@warlock.js/auth 5.11.0 → 5.13.0

package/esm/passkeys/passkey-challenges.mjs

@@ -0,0 +1,53 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { InvalidPasskeyError } from "../errors/invalid-passkey.error.mjs";
+import { hashOneTimeToken, oneTimeTokenModel } from "../services/one-time-tokens.mjs";
+
+//#region ../auth/src/passkeys/passkey-challenges.ts
+/**
+* Store a ceremony challenge server-side: SHA-256 hashed, purpose-bound,
+* expiring (`auth.passkeys.challengeExpiresIn`, default 5m). A registration
+* challenge is bound to its user; an authentication challenge has none.
+*/
+async function storePasskeyChallenge(ceremony, challenge, user) {
+	const expiresAt = new Date(Date.now() + authConfig.passkeys.challengeExpiresInMs());
+	await oneTimeTokenModel().issueChallenge(ceremony, hashOneTimeToken(challenge), expiresAt, user);
+}
+/** The challenge the browser signed, read from `clientDataJSON`. */
+function signedChallenge(credential) {
+	try {
+		const clientData = JSON.parse(Buffer.from(credential.response.clientDataJSON, "base64url").toString("utf8"));
+		if (typeof clientData.challenge === "string" && clientData.challenge.length > 0) return clientData.challenge;
+	} catch {}
+	throw new InvalidPasskeyError("malformed-client-data");
+}
+/**
+* Consume the challenge a credential response signed. It is consumed BEFORE
+* the signature is verified, so a challenge is single-use even when that
+* verification fails. Unknown, other-ceremony, expired and already-used
+* challenges all throw {@link InvalidPasskeyError}.
+*/
+async function takePasskeyChallenge(ceremony, credential) {
+	const challenge = signedChallenge(credential);
+	const row = await oneTimeTokenModel().findByHash(hashOneTimeToken(challenge), ceremony);
+	if (!row || row.isConsumed || row.isExpired) throw new InvalidPasskeyError("unknown-or-expired-challenge");
+	if (!await row.consumeIfActive()) throw new InvalidPasskeyError("challenge-already-used");
+	return {
+		challenge,
+		row
+	};
+}
+/**
+* CSRF rule for a passkey verify: the request's `Origin` header must be one
+* of `auth.passkeys.origin`. The same list is what the signed
+* `clientDataJSON.origin` is checked against.
+*/
+function assertPasskeyOrigin(request) {
+	const origins = authConfig.passkeys.origins();
+	const origin = request.origin;
+	if (typeof origin !== "string" || !origins.includes(origin)) throw new InvalidPasskeyError("origin-mismatch");
+	return origins;
+}
+
+//#endregion
+export { assertPasskeyOrigin, storePasskeyChallenge, takePasskeyChallenge };
+//# sourceMappingURL=passkey-challenges.mjs.map

package/esm/passkeys/passkey-challenges.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-challenges.mjs","names":[],"sources":["../../../../../../../auth/src/passkeys/passkey-challenges.ts"],"sourcesContent":["import type { Request } from \"@warlock.js/core\";\nimport { InvalidPasskeyError } from \"../errors/invalid-passkey.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { OneTimeToken, OneTimeTokenPurpose } from \"../models/one-time-token\";\nimport { authConfig } from \"../services/auth-config\";\nimport { hashOneTimeToken, oneTimeTokenModel } from \"../services/one-time-tokens\";\nimport type { PasskeyResponseJSON } from \"./simplewebauthn\";\n\n/** Which ceremony a challenge belongs to. */\nexport type PasskeyCeremony = Extract<\n  OneTimeTokenPurpose,\n  \"passkey-registration\" | \"passkey-authentication\"\n>;\n\n/**\n * Store a ceremony challenge server-side: SHA-256 hashed, purpose-bound,\n * expiring (`auth.passkeys.challengeExpiresIn`, default 5m). A registration\n * challenge is bound to its user; an authentication challenge has none.\n */\nexport async function storePasskeyChallenge(\n  ceremony: PasskeyCeremony,\n  challenge: string,\n  user?: Auth,\n): Promise<void> {\n  const expiresAt = new Date(Date.now() + authConfig.passkeys.challengeExpiresInMs());\n\n  await oneTimeTokenModel().issueChallenge(ceremony, hashOneTimeToken(challenge), expiresAt, user);\n}\n\n/** The challenge the browser signed, read from `clientDataJSON`. */\nfunction signedChallenge(credential: PasskeyResponseJSON): string {\n  try {\n    const clientData = JSON.parse(\n      Buffer.from(credential.response.clientDataJSON, \"base64url\").toString(\"utf8\"),\n    ) as { challenge?: unknown };\n\n    if (typeof clientData.challenge === \"string\" && clientData.challenge.length > 0) {\n      return clientData.challenge;\n    }\n  } catch {\n    // fall through to the rejection\n  }\n\n  throw new InvalidPasskeyError(\"malformed-client-data\");\n}\n\n/**\n * Consume the challenge a credential response signed. It is consumed BEFORE\n * the signature is verified, so a challenge is single-use even when that\n * verification fails. Unknown, other-ceremony, expired and already-used\n * challenges all throw {@link InvalidPasskeyError}.\n */\nexport async function takePasskeyChallenge(\n  ceremony: PasskeyCeremony,\n  credential: PasskeyResponseJSON,\n): Promise<{ challenge: string; row: OneTimeToken }> {\n  const challenge = signedChallenge(credential);\n  const row = await oneTimeTokenModel().findByHash(hashOneTimeToken(challenge), ceremony);\n\n  if (!row || row.isConsumed || row.isExpired) {\n    throw new InvalidPasskeyError(\"unknown-or-expired-challenge\");\n  }\n\n  if (!(await row.consumeIfActive())) {\n    throw new InvalidPasskeyError(\"challenge-already-used\");\n  }\n\n  return { challenge, row };\n}\n\n/**\n * CSRF rule for a passkey verify: the request's `Origin` header must be one\n * of `auth.passkeys.origin`. The same list is what the signed\n * `clientDataJSON.origin` is checked against.\n */\nexport function assertPasskeyOrigin(request: Request): string[] {\n  const origins = authConfig.passkeys.origins();\n  const origin = request.origin;\n\n  if (typeof origin !== \"string\" || !origins.includes(origin)) {\n    throw new InvalidPasskeyError(\"origin-mismatch\");\n  }\n\n  return origins;\n}\n"],"mappings":";;;;;;;;;;AAmBA,eAAsB,sBACpB,UACA,WACA,MACe;CACf,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,SAAS,qBAAqB,CAAC;CAElF,MAAM,kBAAkB,CAAC,CAAC,eAAe,UAAU,iBAAiB,SAAS,GAAG,WAAW,IAAI;AACjG;;AAGA,SAAS,gBAAgB,YAAyC;CAChE,IAAI;EACF,MAAM,aAAa,KAAK,MACtB,OAAO,KAAK,WAAW,SAAS,gBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAC9E;EAEA,IAAI,OAAO,WAAW,cAAc,YAAY,WAAW,UAAU,SAAS,GAC5E,OAAO,WAAW;CAEtB,QAAQ,CAER;CAEA,MAAM,IAAI,oBAAoB,uBAAuB;AACvD;;;;;;;AAQA,eAAsB,qBACpB,UACA,YACmD;CACnD,MAAM,YAAY,gBAAgB,UAAU;CAC5C,MAAM,MAAM,MAAM,kBAAkB,CAAC,CAAC,WAAW,iBAAiB,SAAS,GAAG,QAAQ;CAEtF,IAAI,CAAC,OAAO,IAAI,cAAc,IAAI,WAChC,MAAM,IAAI,oBAAoB,8BAA8B;CAG9D,IAAI,CAAE,MAAM,IAAI,gBAAgB,GAC9B,MAAM,IAAI,oBAAoB,wBAAwB;CAGxD,OAAO;EAAE;EAAW;CAAI;AAC1B;;;;;;AAOA,SAAgB,oBAAoB,SAA4B;CAC9D,MAAM,UAAU,WAAW,SAAS,QAAQ;CAC5C,MAAM,SAAS,QAAQ;CAEvB,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ,SAAS,MAAM,GACxD,MAAM,IAAI,oBAAoB,iBAAiB;CAGjD,OAAO;AACT"}

package/esm/passkeys/passkey-registration.d.mts

@@ -0,0 +1,29 @@
+import { Auth } from "../models/auth.model.mjs";
+import { PasskeyCredential } from "../models/passkey-credential/passkey-credential.model.mjs";
+import { PasskeyOptionsJSON, PasskeyResponseJSON } from "./simplewebauthn.mjs";
+import { Request } from "@warlock.js/core";
+
+//#region ../auth/src/passkeys/passkey-registration.d.ts
+/**
+ * Registration options for a LOGGED-IN user adding a passkey. The challenge is
+ * stored single-use and bound to this user; the user's existing credentials
+ * are excluded so the same authenticator is not registered twice.
+ *
+ * @example
+ * // POST /auth/passkeys/register/options  (authMiddleware)
+ * response.success(await generatePasskeyRegistrationOptions(request.locals.user));
+ */
+declare function generatePasskeyRegistrationOptions(user: Auth): Promise<PasskeyOptionsJSON>;
+/**
+ * Verify the browser's registration response and store the credential.
+ * Checks, in order: the request `Origin` (CSRF), the single-use challenge
+ * (consumed even if what follows fails) belongs to THIS user, then the
+ * attestation via `@simplewebauthn/server` against the configured origins and
+ * rpID.
+ *
+ * @throws InvalidPasskeyError (400, EC011) on any rejection.
+ */
+declare function verifyPasskeyRegistration(request: Request, user: Auth, credential: PasskeyResponseJSON): Promise<PasskeyCredential>;
+//#endregion
+export { generatePasskeyRegistrationOptions, verifyPasskeyRegistration };
+//# sourceMappingURL=passkey-registration.d.mts.map

package/esm/passkeys/passkey-registration.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-registration.d.mts","names":[],"sources":["../../../../../../../auth/src/passkeys/passkey-registration.ts"],"mappings":";;;;;;;;;AAoCA;;;;;;iBAAsB,kCAAA,CAAmC,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,kBAAA;;;;;;;AAAkB;AAgChG;;iBAAsB,yBAAA,CACpB,OAAA,EAAS,OAAA,EACT,IAAA,EAAM,IAAA,EACN,UAAA,EAAY,mBAAA,GACX,OAAA,CAAQ,iBAAA"}

package/esm/passkeys/passkey-registration.mjs

@@ -0,0 +1,88 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { InvalidPasskeyError } from "../errors/invalid-passkey.error.mjs";
+import { PasskeyCredential } from "../models/passkey-credential/passkey-credential.model.mjs";
+import "../models/passkey-credential/index.mjs";
+import { assertPasskeyOrigin, storePasskeyChallenge, takePasskeyChallenge } from "./passkey-challenges.mjs";
+import { loadSimpleWebAuthn } from "./simplewebauthn.mjs";
+
+//#region ../auth/src/passkeys/passkey-registration.ts
+/** Account name the authenticator shows: `auth.passkeys.userName`, else email, else id. */
+function passkeyUserName(user) {
+	const configured = authConfig.passkeys.settings().userName;
+	if (configured) return configured(user);
+	const email = user.get("email");
+	return typeof email === "string" && email ? email : String(user.id);
+}
+/**
+* Registration options for a LOGGED-IN user adding a passkey. The challenge is
+* stored single-use and bound to this user; the user's existing credentials
+* are excluded so the same authenticator is not registered twice.
+*
+* @example
+* // POST /auth/passkeys/register/options  (authMiddleware)
+* response.success(await generatePasskeyRegistrationOptions(request.locals.user));
+*/
+async function generatePasskeyRegistrationOptions(user) {
+	const webauthn = await loadSimpleWebAuthn();
+	const settings = authConfig.passkeys.settings();
+	const existing = await PasskeyCredential.listFor(user);
+	const options = await webauthn.generateRegistrationOptions({
+		rpName: settings.rpName,
+		rpID: settings.rpID,
+		userName: passkeyUserName(user),
+		userID: new TextEncoder().encode(`${user.userType}:${user.id}`),
+		attestationType: "none",
+		excludeCredentials: existing.map((credential) => ({
+			id: credential.credentialId,
+			transports: credential.get("transports") ?? void 0
+		})),
+		authenticatorSelection: {
+			residentKey: "preferred",
+			userVerification: "preferred"
+		}
+	});
+	await storePasskeyChallenge("passkey-registration", options.challenge, user);
+	return options;
+}
+/**
+* Verify the browser's registration response and store the credential.
+* Checks, in order: the request `Origin` (CSRF), the single-use challenge
+* (consumed even if what follows fails) belongs to THIS user, then the
+* attestation via `@simplewebauthn/server` against the configured origins and
+* rpID.
+*
+* @throws InvalidPasskeyError (400, EC011) on any rejection.
+*/
+async function verifyPasskeyRegistration(request, user, credential) {
+	const webauthn = await loadSimpleWebAuthn();
+	const origins = assertPasskeyOrigin(request);
+	const { challenge, row } = await takePasskeyChallenge("passkey-registration", credential);
+	if (String(row.userId) !== String(user.id) || row.userType !== user.userType) throw new InvalidPasskeyError("challenge-issued-to-another-user");
+	let verification;
+	try {
+		verification = await webauthn.verifyRegistrationResponse({
+			response: credential,
+			expectedChallenge: challenge,
+			expectedOrigin: origins,
+			expectedRPID: authConfig.passkeys.settings().rpID,
+			requireUserVerification: false
+		});
+	} catch (error) {
+		throw new InvalidPasskeyError("registration-verification-failed", error);
+	}
+	if (!verification.verified || !verification.registrationInfo) throw new InvalidPasskeyError("registration-not-verified");
+	const { id, publicKey, counter, transports } = verification.registrationInfo.credential;
+	if (await PasskeyCredential.findByCredentialId(id)) throw new InvalidPasskeyError("credential-already-registered");
+	return PasskeyCredential.create({
+		credential_id: id,
+		public_key: Buffer.from(publicKey).toString("base64url"),
+		counter,
+		transports: transports ?? credential.response.transports ?? [],
+		user_id: user.id,
+		user_type: user.userType
+	});
+}
+
+//#endregion
+export { generatePasskeyRegistrationOptions, verifyPasskeyRegistration };
+//# sourceMappingURL=passkey-registration.mjs.map

package/esm/passkeys/passkey-registration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-registration.mjs","names":[],"sources":["../../../../../../../auth/src/passkeys/passkey-registration.ts"],"sourcesContent":["import type { Request } from \"@warlock.js/core\";\nimport { InvalidPasskeyError } from \"../errors/invalid-passkey.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { PasskeyCredential } from \"../models/passkey-credential\";\nimport { authConfig } from \"../services/auth-config\";\nimport {\n  assertPasskeyOrigin,\n  storePasskeyChallenge,\n  takePasskeyChallenge,\n} from \"./passkey-challenges\";\nimport {\n  loadSimpleWebAuthn,\n  type PasskeyOptionsJSON,\n  type PasskeyResponseJSON,\n} from \"./simplewebauthn\";\n\n/** Account name the authenticator shows: `auth.passkeys.userName`, else email, else id. */\nfunction passkeyUserName(user: Auth): string {\n  const configured = authConfig.passkeys.settings().userName;\n\n  if (configured) return configured(user);\n\n  const email = user.get(\"email\");\n\n  return typeof email === \"string\" && email ? email : String(user.id);\n}\n\n/**\n * Registration options for a LOGGED-IN user adding a passkey. The challenge is\n * stored single-use and bound to this user; the user's existing credentials\n * are excluded so the same authenticator is not registered twice.\n *\n * @example\n * // POST /auth/passkeys/register/options  (authMiddleware)\n * response.success(await generatePasskeyRegistrationOptions(request.locals.user));\n */\nexport async function generatePasskeyRegistrationOptions(user: Auth): Promise<PasskeyOptionsJSON> {\n  const webauthn = await loadSimpleWebAuthn();\n  const settings = authConfig.passkeys.settings();\n  const existing = await PasskeyCredential.listFor(user);\n\n  const options = await webauthn.generateRegistrationOptions({\n    rpName: settings.rpName,\n    rpID: settings.rpID,\n    userName: passkeyUserName(user),\n    userID: new TextEncoder().encode(`${user.userType}:${user.id}`),\n    attestationType: \"none\",\n    excludeCredentials: existing.map((credential) => ({\n      id: credential.credentialId,\n      transports: credential.get(\"transports\") ?? undefined,\n    })),\n    authenticatorSelection: { residentKey: \"preferred\", userVerification: \"preferred\" },\n  });\n\n  await storePasskeyChallenge(\"passkey-registration\", options.challenge, user);\n\n  return options;\n}\n\n/**\n * Verify the browser's registration response and store the credential.\n * Checks, in order: the request `Origin` (CSRF), the single-use challenge\n * (consumed even if what follows fails) belongs to THIS user, then the\n * attestation via `@simplewebauthn/server` against the configured origins and\n * rpID.\n *\n * @throws InvalidPasskeyError (400, EC011) on any rejection.\n */\nexport async function verifyPasskeyRegistration(\n  request: Request,\n  user: Auth,\n  credential: PasskeyResponseJSON,\n): Promise<PasskeyCredential> {\n  const webauthn = await loadSimpleWebAuthn();\n  const origins = assertPasskeyOrigin(request);\n  const { challenge, row } = await takePasskeyChallenge(\"passkey-registration\", credential);\n\n  if (String(row.userId) !== String(user.id) || row.userType !== user.userType) {\n    throw new InvalidPasskeyError(\"challenge-issued-to-another-user\");\n  }\n\n  let verification: Awaited<ReturnType<typeof webauthn.verifyRegistrationResponse>>;\n\n  try {\n    verification = await webauthn.verifyRegistrationResponse({\n      response: credential,\n      expectedChallenge: challenge,\n      expectedOrigin: origins,\n      expectedRPID: authConfig.passkeys.settings().rpID,\n      requireUserVerification: false,\n    });\n  } catch (error) {\n    throw new InvalidPasskeyError(\"registration-verification-failed\", error);\n  }\n\n  if (!verification.verified || !verification.registrationInfo) {\n    throw new InvalidPasskeyError(\"registration-not-verified\");\n  }\n\n  const { id, publicKey, counter, transports } = verification.registrationInfo.credential;\n\n  if (await PasskeyCredential.findByCredentialId(id)) {\n    throw new InvalidPasskeyError(\"credential-already-registered\");\n  }\n\n  return PasskeyCredential.create({\n    credential_id: id,\n    public_key: Buffer.from(publicKey).toString(\"base64url\"),\n    counter,\n    transports: transports ?? credential.response.transports ?? [],\n    user_id: user.id,\n    user_type: user.userType,\n  });\n}\n"],"mappings":";;;;;;;;;AAiBA,SAAS,gBAAgB,MAAoB;CAC3C,MAAM,aAAa,WAAW,SAAS,SAAS,CAAC,CAAC;CAElD,IAAI,YAAY,OAAO,WAAW,IAAI;CAEtC,MAAM,QAAQ,KAAK,IAAI,OAAO;CAE9B,OAAO,OAAO,UAAU,YAAY,QAAQ,QAAQ,OAAO,KAAK,EAAE;AACpE;;;;;;;;;;AAWA,eAAsB,mCAAmC,MAAyC;CAChG,MAAM,WAAW,MAAM,mBAAmB;CAC1C,MAAM,WAAW,WAAW,SAAS,SAAS;CAC9C,MAAM,WAAW,MAAM,kBAAkB,QAAQ,IAAI;CAErD,MAAM,UAAU,MAAM,SAAS,4BAA4B;EACzD,QAAQ,SAAS;EACjB,MAAM,SAAS;EACf,UAAU,gBAAgB,IAAI;EAC9B,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,KAAK,SAAS,GAAG,KAAK,IAAI;EAC9D,iBAAiB;EACjB,oBAAoB,SAAS,KAAK,gBAAgB;GAChD,IAAI,WAAW;GACf,YAAY,WAAW,IAAI,YAAY,KAAK;EAC9C,EAAE;EACF,wBAAwB;GAAE,aAAa;GAAa,kBAAkB;EAAY;CACpF,CAAC;CAED,MAAM,sBAAsB,wBAAwB,QAAQ,WAAW,IAAI;CAE3E,OAAO;AACT;;;;;;;;;;AAWA,eAAsB,0BACpB,SACA,MACA,YAC4B;CAC5B,MAAM,WAAW,MAAM,mBAAmB;CAC1C,MAAM,UAAU,oBAAoB,OAAO;CAC3C,MAAM,EAAE,WAAW,QAAQ,MAAM,qBAAqB,wBAAwB,UAAU;CAExF,IAAI,OAAO,IAAI,MAAM,MAAM,OAAO,KAAK,EAAE,KAAK,IAAI,aAAa,KAAK,UAClE,MAAM,IAAI,oBAAoB,kCAAkC;CAGlE,IAAI;CAEJ,IAAI;EACF,eAAe,MAAM,SAAS,2BAA2B;GACvD,UAAU;GACV,mBAAmB;GACnB,gBAAgB;GAChB,cAAc,WAAW,SAAS,SAAS,CAAC,CAAC;GAC7C,yBAAyB;EAC3B,CAAC;CACH,SAAS,OAAO;EACd,MAAM,IAAI,oBAAoB,oCAAoC,KAAK;CACzE;CAEA,IAAI,CAAC,aAAa,YAAY,CAAC,aAAa,kBAC1C,MAAM,IAAI,oBAAoB,2BAA2B;CAG3D,MAAM,EAAE,IAAI,WAAW,SAAS,eAAe,aAAa,iBAAiB;CAE7E,IAAI,MAAM,kBAAkB,mBAAmB,EAAE,GAC/C,MAAM,IAAI,oBAAoB,+BAA+B;CAG/D,OAAO,kBAAkB,OAAO;EAC9B,eAAe;EACf,YAAY,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,WAAW;EACvD;EACA,YAAY,cAAc,WAAW,SAAS,cAAc,CAAC;EAC7D,SAAS,KAAK;EACd,WAAW,KAAK;CAClB,CAAC;AACH"}

package/esm/passkeys/simplewebauthn.d.mts

@@ -0,0 +1,21 @@
+//#region ../auth/src/passkeys/simplewebauthn.d.ts
+/** The browser's JSON-serialized credential (`startRegistration` / `startAuthentication` result). */
+type PasskeyResponseJSON = {
+  id: string;
+  rawId: string;
+  type: string;
+  response: {
+    clientDataJSON: string;
+    transports?: string[];
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+};
+/** Options JSON handed to the browser; `challenge` is what auth stores. */
+type PasskeyOptionsJSON = {
+  challenge: string;
+  [key: string]: unknown;
+};
+//#endregion
+export { PasskeyOptionsJSON, PasskeyResponseJSON };
+//# sourceMappingURL=simplewebauthn.d.mts.map

package/esm/passkeys/simplewebauthn.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simplewebauthn.d.mts","names":[],"sources":["../../../../../../../auth/src/passkeys/simplewebauthn.ts"],"mappings":";;KAMY,mBAAA;EACV,EAAA;EACA,KAAA;EACA,IAAA;EACA,QAAA;IACE,cAAA;IACA,UAAA;IAAA,CACC,GAAA;EAAA;EAAA,CAEF,GAAA;AAAA;AAAW;AAAA,KAIF,kBAAA;EACV,SAAA;EAAA,CACC,GAAW;AAAA"}

package/esm/passkeys/simplewebauthn.mjs

@@ -0,0 +1,13 @@
+import { loadOptionalPeer } from "../services/optional-peer.mjs";
+
+//#region ../auth/src/passkeys/simplewebauthn.ts
+/** The `warlock add` feature that installs `@simplewebauthn/server`. */
+const PASSKEYS_FEATURE = "auth-passkeys";
+/** Load `@simplewebauthn/server`, or throw `AuthProviderSdkMissingError` naming `warlock add auth-passkeys`. */
+function loadSimpleWebAuthn() {
+	return loadOptionalPeer("@simplewebauthn/server", PASSKEYS_FEATURE);
+}
+
+//#endregion
+export { loadSimpleWebAuthn };
+//# sourceMappingURL=simplewebauthn.mjs.map

package/esm/passkeys/simplewebauthn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"simplewebauthn.mjs","names":[],"sources":["../../../../../../../auth/src/passkeys/simplewebauthn.ts"],"sourcesContent":["import { loadOptionalPeer } from \"../services/optional-peer\";\n\n/** The `warlock add` feature that installs `@simplewebauthn/server`. */\nexport const PASSKEYS_FEATURE = \"auth-passkeys\";\n\n/** The browser's JSON-serialized credential (`startRegistration` / `startAuthentication` result). */\nexport type PasskeyResponseJSON = {\n  id: string;\n  rawId: string;\n  type: string;\n  response: {\n    clientDataJSON: string;\n    transports?: string[];\n    [key: string]: unknown;\n  };\n  [key: string]: unknown;\n};\n\n/** Options JSON handed to the browser; `challenge` is what auth stores. */\nexport type PasskeyOptionsJSON = {\n  challenge: string;\n  [key: string]: unknown;\n};\n\n/** A stored credential in the shape `@simplewebauthn/server` verifies against. */\nexport type WebAuthnCredential = {\n  id: string;\n  publicKey: Uint8Array;\n  counter: number;\n  transports?: string[];\n};\n\n/**\n * The slice of `@simplewebauthn/server` (v13) auth uses — declared locally\n * because the package is an optional peer.\n */\nexport type SimpleWebAuthnServer = {\n  generateRegistrationOptions: (options: Record<string, unknown>) => Promise<PasskeyOptionsJSON>;\n  verifyRegistrationResponse: (options: Record<string, unknown>) => Promise<{\n    verified: boolean;\n    registrationInfo?: { credential: WebAuthnCredential };\n  }>;\n  generateAuthenticationOptions: (options: Record<string, unknown>) => Promise<PasskeyOptionsJSON>;\n  verifyAuthenticationResponse: (options: Record<string, unknown>) => Promise<{\n    verified: boolean;\n    authenticationInfo: { newCounter: number };\n  }>;\n};\n\n/** Load `@simplewebauthn/server`, or throw `AuthProviderSdkMissingError` naming `warlock add auth-passkeys`. */\nexport function loadSimpleWebAuthn(): Promise<SimpleWebAuthnServer> {\n  return loadOptionalPeer<SimpleWebAuthnServer>(\"@simplewebauthn/server\", PASSKEYS_FEATURE);\n}\n"],"mappings":";;;;AAGA,MAAa,mBAAmB;;AA+ChC,SAAgB,qBAAoD;CAClE,OAAO,iBAAuC,0BAA0B,gBAAgB;AAC1F"}

package/esm/providers/google-provider.d.mts

@@ -0,0 +1,40 @@
+import { AuthProvider, GoogleProviderConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+
+//#region ../auth/src/providers/google-provider.d.ts
+/** The `warlock add` feature that installs `jose`. */
+declare const GOOGLE_AUTH_FEATURE = "auth-google";
+/** The slice of `jose` the Google provider uses — declared locally because `jose` is an optional peer. */
+type JoseModule = {
+  createRemoteJWKSet: (url: URL) => unknown;
+  jwtVerify: (token: string, key: unknown, options: {
+    issuer: string[];
+    audience: string;
+  }) => Promise<{
+    payload: Record<string, unknown>;
+  }>;
+};
+/** PKCE S256 code challenge for a verifier. */
+declare function pkceChallenge(codeVerifier: string): string;
+/**
+ * Google sign-in: OpenID Connect authorization code flow with PKCE (S256),
+ * `state` and `nonce`. The code is exchanged with plain `fetch`; the id_token
+ * is verified with `jose` against Google's JWKS (signature, `iss`, `aud` = the
+ * client id, `exp`), then its `nonce` is compared. No Google SDK.
+ */
+declare class GoogleProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "google";
+  constructor(settings: GoogleProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Redeem the authorization code (with the PKCE verifier) for an id_token. */
+  private exchangeCode;
+  /** Verify signature, issuer, audience and expiry; resolve the claims. */
+  private verifyIdToken;
+}
+//#endregion
+export { GOOGLE_AUTH_FEATURE, GoogleProvider, JoseModule, pkceChallenge };
+//# sourceMappingURL=google-provider.d.mts.map

package/esm/providers/google-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/google-provider.ts"],"mappings":";;;;cAkBa,mBAAA;AAAb;AAAA,KAGY,UAAA;EACV,kBAAA,GAAqB,GAAA,EAAK,GAAA;EAC1B,SAAA,GACE,KAAA,UACA,GAAA,WACA,OAAA;IAAW,MAAA;IAAkB,QAAA;EAAA,MAC1B,OAAA;IAAU,OAAA,EAAS,MAAA;EAAA;AAAA;;iBAOV,aAAA,CAAc,YAAoB;;;;;;;cAUrC,cAAA,YAA0B,YAAA;EAAA,iBAGD,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,oBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAelB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAxCZ;EAAA,QA0EV,YAAA;EA1EgB;EAAA,QA4GhB,aAAA;AAAA"}

package/esm/providers/google-provider.mjs

@@ -0,0 +1,105 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { loadOptionalPeer } from "../services/optional-peer.mjs";
+import { createHash } from "node:crypto";
+
+//#region ../auth/src/providers/google-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const JWKS_URI = "https://www.googleapis.com/oauth2/v3/certs";
+const ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+const DEFAULT_SCOPES = [
+	"openid",
+	"email",
+	"profile"
+];
+/** The `warlock add` feature that installs `jose`. */
+const GOOGLE_AUTH_FEATURE = "auth-google";
+/** Google's key set, created once per process; `jose` caches the fetched JWKS inside it. */
+let googleKeySet;
+/** PKCE S256 code challenge for a verifier. */
+function pkceChallenge(codeVerifier) {
+	return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+/**
+* Google sign-in: OpenID Connect authorization code flow with PKCE (S256),
+* `state` and `nonce`. The code is exchanged with plain `fetch`; the id_token
+* is verified with `jose` against Google's JWKS (signature, `iss`, `aud` = the
+* client id, `exp`), then its `nonce` is compared. No Google SDK.
+*/
+var GoogleProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "google";
+	}
+	authorizationUrl(state) {
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", (this.settings.scopes ?? DEFAULT_SCOPES).join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("nonce", state.nonce);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const jose = await loadOptionalPeer("jose", GOOGLE_AUTH_FEATURE);
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const idToken = await this.exchangeCode(code, expected.codeVerifier);
+		const claims = await this.verifyIdToken(jose, idToken);
+		if (typeof claims.nonce !== "string" || claims.nonce !== expected.nonce) throw new InvalidProviderCallbackError("nonce-mismatch");
+		if (typeof claims.sub !== "string" || claims.sub.length === 0) throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: claims.sub,
+			email: typeof claims.email === "string" ? claims.email : void 0,
+			emailVerified: claims.email_verified === true,
+			name: typeof claims.name === "string" ? claims.name : void 0,
+			avatar: typeof claims.picture === "string" ? claims.picture : void 0,
+			raw: claims
+		};
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an id_token. */
+	async exchangeCode(code, codeVerifier) {
+		let body;
+		try {
+			const response = await fetch(TOKEN_ENDPOINT, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					code,
+					client_id: this.settings.clientId,
+					client_secret: this.settings.clientSecret,
+					redirect_uri: this.settings.redirectUri,
+					grant_type: "authorization_code",
+					code_verifier: codeVerifier
+				})
+			});
+			if (!response.ok) throw new Error(`Google token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (typeof body.id_token !== "string") throw new InvalidProviderCallbackError("missing-id-token");
+		return body.id_token;
+	}
+	/** Verify signature, issuer, audience and expiry; resolve the claims. */
+	async verifyIdToken(jose, idToken) {
+		googleKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));
+		try {
+			const { payload } = await jose.jwtVerify(idToken, googleKeySet, {
+				issuer: ISSUERS,
+				audience: this.settings.clientId
+			});
+			return payload;
+		} catch (error) {
+			throw new InvalidProviderCallbackError("invalid-id-token", error);
+		}
+	}
+};
+
+//#endregion
+export { GOOGLE_AUTH_FEATURE, GoogleProvider, pkceChallenge };
+//# sourceMappingURL=google-provider.mjs.map

package/esm/providers/google-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/google-provider.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type {\n  AuthProvider,\n  GoogleProviderConfig,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { loadOptionalPeer } from \"../services/optional-peer\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst TOKEN_ENDPOINT = \"https://oauth2.googleapis.com/token\";\nconst JWKS_URI = \"https://www.googleapis.com/oauth2/v3/certs\";\nconst ISSUERS = [\"https://accounts.google.com\", \"accounts.google.com\"];\nconst DEFAULT_SCOPES = [\"openid\", \"email\", \"profile\"];\n\n/** The `warlock add` feature that installs `jose`. */\nexport const GOOGLE_AUTH_FEATURE = \"auth-google\";\n\n/** The slice of `jose` the Google provider uses — declared locally because `jose` is an optional peer. */\nexport type JoseModule = {\n  createRemoteJWKSet: (url: URL) => unknown;\n  jwtVerify: (\n    token: string,\n    key: unknown,\n    options: { issuer: string[]; audience: string },\n  ) => Promise<{ payload: Record<string, unknown> }>;\n};\n\n/** Google's key set, created once per process; `jose` caches the fetched JWKS inside it. */\nlet googleKeySet: unknown;\n\n/** PKCE S256 code challenge for a verifier. */\nexport function pkceChallenge(codeVerifier: string): string {\n  return createHash(\"sha256\").update(codeVerifier).digest(\"base64url\");\n}\n\n/**\n * Google sign-in: OpenID Connect authorization code flow with PKCE (S256),\n * `state` and `nonce`. The code is exchanged with plain `fetch`; the id_token\n * is verified with `jose` against Google's JWKS (signature, `iss`, `aud` = the\n * client id, `exp`), then its `nonce` is compared. No Google SDK.\n */\nexport class GoogleProvider implements AuthProvider {\n  public readonly name = \"google\";\n\n  public constructor(private readonly settings: GoogleProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"nonce\", state.nonce);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    // Load the peer first: a missing SDK fails loudly before any network call.\n    const jose = await loadOptionalPeer<JoseModule>(\"jose\", GOOGLE_AUTH_FEATURE);\n\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const idToken = await this.exchangeCode(code, expected.codeVerifier);\n    const claims = await this.verifyIdToken(jose, idToken);\n\n    if (typeof claims.nonce !== \"string\" || claims.nonce !== expected.nonce) {\n      throw new InvalidProviderCallbackError(\"nonce-mismatch\");\n    }\n\n    if (typeof claims.sub !== \"string\" || claims.sub.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: claims.sub,\n      email: typeof claims.email === \"string\" ? claims.email : undefined,\n      // Google sends a boolean; anything else counts as NOT verified.\n      emailVerified: claims.email_verified === true,\n      name: typeof claims.name === \"string\" ? claims.name : undefined,\n      avatar: typeof claims.picture === \"string\" ? claims.picture : undefined,\n      raw: claims,\n    };\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an id_token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { id_token?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          client_secret: this.settings.clientSecret,\n          redirect_uri: this.settings.redirectUri,\n          grant_type: \"authorization_code\",\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`Google token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { id_token?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (typeof body.id_token !== \"string\") {\n      throw new InvalidProviderCallbackError(\"missing-id-token\");\n    }\n\n    return body.id_token;\n  }\n\n  /** Verify signature, issuer, audience and expiry; resolve the claims. */\n  private async verifyIdToken(jose: JoseModule, idToken: string): Promise<Record<string, unknown>> {\n    googleKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));\n\n    try {\n      const { payload } = await jose.jwtVerify(idToken, googleKeySet, {\n        issuer: ISSUERS,\n        audience: this.settings.clientId,\n      });\n\n      return payload;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"invalid-id-token\", error);\n    }\n  }\n}\n"],"mappings":";;;;;AAWA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,WAAW;AACjB,MAAM,UAAU,CAAC,+BAA+B,qBAAqB;AACrE,MAAM,iBAAiB;CAAC;CAAU;CAAS;AAAS;;AAGpD,MAAa,sBAAsB;;AAanC,IAAI;;AAGJ,SAAgB,cAAc,cAA8B;CAC1D,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,WAAW;AACrE;;;;;;;AAQA,IAAa,iBAAb,MAAoD;CAGlD,AAAO,YAAY,AAAiB,UAAgC;EAAhC;cAFb;CAE8C;CAErE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EAEnD,MAAM,OAAO,MAAM,iBAA6B,QAAQ,mBAAmB;EAE3E,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,UAAU,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACnE,MAAM,SAAS,MAAM,KAAK,cAAc,MAAM,OAAO;EAErD,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,SAAS,OAChE,MAAM,IAAI,6BAA6B,gBAAgB;EAGzD,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,IAAI,WAAW,GAC1D,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,OAAO;GACvB,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;GAEzD,eAAe,OAAO,mBAAmB;GACzC,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;GACtD,QAAQ,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;GAC9D,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,eAAe,KAAK,SAAS;KAC7B,cAAc,KAAK,SAAS;KAC5B,YAAY;KACZ,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;GAGrE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,OAAO,KAAK,aAAa,UAC3B,MAAM,IAAI,6BAA6B,kBAAkB;EAG3D,OAAO,KAAK;CACd;;CAGA,MAAc,cAAc,MAAkB,SAAmD;EAC/F,iBAAiB,KAAK,mBAAmB,IAAI,IAAI,QAAQ,CAAC;EAE1D,IAAI;GACF,MAAM,EAAE,YAAY,MAAM,KAAK,UAAU,SAAS,cAAc;IAC9D,QAAQ;IACR,UAAU,KAAK,SAAS;GAC1B,CAAC;GAED,OAAO;EACT,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,oBAAoB,KAAK;EAClE;CACF;AACF"}

package/esm/providers/index.d.mts

@@ -0,0 +1,2 @@
+import { GOOGLE_AUTH_FEATURE, GoogleProvider, JoseModule, pkceChallenge } from "./google-provider.mjs";
+import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./provider-login.mjs";

package/esm/providers/index.mjs

@@ -0,0 +1,4 @@
+import { GOOGLE_AUTH_FEATURE, GoogleProvider, pkceChallenge } from "./google-provider.mjs";
+import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./provider-login.mjs";
+
+export {  };

package/esm/providers/provider-login.d.mts

@@ -0,0 +1,43 @@
+import { Auth } from "../models/auth.model.mjs";
+import { AuthProvider } from "../contracts/providers.mjs";
+import { DeviceInfo, LoginResult } from "../contracts/types.mjs";
+import { Request, Response } from "@warlock.js/core";
+import { ChildModel } from "@warlock.js/cascade";
+
+//#region ../auth/src/providers/provider-login.d.ts
+/**
+ * Resolve a provider by name: `google` from `auth.providers.google`, anything
+ * else from `auth.providers.custom`. Throws naming the config key when absent.
+ */
+declare function resolveAuthProvider(name: string): AuthProvider;
+/**
+ * Start a redirect login: generate `state`, `nonce` and a PKCE verifier, store
+ * them in a signed 10-minute cookie, and resolve the provider URL to redirect
+ * the browser to.
+ *
+ * @example
+ * // GET /auth/google
+ * export const googleRedirect: RequestHandler = async (_request, response) =>
+ *   response.redirect(await startProviderLogin(response, "google"));
+ */
+declare function startProviderLogin(response: Response, providerName: string): Promise<string>;
+/**
+ * Finish a redirect login on the provider's callback: consume the state
+ * cookie, reject a missing/forged/expired cookie, a cookie from another
+ * provider, a provider-reported error or a `state` mismatch; let the provider
+ * verify the callback; find-or-link the user; then log them in through
+ * `authService.completeLogin` — the same outcome as password login.
+ *
+ * @throws InvalidProviderCallbackError (400, EC009) for any callback rejection.
+ * @throws ProviderEmailNotVerifiedError (403, EC010) for an unlinked, unverified email.
+ * @throws AuthProviderSdkMissingError when the provider's SDK is not installed.
+ *
+ * @example
+ * // GET /auth/google/callback
+ * const { user, tokens } = await completeProviderLogin(User, "google", request, response);
+ * authService.setAuthCookie(response, tokens.accessToken);
+ */
+declare function completeProviderLogin<T extends Auth>(Model: ChildModel<T>, providerName: string, request: Request, response: Response, deviceInfo?: DeviceInfo): Promise<LoginResult<T>>;
+//#endregion
+export { completeProviderLogin, resolveAuthProvider, startProviderLogin };
+//# sourceMappingURL=provider-login.d.mts.map

package/esm/providers/provider-login.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-login.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/provider-login.ts"],"mappings":";;;;;;;;;AAiBA;;iBAAgB,mBAAA,CAAoB,IAAA,WAAe,YAAY;;AAAA;AA4B/D;;;;;;;;iBAAsB,kBAAA,CACpB,QAAA,EAAU,QAAA,EACV,YAAA,WACC,OAAO;AAAA;AAgCV;;;;;;;;;;;;;;;AAhCU,iBAgCY,qBAAA,WAAgC,IAAA,EACpD,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,YAAA,UACA,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA"}

package/esm/providers/provider-login.mjs

@@ -0,0 +1,86 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { authService } from "../services/auth.service.mjs";
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { safeEqual } from "../utils/safe-equal.mjs";
+import { GoogleProvider } from "./google-provider.mjs";
+import { randomUrlSafe, takeProviderState, writeProviderState } from "./provider-state-cookie.mjs";
+import { resolveProviderUser } from "./resolve-provider-user.mjs";
+
+//#region ../auth/src/providers/provider-login.ts
+/**
+* Resolve a provider by name: `google` from `auth.providers.google`, anything
+* else from `auth.providers.custom`. Throws naming the config key when absent.
+*/
+function resolveAuthProvider(name) {
+	if (name === "google") {
+		const google = authConfig.providers.google();
+		if (google) return new GoogleProvider(google);
+	} else {
+		const custom = authConfig.providers.custom(name);
+		if (custom) return custom;
+	}
+	throw new Error(`@warlock.js/auth: no login provider "${name}" — configure \`auth.providers.${name === "google" ? "google" : `custom.${name}`}\`.`);
+}
+/**
+* Start a redirect login: generate `state`, `nonce` and a PKCE verifier, store
+* them in a signed 10-minute cookie, and resolve the provider URL to redirect
+* the browser to.
+*
+* @example
+* // GET /auth/google
+* export const googleRedirect: RequestHandler = async (_request, response) =>
+*   response.redirect(await startProviderLogin(response, "google"));
+*/
+async function startProviderLogin(response, providerName) {
+	const provider = resolveAuthProvider(providerName);
+	const state = {
+		state: randomUrlSafe(),
+		nonce: randomUrlSafe(),
+		codeVerifier: randomUrlSafe()
+	};
+	const url = await provider.authorizationUrl(state);
+	writeProviderState(response, provider.name, state);
+	return url;
+}
+/**
+* Finish a redirect login on the provider's callback: consume the state
+* cookie, reject a missing/forged/expired cookie, a cookie from another
+* provider, a provider-reported error or a `state` mismatch; let the provider
+* verify the callback; find-or-link the user; then log them in through
+* `authService.completeLogin` — the same outcome as password login.
+*
+* @throws InvalidProviderCallbackError (400, EC009) for any callback rejection.
+* @throws ProviderEmailNotVerifiedError (403, EC010) for an unlinked, unverified email.
+* @throws AuthProviderSdkMissingError when the provider's SDK is not installed.
+*
+* @example
+* // GET /auth/google/callback
+* const { user, tokens } = await completeProviderLogin(User, "google", request, response);
+* authService.setAuthCookie(response, tokens.accessToken);
+*/
+async function completeProviderLogin(Model, providerName, request, response, deviceInfo) {
+	const provider = resolveAuthProvider(providerName);
+	const expected = takeProviderState(request, response);
+	if (!expected) throw new InvalidProviderCallbackError("missing-or-invalid-state-cookie");
+	if (expected.provider !== provider.name) throw new InvalidProviderCallbackError("state-cookie-for-another-provider");
+	const query = {
+		code: request.input("code"),
+		state: request.input("state"),
+		error: request.input("error")
+	};
+	if (query.error) throw new InvalidProviderCallbackError(`provider-error:${String(query.error)}`);
+	if (typeof query.state !== "string" || !safeEqual(query.state, expected.state)) throw new InvalidProviderCallbackError("state-mismatch");
+	const user = await resolveProviderUser(Model, await provider.handleCallback({
+		query,
+		expected: {
+			state: expected.state,
+			nonce: expected.nonce,
+			codeVerifier: expected.codeVerifier
+		}
+	}));
+	return authService.completeLogin(user, deviceInfo);
+}
+
+//#endregion
+export { completeProviderLogin, resolveAuthProvider, startProviderLogin };
+//# sourceMappingURL=provider-login.mjs.map

package/esm/providers/provider-login.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-login.mjs","names":[],"sources":["../../../../../../../auth/src/providers/provider-login.ts"],"sourcesContent":["import type { ChildModel } from \"@warlock.js/cascade\";\nimport type { Request, Response } from \"@warlock.js/core\";\nimport type { AuthProvider } from \"../contracts/providers\";\nimport type { DeviceInfo, LoginResult } from \"../contracts/types\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { authConfig } from \"../services/auth-config\";\nimport { authService } from \"../services/auth.service\";\nimport { GoogleProvider } from \"./google-provider\";\nimport { safeEqual } from \"../utils/safe-equal\";\nimport { randomUrlSafe, takeProviderState, writeProviderState } from \"./provider-state-cookie\";\nimport { resolveProviderUser } from \"./resolve-provider-user\";\n\n/**\n * Resolve a provider by name: `google` from `auth.providers.google`, anything\n * else from `auth.providers.custom`. Throws naming the config key when absent.\n */\nexport function resolveAuthProvider(name: string): AuthProvider {\n  if (name === \"google\") {\n    const google = authConfig.providers.google();\n\n    if (google) return new GoogleProvider(google);\n  } else {\n    const custom = authConfig.providers.custom(name);\n\n    if (custom) return custom;\n  }\n\n  throw new Error(\n    `@warlock.js/auth: no login provider \"${name}\" — configure \\`auth.providers.${\n      name === \"google\" ? \"google\" : `custom.${name}`\n    }\\`.`,\n  );\n}\n\n/**\n * Start a redirect login: generate `state`, `nonce` and a PKCE verifier, store\n * them in a signed 10-minute cookie, and resolve the provider URL to redirect\n * the browser to.\n *\n * @example\n * // GET /auth/google\n * export const googleRedirect: RequestHandler = async (_request, response) =>\n *   response.redirect(await startProviderLogin(response, \"google\"));\n */\nexport async function startProviderLogin(\n  response: Response,\n  providerName: string,\n): Promise<string> {\n  const provider = resolveAuthProvider(providerName);\n\n  const state = {\n    state: randomUrlSafe(),\n    nonce: randomUrlSafe(),\n    codeVerifier: randomUrlSafe(),\n  };\n\n  const url = await provider.authorizationUrl(state);\n\n  writeProviderState(response, provider.name, state);\n\n  return url;\n}\n\n/**\n * Finish a redirect login on the provider's callback: consume the state\n * cookie, reject a missing/forged/expired cookie, a cookie from another\n * provider, a provider-reported error or a `state` mismatch; let the provider\n * verify the callback; find-or-link the user; then log them in through\n * `authService.completeLogin` — the same outcome as password login.\n *\n * @throws InvalidProviderCallbackError (400, EC009) for any callback rejection.\n * @throws ProviderEmailNotVerifiedError (403, EC010) for an unlinked, unverified email.\n * @throws AuthProviderSdkMissingError when the provider's SDK is not installed.\n *\n * @example\n * // GET /auth/google/callback\n * const { user, tokens } = await completeProviderLogin(User, \"google\", request, response);\n * authService.setAuthCookie(response, tokens.accessToken);\n */\nexport async function completeProviderLogin<T extends Auth>(\n  Model: ChildModel<T>,\n  providerName: string,\n  request: Request,\n  response: Response,\n  deviceInfo?: DeviceInfo,\n): Promise<LoginResult<T>> {\n  const provider = resolveAuthProvider(providerName);\n  const expected = takeProviderState(request, response);\n\n  if (!expected) {\n    throw new InvalidProviderCallbackError(\"missing-or-invalid-state-cookie\");\n  }\n\n  if (expected.provider !== provider.name) {\n    throw new InvalidProviderCallbackError(\"state-cookie-for-another-provider\");\n  }\n\n  const query: Record<string, unknown> = {\n    code: request.input(\"code\"),\n    state: request.input(\"state\"),\n    error: request.input(\"error\"),\n  };\n\n  if (query.error) {\n    throw new InvalidProviderCallbackError(`provider-error:${String(query.error)}`);\n  }\n\n  if (typeof query.state !== \"string\" || !safeEqual(query.state, expected.state)) {\n    throw new InvalidProviderCallbackError(\"state-mismatch\");\n  }\n\n  const profile = await provider.handleCallback({\n    query,\n    expected: { state: expected.state, nonce: expected.nonce, codeVerifier: expected.codeVerifier },\n  });\n\n  const user = await resolveProviderUser(Model, profile);\n\n  return authService.completeLogin(user, deviceInfo);\n}\n"],"mappings":";;;;;;;;;;;;;AAiBA,SAAgB,oBAAoB,MAA4B;CAC9D,IAAI,SAAS,UAAU;EACrB,MAAM,SAAS,WAAW,UAAU,OAAO;EAE3C,IAAI,QAAQ,OAAO,IAAI,eAAe,MAAM;CAC9C,OAAO;EACL,MAAM,SAAS,WAAW,UAAU,OAAO,IAAI;EAE/C,IAAI,QAAQ,OAAO;CACrB;CAEA,MAAM,IAAI,MACR,wCAAwC,KAAK,iCAC3C,SAAS,WAAW,WAAW,UAAU,OAC1C,IACH;AACF;;;;;;;;;;;AAYA,eAAsB,mBACpB,UACA,cACiB;CACjB,MAAM,WAAW,oBAAoB,YAAY;CAEjD,MAAM,QAAQ;EACZ,OAAO,cAAc;EACrB,OAAO,cAAc;EACrB,cAAc,cAAc;CAC9B;CAEA,MAAM,MAAM,MAAM,SAAS,iBAAiB,KAAK;CAEjD,mBAAmB,UAAU,SAAS,MAAM,KAAK;CAEjD,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,eAAsB,sBACpB,OACA,cACA,SACA,UACA,YACyB;CACzB,MAAM,WAAW,oBAAoB,YAAY;CACjD,MAAM,WAAW,kBAAkB,SAAS,QAAQ;CAEpD,IAAI,CAAC,UACH,MAAM,IAAI,6BAA6B,iCAAiC;CAG1E,IAAI,SAAS,aAAa,SAAS,MACjC,MAAM,IAAI,6BAA6B,mCAAmC;CAG5E,MAAM,QAAiC;EACrC,MAAM,QAAQ,MAAM,MAAM;EAC1B,OAAO,QAAQ,MAAM,OAAO;EAC5B,OAAO,QAAQ,MAAM,OAAO;CAC9B;CAEA,IAAI,MAAM,OACR,MAAM,IAAI,6BAA6B,kBAAkB,OAAO,MAAM,KAAK,GAAG;CAGhF,IAAI,OAAO,MAAM,UAAU,YAAY,CAAC,UAAU,MAAM,OAAO,SAAS,KAAK,GAC3E,MAAM,IAAI,6BAA6B,gBAAgB;CAQzD,MAAM,OAAO,MAAM,oBAAoB,OAAO,MALxB,SAAS,eAAe;EAC5C;EACA,UAAU;GAAE,OAAO,SAAS;GAAO,OAAO,SAAS;GAAO,cAAc,SAAS;EAAa;CAChG,CAAC,CAEoD;CAErD,OAAO,YAAY,cAAc,MAAM,UAAU;AACnD"}