antarctic 0.2.0

package/dist/providers/line.js

@@ -0,0 +1,98 @@
+import { createS256CodeChallenge } from "../oauth2.js";
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { decodeIdToken } from "../oidc.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://access.line.me/oauth2/v2.1/authorize";
+const tokenEndpoint = "https://api.line.me/oauth2/v2.1/token";
+const userinfoEndpoint = "https://api.line.me/oauth2/v2.1/userinfo";
+const envPrefix = "LINE";
+const defaultScopes = ["openid", "profile", "email"];
+export class Line {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        const codeChallenge = createS256CodeChallenge(codeVerifier);
+        url.searchParams.set("code_challenge_method", "S256");
+        url.searchParams.set("code_challenge", codeChallenge);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("code_verifier", codeVerifier);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        let claims;
+        if ("id_token" in tokens.data) {
+            claims = decodeIdToken(tokens.idToken());
+        }
+        else {
+            // The userinfo endpoint never includes email; only the id_token does.
+            claims = await fetchUserProfile(userinfoEndpoint, tokens.accessToken());
+        }
+        return {
+            id: profileId(claims.sub),
+            name: profileString(claims.name),
+            email: profileString(claims.email),
+            image: profileString(claims.picture)
+        };
+    }
+}

package/dist/providers/linear.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface LinearOptions extends ProviderOptions {
+}
+export declare class Linear {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: LinearOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/linear.js

@@ -0,0 +1,112 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://linear.app/oauth/authorize";
+const tokenEndpoint = "https://api.linear.app/oauth/token";
+const graphqlEndpoint = "https://api.linear.app/graphql";
+const envPrefix = "LINEAR";
+const defaultScopes = ["read"];
+export class Linear {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const viewer = await fetchViewer(tokens.accessToken());
+        return {
+            id: profileId(viewer.id),
+            name: profileString(viewer.name),
+            email: profileString(viewer.email),
+            image: profileString(viewer.avatarUrl)
+        };
+    }
+}
+async function fetchViewer(accessToken) {
+    let response;
+    try {
+        response = await fetch(graphqlEndpoint, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "Content-Type": "application/json"
+            },
+            body: JSON.stringify({ query: "{ viewer { id name email avatarUrl } }" })
+        });
+    }
+    catch {
+        throw new OAuthProviderError("Failed to fetch user profile");
+    }
+    if (!response.ok) {
+        if (response.body !== null) {
+            await response.body.cancel();
+        }
+        throw new OAuthProviderError(`User profile request failed with status ${response.status}`);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw new OAuthProviderError("User profile response was not valid JSON");
+    }
+    if (typeof body !== "object" || body === null) {
+        throw new OAuthProviderError("Unexpected user profile response body");
+    }
+    const data = body.data;
+    if (typeof data !== "object" || data === null) {
+        throw new OAuthProviderError("Unexpected user profile response body");
+    }
+    const viewer = data.viewer;
+    if (typeof viewer !== "object" || viewer === null) {
+        throw new OAuthProviderError("Unexpected user profile response body");
+    }
+    return viewer;
+}

package/dist/providers/linkedin.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface LinkedInOptions extends ProviderOptions {
+}
+export declare class LinkedIn {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: LinkedInOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/linkedin.js

@@ -0,0 +1,89 @@
+// LinkedIn doesn't seem to support HTTP Basic Auth
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { decodeIdToken } from "../oidc.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://www.linkedin.com/oauth/v2/authorization";
+const tokenEndpoint = "https://www.linkedin.com/oauth/v2/accessToken";
+const userinfoEndpoint = "https://api.linkedin.com/v2/userinfo";
+const envPrefix = "LINKEDIN";
+const defaultScopes = ["openid", "profile", "email"];
+export class LinkedIn {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        let claims;
+        if ("id_token" in tokens.data) {
+            claims = decodeIdToken(tokens.idToken());
+        }
+        else {
+            claims = await fetchUserProfile(userinfoEndpoint, tokens.accessToken());
+        }
+        return {
+            id: profileId(claims.sub),
+            name: profileString(claims.name),
+            email: profileString(claims.email),
+            image: profileString(claims.picture)
+        };
+    }
+}

package/dist/providers/mastodon.d.ts

@@ -0,0 +1,20 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface MastodonOptions extends ProviderOptions {
+    baseURL?: string;
+}
+export declare class Mastodon {
+    private authorizationEndpoint;
+    private tokenEndpoint;
+    private tokenRevocationEndpoint;
+    private userEndpoint;
+    private client;
+    private auth;
+    constructor(options: MastodonOptions);
+    constructor(baseURL: string, clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/mastodon.js

@@ -0,0 +1,67 @@
+import { OAuth2Client, CodeChallengeMethod } from "../client.js";
+import { joinURIAndPath } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const envPrefix = "MASTODON";
+const defaultScopes = ["read:accounts"];
+export class Mastodon {
+    authorizationEndpoint;
+    tokenEndpoint;
+    tokenRevocationEndpoint;
+    userEndpoint;
+    client;
+    auth = null;
+    constructor(baseURLOrOptions, clientId, clientSecret, redirectURI) {
+        let baseURL;
+        if (typeof baseURLOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, baseURLOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            baseURL = requireProviderOption(baseURLOrOptions.baseURL, envPrefix, "BASE_URL", "baseURL");
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            baseURL = baseURLOrOptions;
+            this.client = new OAuth2Client(clientId ?? "", clientSecret ?? null, redirectURI ?? null);
+        }
+        this.authorizationEndpoint = joinURIAndPath(baseURL, "/api/v1/oauth/authorize");
+        this.tokenEndpoint = joinURIAndPath(baseURL, "/api/v1/oauth/token");
+        this.tokenRevocationEndpoint = joinURIAndPath(baseURL, "/api/v1/oauth/revoke");
+        this.userEndpoint = joinURIAndPath(baseURL, "/api/v1/accounts/verify_credentials");
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(this.authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(this.tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async revokeToken(token) {
+        await this.client.revokeToken(this.tokenRevocationEndpoint, token);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const profile = await fetchUserProfile(this.userEndpoint, tokens.accessToken());
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.display_name) ?? profileString(profile.username),
+            email: null,
+            image: profileString(profile.avatar)
+        };
+    }
+}

package/dist/providers/mercadolibre.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface MercadoLibreOptions extends ProviderOptions {
+}
+export declare class MercadoLibre {
+    clientId: string;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: MercadoLibreOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(_scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/mercadolibre.js

@@ -0,0 +1,95 @@
+import { createS256CodeChallenge } from "../oauth2.js";
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://auth.mercadolibre.com/authorization";
+const tokenEndpoint = "https://api.mercadolibre.com/oauth/token";
+const userEndpoint = "https://api.mercadolibre.com/users/me";
+const envPrefix = "MERCADO_LIBRE";
+export class MercadoLibre {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    // `scopes` not required since they are defined in the application settings
+    createAuthorizationURL(state, codeVerifier) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        url.searchParams.set("state", state);
+        const codeChallenge = createS256CodeChallenge(codeVerifier);
+        url.searchParams.set("code_challenge_method", "S256");
+        url.searchParams.set("code_challenge", codeChallenge);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("code_verifier", codeVerifier);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    // Scopes are defined in the application settings, so the argument is ignored.
+    async getAuthorizationURL(_scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier);
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        const firstName = profileString(profile.first_name);
+        const lastName = profileString(profile.last_name);
+        const fullName = [firstName, lastName].filter((part) => part !== null).join(" ");
+        let image = null;
+        if (typeof profile.thumbnail === "object" && profile.thumbnail !== null) {
+            image = profileString(profile.thumbnail.picture_url);
+        }
+        return {
+            id: profileId(profile.id),
+            name: fullName !== "" ? fullName : profileString(profile.nickname),
+            email: profileString(profile.email),
+            image
+        };
+    }
+}

package/dist/providers/mercadopago.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface MercadoPagoOptions extends ProviderOptions {
+}
+export declare class MercadoPago {
+    clientId: string;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: MercadoPagoOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(_scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/mercadopago.js

@@ -0,0 +1,95 @@
+import { createS256CodeChallenge } from "../oauth2.js";
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://auth.mercadopago.com/authorization";
+const tokenEndpoint = "https://api.mercadopago.com/oauth/token";
+const userEndpoint = "https://api.mercadopago.com/users/me";
+const envPrefix = "MERCADO_PAGO";
+export class MercadoPago {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    // `scopes` not required since they are defined in the application settings
+    createAuthorizationURL(state, codeVerifier) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        url.searchParams.set("state", state);
+        const codeChallenge = createS256CodeChallenge(codeVerifier);
+        url.searchParams.set("code_challenge_method", "S256");
+        url.searchParams.set("code_challenge", codeChallenge);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("code_verifier", codeVerifier);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    // Scopes are defined in the application settings, so the argument is ignored.
+    async getAuthorizationURL(_scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier);
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        const firstName = profileString(profile.first_name);
+        const lastName = profileString(profile.last_name);
+        const fullName = [firstName, lastName].filter((part) => part !== null).join(" ");
+        let image = null;
+        if (typeof profile.thumbnail === "object" && profile.thumbnail !== null) {
+            image = profileString(profile.thumbnail.picture_url);
+        }
+        return {
+            id: profileId(profile.id),
+            name: fullName !== "" ? fullName : profileString(profile.nickname),
+            email: profileString(profile.email),
+            image
+        };
+    }
+}