@voltro/plugin-auth-social 0.84.0 → 0.86.0

package/dist/linking.js

@@ -0,0 +1,26 @@
+import { SocialAccountLinkError as e } from "./errors.js";
+//#region src/linking.ts
+var t = (t) => {
+	let { profile: n, linkedUserId: r, existingUserIdByEmail: i, policy: a } = t;
+	return r === null ? n.email === null ? {
+		kind: "refuse",
+		error: new e("no_email", `${n.provider} did not return an email address for this account. Add and verify an email with the provider, or sign in another way.`, 400)
+	} : i === null ? { kind: "create-user" } : a === "never" ? {
+		kind: "refuse",
+		error: new e("account_exists_unlinked", `An account already exists for ${n.email}. Sign in with your existing method, then connect ${n.provider} from your account settings.`)
+	} : n.emailVerified ? n.emailIsPrivateRelay ? {
+		kind: "refuse",
+		error: new e("private_relay_email", "This is an Apple private-relay address, which is unique to this app and cannot identify an existing account. Sign in with your existing method, then connect Apple from your account settings.")
+	} : {
+		kind: "link",
+		userId: i
+	} : {
+		kind: "refuse",
+		error: new e("email_not_verified", `${n.provider} did not verify ownership of ${n.email}, so it cannot be attached to the existing account with that address.`)
+	} : {
+		kind: "sign-in",
+		userId: r
+	};
+};
+//#endregion
+export { t as decideSocialLink };

package/dist/login.js

@@ -0,0 +1,27 @@
+import { randomToken as e, s256 as t } from "./pkce.js";
+import { SocialConfigError as n } from "./errors.js";
+import { socialProvider as r } from "./providers.js";
+//#region src/login.ts
+var i = (i) => {
+	if (!i.clientId) throw new n("socialBeginLogin: `clientId` is required");
+	if (!i.redirectUri) throw new n("socialBeginLogin: `redirectUri` is required");
+	let a = r(i.provider, i.endpoints ?? {}), o = i.randomness?.state ?? e(), s = i.randomness?.codeVerifier ?? e(), c = a.kind === "oidc" ? i.randomness?.nonce ?? e() : "", l = i.scopes ?? a.defaultScopes, u = new URLSearchParams({
+		client_id: i.clientId,
+		redirect_uri: i.redirectUri,
+		response_type: "code",
+		scope: l.join(" "),
+		state: o,
+		code_challenge: t(s),
+		code_challenge_method: "S256"
+	});
+	return c && u.set("nonce", c), a.responseMode === "form_post" && u.set("response_mode", "form_post"), i.prompt && u.set("prompt", i.prompt), i.loginHint && u.set(a.id === "github" ? "login" : "login_hint", i.loginHint), {
+		provider: a.id,
+		url: `${a.authorizeUrl}?${u.toString()}`,
+		state: o,
+		codeVerifier: s,
+		nonce: c,
+		responseMode: a.responseMode
+	};
+};
+//#endregion
+export { i as socialBeginLogin };

package/dist/pkce.js

@@ -0,0 +1,5 @@
+import { createHash as e, randomBytes as t } from "node:crypto";
+//#region src/pkce.ts
+var n = () => t(32).toString("base64url"), r = (t) => e("sha256").update(t, "ascii").digest().toString("base64url");
+//#endregion
+export { n as randomToken, r as s256 };

package/dist/plugin.js

@@ -0,0 +1,244 @@
+import { SocialAuthError as e, SocialConfigError as t } from "./errors.js";
+import { isSocialProviderId as n, socialProvider as r } from "./providers.js";
+import { socialBeginLogin as i } from "./login.js";
+import { socialCompleteLogin as a } from "./callback.js";
+import { completeSocialSignIn as o } from "./signIn.js";
+import { dataStoreSocialIdentityStore as s, socialAuthTables as c } from "./identityStore.js";
+import { Effect as l } from "effect";
+import { definePlugin as u } from "@voltro/protocol";
+import { buildSetCookie as d, readCookie as f } from "@voltro/protocol/session";
+//#region src/plugin.ts
+var p = "/auth/social", m = 600, h = "voltro:oauth", g = {
+	google: [{
+		name: "VOLTRO_GOOGLE_CLIENT_ID",
+		secret: !1,
+		description: "Google OAuth client id (…apps.googleusercontent.com)."
+	}, {
+		name: "VOLTRO_GOOGLE_CLIENT_SECRET",
+		secret: !0,
+		description: "Google OAuth client secret."
+	}],
+	github: [{
+		name: "VOLTRO_GITHUB_CLIENT_ID",
+		secret: !1,
+		description: "GitHub OAuth app client id."
+	}, {
+		name: "VOLTRO_GITHUB_CLIENT_SECRET",
+		secret: !0,
+		description: "GitHub OAuth app client secret."
+	}],
+	apple: [
+		{
+			name: "VOLTRO_APPLE_CLIENT_ID",
+			secret: !1,
+			description: "Apple Services ID, e.g. com.example.web."
+		},
+		{
+			name: "VOLTRO_APPLE_TEAM_ID",
+			secret: !1,
+			description: "Apple Developer Team ID (10 chars)."
+		},
+		{
+			name: "VOLTRO_APPLE_KEY_ID",
+			secret: !1,
+			description: "Key ID of the Sign-in-with-Apple .p8 key."
+		},
+		{
+			name: "VOLTRO_APPLE_PRIVATE_KEY",
+			secret: !0,
+			description: "Contents of the .p8 file (PKCS#8 PEM). Apple signs no static secret — this key mints one per exchange."
+		}
+	]
+}, _ = (e, t) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8"
+}), v = (e, t) => ({
+	status: 302,
+	body: "",
+	contentType: "text/plain; charset=utf-8",
+	headers: {
+		location: e,
+		...t === void 0 ? {} : { "set-cookie": t }
+	}
+}), y = (e) => Buffer.from(JSON.stringify(e), "utf8").toString("base64url"), b = (e) => {
+	if (!e) return null;
+	try {
+		let t = JSON.parse(Buffer.from(e, "base64url").toString("utf8"));
+		return typeof t.p != "string" || typeof t.s != "string" || typeof t.v != "string" || typeof t.n != "string" ? null : {
+			p: t.p,
+			s: t.s,
+			v: t.v,
+			n: t.n
+		};
+	} catch {
+		return null;
+	}
+}, x = (e) => e.method === "POST" && (e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded") ? new URLSearchParams(Buffer.from(e.rawBody).toString("utf8")) : new URLSearchParams(e.query), S = (S) => {
+	let C = S.prefix ?? p, w = S.stateTtlSeconds ?? m, T = S.stateCookieName ?? h, E = S.linkPolicy ?? "never", D = S.auth.cookieSecure ?? !0, O = Object.keys(S.providers).filter(n);
+	if (O.length === 0) throw new t("socialAuthPlugin: `providers` is empty — enable at least one of google / github / apple");
+	let k = (S.appBaseUrl ?? S.auth.appBaseUrl ?? "").replace(/\/+$/, ""), A = (e) => {
+		let n = S.providers[e] ?? {}, r = process.env, i = n.clientId ?? r[g[e][0].name] ?? "";
+		if (!i) throw new t(`socialAuthPlugin: ${e} has no client id — pass \`providers.${e}.clientId\` or set ${g[e][0].name}`);
+		let a = n.redirectUri ?? `${k}${C}/${e}/callback`;
+		if (!a.startsWith("http")) throw new t(`socialAuthPlugin: ${e} needs an absolute redirect URI — set \`appBaseUrl\` (or \`providers.${e}.redirectUri\`)`);
+		let o = {
+			id: e,
+			clientId: i,
+			redirectUri: a,
+			endpoints: n.endpoints ?? {},
+			...n.scopes === void 0 ? {} : { scopes: n.scopes }
+		};
+		if (e === "apple") {
+			let e = n.appleKey ?? (r.VOLTRO_APPLE_TEAM_ID && r.VOLTRO_APPLE_KEY_ID && r.VOLTRO_APPLE_PRIVATE_KEY ? {
+				teamId: r.VOLTRO_APPLE_TEAM_ID,
+				keyId: r.VOLTRO_APPLE_KEY_ID,
+				privateKey: r.VOLTRO_APPLE_PRIVATE_KEY.replace(/\\n/g, "\n")
+			} : void 0);
+			if (!e) throw new t("socialAuthPlugin: apple needs `appleKey` (teamId + keyId + .p8) or VOLTRO_APPLE_TEAM_ID / VOLTRO_APPLE_KEY_ID / VOLTRO_APPLE_PRIVATE_KEY");
+			return {
+				...o,
+				appleKey: e
+			};
+		}
+		let s = n.clientSecret ?? r[g[e][1].name] ?? "";
+		if (!s) throw new t(`socialAuthPlugin: ${e} has no client secret — pass \`providers.${e}.clientSecret\` or set ${g[e][1].name}`);
+		return {
+			...o,
+			clientSecret: s
+		};
+	}, j = S.identities ?? null, M = (e) => {
+		if (j) return j;
+		let n = e.store;
+		if (!n) throw new t("socialAuthPlugin: no identity store — pass `identities`, or run on an app with a DataStore");
+		return j = s(n), j;
+	}, N = (e) => {
+		if (!e.startsWith(`${C}/`)) return null;
+		let [t, ...r] = e.slice(C.length + 1).split("/");
+		return !t || !n(t) || !O.includes(t) ? null : r.length === 0 ? {
+			id: t,
+			isCallback: !1
+		} : r.length === 1 && r[0] === "callback" ? {
+			id: t,
+			isCallback: !0
+		} : null;
+	}, P = (e, t, n) => {
+		if (!S.failureRedirect) return _(e, {
+			error: t,
+			message: n
+		});
+		let r = S.failureRedirect.includes("?") ? "&" : "?";
+		return v(`${S.failureRedirect}${r}social_error=${encodeURIComponent(t)}`, d(T, "", {
+			maxAgeSeconds: 0,
+			path: C,
+			secure: D
+		}));
+	}, F = (e, t) => {
+		let n = A(t), a = r(t, n.endpoints), o = i({
+			provider: t,
+			clientId: n.clientId,
+			redirectUri: n.redirectUri,
+			...n.scopes === void 0 ? {} : { scopes: n.scopes },
+			endpoints: n.endpoints,
+			...new URLSearchParams(e.query).get("login_hint") ? { loginHint: new URLSearchParams(e.query).get("login_hint") } : {}
+		}), s = d(T, y({
+			p: t,
+			s: o.state,
+			v: o.codeVerifier,
+			n: o.nonce
+		}), {
+			maxAgeSeconds: w,
+			httpOnly: !0,
+			sameSite: a.responseMode === "form_post" ? "none" : "lax",
+			secure: a.responseMode === "form_post" || D,
+			...S.auth.cookieDomain ? { domain: S.auth.cookieDomain } : {},
+			path: C
+		});
+		return v(o.url, s);
+	}, I = async (e, t) => {
+		let n = x(e), r = n.get("error");
+		if (r) return P(400, "exchange_failed", `${t} refused the authorization: ${r}`);
+		let i = b(f(e.headers.cookie, T)), s = i && i.p === t ? i : null, c = A(t), u = await a({
+			provider: t,
+			clientId: c.clientId,
+			...c.clientSecret === void 0 ? {} : { clientSecret: c.clientSecret },
+			...c.appleKey === void 0 ? {} : { appleKey: c.appleKey },
+			redirectUri: c.redirectUri,
+			code: n.get("code") ?? "",
+			state: n.get("state") ?? "",
+			expectedState: s?.s ?? "",
+			codeVerifier: s?.v ?? "",
+			expectedNonce: s?.n ?? "",
+			...n.get("user") ? { appleUserPayload: n.get("user") } : {},
+			endpoints: c.endpoints
+		}), p = await l.runPromise(o({
+			profile: u,
+			identities: M(e),
+			users: S.users,
+			config: S.auth,
+			policy: E,
+			ipAddress: e.remoteAddr ?? null,
+			userAgent: e.headers["user-agent"] ?? null
+		}));
+		if (p.kind === "refused") return P(p.status, p.code, p.message);
+		let m = d(T, "", {
+			maxAgeSeconds: 0,
+			path: C,
+			secure: D
+		});
+		return {
+			status: 302,
+			body: "",
+			contentType: "text/plain; charset=utf-8",
+			headers: {
+				location: S.successRedirect ?? S.auth.successRedirect ?? "/",
+				"set-cookie": [m, p.setCookie]
+			}
+		};
+	}, L = {
+		method: "*",
+		path: C,
+		handle: async (t) => {
+			let n = N(t.path);
+			if (!n) return _(404, { error: "not_found" });
+			try {
+				return n.isCallback ? t.method !== "GET" && t.method !== "POST" ? _(405, { error: "method_not_allowed" }) : await I(t, n.id) : t.method === "GET" ? F(t, n.id) : _(405, { error: "method_not_allowed" });
+			} catch (t) {
+				if (t instanceof e) return P(t.status, t.code, t.message);
+				throw t;
+			}
+		}
+	}, R = [
+		"store:write",
+		"network:outbound:oauth2.googleapis.com",
+		"network:outbound:www.googleapis.com",
+		"network:outbound:github.com",
+		"network:outbound:api.github.com",
+		"network:outbound:appleid.apple.com"
+	], z = O.flatMap((e) => g[e].map((t) => ({
+		name: t.name,
+		required: S.providers[e]?.clientId === void 0,
+		secret: t.secret,
+		description: t.description
+	})));
+	return u({
+		name: S.name ? `@voltro/plugin-auth-social#${S.name}` : "@voltro/plugin-auth-social",
+		description: "Social login — Sign in with Google / GitHub / Apple. Mandatory PKCE (S256) + state, JWKS-verified ID tokens, a deliberate account-linking policy, and sessions issued through @voltro/plugin-auth.",
+		permissions: R,
+		declaredEnv: z,
+		extendSchema: { tables: c },
+		httpRoutes: [L],
+		onActivate: (e) => l.sync(() => {
+			for (let e of O) A(e);
+			e.logger.info("social auth active", {
+				prefix: C,
+				providers: O.join(","),
+				linkPolicy: E,
+				stateTtlSeconds: w
+			});
+		}),
+		onDeactivate: () => l.void
+	});
+};
+//#endregion
+export { S as socialAuthPlugin };

package/dist/providers.js

@@ -0,0 +1,70 @@
+import { SocialConfigError as e } from "./errors.js";
+//#region src/providers.ts
+var t = {
+	id: "google",
+	label: "Google",
+	authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+	tokenUrl: "https://oauth2.googleapis.com/token",
+	jwksUrl: "https://www.googleapis.com/oauth2/v3/certs",
+	issuer: "https://accounts.google.com",
+	apiBase: null,
+	defaultScopes: [
+		"openid",
+		"email",
+		"profile"
+	],
+	kind: "oidc",
+	responseMode: "query",
+	assertsEmailVerification: !0,
+	pkceEnforced: !0
+}, n = {
+	id: "github",
+	label: "GitHub",
+	authorizeUrl: "https://github.com/login/oauth/authorize",
+	tokenUrl: "https://github.com/login/oauth/access_token",
+	jwksUrl: null,
+	issuer: null,
+	apiBase: "https://api.github.com",
+	defaultScopes: ["read:user", "user:email"],
+	kind: "oauth2",
+	responseMode: "query",
+	assertsEmailVerification: !0,
+	pkceEnforced: !1
+}, r = {
+	id: "apple",
+	label: "Apple",
+	authorizeUrl: "https://appleid.apple.com/auth/authorize",
+	tokenUrl: "https://appleid.apple.com/auth/token",
+	jwksUrl: "https://appleid.apple.com/auth/keys",
+	issuer: "https://appleid.apple.com",
+	apiBase: null,
+	defaultScopes: ["name", "email"],
+	kind: "oidc",
+	responseMode: "form_post",
+	assertsEmailVerification: !0,
+	pkceEnforced: !0
+}, i = {
+	google: t,
+	github: n,
+	apple: r
+}, a = [
+	t,
+	n,
+	r
+], o = [
+	"google",
+	"github",
+	"apple"
+], s = (e) => e === "google" || e === "github" || e === "apple", c = (t, n = {}) => {
+	if (!s(t)) throw new e(`unknown social provider '${t}' — expected one of ${o.join(", ")}`);
+	return {
+		...i[t],
+		...n.authorizeUrl === void 0 ? {} : { authorizeUrl: n.authorizeUrl },
+		...n.tokenUrl === void 0 ? {} : { tokenUrl: n.tokenUrl },
+		...n.jwksUrl === void 0 ? {} : { jwksUrl: n.jwksUrl },
+		...n.issuer === void 0 ? {} : { issuer: n.issuer },
+		...n.apiBase === void 0 ? {} : { apiBase: n.apiBase }
+	};
+};
+//#endregion
+export { a as SOCIAL_PROVIDERS, o as SOCIAL_PROVIDER_IDS, s as isSocialProviderId, c as socialProvider };

package/dist/signIn.js

@@ -0,0 +1,67 @@
+import { SocialAccountLinkError as e } from "./errors.js";
+import { decideSocialLink as t } from "./linking.js";
+import { Effect as n } from "effect";
+import { issueUserSession as r, newAuthId as i, runSubjectGuards as a } from "@voltro/plugin-auth";
+//#region src/signIn.ts
+var o = (e) => ({
+	kind: "refused",
+	status: e.status,
+	code: e.code,
+	message: e.message
+}), s = (s) => n.gen(function* () {
+	let { profile: c, identities: l, users: u, config: d } = s, f = s.policy ?? "never", p = yield* l.findByProviderAccount(c.provider, c.providerAccountId), m = c.email === null ? null : yield* u.findByEmail(c.email), h = t({
+		profile: c,
+		linkedUserId: p?.userId ?? null,
+		existingUserIdByEmail: m?.id ?? null,
+		policy: f
+	});
+	if (h.kind === "refuse") return o(h.error);
+	let g = null, _ = !1, v = !1;
+	if (h.kind === "create-user") {
+		let t = c.email, r = yield* u.insert({
+			id: i("user"),
+			email: t,
+			passwordHash: null,
+			tenantId: d.defaultTenantId
+		}).pipe(n.catchTag("UserAlreadyExistsError", (t) => n.succeed(new e("account_exists_unlinked", `An account already exists for ${t.email}. Sign in with your existing method, then connect ${c.provider} from your account settings.`))));
+		if (r instanceof e) return o(r);
+		g = r, _ = !0;
+	} else {
+		if (v = h.kind === "link", g = yield* u.findById(h.userId), !g) return o(new e("account_exists_unlinked", "The account this login is linked to no longer exists.", 409));
+		let t = d.subjectGuards ?? [];
+		if (t.length > 0) {
+			let e = yield* a(t, g);
+			if (!e.ok) return {
+				kind: "refused",
+				status: 403,
+				code: e.code,
+				message: e.message
+			};
+		}
+	}
+	p === null ? yield* l.insert({
+		userId: g.id,
+		provider: c.provider,
+		providerAccountId: c.providerAccountId,
+		email: c.email,
+		emailVerified: c.emailVerified
+	}) : yield* l.touch(p.id, /* @__PURE__ */ new Date());
+	let y = yield* r(g, u, d, {
+		ipAddress: s.ipAddress ?? null,
+		userAgent: s.userAgent ?? null
+	});
+	return {
+		kind: "ok",
+		userId: g.id,
+		subject: y.subject,
+		setCookie: y.setCookie,
+		created: _,
+		linked: v,
+		oneTimeName: c.nameIsFirstAuthorizationOnly ? {
+			firstName: c.firstName,
+			lastName: c.lastName
+		} : null
+	};
+});
+//#endregion
+export { s as completeSocialSignIn };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth-social",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "description": "First-party social login for the Voltro framework — Sign in with Google, GitHub and Apple. Mandatory PKCE (S256) + state, JWKS-verified ID tokens, a deliberate account-linking policy, and sessions issued through @voltro/plugin-auth. No identity vendor required.",
   "keywords": [
     "voltro",
@@ -33,12 +33,12 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.84.0",
-    "@voltro/plugin-auth": "0.84.0",
-    "@voltro/protocol": "0.84.0"
+    "@voltro/database": "0.86.0",
+    "@voltro/plugin-auth": "0.86.0",
+    "@voltro/protocol": "0.86.0"
   },
   "peerDependencies": {
-    "effect": "^3.22.2"
+    "effect": "4.0.1"
   },
   "publishConfig": {
     "access": "public"