antarctic 0.2.0

package/dist/providers/microsoft-entra-id.d.ts

@@ -0,0 +1,20 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface MicrosoftEntraIdOptions extends ProviderOptions {
+    tenant?: string;
+}
+export declare class MicrosoftEntraId {
+    private authorizationEndpoint;
+    private tokenEndpoint;
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: MicrosoftEntraIdOptions);
+    constructor(tenant: string, clientId: string, clientSecret: string | null, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string, scopes: string[]): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/microsoft-entra-id.js

@@ -0,0 +1,120 @@
+import { createS256CodeChallenge } from "../oauth2.js";
+import { createOAuth2Request, encodeBasicCredentials, joinURIAndPath, sendTokenRequest } from "../request.js";
+import { decodeIdToken } from "../oidc.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const userinfoEndpoint = "https://graph.microsoft.com/oidc/userinfo";
+const envPrefix = "MICROSOFT_ENTRA_ID";
+const defaultScopes = ["openid", "profile", "email"];
+export class MicrosoftEntraId {
+    authorizationEndpoint;
+    tokenEndpoint;
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(tenantOrOptions, clientId, clientSecret, redirectURI) {
+        let tenant;
+        if (typeof tenantOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, tenantOrOptions, { redirectURI: true });
+            tenant = requireProviderOption(tenantOrOptions.tenant, envPrefix, "TENANT", "tenant");
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret;
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            tenant = tenantOrOptions;
+            this.clientId = clientId ?? "";
+            this.clientSecret = clientSecret ?? null;
+            this.redirectURI = redirectURI ?? "";
+        }
+        this.authorizationEndpoint = joinURIAndPath("https://login.microsoftonline.com", tenant, "/oauth2/v2.0/authorize");
+        this.tokenEndpoint = joinURIAndPath("https://login.microsoftonline.com", tenant, "/oauth2/v2.0/token");
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = new URL(this.authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        url.searchParams.set("state", state);
+        const codeChallenge = createS256CodeChallenge(codeVerifier);
+        url.searchParams.set("code_challenge_method", "S256");
+        url.searchParams.set("code_challenge", codeChallenge);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        body.set("code_verifier", codeVerifier);
+        if (this.clientSecret === null) {
+            body.set("client_id", this.clientId);
+        }
+        const request = createOAuth2Request(this.tokenEndpoint, body);
+        if (this.clientSecret !== null) {
+            const encodedCredentials = encodeBasicCredentials(this.clientId, this.clientSecret);
+            request.headers.set("Authorization", `Basic ${encodedCredentials}`);
+        }
+        else {
+            // Origin header required for public clients. Value can be anything.
+            request.headers.set("Origin", "arctic");
+        }
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken, scopes) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        if (this.clientSecret === null) {
+            body.set("client_id", this.clientId);
+        }
+        if (scopes.length > 0) {
+            body.set("scope", scopes.join(" "));
+        }
+        const request = createOAuth2Request(this.tokenEndpoint, body);
+        if (this.clientSecret !== null) {
+            const encodedCredentials = encodeBasicCredentials(this.clientId, this.clientSecret);
+            request.headers.set("Authorization", `Basic ${encodedCredentials}`);
+        }
+        else {
+            // Origin header required for public clients. Value can be anything.
+            request.headers.set("Origin", "arctic");
+        }
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        let claims;
+        if ("id_token" in tokens.data) {
+            claims = decodeIdToken(tokens.idToken());
+        }
+        else {
+            claims = await fetchUserProfile(userinfoEndpoint, tokens.accessToken());
+        }
+        return {
+            id: profileId(claims.sub),
+            name: profileString(claims.name),
+            email: profileString(claims.email) ?? profileString(claims.preferred_username),
+            image: profileString(claims.picture)
+        };
+    }
+}

package/dist/providers/myanimelist.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface MyAnimeListOptions extends ProviderOptions {
+}
+export declare class MyAnimeList {
+    private client;
+    private auth;
+    constructor(options: MyAnimeListOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string | null);
+    createAuthorizationURL(state: string, codeVerifier: string): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(_scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/myanimelist.js

@@ -0,0 +1,56 @@
+import { OAuth2Client, CodeChallengeMethod } from "../client.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://myanimelist.net/v1/oauth2/authorize";
+const tokenEndpoint = "https://myanimelist.net/v1/oauth2/token";
+const userEndpoint = "https://api.myanimelist.net/v2/users/@me";
+const envPrefix = "MY_ANIME_LIST";
+export class MyAnimeList {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { clientSecret: true });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state, codeVerifier) {
+        const url = this.client.createAuthorizationURLWithPKCE(authorizationEndpoint, state, CodeChallengeMethod.Plain, codeVerifier, []);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const tokens = await this.client.refreshAccessToken(tokenEndpoint, refreshToken, []);
+        return tokens;
+    }
+    // MyAnimeList does not use scopes, so the argument is ignored.
+    async getAuthorizationURL(_scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier);
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.name),
+            email: null,
+            image: profileString(profile.picture)
+        };
+    }
+}

package/dist/providers/naver.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface NaverOptions extends ProviderOptions {
+}
+export declare class Naver {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: NaverOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(_scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/naver.js

@@ -0,0 +1,83 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://nid.naver.com/oauth2.0/authorize";
+const tokenEndpoint = "https://nid.naver.com/oauth2.0/token";
+const userEndpoint = "https://openapi.naver.com/v1/nid/me";
+const envPrefix = "NAVER";
+export class Naver {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI ?? "";
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? "";
+        }
+    }
+    createAuthorizationURL() {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("redirect_uri", this.redirectURI);
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        body.set("code", code);
+        body.set("redirect_uri", this.redirectURI);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        body.set("refresh_token", refreshToken);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    // Naver scopes are configured in the application settings, so the argument is ignored.
+    async getAuthorizationURL(_scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL();
+        url.searchParams.set("state", state);
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        const response = profile.response;
+        if (typeof response !== "object" || response === null) {
+            throw new OAuthProviderError("Unexpected user profile response body");
+        }
+        const user = response;
+        return {
+            id: profileId(user.id),
+            name: profileString(user.name) ?? profileString(user.nickname),
+            email: profileString(user.email),
+            image: profileString(user.profile_image)
+        };
+    }
+}

package/dist/providers/notion.d.ts

@@ -0,0 +1,14 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface NotionOptions extends ProviderOptions {
+}
+export declare class Notion {
+    private client;
+    private auth;
+    constructor(options: NotionOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(_scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/notion.js

@@ -0,0 +1,65 @@
+import { OAuth2Client } from "../client.js";
+import { consumeOAuthState, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://api.notion.com/v1/oauth/authorize";
+const tokenEndpoint = "https://api.notion.com/v1/oauth/token";
+const envPrefix = "NOTION";
+export class Notion {
+    client;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            this.client = new OAuth2Client(clientIdOrOptions, clientSecret ?? null, redirectURI ?? null);
+        }
+    }
+    createAuthorizationURL(state) {
+        const url = this.client.createAuthorizationURL(authorizationEndpoint, state, []);
+        url.searchParams.set("owner", "user");
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const tokens = await this.client.validateAuthorizationCode(tokenEndpoint, code, null);
+        return tokens;
+    }
+    // Notion does not use scopes, so the argument is ignored.
+    async getAuthorizationURL(_scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state);
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        // Notion returns the authorizing user inside the token response.
+        const data = tokens.data;
+        const owner = data.owner;
+        if (typeof owner !== "object" || owner === null) {
+            throw new OAuthProviderError("Notion token response is missing the owner");
+        }
+        const user = owner.user;
+        if (typeof user !== "object" || user === null) {
+            throw new OAuthProviderError("Notion token response is missing the user");
+        }
+        const profile = user;
+        let email = null;
+        if (typeof profile.person === "object" && profile.person !== null) {
+            email = profileString(profile.person.email);
+        }
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.name),
+            email,
+            image: profileString(profile.avatar_url)
+        };
+    }
+}

package/dist/providers/okta.d.ts

@@ -0,0 +1,22 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface OktaOptions extends ProviderOptions {
+    domain?: string;
+    authorizationServerId?: string;
+}
+export declare class Okta {
+    private authorizationEndpoint;
+    private tokenEndpoint;
+    private tokenRevocationEndpoint;
+    private userinfoEndpoint;
+    private client;
+    private auth;
+    constructor(options: OktaOptions);
+    constructor(domain: string, authorizationServerId: string | null, clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string, scopes: string[]): Promise<OAuth2Tokens>;
+    revokeToken(token: string): Promise<void>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/okta.js

@@ -0,0 +1,85 @@
+import { CodeChallengeMethod, OAuth2Client } from "../client.js";
+import { decodeIdToken } from "../oidc.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveProviderOption, resolveScopes, saveOAuthState } from "../auth.js";
+import { joinURIAndPath } from "../request.js";
+const envPrefix = "OKTA";
+const defaultScopes = ["openid", "profile", "email"];
+export class Okta {
+    authorizationEndpoint;
+    tokenEndpoint;
+    tokenRevocationEndpoint;
+    userinfoEndpoint;
+    client;
+    auth = null;
+    constructor(domainOrOptions, authorizationServerId, clientId, clientSecret, redirectURI) {
+        let domain;
+        let serverId;
+        if (typeof domainOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, domainOrOptions, {
+                clientSecret: true,
+                redirectURI: true
+            });
+            domain = requireProviderOption(domainOrOptions.domain, envPrefix, "DOMAIN", "domain");
+            serverId = resolveProviderOption(domainOrOptions.authorizationServerId, envPrefix, "AUTHORIZATION_SERVER_ID");
+            this.client = new OAuth2Client(this.auth.clientId, this.auth.clientSecret, this.auth.redirectURI);
+        }
+        else {
+            domain = domainOrOptions;
+            serverId = authorizationServerId ?? null;
+            this.client = new OAuth2Client(clientId ?? "", clientSecret ?? null, redirectURI ?? null);
+        }
+        let baseURL = `https://${domain}/oauth2`;
+        if (serverId !== null) {
+            baseURL = joinURIAndPath(baseURL, serverId);
+        }
+        this.authorizationEndpoint = joinURIAndPath(baseURL, "/v1/authorize");
+        this.tokenEndpoint = joinURIAndPath(baseURL, "/v1/token");
+        this.tokenRevocationEndpoint = joinURIAndPath(baseURL, "/v1/revoke");
+        this.userinfoEndpoint = joinURIAndPath(baseURL, "/v1/userinfo");
+    }
+    createAuthorizationURL(state, codeVerifier, scopes) {
+        const url = this.client.createAuthorizationURLWithPKCE(this.authorizationEndpoint, state, CodeChallengeMethod.S256, codeVerifier, scopes);
+        return url;
+    }
+    async validateAuthorizationCode(code, codeVerifier) {
+        const tokens = await this.client.validateAuthorizationCode(this.tokenEndpoint, code, codeVerifier);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken, scopes) {
+        const tokens = await this.client.refreshAccessToken(this.tokenEndpoint, refreshToken, scopes);
+        return tokens;
+    }
+    async revokeToken(token) {
+        await this.client.revokeToken(this.tokenRevocationEndpoint, token);
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const codeVerifier = generateOAuthCodeVerifier();
+        const url = this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, { codeVerifier });
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        const stored = await consumeOAuthState(auth.store, state);
+        if (typeof stored.codeVerifier !== "string") {
+            throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
+        }
+        const tokens = await this.validateAuthorizationCode(code, stored.codeVerifier);
+        let claims;
+        if ("id_token" in tokens.data) {
+            claims = decodeIdToken(tokens.idToken());
+        }
+        else {
+            claims = await fetchUserProfile(this.userinfoEndpoint, tokens.accessToken());
+        }
+        return {
+            id: profileId(claims.sub),
+            name: profileString(claims.name),
+            email: profileString(claims.email),
+            image: profileString(claims.picture)
+        };
+    }
+}

package/dist/providers/osu.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface OsuOptions extends ProviderOptions {
+}
+export declare class Osu {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: OsuOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string | null);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}

package/dist/providers/osu.js

@@ -0,0 +1,82 @@
+import { createOAuth2Request, sendTokenRequest } from "../request.js";
+import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+const authorizationEndpoint = "https://osu.ppy.sh/oauth/authorize";
+const tokenEndpoint = "https://osu.ppy.sh/oauth/token";
+const userEndpoint = "https://osu.ppy.sh/api/v2/me";
+const envPrefix = "OSU";
+const defaultScopes = ["identify"];
+export class Osu {
+    clientId;
+    clientSecret;
+    redirectURI;
+    auth = null;
+    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+        if (typeof clientIdOrOptions === "object") {
+            this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, { clientSecret: true });
+            this.clientId = this.auth.clientId;
+            this.clientSecret = this.auth.clientSecret ?? "";
+            this.redirectURI = this.auth.redirectURI;
+        }
+        else {
+            this.clientId = clientIdOrOptions;
+            this.clientSecret = clientSecret ?? "";
+            this.redirectURI = redirectURI ?? null;
+        }
+    }
+    createAuthorizationURL(state, scopes) {
+        const url = new URL(authorizationEndpoint);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        url.searchParams.set("state", state);
+        if (scopes.length > 0) {
+            url.searchParams.set("scope", scopes.join(" "));
+        }
+        if (this.redirectURI !== null) {
+            url.searchParams.set("redirect_uri", this.redirectURI);
+        }
+        return url;
+    }
+    async validateAuthorizationCode(code) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "authorization_code");
+        body.set("code", code);
+        if (this.redirectURI !== null) {
+            body.set("redirect_uri", this.redirectURI);
+        }
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", refreshToken);
+        body.set("client_id", this.clientId);
+        body.set("client_secret", this.clientSecret);
+        const request = createOAuth2Request(tokenEndpoint, body);
+        const tokens = await sendTokenRequest(request);
+        return tokens;
+    }
+    async getAuthorizationURL(scopes) {
+        const auth = requireAuthConfig(this.auth);
+        const state = generateOAuthState();
+        const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
+        await saveOAuthState(auth.store, state, {});
+        return url;
+    }
+    async getUser(query) {
+        const auth = requireAuthConfig(this.auth);
+        const { code, state } = parseCallbackQuery(query);
+        await consumeOAuthState(auth.store, state);
+        const tokens = await this.validateAuthorizationCode(code);
+        const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
+        return {
+            id: profileId(profile.id),
+            name: profileString(profile.username),
+            email: null,
+            image: profileString(profile.avatar_url)
+        };
+    }
+}

package/dist/providers/patreon.d.ts

@@ -0,0 +1,17 @@
+import type { OAuth2Tokens } from "../oauth2.js";
+import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+export interface PatreonOptions extends ProviderOptions {
+}
+export declare class Patreon {
+    private clientId;
+    private clientSecret;
+    private redirectURI;
+    private auth;
+    constructor(options: PatreonOptions);
+    constructor(clientId: string, clientSecret: string, redirectURI: string);
+    createAuthorizationURL(state: string, scopes: string[]): URL;
+    validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
+    refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
+    getAuthorizationURL(scopes?: string[]): Promise<URL>;
+    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+}