@thecodeorigin/auth 0.0.1

package/dist/runtime/app/middleware/casl.global.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("#app").RouteMiddleware;
+export default _default;

package/dist/runtime/app/middleware/casl.global.js

@@ -0,0 +1,17 @@
+import { defineNuxtRouteMiddleware, navigateTo, useNuxtApp } from "#app";
+export default defineNuxtRouteMiddleware((to) => {
+  const required = to.meta.can ?? [];
+  if (!required.length)
+    return;
+  const { $ability } = useNuxtApp();
+  const ok = required.every((r) => {
+    const idx = r.indexOf(":");
+    if (idx === -1)
+      return false;
+    const subject = r.slice(0, idx);
+    const action = r.slice(idx + 1);
+    return $ability.can(action, subject);
+  });
+  if (!ok)
+    return navigateTo("/403");
+});

package/dist/runtime/app/plugins/0.session.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("#app").Plugin<Record<string, unknown>> & import("#app").ObjectPlugin<Record<string, unknown>>;
+export default _default;

package/dist/runtime/app/plugins/0.session.js

@@ -0,0 +1,11 @@
+import { defineNuxtPlugin, useRequestFetch, useState } from "#app";
+export default defineNuxtPlugin(async () => {
+  const session = useState("tco-auth-session", () => null);
+  if (session.value === null) {
+    try {
+      session.value = await useRequestFetch()("/api/_auth/session");
+    } catch {
+      session.value = null;
+    }
+  }
+});

package/dist/runtime/app/plugins/ability.d.ts

@@ -0,0 +1,7 @@
+import type { MongoAbility } from '@casl/ability';
+declare const _default: import("#app").Plugin<{
+    ability: MongoAbility<import("@casl/ability").AbilityTuple, import("@casl/ability").MongoQuery>;
+}> & import("#app").ObjectPlugin<{
+    ability: MongoAbility<import("@casl/ability").AbilityTuple, import("@casl/ability").MongoQuery>;
+}>;
+export default _default;

package/dist/runtime/app/plugins/ability.js

@@ -0,0 +1,23 @@
+import { createMongoAbility } from "@casl/ability";
+import { abilitiesPlugin } from "@casl/vue";
+import { watch } from "vue";
+import { defineNuxtPlugin, useState } from "#app";
+export default defineNuxtPlugin((nuxtApp) => {
+  const session = useState("tco-auth-session", () => null);
+  const ability = createMongoAbility([]);
+  nuxtApp.vueApp.use(abilitiesPlugin, ability, { useGlobalProperties: true });
+  function rules() {
+    const s = session.value;
+    if (!s)
+      return [];
+    if (s.systemRole === "admin")
+      return [{ action: "manage", subject: "all" }];
+    return (s.abilities ?? []).map((a) => ({
+      action: a.action,
+      subject: a.subject,
+      ...a.conditions ? { conditions: a.conditions } : {}
+    }));
+  }
+  watch(session, () => ability.update(rules()), { immediate: true, deep: true });
+  return { provide: { ability } };
+});

package/dist/runtime/server/api/_auth/impersonatable-users.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<unknown>>;
+export default _default;

package/dist/runtime/server/api/_auth/impersonatable-users.get.js

@@ -0,0 +1,9 @@
+import { createError, defineEventHandler, getQuery } from "h3";
+import { idpFetch } from "../../utils/idp.js";
+import { readSessionRecord } from "../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const s = await readSessionRecord(event);
+  if (!s)
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  return idpFetch(event, s.id, s.rec, "/api/auth/rp/impersonatable-users", { query: getQuery(event) });
+});

package/dist/runtime/server/api/_auth/impersonate.post.d.ts

@@ -0,0 +1,36 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    user: {
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    };
+    abilities: {
+        action: string;
+        subject: string;
+        conditions?: Record<string, string> | undefined;
+    }[];
+    systemRole: string | null;
+    organizations: {
+        id: string;
+        slug: string;
+        name: string;
+        role: string;
+        personal: boolean;
+    }[];
+    activeOrg: string | null;
+    entitlement: {
+        product: string;
+        plan: string;
+        status: string;
+        active: boolean;
+        currentPeriodEnd: number | null;
+    } | null;
+    impersonator: {
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    } | null;
+}>>;
+export default _default;

package/dist/runtime/server/api/_auth/impersonate.post.js

@@ -0,0 +1,36 @@
+import { createError, defineEventHandler, readValidatedBody } from "h3";
+import { z } from "zod";
+import { idpFetch } from "../../utils/idp.js";
+import { newSessionId, readSessionRecord, toPublicSession, writeSessionRecord } from "../../utils/session.js";
+const bodySchema = z.object({ userId: z.string() });
+export default defineEventHandler(async (event) => {
+  const s = await readSessionRecord(event);
+  if (!s)
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  if (s.rec.isImpersonation)
+    throw createError({ statusCode: 400, statusMessage: "Already impersonating" });
+  const { userId } = await readValidatedBody(event, bodySchema.parse);
+  const res = await idpFetch(event, s.id, s.rec, "/api/auth/rp/impersonate", {
+    method: "POST",
+    body: { userId }
+  });
+  const backupId = newSessionId();
+  await writeSessionRecord(backupId, { ...s.rec, isImpersonation: false });
+  s.rec = {
+    sub: res.user.sub,
+    user: { sub: res.user.sub, email: res.user.email, name: res.user.name ?? null, picture: res.user.picture ?? null },
+    abilities: res.claims.abilities,
+    systemRole: null,
+    organizations: res.claims.organizations,
+    activeOrg: res.claims.org,
+    entitlement: res.claims.entitlement,
+    accessToken: res.accessToken,
+    refreshToken: null,
+    accessExpiresAt: res.expiresAt,
+    isImpersonation: true,
+    impersonator: { sub: s.rec.user.sub, email: s.rec.user.email, name: s.rec.user.name, picture: s.rec.user.picture },
+    backupId
+  };
+  await writeSessionRecord(s.id, s.rec);
+  return toPublicSession(s.rec);
+});

package/dist/runtime/server/api/_auth/organizations/switch.post.d.ts

@@ -0,0 +1,36 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    user: {
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    };
+    abilities: {
+        action: string;
+        subject: string;
+        conditions?: Record<string, string> | undefined;
+    }[];
+    systemRole: string | null;
+    organizations: {
+        id: string;
+        slug: string;
+        name: string;
+        role: string;
+        personal: boolean;
+    }[];
+    activeOrg: string | null;
+    entitlement: {
+        product: string;
+        plan: string;
+        status: string;
+        active: boolean;
+        currentPeriodEnd: number | null;
+    } | null;
+    impersonator: {
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    } | null;
+}>>;
+export default _default;

package/dist/runtime/server/api/_auth/organizations/switch.post.js

@@ -0,0 +1,16 @@
+import { createError, defineEventHandler, readValidatedBody } from "h3";
+import { z } from "zod";
+import { readSessionRecord, toPublicSession, writeSessionRecord } from "../../../utils/session.js";
+const bodySchema = z.object({ organizationId: z.string() });
+export default defineEventHandler(async (event) => {
+  const s = await readSessionRecord(event);
+  if (!s)
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  const { organizationId } = await readValidatedBody(event, bodySchema.parse);
+  const org = s.rec.organizations.find((o) => o.id === organizationId);
+  if (!org)
+    throw createError({ statusCode: 403, statusMessage: "Not a member of that organization" });
+  s.rec.activeOrg = org.id;
+  await writeSessionRecord(s.id, s.rec);
+  return toPublicSession(s.rec);
+});

package/dist/runtime/server/api/_auth/organizations.get.d.ts

@@ -0,0 +1,8 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    id: string;
+    slug: string;
+    name: string;
+    role: string;
+    personal: boolean;
+}[]>>;
+export default _default;

package/dist/runtime/server/api/_auth/organizations.get.js

@@ -0,0 +1,8 @@
+import { createError, defineEventHandler } from "h3";
+import { readSessionRecord } from "../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const s = await readSessionRecord(event);
+  if (!s)
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  return s.rec.organizations;
+});

package/dist/runtime/server/api/_auth/session.get.d.ts

@@ -0,0 +1,36 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    user: {
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    };
+    abilities: {
+        action: string;
+        subject: string;
+        conditions?: Record<string, string> | undefined;
+    }[];
+    systemRole: string | null;
+    organizations: {
+        id: string;
+        slug: string;
+        name: string;
+        role: string;
+        personal: boolean;
+    }[];
+    activeOrg: string | null;
+    entitlement: {
+        product: string;
+        plan: string;
+        status: string;
+        active: boolean;
+        currentPeriodEnd: number | null;
+    } | null;
+    impersonator: {
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    } | null;
+} | null>>;
+export default _default;

package/dist/runtime/server/api/_auth/session.get.js

@@ -0,0 +1,6 @@
+import { defineEventHandler } from "h3";
+import { readSessionRecord, toPublicSession } from "../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const s = await readSessionRecord(event);
+  return s ? toPublicSession(s.rec) : null;
+});

package/dist/runtime/server/api/_auth/stop-impersonating.post.d.ts

@@ -0,0 +1,36 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    user: {
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    };
+    abilities: {
+        action: string;
+        subject: string;
+        conditions?: Record<string, string> | undefined;
+    }[];
+    systemRole: string | null;
+    organizations: {
+        id: string;
+        slug: string;
+        name: string;
+        role: string;
+        personal: boolean;
+    }[];
+    activeOrg: string | null;
+    entitlement: {
+        product: string;
+        plan: string;
+        status: string;
+        active: boolean;
+        currentPeriodEnd: number | null;
+    } | null;
+    impersonator: {
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    } | null;
+}>>;
+export default _default;

package/dist/runtime/server/api/_auth/stop-impersonating.post.js

@@ -0,0 +1,21 @@
+import { createError, defineEventHandler } from "h3";
+import { useStorage } from "nitropack/runtime";
+import { idpFetch } from "../../utils/idp.js";
+import { resolveAuthConfig } from "../../utils/oidc.js";
+import { readSessionRecord, readSessionRecordById, toPublicSession, writeSessionRecord } from "../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const s = await readSessionRecord(event);
+  if (!s || !s.rec.isImpersonation)
+    throw createError({ statusCode: 400, statusMessage: "Not impersonating" });
+  try {
+    await idpFetch(event, s.id, s.rec, "/api/auth/rp/stop-impersonating", { method: "POST" });
+  } catch {
+  }
+  const backup = s.rec.backupId ? await readSessionRecordById(s.rec.backupId) : null;
+  if (!backup)
+    throw createError({ statusCode: 500, statusMessage: "Original session missing \u2014 sign in again" });
+  await writeSessionRecord(s.id, backup);
+  const cfg = resolveAuthConfig();
+  await useStorage(cfg.storageBase).removeItem(`session:${s.rec.backupId}`);
+  return toPublicSession(backup);
+});

package/dist/runtime/server/index.d.ts

@@ -0,0 +1,2 @@
+export { getServerAuthSession } from './utils/session.js';
+export type { ServerAuthSession } from './utils/session.js';

package/dist/runtime/server/index.js

@@ -0,0 +1 @@
+export { getServerAuthSession } from "./utils/session.js";

package/dist/runtime/server/routes/callback.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/routes/callback.get.js

@@ -0,0 +1,61 @@
+import { defineEventHandler, deleteCookie, getCookie, getQuery, sendRedirect } from "h3";
+import { z } from "zod";
+import { UserinfoClaimsSchema } from "../../../contract";
+import { callbackRedirectUri, exchangeCode, fetchUserinfo, resolveAuthConfig, safePath } from "../utils/oidc.js";
+import { newSessionId, setSessionCookie, writeSessionRecord } from "../utils/session.js";
+const RawUserinfoSchema = UserinfoClaimsSchema.extend({
+  sub: z.string(),
+  email: z.string().optional(),
+  email_verified: z.union([z.boolean(), z.string()]).optional(),
+  name: z.string().optional(),
+  picture: z.string().optional()
+});
+export default defineEventHandler(async (event) => {
+  const cfg = resolveAuthConfig();
+  const q = getQuery(event);
+  const fail = (e) => sendRedirect(event, `${cfg.routes.error}?error=${encodeURIComponent(e)}`);
+  if (q.error)
+    return fail(String(q.error));
+  const state = getCookie(event, "tco_state");
+  const verifier = getCookie(event, "tco_verifier");
+  const redirectTo = safePath(getCookie(event, "tco_redirect"), cfg.routes.home);
+  for (const c of ["tco_state", "tco_verifier", "tco_redirect"])
+    deleteCookie(event, c, { path: cfg.routes.callback });
+  if (!q.code || !q.state || !state || q.state !== state || !verifier)
+    return fail("invalid_state");
+  let tokens;
+  let userinfoRaw;
+  try {
+    tokens = await exchangeCode(cfg, String(q.code), verifier, callbackRedirectUri(event, cfg));
+    userinfoRaw = await fetchUserinfo(cfg, tokens.access_token);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    console.error("[auth:callback] exchange failed:", detail);
+    return fail("token_exchange_failed");
+  }
+  const parsed = RawUserinfoSchema.safeParse(userinfoRaw);
+  if (!parsed.success)
+    return fail("userinfo_invalid");
+  const u = parsed.data;
+  const verified = u.email_verified === true || u.email_verified === "true";
+  if (!u.sub || !u.email || !verified)
+    return fail("email_unverified");
+  const id = newSessionId();
+  await writeSessionRecord(id, {
+    sub: u.sub,
+    user: { sub: u.sub, email: u.email, name: u.name ?? null, picture: u.picture ?? null },
+    abilities: u.abilities,
+    systemRole: u.role,
+    organizations: u.organizations,
+    activeOrg: u.org,
+    entitlement: u.entitlement,
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token ?? null,
+    accessExpiresAt: Date.now() + (tokens.expires_in ?? 3600) * 1e3,
+    isImpersonation: false,
+    impersonator: null,
+    backupId: null
+  });
+  await setSessionCookie(event, id);
+  return sendRedirect(event, redirectTo);
+});

package/dist/runtime/server/routes/sign-in.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/routes/sign-in.get.js

@@ -0,0 +1,24 @@
+import { createError, defineEventHandler, getQuery, sendRedirect, setCookie } from "h3";
+import { withQuery } from "ufo";
+import { callbackRedirectUri, pkceChallenge, randomString, resolveAuthConfig, safePath } from "../utils/oidc.js";
+export default defineEventHandler(async (event) => {
+  const cfg = resolveAuthConfig();
+  if (!cfg.issuer || !cfg.clientId || !cfg.clientSecret)
+    throw createError({ statusCode: 503, statusMessage: "Auth not configured" });
+  const state = randomString(32);
+  const verifier = randomString(64);
+  const redirectTo = safePath(getQuery(event).redirect, cfg.routes.home);
+  const opts = { httpOnly: true, secure: !import.meta.dev, sameSite: "lax", maxAge: 600, path: cfg.routes.callback };
+  setCookie(event, "tco_state", state, opts);
+  setCookie(event, "tco_verifier", verifier, opts);
+  setCookie(event, "tco_redirect", redirectTo, opts);
+  return sendRedirect(event, withQuery(`${cfg.issuer}/oauth2/authorize`, {
+    client_id: cfg.clientId,
+    redirect_uri: callbackRedirectUri(event, cfg),
+    response_type: "code",
+    scope: cfg.scopes.join(" "),
+    state,
+    code_challenge: await pkceChallenge(verifier),
+    code_challenge_method: "S256"
+  }));
+});

package/dist/runtime/server/routes/sign-out.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/routes/sign-out.get.js

@@ -0,0 +1,19 @@
+import { defineEventHandler, sendRedirect } from "h3";
+import { $fetch } from "ofetch";
+import { resolveAuthConfig } from "../utils/oidc.js";
+import { destroySession } from "../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const cfg = resolveAuthConfig();
+  const rec = await destroySession(event);
+  if (rec?.accessToken) {
+    try {
+      await $fetch(`${cfg.issuer}/oauth2/endsession`, {
+        method: "POST",
+        body: new URLSearchParams({ token: rec.refreshToken ?? rec.accessToken }).toString(),
+        headers: { "Content-Type": "application/x-www-form-urlencoded" }
+      });
+    } catch {
+    }
+  }
+  return sendRedirect(event, cfg.routes.home);
+});

package/dist/runtime/server/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "../../../.nuxt/tsconfig.server.json"
+}

package/dist/runtime/server/utils/idp.d.ts

@@ -0,0 +1,11 @@
+import type { H3Event } from 'h3';
+import type { SessionRecord } from './session.js';
+/**
+ * Call an IdP path with the session's bearer token. Refreshes once on expiry/401.
+ * Persists the rotated record. Returns parsed JSON.
+ */
+export declare function idpFetch<T>(event: H3Event, id: string, rec: SessionRecord, path: string, opts?: {
+    method?: string;
+    body?: Record<string, unknown>;
+    query?: Record<string, string | number>;
+}): Promise<T>;

package/dist/runtime/server/utils/idp.js

@@ -0,0 +1,58 @@
+import { createError } from "h3";
+import { $fetch } from "ofetch";
+import { resolveAuthConfig } from "./oidc.js";
+import { readSessionRecordById, writeSessionRecord } from "./session.js";
+const SKEW_MS = 6e4;
+async function refresh(cfg, rec) {
+  if (rec.isImpersonation || !rec.refreshToken)
+    return false;
+  try {
+    const t = await $fetch(
+      `${cfg.issuer}/oauth2/token`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          "Authorization": `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`
+        },
+        body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: rec.refreshToken }).toString()
+      }
+    );
+    rec.accessToken = t.access_token;
+    rec.refreshToken = t.refresh_token ?? rec.refreshToken;
+    rec.accessExpiresAt = Date.now() + (t.expires_in ?? 3600) * 1e3;
+    return true;
+  } catch {
+    return false;
+  }
+}
+export async function idpFetch(event, id, rec, path, opts = {}) {
+  const cfg = resolveAuthConfig();
+  if (!rec.isImpersonation && Date.now() > rec.accessExpiresAt - SKEW_MS) {
+    if (await refresh(cfg, rec))
+      await writeSessionRecord(id, rec);
+  }
+  const call = () => $fetch(`${cfg.issuer}${path}`, {
+    method: opts.method,
+    body: opts.body,
+    query: opts.query,
+    headers: { Authorization: `Bearer ${rec.accessToken}` }
+  });
+  try {
+    return await call();
+  } catch (e) {
+    const status = e?.response?.status;
+    if (status !== 401)
+      throw e;
+    const fresh = await readSessionRecordById(id);
+    if (fresh && fresh.accessToken !== rec.accessToken) {
+      Object.assign(rec, fresh);
+      return call();
+    }
+    if (await refresh(cfg, rec)) {
+      await writeSessionRecord(id, rec);
+      return call();
+    }
+    throw createError({ statusCode: 401, statusMessage: "Session expired" });
+  }
+}

package/dist/runtime/server/utils/oidc.d.ts

@@ -0,0 +1,29 @@
+import type { H3Event } from 'h3';
+export interface ResolvedAuthConfig {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    scopes: string[];
+    routes: {
+        signIn: string;
+        callback: string;
+        signOut: string;
+        home: string;
+        error: string;
+    };
+    cookieName: string;
+    storageBase: string;
+}
+export declare function resolveAuthConfig(): ResolvedAuthConfig;
+export declare function randomString(len?: number): string;
+export declare function pkceChallenge(verifier: string): Promise<string>;
+export declare function callbackRedirectUri(event: H3Event, cfg: ResolvedAuthConfig): string;
+export declare function exchangeCode(cfg: ResolvedAuthConfig, code: string, verifier: string, redirectUri: string): Promise<{
+    access_token: string;
+    refresh_token?: string;
+    expires_in?: number;
+    id_token?: string;
+}>;
+export declare function fetchUserinfo(cfg: ResolvedAuthConfig, accessToken: string): Promise<any>;
+/** Same-origin, path-only redirect target (prevents open redirect). */
+export declare function safePath(target: string | undefined, fallback: string): string;

package/dist/runtime/server/utils/oidc.js

@@ -0,0 +1,62 @@
+import { getRequestHost, getRequestProtocol } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
+import { $fetch } from "ofetch";
+export function resolveAuthConfig() {
+  const rc = useRuntimeConfig();
+  const pub = rc.public.auth ?? {};
+  const priv = rc.auth ?? {};
+  const domain = process.env.NUXT_THECODEORIGIN_DOMAIN || pub.domain || "";
+  return {
+    issuer: process.env.NUXT_THECODEORIGIN_ISSUER || pub.issuer || (domain ? `https://${domain}/api/auth` : ""),
+    clientId: process.env.NUXT_THECODEORIGIN_CLIENT_ID || pub.clientId || "",
+    clientSecret: process.env.NUXT_THECODEORIGIN_CLIENT_SECRET || priv.clientSecret || "",
+    scopes: pub.scopes ?? ["openid", "profile", "email"],
+    routes: pub.routes,
+    cookieName: priv.sessionCookieName || "tco_auth",
+    storageBase: priv.sessionStorageBase || "auth"
+  };
+}
+function b64url(buf) {
+  return btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function randomString(len = 64) {
+  const a = new Uint8Array(len);
+  crypto.getRandomValues(a);
+  return b64url(a.buffer).slice(0, len);
+}
+export async function pkceChallenge(verifier) {
+  return b64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
+}
+export function callbackRedirectUri(event, cfg) {
+  const proto = getRequestProtocol(event);
+  const host = getRequestHost(event);
+  return `${proto}://${host}${cfg.routes.callback}`;
+}
+export async function exchangeCode(cfg, code, verifier, redirectUri) {
+  return $fetch(
+    `${cfg.issuer}/oauth2/token`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Authorization": `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: verifier
+      }).toString()
+    }
+  );
+}
+export async function fetchUserinfo(cfg, accessToken) {
+  return $fetch(`${cfg.issuer}/oauth2/userinfo`, {
+    headers: { Authorization: `Bearer ${accessToken}` }
+  });
+}
+export function safePath(target, fallback) {
+  if (!target || !target.startsWith("/") || target.startsWith("//"))
+    return fallback;
+  return target;
+}