@voltro/plugin-auth-social 0.34.0

package/dist/index.js

@@ -0,0 +1,721 @@
+import { Effect as e } from "effect";
+import { definePlugin as t } from "@voltro/protocol";
+import { buildSetCookie as n, readCookie as r, timingSafeStringEqual as i } from "@voltro/protocol/session";
+import { createHash as a, createPrivateKey as o, randomBytes as s, sign as c } from "node:crypto";
+import { JwtVerifyError as l, verifyJwt as u } from "@voltro/protocol/jwt";
+import { issueUserSession as d, newAuthId as f, runSubjectGuards as p } from "@voltro/plugin-auth";
+import { and as m, boolean as h, eq as g, generateId as _, id as v, table as y, text as b, timestamp as x } from "@voltro/database";
+//#region src/pkce.ts
+var S = () => s(32).toString("base64url"), ee = (e) => a("sha256").update(e, "ascii").digest().toString("base64url"), C = class extends Error {
+	status;
+	code;
+	constructor(e, t, n) {
+		super(n), this.status = e, this.code = t, this.name = "SocialAuthError";
+	}
+}, w = class extends C {
+	constructor(e) {
+		super(400, "state_mismatch", e), this.name = "SocialStateMismatchError";
+	}
+}, T = class extends C {
+	constructor(e, t, n = 502) {
+		super(n, e, t), this.name = "SocialExchangeError";
+	}
+}, E = class extends C {
+	constructor(e, t) {
+		super(401, e, t), this.name = "SocialIdTokenError";
+	}
+}, D = class extends C {
+	constructor(e) {
+		super(500, "config", e), this.name = "SocialConfigError";
+	}
+}, O = class extends C {
+	constructor(e, t, n = 409) {
+		super(n, e, t), this.name = "SocialAccountLinkError";
+	}
+}, te = {
+	id: "google",
+	label: "Google",
+	authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+	tokenUrl: "https://oauth2.googleapis.com/token",
+	jwksUrl: "https://www.googleapis.com/oauth2/v3/certs",
+	issuer: "https://accounts.google.com",
+	apiBase: null,
+	defaultScopes: [
+		"openid",
+		"email",
+		"profile"
+	],
+	kind: "oidc",
+	responseMode: "query",
+	assertsEmailVerification: !0,
+	pkceEnforced: !0
+}, ne = {
+	id: "github",
+	label: "GitHub",
+	authorizeUrl: "https://github.com/login/oauth/authorize",
+	tokenUrl: "https://github.com/login/oauth/access_token",
+	jwksUrl: null,
+	issuer: null,
+	apiBase: "https://api.github.com",
+	defaultScopes: ["read:user", "user:email"],
+	kind: "oauth2",
+	responseMode: "query",
+	assertsEmailVerification: !0,
+	pkceEnforced: !1
+}, k = {
+	id: "apple",
+	label: "Apple",
+	authorizeUrl: "https://appleid.apple.com/auth/authorize",
+	tokenUrl: "https://appleid.apple.com/auth/token",
+	jwksUrl: "https://appleid.apple.com/auth/keys",
+	issuer: "https://appleid.apple.com",
+	apiBase: null,
+	defaultScopes: ["name", "email"],
+	kind: "oidc",
+	responseMode: "form_post",
+	assertsEmailVerification: !0,
+	pkceEnforced: !0
+}, re = {
+	google: te,
+	github: ne,
+	apple: k
+}, ie = [
+	te,
+	ne,
+	k
+], A = [
+	"google",
+	"github",
+	"apple"
+], j = (e) => e === "google" || e === "github" || e === "apple", M = (e, t = {}) => {
+	if (!j(e)) throw new D(`unknown social provider '${e}' — expected one of ${A.join(", ")}`);
+	return {
+		...re[e],
+		...t.authorizeUrl === void 0 ? {} : { authorizeUrl: t.authorizeUrl },
+		...t.tokenUrl === void 0 ? {} : { tokenUrl: t.tokenUrl },
+		...t.jwksUrl === void 0 ? {} : { jwksUrl: t.jwksUrl },
+		...t.issuer === void 0 ? {} : { issuer: t.issuer },
+		...t.apiBase === void 0 ? {} : { apiBase: t.apiBase }
+	};
+}, N = (e) => {
+	if (!e.clientId) throw new D("socialBeginLogin: `clientId` is required");
+	if (!e.redirectUri) throw new D("socialBeginLogin: `redirectUri` is required");
+	let t = M(e.provider, e.endpoints ?? {}), n = e.randomness?.state ?? S(), r = e.randomness?.codeVerifier ?? S(), i = t.kind === "oidc" ? e.randomness?.nonce ?? S() : "", a = e.scopes ?? t.defaultScopes, o = new URLSearchParams({
+		client_id: e.clientId,
+		redirect_uri: e.redirectUri,
+		response_type: "code",
+		scope: a.join(" "),
+		state: n,
+		code_challenge: ee(r),
+		code_challenge_method: "S256"
+	});
+	return i && o.set("nonce", i), t.responseMode === "form_post" && o.set("response_mode", "form_post"), e.prompt && o.set("prompt", e.prompt), e.loginHint && o.set(t.id === "github" ? "login" : "login_hint", e.loginHint), {
+		provider: t.id,
+		url: `${t.authorizeUrl}?${o.toString()}`,
+		state: n,
+		codeVerifier: r,
+		nonce: i,
+		responseMode: t.responseMode
+	};
+}, P = 15777e3, ae = 900, oe = "https://appleid.apple.com", F = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64url"), I = /* @__PURE__ */ new Map(), se = (e) => {
+	let t = I.get(e);
+	if (t) return t;
+	let n;
+	try {
+		n = o({ key: e });
+	} catch (e) {
+		throw new D(`apple: could not parse the .p8 private key — ${e.message}`);
+	}
+	if (n.asymmetricKeyType !== "ec") throw new D(`apple: the .p8 key must be an EC (P-256) key, got '${String(n.asymmetricKeyType)}'`);
+	let r = n.asymmetricKeyDetails?.namedCurve;
+	if (r !== void 0 && r !== "prime256v1") throw new D(`apple: ES256 requires the P-256 curve (prime256v1), got '${r}'`);
+	return I.set(e, n), n;
+}, L = /* @__PURE__ */ new Map(), ce = () => {
+	I.clear(), L.clear();
+}, R = (e, t, n = Date.now) => {
+	if (!e) throw new D("apple: `clientId` (Services ID) is required");
+	if (!t.teamId) throw new D("apple: `teamId` is required");
+	if (!t.keyId) throw new D("apple: `keyId` is required");
+	if (!t.privateKey) throw new D("apple: `privateKey` (.p8 contents) is required");
+	let r = t.ttlSeconds ?? 900;
+	if (!Number.isFinite(r) || r <= 0) throw new D("apple: `ttlSeconds` must be a positive number");
+	if (r > 15777e3) throw new D(`apple: \`ttlSeconds\` may not exceed ${P} (six months, Apple's cap) — got ${r}`);
+	let i = n(), a = `${t.teamId}\u0000${t.keyId}\u0000${e}\u0000${r}`, o = L.get(a);
+	if (o && o.expiresAtMs - i > 6e4) return o.secret;
+	let s = Math.floor(i / 1e3), l = s + r, u = `${F(JSON.stringify({
+		alg: "ES256",
+		kid: t.keyId,
+		typ: "JWT"
+	}))}.${F(JSON.stringify({
+		iss: t.teamId,
+		iat: s,
+		exp: l,
+		aud: oe,
+		sub: e
+	}))}`, d = `${u}.${c("sha256", Buffer.from(u, "ascii"), {
+		key: se(t.privateKey),
+		dsaEncoding: "ieee-p1363"
+	}).toString("base64url")}`;
+	return L.set(a, {
+		secret: d,
+		expiresAtMs: l * 1e3
+	}), d;
+}, z = (e) => {
+	if (!e) return null;
+	let t;
+	try {
+		t = JSON.parse(e);
+	} catch {
+		return null;
+	}
+	if (typeof t != "object" || !t) return null;
+	let n = t, r = typeof n.name == "object" && n.name !== null ? n.name : {}, i = (e) => typeof e == "string" && e.length > 0 ? e : null, a = {
+		firstName: i(r.firstName),
+		lastName: i(r.lastName),
+		email: i(n.email)
+	};
+	return a.firstName === null && a.lastName === null && a.email === null ? null : a;
+}, B = (e) => e !== null && e.toLowerCase().endsWith("@privaterelay.appleid.com"), V = (e) => ({
+	authorization: `Bearer ${e}`,
+	accept: "application/vnd.github+json",
+	"x-github-api-version": "2022-11-28",
+	"user-agent": "voltro-plugin-auth-social"
+}), H = async (e, t) => {
+	let n = t.fetchImpl ?? fetch, r = await n(`${t.apiBase}/user`, { headers: V(e) });
+	if (!r.ok) {
+		let e = await r.text().catch(() => "");
+		throw new T("exchange_failed", `github: GET /user failed (${r.status}): ${e.slice(0, 200)}`);
+	}
+	let i = await r.json();
+	if (i.id === void 0 || i.id === null || !i.login) throw new T("malformed_token_response", "github: GET /user response is missing id/login");
+	let a = null, o = !1, s = await n(`${t.apiBase}/user/emails`, { headers: V(e) });
+	if (s.ok) {
+		let e = await s.json();
+		if (Array.isArray(e)) {
+			let t = e.find((e) => e.primary === !0 && typeof e.email == "string");
+			t?.email && (a = t.email, o = t.verified === !0);
+		}
+	}
+	return {
+		accountId: String(i.id),
+		login: i.login,
+		name: typeof i.name == "string" && i.name.length > 0 ? i.name : null,
+		avatarUrl: typeof i.avatar_url == "string" && i.avatar_url.length > 0 ? i.avatar_url : null,
+		email: a,
+		emailVerified: o
+	};
+}, U = (e) => e === !0 || e === "true", W = (e) => typeof e == "string" && e.length > 0 ? e : null, G = async (e) => {
+	let t = M(e.provider, e.endpoints ?? {});
+	if (!e.code) throw new C(400, "missing_code", "socialCompleteLogin: missing `code`");
+	if (!e.expectedState) throw new w("socialCompleteLogin: no `expectedState` — the login was never started by this server, or the state cookie expired. Refusing to exchange the code.");
+	if (!e.state || !i(e.state, e.expectedState)) throw new w("socialCompleteLogin: `state` does not match the value minted for this browser (possible login CSRF).");
+	if (!e.codeVerifier) throw new C(400, "missing_verifier", "socialCompleteLogin: missing `codeVerifier` (PKCE)");
+	if (t.kind === "oidc" && !e.expectedNonce) throw new D(`socialCompleteLogin: ${t.id} returns an ID token, so \`expectedNonce\` is required — without it a token captured from another login replays here.`);
+	let n = t.id === "apple" ? R(e.clientId, e.appleKey ?? (() => {
+		throw new D("apple: `appleKey` (teamId + keyId + .p8) is required");
+	})(), e.now ?? Date.now) : e.clientSecret ?? (() => {
+		throw new D(`${t.id}: \`clientSecret\` is required`);
+	})(), r = e.fetchImpl ?? fetch, a = new URLSearchParams({
+		grant_type: "authorization_code",
+		client_id: e.clientId,
+		client_secret: n,
+		code: e.code,
+		redirect_uri: e.redirectUri,
+		code_verifier: e.codeVerifier
+	}), o = await r(t.tokenUrl, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		},
+		body: a.toString()
+	});
+	if (!o.ok) {
+		let e = await o.text().catch(() => "");
+		throw new T("exchange_failed", `${t.id}: token exchange failed (${o.status}): ${e.slice(0, 200)}`);
+	}
+	let s;
+	try {
+		s = await o.json();
+	} catch {
+		throw new T("malformed_token_response", `${t.id}: token endpoint returned a body that is not JSON`);
+	}
+	if (s.error) throw new T("exchange_failed", `${t.id}: token exchange refused: ${s.error}${s.error_description ? ` (${s.error_description})` : ""}`);
+	if (t.kind === "oauth2") {
+		if (!s.access_token) throw new T("malformed_token_response", `${t.id}: token response carries no access_token`);
+		if (!t.apiBase) throw new D(`${t.id}: no apiBase configured`);
+		let n = await H(s.access_token, {
+			apiBase: t.apiBase,
+			...e.fetchImpl === void 0 ? {} : { fetchImpl: e.fetchImpl }
+		});
+		return {
+			provider: t.id,
+			providerAccountId: n.accountId,
+			email: n.email,
+			emailVerified: n.emailVerified,
+			emailIsPrivateRelay: !1,
+			name: n.name ?? n.login,
+			firstName: null,
+			lastName: null,
+			avatarUrl: n.avatarUrl,
+			nameIsFirstAuthorizationOnly: !1,
+			raw: { ...n }
+		};
+	}
+	if (!s.id_token) throw new T("malformed_token_response", `${t.id}: token response carries no id_token`);
+	if (!t.jwksUrl || !t.issuer) throw new D(`${t.id}: no JWKS/issuer configured`);
+	let c;
+	try {
+		c = await u(s.id_token, t.jwksUrl, {
+			issuer: t.issuer,
+			audience: e.clientId
+		});
+	} catch (e) {
+		throw e instanceof l ? new E("id_token_invalid", `${t.id}: id_token ${e.code}: ${e.message}`) : new E("id_token_invalid", `${t.id}: id_token verification failed: ${e.message}`);
+	}
+	let d = W(c.nonce);
+	if (!d || !i(d, e.expectedNonce ?? "")) throw new E("nonce_mismatch", `${t.id}: id_token nonce does not match the value minted for this login (possible replay).`);
+	let f = W(c.sub);
+	if (!f) throw new E("id_token_invalid", `${t.id}: id_token has no sub claim`);
+	let p = W(c.email), m = U(c.email_verified);
+	if (t.id === "apple") {
+		let t = z(e.appleUserPayload), n = U(c.is_private_email) || B(p), r = t?.firstName ?? null, i = t?.lastName ?? null, a = [r, i].filter((e) => e !== null).join(" ");
+		return {
+			provider: "apple",
+			providerAccountId: f,
+			email: p ?? t?.email ?? null,
+			emailVerified: m,
+			emailIsPrivateRelay: n,
+			name: a.length > 0 ? a : null,
+			firstName: r,
+			lastName: i,
+			avatarUrl: null,
+			nameIsFirstAuthorizationOnly: t !== null,
+			raw: c
+		};
+	}
+	return {
+		provider: t.id,
+		providerAccountId: f,
+		email: p,
+		emailVerified: m,
+		emailIsPrivateRelay: !1,
+		name: W(c.name),
+		firstName: W(c.given_name),
+		lastName: W(c.family_name),
+		avatarUrl: W(c.picture),
+		nameIsFirstAuthorizationOnly: !1,
+		raw: c
+	};
+}, K = (e) => {
+	let { profile: t, linkedUserId: n, existingUserIdByEmail: r, policy: i } = e;
+	return n === null ? t.email === null ? {
+		kind: "refuse",
+		error: new O("no_email", `${t.provider} did not return an email address for this account. Add and verify an email with the provider, or sign in another way.`, 400)
+	} : r === null ? { kind: "create-user" } : i === "never" ? {
+		kind: "refuse",
+		error: new O("account_exists_unlinked", `An account already exists for ${t.email}. Sign in with your existing method, then connect ${t.provider} from your account settings.`)
+	} : t.emailVerified ? t.emailIsPrivateRelay ? {
+		kind: "refuse",
+		error: new O("private_relay_email", "This is an Apple private-relay address, which is unique to this app and cannot identify an existing account. Sign in with your existing method, then connect Apple from your account settings.")
+	} : {
+		kind: "link",
+		userId: r
+	} : {
+		kind: "refuse",
+		error: new O("email_not_verified", `${t.provider} did not verify ownership of ${t.email}, so it cannot be attached to the existing account with that address.`)
+	} : {
+		kind: "sign-in",
+		userId: n
+	};
+}, q = (e) => ({
+	kind: "refused",
+	status: e.status,
+	code: e.code,
+	message: e.message
+}), J = (t) => e.gen(function* () {
+	let { profile: n, identities: r, users: i, config: a } = t, o = t.policy ?? "never", s = yield* r.findByProviderAccount(n.provider, n.providerAccountId), c = n.email === null ? null : yield* i.findByEmail(n.email), l = K({
+		profile: n,
+		linkedUserId: s?.userId ?? null,
+		existingUserIdByEmail: c?.id ?? null,
+		policy: o
+	});
+	if (l.kind === "refuse") return q(l.error);
+	let u = null, m = !1, h = !1;
+	if (l.kind === "create-user") {
+		let t = n.email, r = yield* i.insert({
+			id: f("user"),
+			email: t,
+			passwordHash: null,
+			tenantId: a.defaultTenantId
+		}).pipe(e.catchTag("UserAlreadyExistsError", (t) => e.succeed(new O("account_exists_unlinked", `An account already exists for ${t.email}. Sign in with your existing method, then connect ${n.provider} from your account settings.`))));
+		if (r instanceof O) return q(r);
+		u = r, m = !0;
+	} else {
+		if (h = l.kind === "link", u = yield* i.findById(l.userId), !u) return q(new O("account_exists_unlinked", "The account this login is linked to no longer exists.", 409));
+		let e = a.subjectGuards ?? [];
+		if (e.length > 0) {
+			let t = yield* p(e, u);
+			if (!t.ok) return {
+				kind: "refused",
+				status: 403,
+				code: t.code,
+				message: t.message
+			};
+		}
+	}
+	s === null ? yield* r.insert({
+		userId: u.id,
+		provider: n.provider,
+		providerAccountId: n.providerAccountId,
+		email: n.email,
+		emailVerified: n.emailVerified
+	}) : yield* r.touch(s.id, /* @__PURE__ */ new Date());
+	let g = yield* d(u, i, a, {
+		ipAddress: t.ipAddress ?? null,
+		userAgent: t.userAgent ?? null
+	});
+	return {
+		kind: "ok",
+		userId: u.id,
+		subject: g.subject,
+		setCookie: g.setCookie,
+		created: m,
+		linked: h,
+		oneTimeName: n.nameIsFirstAuthorizationOnly ? {
+			firstName: n.firstName,
+			lastName: n.lastName
+		} : null
+	};
+}), Y = "_voltro_oauth_identities", le = y(Y, {
+	id: v({ prefix: "oauthid" }),
+	userId: b(),
+	provider: b(),
+	providerAccountId: b(),
+	email: b().nullable(),
+	emailVerified: h().default(!1),
+	createdAt: x().default("now"),
+	lastLoginAt: x().nullable()
+}).unique("byOauthProviderAccount", ["provider", "providerAccountId"]).index(["userId"]), ue = [le], de = () => _({
+	kind: "typeid",
+	prefix: "oauthid"
+}, "oauthid"), fe = (t = []) => {
+	let n = [...t];
+	return {
+		findByProviderAccount: (t, r) => e.sync(() => n.find((e) => e.provider === t && e.providerAccountId === r) ?? null),
+		listForUser: (t) => e.sync(() => n.filter((e) => e.userId === t)),
+		insert: (t) => e.sync(() => {
+			let e = {
+				...t,
+				id: de(),
+				createdAt: /* @__PURE__ */ new Date(),
+				lastLoginAt: null
+			};
+			return n.push(e), e;
+		}),
+		touch: (t, r) => e.sync(() => {
+			let e = n.findIndex((e) => e.id === t);
+			e >= 0 && (n[e] = {
+				...n[e],
+				lastLoginAt: r
+			});
+		}),
+		remove: (t, r) => e.sync(() => {
+			let e = n.findIndex((e) => e.userId === t && e.provider === r);
+			return e < 0 ? !1 : (n.splice(e, 1), !0);
+		})
+	};
+}, pe = (e) => {
+	if (e instanceof Date) return e;
+	if (typeof e == "string" || typeof e == "number") {
+		let t = new Date(e);
+		return Number.isNaN(t.getTime()) ? null : t;
+	}
+	return null;
+}, X = (e) => ({
+	id: String(e.id ?? ""),
+	userId: String(e.userId ?? ""),
+	provider: String(e.provider ?? ""),
+	providerAccountId: String(e.providerAccountId ?? ""),
+	email: typeof e.email == "string" && e.email.length > 0 ? e.email : null,
+	emailVerified: e.emailVerified === !0 || e.emailVerified === 1,
+	createdAt: pe(e.createdAt) ?? /* @__PURE__ */ new Date(0),
+	lastLoginAt: pe(e.lastLoginAt)
+}), me = (t) => ({
+	findByProviderAccount: (n, r) => e.promise(async () => {
+		let e = (await t.query({
+			table: Y,
+			predicate: m(g("provider", n), g("providerAccountId", r)),
+			limit: 1
+		}))[0];
+		return e ? X(e) : null;
+	}),
+	listForUser: (n) => e.promise(async () => (await t.query({
+		table: Y,
+		predicate: g("userId", n),
+		order: [{
+			column: "createdAt",
+			direction: "asc"
+		}]
+	})).map(X)),
+	insert: (n) => e.promise(async () => X(await t.insert(Y, {
+		id: de(),
+		userId: n.userId,
+		provider: n.provider,
+		providerAccountId: n.providerAccountId,
+		email: n.email,
+		emailVerified: n.emailVerified,
+		createdAt: /* @__PURE__ */ new Date(),
+		lastLoginAt: null
+	}))),
+	touch: (n, r) => e.promise(async () => {
+		await t.update(Y, n, { lastLoginAt: r });
+	}),
+	remove: (n, r) => e.promise(async () => {
+		let e = (await t.query({
+			table: Y,
+			predicate: m(g("userId", n), g("provider", r)),
+			limit: 1
+		}))[0];
+		return e ? t.delete(Y, String(e.id ?? "")) : !1;
+	})
+}), he = (t, n, r) => e.gen(function* () {
+	let i = yield* t.findByProviderAccount(r.provider, r.providerAccountId);
+	return i ? i.userId === n ? i : yield* e.fail(/* @__PURE__ */ Error(`linkSocialIdentity: this ${r.provider} account is already linked to another user`)) : yield* t.insert({
+		...r,
+		userId: n
+	});
+}), ge = "/auth/social", _e = 600, ve = "voltro:oauth", Z = {
+	google: [{
+		name: "VOLTRO_GOOGLE_CLIENT_ID",
+		secret: !1,
+		description: "Google OAuth client id (…apps.googleusercontent.com)."
+	}, {
+		name: "VOLTRO_GOOGLE_CLIENT_SECRET",
+		secret: !0,
+		description: "Google OAuth client secret."
+	}],
+	github: [{
+		name: "VOLTRO_GITHUB_CLIENT_ID",
+		secret: !1,
+		description: "GitHub OAuth app client id."
+	}, {
+		name: "VOLTRO_GITHUB_CLIENT_SECRET",
+		secret: !0,
+		description: "GitHub OAuth app client secret."
+	}],
+	apple: [
+		{
+			name: "VOLTRO_APPLE_CLIENT_ID",
+			secret: !1,
+			description: "Apple Services ID, e.g. com.example.web."
+		},
+		{
+			name: "VOLTRO_APPLE_TEAM_ID",
+			secret: !1,
+			description: "Apple Developer Team ID (10 chars)."
+		},
+		{
+			name: "VOLTRO_APPLE_KEY_ID",
+			secret: !1,
+			description: "Key ID of the Sign-in-with-Apple .p8 key."
+		},
+		{
+			name: "VOLTRO_APPLE_PRIVATE_KEY",
+			secret: !0,
+			description: "Contents of the .p8 file (PKCS#8 PEM). Apple signs no static secret — this key mints one per exchange."
+		}
+	]
+}, Q = (e, t) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8"
+}), $ = (e, t) => ({
+	status: 302,
+	body: "",
+	contentType: "text/plain; charset=utf-8",
+	headers: {
+		location: e,
+		...t === void 0 ? {} : { "set-cookie": t }
+	}
+}), ye = (e) => Buffer.from(JSON.stringify(e), "utf8").toString("base64url"), be = (e) => {
+	if (!e) return null;
+	try {
+		let t = JSON.parse(Buffer.from(e, "base64url").toString("utf8"));
+		return typeof t.p != "string" || typeof t.s != "string" || typeof t.v != "string" || typeof t.n != "string" ? null : {
+			p: t.p,
+			s: t.s,
+			v: t.v,
+			n: t.n
+		};
+	} catch {
+		return null;
+	}
+}, xe = (e) => e.method === "POST" && (e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded") ? new URLSearchParams(Buffer.from(e.rawBody).toString("utf8")) : new URLSearchParams(e.query), Se = (i) => {
+	let a = i.prefix ?? ge, o = i.stateTtlSeconds ?? _e, s = i.stateCookieName ?? ve, c = i.linkPolicy ?? "never", l = i.auth.cookieSecure ?? !0, u = Object.keys(i.providers).filter(j);
+	if (u.length === 0) throw new D("socialAuthPlugin: `providers` is empty — enable at least one of google / github / apple");
+	let d = (i.appBaseUrl ?? i.auth.appBaseUrl ?? "").replace(/\/+$/, ""), f = (e) => {
+		let t = i.providers[e] ?? {}, n = process.env, r = t.clientId ?? n[Z[e][0].name] ?? "";
+		if (!r) throw new D(`socialAuthPlugin: ${e} has no client id — pass \`providers.${e}.clientId\` or set ${Z[e][0].name}`);
+		let o = t.redirectUri ?? `${d}${a}/${e}/callback`;
+		if (!o.startsWith("http")) throw new D(`socialAuthPlugin: ${e} needs an absolute redirect URI — set \`appBaseUrl\` (or \`providers.${e}.redirectUri\`)`);
+		let s = {
+			id: e,
+			clientId: r,
+			redirectUri: o,
+			endpoints: t.endpoints ?? {},
+			...t.scopes === void 0 ? {} : { scopes: t.scopes }
+		};
+		if (e === "apple") {
+			let e = t.appleKey ?? (n.VOLTRO_APPLE_TEAM_ID && n.VOLTRO_APPLE_KEY_ID && n.VOLTRO_APPLE_PRIVATE_KEY ? {
+				teamId: n.VOLTRO_APPLE_TEAM_ID,
+				keyId: n.VOLTRO_APPLE_KEY_ID,
+				privateKey: n.VOLTRO_APPLE_PRIVATE_KEY.replace(/\\n/g, "\n")
+			} : void 0);
+			if (!e) throw new D("socialAuthPlugin: apple needs `appleKey` (teamId + keyId + .p8) or VOLTRO_APPLE_TEAM_ID / VOLTRO_APPLE_KEY_ID / VOLTRO_APPLE_PRIVATE_KEY");
+			return {
+				...s,
+				appleKey: e
+			};
+		}
+		let c = t.clientSecret ?? n[Z[e][1].name] ?? "";
+		if (!c) throw new D(`socialAuthPlugin: ${e} has no client secret — pass \`providers.${e}.clientSecret\` or set ${Z[e][1].name}`);
+		return {
+			...s,
+			clientSecret: c
+		};
+	}, p = i.identities ?? null, m = (e) => {
+		if (p) return p;
+		let t = e.store;
+		if (!t) throw new D("socialAuthPlugin: no identity store — pass `identities`, or run on an app with a DataStore");
+		return p = me(t), p;
+	}, h = (e) => {
+		if (!e.startsWith(`${a}/`)) return null;
+		let [t, ...n] = e.slice(a.length + 1).split("/");
+		return !t || !j(t) || !u.includes(t) ? null : n.length === 0 ? {
+			id: t,
+			isCallback: !1
+		} : n.length === 1 && n[0] === "callback" ? {
+			id: t,
+			isCallback: !0
+		} : null;
+	}, g = (e, t, r) => {
+		if (!i.failureRedirect) return Q(e, {
+			error: t,
+			message: r
+		});
+		let o = i.failureRedirect.includes("?") ? "&" : "?";
+		return $(`${i.failureRedirect}${o}social_error=${encodeURIComponent(t)}`, n(s, "", {
+			maxAgeSeconds: 0,
+			path: a,
+			secure: l
+		}));
+	}, _ = (e, t) => {
+		let r = f(t), c = M(t, r.endpoints), u = N({
+			provider: t,
+			clientId: r.clientId,
+			redirectUri: r.redirectUri,
+			...r.scopes === void 0 ? {} : { scopes: r.scopes },
+			endpoints: r.endpoints,
+			...new URLSearchParams(e.query).get("login_hint") ? { loginHint: new URLSearchParams(e.query).get("login_hint") } : {}
+		}), d = n(s, ye({
+			p: t,
+			s: u.state,
+			v: u.codeVerifier,
+			n: u.nonce
+		}), {
+			maxAgeSeconds: o,
+			httpOnly: !0,
+			sameSite: c.responseMode === "form_post" ? "none" : "lax",
+			secure: c.responseMode === "form_post" || l,
+			...i.auth.cookieDomain ? { domain: i.auth.cookieDomain } : {},
+			path: a
+		});
+		return $(u.url, d);
+	}, v = async (t, o) => {
+		let u = xe(t), d = u.get("error");
+		if (d) return g(400, "exchange_failed", `${o} refused the authorization: ${d}`);
+		let p = be(r(t.headers.cookie, s)), h = p && p.p === o ? p : null, _ = f(o), v = await G({
+			provider: o,
+			clientId: _.clientId,
+			..._.clientSecret === void 0 ? {} : { clientSecret: _.clientSecret },
+			..._.appleKey === void 0 ? {} : { appleKey: _.appleKey },
+			redirectUri: _.redirectUri,
+			code: u.get("code") ?? "",
+			state: u.get("state") ?? "",
+			expectedState: h?.s ?? "",
+			codeVerifier: h?.v ?? "",
+			expectedNonce: h?.n ?? "",
+			...u.get("user") ? { appleUserPayload: u.get("user") } : {},
+			endpoints: _.endpoints
+		}), y = await e.runPromise(J({
+			profile: v,
+			identities: m(t),
+			users: i.users,
+			config: i.auth,
+			policy: c,
+			ipAddress: t.remoteAddr ?? null,
+			userAgent: t.headers["user-agent"] ?? null
+		}));
+		if (y.kind === "refused") return g(y.status, y.code, y.message);
+		let b = n(s, "", {
+			maxAgeSeconds: 0,
+			path: a,
+			secure: l
+		});
+		return {
+			status: 302,
+			body: "",
+			contentType: "text/plain; charset=utf-8",
+			headers: {
+				location: i.successRedirect ?? i.auth.successRedirect ?? "/",
+				"set-cookie": `${b}\n${y.setCookie}`
+			}
+		};
+	}, y = {
+		method: "*",
+		path: a,
+		handle: async (e) => {
+			let t = h(e.path);
+			if (!t) return Q(404, { error: "not_found" });
+			try {
+				return t.isCallback ? e.method !== "GET" && e.method !== "POST" ? Q(405, { error: "method_not_allowed" }) : await v(e, t.id) : e.method === "GET" ? _(e, t.id) : Q(405, { error: "method_not_allowed" });
+			} catch (e) {
+				if (e instanceof C) return g(e.status, e.code, e.message);
+				throw e;
+			}
+		}
+	}, b = [
+		"store:write",
+		"network:outbound:oauth2.googleapis.com",
+		"network:outbound:www.googleapis.com",
+		"network:outbound:github.com",
+		"network:outbound:api.github.com",
+		"network:outbound:appleid.apple.com"
+	], x = u.flatMap((e) => Z[e].map((t) => ({
+		name: t.name,
+		required: i.providers[e]?.clientId === void 0,
+		secret: t.secret,
+		description: t.description
+	})));
+	return t({
+		name: i.name ? `@voltro/plugin-auth-social#${i.name}` : "@voltro/plugin-auth-social",
+		description: "Social login — Sign in with Google / GitHub / Apple. Mandatory PKCE (S256) + state, JWKS-verified ID tokens, a deliberate account-linking policy, and sessions issued through @voltro/plugin-auth.",
+		permissions: b,
+		declaredEnv: x,
+		extendSchema: { tables: ue },
+		httpRoutes: [y],
+		onActivate: (t) => e.sync(() => {
+			for (let e of u) f(e);
+			t.logger.info("social auth active", {
+				prefix: a,
+				providers: u.join(","),
+				linkPolicy: c,
+				stateTtlSeconds: o
+			});
+		}),
+		onDeactivate: () => e.void
+	});
+};
+//#endregion
+export { ae as APPLE_CLIENT_SECRET_DEFAULT_TTL_S, P as APPLE_CLIENT_SECRET_MAX_TTL_S, Y as SOCIAL_IDENTITY_TABLE, ie as SOCIAL_PROVIDERS, A as SOCIAL_PROVIDER_IDS, O as SocialAccountLinkError, C as SocialAuthError, D as SocialConfigError, T as SocialExchangeError, E as SocialIdTokenError, w as SocialStateMismatchError, ce as _resetAppleSecretCache, R as appleClientSecret, J as completeSocialSignIn, me as dataStoreSocialIdentityStore, K as decideSocialLink, H as fetchGithubIdentity, B as isApplePrivateRelayEmail, j as isSocialProviderId, he as linkSocialIdentity, fe as memorySocialIdentityStore, z as parseAppleUserPayload, Se as socialAuthPlugin, ue as socialAuthTables, N as socialBeginLogin, G as socialCompleteLogin, le as socialIdentitiesTable, M as socialProvider };