antarctic 0.2.0

package/dist/providers/spotify.js

@@ -0,0 +1,67 @@
+import { CodeChallengeMethod, OAuth2Client } from "../client.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://accounts.spotify.com/authorize";
+const tokenEndpoint = "https://accounts.spotify.com/api/token";
+const userEndpoint = "https://api.spotify.com/v1/me";
+const envPrefix = "SPOTIFY";
+const defaultScopes = ["user-read-email", "user-read-private"];
+export class Spotify {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { redirectURI: true });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? "");
+        }
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        let url;
+        if (codeVerifier !== null) {
+            url = this.client.createAuthorizationURLWithPKCE(authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        }
+        else {
+            url = this.client.createAuthorizationURL(authorizationEndpoint, state, scopes);
+        }
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        let image = null;
+        if (Array.isArray(profile.images) && profile.images.length > 0) {
+            const first = profile.images[0];
+            image = profileString(first.url);
+        }
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.display_name),
+            email: profileString(profile.email),
+            image
+        };
+    }
+}

package/dist/providers/startgg.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface StartGGOptions extends ProviderOptions {
+}
+export declare class StartGG {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: StartGGOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, scopes: string[]): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string, scopes: string[]): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/startgg.js

@@ -0,0 +1,143 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://start.gg/oauth/authorize";
+const tokenEndpoint = "https://api.start.gg/oauth/access_token";
+const refreshEndpoint = "https://api.start.gg/oauth/refresh";
+const graphqlEndpoint = "https://api.start.gg/gql/alpha";
+const envPrefix = "START_GG";
+const defaultScopes = ["user.identity", "user.email"];
+const currentUserQuery = "{ currentUser { id name email images { url } } }";
+async function fetchCurrentUser(accessToken) {
+    const request = new Request(graphqlEndpoint, {
+        method: "POST",
+        body: JSON.stringify({ query: currentUserQuery })
+    });
+    request.headers.set("Authorization", `Bearer ${accessToken}`);
+    request.headers.set("Content-Type", "application/json");
+    request.headers.set("Accept", "application/json");
+    request.headers.set("User-Agent", "arctic");
+    let response;
+    try {
+        response = await fetch(request);
+    }
+    catch {
+        throw new OAuthProviderError("Failed to fetch user profile");
+    }
+    if (!response.ok) {
+        if (response.body !== null) {
+            await response.body.cancel();
+        }
+        throw new OAuthProviderError(`User profile request failed with status ${response.status}`);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw new OAuthProviderError("User profile response was not valid JSON");
+    }
+    if (typeof body !== "object" || body === null) {
+        throw new OAuthProviderError("Unexpected user profile response body");
+    }
+    const errors = body.errors;
+    if (Array.isArray(errors) && errors.length > 0) {
+        const first = errors[0];
+        throw new OAuthProviderError(`User profile request failed: ${profileString(first.message) ?? "unknown error"}`);
+    }
+    const data = body.data;
+    if (typeof data !== "object" || data === null) {
+        throw new OAuthProviderError("Unexpected user profile response body");
+    }
+    const currentUser = data.currentUser;
+    if (typeof currentUser !== "object" || currentUser === null) {
+        throw new OAuthProviderError("Unexpected user profile response body");
+    }
+    return currentUser;
+}
+export class StartGG {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code, scopes) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        if (scopes.length > 0) {
+            body.set("scope", scopes.join(" "));
+        }
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken, scopes) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        if (scopes.length > 0) {
+            body.set("scope", scopes.join(" "));
+        }
+        const request = createOAuth2Request(refreshEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const resolved = resolveScopes(scopes, auth, defaultScopes);
+        const url = this.createAuthorizationURL(state, resolved);
+        await saveOAuthState(auth.store, state, { scopes: resolved });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code, stored.scopes ?? resolveScopes(undefined, auth, defaultScopes));
+        const profile = await fetchCurrentUser(tokens.accessToken());
+        let image = null;
+        if (Array.isArray(profile.images) && profile.images.length > 0) {
+            const first = profile.images[0];
+            image = profileString(first.url);
+        }
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.name),
+            email: profileString(profile.email),
+            image
+        };
+    }
+}

package/dist/providers/strava.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface StravaOptions extends ProviderOptions {
+}
+export declare class Strava {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: StravaOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/strava.js

@@ -0,0 +1,85 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://www.strava.com/oauth/authorize";
+const tokenEndpoint = "https://www.strava.com/api/v3/oauth/token";
+const userEndpoint = "https://www.strava.com/api/v3/athlete";
+const envPrefix = "STRAVA";
+const defaultScopes = ["read"];
+export class Strava {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        // Strava deviates from the RFC and uses a comma-delimitated string instead of space.
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(","));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        const firstName = profileString(profile.firstname);
+        const lastName = profileString(profile.lastname);
+        const name = [firstName, lastName].filter((part) => part !== null).join(" ");
+        return {
+            id: profileId(profile.id),
+            name: name !== "" ? name : null,
+            email: null,
+            image: profileString(profile.profile)
+        };
+    }
+}

package/dist/providers/synology.d.ts

@@ -0,0 +1,9 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+export declare class Synology {
+    private authorizationEndpoint;
+    private tokenEndpoint;
+    private client;
+    constructor(baseURL: string, applicationId: string, applicationSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+}

package/dist/providers/synology.js

@@ -0,0 +1,20 @@
+import { CodeChallengeMethod, OAuth2Client } from "../client.js";
+import { joinURIAndPath } from "../request.js";
+export class Synology {
+    authorizationEndpoint;
+    tokenEndpoint;
+    client;
+    constructor(baseURL, applicationId, applicationSecret, redirectURI) {
+        this.authorizationEndpoint = joinURIAndPath(baseURL, "/webman/sso/SSOOauth.cgi");
+        this.tokenEndpoint = joinURIAndPath(baseURL, "/webman/sso/SSOAccessToken.cgi");
+        this.client = new OAuth2Client(applicationId, applicationSecret, redirectURI);
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(this.authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(this.tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+}

package/dist/providers/tiktok.d.ts

@@ -0,0 +1,18 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface TikTokOptions extends ProviderOptions {
+}
+export declare class TikTok {
+    private clientKey;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: TikTokOptions);
+    constructor(clientKey: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/tiktok.js

@@ -0,0 +1,109 @@
+import { createS256CodeChallenge } from "../oauth2.js";
+import { createOAuth2Request, sendTokenRequest, sendTokenRevocationRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://www.tiktok.com/v2/auth/authorize";
+const tokenEndpoint = "https://open.tiktokapis.com/v2/oauth/token/";
+const tokenRevocationEndpoint = "https://open.tiktokapis.com/v2/oauth/revoke/";
+const userEndpoint = "https://open.tiktokapis.com/v2/user/info/";
+const envPrefix = "TIKTOK";
+const defaultScopes = ["user.info.basic"];
+export class TikTok {
+    clientKey;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientKeyOrOptions, clientSecret, redirectURI) {
+        if (typeof clientKeyOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientKeyOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientKey = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientKey = clientKeyOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_key", this.clientKey);
+        url.searchParams.set("state", state);
+        const codeChallenge = createS256CodeChallenge(codeVerifier);
+        url.searchParams.set("code_challenge_method", "S256");
+        url.searchParams.set("code_challenge", codeChallenge);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(","));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("code_verifier", codeVerifier);
+        body.set("client_key", this.clientKey);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_key", this.clientKey);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async revokeToken(token) {
+        const body = new URLSearchParams();
+        body.set("token", token);
+        body.set("client_key", this.clientKey);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenRevocationEndpoint, body);
+        await sendTokenRevocationRequest(request);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const url = new URL(userEndpoint);
+        url.searchParams.set("fields", "open_id,display_name,avatar_url");
+        const profile = await fetchUserProfile(url, tokens.accessToken());
+        let user = {};
+        if (typeof profile.data === "object" && profile.data !== null) {
+            const inner = profile.data.user;
+            if (typeof inner === "object" && inner !== null) {
+                user = inner;
+            }
+        }
+        // TikTok does not expose an email address.
+        return {
+            id: profileId(user.open_id),
+            name: profileString(user.display_name),
+            email: null,
+            image: profileString(user.avatar_url)
+        };
+    }
+}

package/dist/providers/tiltify.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface TiltifyOptions extends ProviderOptions {
+}
+export declare class Tiltify {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: TiltifyOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/tiltify.js

@@ -0,0 +1,90 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://v5api.tiltify.com/oauth/authorize";
+const tokenEndpoint = "https://v5api.tiltify.com/oauth/token";
+const userEndpoint = "https://v5api.tiltify.com/api/public/current-user";
+const envPrefix = "TILTIFY";
+const defaultScopes = ["public"];
+export class Tiltify {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        let user = {};
+        if (typeof profile.data === "object" && profile.data !== null) {
+            user = profile.data;
+        }
+        let image = null;
+        if (typeof user.avatar === "object" && user.avatar !== null) {
+            image = profileString(user.avatar.src);
+        }
+        // Tiltify does not expose an email address on the public current-user endpoint.
+        return {
+            id: profileId(user.id),
+            name: profileString(user.username),
+            email: null,
+            image
+        };
+    }
+}

package/dist/providers/tumblr.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface TumblrOptions extends ProviderOptions {
+}
+export declare class Tumblr {
+    private client;
+    private auth;
+    constructor(options: TumblrOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}