@terrafirmagreg-team/auth 1.2.3 → 1.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@terrafirmagreg-team/auth",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "type": "module",
   "description": "GitHub OAuth sign-in and cookie sessions",
   "license": "LGPL-3.0-only",
@@ -15,11 +15,11 @@
     "src"
   ],
   "dependencies": {
-    "@terrafirmagreg-team/data": "^1.2.4",
-    "arctic": "^3.7.0"
+    "@terrafirmagreg-team/data": "^1.2.5",
+    "oauth4webapi": "^3.8.8"
   },
   "devDependencies": {
-    "@types/node": "^26.6.5"
+    "@types/node": "^26.6.6"
   },
   "repository": {
     "type": "git",

package/src/lib/github-oauth.ts

@@ -0,0 +1,48 @@
+import * as oauth from 'oauth4webapi';
+
+const server: oauth.AuthorizationServer = {
+  issuer: 'https://github.com',
+  authorization_endpoint: 'https://github.com/login/oauth/authorize',
+  token_endpoint: 'https://github.com/login/oauth/access_token',
+};
+
+export interface GitHubOAuth {
+  createAuthorizationURL(state: string, scopes: string[]): URL;
+  validateAuthorizationCode(code: string): Promise<string>;
+}
+
+export function createGitHubOAuth(
+  clientId: string,
+  clientSecret: string,
+  redirectUri: string,
+): GitHubOAuth {
+  const client: oauth.Client = { client_id: clientId };
+  const auth = oauth.ClientSecretPost(clientSecret);
+  return {
+    createAuthorizationURL(state, scopes) {
+      const url = new URL(server.authorization_endpoint!);
+      url.searchParams.set('client_id', clientId);
+      url.searchParams.set('redirect_uri', redirectUri);
+      url.searchParams.set('response_type', 'code');
+      url.searchParams.set('state', state);
+      if (scopes.length > 0) url.searchParams.set('scope', scopes.join(' '));
+      return url;
+    },
+    async validateAuthorizationCode(code) {
+      const res = await oauth.authorizationCodeGrantRequest(
+        server,
+        client,
+        auth,
+        new URLSearchParams({ code }),
+        redirectUri,
+        oauth.nopkce,
+      );
+      const tokens = await oauth.processAuthorizationCodeResponse(
+        server,
+        client,
+        res,
+      );
+      return tokens.access_token;
+    },
+  };
+}

package/src/lib/oauth.ts

@@ -1,5 +1,5 @@
 import { decrypt, encrypt } from '@terrafirmagreg-team/data';
-import { GitHub } from 'arctic';
+import { createGitHubOAuth, type GitHubOAuth } from './github-oauth';
 import type { AuthConfig } from './config';
 
 const STATE_TTL = 10 * 60 * 1000;
@@ -77,8 +77,8 @@ button:hover{opacity:.85}
 }
 
 export function createOAuthFlow(getConfig: () => AuthConfig): OAuthFlow {
-  function github(config: AuthConfig, self: string): GitHub {
-    return new GitHub(
+  function github(config: AuthConfig, self: string): GitHubOAuth {
+    return createGitHubOAuth(
       config.clientId,
       config.clientSecret,
       `${self}${config.callbackPath}`,
@@ -139,14 +139,16 @@ export function createOAuthFlow(getConfig: () => AuthConfig): OAuthFlow {
     if (url.searchParams.get('error') || !code)
       return Response.redirect(returnUrl, 302);
     try {
-      const tokens = await github(config, self).validateAuthorizationCode(code);
+      const accessToken = await github(config, self).validateAuthorizationCode(
+        code,
+      );
       return new Response(null, {
         status: 302,
         headers: {
           location: returnUrl,
           'set-cookie': setCookieHeader(
             config.cookieName,
-            encrypt(tokens.accessToken(), config.tokenSecret),
+            encrypt(accessToken, config.tokenSecret),
             COOKIE_MAX_AGE,
           ),
         },