antarctic 0.2.0

package/dist/index.js

@@ -0,0 +1,69 @@
+export { AmazonCognito } from "./providers/amazon-cognito.js";
+export { AniList } from "./providers/anilist.js";
+export { Apple } from "./providers/apple.js";
+export { Atlassian } from "./providers/atlassian.js";
+export { Auth0 } from "./providers/auth0.js";
+export { Authentik } from "./providers/authentik.js";
+export { Autodesk } from "./providers/autodesk.js";
+export { BattleNet } from "./providers/battlenet.js";
+export { Bitbucket } from "./providers/bitbucket.js";
+export { Box } from "./providers/box.js";
+export { Bungie } from "./providers/bungie.js";
+export { Coinbase } from "./providers/coinbase.js";
+export { Discord } from "./providers/discord.js";
+export { DonationAlerts } from "./providers/donation-alerts.js";
+export { Dribbble } from "./providers/dribbble.js";
+export { Dropbox } from "./providers/dropbox.js";
+export { Etsy } from "./providers/etsy.js";
+export { EpicGames } from "./providers/epicgames.js";
+export { Facebook } from "./providers/facebook.js";
+export { Figma } from "./providers/figma.js";
+export { Gitea } from "./providers/gitea.js";
+export { GitHub } from "./providers/github.js";
+export { GitLab } from "./providers/gitlab.js";
+export { Google } from "./providers/google.js";
+export { Intuit } from "./providers/intuit.js";
+export { Kakao } from "./providers/kakao.js";
+export { Kick } from "./providers/kick.js";
+export { KeyCloak } from "./providers/keycloak.js";
+export { Lichess } from "./providers/lichess.js";
+export { Line } from "./providers/line.js";
+export { Linear } from "./providers/linear.js";
+export { LinkedIn } from "./providers/linkedin.js";
+export { Mastodon } from "./providers/mastodon.js";
+export { MercadoLibre } from "./providers/mercadolibre.js";
+export { MercadoPago } from "./providers/mercadopago.js";
+export { MicrosoftEntraId } from "./providers/microsoft-entra-id.js";
+export { MyAnimeList } from "./providers/myanimelist.js";
+export { Naver } from "./providers/naver.js";
+export { Notion } from "./providers/notion.js";
+export { Okta } from "./providers/okta.js";
+export { Osu } from "./providers/osu.js";
+export { Patreon } from "./providers/patreon.js";
+export { Polar } from "./providers/polar.js";
+export { Reddit } from "./providers/reddit.js";
+export { Roblox } from "./providers/roblox.js";
+export { Salesforce } from "./providers/salesforce.js";
+export { Shikimori } from "./providers/shikimori.js";
+export { Slack } from "./providers/slack.js";
+export { Spotify } from "./providers/spotify.js";
+export { StartGG } from "./providers/startgg.js";
+export { Strava } from "./providers/strava.js";
+export { Synology } from "./providers/synology.js";
+export { TikTok } from "./providers/tiktok.js";
+export { Tiltify } from "./providers/tiltify.js";
+export { Tumblr } from "./providers/tumblr.js";
+export { Twitch } from "./providers/twitch.js";
+export { Twitter } from "./providers/twitter.js";
+export { VK } from "./providers/vk.js";
+export { Withings } from "./providers/withings.js";
+export { WorkOS } from "./providers/workos.js";
+export { Yahoo } from "./providers/yahoo.js";
+export { Yandex } from "./providers/yandex.js";
+export { Zoom } from "./providers/zoom.js";
+export { FortyTwo } from "./providers/42.js";
+export { OAuth2Client, CodeChallengeMethod } from "./client.js";
+export { OAuth2Tokens, generateCodeVerifier, generateState } from "./oauth2.js";
+export { OAuth2RequestError, ArcticFetchError, UnexpectedErrorResponseBodyError, UnexpectedResponseError } from "./request.js";
+export { decodeIdToken } from "./oidc.js";
+export { InvalidOAuthCallbackError, InvalidOAuthStateError, OAuthConfigurationError, OAuthProviderError } from "./auth.js";

package/dist/oauth2.d.ts

@@ -0,0 +1,16 @@
+export declare class OAuth2Tokens {
+    data: object;
+    constructor(data: object);
+    tokenType(): string;
+    accessToken(): string;
+    accessTokenExpiresInSeconds(): number;
+    accessTokenExpiresAt(): Date;
+    hasRefreshToken(): boolean;
+    refreshToken(): string;
+    hasScopes(): boolean;
+    scopes(): string[];
+    idToken(): string;
+}
+export declare function createS256CodeChallenge(codeVerifier: string): string;
+export declare function generateCodeVerifier(): string;
+export declare function generateState(): string;

package/dist/oauth2.js

@@ -0,0 +1,67 @@
+import * as encoding from "@oslojs/encoding";
+import * as sha2 from "@oslojs/crypto/sha2";
+export class OAuth2Tokens {
+    data;
+    constructor(data) {
+        this.data = data;
+    }
+    tokenType() {
+        if ("token_type" in this.data && typeof this.data.token_type === "string") {
+            return this.data.token_type;
+        }
+        throw new Error("Missing or invalid 'token_type' field");
+    }
+    accessToken() {
+        if ("access_token" in this.data && typeof this.data.access_token === "string") {
+            return this.data.access_token;
+        }
+        throw new Error("Missing or invalid 'access_token' field");
+    }
+    accessTokenExpiresInSeconds() {
+        if ("expires_in" in this.data && typeof this.data.expires_in === "number") {
+            return this.data.expires_in;
+        }
+        throw new Error("Missing or invalid 'expires_in' field");
+    }
+    accessTokenExpiresAt() {
+        return new Date(Date.now() + this.accessTokenExpiresInSeconds() * 1000);
+    }
+    hasRefreshToken() {
+        return "refresh_token" in this.data && typeof this.data.refresh_token === "string";
+    }
+    refreshToken() {
+        if ("refresh_token" in this.data && typeof this.data.refresh_token === "string") {
+            return this.data.refresh_token;
+        }
+        throw new Error("Missing or invalid 'refresh_token' field");
+    }
+    hasScopes() {
+        return "scope" in this.data && typeof this.data.scope === "string";
+    }
+    scopes() {
+        if ("scope" in this.data && typeof this.data.scope === "string") {
+            return this.data.scope.split(" ");
+        }
+        throw new Error("Missing or invalid 'scope' field");
+    }
+    idToken() {
+        if ("id_token" in this.data && typeof this.data.id_token === "string") {
+            return this.data.id_token;
+        }
+        throw new Error("Missing or invalid field 'id_token'");
+    }
+}
+export function createS256CodeChallenge(codeVerifier) {
+    const codeChallengeBytes = sha2.sha256(new TextEncoder().encode(codeVerifier));
+    return encoding.encodeBase64urlNoPadding(codeChallengeBytes);
+}
+export function generateCodeVerifier() {
+    const randomValues = new Uint8Array(32);
+    crypto.getRandomValues(randomValues);
+    return encoding.encodeBase64urlNoPadding(randomValues);
+}
+export function generateState() {
+    const randomValues = new Uint8Array(32);
+    crypto.getRandomValues(randomValues);
+    return encoding.encodeBase64urlNoPadding(randomValues);
+}

package/dist/oidc.d.ts

@@ -0,0 +1 @@
+export declare function decodeIdToken(idToken: string): object;

package/dist/oidc.js

@@ -0,0 +1,11 @@
+import * as jwt from "@oslojs/jwt";
+export function decodeIdToken(idToken) {
+    try {
+        return jwt.decodeJWT(idToken);
+    }
+    catch (e) {
+        throw new Error("Invalid ID token", {
+            cause: e
+        });
+    }
+}

package/dist/providers/42.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface FortyTwoOptions extends ProviderOptions {
+}
+export declare class FortyTwo {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: FortyTwoOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/42.js

@@ -0,0 +1,75 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://api.intra.42.fr/oauth/authorize";
+const tokenEndpoint = "https://api.intra.42.fr/oauth/token";
+const userEndpoint = "https://api.intra.42.fr/v2/me";
+const envPrefix = "FORTY_TWO";
+const defaultScopes = ["public"];
+export class FortyTwo {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        let image = null;
+        if (typeof profile.image === "object" && profile.image !== null) {
+            image = profileString(profile.image.link);
+        }
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.displayname) ?? profileString(profile.login),
+            email: profileString(profile.email),
+            image
+        };
+    }
+}

package/dist/providers/amazon-cognito.d.ts

@@ -0,0 +1,21 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface AmazonCognitoOptions extends ProviderOptions {
+    domain?: string;
+}
+export declare class AmazonCognito {
+    private authorizationEndpoint;
+    private tokenEndpoint;
+    private tokenRevocationEndpoint;
+    private userinfoEndpoint;
+    private client;
+    private auth;
+    constructor(options: AmazonCognitoOptions);
+    constructor(domain: string, clientId: string, clientSecret: string | null, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string, scopes: string[]): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/amazon-cognito.js

@@ -0,0 +1,76 @@
+import { CodeChallengeMethod, OAuth2Client } from "../client.js";
+import { decodeIdToken } from "../oidc.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const envPrefix = "AMAZON_COGNITO";
+const defaultScopes = ["openid", "profile", "email"];
+export class AmazonCognito {
+    authorizationEndpoint;
+    tokenEndpoint;
+    tokenRevocationEndpoint;
+    userinfoEndpoint;
+    client;
+    auth = null;
+    constructor(domainOrOptions, clientId, clientSecret, redirectURI) {
+        let domain;
+        if (typeof domainOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, domainOrOptions, { redirectURI: true });
+            domain = requireProviderOption(domainOrOptions.domain, envPrefix, "DOMAIN", "domain");
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            domain = domainOrOptions;
+            this.client = new OAuth2Client(clientId ?? "", clientSecret ?? null, redirectURI ?? null);
+        }
+        this.authorizationEndpoint = `https://${domain}/oauth2/authorize`;
+        this.tokenEndpoint = `https://${domain}/oauth2/token`;
+        this.tokenRevocationEndpoint = `https://${domain}/oauth2/revoke`;
+        this.userinfoEndpoint = `https://${domain}/oauth2/userInfo`;
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(this.authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(this.tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken, scopes) {
+        const tokens = await this.client.refreshAccessToken(this.tokenEndpoint, refreshToken, scopes);
+        return tokens;
+    }
+    async revokeToken(token) {
+        await this.client.revokeToken(this.tokenRevocationEndpoint, token);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        let claims;
+        if ("id_token" in tokens.data) {
+            claims = decodeIdToken(tokens.idToken());
+        }
+        else {
+            claims = await fetchUserProfile(this.userinfoEndpoint, tokens.accessToken());
+        }
+        return {
+            id: profileId(claims.sub),
+            name: profileString(claims.name) ??
+                profileString(claims["cognito:username"]) ??
+                profileString(claims.username),
+            email: profileString(claims.email),
+            image: profileString(claims.picture)
+        };
+    }
+}

package/dist/providers/anilist.d.ts

@@ -0,0 +1,14 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface AniListOptions extends ProviderOptions {
+}
+export declare class AniList {
+    private client;
+    private auth;
+    constructor(options: AniListOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/anilist.js

@@ -0,0 +1,91 @@
+import { OAuth2Client } from "../client.js";
+import { consumeOAuthState, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://anilist.co/api/v2/oauth/authorize";
+const tokenEndpoint = "https://anilist.co/api/v2/oauth/token";
+const graphqlEndpoint = "https://graphql.anilist.co";
+const envPrefix = "ANI_LIST";
+export class AniList {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state) {
+        const url = this.client.createAuthorizationURL(authorizationEndpoint, state, []);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, null);
+        return tokens;
+    }
+    async getAuthorizationURL() {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state);
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const viewer = await fetchViewer(tokens.accessToken());
+        let image = null;
+        if (typeof viewer.avatar === "object" && viewer.avatar !== null) {
+            image = profileString(viewer.avatar.large);
+        }
+        return {
+            id: profileId(viewer.id),
+            name: profileString(viewer.name),
+            email: null,
+            image
+        };
+    }
+}
+// AniList only exposes the authenticated user through its GraphQL API.
+async function fetchViewer(accessToken) {
+    let response;
+    try {
+        response = await fetch(graphqlEndpoint, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "Content-Type": "application/json",
+                Accept: "application/json",
+                "User-Agent": "arctic"
+            },
+            body: JSON.stringify({ query: "query { Viewer { id name avatar { large } } }" })
+        });
+    }
+    catch {
+        throw new OAuthProviderError("Failed to fetch user profile");
+    }
+    if (!response.ok) {
+        if (response.body !== null) {
+            await response.body.cancel();
+        }
+        throw new OAuthProviderError(`User profile request failed with status ${response.status}`);
+    }
+    let data;
+    try {
+        data = await response.json();
+    }
+    catch {
+        throw new OAuthProviderError("User profile response was not valid JSON");
+    }
+    const viewer = data?.data?.Viewer;
+    if (typeof viewer !== "object" || viewer === null) {
+        throw new OAuthProviderError("Unexpected user profile response body");
+    }
+    return viewer;
+}

package/dist/providers/apple.d.ts

@@ -0,0 +1,22 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface AppleOptions extends ProviderOptions {
+    teamId?: string;
+    keyId?: string;
+    pkcs8PrivateKey: Uint8Array;
+}
+export declare class Apple {
+    private clientId;
+    private teamId;
+    private keyId;
+    private pkcs8PrivateKey;
+    private redirectURI;
+    private auth;
+    constructor(options: AppleOptions);
+    constructor(clientId: string, teamId: string, keyId: string, pkcs8PrivateKey: Uint8Array, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    private createClientSecret;
+}

package/dist/providers/apple.js

@@ -0,0 +1,106 @@
+import * as jwt from "@oslojs/jwt";
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { decodeIdToken } from "../oidc.js";
+import { consumeOAuthState, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://appleid.apple.com/auth/authorize";
+const tokenEndpoint = "https://appleid.apple.com/auth/token";
+const envPrefix = "APPLE";
+const defaultScopes = ["email"];
+export class Apple {
+    clientId;
+    teamId;
+    keyId;
+    pkcs8PrivateKey;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, teamId, keyId, pkcs8PrivateKey, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { redirectURI: true });
+            this.clientId = this.auth.clientId;
+            this.teamId = requireProviderOption(clientIdOrOptions.teamId, envPrefix, "TEAM_ID", "teamId");
+            this.keyId = requireProviderOption(clientIdOrOptions.keyId, envPrefix, "KEY_ID", "keyId");
+            this.pkcs8PrivateKey = clientIdOrOptions.pkcs8PrivateKey;
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.teamId = teamId ?? "";
+            this.keyId = keyId ?? "";
+            this.pkcs8PrivateKey = pkcs8PrivateKey ?? new Uint8Array();
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        const clientSecret = await this.createClientSecret();
+        body.set("client_secret", clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const resolvedScopes = resolveScopes(scopes, auth, defaultScopes);
+        const url = this.createAuthorizationURL(state, resolvedScopes);
+        // Apple requires form_post whenever scopes are requested.
+        if (resolvedScopes.length > 0) {
+            url.searchParams.set("response_mode", "form_post");
+        }
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const claims = decodeIdToken(tokens.idToken());
+        return {
+            id: profileId(claims.sub),
+            name: null,
+            email: profileString(claims.email),
+            image: null
+        };
+    }
+    async createClientSecret() {
+        const privateKey = await crypto.subtle.importKey("pkcs8", this.pkcs8PrivateKey, {
+            name: "ECDSA",
+            namedCurve: "P-256"
+        }, false, ["sign"]);
+        const now = Math.floor(Date.now() / 1000);
+        const headerJSON = JSON.stringify({
+            typ: "JWT",
+            alg: "ES256",
+            kid: this.keyId
+        });
+        const payloadJSON = JSON.stringify({
+            iss: this.teamId,
+            exp: now + 5 * 60,
+            aud: ["https://appleid.apple.com"],
+            sub: this.clientId,
+            iat: now
+        });
+        const signature = new Uint8Array(await crypto.subtle.sign({
+            name: "ECDSA",
+            hash: "SHA-256"
+        }, privateKey, jwt.createJWTSignatureMessage(headerJSON, payloadJSON)));
+        const token = jwt.encodeJWT(headerJSON, payloadJSON, signature);
+        return token;
+    }
+}

package/dist/providers/atlassian.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface AtlassianOptions extends ProviderOptions {
+}
+export declare class Atlassian {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: AtlassianOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}