@webda/google-auth 4.0.0-beta.2 → 4.0.0-beta.4

package/README.md

@@ -0,0 +1,122 @@
+# @webda/google-auth module
+
+This module is part of Webda Application Framework that allows you to quickly develop applications with all modern prerequisites: Security, Extensibility, GraphQL, REST, CloudNative [https://webda.io](https://webda.io)
+
+<img src="https://webda.io/images/webda.svg" width="128" />
+
+![CI](https://github.com/loopingz/webda.io/workflows/CI/badge.svg)
+
+[![Join the chat at https://gitter.im/loopingz/webda](https://badges.gitter.im/loopingz/webda.svg)](https://gitter.im/loopingz/webda?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+[![codecov](https://codecov.io/gh/loopingz/webda.io/branch/main/graph/badge.svg?token=8N9DNM3K3O)](https://codecov.io/gh/loopingz/webda.io)
+[![SonarCloud.io](https://sonarcloud.io/api/project_badges/measure?project=loopingz_webda.io&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=loopingz_webda.io)
+![CodeQL](https://github.com/loopingz/webda.io/workflows/CodeQL/badge.svg)
+
+<!-- README_HEADER -->
+
+# @webda/google-auth
+
+> "Sign in with Google" (OpenID Connect) provider for [`@webda/auth`](../auth): adds `GET /auth/google`, its callback
+> and the `Auth.Google.Token` operation; logins go through the `Authentication` service (linking, registration,
+> sessions, tokens).
+
+## When to use it
+
+- You want users to sign in with their Google account, in the browser or from a mobile/desktop client holding a
+  Google ID token.
+- You want to restrict logins to a Google Workspace domain (`hostedDomain`).
+- You need an offline Google refresh token (`access_type: "offline"`; stored in the ident tokens).
+
+## Install
+
+```bash
+pnpm add @webda/auth @webda/google-auth
+```
+
+## Configuration
+
+`GoogleAuthentication` is a provider service next to `Authentication` (see the
+[Authentication guide](https://docs.webda.io/Security/Authentication)):
+
+```jsonc
+{
+  "services": {
+    "Authentication": { "type": "Webda/Authentication" },
+    "google": {
+      "type": "Webda/GoogleAuthentication",
+      "client_id": "${GOOGLE_CLIENT_ID}",
+      "client_secret": "${GOOGLE_CLIENT_SECRET}",
+      // Register exactly this url in the Google Cloud console; set it explicitly behind a proxy
+      "redirect_uri": "https://api.example.com/auth/google/callback",
+      "redirects": {
+        "success": "https://app.example.com/", // default "/"
+        "failure": "https://app.example.com/login" // required, receives ?reason=CODE
+      },
+      // Allowed targets of GET /auth/google?redirect=... (same origin, this path or below)
+      "authorized_uris": ["https://app.example.com/"],
+      "audiences": ["1234-ios.apps.googleusercontent.com"], // other client ids accepted by Auth.Google.Token
+      "hostedDomain": "example.com" // optional: Google Workspace accounts of this domain only
+    }
+  }
+}
+```
+
+| Parameter                                       | Default                          | Description                                                                                     |
+| ----------------------------------------------- | -------------------------------- | ----------------------------------------------------------------------------------------------- |
+| `client_id`, `client_secret`                    | required                         | OAuth client of type "Web application"                                                          |
+| `url`                                           | `/auth/google`                   | Prefix of the login and callback routes                                                         |
+| `redirect_uri`                                  | request url + `/callback`        | Callback url sent to Google                                                                     |
+| `redirects.success` / `redirects.failure`       | `/` / required                   | Where the callback redirects                                                                    |
+| `authorized_uris`                               | `[]`                             | Allowed `redirect` parameters (absolute urls)                                                   |
+| `scope`                                         | `["openid", "email", "profile"]` | Requested scopes (`openid` is needed for the ID token)                                          |
+| `access_type`                                   | `"online"`                       | `"offline"` also returns a refresh token                                                        |
+| `audiences`                                     | `[]`                             | Extra client ids accepted by `Auth.Google.Token`                                                |
+| `hostedDomain`                                  | -                                | Required `hd` claim; refused with `EMAIL_DOMAIN_NOT_ALLOWED`                                    |
+| `auth_options`                                  | -                                | Extra authorization url parameters (`prompt`, `login_hint`...); cannot override the flow fields |
+| `allowedEmailDomains`, `trustEmailVerification` | -                                | Per-provider email policy of `@webda/auth`                                                      |
+
+## Usage
+
+- Browser: link to `GET /auth/google?redirect=https://app.example.com/after`. The flow uses PKCE and an OpenID nonce,
+  kept in a short-lived encrypted `webda_oauth_google` cookie (so it also works with a `SameSite=Strict` session
+  cookie). After the Google consent the callback logs the user in and redirects to `redirect` (or
+  `redirects.success`), adding `?mfa=required` when the user still has to pass MFA. Failures redirect to
+  `redirects.failure?reason=CODE` (`STATE_MISMATCH`, `PROVIDER_ERROR`, `TOKEN_INVALID`, `ACCOUNT_EXISTS`,
+  `EMAIL_DOMAIN_NOT_ALLOWED`, ...).
+- Other clients: `POST /auth/google/token` (`Auth.Google.Token`) with a JSON body `{ "token": "<Google ID token>" }`
+  or the v3 body `{ "tokens": { "id_token": "...", "access_token": "...", ... } }` returns the `@webda/auth` result
+  (`{ status: "ok", accessToken, refreshToken, ... }`). Only ID tokens are verified; access tokens alone are refused.
+  This operation never links the identity to an already logged-in user.
+
+The Google identity is the ID token `sub`; the email is only treated as verified when `email_verified` is `true`.
+Google credentials are stored encrypted on the ident (`await ident.tokens.get()`) and published after each login:
+
+```typescript
+useService("google").on("GoogleAuth.Tokens", async ({ tokens, context }) => {
+  // tokens.access_token, tokens.refresh_token (access_type "offline")
+});
+```
+
+## Reference
+
+- Source: [`packages/google-auth`](https://github.com/loopingz/webda.io/tree/main/packages/google-auth)
+- Related: [`@webda/auth`](../auth) (`OAuthProvider` base class, `Authentication` service).
+
+<!-- README_FOOTER -->
+
+## Sponsors
+
+<!--
+Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor](mailto:sponsor@webda.io)
+-->
+
+Arize AI is a machine learning observability and model monitoring platform. It helps you visualize, monitor, and explain your machine learning models. [Learn more](https://arize.com)
+
+[<img src="https://arize.com/hubfs/arize/brand/arize-logomark-1.png" width="200">](https://arize.com)
+
+Loopingz is a software development company that provides consulting and development services. [Learn more](https://loopingz.com)
+
+[<img src="https://loopingz.com/images/logo.png" width="200">](https://loopingz.com)
+
+Tellae is an innovative consulting firm specialized in cities transportation issues. We provide our clients, both public and private, with solutions to support your strategic and operational decisions. [Learn more](https://tellae.fr)
+
+[<img src="https://tellae.fr/" width="200">](https://tellae.fr)

package/lib/google-auth.service.d.ts

@@ -0,0 +1,125 @@
+import { type AuthResult, type EventWithContext, type ResolvedIdentity } from "@webda/core";
+import { type OAuthAuthorizationRequest, type OAuthCallbackRequest, OAuthProvider, OAuthProviderParameters, type OAuthTokenRequest } from "@webda/auth";
+import { type Credentials, OAuth2Client, type TokenPayload } from "google-auth-library";
+/** Emitted with the Google credentials of a successful login */
+export interface EventGoogleOAuthToken extends EventWithContext {
+    /**
+     * Credentials: from the code exchange (browser flow), or as sent to `Auth.Google.Token` (`tokens`, or
+     * `{ id_token }` for a bare token). Only the ID token is verified: treat the other values as client-provided on
+     * the token operation
+     */
+    tokens: Credentials;
+}
+/** Events of GoogleAuthentication */
+export type GoogleAuthEvents = {
+    "GoogleAuth.Tokens": EventGoogleOAuthToken;
+};
+/**
+ * Google login parameters
+ * https://developers.google.com/identity/protocols/oauth2/openid-connect
+ */
+export declare class GoogleParameters extends OAuthProviderParameters {
+    /**
+     * Google OAuth client id (web application)
+     */
+    client_id: string;
+    /**
+     * Google OAuth client secret
+     */
+    client_secret: string;
+    /**
+     * Scopes requested from Google
+     * @default ["openid", "email", "profile"]
+     */
+    scope?: string[];
+    /**
+     * Type of access: "offline" also returns a refresh token (stored encrypted in the ident tokens)
+     * @default "online"
+     */
+    access_type?: "online" | "offline";
+    /**
+     * Other client ids whose ID tokens `Auth.Google.Token` accepts (for example Android/iOS client ids)
+     * @default []
+     */
+    audiences?: string[];
+    /**
+     * Only accept Google Workspace accounts of this domain (the `hd` claim of the ID token); also sent as a hint to
+     * the account chooser
+     */
+    hostedDomain?: string;
+    /**
+     * Additional authorization url parameters (for example `prompt`, `login_hint`); cannot override `state`,
+     * `redirect_uri`, `scope`, `access_type`, `response_type`, `code_challenge*`, `nonce` nor `hd`
+     * See https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters
+     */
+    auth_options?: Record<string, any>;
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params?: any): this;
+}
+/**
+ * Sign in with Google (OpenID Connect)
+ *
+ * The browser flow (`GET /auth/google`, `GET /auth/google/callback`) uses PKCE and a nonce, exchanges the code and
+ * verifies the returned ID token for `client_id`. `Auth.Google.Token` accepts a Google ID token, as `token` or as
+ * the `id_token` of `tokens` (v3 body), whose audience is `client_id` or one of `audiences` (never an access
+ * token). Credentials are stored encrypted on the ident and emitted with `GoogleAuth.Tokens` after the login.
+ * @WebdaModda GoogleAuthentication
+ */
+export declare class GoogleAuthentication<T extends GoogleParameters = GoogleParameters> extends OAuthProvider<T, GoogleAuthEvents> {
+    static Parameters: typeof GoogleParameters;
+    readonly providerName = "google";
+    /** Client verifying ID tokens: one per service so the Google certificates cache is reused */
+    protected verifier: OAuth2Client;
+    /** @override */
+    init(): Promise<this>;
+    /**
+     * @param redirectUri - callback url
+     * @returns a Google OAuth client for the authorization url and the code exchange
+     */
+    protected getClient(redirectUri?: string): OAuth2Client;
+    /**
+     * @param request - authorization request
+     * @returns the Google authorization url
+     */
+    getAuthorizationUrl(request: OAuthAuthorizationRequest): string;
+    /**
+     * Exchange the code with the PKCE verifier, verify the returned ID token for `client_id` and its nonce
+     * @param request - code exchange
+     * @returns the identity, with the credentials of the exchange
+     */
+    handleCallback(request: OAuthCallbackRequest): Promise<ResolvedIdentity>;
+    /**
+     * Verify a Google ID token sent by a client, as `token` or `tokens.id_token`
+     * @param request - token request
+     * @returns the identity, with the credentials sent in `tokens`
+     */
+    handleToken(request: OAuthTokenRequest): Promise<ResolvedIdentity>;
+    /**
+     * Emit `GoogleAuth.Tokens` once the login succeeded
+     * @param identity - the identity
+     * @param _result - the result
+     * @param source - browser callback or token operation
+     * @param request - the token operation request
+     */
+    protected onAuthenticated(identity: ResolvedIdentity, _result: AuthResult, source: "callback" | "token", request?: OAuthTokenRequest): Promise<void>;
+    /**
+     * Verify an ID token: signature, expiry, issuer (google-auth-library), audience and hosted domain
+     * @param idToken - ID token
+     * @param audiences - accepted audiences
+     * @returns the payload
+     * @throws TokenInvalid when the token does not verify
+     * @throws EmailDomainNotAllowed when `hostedDomain` is set and the token is not from that domain
+     */
+    protected verifyIdToken(idToken: string, audiences: string[]): Promise<TokenPayload>;
+    /**
+     * @param payload - verified ID token payload
+     * @param tokens - credentials to store
+     * @returns the identity
+     */
+    protected toIdentity(payload: TokenPayload, tokens?: Credentials): ResolvedIdentity;
+}
+export default GoogleAuthentication;
+//# sourceMappingURL=google-auth.service.d.ts.map

package/lib/google-auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-auth.service.d.ts","sourceRoot":"","sources":["../src/google-auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAA0B,MAAM,aAAa,CAAC;AACpH,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,aAAa,EACb,uBAAuB,EACvB,KAAK,iBAAiB,EAGvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAuB,KAAK,WAAW,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE7G,gEAAgE;AAChE,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,qCAAqC;AACrC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,mBAAmB,EAAE,qBAAqB,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,uBAAuB;IAC3D;;OAEG;IACK,SAAS,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACK,aAAa,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACK,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEnC;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAM3B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,CAAE,SAAQ,aAAa,CACpG,CAAC,EACD,gBAAgB,CACjB;IACC,MAAM,CAAC,UAAU,0BAAoB;IAErC,QAAQ,CAAC,YAAY,YAAY;IAEjC,6FAA6F;IAC7F,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC;IAEjC,gBAAgB;IACV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAI1B;IAED;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAMtD;IAED;;;OAGG;IACH,mBAAmB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAc9D;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoB7E;IAED;;;;OAIG;IACG,WAAW,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAcvE;IAED;;;;;;OAMG;IACH,UAAgB,eAAe,CAC7B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,UAAU,GAAG,OAAO,EAC5B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAGf;IAED;;;;;;;OAOG;IACH,UAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CA2BzF;IAED;;;;OAIG;IACH,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,gBAAgB,CAUlF;CACF;eAcc,oBAAoB"}

package/lib/google-auth.service.js

@@ -0,0 +1,197 @@
+import { timingSafeEqual } from "node:crypto";
+import { useContext, WebdaError } from "@webda/core";
+import { EmailDomainNotAllowed, OAuthProvider, OAuthProviderParameters, safeErrorReason, TokenInvalid } from "@webda/auth";
+import { CodeChallengeMethod, OAuth2Client } from "google-auth-library";
+/**
+ * Google login parameters
+ * https://developers.google.com/identity/protocols/oauth2/openid-connect
+ */
+export class GoogleParameters extends OAuthProviderParameters {
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params = {}) {
+        super.load(params);
+        this.access_type ?? (this.access_type = "online");
+        this.scope ?? (this.scope = ["openid", "email", "profile"]);
+        this.audiences ?? (this.audiences = []);
+        return this;
+    }
+}
+/**
+ * Sign in with Google (OpenID Connect)
+ *
+ * The browser flow (`GET /auth/google`, `GET /auth/google/callback`) uses PKCE and a nonce, exchanges the code and
+ * verifies the returned ID token for `client_id`. `Auth.Google.Token` accepts a Google ID token, as `token` or as
+ * the `id_token` of `tokens` (v3 body), whose audience is `client_id` or one of `audiences` (never an access
+ * token). Credentials are stored encrypted on the ident and emitted with `GoogleAuth.Tokens` after the login.
+ * @WebdaModda GoogleAuthentication
+ */
+export class GoogleAuthentication extends OAuthProvider {
+    constructor() {
+        super(...arguments);
+        this.providerName = "google";
+    }
+    /** @override */
+    async init() {
+        await super.init();
+        this.verifier = new OAuth2Client({ clientId: this.parameters.client_id });
+        return this;
+    }
+    /**
+     * @param redirectUri - callback url
+     * @returns a Google OAuth client for the authorization url and the code exchange
+     */
+    getClient(redirectUri) {
+        return new OAuth2Client({
+            clientId: this.parameters.client_id,
+            clientSecret: this.parameters.client_secret,
+            redirectUri
+        });
+    }
+    /**
+     * @param request - authorization request
+     * @returns the Google authorization url
+     */
+    getAuthorizationUrl(request) {
+        const { auth_options, access_type, hostedDomain } = this.parameters;
+        return this.getClient(request.redirectUri).generateAuthUrl({
+            ...(auth_options ?? {}),
+            access_type,
+            scope: request.scope,
+            state: request.state,
+            redirect_uri: request.redirectUri,
+            response_type: "code",
+            code_challenge_method: CodeChallengeMethod.S256,
+            code_challenge: request.codeChallenge,
+            nonce: request.nonce,
+            ...(hostedDomain ? { hd: hostedDomain } : {})
+        });
+    }
+    /**
+     * Exchange the code with the PKCE verifier, verify the returned ID token for `client_id` and its nonce
+     * @param request - code exchange
+     * @returns the identity, with the credentials of the exchange
+     */
+    async handleCallback(request) {
+        let tokens;
+        try {
+            ({ tokens } = await this.getClient(request.redirectUri).getToken({
+                code: request.code,
+                codeVerifier: request.codeVerifier,
+                redirect_uri: request.redirectUri
+            }));
+        }
+        catch (err) {
+            this.log("WARN", "Google code exchange failed:", safeErrorReason(err));
+            throw new TokenInvalid("Code exchange failed");
+        }
+        if (!tokens?.id_token) {
+            throw new TokenInvalid("Google returned no ID token: the 'openid' scope is required");
+        }
+        const payload = await this.verifyIdToken(tokens.id_token, [this.parameters.client_id]);
+        if (typeof payload.nonce !== "string" || !sameSecret(payload.nonce, request.nonce)) {
+            throw new TokenInvalid("ID token nonce mismatch");
+        }
+        return this.toIdentity(payload, tokens);
+    }
+    /**
+     * Verify a Google ID token sent by a client, as `token` or `tokens.id_token`
+     * @param request - token request
+     * @returns the identity, with the credentials sent in `tokens`
+     */
+    async handleToken(request) {
+        const fromTokens = request.tokens?.id_token;
+        if (request.token && fromTokens !== undefined && fromTokens !== request.token) {
+            throw new WebdaError.BadRequest("token and tokens.id_token differ");
+        }
+        const idToken = request.token ?? fromTokens;
+        if (typeof idToken !== "string" || !idToken) {
+            throw new TokenInvalid("A Google ID token is required");
+        }
+        const payload = await this.verifyIdToken(idToken, [
+            this.parameters.client_id,
+            ...(this.parameters.audiences ?? [])
+        ]);
+        return this.toIdentity(payload, request.tokens);
+    }
+    /**
+     * Emit `GoogleAuth.Tokens` once the login succeeded
+     * @param identity - the identity
+     * @param _result - the result
+     * @param source - browser callback or token operation
+     * @param request - the token operation request
+     */
+    async onAuthenticated(identity, _result, source, request) {
+        const tokens = source === "token" ? (request?.tokens ?? { id_token: request?.token }) : identity.tokens;
+        await this.emit("GoogleAuth.Tokens", { tokens, context: useContext() });
+    }
+    /**
+     * Verify an ID token: signature, expiry, issuer (google-auth-library), audience and hosted domain
+     * @param idToken - ID token
+     * @param audiences - accepted audiences
+     * @returns the payload
+     * @throws TokenInvalid when the token does not verify
+     * @throws EmailDomainNotAllowed when `hostedDomain` is set and the token is not from that domain
+     */
+    async verifyIdToken(idToken, audiences) {
+        const audience = audiences.filter(a => typeof a === "string" && a);
+        // Without audience the library would skip the check: never verify without one
+        if (!audience.length) {
+            throw new TokenInvalid("No audience configured");
+        }
+        this.verifier ?? (this.verifier = new OAuth2Client({ clientId: this.parameters.client_id }));
+        let payload;
+        try {
+            const ticket = await this.verifier.verifyIdToken({
+                idToken,
+                audience: audience.length === 1 ? audience[0] : audience
+            });
+            payload = ticket.getPayload();
+        }
+        catch (err) {
+            // The library messages contain the token or its payload: only the error class is logged
+            this.log("WARN", "Google ID token verification failed:", safeErrorReason(err));
+            throw new TokenInvalid();
+        }
+        if (!payload?.sub) {
+            throw new TokenInvalid("ID token has no subject");
+        }
+        const hostedDomain = this.parameters.hostedDomain?.trim().toLowerCase();
+        if (hostedDomain && payload.hd?.toLowerCase() !== hostedDomain) {
+            throw new EmailDomainNotAllowed("Google account is not from the hosted domain");
+        }
+        return payload;
+    }
+    /**
+     * @param payload - verified ID token payload
+     * @param tokens - credentials to store
+     * @returns the identity
+     */
+    toIdentity(payload, tokens) {
+        return {
+            provider: this.providerName,
+            providerUid: payload.sub,
+            email: payload.email,
+            emailVerified: payload.email_verified === true,
+            profile: { name: payload.name, picture: payload.picture, locale: payload.locale, hd: payload.hd },
+            tokens,
+            amr: ["oauth"]
+        };
+    }
+}
+GoogleAuthentication.Parameters = GoogleParameters;
+/**
+ * Constant-time comparison
+ * @param a - received value
+ * @param b - expected value
+ * @returns true when equal
+ */
+function sameSecret(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+export default GoogleAuthentication;
+//# sourceMappingURL=google-auth.service.js.map

package/lib/google-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-auth.service.js","sourceRoot":"","sources":["../src/google-auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAiE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpH,OAAO,EACL,qBAAqB,EAGrB,aAAa,EACb,uBAAuB,EAEvB,eAAe,EACf,YAAY,EACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAoB,YAAY,EAAqB,MAAM,qBAAqB,CAAC;AAiB7G;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,uBAAuB;IAoC3D;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,WAAW,KAAhB,IAAI,CAAC,WAAW,GAAK,QAAQ,EAAC;QAC9B,IAAI,CAAC,KAAK,KAAV,IAAI,CAAC,KAAK,GAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,EAAC;QAC9C,IAAI,CAAC,SAAS,KAAd,IAAI,CAAC,SAAS,GAAK,EAAE,EAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoE,SAAQ,aAGxF;IAHD;;QAMW,iBAAY,GAAG,QAAQ,CAAC;IAkKnC,CAAC;IA7JC,gBAAgB;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,WAAoB;QACtC,OAAO,IAAI,YAAY,CAAC;YACtB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;YACnC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa;YAC3C,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,OAAkC;QACpD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACpE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC;YACzD,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YACvB,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,MAAM;YACrB,qBAAqB,EAAE,mBAAmB,CAAC,IAAI;YAC/C,cAAc,EAAE,OAAO,CAAC,aAAa;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAA6B;QAChD,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;gBAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,YAAY,EAAE,OAAO,CAAC,WAAW;aAClC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,8BAA8B,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CAAC,6DAA6D,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAA0B;QAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC9E,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC;QAC5C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,YAAY,CAAC,+BAA+B,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;YAChD,IAAI,CAAC,UAAU,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,MAAqB,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,eAAe,CAC7B,QAA0B,EAC1B,OAAmB,EACnB,MAA4B,EAC5B,OAA2B;QAE3B,MAAM,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAA2B,CAAC,CAAC;IACnG,CAAC;IAED;;;;;;;OAOG;IACO,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,SAAmB;QAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;QACnE,8EAA8E;QAC9E,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,YAAY,CAAC,wBAAwB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,QAAQ,KAAb,IAAI,CAAC,QAAQ,GAAK,IAAI,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAC;QAC5E,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC/C,OAAO;gBACP,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;aACzD,CAAC,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wFAAwF;YACxF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,sCAAsC,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/E,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,YAAY,IAAI,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;YAC/D,MAAM,IAAI,qBAAqB,CAAC,8CAA8C,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACO,UAAU,CAAC,OAAqB,EAAE,MAAoB;QAC9D,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;YAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;YACjG,MAAM;YACN,GAAG,EAAE,CAAC,OAAO,CAAC;SACf,CAAC;IACJ,CAAC;CACF;AApKQ,+BAAU,GAAG,gBAAgB,AAAnB,CAAoB;AAsKvC;;;;;GAKG;AACH,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,eAAe,oBAAoB,CAAC"}

package/lib/index.d.ts

@@ -1,2 +1,2 @@
-export * from "./google-auth.js";
+export * from "./google-auth.service.js";
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC"}

package/lib/index.js

@@ -1,2 +1,2 @@
-export * from "./google-auth.js";
+export * from "./google-auth.service.js";
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC"}

package/package.json

@@ -1,18 +1,8 @@
 {
   "name": "@webda/google-auth",
-  "version": "4.0.0-beta.2",
+  "version": "4.0.0-beta.4",
   "description": "Webda Google Authentication",
   "main": "lib/index.js",
-  "scripts": {
-    "build": "webda build",
-    "build:watch": "webda build --watch",
-    "pretest": "npm run build",
-    "lint": "eslint",
-    "lint:fix": "eslint --fix",
-    "test": "c8 mocha",
-    "format": "prettier --check src/**/*",
-    "format:fix": "prettier --write src/**/*"
-  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/loopingz/webda.io.git"
@@ -33,41 +23,47 @@
   },
   "homepage": "https://github.com/loopingz/webda.io#readme",
   "dependencies": {
-    "@webda/core": "^4.0.0-beta.2",
-    "google-auth-library": "^9.0.0"
-  },
-  "c8": {
-    "report-dir": "./reports",
-    "reporter": [
-      "html",
-      "lcov",
-      "json",
-      "text"
-    ],
-    "exclude": [
-      "**/*.spec.ts"
-    ]
+    "google-auth-library": "^10.6.2",
+    "@webda/auth": "4.0.0-beta.4",
+    "@webda/core": "4.0.0-beta.4"
   },
   "publishConfig": {
     "access": "public"
   },
   "devDependencies": {
-    "@testdeck/mocha": "^0.3.2",
-    "@types/node": "20.0.0",
-    "@webda/shell": "^4.0.0-beta.2",
-    "node-fetch": "^3.3.1",
-    "sinon": "^19.0.2",
-    "tsx": "^4.17.0"
+    "@types/node": "25.5.0",
+    "@vitest/coverage-v8": "^4.1.2",
+    "jscodeshift": "^17.3.0",
+    "skott": "^0.35.8",
+    "tsx": "^4.21.0",
+    "typescript": "7.1.0-dev.20260929.1",
+    "vite": "^6.0.0",
+    "vitest": "^4.1.2",
+    "@webda/compiler": "^4.0.0-beta.4",
+    "@webda/content-mapper": "^4.0.0-beta.4",
+    "@webda/test": "4.0.0-beta.3",
+    "@webda/workout": "4.0.0-beta.3"
   },
   "type": "module",
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.0.0"
   },
   "nx": {
     "implicitDependencies": [
       "@webda/core",
-      "@webda/shell"
+      "@webda/auth"
     ]
   },
-  "gitHead": "e992dcfb82cefa6cd5c61c54a0e63778b6f53d8e"
-}
+  "scripts": {
+    "build": "webdac build",
+    "build:watch": "webdac build --watch",
+    "pretest": "npm run build",
+    "lint": "eslint",
+    "lint:fix": "eslint --fix",
+    "test": "vitest run",
+    "format": "prettier --check src/**/*",
+    "format:fix": "prettier --write src/**/*",
+    "deps:graph": "skott --showCircularDependencies --no-trackTypeOnlyDependencies --displayMode=raw -e .ts",
+    "codemod": "jscodeshift --parser=ts --extensions=tsx,ts -t ../codemod/current.mjs src"
+  }
+}