@tryghost/adapter-base-sso 0.1.0

package/LICENSE

@@ -0,0 +1,22 @@
+Copyright (c) 2013-2026 Ghost Foundation
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,29 @@
+# @tryghost/adapter-base-sso
+
+The adapter-base-sso package for Ghost.
+
+## Develop
+
+This is a workspace package in the Ghost monorepo. From the repo root:
+
+```bash
+pnpm --filter @tryghost/adapter-base-sso build   # compile to build/ with tsc (ESM)
+pnpm --filter @tryghost/adapter-base-sso test    # type-check + unit tests
+pnpm --filter @tryghost/adapter-base-sso dev     # rebuild on change
+```
+
+In-monorepo consumers resolve this package via the `source` export condition
+(raw `src/*.ts`, no build needed in dev/test). Production and any published
+tarball use the compiled `build/` output.
+
+This package is ESM-only and compiled with `tsc` (`module: nodenext`). Relative
+imports in `src/` must carry an explicit extension; write the real `.ts` one —
+`import {x} from './x.ts'` — and `tsc` rewrites it to `.js` on emit
+(`rewriteRelativeImportExtensions`).
+
+`ghost/core` is CommonJS but consumes this package via `require()`, which works
+on Ghost's Node version (22.13+/24) through Node's `require(esm)` support. That
+support has one hard constraint: **no top-level `await`** anywhere in this
+package's module graph — it makes the graph async and `require()` of it throws
+`ERR_REQUIRE_ASYNC_MODULE`. Keep module-level initialization synchronous. (An
+ESLint rule enforces this.)

package/build/base.d.ts

@@ -0,0 +1,50 @@
+import type { Request } from 'express';
+export interface User {
+    id: string;
+    email: string;
+}
+/**
+ * A small set of user lookups that Ghost injects into the SSO adapter, so that
+ * adapter implementations can resolve users without reaching into Ghost's model
+ * layer directly.
+ *
+ * Ghost core provides the implementation (backed by the User model) via
+ * `SSOBase.setUserRepository`; adapter implementations consume it through the
+ * protected `getUserByEmail` / `getOwnerUser` helpers on `SSOBase`.
+ */
+export interface UserRepository {
+    /** Look up a single user by their email address, or `null` if none exists. */
+    getByEmail(email: string): Promise<User | null>;
+    /** Look up the site owner user, or `null` if none exists. */
+    getOwner(): Promise<User | null>;
+}
+export interface SSOAdapter<Token, Lookup> {
+    getRequestCredentials(request: Request): Promise<Token | null>;
+    getIdentityFromCredentials(credentials: Token): Promise<Lookup | null>;
+    getUserForIdentity(identity: Lookup): Promise<User | null>;
+}
+export declare abstract class SSOBase<Token, Lookup> implements SSOAdapter<Token, Lookup> {
+    #private;
+    readonly requiredFns: readonly ['getRequestCredentials', 'getIdentityFromCredentials', 'getUserForIdentity'];
+    constructor();
+    /**
+     * Inject the user repository. Ghost core calls this after constructing the
+     * adapter, supplying an implementation backed by the User model. Adapter
+     * implementations should not call this themselves.
+     */
+    setUserRepository(userRepository: UserRepository): void;
+    /**
+     * Look up a single user by email. Available to adapter implementations so
+     * they can resolve users without depending on Ghost's model layer.
+     */
+    protected getUserByEmail(email: string): Promise<User | null>;
+    /**
+     * Look up the site owner user. Available to adapter implementations so they
+     * can resolve the owner without depending on Ghost's model layer.
+     */
+    protected getOwnerUser(): Promise<User | null>;
+    abstract getRequestCredentials(request: Request): Promise<Token | null>;
+    abstract getIdentityFromCredentials(credentials: Token): Promise<Lookup | null>;
+    abstract getUserForIdentity(identity: Lookup): Promise<User | null>;
+}
+//# sourceMappingURL=base.d.ts.map

package/build/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../src/base.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAGrC,MAAM,WAAW,IAAI;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC3B,8EAA8E;IAC9E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAChD,6DAA6D;IAC7D,QAAQ,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU,CAAC,KAAK,EAAE,MAAM;IACrC,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC/D,0BAA0B,CAAC,WAAW,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,8BAAsB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAE,YAAW,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC;;IAC7E,SAAiB,WAAW,EAAE,SAAS,CAAC,uBAAuB,EAAE,4BAA4B,EAAE,oBAAoB,CAAC,CAAC;IAIrH,cAKC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAEtD;IAWD;;;OAGG;IACH,UAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAElE;IAED;;;OAGG;IACH,UAAgB,YAAY,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAEnD;IAED,QAAQ,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACxE,QAAQ,CAAC,0BAA0B,CAAC,WAAW,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChF,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;CACvE"}

package/build/base.js

@@ -0,0 +1,41 @@
+import errors from '@tryghost/errors';
+export class SSOBase {
+    #userRepository = null;
+    constructor() {
+        Object.defineProperty(this, 'requiredFns', {
+            value: Object.freeze(['getRequestCredentials', 'getIdentityFromCredentials', 'getUserForIdentity']),
+            writable: false,
+        });
+    }
+    /**
+     * Inject the user repository. Ghost core calls this after constructing the
+     * adapter, supplying an implementation backed by the User model. Adapter
+     * implementations should not call this themselves.
+     */
+    setUserRepository(userRepository) {
+        this.#userRepository = userRepository;
+    }
+    get #users() {
+        if (!this.#userRepository) {
+            throw new errors.IncorrectUsageError({
+                message: 'SSO adapter has no user repository configured. Ghost must call setUserRepository() before the adapter is used.'
+            });
+        }
+        return this.#userRepository;
+    }
+    /**
+     * Look up a single user by email. Available to adapter implementations so
+     * they can resolve users without depending on Ghost's model layer.
+     */
+    async getUserByEmail(email) {
+        return this.#users.getByEmail(email);
+    }
+    /**
+     * Look up the site owner user. Available to adapter implementations so they
+     * can resolve the owner without depending on Ghost's model layer.
+     */
+    async getOwnerUser() {
+        return this.#users.getOwner();
+    }
+}
+//# sourceMappingURL=base.js.map

package/build/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../src/base.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,kBAAkB,CAAC;AA6BtC,MAAM,OAAgB,OAAO;IAGzB,eAAe,GAA0B,IAAI,CAAC;IAE9C;QACI,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE;YACvC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,uBAAuB,EAAE,4BAA4B,EAAE,oBAAoB,CAAC,CAAC;YACnG,QAAQ,EAAE,KAAK;SAClB,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,cAA8B;QAC5C,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM;QACN,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YACxB,MAAM,IAAI,MAAM,CAAC,mBAAmB,CAAC;gBACjC,OAAO,EAAE,gHAAgH;aAC5H,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,cAAc,CAAC,KAAa;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,YAAY;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;CAKJ"}

package/build/index.d.ts

@@ -0,0 +1,2 @@
+export * from './base.ts';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/build/index.js

@@ -0,0 +1,2 @@
+export * from './base.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@tryghost/adapter-base-sso",
+  "version": "0.1.0",
+  "description": "The adapter-base-sso package for Ghost.",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TryGhost/Ghost.git",
+    "directory": "packages/adapters/sso-base"
+  },
+  "author": "Ghost Foundation",
+  "license": "MIT",
+  "exports": {
+    ".": {
+      "types": "./build/index.d.ts",
+      "default": "./build/index.js"
+    }
+  },
+  "main": "build/index.js",
+  "types": "build/index.d.ts",
+  "files": [
+    "build"
+  ],
+  "dependencies": {
+    "@tryghost/errors": "1.3.13"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test:unit": "NODE_ENV=testing vitest run --coverage",
+    "test": "pnpm run '/^test:/'",
+    "test:types": "tsc --noEmit -p test/tsconfig.json",
+    "lint:code": "eslint src/ --cache",
+    "lint:test": "eslint test/ --cache",
+    "lint": "pnpm run '/^lint:/'"
+  }
+}