@terrafirmagreg-team/auth 0.1.0 → 1.2.0

package/package.json

@@ -1,24 +1,22 @@
 {
   "name": "@terrafirmagreg-team/auth",
-  "version": "0.1.0",
+  "version": "1.2.0",
   "type": "module",
+  "description": "GitHub OAuth sign-in and cookie sessions",
+  "license": "LGPL-3.0-only",
   "exports": {
     ".": "./src/lib/index.ts",
-    "./*": [
-      "./src/*.ts",
-      "./src/*.tsx",
-      "./src/*/index.ts",
-      "./src/*/index.tsx"
+    "./lib/*": [
+      "./src/lib/*.ts",
+      "./src/lib/*/index.ts"
     ]
   },
   "files": [
-    "src",
-    "styles",
-    "styles.css",
-    "locales"
+    "src"
   ],
   "dependencies": {
-    "@terrafirmagreg-team/data": "0.1.0"
+    "@terrafirmagreg-team/data": "1.2.0",
+    "arctic": "^3.7.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.5"

package/src/lib/adapters.ts

@@ -47,6 +47,9 @@ export function githubCookieAuth({
           )
           .catch(() => null);
         cache.set(token, session);
+        session.then((s) => {
+          if (!s && cache.get(token) === session) cache.delete(token);
+        });
       }
       return session;
     },
@@ -67,3 +70,4 @@ export function devCookieAuth({
     },
   };
 }
+

package/src/lib/config.ts

@@ -12,16 +12,7 @@ export function authMode(): AuthMode {
 
 export function authEnabled() {
   if (authMode() === 'dev') return true;
-  return Boolean(
-    env('COMMENTS_TOKEN_SECRET') && env('GITHUB_COMMENTS_CLIENT_ID'),
-  );
-}
-
-export function authOwnerLogins() {
-  return (env('GITHUB_COMMENTS_OWNER_LOGINS') ?? '')
-    .split(',')
-    .map((login) => login.trim())
-    .filter(Boolean);
+  return Boolean(env('DISCUSSIONS_SECRET') && env('APP_CLIENT_ID'));
 }
 
 export interface AuthConfig {
@@ -38,14 +29,15 @@ export interface AuthConfig {
 
 export function authConfig(): AuthConfig {
   return {
-    clientId: env('GITHUB_COMMENTS_CLIENT_ID')!,
-    clientSecret: env('GITHUB_COMMENTS_CLIENT_SECRET')!,
-    tokenSecret: env('COMMENTS_TOKEN_SECRET')!,
+    clientId: env('APP_CLIENT_ID')!,
+    clientSecret: env('APP_SECRET')!,
+    tokenSecret: env('DISCUSSIONS_SECRET') ?? 'dev-token-secret',
     cookieName: authCookie,
     devCookieName: devAuthCookie,
     callbackPath: '/api/comments/oauth/callback',
     loginPath: '/api/comments/oauth/login',
-    scope: 'public_repo',
+    scope: '',
     mode: authMode(),
   };
 }
+

package/src/lib/index.ts

@@ -2,7 +2,6 @@ export {
   authConfig,
   authEnabled,
   authMode,
-  authOwnerLogins,
   authCookie,
   devAuthCookie,
   type AuthConfig,
@@ -23,3 +22,4 @@ import { authConfig } from './config';
 const flow = createOAuthFlow(authConfig);
 
 export const { login, callback, logout, devLogin } = flow;
+

package/src/lib/oauth.ts

@@ -1,8 +1,7 @@
 import { decrypt, encrypt } from '@terrafirmagreg-team/data';
+import { GitHub } from 'arctic';
 import type { AuthConfig } from './config';
 
-const GITHUB_AUTHORIZE = 'https://github.com/login/oauth/authorize';
-const GITHUB_ACCESS_TOKEN = 'https://github.com/login/oauth/access_token';
 const STATE_TTL = 10 * 60 * 1000;
 const COOKIE_MAX_AGE = 60 * 60 * 24 * 365;
 const COOKIE_BASE = 'Path=/; Max-Age=%d; SameSite=Lax; HttpOnly; Secure';
@@ -78,18 +77,24 @@ button:hover{opacity:.85}
 }
 
 export function createOAuthFlow(getConfig: () => AuthConfig): OAuthFlow {
+  function github(config: AuthConfig, self: string): GitHub {
+    return new GitHub(
+      config.clientId,
+      config.clientSecret,
+      `${self}${config.callbackPath}`,
+    );
+  }
+
   function login(request: Request): Response {
     const config = getConfig();
     if (config.mode === 'dev') return devLoginForm(request, config);
     const self = new URL(request.url).origin;
     const returnUrl = sameOrigin(new URL(request.url).searchParams.get('return'), self);
-    const params = new URLSearchParams({
-      client_id: config.clientId,
-      redirect_uri: `${self}${config.callbackPath}`,
-      scope: config.scope,
-      state: encodeState(returnUrl, config.tokenSecret),
-    });
-    return Response.redirect(`${GITHUB_AUTHORIZE}?${params}`, 302);
+    const url = github(config, self).createAuthorizationURL(
+      encodeState(returnUrl, config.tokenSecret),
+      config.scope.split(' ').filter(Boolean),
+    );
+    return Response.redirect(url, 302);
   }
 
   async function devLogin(request: Request): Promise<Response> {
@@ -134,27 +139,14 @@ export function createOAuthFlow(getConfig: () => AuthConfig): OAuthFlow {
     if (url.searchParams.get('error') || !code)
       return Response.redirect(returnUrl, 302);
     try {
-      const res = await fetch(GITHUB_ACCESS_TOKEN, {
-        method: 'POST',
-        headers: {
-          accept: 'application/json',
-          'content-type': 'application/x-www-form-urlencoded',
-        },
-        body: new URLSearchParams({
-          client_id: config.clientId,
-          client_secret: config.clientSecret,
-          code,
-        }),
-      });
-      const { access_token } = (await res.json()) as { access_token?: string };
-      if (!access_token) throw new Error('no token');
+      const tokens = await github(config, self).validateAuthorizationCode(code);
       return new Response(null, {
         status: 302,
         headers: {
           location: returnUrl,
           'set-cookie': setCookieHeader(
             config.cookieName,
-            encrypt(access_token, config.tokenSecret),
+            encrypt(tokens.accessToken(), config.tokenSecret),
             COOKIE_MAX_AGE,
           ),
         },
@@ -180,3 +172,4 @@ export function createOAuthFlow(getConfig: () => AuthConfig): OAuthFlow {
 
   return { login, devLogin, callback, logout };
 }
+