login?error=oauth_expired`);
+  }
+  await c.env.OAUTH_STATES.delete(`oauth:state:${state}`);
+  const {
+    provider: _stateProvider,
+    invitationToken,
+    redirect: loginRedirect,
+    codeChallenge,
+    codeChallengeMethod,
+    mobileRedirectUri
+  } = stateData;
+  const codeVerifier = c.req.query("code_verifier");
+  if (codeChallenge && codeChallengeMethod === "S256") {
+    if (!codeVerifier) {
+      logger_default.warn("OAuth PKCE: missing code_verifier", { provider });
+      return c.redirect(`${appUrl}/login?error=oauth_pkce_missing`);
+    }
+    const pkceValid = await verifyCodeChallenge(codeVerifier, codeChallenge);
+    if (!pkceValid) {
+      logger_default.warn("OAuth PKCE: invalid code_verifier", { provider });
+      return c.redirect(`${appUrl}/login?error=oauth_pkce_invalid`);
+    }
+  }
+  const providerConfig = PROVIDERS[provider];
+  if (!providerConfig) {
+    return c.redirect(`${appUrl}/login?error=oauth_failed`);
+  }
+  const credentials = getProviderCredentials(provider, c.env);
+  if (!credentials) {
+    return c.redirect(`${appUrl}/login?error=oauth_not_configured`);
+  }
+  const redirectUri = new URL(`/v1/auth/oauth/${provider}/callback`, c.req.url).toString();
+  try {
+    const tokenResponse = await fetch(providerConfig.tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: credentials.clientId,
+        client_secret: credentials.clientSecret
+      }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!tokenResponse.ok) {
+      const body = await tokenResponse.text();
+      logError(new Error(`OAuth token exchange failed: ${tokenResponse.status} ${body}`), {
+        context: "oauth_token_exchange",
+        provider
+      });
+      return c.redirect(`${appUrl}/login?error=oauth_failed`);
+    }
+    const tokenData = await tokenResponse.json();
+    if (!tokenData.access_token) {
+      logError(new Error("No access_token in OAuth response"), {
+        context: "oauth_token_exchange",
+        provider
+      });
+      return c.redirect(`${appUrl}/login?error=oauth_failed`);
+    }
+    const userinfoResponse = await fetch(providerConfig.userinfoUrl, {
+      headers: { Authorization: `Bearer ${tokenData.access_token}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!userinfoResponse.ok) {
+      logError(new Error(`OAuth userinfo failed: ${userinfoResponse.status}`), {
+        context: "oauth_userinfo",
+        provider
+      });
+      return c.redirect(`${appUrl}/login?error=oauth_failed`);
+    }
+    const userInfo = await userinfoResponse.json();
+    const email = providerConfig.emailExtractor(userInfo)?.toLowerCase();
+    const providerUserId = providerConfig.userIdExtractor(userInfo);
+    if (!email) {
+      logger_default.warn("No email returned from OAuth provider", { provider });
+      return c.redirect(`${appUrl}/login?error=oauth_no_email`);
+    }
+    if (!providerUserId) {
+      logger_default.warn("No user ID returned from OAuth provider", { provider });
+      return c.redirect(`${appUrl}/login?error=oauth_failed`);
+    }
+    const { db, schema } = getAuthContext(c);
+    const [existingUser] = await db.select({ id: schema.users.id, email: schema.users.email }).from(schema.users).where(eq31(schema.users.email, email)).limit(1);
+    if (existingUser) {
+      const loginCode = crypto.randomUUID();
+      await c.env.OAUTH_STATES.put(
+        `oauth:login:${loginCode}`,
+        JSON.stringify({
+          userId: existingUser.id,
+          email: existingUser.email,
+          provider,
+          providerUserId,
+          redirect: loginRedirect,
+          invitationToken
+        }),
+        { expirationTtl: 60 }
+      );
+      logSecurityEvent("oauth_login_initiated", "low", {
+        userId: existingUser.id,
+        email: existingUser.email,
+        provider
+      });
+      if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
+        const mobileUrl = new URL(mobileRedirectUri);
+        mobileUrl.searchParams.set("code", loginCode);
+        mobileUrl.searchParams.set("action", "login");
+        return c.redirect(mobileUrl.toString());
+      }
+      return c.redirect(`${appUrl}/auth/callback?code=${loginCode}&action=login`);
+    } else {
+      const signupToken = crypto.randomUUID();
+      await c.env.OAUTH_STATES.put(
+        `oauth:signup:${signupToken}`,
+        JSON.stringify({ email, provider, providerUserId, invitationToken }),
+        { expirationTtl: 600 }
+      );
+      logger_default.info("OAuth signup initiated", { provider, email });
+      if (mobileRedirectUri && isDeepLinkUri(mobileRedirectUri)) {
+        const mobileUrl = new URL(mobileRedirectUri);
+        mobileUrl.searchParams.set("oauth_token", signupToken);
+        mobileUrl.searchParams.set("email", email);
+        if (invitationToken) {
+          mobileUrl.searchParams.set("invitation", invitationToken);
+        }
+        return c.redirect(mobileUrl.toString());
+      }
+      let signupUrl = `${appUrl}/signup?oauth_token=${signupToken}&email=${encodeURIComponent(email)}`;
+      if (invitationToken) signupUrl += `&invitation=${invitationToken}`;
+      return c.redirect(signupUrl);
+    }
+  } catch (err) {
+    logError(err, { context: "oauth_callback", provider });
+    return c.redirect(`${appUrl}/login?error=oauth_failed`);
+  }
+};
+
+// src/routes/oauth/complete.ts
+import { createRoute as createRoute30 } from "@hono/zod-openapi";
+import { eq as eq32 } from "drizzle-orm";
+var completeRoute = createRoute30({
+  method: "post",
+  path: "/complete",
+  tags: ["OAuth"],
+  summary: "Complete OAuth login",
+  description: "Exchanges a one-time login code (from the OAuth callback) for a session cookie. Called by the /auth/callback frontend page.",
+  request: {
+    body: {
+      content: { "application/json": { schema: oauthCompleteRequestSchema } },
+      required: true
+    }
+  },
+  responses: {
+    200: {
+      description: "Session created successfully",
+      content: { "application/json": { schema: oauthCompleteResponseSchema } }
+    },
+    401: {
+      description: "Invalid or expired login code",
+      content: { "application/json": { schema: errorResponseSchema4 } }
+    }
+  }
+});
+var completeMiddleware = [
+  rateLimit({
+    identifier: (c) => c.req.header("cf-connecting-ip") || "unknown",
+    action: "oauth_complete",
+    maxAttempts: 10,
+    windowMs: 9e5
+    // 15 minutes
+  })
+];
+var completeHandler = async (c) => {
+  const { code } = c.req.valid("json");
+  const stored = await c.env.OAUTH_STATES.get(`oauth:login:${code}`);
+  if (!stored) {
+    return problems.unauthorized(c, "Invalid or expired login code");
+  }
+  await c.env.OAUTH_STATES.delete(`oauth:login:${code}`);
+  const {
+    userId,
+    email,
+    provider,
+    providerUserId,
+    redirect: storedRedirect
+  } = JSON.parse(stored);
+  const { db, schema } = getAuthContext(c);
+  await db.update(schema.users).set({ emailVerified: true }).where(eq32(schema.users.id, userId));
+  await db.insert(schema.oauthAccounts).values({ userId, provider, providerUserId, email }).onConflictDoNothing();
+  const fingerprint = await generateFingerprint(c.req.raw);
+  const ipAddress = getClientIp(c.req.raw);
+  const sessionId = await createSession(db, { sessions: schema.sessions }, userId, fingerprint, ipAddress);
+  const redirect = storedRedirect?.startsWith("/") && !storedRedirect.startsWith("//") ? storedRedirect : "/";
+  logger_default.info("OAuth login completed", { userId, provider, sessionId: sessionId.slice(0, 8) });
+  logSecurityEvent("oauth_login_success", "low", {
+    userId,
+    email,
+    provider,
+    ip: c.req.header("cf-connecting-ip")
+  });
+  return c.json(
+    { message: "Login successful", redirect, user: { id: userId, email, emailVerified: true } },
+    200,
+    { "Set-Cookie": setSessionCookie(sessionId, c.env) }
+  );
+};
+
+// src/routes/oauth/index.ts
+var oauth = new OpenAPIHono2();
+oauth.use("/complete", ...completeMiddleware);
+var oauthRoutes = oauth.openapi(authorizeRoute, authorizeHandler).openapi(callbackRoute, callbackHandler).openapi(completeRoute, completeHandler);
+var oauth_default = oauthRoutes;
 
 // src/routes/index.ts
-var auth = new OpenAPIHono2();
+var auth = new OpenAPIHono3();
 auth.use("*", csrf);
 auth.use("/signup", ...signupMiddleware);
-auth.openapi(signupRoute, signupHandler);
 auth.use("/login", ...loginMiddleware);
-auth.openapi(loginRoute, loginHandler);
-auth.openapi(logoutRoute, logoutHandler);
 auth.use("/me", ...meMiddleware);
-auth.openapi(meRoute, meHandler);
-auth.openapi(verifyEmailRoute, verifyEmailHandler);
 auth.use("/forgot-password", ...forgotPasswordMiddleware);
-auth.openapi(forgotPasswordRoute, forgotPasswordHandler);
 auth.use("/reset-password", ...resetPasswordMiddleware);
-auth.openapi(resetPasswordRoute, resetPasswordHandler);
 auth.use("/change-password", ...changePasswordMiddleware);
-auth.openapi(changePasswordRoute, changePasswordHandler);
 auth.use("/heartbeat", ...heartbeatMiddleware);
-auth.openapi(heartbeatRoute, heartbeatHandler);
 auth.use("/change-email", ...changeEmailMiddleware);
-auth.openapi(changeEmailRoute, changeEmailHandler);
-auth.openapi(confirmEmailChangeRoute, confirmEmailChangeHandler);
-auth.openapi(cancelEmailChangeRoute, cancelEmailChangeHandler);
 auth.use("/account", ...deleteAccountMiddleware);
-auth.openapi(deleteAccountRoute, deleteAccountHandler);
 auth.use("/refresh", ...refreshMiddleware);
-auth.openapi(refreshRoute, refreshHandler);
 auth.use("/resend-verification", ...resendVerificationMiddleware);
-auth.openapi(resendVerificationRoute, resendVerificationHandler);
-auth.route("/2fa", fa_default);
-var routes_default = auth;
+var authRoutes = auth.openapi(signupRoute, signupHandler).openapi(loginRoute, loginHandler).openapi(logoutRoute, logoutHandler).openapi(meRoute, meHandler).openapi(verifyEmailRoute, verifyEmailHandler).openapi(forgotPasswordRoute, forgotPasswordHandler).openapi(resetPasswordRoute, resetPasswordHandler).openapi(changePasswordRoute, changePasswordHandler).openapi(heartbeatRoute, heartbeatHandler).openapi(changeEmailRoute, changeEmailHandler).openapi(confirmEmailChangeRoute, confirmEmailChangeHandler).openapi(cancelEmailChangeRoute, cancelEmailChangeHandler).openapi(deleteAccountRoute, deleteAccountHandler).openapi(refreshRoute, refreshHandler).openapi(resendVerificationRoute, resendVerificationHandler).route("/2fa", fa_default).route("/oauth", oauth_default);
+var routes_default = authRoutes;
 
 // src/lib/email/webhook-verifier.ts
 import { Webhook } from "svix";
@@ -5250,6 +5725,7 @@ function verifyWebhookSignature(payload, signature, secret) {
 export {
   AUTH_DEFAULTS,
   CHALLENGE_TTL_MS,
+  CloudflareEmailAdapter,
   EmailService,
   MAX_CHALLENGE_ATTEMPTS,
   ProblemTypes,