@voltro/plugin-auth-social 0.86.0 → 0.87.0

package/dist/index.js

@@ -1,11 +1,16 @@
-import { SocialAccountLinkError as e, SocialAuthError as t, SocialConfigError as n, SocialExchangeError as r, SocialIdTokenError as i, SocialStateMismatchError as a } from "./errors.js";
-import { SOCIAL_PROVIDERS as o, SOCIAL_PROVIDER_IDS as s, isSocialProviderId as c, socialProvider as l } from "./providers.js";
-import { socialBeginLogin as u } from "./login.js";
-import { APPLE_CLIENT_SECRET_DEFAULT_TTL_S as d, APPLE_CLIENT_SECRET_MAX_TTL_S as f, _resetAppleSecretCache as p, appleClientSecret as m, isApplePrivateRelayEmail as h, parseAppleUserPayload as g } from "./apple.js";
-import { fetchGithubIdentity as _ } from "./github.js";
-import { socialCompleteLogin as v } from "./callback.js";
-import { decideSocialLink as y } from "./linking.js";
-import { completeSocialSignIn as b } from "./signIn.js";
-import { SOCIAL_IDENTITY_TABLE as x, dataStoreSocialIdentityStore as S, linkSocialIdentity as C, memorySocialIdentityStore as w, socialAuthTables as T, socialIdentitiesTable as E } from "./identityStore.js";
-import { socialAuthPlugin as D } from "./plugin.js";
-export { d as APPLE_CLIENT_SECRET_DEFAULT_TTL_S, f as APPLE_CLIENT_SECRET_MAX_TTL_S, x as SOCIAL_IDENTITY_TABLE, o as SOCIAL_PROVIDERS, s as SOCIAL_PROVIDER_IDS, e as SocialAccountLinkError, t as SocialAuthError, n as SocialConfigError, r as SocialExchangeError, i as SocialIdTokenError, a as SocialStateMismatchError, p as _resetAppleSecretCache, m as appleClientSecret, b as completeSocialSignIn, S as dataStoreSocialIdentityStore, y as decideSocialLink, _ as fetchGithubIdentity, h as isApplePrivateRelayEmail, c as isSocialProviderId, C as linkSocialIdentity, w as memorySocialIdentityStore, g as parseAppleUserPayload, D as socialAuthPlugin, T as socialAuthTables, u as socialBeginLogin, v as socialCompleteLogin, E as socialIdentitiesTable, l as socialProvider };
+import { PlatformTicketError as e, SocialAccountLinkError as t, SocialAuthError as n, SocialConfigError as r, SocialExchangeError as i, SocialIdTokenError as a, SocialStateMismatchError as o } from "./errors.js";
+import { SOCIAL_PROVIDERS as s, SOCIAL_PROVIDER_IDS as c, isSocialProviderId as l, socialProvider as u } from "./providers.js";
+import { socialBeginLogin as d } from "./login.js";
+import { APPLE_CLIENT_SECRET_DEFAULT_TTL_S as f, APPLE_CLIENT_SECRET_MAX_TTL_S as p, _resetAppleSecretCache as m, appleClientSecret as h, isApplePrivateRelayEmail as g, parseAppleUserPayload as _ } from "./apple.js";
+import { fetchGithubIdentity as v } from "./github.js";
+import { fetchDiscordIdentity as y } from "./discord.js";
+import { fetchEpicIdentity as b } from "./epic.js";
+import { socialCompleteLogin as x } from "./callback.js";
+import { decideSocialLink as S } from "./linking.js";
+import { completeSocialSignIn as C } from "./signIn.js";
+import { SOCIAL_IDENTITY_TABLE as w, SocialIdentityConflict as T, dataStoreSocialIdentityStore as E, linkSocialIdentity as D, memorySocialIdentityStore as O, socialAuthTables as k, socialIdentitiesTable as A } from "./identityStore.js";
+import { completeGuestSocialUpgrade as j } from "./guestUpgrade.js";
+import { steamBeginOpenId as M, steamCompleteOpenId as N, verifySteamWebApiTicket as P } from "./steam.js";
+import { definePlatformLogin as F, eosPlatformLogin as I, steamPlatformLogin as L, verifyPlatformTicket as R } from "./platform.js";
+import { socialAuthPlugin as z } from "./plugin.js";
+export { f as APPLE_CLIENT_SECRET_DEFAULT_TTL_S, p as APPLE_CLIENT_SECRET_MAX_TTL_S, e as PlatformTicketError, w as SOCIAL_IDENTITY_TABLE, s as SOCIAL_PROVIDERS, c as SOCIAL_PROVIDER_IDS, t as SocialAccountLinkError, n as SocialAuthError, r as SocialConfigError, i as SocialExchangeError, a as SocialIdTokenError, T as SocialIdentityConflict, o as SocialStateMismatchError, m as _resetAppleSecretCache, h as appleClientSecret, j as completeGuestSocialUpgrade, C as completeSocialSignIn, E as dataStoreSocialIdentityStore, S as decideSocialLink, F as definePlatformLogin, I as eosPlatformLogin, y as fetchDiscordIdentity, b as fetchEpicIdentity, v as fetchGithubIdentity, g as isApplePrivateRelayEmail, l as isSocialProviderId, D as linkSocialIdentity, O as memorySocialIdentityStore, _ as parseAppleUserPayload, z as socialAuthPlugin, k as socialAuthTables, d as socialBeginLogin, x as socialCompleteLogin, A as socialIdentitiesTable, u as socialProvider, M as steamBeginOpenId, N as steamCompleteOpenId, L as steamPlatformLogin, R as verifyPlatformTicket, P as verifySteamWebApiTicket };

package/dist/linking.js

@@ -2,10 +2,7 @@ import { SocialAccountLinkError as e } from "./errors.js";
 //#region src/linking.ts
 var t = (t) => {
 	let { profile: n, linkedUserId: r, existingUserIdByEmail: i, policy: a } = t;
-	return r === null ? n.email === null ? {
-		kind: "refuse",
-		error: new e("no_email", `${n.provider} did not return an email address for this account. Add and verify an email with the provider, or sign in another way.`, 400)
-	} : i === null ? { kind: "create-user" } : a === "never" ? {
+	return r === null ? n.email === null || i === null ? { kind: "create-user" } : a === "never" ? {
 		kind: "refuse",
 		error: new e("account_exists_unlinked", `An account already exists for ${n.email}. Sign in with your existing method, then connect ${n.provider} from your account settings.`)
 	} : n.emailVerified ? n.emailIsPrivateRelay ? {

package/dist/login.js

@@ -14,7 +14,12 @@ var i = (i) => {
 		code_challenge: t(s),
 		code_challenge_method: "S256"
 	});
-	return c && u.set("nonce", c), a.responseMode === "form_post" && u.set("response_mode", "form_post"), i.prompt && u.set("prompt", i.prompt), i.loginHint && u.set(a.id === "github" ? "login" : "login_hint", i.loginHint), {
+	return c && u.set("nonce", c), a.id === "twitch" && u.set("claims", JSON.stringify({ id_token: {
+		email: null,
+		email_verified: null,
+		preferred_username: null,
+		picture: null
+	} })), a.responseMode === "form_post" && u.set("response_mode", "form_post"), i.prompt && u.set("prompt", i.prompt), i.loginHint && u.set(a.id === "github" ? "login" : "login_hint", i.loginHint), {
 		provider: a.id,
 		url: `${a.authorizeUrl}?${u.toString()}`,
 		state: o,

package/dist/nativeGuestUpgrade.js

@@ -0,0 +1,66 @@
+import { guestIdentityOf as e } from "./guestHandoff.js";
+import { signAuthClaims as t, verifyAuthClaims as n } from "@voltro/plugin-auth";
+import { createCipheriv as r, createDecipheriv as i, createHash as a, hkdfSync as o, randomBytes as s, timingSafeEqual as c } from "node:crypto";
+//#region src/nativeGuestUpgrade.ts
+var l = /^[A-Za-z0-9_-]{43}$/, u = /^[A-Za-z0-9._~-]{43,128}$/, d = /^[A-Za-z0-9._~-]{1,256}$/, f = (e, t) => {
+	if (!e || typeof e != "object" || Array.isArray(e)) return null;
+	let n = e;
+	return Object.keys(n).some((e) => e !== "ch" && e !== "r" && e !== "ns") || typeof n.ch != "string" || !l.test(n.ch) || typeof n.r != "string" || !t.includes(n.r) || typeof n.ns != "string" || !d.test(n.ns) ? null : {
+		ch: n.ch,
+		r: n.r,
+		ns: n.ns
+	};
+}, p = (e) => typeof e == "string" && u.test(e), m = (e, t) => {
+	let n = Buffer.from(a("sha256").update(e, "ascii").digest("base64url")), r = Buffer.from(t);
+	return n.length === r.length && c(n, r);
+}, h = (e) => [e.current, e.previous].filter((e) => e !== void 0).map((e) => e.secret), g = (e, n) => t({
+	kind: "ticket",
+	g: e.guest,
+	p: e.provider,
+	...e.native,
+	exp: e.exp,
+	audience: e.audience
+}, n.current.secret, "social-native-upgrade"), _ = (t, r, i, a) => {
+	if (!t || t.length > 3e3) return null;
+	let o = h(r).map((e) => n(t, e, "social-native-upgrade")).find((e) => e !== null);
+	if (!o || o.kind !== "ticket" || o.audience !== i || typeof o.exp != "number" || o.exp <= Math.floor(Date.now() / 1e3) || typeof o.p != "string") return null;
+	let s = e(o.g), c = f({
+		ch: o.ch,
+		r: o.r,
+		ns: o.ns
+	}, a);
+	return s && c ? {
+		guest: s,
+		provider: o.p,
+		native: c
+	} : null;
+}, v = (e, t) => Buffer.from(o("sha256", e, "voltro:social-native-upgrade:v1", t, 32)), y = (e, t, n) => {
+	let i = s(12), a = r("aes-256-gcm", v(t.current.secret, n), i), o = Buffer.concat([a.update(JSON.stringify({
+		h: e.handoff,
+		ch: e.ch,
+		g: e.guestId,
+		exp: e.exp
+	}), "utf8"), a.final()]);
+	return Buffer.concat([
+		i,
+		a.getAuthTag(),
+		o
+	]).toString("base64url");
+}, b = (e, t, n) => {
+	if (typeof e != "string" || e.length < 40 || e.length > 6e3 || !/^[A-Za-z0-9_-]+$/.test(e)) return null;
+	let r = Buffer.from(e, "base64url");
+	if (r.length < 29) return null;
+	for (let e of h(t)) try {
+		let t = i("aes-256-gcm", v(e, n), r.subarray(0, 12));
+		t.setAuthTag(r.subarray(12, 28));
+		let a = JSON.parse(Buffer.concat([t.update(r.subarray(28)), t.final()]).toString("utf8"));
+		return typeof a.h != "string" || typeof a.ch != "string" || typeof a.g != "string" || typeof a.exp != "number" || a.exp <= Math.floor(Date.now() / 1e3) ? null : {
+			handoff: a.h,
+			ch: a.ch,
+			guestId: a.g
+		};
+	} catch {}
+	return null;
+};
+//#endregion
+export { p as isNativeVerifier, f as nativeUpgradeRequestOf, b as openNativeUpgradeCode, y as sealNativeUpgradeCode, g as signNativeUpgradeTicket, m as verifierMatches, _ as verifyNativeUpgradeTicket };

package/dist/platform.js

@@ -0,0 +1,115 @@
+import { PlatformTicketError as e, SocialAuthError as t, SocialConfigError as n, SocialExchangeError as r } from "./errors.js";
+import { isSocialProviderId as i } from "./providers.js";
+import { verifySteamWebApiTicket as a } from "./steam.js";
+import { JwtVerifyError as o, verifyJwt as s } from "@voltro/protocol/jwt";
+//#region src/platform.ts
+var c = /^[a-z][a-z0-9-]{1,31}$/, l = /^[\x21-\x7e]{1,255}$/, u = (e) => {
+	if (!c.test(e.id) || i(e.id)) throw new n("definePlatformLogin: id must be 2–32 lowercase letters, digits or hyphens and not a social provider id");
+	let t = e.verify;
+	return {
+		id: e.id,
+		declaredEnv: e.declaredEnv ?? [],
+		permissions: e.permissions ?? [],
+		check: e.check ?? (() => void 0),
+		verify: async (n) => {
+			let i = await t(n);
+			if (typeof i?.accountId != "string" || !l.test(i.accountId)) throw new r("malformed_token_response", `${e.id}: the verifier returned no usable account id`, 503);
+			return { accountId: i.accountId };
+		}
+	};
+}, d = (e = {}) => {
+	let t = e.identity ?? "voltro";
+	if (!t || t.length > 255) throw new n("steamPlatformLogin: identity must be 1–255 characters");
+	let r = () => {
+		let t = e.appId ?? Number(process.env.VOLTRO_STEAM_APP_ID ?? ""), r = e.publisherKey ?? process.env.VOLTRO_STEAM_PUBLISHER_KEY ?? "";
+		if (!Number.isSafeInteger(t) || t < 1 || t > 4294967295) throw new n("steamPlatformLogin: no app id — pass `appId` or set VOLTRO_STEAM_APP_ID");
+		if (!r) throw new n("steamPlatformLogin: no publisher key — pass `publisherKey` or set VOLTRO_STEAM_PUBLISHER_KEY");
+		return {
+			appId: t,
+			publisherKey: r
+		};
+	};
+	return {
+		id: "steam",
+		declaredEnv: [{
+			name: "VOLTRO_STEAM_APP_ID",
+			required: e.appId === void 0,
+			secret: !1,
+			description: "Steam App ID the game runs as."
+		}, {
+			name: "VOLTRO_STEAM_PUBLISHER_KEY",
+			required: e.publisherKey === void 0,
+			secret: !0,
+			description: "Steamworks Web API publisher key; verifies game tickets on the server."
+		}],
+		permissions: ["network:outbound:partner.steam-api.com"],
+		check: () => {
+			r();
+		},
+		verify: async (n) => {
+			let { appId: i, publisherKey: o } = r();
+			return { accountId: (await a({
+				ticket: n,
+				appId: i,
+				identity: t,
+				publisherKey: o,
+				...e.timeoutMs === void 0 ? {} : { timeoutMs: e.timeoutMs },
+				...e.allowPublisherBanned === void 0 ? {} : { allowPublisherBanned: e.allowPublisherBanned },
+				...e.verificationUrl === void 0 ? {} : { verificationUrl: e.verificationUrl },
+				...e.fetchImpl === void 0 ? {} : { fetchImpl: e.fetchImpl }
+			})).providerAccountId };
+		}
+	};
+}, f = "https://api.epicgames.dev/auth/v1/oauth/jwks", p = "https://api.epicgames.dev", m = /^[0-9a-fA-F]{32}$/, h = (t = {}) => {
+	let i = () => {
+		let e = t.clientId ?? process.env.VOLTRO_EOS_CLIENT_ID ?? "", r = t.deploymentId ?? process.env.VOLTRO_EOS_DEPLOYMENT_ID ?? "";
+		if (!e) throw new n("eosPlatformLogin: no client id — pass `clientId` or set VOLTRO_EOS_CLIENT_ID");
+		if (!r) throw new n("eosPlatformLogin: no deployment id — pass `deploymentId` or set VOLTRO_EOS_DEPLOYMENT_ID");
+		return {
+			clientId: e,
+			deploymentId: r
+		};
+	};
+	return {
+		id: "eos",
+		declaredEnv: [{
+			name: "VOLTRO_EOS_CLIENT_ID",
+			required: t.clientId === void 0,
+			secret: !1,
+			description: "EOS client id the game signs in with."
+		}, {
+			name: "VOLTRO_EOS_DEPLOYMENT_ID",
+			required: t.deploymentId === void 0,
+			secret: !1,
+			description: "EOS deployment id the game runs in."
+		}],
+		permissions: ["network:outbound:api.epicgames.dev"],
+		check: () => {
+			i();
+		},
+		verify: async (n) => {
+			let { clientId: a, deploymentId: c } = i();
+			if (n.length > 8192 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(n)) throw new e("eos: malformed ID token");
+			let l;
+			try {
+				l = await s(n, t.jwksUrl ?? f, {
+					audience: a,
+					algorithms: ["RS256"]
+				});
+			} catch (t) {
+				throw t instanceof o && t.code === "jwks_unreachable" ? new r("exchange_failed", "eos: signing keys unavailable", 503) : new e("eos: ID token failed verification");
+			}
+			let u = l.iss, d = l.iat;
+			if (typeof u != "string" || !(u === p || u.startsWith(p + "/")) || typeof d != "number" || d * 1e3 > Date.now() + 6e4 || l.pfdid !== c || typeof l.sub != "string" || !m.test(l.sub)) throw new e("eos: ID token is for another issuer, deployment or player");
+			return { accountId: l.sub };
+		}
+	};
+}, g = async (e, n) => {
+	try {
+		return await e.verify(n);
+	} catch (n) {
+		throw n instanceof t ? n : new r("exchange_failed", `${e.id}: ticket verification failed`, 503);
+	}
+};
+//#endregion
+export { u as definePlatformLogin, h as eosPlatformLogin, d as steamPlatformLogin, g as verifyPlatformTicket };