alepha 0.19.4 → 0.19.5

package/dist/server/auth/index.js

@@ -1328,11 +1328,19 @@ var AuthPrimitive = class extends Primitive {
 	/**
 	* Extracts user information from the access token.
 	* This is used to create a user account from the access token.
+	*
+	* `externalProfile` carries extra profile fields that cannot be derived from the
+	* ID token or userinfo endpoint — e.g. Apple's `user` form field that is only
+	* delivered once, on first authorization. ID token / userinfo fields take
+	* precedence; externalProfile only fills gaps.
 	*/
-	async user(tokens) {
+	async user(tokens, externalProfile) {
 		try {
 			if ("oauth" in this.options) {
-				const profile = await this.options.oauth.userinfo(tokens);
+				const profile = {
+					...externalProfile,
+					...await this.options.oauth.userinfo(tokens)
+				};
 				if (this.options.oauth.account) return this.options.oauth.account({
 					...tokens,
 					user: profile
@@ -1340,7 +1348,10 @@ var AuthPrimitive = class extends Primitive {
 				return this.securityProvider.createUserFromPayload(profile);
 			}
 			if ("oidc" in this.options) {
-				const payload = this.getUserFromIdToken(tokens.id_token || "");
+				const payload = {
+					...externalProfile,
+					...this.getUserFromIdToken(tokens.id_token || "")
+				};
 				if (this.options.oidc.account) return this.options.oidc.account({
 					...tokens,
 					user: payload
@@ -1426,6 +1437,14 @@ var ServerAuthProvider = class {
 	serverCookiesProvider = $inject(ServerCookiesProvider);
 	dateTimeProvider = $inject(DateTimeProvider);
 	serverLinksProvider = $inject(ServerLinksProvider);
+	/**
+	* Validates that a redirect URI is a safe relative path.
+	* Prevents open redirect attacks by rejecting absolute URLs and protocol-relative URLs.
+	*/
+	validateRedirectUri(uri) {
+		if (!uri.startsWith("/") || uri.startsWith("//")) return "/";
+		return uri;
+	}
 	get identities() {
 		return this.alepha.primitives($auth).filter((auth) => !auth.options.disabled);
 	}
@@ -1433,6 +1452,7 @@ var ServerAuthProvider = class {
 		name: "authorizationCode",
 		ttl: [15, "minutes"],
 		httpOnly: true,
+		encrypt: true,
 		schema: t.object({
 			provider: t.text(),
 			realm: t.optional(t.text()),
@@ -1494,7 +1514,7 @@ var ServerAuthProvider = class {
 			const tokens = this.getTokens(cookies);
 			if (tokens) {
 				const provider = this.provider(tokens);
-				if (!("realm" in provider.options)) {
+				if (!("issuer" in provider.options)) {
 					const user = await provider.user(tokens);
 					return {
 						api: await this.serverLinksProvider.getUserApiLinks({
@@ -1619,10 +1639,12 @@ var ServerAuthProvider = class {
 				};
 				if (oidc) parameters.nonce = randomState();
 				if (scope) parameters.scope = scope;
+				if (oidc && oidc.responseMode) parameters.response_mode = oidc.responseMode;
+				if (oidc && oidc.authorizationParameters) Object.assign(parameters, oidc.authorizationParameters);
 				this.authorizationCode.set({
 					state,
 					nonce: parameters.nonce,
-					redirectUri: query.redirect_uri ?? "/",
+					redirectUri: this.validateRedirectUri(query.redirect_uri ?? "/"),
 					loginUri,
 					provider: query.provider,
 					realm: query.realm
@@ -1638,9 +1660,11 @@ var ServerAuthProvider = class {
 				code_challenge_method: "S256"
 			};
 			if (scope) parameters.scope = scope;
+			if (oidc && oidc.responseMode) parameters.response_mode = oidc.responseMode;
+			if (oidc && oidc.authorizationParameters) Object.assign(parameters, oidc.authorizationParameters);
 			this.authorizationCode.set({
 				codeVerifier,
-				redirectUri: query.redirect_uri ?? "/",
+				redirectUri: this.validateRedirectUri(query.redirect_uri ?? "/"),
 				loginUri,
 				provider: query.provider,
 				realm: query.realm
@@ -1649,55 +1673,103 @@ var ServerAuthProvider = class {
 		}
 	});
 	/**
+	* Extracts provider-specific extra profile fields delivered via the
+	* authorization callback form body rather than the ID token or userinfo
+	* endpoint. Currently handles Apple Sign In's `user` field, which is sent
+	* only on the user's first authorization and contains their name.
+	*/
+	async extractFormPostProfile(req) {
+		try {
+			const userField = (await req.formData()).get("user");
+			if (typeof userField !== "string") return;
+			const parsed = JSON.parse(userField);
+			const profile = {};
+			if (parsed.name?.firstName) profile.given_name = parsed.name.firstName;
+			if (parsed.name?.lastName) profile.family_name = parsed.name.lastName;
+			if (parsed.name?.firstName || parsed.name?.lastName) profile.name = [parsed.name?.firstName, parsed.name?.lastName].filter(Boolean).join(" ");
+			if (parsed.email) profile.email = parsed.email;
+			return Object.keys(profile).length > 0 ? profile : void 0;
+		} catch (e) {
+			this.log.warn("Failed to parse form_post profile from callback body", e);
+			return;
+		}
+	}
+	/**
+	* Shared callback logic for both GET and POST OAuth2/OIDC callbacks.
+	* For form_post response mode (e.g. Apple Sign In), the raw Request object
+	* is passed so openid-client can read the authorization code from the POST body.
+	*/
+	async handleCallback(url, reply, cookies, raw) {
+		const authorizationCode = this.authorizationCode.get({ cookies });
+		if (!authorizationCode) throw new BadRequestError("Missing code verifier");
+		const provider = this.provider(authorizationCode);
+		const oauth = await provider.getOAuth();
+		if (!oauth) throw new SecurityError(`Auth provider '${provider.name}' does not support OAuth2`);
+		const redirectUri = authorizationCode.redirectUri ?? "/";
+		const loginUri = authorizationCode.loginUri;
+		let currentUrl = url;
+		let externalProfile;
+		if (raw?.web?.req && raw.web.req.method === "POST") {
+			const cloned = raw.web.req.clone();
+			currentUrl = raw.web.req;
+			externalProfile = await this.extractFormPostProfile(cloned);
+		}
+		const externalTokens = await authorizationCodeGrant(oauth, currentUrl, {
+			pkceCodeVerifier: authorizationCode.codeVerifier,
+			expectedState: authorizationCode.state,
+			expectedNonce: authorizationCode.nonce
+		}).then((tokens) => ({
+			issued_at: this.dateTimeProvider.now().unix(),
+			provider: provider.name,
+			...tokens
+		})).catch((e) => {
+			this.log.error("Failed to get access token", e);
+			throw new SecurityError("Failed to get access token", { cause: e });
+		});
+		this.authorizationCode.del({ cookies });
+		const issuer = provider.issuer;
+		if (!issuer) {
+			this.setTokens(externalTokens, cookies);
+			reply.redirect(redirectUri, 302);
+			return;
+		}
+		let user;
+		try {
+			user = await provider.user(externalTokens, externalProfile);
+		} catch (e) {
+			this.log.warn("OAuth2 account linking failed", e);
+			const errorUrl = new URL(loginUri || redirectUri, url.origin);
+			errorUrl.searchParams.set("error", e instanceof BadRequestError ? e.message : "Authentication failed");
+			reply.redirect(errorUrl.pathname + errorUrl.search, 302);
+			return;
+		}
+		const tokens = await issuer.createToken(user);
+		this.setTokens({
+			...tokens,
+			issued_at: this.dateTimeProvider.now().unix(),
+			provider: provider.name
+		}, cookies);
+		reply.redirect(redirectUri, 302);
+	}
+	/**
 	* Callback for OAuth2/OIDC providers.
 	* It handles the authorization code flow and retrieves the access token.
 	*/
 	callback = $route({
 		path: alephaServerAuthRoutes.callback,
 		handler: async ({ url, reply, cookies }) => {
-			const authorizationCode = this.authorizationCode.get({ cookies });
-			if (!authorizationCode) throw new BadRequestError("Missing code verifier");
-			const provider = this.provider(authorizationCode);
-			const oauth = await provider.getOAuth();
-			if (!oauth) throw new SecurityError(`Auth provider '${provider.name}' does not support OAuth2`);
-			const redirectUri = authorizationCode.redirectUri ?? "/";
-			const loginUri = authorizationCode.loginUri;
-			const externalTokens = await authorizationCodeGrant(oauth, url, {
-				pkceCodeVerifier: authorizationCode.codeVerifier,
-				expectedState: authorizationCode.state,
-				expectedNonce: authorizationCode.nonce
-			}).then((tokens) => ({
-				issued_at: this.dateTimeProvider.now().unix(),
-				provider: provider.name,
-				...tokens
-			})).catch((e) => {
-				this.log.error("Failed to get access token", e);
-				throw new SecurityError("Failed to get access token", { cause: e });
-			});
-			this.authorizationCode.del({ cookies });
-			const issuer = provider.issuer;
-			if (!issuer) {
-				this.setTokens(externalTokens, cookies);
-				reply.redirect(redirectUri, 302);
-				return;
-			}
-			let user;
-			try {
-				user = await provider.user(externalTokens);
-			} catch (e) {
-				this.log.warn("OAuth2 account linking failed", e);
-				const errorUrl = new URL(loginUri || redirectUri, url.origin);
-				errorUrl.searchParams.set("error", e instanceof BadRequestError ? e.message : "Authentication failed");
-				reply.redirect(errorUrl.pathname + errorUrl.search, 302);
-				return;
-			}
-			const tokens = await issuer.createToken(user);
-			this.setTokens({
-				...tokens,
-				issued_at: this.dateTimeProvider.now().unix(),
-				provider: provider.name
-			}, cookies);
-			reply.redirect(redirectUri, 302);
+			await this.handleCallback(url, reply, cookies);
+		}
+	});
+	/**
+	* POST callback for OAuth2/OIDC providers using form_post response mode.
+	* Apple Sign In sends the authorization code via POST body instead of URL query parameters.
+	*/
+	callbackPost = $route({
+		path: alephaServerAuthRoutes.callback,
+		method: "POST",
+		handler: async ({ url, reply, cookies, raw }) => {
+			await this.handleCallback(url, reply, cookies, raw);
 		}
 	});
 	/**
@@ -1708,7 +1780,7 @@ var ServerAuthProvider = class {
 		method: "POST",
 		schema: { query: t.object({ post_logout_redirect_uri: t.optional(t.text()) }) },
 		handler: async ({ query, reply, cookies }) => {
-			const redirect = query.post_logout_redirect_uri ?? "/";
+			const redirect = this.validateRedirectUri(query.post_logout_redirect_uri ?? "/");
 			const tokens = this.getTokens(cookies);
 			if (!tokens) {
 				reply.redirect(redirect, 302);
@@ -1812,7 +1884,7 @@ var ServerAuthProvider = class {
 	}
 	extractAccessToken(tokens) {
 		const idp = this.provider(tokens.provider);
-		if ("oidc" in idp.options && !("realm" in idp.options) && idp.options.oidc?.useIdToken) return tokens.id_token;
+		if ("oidc" in idp.options && !("issuer" in idp.options) && idp.options.oidc?.useIdToken) return tokens.id_token;
 		return tokens.access_token;
 	}
 	async refreshTokens(tokens) {
@@ -1851,6 +1923,84 @@ const authenticationProviderSchema = t.object({
 	], { description: "Type of the authentication provider." })
 }, { title: "AuthenticationProvider" });
 //#endregion
+//#region ../../src/server/auth/primitives/$authApple.ts
+/**
+* Already configured Apple authentication primitive.
+*
+* Uses OpenID Connect (OIDC) to authenticate users via their Apple accounts.
+* Upon successful authentication, it links the Apple account to a user session.
+*
+* Apple-specific behavior:
+* - `response_mode=form_post` (required by Apple when requesting `email`/`name`).
+* - Scope: `name email` (Apple does not support the standard `profile` scope).
+* - The user's name is only provided on the first authorization, as a `user`
+*   form field on the POST callback. The framework extracts it and injects
+*   `given_name` / `family_name` / `name` into the profile before linking.
+*   Subsequent logins only return `sub` and `email` in the ID token.
+* - `email_verified` and `is_private_email` are normalized from Apple's
+*   string ("true"/"false") representation to booleans.
+*
+* Client secret:
+* Apple requires the client secret to be a signed ES256 JWT generated from
+* your Apple private key, team ID, and key ID. This JWT is valid for up to 6
+* months; you must rotate it before expiration. Generate it out of band and
+* set it via `APPLE_CLIENT_SECRET`.
+*
+* See: https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret
+*
+* Environment Variables:
+* - `APPLE_CLIENT_ID`: The Service ID obtained from the Apple Developer Console.
+* - `APPLE_CLIENT_SECRET`: The signed ES256 JWT client secret generated from your
+*   Apple private key.
+*/
+const $authApple = (realm, options = {}) => {
+	const { alepha } = $context();
+	const env = alepha.parseEnv(t.object({
+		APPLE_CLIENT_ID: t.optional(t.text({ description: "The Service ID obtained from the Apple Developer Console." })),
+		APPLE_CLIENT_SECRET: t.optional(t.text({ description: "The signed ES256 JWT client secret generated from your Apple private key." }))
+	}));
+	const disabled = !env.APPLE_CLIENT_ID || !env.APPLE_CLIENT_SECRET;
+	const name = "apple";
+	const userAccount = options.account ?? (realm.link ? realm.link(name) : void 0);
+	if (!userAccount) throw new AlephaError("Authentication requires a link function in the realm primitive.");
+	const account = async (opts) => {
+		return userAccount(normalizeApplePayload(opts));
+	};
+	return $auth({
+		issuer: realm,
+		name,
+		oidc: {
+			issuer: "https://appleid.apple.com",
+			clientId: env.APPLE_CLIENT_ID,
+			clientSecret: env.APPLE_CLIENT_SECRET,
+			scope: "name email",
+			responseMode: "form_post",
+			...options,
+			account
+		},
+		disabled
+	});
+};
+/**
+* Normalize Apple-specific profile quirks before handing off to the
+* user-provided link function.
+*
+* Why: Apple's ID token non-conformities — `email_verified` and
+* `is_private_email` are delivered as the strings "true"/"false" rather than
+* booleans. Normalize so downstream code can rely on standard OIDC shapes.
+*/
+const normalizeApplePayload = (opts) => {
+	const user = { ...opts.user };
+	for (const key of ["email_verified", "is_private_email"]) {
+		const raw = user[key];
+		if (typeof raw === "string") user[key] = raw === "true";
+	}
+	return {
+		...opts,
+		user
+	};
+};
+//#endregion
 //#region ../../src/server/auth/primitives/$authCredentials.ts
 /**
 * Already configured Credentials authentication primitive.
@@ -1868,6 +2018,108 @@ const $authCredentials = (realm, options = {}) => {
 	});
 };
 //#endregion
+//#region ../../src/server/auth/primitives/$authFacebook.ts
+/**
+* Already configured Facebook authentication primitive.
+*
+* Uses OAuth2 to authenticate users via their Facebook accounts.
+* Upon successful authentication, it links the Facebook account to a user session.
+*
+* Environment Variables:
+* - `FACEBOOK_CLIENT_ID`: The App ID obtained from the Meta Developer Console.
+* - `FACEBOOK_CLIENT_SECRET`: The App Secret obtained from the Meta Developer Console.
+*/
+const $authFacebook = (realm, options = {}) => {
+	const { alepha } = $context();
+	const env = alepha.parseEnv(t.object({
+		FACEBOOK_CLIENT_ID: t.optional(t.text({ description: "The App ID obtained from the Meta Developer Console." })),
+		FACEBOOK_CLIENT_SECRET: t.optional(t.text({ description: "The App Secret obtained from the Meta Developer Console." }))
+	}));
+	const disabled = !env.FACEBOOK_CLIENT_ID || !env.FACEBOOK_CLIENT_SECRET;
+	const name = "facebook";
+	const account = options.account ?? (realm.link ? realm.link(name) : void 0);
+	if (!account) throw new AlephaError("Authentication requires a link function in the realm primitive.");
+	return $auth({
+		issuer: realm,
+		name,
+		oauth: {
+			clientId: env.FACEBOOK_CLIENT_ID,
+			clientSecret: env.FACEBOOK_CLIENT_SECRET,
+			authorization: "https://www.facebook.com/v25.0/dialog/oauth",
+			token: "https://graph.facebook.com/v25.0/oauth/access_token",
+			scope: "email",
+			userinfo: async (tokens) => {
+				const res = await fetch("https://graph.facebook.com/v25.0/me?fields=id,name,email,picture.width(200).height(200)", { headers: { Authorization: `Bearer ${tokens.access_token}` } }).then((res) => res.json());
+				const user = { sub: res.id };
+				if (res.email) user.email = res.email;
+				if (res.name) user.name = res.name.trim();
+				if (res.picture?.data?.url) user.picture = res.picture.data.url;
+				return user;
+			},
+			...options,
+			account
+		},
+		disabled
+	});
+};
+//#endregion
+//#region ../../src/server/auth/primitives/$authFranceConnect.ts
+/**
+* Creates an authentication provider primitive for France Connect.
+*
+* Uses OpenID Connect (OIDC) to authenticate users via France Connect,
+* the French government's identity federation system. It provides verified
+* identity data (name, email, birthdate) sourced directly from government
+* databases.
+*
+* **France Connect-specific behaviour**:
+* - Scopes use individual claim names (`given_name`, `family_name`) rather
+*   than the standard grouped `profile` scope.
+* - The `acr_values=eidas1` authorization parameter is mandatory and is
+*   included automatically.
+* - Logout is mandatory in France Connect integrations. Store the `id_token`
+*   returned at login and pass it to the logout endpoint when the session ends.
+*
+* **Environment Variables** (obtain from partenaires.franceconnect.gouv.fr):
+* - `FRANCECONNECT_CLIENT_ID` — OAuth 2.0 client ID for your France Connect service provider.
+* - `FRANCECONNECT_CLIENT_SECRET` — OAuth 2.0 client secret for your France Connect service provider.
+*
+* @example
+* ```ts
+* class AuthProviders {
+*   franceconnect = $authFranceConnect(this.userRealm);
+* }
+* ```
+*/
+const $authFranceConnect = (realm, options = {}) => {
+	const { alepha } = $context();
+	const env = alepha.parseEnv(t.object({
+		FRANCECONNECT_CLIENT_ID: t.optional(t.text({ description: "The OAuth 2.0 client ID for your France Connect service provider, obtained from partenaires.franceconnect.gouv.fr." })),
+		FRANCECONNECT_CLIENT_SECRET: t.optional(t.text({ description: "The OAuth 2.0 client secret for your France Connect service provider, obtained from partenaires.franceconnect.gouv.fr." }))
+	}));
+	const disabled = !env.FRANCECONNECT_CLIENT_ID || !env.FRANCECONNECT_CLIENT_SECRET;
+	const name = "franceconnect";
+	const account = options.account ?? (realm.link ? realm.link(name) : void 0);
+	if (!account) throw new AlephaError("Authentication requires a link function in the realm primitive.");
+	return $auth({
+		issuer: realm,
+		name,
+		oidc: {
+			issuer: "https://oidc.franceconnect.gouv.fr/api/v2",
+			clientId: env.FRANCECONNECT_CLIENT_ID,
+			clientSecret: env.FRANCECONNECT_CLIENT_SECRET,
+			scope: "openid given_name family_name email",
+			...options,
+			authorizationParameters: {
+				acr_values: "eidas1",
+				...options.authorizationParameters
+			},
+			account
+		},
+		disabled
+	});
+};
+//#endregion
 //#region ../../src/server/auth/primitives/$authGithub.ts
 /**
 * Already configured GitHub authentication primitive.
@@ -1900,23 +2152,20 @@ const $authGithub = (realm, options = {}) => {
 			scope: "read:user user:email",
 			userinfo: async (tokens) => {
 				const BASE_URL = "https://api.github.com";
-				const res = await fetch(`${BASE_URL}/user`, { headers: {
+				const headers = {
 					Authorization: `Bearer ${tokens.access_token}`,
 					"User-Agent": "Alepha"
-				} }).then((res) => res.json());
+				};
+				const res = await fetch(`${BASE_URL}/user`, { headers }).then((res) => res.json());
 				const user = { sub: res.id.toString() };
 				if (res.email) user.email = res.email;
 				if (res.name) user.name = res.name.trim();
 				if (res.avatar_url) user.picture = res.avatar_url;
-				if (!user.email) {
-					const res = await fetch(`${BASE_URL}/user/emails`, { headers: {
-						Authorization: `Bearer ${tokens.access_token}`,
-						"User-Agent": "Alepha"
-					} });
-					if (res.ok) {
-						const emails = await res.json();
-						user.email = (emails.find((e) => e.primary) ?? emails[0]).email;
-					}
+				const emailsRes = await fetch(`${BASE_URL}/user/emails`, { headers });
+				if (emailsRes.ok) {
+					const emails = await emailsRes.json();
+					if (!user.email) user.email = (emails.find((e) => e.primary) ?? emails[0])?.email;
+					if (user.email) user.email_verified = emails.find((e) => e.email === user.email)?.verified ?? false;
 				}
 				return user;
 			},
@@ -1962,6 +2211,55 @@ const $authGoogle = (realm, options = {}) => {
 	});
 };
 //#endregion
+//#region ../../src/server/auth/primitives/$authMicrosoft.ts
+/**
+* Already configured Microsoft Entra ID (Azure AD) authentication primitive.
+*
+* Uses OpenID Connect (OIDC) to authenticate users via their Microsoft accounts.
+* Supports personal Microsoft accounts, work/school (Azure AD) accounts, and
+* multi-tenant applications.
+*
+* The tenant ID defaults to `"common"`, which allows all Microsoft account types
+* (personal, work, school). To restrict to a specific Azure AD tenant, set
+* `MICROSOFT_TENANT_ID` to your tenant's GUID or domain.
+*
+* **Note on multi-tenant issuer validation**: Microsoft's OIDC discovery document
+* for the `common` endpoint returns `{tenantid}` as a literal placeholder in the
+* `issuer` field. This is expected behavior for multi-tenant endpoints. The
+* openid-client library handles this during token validation automatically.
+*
+* Environment Variables:
+* - `MICROSOFT_CLIENT_ID`: The application (client) ID from the Azure Portal.
+* - `MICROSOFT_CLIENT_SECRET`: The client secret value from the Azure Portal.
+* - `MICROSOFT_TENANT_ID`: (Optional) Azure AD tenant ID or `"common"` for
+*   multi-tenant. Defaults to `"common"`.
+*/
+const $authMicrosoft = (realm, options = {}) => {
+	const { alepha } = $context();
+	const env = alepha.parseEnv(t.object({
+		MICROSOFT_CLIENT_ID: t.optional(t.text({ description: "The application (client) ID obtained from the Azure Portal." })),
+		MICROSOFT_CLIENT_SECRET: t.optional(t.text({ description: "The client secret value obtained from the Azure Portal." })),
+		MICROSOFT_TENANT_ID: t.optional(t.text({ description: "The Azure AD tenant ID or 'common' for multi-tenant. Defaults to 'common'." }))
+	}));
+	const disabled = !env.MICROSOFT_CLIENT_ID || !env.MICROSOFT_CLIENT_SECRET;
+	const tenantId = env.MICROSOFT_TENANT_ID ?? "common";
+	const name = "microsoft";
+	const account = options.account ?? (realm.link ? realm.link(name) : void 0);
+	if (!account) throw new AlephaError("Authentication requires a link function in the realm primitive.");
+	return $auth({
+		issuer: realm,
+		name,
+		oidc: {
+			issuer: `https://login.microsoftonline.com/${tenantId}/v2.0`,
+			clientId: env.MICROSOFT_CLIENT_ID,
+			clientSecret: env.MICROSOFT_CLIENT_SECRET,
+			...options,
+			account
+		},
+		disabled
+	});
+};
+//#endregion
 //#region ../../src/server/auth/index.ts
 /**
 * OAuth2/OIDC authentication with social login providers.
@@ -1972,6 +2270,9 @@ const $authGoogle = (realm, options = {}) => {
 * - Google OAuth integration
 * - GitHub OAuth integration
 * - Apple OAuth integration
+* - Facebook OAuth integration
+* - Microsoft Entra ID (Azure AD) integration
+* - France Connect integration
 * - Cookie-based, SSR-friendly authentication
 * - Token management and refresh
 *
@@ -1983,6 +2284,6 @@ const AlephaServerAuth = $module({
 	services: [AlephaServerCookies, ServerAuthProvider]
 });
 //#endregion
-export { $auth, $authCredentials, $authGithub, $authGoogle, AlephaServerAuth, AuthPrimitive, ServerAuthProvider, alephaServerAuthRoutes, authenticationProviderSchema, tokenResponseSchema, tokensSchema, userinfoResponseSchema };
+export { $auth, $authApple, $authCredentials, $authFacebook, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, AlephaServerAuth, AuthPrimitive, ServerAuthProvider, alephaServerAuthRoutes, authenticationProviderSchema, tokenResponseSchema, tokensSchema, userinfoResponseSchema };
 
 //# sourceMappingURL=index.js.map