@yielded/auth 0.1.0-beta.3 → 0.1.0-beta.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/DrizzleD1.d.mts +2 -2
- package/dist/DrizzleLibsql.d.mts +11 -11
- package/dist/DrizzlePostgres.d.mts +4 -4
- package/dist/DrizzleSqliteBun.d.mts +2 -2
- package/dist/DrizzleSqliteDo.d.mts +11 -11
- package/dist/DrizzleSqliteWasm.d.mts +4 -4
- package/dist/drizzle/d1-oauth.d.mts +2 -2
- package/dist/oauth/github/protocol.mjs +2 -2
- package/dist/oauth/github/protocol.mjs.map +1 -1
- package/package.json +1 -1
- package/src/oauth/github/protocol.ts +3 -2
package/dist/DrizzleD1.d.mts
CHANGED
|
@@ -337,12 +337,12 @@ declare const makeOAuthConnectedServices: <S extends AnySQLiteTable<{
|
|
|
337
337
|
readonly nowMillis: number;
|
|
338
338
|
}, prepare: PrepareOAuthCommit<{
|
|
339
339
|
readonly _tag: "Rejected";
|
|
340
|
+
} | {
|
|
341
|
+
readonly _tag: "Ambiguous";
|
|
340
342
|
} | {
|
|
341
343
|
readonly _tag: "Conflict";
|
|
342
344
|
} | {
|
|
343
345
|
readonly _tag: "Cancelled";
|
|
344
|
-
} | {
|
|
345
|
-
readonly _tag: "Ambiguous";
|
|
346
346
|
} | {
|
|
347
347
|
readonly _tag: "Connected";
|
|
348
348
|
readonly grant: {
|
package/dist/DrizzleLibsql.d.mts
CHANGED
|
@@ -701,9 +701,11 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
701
701
|
}, prepare: PrepareOAuthCommit<{
|
|
702
702
|
readonly _tag: "Rejected";
|
|
703
703
|
} | {
|
|
704
|
-
readonly _tag: "
|
|
704
|
+
readonly _tag: "Conflict";
|
|
705
705
|
} | {
|
|
706
706
|
readonly _tag: "Cancelled";
|
|
707
|
+
} | {
|
|
708
|
+
readonly _tag: "Ambiguous";
|
|
707
709
|
} | {
|
|
708
710
|
readonly _tag: "Linked";
|
|
709
711
|
readonly credential: {
|
|
@@ -725,8 +727,6 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
725
727
|
};
|
|
726
728
|
};
|
|
727
729
|
readonly changed: boolean;
|
|
728
|
-
} | {
|
|
729
|
-
readonly _tag: "Conflict";
|
|
730
730
|
}, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
|
|
731
731
|
readonly inspectUnlink: (input: {
|
|
732
732
|
readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
|
|
@@ -780,10 +780,10 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
780
780
|
readonly retentionUntilMillis: number;
|
|
781
781
|
}, prepare: PrepareOAuthCommit<{
|
|
782
782
|
readonly _tag: "Rejected";
|
|
783
|
-
} | {
|
|
784
|
-
readonly _tag: "LastSignInMethod";
|
|
785
783
|
} | {
|
|
786
784
|
readonly _tag: "Conflict";
|
|
785
|
+
} | {
|
|
786
|
+
readonly _tag: "LastSignInMethod";
|
|
787
787
|
} | {
|
|
788
788
|
readonly _tag: "Unlinked";
|
|
789
789
|
readonly result: {
|
|
@@ -1071,8 +1071,6 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
1071
1071
|
readonly flow: OAuthConnectedPendingFlow;
|
|
1072
1072
|
readonly authorization: OAuthConnectedActionAuthorization;
|
|
1073
1073
|
}, prepare: PrepareOAuthCommit<{
|
|
1074
|
-
readonly _tag: "Rejected";
|
|
1075
|
-
} | {
|
|
1076
1074
|
readonly _tag: "Issued";
|
|
1077
1075
|
readonly flow: {
|
|
1078
1076
|
readonly context: {
|
|
@@ -1164,6 +1162,8 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
1164
1162
|
};
|
|
1165
1163
|
readonly retentionUntilMillis: number;
|
|
1166
1164
|
};
|
|
1165
|
+
} | {
|
|
1166
|
+
readonly _tag: "Rejected";
|
|
1167
1167
|
}, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
|
|
1168
1168
|
readonly preflight: (input: OAuthConnectedAccess) => Effect.Effect<OAuthConnectedPendingFlow | undefined, OAuthUnavailable>;
|
|
1169
1169
|
readonly claim: <A>(input: {
|
|
@@ -1281,14 +1281,14 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
1281
1281
|
};
|
|
1282
1282
|
}) => Effect.Effect<{
|
|
1283
1283
|
readonly _tag: "Rejected";
|
|
1284
|
-
} | {
|
|
1285
|
-
readonly _tag: "Conflict";
|
|
1286
1284
|
} | {
|
|
1287
1285
|
readonly _tag: "Target";
|
|
1288
1286
|
readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
|
|
1289
1287
|
} | {
|
|
1290
1288
|
readonly _tag: "Quarantine";
|
|
1291
1289
|
readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
|
|
1290
|
+
} | {
|
|
1291
|
+
readonly _tag: "Conflict";
|
|
1292
1292
|
}, OAuthUnavailable>;
|
|
1293
1293
|
readonly settle: <A>(input: {
|
|
1294
1294
|
readonly claim: OAuthConnectedClaim;
|
|
@@ -1298,11 +1298,11 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
1298
1298
|
}, prepare: PrepareOAuthCommit<{
|
|
1299
1299
|
readonly _tag: "Rejected";
|
|
1300
1300
|
} | {
|
|
1301
|
-
readonly _tag: "
|
|
1301
|
+
readonly _tag: "Conflict";
|
|
1302
1302
|
} | {
|
|
1303
1303
|
readonly _tag: "Cancelled";
|
|
1304
1304
|
} | {
|
|
1305
|
-
readonly _tag: "
|
|
1305
|
+
readonly _tag: "Ambiguous";
|
|
1306
1306
|
} | {
|
|
1307
1307
|
readonly _tag: "Connected";
|
|
1308
1308
|
readonly grant: {
|
|
@@ -220,12 +220,12 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
|
|
|
220
220
|
readonly nowMillis: number;
|
|
221
221
|
}, prepare: PrepareOAuthCommit<{
|
|
222
222
|
readonly _tag: "Rejected";
|
|
223
|
+
} | {
|
|
224
|
+
readonly _tag: "Ambiguous";
|
|
223
225
|
} | {
|
|
224
226
|
readonly _tag: "Conflict";
|
|
225
227
|
} | {
|
|
226
228
|
readonly _tag: "Cancelled";
|
|
227
|
-
} | {
|
|
228
|
-
readonly _tag: "Ambiguous";
|
|
229
229
|
} | {
|
|
230
230
|
readonly _tag: "Linked";
|
|
231
231
|
readonly credential: {
|
|
@@ -817,12 +817,12 @@ declare const makeOAuthAccountsServices: <S extends AnyPgTable<{
|
|
|
817
817
|
readonly nowMillis: number;
|
|
818
818
|
}, prepare: PrepareOAuthCommit<{
|
|
819
819
|
readonly _tag: "Rejected";
|
|
820
|
+
} | {
|
|
821
|
+
readonly _tag: "Ambiguous";
|
|
820
822
|
} | {
|
|
821
823
|
readonly _tag: "Conflict";
|
|
822
824
|
} | {
|
|
823
825
|
readonly _tag: "Cancelled";
|
|
824
|
-
} | {
|
|
825
|
-
readonly _tag: "Ambiguous";
|
|
826
826
|
} | {
|
|
827
827
|
readonly _tag: "Connected";
|
|
828
828
|
readonly grant: {
|
|
@@ -781,6 +781,8 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
781
781
|
readonly _tag: "Rejected";
|
|
782
782
|
} | {
|
|
783
783
|
readonly _tag: "Conflict";
|
|
784
|
+
} | {
|
|
785
|
+
readonly _tag: "LastSignInMethod";
|
|
784
786
|
} | {
|
|
785
787
|
readonly _tag: "Unlinked";
|
|
786
788
|
readonly result: {
|
|
@@ -794,8 +796,6 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
794
796
|
};
|
|
795
797
|
};
|
|
796
798
|
readonly replayed: boolean;
|
|
797
|
-
} | {
|
|
798
|
-
readonly _tag: "LastSignInMethod";
|
|
799
799
|
}, A>) => import("effect/Effect").Effect<PreparedCommit<A>, OAuthUnavailable>;
|
|
800
800
|
readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
|
|
801
801
|
readonly terminalized: number;
|
|
@@ -756,9 +756,11 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
756
756
|
}, prepare: PrepareOAuthCommit<{
|
|
757
757
|
readonly _tag: "Rejected";
|
|
758
758
|
} | {
|
|
759
|
-
readonly _tag: "
|
|
759
|
+
readonly _tag: "Conflict";
|
|
760
760
|
} | {
|
|
761
761
|
readonly _tag: "Cancelled";
|
|
762
|
+
} | {
|
|
763
|
+
readonly _tag: "Ambiguous";
|
|
762
764
|
} | {
|
|
763
765
|
readonly _tag: "Linked";
|
|
764
766
|
readonly credential: {
|
|
@@ -780,8 +782,6 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
780
782
|
};
|
|
781
783
|
};
|
|
782
784
|
readonly changed: boolean;
|
|
783
|
-
} | {
|
|
784
|
-
readonly _tag: "Conflict";
|
|
785
785
|
}, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
|
|
786
786
|
readonly inspectUnlink: (input: {
|
|
787
787
|
readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
|
|
@@ -835,10 +835,10 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
835
835
|
readonly retentionUntilMillis: number;
|
|
836
836
|
}, prepare: PrepareOAuthCommit<{
|
|
837
837
|
readonly _tag: "Rejected";
|
|
838
|
-
} | {
|
|
839
|
-
readonly _tag: "LastSignInMethod";
|
|
840
838
|
} | {
|
|
841
839
|
readonly _tag: "Conflict";
|
|
840
|
+
} | {
|
|
841
|
+
readonly _tag: "LastSignInMethod";
|
|
842
842
|
} | {
|
|
843
843
|
readonly _tag: "Unlinked";
|
|
844
844
|
readonly result: {
|
|
@@ -1126,8 +1126,6 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
1126
1126
|
readonly flow: OAuthConnectedPendingFlow;
|
|
1127
1127
|
readonly authorization: OAuthConnectedActionAuthorization;
|
|
1128
1128
|
}, prepare: PrepareOAuthCommit<{
|
|
1129
|
-
readonly _tag: "Rejected";
|
|
1130
|
-
} | {
|
|
1131
1129
|
readonly _tag: "Issued";
|
|
1132
1130
|
readonly flow: {
|
|
1133
1131
|
readonly context: {
|
|
@@ -1219,6 +1217,8 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
1219
1217
|
};
|
|
1220
1218
|
readonly retentionUntilMillis: number;
|
|
1221
1219
|
};
|
|
1220
|
+
} | {
|
|
1221
|
+
readonly _tag: "Rejected";
|
|
1222
1222
|
}, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
|
|
1223
1223
|
readonly preflight: (input: OAuthConnectedAccess) => Effect.Effect<OAuthConnectedPendingFlow | undefined, OAuthUnavailable>;
|
|
1224
1224
|
readonly claim: <A>(input: {
|
|
@@ -1336,14 +1336,14 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
1336
1336
|
};
|
|
1337
1337
|
}) => Effect.Effect<{
|
|
1338
1338
|
readonly _tag: "Rejected";
|
|
1339
|
-
} | {
|
|
1340
|
-
readonly _tag: "Conflict";
|
|
1341
1339
|
} | {
|
|
1342
1340
|
readonly _tag: "Target";
|
|
1343
1341
|
readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
|
|
1344
1342
|
} | {
|
|
1345
1343
|
readonly _tag: "Quarantine";
|
|
1346
1344
|
readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
|
|
1345
|
+
} | {
|
|
1346
|
+
readonly _tag: "Conflict";
|
|
1347
1347
|
}, OAuthUnavailable>;
|
|
1348
1348
|
readonly settle: <A>(input: {
|
|
1349
1349
|
readonly claim: OAuthConnectedClaim;
|
|
@@ -1353,11 +1353,11 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
1353
1353
|
}, prepare: PrepareOAuthCommit<{
|
|
1354
1354
|
readonly _tag: "Rejected";
|
|
1355
1355
|
} | {
|
|
1356
|
-
readonly _tag: "
|
|
1356
|
+
readonly _tag: "Conflict";
|
|
1357
1357
|
} | {
|
|
1358
1358
|
readonly _tag: "Cancelled";
|
|
1359
1359
|
} | {
|
|
1360
|
-
readonly _tag: "
|
|
1360
|
+
readonly _tag: "Ambiguous";
|
|
1361
1361
|
} | {
|
|
1362
1362
|
readonly _tag: "Connected";
|
|
1363
1363
|
readonly grant: {
|
|
@@ -699,12 +699,12 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
699
699
|
readonly nowMillis: number;
|
|
700
700
|
}, prepare: PrepareOAuthCommit<{
|
|
701
701
|
readonly _tag: "Rejected";
|
|
702
|
+
} | {
|
|
703
|
+
readonly _tag: "Ambiguous";
|
|
702
704
|
} | {
|
|
703
705
|
readonly _tag: "Conflict";
|
|
704
706
|
} | {
|
|
705
707
|
readonly _tag: "Cancelled";
|
|
706
|
-
} | {
|
|
707
|
-
readonly _tag: "Ambiguous";
|
|
708
708
|
} | {
|
|
709
709
|
readonly _tag: "Linked";
|
|
710
710
|
readonly credential: {
|
|
@@ -1296,12 +1296,12 @@ declare const makeOAuthAccountsServices: <S extends AnySQLiteTable<{
|
|
|
1296
1296
|
readonly nowMillis: number;
|
|
1297
1297
|
}, prepare: PrepareOAuthCommit<{
|
|
1298
1298
|
readonly _tag: "Rejected";
|
|
1299
|
+
} | {
|
|
1300
|
+
readonly _tag: "Ambiguous";
|
|
1299
1301
|
} | {
|
|
1300
1302
|
readonly _tag: "Conflict";
|
|
1301
1303
|
} | {
|
|
1302
1304
|
readonly _tag: "Cancelled";
|
|
1303
|
-
} | {
|
|
1304
|
-
readonly _tag: "Ambiguous";
|
|
1305
1305
|
} | {
|
|
1306
1306
|
readonly _tag: "Connected";
|
|
1307
1307
|
readonly grant: {
|
|
@@ -229,6 +229,8 @@ declare const makeD1OAuthAccountsServices: <S extends SQLiteTable, O extends SQL
|
|
|
229
229
|
readonly _tag: "Rejected";
|
|
230
230
|
} | {
|
|
231
231
|
readonly _tag: "Conflict";
|
|
232
|
+
} | {
|
|
233
|
+
readonly _tag: "LastSignInMethod";
|
|
232
234
|
} | {
|
|
233
235
|
readonly _tag: "Unlinked";
|
|
234
236
|
readonly result: {
|
|
@@ -242,8 +244,6 @@ declare const makeD1OAuthAccountsServices: <S extends SQLiteTable, O extends SQL
|
|
|
242
244
|
};
|
|
243
245
|
};
|
|
244
246
|
readonly replayed: boolean;
|
|
245
|
-
} | {
|
|
246
|
-
readonly _tag: "LastSignInMethod";
|
|
247
247
|
}, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
|
|
248
248
|
readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
|
|
249
249
|
readonly terminalized: number;
|
|
@@ -15,7 +15,7 @@ import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from "effect";
|
|
|
15
15
|
//#region src/oauth/github/protocol.ts
|
|
16
16
|
const unavailable = () => OAuthUnavailable.make({});
|
|
17
17
|
const invalid = () => OpenIdClientConfigurationError.make({ reason: "provider" });
|
|
18
|
-
const issuer = OAuthIssuer.make("https://github.com");
|
|
18
|
+
const issuer = OAuthIssuer.make("https://github.com/login/oauth");
|
|
19
19
|
const headers = Object.freeze({
|
|
20
20
|
Accept: "application/vnd.github+json",
|
|
21
21
|
"User-Agent": "effect-auth-github-oauth-app",
|
|
@@ -61,7 +61,7 @@ const provider = (registration) => ({
|
|
|
61
61
|
issuance: registration.issuance,
|
|
62
62
|
issuer,
|
|
63
63
|
protocol: "oauth",
|
|
64
|
-
responseIssuerMode: "
|
|
64
|
+
responseIssuerMode: "required",
|
|
65
65
|
clientId: registration.clientId,
|
|
66
66
|
authentication: {
|
|
67
67
|
method: "client_secret_post",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/github/protocol.ts"],"sourcesContent":["import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport { OAuthConnectedProfile } from \"../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../OAuthConnectedProtocol\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport {\n DefiniteTokenRejection,\n tokenCompatibility,\n type ConnectedCompatibility,\n} from \"../openid-client/compatibility\";\nimport { makeConnectedProtocolWithCompatibility } from \"../openid-client/connected/protocol\";\nimport {\n OpenIdClientConfigurationError,\n type OpenIdClientOAuthProvider,\n} from \"../openid-client/models\";\nimport { makeOpenIdClientOAuthProtocol } from \"../openid-client/protocol\";\nimport { ProviderRevocation } from \"../openid-client/ProviderRevocation\";\nimport { boundedFetch } from \"../openid-client/transport\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport { OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from \"../signInModels\";\nimport { snapshotOAuthSync } from \"../signInSnapshot\";\nimport { decodeGitHubIdentity, gitHubOAuthAppProviderKey } from \"./identity\";\nimport type {\n GitHubOAuthAppConnectedProtocolOptions,\n GitHubOAuthAppGeneration,\n GitHubOAuthAppProtocolOptions,\n} from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst invalid = () => OpenIdClientConfigurationError.make({ reason: \"provider\" });\nconst issuer = OAuthIssuer.make(\"https://github.com\");\n\nconst headers = Object.freeze({\n Accept: \"application/vnd.github+json\",\n \"User-Agent\": \"effect-auth-github-oauth-app\",\n \"X-GitHub-Api-Version\": \"2026-03-10\",\n});\n\nconst generation = Schema.Struct({\n configurationGeneration: OAuthGeneration,\n issuance: Schema.Literals([\"active\", \"retired\"]),\n clientId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]{1,256}$/)),\n clientSecret: Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(4096))),\n callbacks: Schema.Array(\n Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n});\n\nconst generations = Schema.Array(generation).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst connectedGenerations = Schema.Array(\n Schema.Struct({\n ...generation.fields,\n profiles: Schema.Array(OAuthConnectedProfile).check(\n Schema.isMinLength(1),\n Schema.isMaxLength(64),\n ),\n }),\n).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst timeout = Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 }));\nconst isTimeout = Schema.is(timeout);\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n schema: S,\n registrations: S[\"Type\"],\n options: {\n readonly timeoutSeconds: number;\n readonly fetch?: GitHubOAuthAppProtocolOptions[\"fetch\"];\n },\n) =>\n Effect.try({\n try: () => {\n const result = snapshotOAuthSync(schema, registrations);\n const fetch = options.fetch;\n const timeoutSeconds = options.timeoutSeconds;\n\n if (!isTimeout(timeoutSeconds) || (fetch !== undefined && !Predicate.isFunction(fetch)))\n throw invalid();\n\n return { registrations: result, timeoutSeconds, ...(fetch === undefined ? {} : { fetch }) };\n },\n catch: invalid,\n });\n\nconst provider = (\n registration: GitHubOAuthAppGeneration,\n): Omit<OpenIdClientOAuthProvider, \"scopes\"> => ({\n provider: gitHubOAuthAppProviderKey,\n configurationGeneration: registration.configurationGeneration,\n issuance: registration.issuance,\n issuer,\n protocol: \"oauth\",\n responseIssuerMode: \"unsupported\",\n clientId: registration.clientId,\n authentication: { method: \"client_secret_post\", secret: registration.clientSecret },\n callbacks: registration.callbacks,\n authorizationEndpoint: \"https://github.com/login/oauth/authorize\",\n tokenEndpoint: \"https://github.com/login/oauth/access_token\",\n pkceS256: true,\n identitySource: {\n url: \"https://api.github.com/user\",\n headers,\n decodeIdentity: decodeGitHubIdentity,\n },\n});\n\nconst csvCell = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_:-]{1,256}$/));\nconst isCell = Schema.is(csvCell);\n\n/** GitHub's receipt is comma-delimited, unlike the generic OAuth scope string. */\nconst scopes = (\n receipt: string | undefined,\n expected: ReadonlyArray<string>,\n): ReadonlyArray<string> => {\n if (receipt === undefined || receipt.length > 16447) throw unavailable();\n\n const result =\n receipt === \"\" ? [] : receipt.split(\",\").map((cell) => cell.replace(/^[ \\t]+|[ \\t]+$/g, \"\"));\n\n if (\n result.length > 64 ||\n result.some((cell) => !isCell(cell)) ||\n new Set(result).size !== result.length ||\n result.length !== expected.length ||\n result.some((cell) => !expected.includes(cell))\n )\n throw unavailable();\n\n return result;\n};\n\nconst token = Schema.NonEmptyString.check(Schema.isMaxLength(16384));\nconst expiry = Schema.Finite.check(Schema.isGreaterThan(0));\n\nconst receiptSchema = Schema.Struct({\n access_token: token,\n token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),\n scope: Schema.String.check(Schema.isMaxLength(16447)),\n expires_in: Schema.optionalKey(expiry),\n refresh_token: Schema.optionalKey(token),\n refresh_token_expires_in: Schema.optionalKey(expiry),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Inspect the bounded raw receipt before the maintained parser can coerce expiry fields.\nconst decodeReceipt = Schema.decodeUnknownSync(receiptSchema);\n\nconst encodeRevocation = Schema.encodeSync(\n Schema.fromJsonString(Schema.Struct({ access_token: token })),\n);\n\nconst terminalReceipt = Schema.Struct({\n error: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),\n error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Fully validate the raw terminal receipt before classifying a provider rejection.\nconst decodeTerminalReceipt = Schema.decodeUnknownSync(terminalReceipt);\n\nconst successKeys = [\n \"access_token\",\n \"token_type\",\n \"scope\",\n \"expires_in\",\n \"refresh_token\",\n \"refresh_token_expires_in\",\n \"id_token\",\n];\n\nconst compatibility: ConnectedCompatibility = Object.freeze<ConnectedCompatibility>({\n inspectReceipt: ({ body, status, contentType }, input) => {\n if (contentType?.split(\";\", 1)[0]?.trim().toLowerCase() !== \"application/json\")\n throw unavailable();\n if (!Predicate.isObject(body)) throw unavailable();\n if (Object.hasOwn(body, \"error\")) {\n if (successKeys.some((key) => Object.hasOwn(body, key))) throw unavailable();\n const terminal = decodeTerminalReceipt(body);\n\n if (\n (status === 200 || status === 400) &&\n terminal.error ===\n (input.operation === \"authorization_code\" ? \"bad_verification_code\" : \"bad_refresh_token\")\n ) {\n throw new DefiniteTokenRejection();\n }\n throw unavailable();\n }\n if (\n status !== 200 ||\n [\"error_description\", \"error_uri\", \"id_token\"].some((key) => Object.hasOwn(body, key))\n )\n throw unavailable();\n const receipt = decodeReceipt(body);\n\n scopes(receipt.scope, input.scopes);\n if (\n input.refreshRequired &&\n (receipt.refresh_token === undefined ||\n receipt.expires_in === undefined ||\n receipt.refresh_token_expires_in === undefined)\n )\n throw unavailable();\n },\n authorizationScopes: (permissions, refresh) =>\n refresh ? [...permissions, \"offline_access\"] : permissions,\n decodeScopes: scopes,\n includeRefreshScope: false,\n});\n\nconst revocationLayer = (\n options: Pick<GitHubOAuthAppConnectedProtocolOptions, \"fetch\" | \"timeoutSeconds\">,\n) => {\n const fetch: CustomFetch =\n options.fetch ??\n ((url, init) =>\n globalThis.fetch(url, {\n ...init,\n body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n }));\n\n const timeoutSeconds = options.timeoutSeconds;\n\n return Layer.succeed(\n ProviderRevocation,\n ProviderRevocation.of({\n revoke: Effect.fn(\"GitHubOAuthApp.revoke\")(function* (input) {\n yield* Effect.tryPromise({\n try: async (effectSignal) => {\n if (\n input.authentication.method !== \"client_secret_post\" ||\n input.context.configuration.profile.clientRegistrationId !== input.clientId ||\n input.context.identity.provider !== gitHubOAuthAppProviderKey ||\n input.context.identity.issuer !== issuer\n )\n throw unavailable();\n const url = `https://api.github.com/applications/${encodeURIComponent(input.clientId)}/grant`;\n\n const signal = AbortSignal.any([\n effectSignal,\n AbortSignal.timeout(Math.ceil(timeoutSeconds * 1000)),\n ]);\n\n const transport = boundedFetch(fetch, signal, new Set([url]));\n\n const response = await transport(url, {\n method: \"DELETE\",\n redirect: \"manual\",\n headers: {\n ...headers,\n \"Content-Type\": \"application/json\",\n Authorization: `Basic ${Encoding.encodeBase64(`${input.clientId}:${Redacted.value(input.authentication.secret)}`)}`,\n },\n body: encodeRevocation({ access_token: Redacted.value(input.material.accessToken) }),\n signal,\n });\n\n signal.throwIfAborted();\n if (response.status !== 204) throw unavailable();\n },\n catch: unavailable,\n });\n }),\n }),\n );\n};\n\n/** A GitHub.com OAuth App generation for the same provider list as generic OIDC.\n * Retains GitHub receipt/error rules and requests read:user, with no repository access.\n * Construction performs no I/O; invalid configuration throws the typed configuration error. */\nexport const gitHubOAuthAppProvider = (\n registration: GitHubOAuthAppGeneration,\n): OpenIdClientOAuthProvider => {\n let saved: GitHubOAuthAppGeneration;\n\n try {\n saved = snapshotOAuthSync(generation, registration);\n } catch {\n throw invalid();\n }\n\n return {\n ...provider(saved),\n scopes: [\"read:user\"],\n [tokenCompatibility]: compatibility,\n };\n};\n\nexport const makeGitHubOAuthAppProtocol = Effect.fn(\"makeGitHubOAuthAppProtocol\")(function* (\n options: GitHubOAuthAppProtocolOptions,\n) {\n const saved = yield* capture(generations, options.registrations, options);\n\n if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n return yield* invalid();\n\n return yield* makeOpenIdClientOAuthProtocol({\n ...saved,\n providers: saved.registrations.map(gitHubOAuthAppProvider),\n });\n});\n\nexport const makeGitHubOAuthAppConnectedProtocol = Effect.fn(\"makeGitHubOAuthAppConnectedProtocol\")(\n function* (options: GitHubOAuthAppConnectedProtocolOptions) {\n const saved = yield* capture(connectedGenerations, options.registrations, options);\n\n if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n return yield* invalid();\n for (const registration of saved.registrations) {\n for (const profile of registration.profiles) {\n if (\n profile.provider !== gitHubOAuthAppProviderKey ||\n profile.clientRegistrationId !== registration.clientId ||\n profile.resources.length !== 0 ||\n profile.scopes.some((scope) => scope === \"offline_access\" || !isCell(scope)) ||\n (profile.retention === \"access-only\"\n ? profile.refresh !== \"unsupported\" ||\n profile.maximumRefreshLifetimeMillis !== undefined\n : profile.refresh !== \"rotating\" || profile.maximumRefreshLifetimeMillis === undefined)\n )\n return yield* invalid();\n }\n }\n\n return yield* makeConnectedProtocolWithCompatibility(\n {\n ...saved,\n providers: saved.registrations.map((item) => ({\n ...provider(item),\n profiles: item.profiles,\n clientRegistrationId: item.clientId,\n resourceIndicators: \"unsupported\",\n refreshExpiry: { field: \"refresh_token_expires_in\", zero: \"expired\" },\n revocation: { mode: \"provider-cohort\" },\n })),\n },\n compatibility,\n ).pipe(Effect.provide(revocationLayer(saved)));\n },\n);\n\nexport const gitHubOAuthAppProtocolLayer = (options: GitHubOAuthAppProtocolOptions) =>\n Layer.effect(OAuthProtocol, makeGitHubOAuthAppProtocol(options));\n\nexport const gitHubOAuthAppConnectedProtocolLayer = (\n options: GitHubOAuthAppConnectedProtocolOptions,\n) => Layer.effect(OAuthConnectedProtocol, makeGitHubOAuthAppConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;AA6BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,gBAAgB,+BAA+B,KAAK,EAAE,QAAQ,WAAW,CAAC;AAChF,MAAM,SAAS,YAAY,KAAK,oBAAoB;AAEpD,MAAM,UAAU,OAAO,OAAO;CAC5B,QAAQ;CACR,cAAc;CACd,wBAAwB;AAC1B,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;CACzE,cAAc,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAC5F,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,cAAc,OAAO,MAAM,UAAU,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAEhG,MAAM,uBAAuB,OAAO,MAClC,OAAO,OAAO;CACZ,GAAG,WAAW;CACd,UAAU,OAAO,MAAM,qBAAqB,CAAC,CAAC,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,CACvB;AACF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAErD,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAG,CAAC,CAAC;AACjF,MAAM,YAAY,OAAO,GAAG,OAAO;AAEnC,MAAM,WACJ,QACA,eACA,YAKA,OAAO,IAAI;CACT,WAAW;EACT,MAAM,SAAS,kBAAkB,QAAQ,aAAa;EACtD,MAAM,QAAQ,QAAQ;EACtB,MAAM,iBAAiB,QAAQ;EAE/B,IAAI,CAAC,UAAU,cAAc,KAAM,UAAU,KAAA,KAAa,CAAC,UAAU,WAAW,KAAK,GACnF,MAAM,QAAQ;EAEhB,OAAO;GAAE,eAAe;GAAQ;GAAgB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EAAG;CAC5F;CACA,OAAO;AACT,CAAC;AAEH,MAAM,YACJ,kBAC+C;CAC/C,UAAU;CACV,yBAAyB,aAAa;CACtC,UAAU,aAAa;CACvB;CACA,UAAU;CACV,oBAAoB;CACpB,UAAU,aAAa;CACvB,gBAAgB;EAAE,QAAQ;EAAsB,QAAQ,aAAa;CAAa;CAClF,WAAW,aAAa;CACxB,uBAAuB;CACvB,eAAe;CACf,UAAU;CACV,gBAAgB;EACd,KAAK;EACL;EACA,gBAAgB;CAClB;AACF;AAEA,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;AAC/E,MAAM,SAAS,OAAO,GAAG,OAAO;;AAGhC,MAAM,UACJ,SACA,aAC0B;CAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,OAAO,MAAM,YAAY;CAEvE,MAAM,SACJ,YAAY,KAAK,CAAC,IAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,KAAK,QAAQ,oBAAoB,EAAE,CAAC;CAE7F,IACE,OAAO,SAAS,MAChB,OAAO,MAAM,SAAS,CAAC,OAAO,IAAI,CAAC,KACnC,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAChC,OAAO,WAAW,SAAS,UAC3B,OAAO,MAAM,SAAS,CAAC,SAAS,SAAS,IAAI,CAAC,GAE9C,MAAM,YAAY;CAEpB,OAAO;AACT;AAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC;AACnE,MAAM,SAAS,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC;AAE1D,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc;CACd,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC;CAC9E,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC;CACpD,YAAY,OAAO,YAAY,MAAM;CACrC,eAAe,OAAO,YAAY,KAAK;CACvC,0BAA0B,OAAO,YAAY,MAAM;AACrD,CAAC;AAGD,MAAM,gBAAgB,OAAO,kBAAkB,aAAa;AAE5D,MAAM,mBAAmB,OAAO,WAC9B,OAAO,eAAe,OAAO,OAAO,EAAE,cAAc,MAAM,CAAC,CAAC,CAC9D;AAEA,MAAM,kBAAkB,OAAO,OAAO;CACpC,OAAO,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC1D,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACnF,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC7E,CAAC;AAGD,MAAM,wBAAwB,OAAO,kBAAkB,eAAe;AAEtE,MAAM,cAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,gBAAwC,OAAO,OAA+B;CAClF,iBAAiB,EAAE,MAAM,QAAQ,eAAe,UAAU;EACxD,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MAAM,oBAC1D,MAAM,YAAY;EACpB,IAAI,CAAC,UAAU,SAAS,IAAI,GAAG,MAAM,YAAY;EACjD,IAAI,OAAO,OAAO,MAAM,OAAO,GAAG;GAChC,IAAI,YAAY,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAAG,MAAM,YAAY;GAC3E,MAAM,WAAW,sBAAsB,IAAI;GAE3C,KACG,WAAW,OAAO,WAAW,QAC9B,SAAS,WACN,MAAM,cAAc,uBAAuB,0BAA0B,sBAExE,MAAM,IAAI,uBAAuB;GAEnC,MAAM,YAAY;EACpB;EACA,IACE,WAAW,OACX;GAAC;GAAqB;GAAa;EAAU,CAAC,CAAC,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAErF,MAAM,YAAY;EACpB,MAAM,UAAU,cAAc,IAAI;EAElC,OAAO,QAAQ,OAAO,MAAM,MAAM;EAClC,IACE,MAAM,oBACL,QAAQ,kBAAkB,KAAA,KACzB,QAAQ,eAAe,KAAA,KACvB,QAAQ,6BAA6B,KAAA,IAEvC,MAAM,YAAY;CACtB;CACA,sBAAsB,aAAa,YACjC,UAAU,CAAC,GAAG,aAAa,gBAAgB,IAAI;CACjD,cAAc;CACd,qBAAqB;AACvB,CAAC;AAED,MAAM,mBACJ,YACG;CACH,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,MAAM,iBAAiB,QAAQ;CAE/B,OAAO,MAAM,QACX,oBACA,mBAAmB,GAAG,EACpB,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO;EAC3D,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,iBAAiB;IAC3B,IACE,MAAM,eAAe,WAAW,wBAChC,MAAM,QAAQ,cAAc,QAAQ,yBAAyB,MAAM,YACnE,MAAM,QAAQ,SAAS,aAAa,6BACpC,MAAM,QAAQ,SAAS,WAAW,QAElC,MAAM,YAAY;IACpB,MAAM,MAAM,uCAAuC,mBAAmB,MAAM,QAAQ,EAAE;IAEtF,MAAM,SAAS,YAAY,IAAI,CAC7B,cACA,YAAY,QAAQ,KAAK,KAAK,iBAAiB,GAAI,CAAC,CACtD,CAAC;IAID,MAAM,WAAW,MAFC,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAE5B,CAAC,CAAC,KAAK;KACpC,QAAQ;KACR,UAAU;KACV,SAAS;MACP,GAAG;MACH,gBAAgB;MAChB,eAAe,SAAS,SAAS,aAAa,GAAG,MAAM,SAAS,GAAG,SAAS,MAAM,MAAM,eAAe,MAAM,GAAG;KAClH;KACA,MAAM,iBAAiB,EAAE,cAAc,SAAS,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC;KACnF;IACF,CAAC;IAED,OAAO,eAAe;IACtB,IAAI,SAAS,WAAW,KAAK,MAAM,YAAY;GACjD;GACA,OAAO;EACT,CAAC;CACH,CAAC,EACH,CAAC,CACH;AACF;;;;AAKA,MAAa,0BACX,iBAC8B;CAC9B,IAAI;CAEJ,IAAI;EACF,QAAQ,kBAAkB,YAAY,YAAY;CACpD,QAAQ;EACN,MAAM,QAAQ;CAChB;CAEA,OAAO;EACL,GAAG,SAAS,KAAK;EACjB,QAAQ,CAAC,WAAW;GACnB,qBAAqB;CACxB;AACF;AAEA,MAAa,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAChF,SACA;CACA,MAAM,QAAQ,OAAO,QAAQ,aAAa,QAAQ,eAAe,OAAO;CAExE,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CAExB,OAAO,OAAO,8BAA8B;EAC1C,GAAG;EACH,WAAW,MAAM,cAAc,IAAI,sBAAsB;CAC3D,CAAC;AACH,CAAC;AAED,MAAa,sCAAsC,OAAO,GAAG,qCAAqC,CAAC,CACjG,WAAW,SAAiD;CAC1D,MAAM,QAAQ,OAAO,QAAQ,sBAAsB,QAAQ,eAAe,OAAO;CAEjF,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CACxB,KAAK,MAAM,gBAAgB,MAAM,eAC/B,KAAK,MAAM,WAAW,aAAa,UACjC,IACE,QAAQ,aAAa,6BACrB,QAAQ,yBAAyB,aAAa,YAC9C,QAAQ,UAAU,WAAW,KAC7B,QAAQ,OAAO,MAAM,UAAU,UAAU,oBAAoB,CAAC,OAAO,KAAK,CAAC,MAC1E,QAAQ,cAAc,gBACnB,QAAQ,YAAY,iBACpB,QAAQ,iCAAiC,KAAA,IACzC,QAAQ,YAAY,cAAc,QAAQ,iCAAiC,KAAA,IAE/E,OAAO,OAAO,QAAQ;CAI5B,OAAO,OAAO,uCACZ;EACE,GAAG;EACH,WAAW,MAAM,cAAc,KAAK,UAAU;GAC5C,GAAG,SAAS,IAAI;GAChB,UAAU,KAAK;GACf,sBAAsB,KAAK;GAC3B,oBAAoB;GACpB,eAAe;IAAE,OAAO;IAA4B,MAAM;GAAU;GACpE,YAAY,EAAE,MAAM,kBAAkB;EACxC,EAAE;CACJ,GACA,aACF,CAAC,CAAC,KAAK,OAAO,QAAQ,gBAAgB,KAAK,CAAC,CAAC;AAC/C,CACF;AAEA,MAAa,+BAA+B,YAC1C,MAAM,OAAO,eAAe,2BAA2B,OAAO,CAAC;AAEjE,MAAa,wCACX,YACG,MAAM,OAAO,wBAAwB,oCAAoC,OAAO,CAAC"}
|
|
1
|
+
{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/github/protocol.ts"],"sourcesContent":["import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport { OAuthConnectedProfile } from \"../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../OAuthConnectedProtocol\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport {\n DefiniteTokenRejection,\n tokenCompatibility,\n type ConnectedCompatibility,\n} from \"../openid-client/compatibility\";\nimport { makeConnectedProtocolWithCompatibility } from \"../openid-client/connected/protocol\";\nimport {\n OpenIdClientConfigurationError,\n type OpenIdClientOAuthProvider,\n} from \"../openid-client/models\";\nimport { makeOpenIdClientOAuthProtocol } from \"../openid-client/protocol\";\nimport { ProviderRevocation } from \"../openid-client/ProviderRevocation\";\nimport { boundedFetch } from \"../openid-client/transport\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport { OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from \"../signInModels\";\nimport { snapshotOAuthSync } from \"../signInSnapshot\";\nimport { decodeGitHubIdentity, gitHubOAuthAppProviderKey } from \"./identity\";\nimport type {\n GitHubOAuthAppConnectedProtocolOptions,\n GitHubOAuthAppGeneration,\n GitHubOAuthAppProtocolOptions,\n} from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst invalid = () => OpenIdClientConfigurationError.make({ reason: \"provider\" });\n// GitHub's OAuth authorization server issuer, including its RFC 9207 callback value.\nconst issuer = OAuthIssuer.make(\"https://github.com/login/oauth\");\n\nconst headers = Object.freeze({\n Accept: \"application/vnd.github+json\",\n \"User-Agent\": \"effect-auth-github-oauth-app\",\n \"X-GitHub-Api-Version\": \"2026-03-10\",\n});\n\nconst generation = Schema.Struct({\n configurationGeneration: OAuthGeneration,\n issuance: Schema.Literals([\"active\", \"retired\"]),\n clientId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]{1,256}$/)),\n clientSecret: Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(4096))),\n callbacks: Schema.Array(\n Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n});\n\nconst generations = Schema.Array(generation).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst connectedGenerations = Schema.Array(\n Schema.Struct({\n ...generation.fields,\n profiles: Schema.Array(OAuthConnectedProfile).check(\n Schema.isMinLength(1),\n Schema.isMaxLength(64),\n ),\n }),\n).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst timeout = Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 }));\nconst isTimeout = Schema.is(timeout);\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n schema: S,\n registrations: S[\"Type\"],\n options: {\n readonly timeoutSeconds: number;\n readonly fetch?: GitHubOAuthAppProtocolOptions[\"fetch\"];\n },\n) =>\n Effect.try({\n try: () => {\n const result = snapshotOAuthSync(schema, registrations);\n const fetch = options.fetch;\n const timeoutSeconds = options.timeoutSeconds;\n\n if (!isTimeout(timeoutSeconds) || (fetch !== undefined && !Predicate.isFunction(fetch)))\n throw invalid();\n\n return { registrations: result, timeoutSeconds, ...(fetch === undefined ? {} : { fetch }) };\n },\n catch: invalid,\n });\n\nconst provider = (\n registration: GitHubOAuthAppGeneration,\n): Omit<OpenIdClientOAuthProvider, \"scopes\"> => ({\n provider: gitHubOAuthAppProviderKey,\n configurationGeneration: registration.configurationGeneration,\n issuance: registration.issuance,\n issuer,\n protocol: \"oauth\",\n responseIssuerMode: \"required\",\n clientId: registration.clientId,\n authentication: { method: \"client_secret_post\", secret: registration.clientSecret },\n callbacks: registration.callbacks,\n authorizationEndpoint: \"https://github.com/login/oauth/authorize\",\n tokenEndpoint: \"https://github.com/login/oauth/access_token\",\n pkceS256: true,\n identitySource: {\n url: \"https://api.github.com/user\",\n headers,\n decodeIdentity: decodeGitHubIdentity,\n },\n});\n\nconst csvCell = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_:-]{1,256}$/));\nconst isCell = Schema.is(csvCell);\n\n/** GitHub's receipt is comma-delimited, unlike the generic OAuth scope string. */\nconst scopes = (\n receipt: string | undefined,\n expected: ReadonlyArray<string>,\n): ReadonlyArray<string> => {\n if (receipt === undefined || receipt.length > 16447) throw unavailable();\n\n const result =\n receipt === \"\" ? [] : receipt.split(\",\").map((cell) => cell.replace(/^[ \\t]+|[ \\t]+$/g, \"\"));\n\n if (\n result.length > 64 ||\n result.some((cell) => !isCell(cell)) ||\n new Set(result).size !== result.length ||\n result.length !== expected.length ||\n result.some((cell) => !expected.includes(cell))\n )\n throw unavailable();\n\n return result;\n};\n\nconst token = Schema.NonEmptyString.check(Schema.isMaxLength(16384));\nconst expiry = Schema.Finite.check(Schema.isGreaterThan(0));\n\nconst receiptSchema = Schema.Struct({\n access_token: token,\n token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),\n scope: Schema.String.check(Schema.isMaxLength(16447)),\n expires_in: Schema.optionalKey(expiry),\n refresh_token: Schema.optionalKey(token),\n refresh_token_expires_in: Schema.optionalKey(expiry),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Inspect the bounded raw receipt before the maintained parser can coerce expiry fields.\nconst decodeReceipt = Schema.decodeUnknownSync(receiptSchema);\n\nconst encodeRevocation = Schema.encodeSync(\n Schema.fromJsonString(Schema.Struct({ access_token: token })),\n);\n\nconst terminalReceipt = Schema.Struct({\n error: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),\n error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Fully validate the raw terminal receipt before classifying a provider rejection.\nconst decodeTerminalReceipt = Schema.decodeUnknownSync(terminalReceipt);\n\nconst successKeys = [\n \"access_token\",\n \"token_type\",\n \"scope\",\n \"expires_in\",\n \"refresh_token\",\n \"refresh_token_expires_in\",\n \"id_token\",\n];\n\nconst compatibility: ConnectedCompatibility = Object.freeze<ConnectedCompatibility>({\n inspectReceipt: ({ body, status, contentType }, input) => {\n if (contentType?.split(\";\", 1)[0]?.trim().toLowerCase() !== \"application/json\")\n throw unavailable();\n if (!Predicate.isObject(body)) throw unavailable();\n if (Object.hasOwn(body, \"error\")) {\n if (successKeys.some((key) => Object.hasOwn(body, key))) throw unavailable();\n const terminal = decodeTerminalReceipt(body);\n\n if (\n (status === 200 || status === 400) &&\n terminal.error ===\n (input.operation === \"authorization_code\" ? \"bad_verification_code\" : \"bad_refresh_token\")\n ) {\n throw new DefiniteTokenRejection();\n }\n throw unavailable();\n }\n if (\n status !== 200 ||\n [\"error_description\", \"error_uri\", \"id_token\"].some((key) => Object.hasOwn(body, key))\n )\n throw unavailable();\n const receipt = decodeReceipt(body);\n\n scopes(receipt.scope, input.scopes);\n if (\n input.refreshRequired &&\n (receipt.refresh_token === undefined ||\n receipt.expires_in === undefined ||\n receipt.refresh_token_expires_in === undefined)\n )\n throw unavailable();\n },\n authorizationScopes: (permissions, refresh) =>\n refresh ? [...permissions, \"offline_access\"] : permissions,\n decodeScopes: scopes,\n includeRefreshScope: false,\n});\n\nconst revocationLayer = (\n options: Pick<GitHubOAuthAppConnectedProtocolOptions, \"fetch\" | \"timeoutSeconds\">,\n) => {\n const fetch: CustomFetch =\n options.fetch ??\n ((url, init) =>\n globalThis.fetch(url, {\n ...init,\n body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n }));\n\n const timeoutSeconds = options.timeoutSeconds;\n\n return Layer.succeed(\n ProviderRevocation,\n ProviderRevocation.of({\n revoke: Effect.fn(\"GitHubOAuthApp.revoke\")(function* (input) {\n yield* Effect.tryPromise({\n try: async (effectSignal) => {\n if (\n input.authentication.method !== \"client_secret_post\" ||\n input.context.configuration.profile.clientRegistrationId !== input.clientId ||\n input.context.identity.provider !== gitHubOAuthAppProviderKey ||\n input.context.identity.issuer !== issuer\n )\n throw unavailable();\n const url = `https://api.github.com/applications/${encodeURIComponent(input.clientId)}/grant`;\n\n const signal = AbortSignal.any([\n effectSignal,\n AbortSignal.timeout(Math.ceil(timeoutSeconds * 1000)),\n ]);\n\n const transport = boundedFetch(fetch, signal, new Set([url]));\n\n const response = await transport(url, {\n method: \"DELETE\",\n redirect: \"manual\",\n headers: {\n ...headers,\n \"Content-Type\": \"application/json\",\n Authorization: `Basic ${Encoding.encodeBase64(`${input.clientId}:${Redacted.value(input.authentication.secret)}`)}`,\n },\n body: encodeRevocation({ access_token: Redacted.value(input.material.accessToken) }),\n signal,\n });\n\n signal.throwIfAborted();\n if (response.status !== 204) throw unavailable();\n },\n catch: unavailable,\n });\n }),\n }),\n );\n};\n\n/** A GitHub.com OAuth App generation for the same provider list as generic OIDC.\n * Retains GitHub receipt/error rules and requests read:user, with no repository access.\n * Construction performs no I/O; invalid configuration throws the typed configuration error. */\nexport const gitHubOAuthAppProvider = (\n registration: GitHubOAuthAppGeneration,\n): OpenIdClientOAuthProvider => {\n let saved: GitHubOAuthAppGeneration;\n\n try {\n saved = snapshotOAuthSync(generation, registration);\n } catch {\n throw invalid();\n }\n\n return {\n ...provider(saved),\n scopes: [\"read:user\"],\n [tokenCompatibility]: compatibility,\n };\n};\n\nexport const makeGitHubOAuthAppProtocol = Effect.fn(\"makeGitHubOAuthAppProtocol\")(function* (\n options: GitHubOAuthAppProtocolOptions,\n) {\n const saved = yield* capture(generations, options.registrations, options);\n\n if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n return yield* invalid();\n\n return yield* makeOpenIdClientOAuthProtocol({\n ...saved,\n providers: saved.registrations.map(gitHubOAuthAppProvider),\n });\n});\n\nexport const makeGitHubOAuthAppConnectedProtocol = Effect.fn(\"makeGitHubOAuthAppConnectedProtocol\")(\n function* (options: GitHubOAuthAppConnectedProtocolOptions) {\n const saved = yield* capture(connectedGenerations, options.registrations, options);\n\n if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n return yield* invalid();\n for (const registration of saved.registrations) {\n for (const profile of registration.profiles) {\n if (\n profile.provider !== gitHubOAuthAppProviderKey ||\n profile.clientRegistrationId !== registration.clientId ||\n profile.resources.length !== 0 ||\n profile.scopes.some((scope) => scope === \"offline_access\" || !isCell(scope)) ||\n (profile.retention === \"access-only\"\n ? profile.refresh !== \"unsupported\" ||\n profile.maximumRefreshLifetimeMillis !== undefined\n : profile.refresh !== \"rotating\" || profile.maximumRefreshLifetimeMillis === undefined)\n )\n return yield* invalid();\n }\n }\n\n return yield* makeConnectedProtocolWithCompatibility(\n {\n ...saved,\n providers: saved.registrations.map((item) => ({\n ...provider(item),\n profiles: item.profiles,\n clientRegistrationId: item.clientId,\n resourceIndicators: \"unsupported\",\n refreshExpiry: { field: \"refresh_token_expires_in\", zero: \"expired\" },\n revocation: { mode: \"provider-cohort\" },\n })),\n },\n compatibility,\n ).pipe(Effect.provide(revocationLayer(saved)));\n },\n);\n\nexport const gitHubOAuthAppProtocolLayer = (options: GitHubOAuthAppProtocolOptions) =>\n Layer.effect(OAuthProtocol, makeGitHubOAuthAppProtocol(options));\n\nexport const gitHubOAuthAppConnectedProtocolLayer = (\n options: GitHubOAuthAppConnectedProtocolOptions,\n) => Layer.effect(OAuthConnectedProtocol, makeGitHubOAuthAppConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;AA6BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,gBAAgB,+BAA+B,KAAK,EAAE,QAAQ,WAAW,CAAC;AAEhF,MAAM,SAAS,YAAY,KAAK,gCAAgC;AAEhE,MAAM,UAAU,OAAO,OAAO;CAC5B,QAAQ;CACR,cAAc;CACd,wBAAwB;AAC1B,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;CACzE,cAAc,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAC5F,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,cAAc,OAAO,MAAM,UAAU,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAEhG,MAAM,uBAAuB,OAAO,MAClC,OAAO,OAAO;CACZ,GAAG,WAAW;CACd,UAAU,OAAO,MAAM,qBAAqB,CAAC,CAAC,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,CACvB;AACF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAErD,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAG,CAAC,CAAC;AACjF,MAAM,YAAY,OAAO,GAAG,OAAO;AAEnC,MAAM,WACJ,QACA,eACA,YAKA,OAAO,IAAI;CACT,WAAW;EACT,MAAM,SAAS,kBAAkB,QAAQ,aAAa;EACtD,MAAM,QAAQ,QAAQ;EACtB,MAAM,iBAAiB,QAAQ;EAE/B,IAAI,CAAC,UAAU,cAAc,KAAM,UAAU,KAAA,KAAa,CAAC,UAAU,WAAW,KAAK,GACnF,MAAM,QAAQ;EAEhB,OAAO;GAAE,eAAe;GAAQ;GAAgB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EAAG;CAC5F;CACA,OAAO;AACT,CAAC;AAEH,MAAM,YACJ,kBAC+C;CAC/C,UAAU;CACV,yBAAyB,aAAa;CACtC,UAAU,aAAa;CACvB;CACA,UAAU;CACV,oBAAoB;CACpB,UAAU,aAAa;CACvB,gBAAgB;EAAE,QAAQ;EAAsB,QAAQ,aAAa;CAAa;CAClF,WAAW,aAAa;CACxB,uBAAuB;CACvB,eAAe;CACf,UAAU;CACV,gBAAgB;EACd,KAAK;EACL;EACA,gBAAgB;CAClB;AACF;AAEA,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;AAC/E,MAAM,SAAS,OAAO,GAAG,OAAO;;AAGhC,MAAM,UACJ,SACA,aAC0B;CAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,OAAO,MAAM,YAAY;CAEvE,MAAM,SACJ,YAAY,KAAK,CAAC,IAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,KAAK,QAAQ,oBAAoB,EAAE,CAAC;CAE7F,IACE,OAAO,SAAS,MAChB,OAAO,MAAM,SAAS,CAAC,OAAO,IAAI,CAAC,KACnC,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAChC,OAAO,WAAW,SAAS,UAC3B,OAAO,MAAM,SAAS,CAAC,SAAS,SAAS,IAAI,CAAC,GAE9C,MAAM,YAAY;CAEpB,OAAO;AACT;AAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC;AACnE,MAAM,SAAS,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC;AAE1D,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc;CACd,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC;CAC9E,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC;CACpD,YAAY,OAAO,YAAY,MAAM;CACrC,eAAe,OAAO,YAAY,KAAK;CACvC,0BAA0B,OAAO,YAAY,MAAM;AACrD,CAAC;AAGD,MAAM,gBAAgB,OAAO,kBAAkB,aAAa;AAE5D,MAAM,mBAAmB,OAAO,WAC9B,OAAO,eAAe,OAAO,OAAO,EAAE,cAAc,MAAM,CAAC,CAAC,CAC9D;AAEA,MAAM,kBAAkB,OAAO,OAAO;CACpC,OAAO,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC1D,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACnF,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC7E,CAAC;AAGD,MAAM,wBAAwB,OAAO,kBAAkB,eAAe;AAEtE,MAAM,cAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,gBAAwC,OAAO,OAA+B;CAClF,iBAAiB,EAAE,MAAM,QAAQ,eAAe,UAAU;EACxD,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MAAM,oBAC1D,MAAM,YAAY;EACpB,IAAI,CAAC,UAAU,SAAS,IAAI,GAAG,MAAM,YAAY;EACjD,IAAI,OAAO,OAAO,MAAM,OAAO,GAAG;GAChC,IAAI,YAAY,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAAG,MAAM,YAAY;GAC3E,MAAM,WAAW,sBAAsB,IAAI;GAE3C,KACG,WAAW,OAAO,WAAW,QAC9B,SAAS,WACN,MAAM,cAAc,uBAAuB,0BAA0B,sBAExE,MAAM,IAAI,uBAAuB;GAEnC,MAAM,YAAY;EACpB;EACA,IACE,WAAW,OACX;GAAC;GAAqB;GAAa;EAAU,CAAC,CAAC,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAErF,MAAM,YAAY;EACpB,MAAM,UAAU,cAAc,IAAI;EAElC,OAAO,QAAQ,OAAO,MAAM,MAAM;EAClC,IACE,MAAM,oBACL,QAAQ,kBAAkB,KAAA,KACzB,QAAQ,eAAe,KAAA,KACvB,QAAQ,6BAA6B,KAAA,IAEvC,MAAM,YAAY;CACtB;CACA,sBAAsB,aAAa,YACjC,UAAU,CAAC,GAAG,aAAa,gBAAgB,IAAI;CACjD,cAAc;CACd,qBAAqB;AACvB,CAAC;AAED,MAAM,mBACJ,YACG;CACH,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,MAAM,iBAAiB,QAAQ;CAE/B,OAAO,MAAM,QACX,oBACA,mBAAmB,GAAG,EACpB,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO;EAC3D,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,iBAAiB;IAC3B,IACE,MAAM,eAAe,WAAW,wBAChC,MAAM,QAAQ,cAAc,QAAQ,yBAAyB,MAAM,YACnE,MAAM,QAAQ,SAAS,aAAa,6BACpC,MAAM,QAAQ,SAAS,WAAW,QAElC,MAAM,YAAY;IACpB,MAAM,MAAM,uCAAuC,mBAAmB,MAAM,QAAQ,EAAE;IAEtF,MAAM,SAAS,YAAY,IAAI,CAC7B,cACA,YAAY,QAAQ,KAAK,KAAK,iBAAiB,GAAI,CAAC,CACtD,CAAC;IAID,MAAM,WAAW,MAFC,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAE5B,CAAC,CAAC,KAAK;KACpC,QAAQ;KACR,UAAU;KACV,SAAS;MACP,GAAG;MACH,gBAAgB;MAChB,eAAe,SAAS,SAAS,aAAa,GAAG,MAAM,SAAS,GAAG,SAAS,MAAM,MAAM,eAAe,MAAM,GAAG;KAClH;KACA,MAAM,iBAAiB,EAAE,cAAc,SAAS,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC;KACnF;IACF,CAAC;IAED,OAAO,eAAe;IACtB,IAAI,SAAS,WAAW,KAAK,MAAM,YAAY;GACjD;GACA,OAAO;EACT,CAAC;CACH,CAAC,EACH,CAAC,CACH;AACF;;;;AAKA,MAAa,0BACX,iBAC8B;CAC9B,IAAI;CAEJ,IAAI;EACF,QAAQ,kBAAkB,YAAY,YAAY;CACpD,QAAQ;EACN,MAAM,QAAQ;CAChB;CAEA,OAAO;EACL,GAAG,SAAS,KAAK;EACjB,QAAQ,CAAC,WAAW;GACnB,qBAAqB;CACxB;AACF;AAEA,MAAa,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAChF,SACA;CACA,MAAM,QAAQ,OAAO,QAAQ,aAAa,QAAQ,eAAe,OAAO;CAExE,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CAExB,OAAO,OAAO,8BAA8B;EAC1C,GAAG;EACH,WAAW,MAAM,cAAc,IAAI,sBAAsB;CAC3D,CAAC;AACH,CAAC;AAED,MAAa,sCAAsC,OAAO,GAAG,qCAAqC,CAAC,CACjG,WAAW,SAAiD;CAC1D,MAAM,QAAQ,OAAO,QAAQ,sBAAsB,QAAQ,eAAe,OAAO;CAEjF,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CACxB,KAAK,MAAM,gBAAgB,MAAM,eAC/B,KAAK,MAAM,WAAW,aAAa,UACjC,IACE,QAAQ,aAAa,6BACrB,QAAQ,yBAAyB,aAAa,YAC9C,QAAQ,UAAU,WAAW,KAC7B,QAAQ,OAAO,MAAM,UAAU,UAAU,oBAAoB,CAAC,OAAO,KAAK,CAAC,MAC1E,QAAQ,cAAc,gBACnB,QAAQ,YAAY,iBACpB,QAAQ,iCAAiC,KAAA,IACzC,QAAQ,YAAY,cAAc,QAAQ,iCAAiC,KAAA,IAE/E,OAAO,OAAO,QAAQ;CAI5B,OAAO,OAAO,uCACZ;EACE,GAAG;EACH,WAAW,MAAM,cAAc,KAAK,UAAU;GAC5C,GAAG,SAAS,IAAI;GAChB,UAAU,KAAK;GACf,sBAAsB,KAAK;GAC3B,oBAAoB;GACpB,eAAe;IAAE,OAAO;IAA4B,MAAM;GAAU;GACpE,YAAY,EAAE,MAAM,kBAAkB;EACxC,EAAE;CACJ,GACA,aACF,CAAC,CAAC,KAAK,OAAO,QAAQ,gBAAgB,KAAK,CAAC,CAAC;AAC/C,CACF;AAEA,MAAa,+BAA+B,YAC1C,MAAM,OAAO,eAAe,2BAA2B,OAAO,CAAC;AAEjE,MAAa,wCACX,YACG,MAAM,OAAO,wBAAwB,oCAAoC,OAAO,CAAC"}
|
package/package.json
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"name":"@yielded/auth","version":"0.1.0-beta.
|
|
1
|
+
{"name":"@yielded/auth","version":"0.1.0-beta.4","dependencies":{"@noble/ciphers":"2.1.1","@noble/hashes":"2.3.0"},"devDependencies":{"@cloudflare/workers-types":"5.20260825.1","@effect/platform-bun":"4.0.0-rc.112","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/sql-libsql":"4.0.0-rc.112","@effect/sql-mysql2":"4.0.0-rc.112","@effect/sql-pg":"4.0.0-rc.112","@effect/sql-pglite":"4.0.0-rc.112","@effect/sql-sqlite-bun":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112","@effect/sql-sqlite-node":"4.0.0-rc.112","@effect/sql-sqlite-wasm":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","@simplewebauthn/browser":"14.0.0","@simplewebauthn/server":"14.0.1","drizzle-orm":"1.0.0-rc.5-ab785fc","effect":"4.0.0-rc.112","effect-cf":"0.40.0","openid-client":"6.8.8","tldts":"7.4.11","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"@effect/sql-d1":">=4.0.0-rc.112","@effect/sql-libsql":">=4.0.0-rc.112","@effect/sql-mysql2":">=4.0.0-rc.112","@effect/sql-pg":">=4.0.0-rc.112","@effect/sql-pglite":">=4.0.0-rc.112","@effect/sql-sqlite-bun":">=4.0.0-rc.112","@effect/sql-sqlite-do":">=4.0.0-rc.112","@effect/sql-sqlite-node":">=4.0.0-rc.112","@effect/sql-sqlite-wasm":">=4.0.0-rc.112","@simplewebauthn/browser":">=14.0.0 <15","@simplewebauthn/server":">=14.0.1 <15","drizzle-orm":">=1.0.0-rc.5-ab785fc","effect":"^4.0.0-rc.112","effect-cf":"^0.40.0","openid-client":">=6.8.8 <7","tldts":">=7.4.11 <8"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Auth":{"types":"./dist/Auth.d.mts","default":"./dist/Auth.mjs"},"./Drizzle":{"types":"./dist/Drizzle.d.mts","default":"./dist/Drizzle.mjs"},"./DrizzleD1":{"types":"./dist/DrizzleD1.d.mts","default":"./dist/DrizzleD1.mjs"},"./DrizzleLibsql":{"types":"./dist/DrizzleLibsql.d.mts","default":"./dist/DrizzleLibsql.mjs"},"./DrizzleMysql2":{"types":"./dist/DrizzleMysql2.d.mts","default":"./dist/DrizzleMysql2.mjs"},"./DrizzlePglite":{"types":"./dist/DrizzlePglite.d.mts","default":"./dist/DrizzlePglite.mjs"},"./DrizzlePostgres":{"types":"./dist/DrizzlePostgres.d.mts","default":"./dist/DrizzlePostgres.mjs"},"./DrizzleSqliteBun":{"types":"./dist/DrizzleSqliteBun.d.mts","default":"./dist/DrizzleSqliteBun.mjs"},"./DrizzleSqliteDo":{"types":"./dist/DrizzleSqliteDo.d.mts","default":"./dist/DrizzleSqliteDo.mjs"},"./DrizzleSqliteNode":{"types":"./dist/DrizzleSqliteNode.d.mts","default":"./dist/DrizzleSqliteNode.mjs"},"./DrizzleSqliteWasm":{"types":"./dist/DrizzleSqliteWasm.d.mts","default":"./dist/DrizzleSqliteWasm.mjs"},"./Cloudflare":{"types":"./dist/Cloudflare.d.mts","default":"./dist/Cloudflare.mjs"},"./Http":{"types":"./dist/Http.d.mts","default":"./dist/Http.mjs"},"./HttpServer":{"types":"./dist/HttpServer.d.mts","default":"./dist/HttpServer.mjs"},"./OperationHttp":{"types":"./dist/OperationHttp.d.mts","default":"./dist/OperationHttp.mjs"},"./OperationHttpClient":{"types":"./dist/OperationHttpClient.d.mts","default":"./dist/OperationHttpClient.mjs"},"./OperationHttpServer":{"types":"./dist/OperationHttpServer.d.mts","default":"./dist/OperationHttpServer.mjs"},"./Atom":{"types":"./dist/Atom.d.mts","default":"./dist/Atom.mjs"},"./Hooks":{"types":"./dist/Hooks.d.mts","default":"./dist/Hooks.mjs"},"./Identity":{"types":"./dist/Identity.d.mts","default":"./dist/Identity.mjs"},"./OAuth":{"types":"./dist/OAuth.d.mts","default":"./dist/OAuth.mjs"},"./Operations":{"types":"./dist/Operations.d.mts","default":"./dist/Operations.mjs"},"./Rpc":{"types":"./dist/Rpc.d.mts","default":"./dist/Rpc.mjs"},"./Schema":{"types":"./dist/Schema.d.mts","default":"./dist/Schema.mjs"},"./Testing":{"types":"./dist/Testing.d.mts","default":"./dist/Testing.mjs"},"./WebCrypto":{"types":"./dist/WebCrypto.d.mts","default":"./dist/WebCrypto.mjs"},"./Sessions":{"types":"./dist/Sessions.d.mts","default":"./dist/Sessions.mjs"},"./SessionContract":{"types":"./dist/SessionContract.d.mts","default":"./dist/SessionContract.mjs"},"./Proofs":{"types":"./dist/Proofs.d.mts","default":"./dist/Proofs.mjs"},"./Password":{"types":"./dist/Password.d.mts","default":"./dist/Password.mjs"},"./Email":{"types":"./dist/Email.d.mts","default":"./dist/Email.mjs"},"./OpenIdClient":{"types":"./dist/OpenIdClient.d.mts","default":"./dist/OpenIdClient.mjs"},"./OpenIdClientConnected":{"types":"./dist/OpenIdClientConnected.d.mts","default":"./dist/OpenIdClientConnected.mjs"},"./Passkey":{"types":"./dist/Passkey.d.mts","default":"./dist/Passkey.mjs"},"./PasskeyPassword":{"types":"./dist/PasskeyPassword.d.mts","default":"./dist/PasskeyPassword.mjs"},"./PasskeySimpleWebAuthn":{"types":"./dist/PasskeySimpleWebAuthn.d.mts","default":"./dist/PasskeySimpleWebAuthn.mjs"},"./PasskeyBrowser":{"types":"./dist/PasskeyBrowser.d.mts","default":"./dist/PasskeyBrowser.mjs"},"./GitHub":{"types":"./dist/GitHub.d.mts","default":"./dist/GitHub.mjs"},"./AuthSession":{"types":"./dist/AuthSession.d.mts","default":"./dist/AuthSession.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./Workflows":{"types":"./dist/Workflows.d.mts","default":"./dist/Workflows.mjs"},"./PasswordHasher":{"types":"./dist/PasswordHasher.d.mts","default":"./dist/PasswordHasher.mjs"},"./EmailOtp":{"types":"./dist/EmailOtp.d.mts","default":"./dist/EmailOtp.mjs"},"./AuthStore":{"types":"./dist/AuthStore.d.mts","default":"./dist/AuthStore.mjs"},"./PasswordAuth":{"types":"./dist/PasswordAuth.d.mts","default":"./dist/PasswordAuth.mjs"},"./Policy":{"types":"./dist/Policy.d.mts","default":"./dist/Policy.mjs"},"./EmailOtpSender":{"types":"./dist/EmailOtpSender.d.mts","default":"./dist/EmailOtpSender.mjs"},"./AuthTokenCodec":{"types":"./dist/AuthTokenCodec.d.mts","default":"./dist/AuthTokenCodec.mjs"},"./IdentityResolver":{"types":"./dist/IdentityResolver.d.mts","default":"./dist/IdentityResolver.mjs"},"./PasswordCredentialStore":{"types":"./dist/PasswordCredentialStore.d.mts","default":"./dist/PasswordCredentialStore.mjs"},"./PhoneOtp":{"types":"./dist/PhoneOtp.d.mts","default":"./dist/PhoneOtp.mjs"},"./Totp":{"types":"./dist/Totp.d.mts","default":"./dist/Totp.mjs"},"./PasskeyContract":{"types":"./dist/PasskeyContract.d.mts","default":"./dist/PasskeyContract.mjs"},"./TotpContract":{"types":"./dist/TotpContract.d.mts","default":"./dist/TotpContract.mjs"},"./AuthContract":{"types":"./dist/AuthContract.d.mts","default":"./dist/AuthContract.mjs"},"./Client":{"types":"./dist/Client.d.mts","default":"./dist/Client.mjs"}},"description":"Composable authentication, sessions, and identity workflows for Effect.","keywords":["authentication","effect","oauth","passkeys","sessions","typescript"],"homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/effect-auth"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","e2e":"bun test/e2e/harness.ts","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true},"@simplewebauthn/browser":{"optional":true},"@simplewebauthn/server":{"optional":true},"drizzle-orm":{"optional":true},"effect-cf":{"optional":true},"openid-client":{"optional":true},"tldts":{"optional":true}}}
|
|
@@ -29,7 +29,8 @@ import type {
|
|
|
29
29
|
|
|
30
30
|
const unavailable = () => OAuthUnavailable.make({});
|
|
31
31
|
const invalid = () => OpenIdClientConfigurationError.make({ reason: "provider" });
|
|
32
|
-
|
|
32
|
+
// GitHub's OAuth authorization server issuer, including its RFC 9207 callback value.
|
|
33
|
+
const issuer = OAuthIssuer.make("https://github.com/login/oauth");
|
|
33
34
|
|
|
34
35
|
const headers = Object.freeze({
|
|
35
36
|
Accept: "application/vnd.github+json",
|
|
@@ -92,7 +93,7 @@ const provider = (
|
|
|
92
93
|
issuance: registration.issuance,
|
|
93
94
|
issuer,
|
|
94
95
|
protocol: "oauth",
|
|
95
|
-
responseIssuerMode: "
|
|
96
|
+
responseIssuerMode: "required",
|
|
96
97
|
clientId: registration.clientId,
|
|
97
98
|
authentication: { method: "client_secret_post", secret: registration.clientSecret },
|
|
98
99
|
callbacks: registration.callbacks,
|