@vercel/cli-auth 0.0.1

package/oauth.js

@@ -0,0 +1,311 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth = OAuth;
+exports.isOAuthError = isOAuthError;
+const z = __importStar(require("zod/mini"));
+const AuthorizationServerMetadata = z.object({
+    issuer: z.url(),
+    device_authorization_endpoint: z.url(),
+    token_endpoint: z.url(),
+    revocation_endpoint: z.url(),
+    jwks_uri: z.url(),
+    introspection_endpoint: z.url(),
+});
+const DeviceAuthorization = z.object({
+    device_code: z.string(),
+    user_code: z.string(),
+    verification_uri: z.url(),
+    verification_uri_complete: z.url(),
+    expires_in: z.number(),
+    interval: z.number(),
+});
+const IntrospectionResponse = z.object({
+    active: z.boolean(),
+    client_id: z.optional(z.string()),
+    session_id: z.optional(z.string()),
+});
+function OAuth(config) {
+    const { issuer, clientId, userAgent } = config;
+    let as;
+    function assertAs(as) {
+        if (as)
+            return;
+        throw new Error('Authorization Server Metadata not initialized. Call init() first.');
+    }
+    return {
+        async init() {
+            as ??= await this.authorizationServerMetadata();
+            return { ...this, as };
+        },
+        /**
+         * Returns the Authorization Server Metadata
+         *
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
+         */
+        async authorizationServerMetadata() {
+            const response = await fetch(new URL('.well-known/openid-configuration', issuer), {
+                headers: {
+                    'Content-Type': 'application/json',
+                    'user-agent': userAgent,
+                },
+            });
+            const json = await response.json();
+            as = AuthorizationServerMetadata.parse(json);
+            if (as.issuer !== issuer.origin) {
+                throw new OAuthError(`Issuer mismatch: expected ${issuer}, got ${as.issuer}`, json);
+            }
+            return as;
+        },
+        /**
+         * Perform the Device Authorization Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+         */
+        async deviceAuthorizationRequest() {
+            assertAs(as);
+            const response = await fetch(as.device_authorization_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({
+                    client_id: clientId,
+                    scope: 'openid offline_access',
+                }),
+            });
+            const json = await response.json();
+            const parsed = DeviceAuthorization.safeParse(json);
+            if (!parsed.success) {
+                throw new OAuthError(`Failed to parse device authorization response: ${parsed.error.message}`, json);
+            }
+            return {
+                device_code: parsed.data.device_code,
+                user_code: parsed.data.user_code,
+                verification_uri: parsed.data.verification_uri,
+                verification_uri_complete: parsed.data.verification_uri_complete,
+                expiresAt: Date.now() + parsed.data.expires_in * 1000,
+                interval: parsed.data.interval,
+            };
+        },
+        /**
+         * Perform the Device Access Token Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+         */
+        async deviceAccessTokenRequest(device_code) {
+            assertAs(as);
+            try {
+                return [
+                    null,
+                    await fetch(as.token_endpoint, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/x-www-form-urlencoded',
+                            'user-agent': userAgent,
+                        },
+                        body: new URLSearchParams({
+                            client_id: clientId,
+                            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                            device_code,
+                        }),
+                        signal: AbortSignal.timeout(10 * 1000),
+                    }),
+                ];
+            }
+            catch (error) {
+                if (error instanceof Error)
+                    return [error];
+                return [
+                    new Error('An unknown error occurred. See the logs for details.', {
+                        cause: error,
+                    }),
+                ];
+            }
+        },
+        /**
+         * Process the Token request Response
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+         */
+        async processTokenResponse(response) {
+            const json = await response.json();
+            const processed = TokenSet.safeParse(json);
+            if (!processed.success) {
+                return [
+                    new OAuthError(`Failed to parse token response: ${processed.error.message}`, json),
+                ];
+            }
+            return [null, processed.data];
+        },
+        /**
+         * Perform a Token Revocation Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
+         */
+        async revokeToken(token) {
+            assertAs(as);
+            const response = await fetch(as.revocation_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({ token, client_id: clientId }),
+            });
+            if (response.ok)
+                return;
+            const json = await response.json();
+            return new OAuthError('Revocation request failed', json);
+        },
+        /**
+         * Perform Refresh Token Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+         */
+        async refreshToken(token) {
+            assertAs(as);
+            const response = await fetch(as.token_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({
+                    client_id: clientId,
+                    grant_type: 'refresh_token',
+                    refresh_token: token,
+                }),
+            });
+            const [tokensError, tokenSet] = await this.processTokenResponse(response);
+            if (tokensError)
+                throw tokensError;
+            return tokenSet;
+        },
+        /**
+         * Perform Token Introspection Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+         */
+        async introspectToken(token) {
+            assertAs(as);
+            const response = await fetch(as.introspection_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({ token }),
+            });
+            const json = await response.json();
+            const processed = IntrospectionResponse.safeParse(json);
+            if (!processed.success) {
+                throw new OAuthError(`Failed to parse introspection response: ${processed.error.message}`, json);
+            }
+            return processed.data;
+        },
+    };
+}
+const TokenSet = z.object({
+    /** The access token issued by the authorization server. */
+    access_token: z.string(),
+    /** The type of the token issued */
+    token_type: z.literal('Bearer'),
+    /** The lifetime in seconds of the access token. */
+    expires_in: z.number(),
+    /** The refresh token, which can be used to obtain new access tokens. */
+    refresh_token: z.optional(z.string()),
+    /** The scope of the access token. */
+    scope: z.optional(z.string()),
+});
+const OAuthErrorResponse = z.object({
+    error: z.enum([
+        'invalid_request',
+        'invalid_client',
+        'invalid_grant',
+        'unauthorized_client',
+        'unsupported_grant_type',
+        'invalid_scope',
+        'server_error',
+        // Device Authorization Response Errors
+        'authorization_pending',
+        'slow_down',
+        'access_denied',
+        'expired_token',
+        // Revocation Response Errors
+        'unsupported_token_type',
+    ]),
+    error_description: z.optional(z.string()),
+    error_uri: z.optional(z.string()),
+});
+function processOAuthErrorResponse(json) {
+    try {
+        return OAuthErrorResponse.parse(json);
+    }
+    catch (error) {
+        if (error instanceof z.core.$ZodError) {
+            return new TypeError(`Invalid OAuth error response: ${error.message}`);
+        }
+        return new TypeError('Failed to parse OAuth error response');
+    }
+}
+class OAuthError extends Error {
+    constructor(message, response) {
+        super(message);
+        this.name = 'OAuthError';
+        const error = processOAuthErrorResponse(response);
+        if (error instanceof TypeError) {
+            const message = `Unexpected server response: ${JSON.stringify(response)}`;
+            this.cause = new Error(message, { cause: error });
+            this.code = 'server_error';
+            return;
+        }
+        let cause = error.error;
+        if (error.error_description)
+            cause += `: ${error.error_description}`;
+        if (error.error_uri)
+            cause += ` (${error.error_uri})`;
+        this.cause = new Error(cause.toString());
+        this.code = error.error;
+    }
+}
+function isOAuthError(error) {
+    return error instanceof OAuthError;
+}
+//# sourceMappingURL=oauth.js.map

package/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["oauth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,sBAmPC;AA6ED,oCAEC;AAhWD,4CAA8B;AAE9B,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,6BAA6B,EAAE,CAAC,CAAC,GAAG,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,GAAG,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,sBAAsB,EAAE,CAAC,CAAC,GAAG,EAAE;CAChC,CAAC,CAAC;AAMH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,yBAAyB,EAAE,CAAC,CAAC,GAAG,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAEH,SAAgB,KAAK,CAAC,MAIrB;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,IAAI,EAA2C,CAAC;IAEhD,SAAS,QAAQ,CAAC,EAAW;QAC3B,IAAI,EAAE;YAAE,OAAO;QACf,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,EAAE,KAAK,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,2BAA2B;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,EACnD;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,SAAS;iBACxB;aACF,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE7C,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,IAAI,UAAU,CAClB,6BAA6B,MAAM,SAAS,EAAE,CAAC,MAAM,EAAE,EACvD,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,0BAA0B;YAuB9B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,6BAA6B,EAAE;gBAC7D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,QAAQ;oBACnB,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,UAAU,CAClB,kDAAkD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACxE,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;gBAC9C,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB;gBAChE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;aAC/B,CAAC;QACJ,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,wBAAwB,CAC5B,WAAmB;YAEnB,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,OAAO;oBACL,IAAI;oBACJ,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE;wBAC7B,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,mCAAmC;4BACnD,YAAY,EAAE,SAAS;yBACxB;wBACD,IAAI,EAAE,IAAI,eAAe,CAAC;4BACxB,SAAS,EAAE,QAAQ;4BACnB,UAAU,EAAE,8CAA8C;4BAC1D,WAAW;yBACZ,CAAC;wBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;qBACvC,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC3C,OAAO;oBACL,IAAI,KAAK,CAAC,sDAAsD,EAAE;wBAChE,KAAK,EAAE,KAAK;qBACb,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,oBAAoB,CACxB,QAAkB;YAElB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAE3C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO;oBACL,IAAI,UAAU,CACZ,mCAAmC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAC5D,IAAI,CACL;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,mBAAmB,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aAC1D,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO;YACxB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,OAAO,IAAI,UAAU,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,YAAY,CAAC,KAAa;YAC9B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,QAAQ;oBACnB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,KAAK;iBACrB,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC1E,IAAI,WAAW;gBAAE,MAAM,WAAW,CAAC;YACnC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,eAAe,CACnB,KAAa;YAEb,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,sBAAsB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC;aACrC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,UAAU,CAClB,2CAA2C,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EACpE,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAID,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,mDAAmD;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,wEAAwE;IACxE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,qCAAqC;IACrC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAIH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,eAAe;QACf,qBAAqB;QACrB,wBAAwB;QACxB,eAAe;QACf,cAAc;QACd,uCAAuC;QACvC,uBAAuB;QACvB,WAAW;QACX,eAAe;QACf,eAAe;QACf,6BAA6B;QAC7B,wBAAwB;KACzB,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAIH,SAAS,yBAAyB,CAChC,IAAa;IAEb,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,SAAS,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAW,SAAQ,KAAK;IAI5B,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QAJjB,SAAI,GAAG,YAAY,CAAC;QAKlB,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,+BAA+B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB;YAAE,KAAK,IAAI,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACrE,IAAI,KAAK,CAAC,SAAS;YAAE,KAAK,IAAI,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC;QAEtD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;CACF;AAED,SAAgB,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,UAAU,CAAC;AACrC,CAAC"}

package/oauth.ts

@@ -0,0 +1,353 @@
+import * as z from 'zod/mini';
+
+const AuthorizationServerMetadata = z.object({
+  issuer: z.url(),
+  device_authorization_endpoint: z.url(),
+  token_endpoint: z.url(),
+  revocation_endpoint: z.url(),
+  jwks_uri: z.url(),
+  introspection_endpoint: z.url(),
+});
+
+export type AuthorizationServerMetadata = z.infer<
+  typeof AuthorizationServerMetadata
+>;
+
+const DeviceAuthorization = z.object({
+  device_code: z.string(),
+  user_code: z.string(),
+  verification_uri: z.url(),
+  verification_uri_complete: z.url(),
+  expires_in: z.number(),
+  interval: z.number(),
+});
+
+const IntrospectionResponse = z.object({
+  active: z.boolean(),
+  client_id: z.optional(z.string()),
+  session_id: z.optional(z.string()),
+});
+
+export function OAuth(config: {
+  issuer: URL;
+  clientId: string;
+  userAgent: string;
+}) {
+  const { issuer, clientId, userAgent } = config;
+  let as: AuthorizationServerMetadata | undefined;
+
+  function assertAs(as: unknown): asserts as is AuthorizationServerMetadata {
+    if (as) return;
+    throw new Error(
+      'Authorization Server Metadata not initialized. Call init() first.'
+    );
+  }
+
+  return {
+    async init() {
+      as ??= await this.authorizationServerMetadata();
+      return { ...this, as };
+    },
+    /**
+     * Returns the Authorization Server Metadata
+     *
+     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
+     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
+     */
+    async authorizationServerMetadata(): Promise<AuthorizationServerMetadata> {
+      const response = await fetch(
+        new URL('.well-known/openid-configuration', issuer),
+        {
+          headers: {
+            'Content-Type': 'application/json',
+            'user-agent': userAgent,
+          },
+        }
+      );
+
+      const json = await response.json();
+      as = AuthorizationServerMetadata.parse(json);
+
+      if (as.issuer !== issuer.origin) {
+        throw new OAuthError(
+          `Issuer mismatch: expected ${issuer}, got ${as.issuer}`,
+          json
+        );
+      }
+
+      return as;
+    },
+    /**
+     * Perform the Device Authorization Request
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+     */
+    async deviceAuthorizationRequest(): Promise<{
+      /** The device verification code. */
+      device_code: string;
+      /** The end-user verification code. */
+      user_code: string;
+      /**
+       * The minimum amount of time in seconds that the client
+       * SHOULD wait between polling requests to the token endpoint.
+       */
+      interval: number;
+      /** The end-user verification URI on the authorization server. */
+      verification_uri: string;
+      /**
+       * The end-user verification URI on the authorization server,
+       * including the `user_code`, without redirection.
+       */
+      verification_uri_complete: string;
+      /**
+       * The absolute lifetime of the `device_code` and `user_code`.
+       * Calculated from `expires_in`.
+       */
+      expiresAt: number;
+    }> {
+      assertAs(as);
+      const response = await fetch(as.device_authorization_endpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'user-agent': userAgent,
+        },
+        body: new URLSearchParams({
+          client_id: clientId,
+          scope: 'openid offline_access',
+        }),
+      });
+
+      const json = await response.json();
+      const parsed = DeviceAuthorization.safeParse(json);
+
+      if (!parsed.success) {
+        throw new OAuthError(
+          `Failed to parse device authorization response: ${parsed.error.message}`,
+          json
+        );
+      }
+
+      return {
+        device_code: parsed.data.device_code,
+        user_code: parsed.data.user_code,
+        verification_uri: parsed.data.verification_uri,
+        verification_uri_complete: parsed.data.verification_uri_complete,
+        expiresAt: Date.now() + parsed.data.expires_in * 1000,
+        interval: parsed.data.interval,
+      };
+    },
+    /**
+     * Perform the Device Access Token Request
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+     */
+    async deviceAccessTokenRequest(
+      device_code: string
+    ): Promise<[Error] | [null, Response]> {
+      assertAs(as);
+      try {
+        return [
+          null,
+          await fetch(as.token_endpoint, {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/x-www-form-urlencoded',
+              'user-agent': userAgent,
+            },
+            body: new URLSearchParams({
+              client_id: clientId,
+              grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+              device_code,
+            }),
+            signal: AbortSignal.timeout(10 * 1000),
+          }),
+        ];
+      } catch (error) {
+        if (error instanceof Error) return [error];
+        return [
+          new Error('An unknown error occurred. See the logs for details.', {
+            cause: error,
+          }),
+        ];
+      }
+    },
+    /**
+     * Process the Token request Response
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+     */
+    async processTokenResponse(
+      response: Response
+    ): Promise<[OAuthError] | [null, TokenSet]> {
+      const json = await response.json();
+      const processed = TokenSet.safeParse(json);
+
+      if (!processed.success) {
+        return [
+          new OAuthError(
+            `Failed to parse token response: ${processed.error.message}`,
+            json
+          ),
+        ];
+      }
+
+      return [null, processed.data];
+    },
+    /**
+     * Perform a Token Revocation Request.
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
+     */
+    async revokeToken(token: string): Promise<OAuthError | undefined> {
+      assertAs(as);
+      const response = await fetch(as.revocation_endpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'user-agent': userAgent,
+        },
+        body: new URLSearchParams({ token, client_id: clientId }),
+      });
+
+      if (response.ok) return;
+      const json = await response.json();
+
+      return new OAuthError('Revocation request failed', json);
+    },
+    /**
+     * Perform Refresh Token Request.
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+     */
+    async refreshToken(token: string): Promise<TokenSet> {
+      assertAs(as);
+      const response = await fetch(as.token_endpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'user-agent': userAgent,
+        },
+        body: new URLSearchParams({
+          client_id: clientId,
+          grant_type: 'refresh_token',
+          refresh_token: token,
+        }),
+      });
+
+      const [tokensError, tokenSet] = await this.processTokenResponse(response);
+      if (tokensError) throw tokensError;
+      return tokenSet;
+    },
+    /**
+     * Perform Token Introspection Request.
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+     */
+    async introspectToken(
+      token: string
+    ): Promise<z.infer<typeof IntrospectionResponse>> {
+      assertAs(as);
+      const response = await fetch(as.introspection_endpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'user-agent': userAgent,
+        },
+        body: new URLSearchParams({ token }),
+      });
+
+      const json = await response.json();
+      const processed = IntrospectionResponse.safeParse(json);
+      if (!processed.success) {
+        throw new OAuthError(
+          `Failed to parse introspection response: ${processed.error.message}`,
+          json
+        );
+      }
+
+      return processed.data;
+    },
+  };
+}
+
+export type OAuth = ReturnType<typeof OAuth>;
+
+const TokenSet = z.object({
+  /** The access token issued by the authorization server. */
+  access_token: z.string(),
+  /** The type of the token issued */
+  token_type: z.literal('Bearer'),
+  /** The lifetime in seconds of the access token. */
+  expires_in: z.number(),
+  /** The refresh token, which can be used to obtain new access tokens. */
+  refresh_token: z.optional(z.string()),
+  /** The scope of the access token. */
+  scope: z.optional(z.string()),
+});
+
+type TokenSet = z.infer<typeof TokenSet>;
+
+const OAuthErrorResponse = z.object({
+  error: z.enum([
+    'invalid_request',
+    'invalid_client',
+    'invalid_grant',
+    'unauthorized_client',
+    'unsupported_grant_type',
+    'invalid_scope',
+    'server_error',
+    // Device Authorization Response Errors
+    'authorization_pending',
+    'slow_down',
+    'access_denied',
+    'expired_token',
+    // Revocation Response Errors
+    'unsupported_token_type',
+  ]),
+  error_description: z.optional(z.string()),
+  error_uri: z.optional(z.string()),
+});
+
+type OAuthErrorResponse = z.infer<typeof OAuthErrorResponse>;
+
+function processOAuthErrorResponse(
+  json: unknown
+): OAuthErrorResponse | TypeError {
+  try {
+    return OAuthErrorResponse.parse(json);
+  } catch (error) {
+    if (error instanceof z.core.$ZodError) {
+      return new TypeError(`Invalid OAuth error response: ${error.message}`);
+    }
+    return new TypeError('Failed to parse OAuth error response');
+  }
+}
+
+class OAuthError extends Error {
+  name = 'OAuthError';
+  code: OAuthErrorResponse['error'];
+  cause: Error;
+  constructor(message: string, response: unknown) {
+    super(message);
+    const error = processOAuthErrorResponse(response);
+    if (error instanceof TypeError) {
+      const message = `Unexpected server response: ${JSON.stringify(response)}`;
+      this.cause = new Error(message, { cause: error });
+      this.code = 'server_error';
+      return;
+    }
+    let cause = error.error;
+    if (error.error_description) cause += `: ${error.error_description}`;
+    if (error.error_uri) cause += ` (${error.error_uri})`;
+
+    this.cause = new Error(cause.toString());
+    this.code = error.error;
+  }
+}
+
+export function isOAuthError(error: unknown): error is OAuthError {
+  return error instanceof OAuthError;
+}