antarctic 0.5.0 → 0.7.0

package/README.md

@@ -0,0 +1,252 @@
+# Antarctic
+
+Antarctic is a fork of [Arctic](https://arcticjs.dev) by [pilcrowOnPaper](https://github.com/pilcrowOnPaper), adding a high level auth layer on top of its OAuth 2.0 clients. Only the authorization code flow is supported. Built on top of the Fetch API, it's light weight, fully-typed, and runtime-agnostic.
+
+Read the documentation at [antarcticjs.dev](https://antarcticjs.dev).
+
+All of the OAuth 2.0 clients and provider coverage are Arctic's work. If you only need those, use [Arctic](https://arcticjs.dev) directly. See [credits](#credits).
+
+```
+npm install antarctic
+```
+
+## High-level API
+
+Every provider except Synology has two methods that run the whole sign-in flow: `getAuthorizationURL()` starts it and `getUser()` finishes it in your callback route. Antarctic keeps nothing in between: you hold the `state` and `payload` from the first call, usually in a signed cookie, and pass them to the second.
+
+```ts
+import * as auth from "antarctic";
+
+const github = new auth.GitHub();
+
+// Login route
+const { url, state, payload } = await github.getAuthorizationURL();
+setCookie("oauth", JSON.stringify({ state, payload }), { httpOnly: true, maxAge: 600 });
+return Response.redirect(url);
+
+// Callback route
+const user = await github.getUser(request.url, JSON.parse(getCookie("oauth")));
+// { id: "1", name: "The Octocat", email: "octocat@github.com", image: "https://...", ... }
+```
+
+### Options
+
+```ts
+new auth.GitHub({ clientId, clientSecret, redirectURI, scopes });
+```
+
+Every option is optional. A missing one falls back to an environment variable named after the provider, then to the provider default:
+
+```
+GITHUB_CLIENT_ID
+GITHUB_CLIENT_SECRET
+GITHUB_REDIRECT_URI
+GITHUB_SCOPES
+```
+
+The environment is read when the provider is constructed, so load your `.env` file first. Some providers take extra options, such as Auth0's `domain` (`AUTH0_DOMAIN`). Apple always needs `{ pkcs8PrivateKey }`, which has no environment variable.
+
+### `getAuthorizationURL(scopes?)`
+
+Generates a fresh `state` and, where the provider uses PKCE, a code verifier. It returns:
+
+- `url`: where to redirect the user.
+- `state`: the CSRF token.
+- `payload`: whatever `getUser()` needs later, such as the PKCE verifier. Keep it as it is.
+
+### `getUser(query, { state, payload })`
+
+Takes the callback query (a full URL, a query string, a `URLSearchParams`, or a plain object) and the `state` and `payload` you kept. It checks your `state` against the one in the query, exchanges the code, fetches the profile, and returns the same shape for every provider:
+
+```ts
+{
+	(id, name, email, image, raw, accessToken, refreshToken, scopes);
+}
+```
+
+`name`, `email`, and `image` are `null` when the provider does not expose them. `raw` is the provider's own profile, for the fields this shape does not cover. `scopes` are the ones the provider actually granted, or `null` if it does not say.
+
+Delete the saved state once you read it, so it cannot be used twice.
+
+### Scopes
+
+Scopes are set per provider and can be overridden per login. From highest to lowest priority:
+
+1. The argument to `getAuthorizationURL(scopes)`, for that login only.
+2. The `scopes` option, for every login with that provider.
+3. `GITHUB_SCOPES`, separated by commas, whitespace, or both.
+4. The provider default, the minimal set that yields a full profile.
+
+```ts
+const github = new auth.GitHub({ scopes: ["read:user", "user:email"] });
+
+await github.getAuthorizationURL(); // read:user user:email
+await github.getAuthorizationURL(["read:user", "user:email", "repo"]); // this login only
+```
+
+An override replaces the list instead of adding to it, so repeat the scopes you still need. An empty array requests none. AniList, Bitbucket, MercadoLibre, MercadoPago, MyAnimeList, Naver, Notion, Shikimori, and WorkOS take their scopes from the app settings and ignore all of the above.
+
+### Errors
+
+- `OAuthConfigurationError`: a required option is missing from both the constructor and the environment, or a high-level method was called on a provider built with the positional constructor.
+- `InvalidOAuthCallbackError`: the callback query has no `code` or `state`, or the `payload` lacks a PKCE verifier the provider needs.
+- `InvalidOAuthStateError`: the saved `state` does not match the one in the callback query.
+- `OAuthProviderError`: the provider returned an error, or a profile that cannot be used. `error.code` holds its error code when it sent one.
+
+Sessions, cookies, and your user database remain your responsibility: take the returned user and plug it into your framework of choice. See the [documentation](https://antarcticjs.dev/high-level-api) for the details.
+
+## Low-level API
+
+Arctic's low level API remains available on the same objects, including the positional constructors. It is unchanged except that PKCE providers build the URL asynchronously, so `createAuthorizationURL()` returns a promise for them:
+
+```ts
+import * as arctic from "antarctic";
+
+const github = new arctic.GitHub(clientId, clientSecret, redirectURI);
+
+const state = arctic.generateState();
+const scopes = ["user:email"];
+const authorizationURL = github.createAuthorizationURL(state, scopes);
+
+// ...
+
+const tokens = await github.validateAuthorizationCode(code);
+const accessToken = tokens.accessToken();
+```
+
+See the [low-level API](https://antarcticjs.dev/low-level-api) docs for the full flow.
+
+> Antarctic only supports providers that follow the OAuth 2.0 spec (including PKCE and token revocation).
+
+## Compare to Arctic
+
+Arctic gives you the OAuth primitives and leaves the flow to you: generating the state and PKCE verifier, checking the callback, and fetching and mapping the profile for each provider. Antarctic does all of that in two calls and returns the same user shape for every provider. Here is Google, which uses PKCE, in Arctic:
+
+```ts
+import * as arctic from "arctic";
+// import * as arctic from "antarctic"; // Exactly the same for the low-level API
+
+const google = new arctic.Google(clientId, clientSecret, redirectURI);
+
+// Login route
+const state = arctic.generateState();
+const codeVerifier = arctic.generateCodeVerifier();
+const scopes = ["openid", "profile", "email"];
+const url = await google.createAuthorizationURL(state, codeVerifier, scopes);
+setCookie("state", state, { httpOnly: true, maxAge: 600 });
+setCookie("code_verifier", codeVerifier, { httpOnly: true, maxAge: 600 });
+return Response.redirect(url);
+
+// Callback route
+const params = new URL(request.url).searchParams;
+const code = params.get("code");
+if (code === null || params.get("state") !== getCookie("state")) {
+	throw new Error("Invalid request");
+}
+const tokens = await google.validateAuthorizationCode(code, getCookie("code_verifier"));
+const claims = arctic.decodeIdToken(tokens.idToken());
+// Map the claims to your own user shape, or fetch the profile for non-OIDC providers
+```
+
+And in Antarctic:
+
+```ts
+import * as auth from "antarctic";
+
+const google = new auth.Google();
+
+// Login route
+const { url, state, payload } = await google.getAuthorizationURL();
+setCookie("oauth", JSON.stringify({ state, payload }), { httpOnly: true, maxAge: 600 });
+return Response.redirect(url);
+
+// Callback route
+const user = await google.getUser(request.url, JSON.parse(getCookie("oauth")));
+// { id, name, email, image, raw, accessToken, refreshToken, scopes }
+```
+
+|                               | Arctic                | Antarctic                         |
+| ----------------------------- | --------------------- | --------------------------------- |
+| Credentials                   | Positional arguments  | Environment or options            |
+| State and PKCE verifier       | You generate them     | Generated for you                 |
+| Scopes                        | You pass them         | Per-provider default, overridable |
+| Callback query and CSRF check | You parse and compare | Done in `getUser()`               |
+| User profile                  | You fetch and map it  | Normalized user with the tokens   |
+
+## Credits
+
+Antarctic is a fork of [Arctic](https://github.com/pilcrowonpaper/arctic), created and maintained by [pilcrowOnPaper](https://github.com/pilcrowOnPaper). The OAuth 2.0 clients, the provider implementations, the docs those pages grew from, and the design that makes all of it consistent are their work. Antarctic adds one layer on top: `getAuthorizationURL()`, `getUser()`, and the option resolution around them.
+
+Arctic is MIT licensed. Antarctic keeps that license and the original copyright notice, and adds its own for the new work. See [LICENSE](./LICENSE).
+
+If you only need the OAuth 2.0 clients without the high level layer, use [Arctic](https://arcticjs.dev) directly. Please report provider issues that are not specific to Antarctic's additions upstream, where they benefit everyone.
+
+## Semver
+
+Antarctic does not strictly follow semantic versioning. While we aim to only introduce breaking changes in major versions, we may introduce them in a minor update if a provider updates their API in a non-backward compatible way. However, they will never be introduced in a patch update.
+
+## Supported providers
+
+- 42 School
+- Amazon Cognito
+- AniList
+- Apple
+- Atlassian
+- Auth0
+- Authentik
+- Autodesk Platform Services
+- Battle.net
+- Bitbucket
+- Box
+- Bungie
+- Coinbase
+- Discord
+- DonationAlerts
+- Dribbble
+- Dropbox
+- Etsy
+- Epic Games
+- Facebook
+- Figma
+- Gitea
+- GitHub
+- GitLab
+- Google
+- Intuit
+- Kakao
+- KeyCloak
+- Kick
+- Lichess
+- Line
+- Linear
+- LinkedIn
+- Mastodon
+- MercadoLibre
+- MercadoPago
+- Microsoft Entra ID
+- MyAnimeList
+- Naver
+- Notion
+- Okta
+- osu!
+- Patreon
+- Polar
+- Reddit
+- Roblox
+- Salesforce
+- Shikimori
+- Slack
+- Spotify
+- Start.gg
+- Strava
+- Synology
+- TikTok
+- Tiltify
+- Tumblr
+- Twitch
+- Twitter
+- VK
+- WorkOS
+- Yahoo
+- Yandex
+- Zoom

package/dist/auth.d.ts

@@ -1,23 +1,19 @@
+import type { OAuth2Tokens } from "./oauth2.js";
 export interface OAuthUser {
     id: string;
     name?: string | null;
     email?: string | null;
     image?: string | null;
     raw?: Record<string, unknown>;
-}
-export interface OAuthStateStore {
-    get: (key: string) => Promise<any>;
-    set: (key: string, value: any, options?: {
-        expires?: number | string;
-    }) => Promise<any>;
-    del: (key: string) => Promise<any>;
+    accessToken?: string;
+    refreshToken?: string | null;
+    scopes?: string[] | null;
 }
 export interface ProviderOptions {
     clientId?: string;
     clientSecret?: string;
     redirectURI?: string;
     scopes?: string[];
-    store: OAuthStateStore;
 }
 export declare class OAuthConfigurationError extends Error {
 }
@@ -35,7 +31,6 @@ export interface AuthConfig {
     clientSecret: string | null;
     redirectURI: string | null;
     scopes: string[] | null;
-    store: OAuthStateStore;
 }
 export declare function resolveProviderOption(explicit: string | undefined, envPrefix: string, envSuffix: string): string | null;
 export declare function requireProviderOption(explicit: string | undefined, envPrefix: string, envSuffix: string, optionName: string): string;
@@ -50,8 +45,21 @@ export interface StoredOAuthState {
     nonce?: string;
     scopes?: string[];
 }
-export declare function saveOAuthState(store: OAuthStateStore, state: string, payload: StoredOAuthState): Promise<void>;
-export declare function consumeOAuthState(store: OAuthStateStore, state: string): Promise<StoredOAuthState>;
+export interface AuthorizationRequest {
+    url: URL;
+    state: string;
+    payload: StoredOAuthState;
+}
+export interface SavedOAuthState {
+    state: string;
+    payload?: StoredOAuthState;
+}
+export declare function resolveOAuthState(state: string, saved: SavedOAuthState): StoredOAuthState;
+export declare function extractOAuthTokens(tokens: OAuth2Tokens): {
+    accessToken: string;
+    refreshToken: string | null;
+    scopes: string[] | null;
+};
 export type OAuthCallbackQuery = string | URL | URLSearchParams | Record<string, string | string[] | undefined | null>;
 export declare function parseCallbackQuery(query: OAuthCallbackQuery): {
     code: string;

package/dist/auth.js

@@ -5,7 +5,7 @@ export class InvalidOAuthCallbackError extends Error {
 }
 export class InvalidOAuthStateError extends Error {
     constructor() {
-        super("Unknown or expired OAuth state");
+        super("OAuth state does not match the saved state");
     }
 }
 export class OAuthProviderError extends Error {
@@ -57,39 +57,32 @@ export function resolveAuthConfig(envPrefix, options, requirements) {
             scopes = envScopes.split(/[\s,]+/).filter((scope) => scope !== "");
         }
     }
-    if (options.store === undefined) {
-        throw new OAuthConfigurationError("Missing 'store': pass a polystore-compatible store");
-    }
-    return {
-        clientId,
-        clientSecret,
-        redirectURI,
-        scopes,
-        store: options.store
-    };
+    return { clientId, clientSecret, redirectURI, scopes };
 }
 export function requireAuthConfig(auth) {
     if (auth === null) {
-        throw new OAuthConfigurationError("getAuthorizationURL() and getUser() require the options constructor with a 'store'");
+        throw new OAuthConfigurationError("getAuthorizationURL() and getUser() require the options constructor");
     }
     return auth;
 }
 export function resolveScopes(argument, auth, defaultScopes) {
     return argument ?? auth.scopes ?? defaultScopes;
 }
-const stateKeyPrefix = "arctic:state:";
-const stateExpiresSeconds = 60 * 10;
-export async function saveOAuthState(store, state, payload) {
-    await store.set(stateKeyPrefix + state, payload, { expires: stateExpiresSeconds });
-}
-export async function consumeOAuthState(store, state) {
-    const key = stateKeyPrefix + state;
-    const payload = await store.get(key);
-    if (typeof payload !== "object" || payload === null) {
+// Comparing the saved state against the one the provider echoed back is the CSRF check.
+export function resolveOAuthState(state, saved) {
+    if (saved?.state !== state) {
         throw new InvalidOAuthStateError();
     }
-    await store.del(key);
-    return payload;
+    return saved.payload ?? {};
+}
+// OAuth2Tokens throws on absent fields, and most providers omit the refresh
+// token and scopes unless they were asked for.
+export function extractOAuthTokens(tokens) {
+    return {
+        accessToken: tokens.accessToken(),
+        refreshToken: tokens.hasRefreshToken() ? tokens.refreshToken() : null,
+        scopes: tokens.hasScopes() ? tokens.scopes() : null
+    };
 }
 export function parseCallbackQuery(query) {
     let params;

package/dist/index.d.ts

@@ -67,4 +67,4 @@ export { OAuth2Tokens, generateCodeVerifier, generateState } from "./oauth2.js";
 export { OAuth2RequestError, ArcticFetchError, UnexpectedErrorResponseBodyError, UnexpectedResponseError } from "./request.js";
 export { decodeIdToken } from "./oidc.js";
 export { InvalidOAuthCallbackError, InvalidOAuthStateError, OAuthConfigurationError, OAuthProviderError } from "./auth.js";
-export type { OAuthCallbackQuery, OAuthStateStore, OAuthUser, ProviderOptions } from "./auth.js";
+export type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState, StoredOAuthState } from "./auth.js";

package/dist/providers/42.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface FortyTwoOptions extends ProviderOptions {
 }
 export declare class FortyTwo {
@@ -7,10 +7,10 @@ export declare class FortyTwo {
     private clientSecret;
     private redirectURI;
     private auth;
-    constructor(options: FortyTwoOptions);
+    constructor(options?: FortyTwoOptions);
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/42.js

@@ -1,5 +1,5 @@
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const authorizationEndpoint = "https://api.intra.42.fr/oauth/authorize";
 const tokenEndpoint = "https://api.intra.42.fr/oauth/token";
 const userEndpoint = "https://api.intra.42.fr/v2/me";
@@ -10,7 +10,7 @@ export class FortyTwo {
     clientSecret;
     redirectURI;
     auth = null;
-    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+    constructor(clientIdOrOptions = {}, clientSecret, redirectURI) {
         if (typeof clientIdOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
                 clientSecret: true,
@@ -52,13 +52,13 @@ export class FortyTwo {
         const auth = requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        resolveOAuthState(state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const profile = await fetchUserProfile(userEndpoint, tokens.accessToken());
         let image = null;
@@ -70,7 +70,8 @@ export class FortyTwo {
             name: profileString(profile.displayname) ?? profileString(profile.login),
             email: profileString(profile.email),
             image,
-            raw: profile
+            raw: profile,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/amazon-cognito.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AmazonCognitoOptions extends ProviderOptions {
     domain?: string;
 }
@@ -10,12 +10,12 @@ export declare class AmazonCognito {
     private userinfoEndpoint;
     private client;
     private auth;
-    constructor(options: AmazonCognitoOptions);
+    constructor(options?: AmazonCognitoOptions);
     constructor(domain: string, clientId: string, clientSecret: string | null, redirectURI: string);
     createAuthorizationURL(state: string, codeVerifier: string, scopes: string[]): Promise<URL>;
     validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string, scopes: string[]): Promise<OAuth2Tokens>;
     revokeToken(token: string): Promise<void>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/amazon-cognito.js

@@ -1,6 +1,6 @@
 import { CodeChallengeMethod, OAuth2Client } from "../client.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, fetchUserProfile, generateOAuthCodeVerifier, generateOAuthState, InvalidOAuthCallbackError, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const envPrefix = "AMAZON_COGNITO";
 const defaultScopes = ["openid", "profile", "email"];
 export class AmazonCognito {
@@ -10,7 +10,7 @@ export class AmazonCognito {
     userinfoEndpoint;
     client;
     auth = null;
-    constructor(domainOrOptions, clientId, clientSecret, redirectURI) {
+    constructor(domainOrOptions = {}, clientId, clientSecret, redirectURI) {
         let domain;
         if (typeof domainOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, domainOrOptions, { redirectURI: true });
@@ -46,13 +46,13 @@ export class AmazonCognito {
         const state = generateOAuthState();
         const codeVerifier = generateOAuthCodeVerifier();
         const url = await this.createAuthorizationURL(state, codeVerifier, resolveScopes(scopes, auth, defaultScopes));
-        await saveOAuthState(auth.store, state, { codeVerifier });
-        return url;
+        const payload = { codeVerifier };
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        const stored = await consumeOAuthState(auth.store, state);
+        const stored = resolveOAuthState(state, saved);
         if (typeof stored.codeVerifier !== "string") {
             throw new InvalidOAuthCallbackError("Missing PKCE code verifier for OAuth state");
         }
@@ -71,7 +71,8 @@ export class AmazonCognito {
                 profileString(claims.username),
             email: profileString(claims.email),
             image: profileString(claims.picture),
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/anilist.d.ts

@@ -1,14 +1,14 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AniListOptions extends ProviderOptions {
 }
 export declare class AniList {
     private client;
     private auth;
-    constructor(options: AniListOptions);
+    constructor(options?: AniListOptions);
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }

package/dist/providers/anilist.js

@@ -1,5 +1,5 @@
 import { OAuth2Client } from "../client.js";
-import { consumeOAuthState, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, generateOAuthState, OAuthProviderError, parseCallbackQuery, profileId, profileString, requireAuthConfig, resolveAuthConfig, resolveOAuthState } from "../auth.js";
 const authorizationEndpoint = "https://anilist.co/api/v2/oauth/authorize";
 const tokenEndpoint = "https://anilist.co/api/v2/oauth/token";
 const graphqlEndpoint = "https://graphql.anilist.co";
@@ -7,7 +7,7 @@ const envPrefix = "ANI_LIST";
 export class AniList {
     client;
     auth = null;
-    constructor(clientIdOrOptions, clientSecret, redirectURI) {
+    constructor(clientIdOrOptions = {}, clientSecret, redirectURI) {
         if (typeof clientIdOrOptions === "object") {
             this.auth = resolveAuthConfig(envPrefix, clientIdOrOptions, {
                 clientSecret: true,
@@ -28,16 +28,16 @@ export class AniList {
         return tokens;
     }
     async getAuthorizationURL() {
-        const auth = requireAuthConfig(this.auth);
+        requireAuthConfig(this.auth);
         const state = generateOAuthState();
         const url = this.createAuthorizationURL(state);
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        resolveOAuthState(state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const viewer = await fetchViewer(tokens.accessToken());
         let image = null;
@@ -49,7 +49,8 @@ export class AniList {
             name: profileString(viewer.name),
             email: null,
             image,
-            raw: viewer
+            raw: viewer,
+            ...extractOAuthTokens(tokens)
         };
     }
 }

package/dist/providers/apple.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AppleOptions extends ProviderOptions {
     teamId?: string;
     keyId?: string;
@@ -16,7 +16,7 @@ export declare class Apple {
     constructor(clientId: string, teamId: string, keyId: string, pkcs8PrivateKey: Uint8Array, redirectURI: string);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
     private createClientSecret;
 }

package/dist/providers/apple.js

@@ -1,7 +1,7 @@
 import { createJWTSignatureMessage, encodeJWT } from "../jwt.js";
 import { createOAuth2Request, sendTokenRequest } from "../request.js";
 import { decodeIdToken } from "../oidc.js";
-import { consumeOAuthState, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveScopes, saveOAuthState } from "../auth.js";
+import { extractOAuthTokens, generateOAuthState, parseCallbackQuery, profileId, profileString, requireAuthConfig, requireProviderOption, resolveAuthConfig, resolveOAuthState, resolveScopes } from "../auth.js";
 const authorizationEndpoint = "https://appleid.apple.com/auth/authorize";
 const tokenEndpoint = "https://appleid.apple.com/auth/token";
 const envPrefix = "APPLE";
@@ -62,13 +62,13 @@ export class Apple {
         if (resolvedScopes.length > 0) {
             url.searchParams.set("response_mode", "form_post");
         }
-        await saveOAuthState(auth.store, state, {});
-        return url;
+        const payload = {};
+        return { url, state, payload };
     }
-    async getUser(query) {
-        const auth = requireAuthConfig(this.auth);
+    async getUser(query, saved) {
+        requireAuthConfig(this.auth);
         const { code, state } = parseCallbackQuery(query);
-        await consumeOAuthState(auth.store, state);
+        resolveOAuthState(state, saved);
         const tokens = await this.validateAuthorizationCode(code);
         const claims = decodeIdToken(tokens.idToken());
         return {
@@ -76,7 +76,8 @@ export class Apple {
             name: null,
             email: profileString(claims.email),
             image: null,
-            raw: claims
+            raw: claims,
+            ...extractOAuthTokens(tokens)
         };
     }
     async createClientSecret() {

package/dist/providers/atlassian.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2Tokens } from "../oauth2.js";
-import type { OAuthCallbackQuery, OAuthUser, ProviderOptions } from "../auth.js";
+import type { AuthorizationRequest, OAuthCallbackQuery, OAuthUser, ProviderOptions, SavedOAuthState } from "../auth.js";
 export interface AtlassianOptions extends ProviderOptions {
 }
 export declare class Atlassian {
@@ -7,11 +7,11 @@ export declare class Atlassian {
     private clientSecret;
     private redirectURI;
     private auth;
-    constructor(options: AtlassianOptions);
+    constructor(options?: AtlassianOptions);
     constructor(clientId: string, clientSecret: string, redirectURI: string);
     createAuthorizationURL(state: string, scopes: string[]): URL;
     validateAuthorizationCode(code: string): Promise<OAuth2Tokens>;
     refreshAccessToken(refreshToken: string): Promise<OAuth2Tokens>;
-    getAuthorizationURL(scopes?: string[]): Promise<URL>;
-    getUser(query: OAuthCallbackQuery): Promise<OAuthUser>;
+    getAuthorizationURL(scopes?: string[]): Promise<AuthorizationRequest>;
+    getUser(query: OAuthCallbackQuery, saved: SavedOAuthState): Promise<OAuthUser>;
 }