@voltro/plugin-auth-social 0.85.0 → 0.86.0

package/THIRD-PARTY-NOTICES.md

@@ -1,11 +1,11 @@
 # Third-Party Notices — @voltro/plugin-auth-social
 
-This package depends on the open-source software listed below. Each is the
+This package uses the open-source software listed below. Each is the
 property of its respective copyright holders and is used under the terms of
 its license. This file is provided for attribution; it grants no rights in
 @voltro/plugin-auth-social itself, which is proprietary (see LICENSE).
 
-Generated from the resolved runtime dependency closure (5 packages).
+Generated from the resolved runtime dependency closure (4 packages).
 
 ---
 
@@ -37,34 +37,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## layerr@3.0.0
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2020 Perry Mitchell
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ## typeid-js@1.2.0
 
 License: Apache-2.0
@@ -273,14 +245,14 @@ Apache License
    limitations under the License.
 ```
 
-## ulidx@2.4.1
+## ulid@3.0.2
 
 License: MIT
 
 ```
-MIT License
+The MIT License (MIT)
 
-Copyright (c) 2021 Perry Mitchell
+Copyright (c) 2017 Alizain Feerasta
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/apple.js

@@ -0,0 +1,64 @@
+import { SocialConfigError as e } from "./errors.js";
+import { createPrivateKey as t, sign as n } from "node:crypto";
+//#region src/apple.ts
+var r = 15777e3, i = 900, a = "https://appleid.apple.com", o = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64url"), s = /* @__PURE__ */ new Map(), c = (n) => {
+	let r = s.get(n);
+	if (r) return r;
+	let i;
+	try {
+		i = t({ key: n });
+	} catch (t) {
+		throw new e(`apple: could not parse the .p8 private key — ${t.message}`);
+	}
+	if (i.asymmetricKeyType !== "ec") throw new e(`apple: the .p8 key must be an EC (P-256) key, got '${String(i.asymmetricKeyType)}'`);
+	let a = i.asymmetricKeyDetails?.namedCurve;
+	if (a !== void 0 && a !== "prime256v1") throw new e(`apple: ES256 requires the P-256 curve (prime256v1), got '${a}'`);
+	return s.set(n, i), i;
+}, l = /* @__PURE__ */ new Map(), u = () => {
+	s.clear(), l.clear();
+}, d = (t, i, s = Date.now) => {
+	if (!t) throw new e("apple: `clientId` (Services ID) is required");
+	if (!i.teamId) throw new e("apple: `teamId` is required");
+	if (!i.keyId) throw new e("apple: `keyId` is required");
+	if (!i.privateKey) throw new e("apple: `privateKey` (.p8 contents) is required");
+	let u = i.ttlSeconds ?? 900;
+	if (!Number.isFinite(u) || u <= 0) throw new e("apple: `ttlSeconds` must be a positive number");
+	if (u > 15777e3) throw new e(`apple: \`ttlSeconds\` may not exceed ${r} (six months, Apple's cap) — got ${u}`);
+	let d = s(), f = `${i.teamId}\u0000${i.keyId}\u0000${t}\u0000${u}`, p = l.get(f);
+	if (p && p.expiresAtMs - d > 6e4) return p.secret;
+	let m = Math.floor(d / 1e3), h = m + u, g = `${o(JSON.stringify({
+		alg: "ES256",
+		kid: i.keyId,
+		typ: "JWT"
+	}))}.${o(JSON.stringify({
+		iss: i.teamId,
+		iat: m,
+		exp: h,
+		aud: a,
+		sub: t
+	}))}`, _ = `${g}.${n("sha256", Buffer.from(g, "ascii"), {
+		key: c(i.privateKey),
+		dsaEncoding: "ieee-p1363"
+	}).toString("base64url")}`;
+	return l.set(f, {
+		secret: _,
+		expiresAtMs: h * 1e3
+	}), _;
+}, f = (e) => {
+	if (!e) return null;
+	let t;
+	try {
+		t = JSON.parse(e);
+	} catch {
+		return null;
+	}
+	if (typeof t != "object" || !t) return null;
+	let n = t, r = typeof n.name == "object" && n.name !== null ? n.name : {}, i = (e) => typeof e == "string" && e.length > 0 ? e : null, a = {
+		firstName: i(r.firstName),
+		lastName: i(r.lastName),
+		email: i(n.email)
+	};
+	return a.firstName === null && a.lastName === null && a.email === null ? null : a;
+}, p = (e) => e !== null && e.toLowerCase().endsWith("@privaterelay.appleid.com");
+//#endregion
+export { i as APPLE_CLIENT_SECRET_DEFAULT_TTL_S, r as APPLE_CLIENT_SECRET_MAX_TTL_S, u as _resetAppleSecretCache, d as appleClientSecret, p as isApplePrivateRelayEmail, f as parseAppleUserPayload };

package/dist/callback.js

@@ -0,0 +1,113 @@
+import { SocialAuthError as e, SocialConfigError as t, SocialExchangeError as n, SocialIdTokenError as r, SocialStateMismatchError as i } from "./errors.js";
+import { socialProvider as a } from "./providers.js";
+import { appleClientSecret as o, isApplePrivateRelayEmail as s, parseAppleUserPayload as c } from "./apple.js";
+import { fetchGithubIdentity as l } from "./github.js";
+import { timingSafeStringEqual as u } from "@voltro/protocol/session";
+import { JwtVerifyError as d, verifyJwt as f } from "@voltro/protocol/jwt";
+//#region src/callback.ts
+var p = (e) => e === !0 || e === "true", m = (e) => typeof e == "string" && e.length > 0 ? e : null, h = async (h) => {
+	let g = a(h.provider, h.endpoints ?? {});
+	if (!h.code) throw new e(400, "missing_code", "socialCompleteLogin: missing `code`");
+	if (!h.expectedState) throw new i("socialCompleteLogin: no `expectedState` — the login was never started by this server, or the state cookie expired. Refusing to exchange the code.");
+	if (!h.state || !u(h.state, h.expectedState)) throw new i("socialCompleteLogin: `state` does not match the value minted for this browser (possible login CSRF).");
+	if (!h.codeVerifier) throw new e(400, "missing_verifier", "socialCompleteLogin: missing `codeVerifier` (PKCE)");
+	if (g.kind === "oidc" && !h.expectedNonce) throw new t(`socialCompleteLogin: ${g.id} returns an ID token, so \`expectedNonce\` is required — without it a token captured from another login replays here.`);
+	let _ = g.id === "apple" ? o(h.clientId, h.appleKey ?? (() => {
+		throw new t("apple: `appleKey` (teamId + keyId + .p8) is required");
+	})(), h.now ?? Date.now) : h.clientSecret ?? (() => {
+		throw new t(`${g.id}: \`clientSecret\` is required`);
+	})(), v = h.fetchImpl ?? fetch, y = new URLSearchParams({
+		grant_type: "authorization_code",
+		client_id: h.clientId,
+		client_secret: _,
+		code: h.code,
+		redirect_uri: h.redirectUri,
+		code_verifier: h.codeVerifier
+	}), b = await v(g.tokenUrl, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		},
+		body: y.toString()
+	});
+	if (!b.ok) {
+		let e = await b.text().catch(() => "");
+		throw new n("exchange_failed", `${g.id}: token exchange failed (${b.status}): ${e.slice(0, 200)}`);
+	}
+	let x;
+	try {
+		x = await b.json();
+	} catch {
+		throw new n("malformed_token_response", `${g.id}: token endpoint returned a body that is not JSON`);
+	}
+	if (x.error) throw new n("exchange_failed", `${g.id}: token exchange refused: ${x.error}${x.error_description ? ` (${x.error_description})` : ""}`);
+	if (g.kind === "oauth2") {
+		if (!x.access_token) throw new n("malformed_token_response", `${g.id}: token response carries no access_token`);
+		if (!g.apiBase) throw new t(`${g.id}: no apiBase configured`);
+		let e = await l(x.access_token, {
+			apiBase: g.apiBase,
+			...h.fetchImpl === void 0 ? {} : { fetchImpl: h.fetchImpl }
+		});
+		return {
+			provider: g.id,
+			providerAccountId: e.accountId,
+			email: e.email,
+			emailVerified: e.emailVerified,
+			emailIsPrivateRelay: !1,
+			name: e.name ?? e.login,
+			firstName: null,
+			lastName: null,
+			avatarUrl: e.avatarUrl,
+			nameIsFirstAuthorizationOnly: !1,
+			raw: { ...e }
+		};
+	}
+	if (!x.id_token) throw new n("malformed_token_response", `${g.id}: token response carries no id_token`);
+	if (!g.jwksUrl || !g.issuer) throw new t(`${g.id}: no JWKS/issuer configured`);
+	let S;
+	try {
+		S = await f(x.id_token, g.jwksUrl, {
+			issuer: g.issuer,
+			audience: h.clientId
+		});
+	} catch (e) {
+		throw e instanceof d ? new r("id_token_invalid", `${g.id}: id_token ${e.code}: ${e.message}`) : new r("id_token_invalid", `${g.id}: id_token verification failed: ${e.message}`);
+	}
+	let C = m(S.nonce);
+	if (!C || !u(C, h.expectedNonce ?? "")) throw new r("nonce_mismatch", `${g.id}: id_token nonce does not match the value minted for this login (possible replay).`);
+	let w = m(S.sub);
+	if (!w) throw new r("id_token_invalid", `${g.id}: id_token has no sub claim`);
+	let T = m(S.email), E = p(S.email_verified);
+	if (g.id === "apple") {
+		let e = c(h.appleUserPayload), t = p(S.is_private_email) || s(T), n = e?.firstName ?? null, r = e?.lastName ?? null, i = [n, r].filter((e) => e !== null).join(" ");
+		return {
+			provider: "apple",
+			providerAccountId: w,
+			email: T ?? e?.email ?? null,
+			emailVerified: E,
+			emailIsPrivateRelay: t,
+			name: i.length > 0 ? i : null,
+			firstName: n,
+			lastName: r,
+			avatarUrl: null,
+			nameIsFirstAuthorizationOnly: e !== null,
+			raw: S
+		};
+	}
+	return {
+		provider: g.id,
+		providerAccountId: w,
+		email: T,
+		emailVerified: E,
+		emailIsPrivateRelay: !1,
+		name: m(S.name),
+		firstName: m(S.given_name),
+		lastName: m(S.family_name),
+		avatarUrl: m(S.picture),
+		nameIsFirstAuthorizationOnly: !1,
+		raw: S
+	};
+};
+//#endregion
+export { h as socialCompleteLogin };

package/dist/errors.js

@@ -0,0 +1,30 @@
+//#region src/errors.ts
+var e = class extends Error {
+	status;
+	code;
+	constructor(e, t, n) {
+		super(n), this.status = e, this.code = t, this.name = "SocialAuthError";
+	}
+}, t = class extends e {
+	constructor(e) {
+		super(400, "state_mismatch", e), this.name = "SocialStateMismatchError";
+	}
+}, n = class extends e {
+	constructor(e, t, n = 502) {
+		super(n, e, t), this.name = "SocialExchangeError";
+	}
+}, r = class extends e {
+	constructor(e, t) {
+		super(401, e, t), this.name = "SocialIdTokenError";
+	}
+}, i = class extends e {
+	constructor(e) {
+		super(500, "config", e), this.name = "SocialConfigError";
+	}
+}, a = class extends e {
+	constructor(e, t, n = 409) {
+		super(n, e, t), this.name = "SocialAccountLinkError";
+	}
+};
+//#endregion
+export { a as SocialAccountLinkError, e as SocialAuthError, i as SocialConfigError, n as SocialExchangeError, r as SocialIdTokenError, t as SocialStateMismatchError };

package/dist/github.js

@@ -0,0 +1,34 @@
+import { SocialExchangeError as e } from "./errors.js";
+//#region src/github.ts
+var t = (e) => ({
+	authorization: `Bearer ${e}`,
+	accept: "application/vnd.github+json",
+	"x-github-api-version": "2022-11-28",
+	"user-agent": "voltro-plugin-auth-social"
+}), n = async (n, r) => {
+	let i = r.fetchImpl ?? fetch, a = await i(`${r.apiBase}/user`, { headers: t(n) });
+	if (!a.ok) {
+		let t = await a.text().catch(() => "");
+		throw new e("exchange_failed", `github: GET /user failed (${a.status}): ${t.slice(0, 200)}`);
+	}
+	let o = await a.json();
+	if (o.id === void 0 || o.id === null || !o.login) throw new e("malformed_token_response", "github: GET /user response is missing id/login");
+	let s = null, c = !1, l = await i(`${r.apiBase}/user/emails`, { headers: t(n) });
+	if (l.ok) {
+		let e = await l.json();
+		if (Array.isArray(e)) {
+			let t = e.find((e) => e.primary === !0 && typeof e.email == "string");
+			t?.email && (s = t.email, c = t.verified === !0);
+		}
+	}
+	return {
+		accountId: String(o.id),
+		login: o.login,
+		name: typeof o.name == "string" && o.name.length > 0 ? o.name : null,
+		avatarUrl: typeof o.avatar_url == "string" && o.avatar_url.length > 0 ? o.avatar_url : null,
+		email: s,
+		emailVerified: c
+	};
+};
+//#endregion
+export { n as fetchGithubIdentity };

package/dist/identityStore.js

@@ -0,0 +1,104 @@
+import { Effect as e } from "effect";
+import { and as t, boolean as n, eq as r, generateId as i, id as a, table as o, text as s, timestamp as c } from "@voltro/database";
+//#region src/identityStore.ts
+var l = "_voltro_oauth_identities", u = o(l, {
+	id: a({ prefix: "oauthid" }),
+	userId: s(),
+	provider: s(),
+	providerAccountId: s(),
+	email: s().nullable(),
+	emailVerified: n().default(!1),
+	createdAt: c().default("now"),
+	lastLoginAt: c().nullable()
+}).unique("byOauthProviderAccount", ["provider", "providerAccountId"]).index(["userId"]), d = [u], f = () => i({
+	kind: "typeid",
+	prefix: "oauthid"
+}, "oauthid"), p = (t = []) => {
+	let n = [...t];
+	return {
+		findByProviderAccount: (t, r) => e.sync(() => n.find((e) => e.provider === t && e.providerAccountId === r) ?? null),
+		listForUser: (t) => e.sync(() => n.filter((e) => e.userId === t)),
+		insert: (t) => e.sync(() => {
+			let e = {
+				...t,
+				id: f(),
+				createdAt: /* @__PURE__ */ new Date(),
+				lastLoginAt: null
+			};
+			return n.push(e), e;
+		}),
+		touch: (t, r) => e.sync(() => {
+			let e = n.findIndex((e) => e.id === t);
+			e >= 0 && (n[e] = {
+				...n[e],
+				lastLoginAt: r
+			});
+		}),
+		remove: (t, r) => e.sync(() => {
+			let e = n.findIndex((e) => e.userId === t && e.provider === r);
+			return e < 0 ? !1 : (n.splice(e, 1), !0);
+		})
+	};
+}, m = (e) => {
+	if (e instanceof Date) return e;
+	if (typeof e == "string" || typeof e == "number") {
+		let t = new Date(e);
+		return Number.isNaN(t.getTime()) ? null : t;
+	}
+	return null;
+}, h = (e) => ({
+	id: String(e.id ?? ""),
+	userId: String(e.userId ?? ""),
+	provider: String(e.provider ?? ""),
+	providerAccountId: String(e.providerAccountId ?? ""),
+	email: typeof e.email == "string" && e.email.length > 0 ? e.email : null,
+	emailVerified: e.emailVerified === !0 || e.emailVerified === 1,
+	createdAt: m(e.createdAt) ?? /* @__PURE__ */ new Date(0),
+	lastLoginAt: m(e.lastLoginAt)
+}), g = (n) => ({
+	findByProviderAccount: (i, a) => e.promise(async () => {
+		let e = (await n.query({
+			table: l,
+			predicate: t(r("provider", i), r("providerAccountId", a)),
+			limit: 1
+		}))[0];
+		return e ? h(e) : null;
+	}),
+	listForUser: (t) => e.promise(async () => (await n.query({
+		table: l,
+		predicate: r("userId", t),
+		order: [{
+			column: "createdAt",
+			direction: "asc"
+		}]
+	})).map(h)),
+	insert: (t) => e.promise(async () => h(await n.insert(l, {
+		id: f(),
+		userId: t.userId,
+		provider: t.provider,
+		providerAccountId: t.providerAccountId,
+		email: t.email,
+		emailVerified: t.emailVerified,
+		createdAt: /* @__PURE__ */ new Date(),
+		lastLoginAt: null
+	}))),
+	touch: (t, r) => e.promise(async () => {
+		await n.update(l, t, { lastLoginAt: r });
+	}),
+	remove: (i, a) => e.promise(async () => {
+		let e = (await n.query({
+			table: l,
+			predicate: t(r("userId", i), r("provider", a)),
+			limit: 1
+		}))[0];
+		return e ? n.delete(l, String(e.id ?? "")) : !1;
+	})
+}), _ = (t, n, r) => e.gen(function* () {
+	let i = yield* t.findByProviderAccount(r.provider, r.providerAccountId);
+	return i ? i.userId === n ? i : yield* e.fail(/* @__PURE__ */ Error(`linkSocialIdentity: this ${r.provider} account is already linked to another user`)) : yield* t.insert({
+		...r,
+		userId: n
+	});
+});
+//#endregion
+export { l as SOCIAL_IDENTITY_TABLE, g as dataStoreSocialIdentityStore, _ as linkSocialIdentity, p as memorySocialIdentityStore, d as socialAuthTables, u as socialIdentitiesTable };