@voltro/plugin-auth-social 0.85.0 → 0.87.0

package/dist/linking.js

@@ -0,0 +1,23 @@
+import { SocialAccountLinkError as e } from "./errors.js";
+//#region src/linking.ts
+var t = (t) => {
+	let { profile: n, linkedUserId: r, existingUserIdByEmail: i, policy: a } = t;
+	return r === null ? n.email === null || i === null ? { kind: "create-user" } : a === "never" ? {
+		kind: "refuse",
+		error: new e("account_exists_unlinked", `An account already exists for ${n.email}. Sign in with your existing method, then connect ${n.provider} from your account settings.`)
+	} : n.emailVerified ? n.emailIsPrivateRelay ? {
+		kind: "refuse",
+		error: new e("private_relay_email", "This is an Apple private-relay address, which is unique to this app and cannot identify an existing account. Sign in with your existing method, then connect Apple from your account settings.")
+	} : {
+		kind: "link",
+		userId: i
+	} : {
+		kind: "refuse",
+		error: new e("email_not_verified", `${n.provider} did not verify ownership of ${n.email}, so it cannot be attached to the existing account with that address.`)
+	} : {
+		kind: "sign-in",
+		userId: r
+	};
+};
+//#endregion
+export { t as decideSocialLink };

package/dist/login.js

@@ -0,0 +1,32 @@
+import { randomToken as e, s256 as t } from "./pkce.js";
+import { SocialConfigError as n } from "./errors.js";
+import { socialProvider as r } from "./providers.js";
+//#region src/login.ts
+var i = (i) => {
+	if (!i.clientId) throw new n("socialBeginLogin: `clientId` is required");
+	if (!i.redirectUri) throw new n("socialBeginLogin: `redirectUri` is required");
+	let a = r(i.provider, i.endpoints ?? {}), o = i.randomness?.state ?? e(), s = i.randomness?.codeVerifier ?? e(), c = a.kind === "oidc" ? i.randomness?.nonce ?? e() : "", l = i.scopes ?? a.defaultScopes, u = new URLSearchParams({
+		client_id: i.clientId,
+		redirect_uri: i.redirectUri,
+		response_type: "code",
+		scope: l.join(" "),
+		state: o,
+		code_challenge: t(s),
+		code_challenge_method: "S256"
+	});
+	return c && u.set("nonce", c), a.id === "twitch" && u.set("claims", JSON.stringify({ id_token: {
+		email: null,
+		email_verified: null,
+		preferred_username: null,
+		picture: null
+	} })), a.responseMode === "form_post" && u.set("response_mode", "form_post"), i.prompt && u.set("prompt", i.prompt), i.loginHint && u.set(a.id === "github" ? "login" : "login_hint", i.loginHint), {
+		provider: a.id,
+		url: `${a.authorizeUrl}?${u.toString()}`,
+		state: o,
+		codeVerifier: s,
+		nonce: c,
+		responseMode: a.responseMode
+	};
+};
+//#endregion
+export { i as socialBeginLogin };

package/dist/nativeGuestUpgrade.js

@@ -0,0 +1,66 @@
+import { guestIdentityOf as e } from "./guestHandoff.js";
+import { signAuthClaims as t, verifyAuthClaims as n } from "@voltro/plugin-auth";
+import { createCipheriv as r, createDecipheriv as i, createHash as a, hkdfSync as o, randomBytes as s, timingSafeEqual as c } from "node:crypto";
+//#region src/nativeGuestUpgrade.ts
+var l = /^[A-Za-z0-9_-]{43}$/, u = /^[A-Za-z0-9._~-]{43,128}$/, d = /^[A-Za-z0-9._~-]{1,256}$/, f = (e, t) => {
+	if (!e || typeof e != "object" || Array.isArray(e)) return null;
+	let n = e;
+	return Object.keys(n).some((e) => e !== "ch" && e !== "r" && e !== "ns") || typeof n.ch != "string" || !l.test(n.ch) || typeof n.r != "string" || !t.includes(n.r) || typeof n.ns != "string" || !d.test(n.ns) ? null : {
+		ch: n.ch,
+		r: n.r,
+		ns: n.ns
+	};
+}, p = (e) => typeof e == "string" && u.test(e), m = (e, t) => {
+	let n = Buffer.from(a("sha256").update(e, "ascii").digest("base64url")), r = Buffer.from(t);
+	return n.length === r.length && c(n, r);
+}, h = (e) => [e.current, e.previous].filter((e) => e !== void 0).map((e) => e.secret), g = (e, n) => t({
+	kind: "ticket",
+	g: e.guest,
+	p: e.provider,
+	...e.native,
+	exp: e.exp,
+	audience: e.audience
+}, n.current.secret, "social-native-upgrade"), _ = (t, r, i, a) => {
+	if (!t || t.length > 3e3) return null;
+	let o = h(r).map((e) => n(t, e, "social-native-upgrade")).find((e) => e !== null);
+	if (!o || o.kind !== "ticket" || o.audience !== i || typeof o.exp != "number" || o.exp <= Math.floor(Date.now() / 1e3) || typeof o.p != "string") return null;
+	let s = e(o.g), c = f({
+		ch: o.ch,
+		r: o.r,
+		ns: o.ns
+	}, a);
+	return s && c ? {
+		guest: s,
+		provider: o.p,
+		native: c
+	} : null;
+}, v = (e, t) => Buffer.from(o("sha256", e, "voltro:social-native-upgrade:v1", t, 32)), y = (e, t, n) => {
+	let i = s(12), a = r("aes-256-gcm", v(t.current.secret, n), i), o = Buffer.concat([a.update(JSON.stringify({
+		h: e.handoff,
+		ch: e.ch,
+		g: e.guestId,
+		exp: e.exp
+	}), "utf8"), a.final()]);
+	return Buffer.concat([
+		i,
+		a.getAuthTag(),
+		o
+	]).toString("base64url");
+}, b = (e, t, n) => {
+	if (typeof e != "string" || e.length < 40 || e.length > 6e3 || !/^[A-Za-z0-9_-]+$/.test(e)) return null;
+	let r = Buffer.from(e, "base64url");
+	if (r.length < 29) return null;
+	for (let e of h(t)) try {
+		let t = i("aes-256-gcm", v(e, n), r.subarray(0, 12));
+		t.setAuthTag(r.subarray(12, 28));
+		let a = JSON.parse(Buffer.concat([t.update(r.subarray(28)), t.final()]).toString("utf8"));
+		return typeof a.h != "string" || typeof a.ch != "string" || typeof a.g != "string" || typeof a.exp != "number" || a.exp <= Math.floor(Date.now() / 1e3) ? null : {
+			handoff: a.h,
+			ch: a.ch,
+			guestId: a.g
+		};
+	} catch {}
+	return null;
+};
+//#endregion
+export { p as isNativeVerifier, f as nativeUpgradeRequestOf, b as openNativeUpgradeCode, y as sealNativeUpgradeCode, g as signNativeUpgradeTicket, m as verifierMatches, _ as verifyNativeUpgradeTicket };

package/dist/pkce.js

@@ -0,0 +1,5 @@
+import { createHash as e, randomBytes as t } from "node:crypto";
+//#region src/pkce.ts
+var n = () => t(32).toString("base64url"), r = (t) => e("sha256").update(t, "ascii").digest().toString("base64url");
+//#endregion
+export { n as randomToken, r as s256 };

package/dist/platform.js

@@ -0,0 +1,115 @@
+import { PlatformTicketError as e, SocialAuthError as t, SocialConfigError as n, SocialExchangeError as r } from "./errors.js";
+import { isSocialProviderId as i } from "./providers.js";
+import { verifySteamWebApiTicket as a } from "./steam.js";
+import { JwtVerifyError as o, verifyJwt as s } from "@voltro/protocol/jwt";
+//#region src/platform.ts
+var c = /^[a-z][a-z0-9-]{1,31}$/, l = /^[\x21-\x7e]{1,255}$/, u = (e) => {
+	if (!c.test(e.id) || i(e.id)) throw new n("definePlatformLogin: id must be 2–32 lowercase letters, digits or hyphens and not a social provider id");
+	let t = e.verify;
+	return {
+		id: e.id,
+		declaredEnv: e.declaredEnv ?? [],
+		permissions: e.permissions ?? [],
+		check: e.check ?? (() => void 0),
+		verify: async (n) => {
+			let i = await t(n);
+			if (typeof i?.accountId != "string" || !l.test(i.accountId)) throw new r("malformed_token_response", `${e.id}: the verifier returned no usable account id`, 503);
+			return { accountId: i.accountId };
+		}
+	};
+}, d = (e = {}) => {
+	let t = e.identity ?? "voltro";
+	if (!t || t.length > 255) throw new n("steamPlatformLogin: identity must be 1–255 characters");
+	let r = () => {
+		let t = e.appId ?? Number(process.env.VOLTRO_STEAM_APP_ID ?? ""), r = e.publisherKey ?? process.env.VOLTRO_STEAM_PUBLISHER_KEY ?? "";
+		if (!Number.isSafeInteger(t) || t < 1 || t > 4294967295) throw new n("steamPlatformLogin: no app id — pass `appId` or set VOLTRO_STEAM_APP_ID");
+		if (!r) throw new n("steamPlatformLogin: no publisher key — pass `publisherKey` or set VOLTRO_STEAM_PUBLISHER_KEY");
+		return {
+			appId: t,
+			publisherKey: r
+		};
+	};
+	return {
+		id: "steam",
+		declaredEnv: [{
+			name: "VOLTRO_STEAM_APP_ID",
+			required: e.appId === void 0,
+			secret: !1,
+			description: "Steam App ID the game runs as."
+		}, {
+			name: "VOLTRO_STEAM_PUBLISHER_KEY",
+			required: e.publisherKey === void 0,
+			secret: !0,
+			description: "Steamworks Web API publisher key; verifies game tickets on the server."
+		}],
+		permissions: ["network:outbound:partner.steam-api.com"],
+		check: () => {
+			r();
+		},
+		verify: async (n) => {
+			let { appId: i, publisherKey: o } = r();
+			return { accountId: (await a({
+				ticket: n,
+				appId: i,
+				identity: t,
+				publisherKey: o,
+				...e.timeoutMs === void 0 ? {} : { timeoutMs: e.timeoutMs },
+				...e.allowPublisherBanned === void 0 ? {} : { allowPublisherBanned: e.allowPublisherBanned },
+				...e.verificationUrl === void 0 ? {} : { verificationUrl: e.verificationUrl },
+				...e.fetchImpl === void 0 ? {} : { fetchImpl: e.fetchImpl }
+			})).providerAccountId };
+		}
+	};
+}, f = "https://api.epicgames.dev/auth/v1/oauth/jwks", p = "https://api.epicgames.dev", m = /^[0-9a-fA-F]{32}$/, h = (t = {}) => {
+	let i = () => {
+		let e = t.clientId ?? process.env.VOLTRO_EOS_CLIENT_ID ?? "", r = t.deploymentId ?? process.env.VOLTRO_EOS_DEPLOYMENT_ID ?? "";
+		if (!e) throw new n("eosPlatformLogin: no client id — pass `clientId` or set VOLTRO_EOS_CLIENT_ID");
+		if (!r) throw new n("eosPlatformLogin: no deployment id — pass `deploymentId` or set VOLTRO_EOS_DEPLOYMENT_ID");
+		return {
+			clientId: e,
+			deploymentId: r
+		};
+	};
+	return {
+		id: "eos",
+		declaredEnv: [{
+			name: "VOLTRO_EOS_CLIENT_ID",
+			required: t.clientId === void 0,
+			secret: !1,
+			description: "EOS client id the game signs in with."
+		}, {
+			name: "VOLTRO_EOS_DEPLOYMENT_ID",
+			required: t.deploymentId === void 0,
+			secret: !1,
+			description: "EOS deployment id the game runs in."
+		}],
+		permissions: ["network:outbound:api.epicgames.dev"],
+		check: () => {
+			i();
+		},
+		verify: async (n) => {
+			let { clientId: a, deploymentId: c } = i();
+			if (n.length > 8192 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(n)) throw new e("eos: malformed ID token");
+			let l;
+			try {
+				l = await s(n, t.jwksUrl ?? f, {
+					audience: a,
+					algorithms: ["RS256"]
+				});
+			} catch (t) {
+				throw t instanceof o && t.code === "jwks_unreachable" ? new r("exchange_failed", "eos: signing keys unavailable", 503) : new e("eos: ID token failed verification");
+			}
+			let u = l.iss, d = l.iat;
+			if (typeof u != "string" || !(u === p || u.startsWith(p + "/")) || typeof d != "number" || d * 1e3 > Date.now() + 6e4 || l.pfdid !== c || typeof l.sub != "string" || !m.test(l.sub)) throw new e("eos: ID token is for another issuer, deployment or player");
+			return { accountId: l.sub };
+		}
+	};
+}, g = async (e, n) => {
+	try {
+		return await e.verify(n);
+	} catch (n) {
+		throw n instanceof t ? n : new r("exchange_failed", `${e.id}: ticket verification failed`, 503);
+	}
+};
+//#endregion
+export { u as definePlatformLogin, h as eosPlatformLogin, d as steamPlatformLogin, g as verifyPlatformTicket };