cauthy-auth 0.0.0-stage → 0.2.0

package/dist/index.js

@@ -0,0 +1,748 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  CauthyConfigError: () => CauthyConfigError,
+  CauthyWebhookError: () => CauthyWebhookError,
+  can: () => can,
+  createCauthy: () => createCauthy,
+  pushPolicy: () => pushPolicy,
+  pushTheme: () => pushTheme,
+  themeFromStackmyth: () => themeFromStackmyth,
+  verifyWebhook: () => verifyWebhook
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/cookies.ts
+var PART = 3500;
+function readCookies(header) {
+  const out2 = /* @__PURE__ */ new Map();
+  for (const pair of (header ?? "").split(";")) {
+    const i = pair.indexOf("=");
+    if (i > 0) out2.set(pair.slice(0, i).trim(), pair.slice(i + 1).trim());
+  }
+  return out2;
+}
+function readParts(cookies, name) {
+  let value = "";
+  for (let i = 0; cookies.has(`${name}.${i}`); i++) value += cookies.get(`${name}.${i}`);
+  return value === "" ? null : value;
+}
+function attributes(a) {
+  return `Path=${a.path ?? "/"}; HttpOnly; SameSite=Lax; Max-Age=${a.maxAge}${a.secure ? "; Secure" : ""}`;
+}
+function writeCookie(name, value, a) {
+  return `${name}=${value}; ${attributes(a)}`;
+}
+function writeParts(name, value, a, had) {
+  const out2 = [];
+  let n = 0;
+  for (let i = 0; i < value.length; i += PART) out2.push(writeCookie(`${name}.${n++}`, value.slice(i, i + PART), a));
+  for (let i = n; had.has(`${name}.${i}`); i++) out2.push(writeCookie(`${name}.${i}`, "", { ...a, maxAge: 0 }));
+  return out2;
+}
+function clearParts(name, a, had) {
+  const out2 = [];
+  for (let i = 0; had.has(`${name}.${i}`) || i === 0; i++) out2.push(writeCookie(`${name}.${i}`, "", { ...a, maxAge: 0 }));
+  return out2;
+}
+
+// src/seal.ts
+var import_jose = require("jose");
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+async function keyOf(secret) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(secret)));
+}
+async function seal(value, key) {
+  return new import_jose.CompactEncrypt(encoder.encode(JSON.stringify(value))).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).encrypt(key);
+}
+async function unseal(sealed, key) {
+  try {
+    const { plaintext } = await (0, import_jose.compactDecrypt)(sealed, key, {
+      keyManagementAlgorithms: ["dir"],
+      contentEncryptionAlgorithms: ["A256GCM"]
+    });
+    return JSON.parse(decoder.decode(plaintext));
+  } catch {
+    return null;
+  }
+}
+
+// src/webhook.ts
+var import_jose2 = require("jose");
+var CauthyWebhookError = class extends Error {
+  constructor(reason) {
+    super(`cauthy-auth: webhook refused: ${reason}`);
+    this.reason = reason;
+    this.name = "CauthyWebhookError";
+  }
+  reason;
+};
+var keys = /* @__PURE__ */ new Map();
+function keysOf(issuer) {
+  let set = keys.get(issuer);
+  if (set === void 0) {
+    set = (0, import_jose2.createRemoteJWKSet)(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 3e4 });
+    keys.set(issuer, set);
+  }
+  return set;
+}
+var hex = (s) => typeof s === "string" && s !== "" ? s : void 0;
+async function verifyWebhook(request, options = {}) {
+  const env2 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
+  const issuer = (options.issuer ?? env2 ?? "").replace(/\/+$/, "");
+  if (issuer === "") throw new CauthyWebhookError("issuer (CAUTHY_ISSUER) is not set");
+  const signature = request.headers.get("x-cauthy-signature-jwt");
+  if (!signature) throw new CauthyWebhookError("no signature");
+  const raw = new Uint8Array(await request.arrayBuffer());
+  const audience = options.url ?? request.url.split("?")[0];
+  let claims;
+  try {
+    const verified = await (0, import_jose2.jwtVerify)(signature, options.jwks ?? keysOf(issuer), {
+      algorithms: ["RS256"],
+      issuer,
+      audience,
+      typ: "cauthy-webhook+jwt",
+      requiredClaims: ["exp", "iat", "jti", "body_sha256"],
+      currentDate: options.now,
+      clockTolerance: 30
+    });
+    claims = verified.payload;
+  } catch (err) {
+    throw new CauthyWebhookError(err instanceof Error ? err.message : "bad signature");
+  }
+  const now = Math.floor((options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
+  if (typeof claims.iat !== "number" || claims.iat > now + 30) throw new CauthyWebhookError("signed in the future");
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", raw));
+  let b64 = "";
+  for (const b of digest) b64 += String.fromCharCode(b);
+  const hash = btoa(b64).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  if (hash !== claims.body_sha256) throw new CauthyWebhookError("the body is not the one that was signed");
+  let body;
+  try {
+    body = JSON.parse(new TextDecoder().decode(raw));
+  } catch {
+    throw new CauthyWebhookError("the body is not JSON");
+  }
+  if (body.id !== claims.jti || body.event !== claims.evt || body.tenant_id !== claims.tid) {
+    throw new CauthyWebhookError("the body and its signature disagree");
+  }
+  const inner = body.data ?? {};
+  return {
+    id: String(body.id),
+    type: String(body.event),
+    tenantId: String(body.tenant_id),
+    createdAt: String(inner.created_at ?? body.created_at ?? ""),
+    ...hex(inner.user_id) ? { userId: inner.user_id } : {},
+    ...hex(inner.actor_id) ? { actorId: inner.actor_id } : {},
+    data: inner.data ?? {}
+  };
+}
+
+// src/types.ts
+var CauthyConfigError = class extends Error {
+  constructor(message) {
+    super(`cauthy-auth: ${message}`);
+    this.name = "CauthyConfigError";
+  }
+};
+
+// src/cauthy.ts
+var SESSION_DAYS = 30;
+var FLOW_SECONDS = 600;
+var SKEW_SECONDS = 30;
+var ORGANIZATIONS_TTL_MS = 6e4;
+function env(name) {
+  return typeof process !== "undefined" ? process.env?.[name] : void 0;
+}
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function random(bytes = 32) {
+  return b64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function localPath(candidate, fallback) {
+  if (!candidate || !candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) return fallback;
+  return candidate;
+}
+function json(body, status = 200, headers) {
+  const h = headers ?? new Headers();
+  h.set("content-type", "application/json; charset=utf-8");
+  h.set("cache-control", "no-store");
+  return new Response(JSON.stringify(body), { status, headers: h });
+}
+function redirect(location, cookies = []) {
+  const h = new Headers({ location, "cache-control": "no-store" });
+  for (const c of cookies) h.append("set-cookie", c);
+  return new Response(null, { status: 302, headers: h });
+}
+function createCauthy(given = {}) {
+  const issuer = (given.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = given.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
+  const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET");
+  const secret = given.secret ?? env("CAUTHY_SECRET") ?? "";
+  const system = given.system ?? env("CAUTHY_SYSTEM") ?? "";
+  if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
+  if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
+  if (secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
+  const basePath = "/" + (given.basePath ?? "/api/auth").replace(/^\/+|\/+$/g, "");
+  const afterSignIn = localPath(given.afterSignIn, "/");
+  const afterSignOut = localPath(given.afterSignOut, "/");
+  const cookieName = given.cookieName ?? "cauthy_session";
+  const flowCookie = `${cookieName}_flow`;
+  const doFetch = (...args) => (given.fetch ?? fetch)(...args);
+  const key = keyOf(secret);
+  const originOf = (request) => (given.baseURL ?? new URL(request.url).origin).replace(/\/+$/, "");
+  const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
+  async function token(form) {
+    const body = new URLSearchParams({ client_id: clientId, ...form });
+    if (clientSecret) body.set("client_secret", clientSecret);
+    try {
+      const res = await doFetch(`${issuer}/v1/oauth/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body
+      });
+      if (res.ok) return { ok: true, body: await res.json() };
+      return { ok: false, ended: res.status >= 400 && res.status < 500 };
+    } catch {
+      return { ok: false, ended: false };
+    }
+  }
+  async function userinfo(accessToken) {
+    try {
+      const res = await doFetch(`${issuer}/v1/oauth/userinfo`, { headers: { authorization: `Bearer ${accessToken}` } });
+      if (!res.ok) return null;
+      const b = await res.json();
+      return {
+        tid: String(b.tid ?? ""),
+        roles: Array.isArray(b.roles) ? b.roles.filter((r) => typeof r === "string") : [],
+        u: {
+          id: String(b.sub ?? ""),
+          email: String(b.email ?? ""),
+          name: String(b.name ?? ""),
+          emailVerified: b.email_verified === true,
+          restricted: b.restricted === true,
+          ...typeof b.email_verify_by === "string" ? { emailVerifyBy: b.email_verify_by } : {},
+          ...typeof b.locale === "string" && b.locale !== "" ? { locale: b.locale } : {}
+        }
+      };
+    } catch {
+      return null;
+    }
+  }
+  async function stored(body) {
+    if (typeof body?.access_token !== "string" || typeof body?.refresh_token !== "string") return null;
+    const who = await userinfo(body.access_token);
+    if (who === null || who.u.id === "") return null;
+    const lifetime = typeof body.expires_in === "number" && body.expires_in > 0 ? body.expires_in : 300;
+    return { at: body.access_token, rt: body.refresh_token, exp: Math.floor(Date.now() / 1e3) + lifetime, ...who };
+  }
+  function toSession(s) {
+    return { user: s.u, tenantId: s.tid, roles: s.roles, accessToken: s.at, expiresAt: new Date(s.exp * 1e3).toISOString() };
+  }
+  async function read(request) {
+    const had = readCookies(request.headers.get("cookie"));
+    const raw = readParts(had, cookieName);
+    if (raw === null) return { had, value: null, present: false };
+    const value = await unseal(raw, await key);
+    const sound = value !== null && typeof value.at === "string" && typeof value.rt === "string" && typeof value.exp === "number";
+    return { had, value: sound ? value : null, present: true };
+  }
+  async function write(request, s, had) {
+    return writeParts(cookieName, await seal(s, await key), attrs(request, SESSION_DAYS * 86400), had);
+  }
+  const fresh = (s) => s.exp - Date.now() / 1e3 > SKEW_SECONDS;
+  const renewing = /* @__PURE__ */ new Map();
+  function renew(was) {
+    let running = renewing.get(was.rt);
+    if (running === void 0) {
+      const rt = was.rt;
+      running = (async () => {
+        const res = await token({ grant_type: "refresh_token", refresh_token: rt });
+        if (!res.ok) return res.ended ? "ended" : "unreachable";
+        const next = await stored(res.body);
+        if (next !== null) return next;
+        if (typeof res.body?.access_token !== "string" || typeof res.body?.refresh_token !== "string") return "unreachable";
+        const lifetime = typeof res.body.expires_in === "number" && res.body.expires_in > 0 ? res.body.expires_in : 300;
+        return { ...was, at: res.body.access_token, rt: res.body.refresh_token, exp: Math.floor(Date.now() / 1e3) + lifetime };
+      })();
+      renewing.set(rt, running);
+      void running.then((result) => {
+        if (result === "unreachable") return renewing.delete(rt);
+        const timer = setTimeout(() => renewing.delete(rt), 5e3);
+        timer.unref?.();
+      });
+    }
+    return running;
+  }
+  async function resolve2(request) {
+    const { had, value, present } = await read(request);
+    if (value === null) {
+      return { session: null, status: "unauthenticated", cookies: present ? clearParts(cookieName, attrs(request, 0), had) : [] };
+    }
+    if (fresh(value)) return { session: toSession(value), status: "authenticated", cookies: [] };
+    const renewed = await renew(value);
+    if (renewed === "ended") {
+      return { session: null, status: "unauthenticated", cookies: clearParts(cookieName, attrs(request, 0), had) };
+    }
+    if (renewed === "unreachable") return { session: null, status: "expired", cookies: [] };
+    return { session: toSession(renewed), status: "authenticated", cookies: await write(request, renewed, had) };
+  }
+  async function getSession(request, responseHeaders) {
+    if (responseHeaders === void 0) {
+      const { value } = await read(request);
+      return value !== null && fresh(value) ? toSession(value) : null;
+    }
+    const r = await resolve2(request);
+    for (const c of r.cookies) responseHeaders.append("set-cookie", c);
+    return r.session;
+  }
+  async function status(request) {
+    const { value } = await read(request);
+    if (value === null) return "unauthenticated";
+    return fresh(value) ? "authenticated" : "expired";
+  }
+  const orgCache = /* @__PURE__ */ new Map();
+  async function organizations(session) {
+    const hit = orgCache.get(session.accessToken);
+    if (hit && Date.now() - hit.at < ORGANIZATIONS_TTL_MS) return hit.value;
+    const url = `${issuer}/v1/oauth/organizations${system ? `?system=${encodeURIComponent(system)}` : ""}`;
+    const res = await doFetch(url, { headers: { authorization: `Bearer ${session.accessToken}` } });
+    if (!res.ok) throw new Error(`cauthy-auth: reading organizations: ${res.status}`);
+    const body = await res.json();
+    const value = (body.data ?? []).map(
+      (o) => ({
+        id: String(o.id),
+        system: String(o.system ?? ""),
+        name: String(o.name ?? ""),
+        kind: String(o.kind ?? ""),
+        role: String(o.role ?? ""),
+        metadata: o.metadata ?? {},
+        ...o.external_id ? { externalId: String(o.external_id) } : {},
+        ...Array.isArray(o.permissions) ? { permissions: o.permissions.map(String), denied: Array.isArray(o.denied) ? o.denied.map(String) : [] } : {}
+      })
+    );
+    if (orgCache.size > 5e3) orgCache.clear();
+    orgCache.set(session.accessToken, { at: Date.now(), value });
+    return value;
+  }
+  async function toPublic(session) {
+    let orgs = [];
+    try {
+      orgs = await organizations(session);
+    } catch {
+    }
+    return { user: session.user, tenantId: session.tenantId, roles: session.roles, organizations: orgs, expiresAt: session.expiresAt };
+  }
+  const urls = {
+    signIn: (returnTo) => `${basePath}/login${returnTo ? `?return_to=${encodeURIComponent(returnTo)}` : ""}`,
+    signOut: () => `${basePath}/logout`,
+    account: (returnTo) => `${basePath}/account${returnTo ? `?return_to=${encodeURIComponent(returnTo)}` : ""}`,
+    session: `${basePath}/session`
+  };
+  async function login(request, url) {
+    const flow = { state: random(), verifier: random(48), returnTo: localPath(url.searchParams.get("return_to"), afterSignIn) };
+    const challenge = b64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(flow.verifier))));
+    const q = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: `${originOf(request)}${basePath}/callback`,
+      response_type: "code",
+      state: flow.state,
+      code_challenge: challenge,
+      code_challenge_method: "S256"
+    });
+    const prompt = url.searchParams.get("prompt");
+    if (prompt === "login" || prompt === "none") q.set("prompt", prompt);
+    const locale = url.searchParams.get("locale") ?? url.searchParams.get("ui_locales");
+    if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set("ui_locales", locale);
+    return redirect(`${issuer}/v1/oauth/authorize?${q}`, [
+      writeCookie(flowCookie, await seal(flow, await key), attrs(request, FLOW_SECONDS))
+    ]);
+  }
+  function failed(request, reason) {
+    const h = new Headers({ "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" });
+    h.append("set-cookie", writeCookie(flowCookie, "", attrs(request, 0)));
+    return new Response(`Sign-in could not be completed (${reason}). Go back and try again.`, { status: 400, headers: h });
+  }
+  async function callback(request, url) {
+    const had = readCookies(request.headers.get("cookie"));
+    const sealed = had.get(flowCookie);
+    const flow = sealed ? await unseal(sealed, await key) : null;
+    if (flow === null || url.searchParams.get("state") !== flow.state) return failed(request, "state_mismatch");
+    const error = url.searchParams.get("error");
+    if (error !== null) {
+      if (error === "login_required") return redirect(flow.returnTo, [writeCookie(flowCookie, "", attrs(request, 0))]);
+      return failed(request, error.slice(0, 60));
+    }
+    const code = url.searchParams.get("code");
+    if (!code) return failed(request, "no_code");
+    const res = await token({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: `${originOf(request)}${basePath}/callback`,
+      code_verifier: flow.verifier
+    });
+    const s = res.ok ? await stored(res.body) : null;
+    if (s === null) return failed(request, "exchange_failed");
+    return redirect(flow.returnTo, [...await write(request, s, had), writeCookie(flowCookie, "", attrs(request, 0))]);
+  }
+  async function logout(request) {
+    const { had, value } = await read(request);
+    if (value !== null) {
+      const body = new URLSearchParams({ client_id: clientId, token: value.rt });
+      if (clientSecret) body.set("client_secret", clientSecret);
+      await doFetch(`${issuer}/v1/oauth/revoke`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      }).catch(() => void 0);
+      orgCache.delete(value.at);
+    }
+    const q = new URLSearchParams({ client_id: clientId, post_logout_redirect_uri: `${originOf(request)}${afterSignOut}` });
+    return redirect(`${issuer}/v1/oauth/logout?${q}`, clearParts(cookieName, attrs(request, 0), had));
+  }
+  async function handler(request) {
+    const url = new URL(request.url);
+    if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) return new Response("Not found", { status: 404 });
+    const route = url.pathname.slice(basePath.length).replace(/\/+$/, "") || "/";
+    const get = request.method === "GET" || request.method === "HEAD";
+    if (route === "/login" && get) return login(request, url);
+    if (route === "/callback" && get) return callback(request, url);
+    if (route === "/logout" && (get || request.method === "POST")) return logout(request);
+    if (route === "/session" && get) {
+      const r = await resolve2(request);
+      const h = new Headers();
+      for (const c of r.cookies) h.append("set-cookie", c);
+      return json({ session: r.session ? await toPublic(r.session) : null, status: r.status }, 200, h);
+    }
+    if (route === "/refresh" && get) {
+      const r = await resolve2(request);
+      const back = localPath(url.searchParams.get("return_to"), afterSignIn);
+      if (r.status === "unauthenticated") return redirect(urls.signIn(back), r.cookies);
+      if (r.status === "expired") return new Response("Sign-in is unavailable right now. Try again in a moment.", { status: 503 });
+      return redirect(back, r.cookies);
+    }
+    if (route === "/account" && get) {
+      const q = new URLSearchParams({ client_id: clientId });
+      const back = localPath(url.searchParams.get("return_to"), "");
+      if (back !== "") q.set("return_to", `${originOf(request)}${back}`);
+      const locale = url.searchParams.get("locale");
+      if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set("ui_locales", locale);
+      return redirect(`${issuer}/v1/oauth/account?${q}`);
+    }
+    return new Response("Not found", { status: 404 });
+  }
+  async function protect(request) {
+    const { value } = await read(request);
+    if (value !== null && fresh(value)) return { session: toSession(value) };
+    const url = new URL(request.url);
+    const state = value === null ? "none" : "expired";
+    const page = request.method === "GET" && (request.headers.get("sec-fetch-mode") ?? "navigate") === "navigate" && (request.headers.get("accept") ?? "text/html").includes("text/html");
+    if (!page) {
+      return { response: json({ error: "unauthenticated", session: state }, 401, new Headers({ "x-cauthy-session": state })) };
+    }
+    const back = url.pathname + url.search;
+    const to = value === null ? urls.signIn(back) : `${basePath}/refresh?return_to=${encodeURIComponent(back)}`;
+    return { response: redirect(to) };
+  }
+  const webhook = (request, o = {}) => verifyWebhook(request, { issuer, url: o.url ?? `${originOf(request)}${new URL(request.url).pathname}`, jwks: o.jwks, now: o.now });
+  return {
+    handler,
+    webhook,
+    getSession,
+    status,
+    resolve: resolve2,
+    protect,
+    organizations,
+    toPublic,
+    urls,
+    options: { issuer, clientId, basePath, afterSignIn, afterSignOut, cookieName }
+  };
+}
+
+// src/theme.ts
+var MAX_RADIUS = 40;
+function declarations(css) {
+  const text = css.replace(/\/\*[\s\S]*?\*\//g, "");
+  const out2 = [];
+  const within = [];
+  let chunk = "";
+  let quote = "";
+  let depth = 0;
+  const flush = () => {
+    const m = /^\s*(--[\w-]+)\s*:\s*([\s\S]+?)\s*$/.exec(chunk);
+    if (m) out2.push({ name: m[1], value: m[2].replace(/\s+/g, " ").replace(/\s*!important$/, ""), within: [...within] });
+    chunk = "";
+  };
+  for (const ch of text) {
+    if (quote) {
+      chunk += ch;
+      if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      chunk += ch;
+    } else if (ch === "(") {
+      depth++;
+      chunk += ch;
+    } else if (ch === ")") {
+      depth = Math.max(0, depth - 1);
+      chunk += ch;
+    } else if (ch === "{" && depth === 0) {
+      within.push(chunk.trim().replace(/\s+/g, " "));
+      chunk = "";
+    } else if (ch === "}" && depth === 0) {
+      flush();
+      within.pop();
+    } else if (ch === ";" && depth === 0) {
+      flush();
+    } else {
+      chunk += ch;
+    }
+  }
+  return out2;
+}
+var DARK = /prefers-color-scheme:\s*dark|data-(mode|theme|color-scheme)=["']?dark|\.dark\b/i;
+var LIGHT = /prefers-color-scheme:\s*light|data-(mode|theme|color-scheme)=["']?light|\.light\b/i;
+var NAMED = /data-theme=["']?([\w-]+)/i;
+function applies(d, o) {
+  for (const scope of d.within) {
+    if (o.mode === "light" && DARK.test(scope)) return false;
+    if (o.mode === "dark" && LIGHT.test(scope)) return false;
+    const named = NAMED.exec(scope);
+    if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false;
+    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host/.test(scope)) return false;
+  }
+  return true;
+}
+function resolve(value, vars, seen = 0) {
+  if (seen > 16) return null;
+  let unresolved = false;
+  let out2 = value;
+  for (let guard = 0; guard < 32 && /var\(/.test(out2); guard++) {
+    out2 = out2.replace(/var\(\s*(--[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
+      const known = vars.get(name);
+      const next = known !== void 0 ? resolve(known, vars, seen + 1) : fallback !== void 0 ? resolve(fallback.trim(), vars, seen + 1) : null;
+      if (next === null) unresolved = true;
+      return next ?? "";
+    });
+    if (unresolved) return null;
+  }
+  return /var\(/.test(out2) ? null : out2.trim();
+}
+var clamp01 = (n) => Math.min(1, Math.max(0, n));
+var hex2 = (n) => Math.round(clamp01(n) * 255).toString(16).padStart(2, "0");
+var gamma = (c) => c <= 31308e-7 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055;
+function out(r, g, b, a = 1) {
+  if (a >= 1) return `#${hex2(r)}${hex2(g)}${hex2(b)}`;
+  return `rgba(${Math.round(clamp01(r) * 255)}, ${Math.round(clamp01(g) * 255)}, ${Math.round(clamp01(b) * 255)}, ${Math.round(clamp01(a) * 1e3) / 1e3})`;
+}
+var alpha = (s) => s === void 0 ? 1 : s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s);
+var KEYWORDS = { white: "#ffffff", black: "#000000" };
+function toColor(value) {
+  const v = value.trim().toLowerCase();
+  if (KEYWORDS[v]) return KEYWORDS[v];
+  if (/^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(v)) return v;
+  let m = /^rgba?\(\s*([\d.]+%?)[\s,]+([\d.]+%?)[\s,]+([\d.]+%?)(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const ch = (s) => s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s) / 255;
+    return out(ch(m[1]), ch(m[2]), ch(m[3]), alpha(m[4]));
+  }
+  m = /^hsla?\(\s*([\d.]+)(?:deg)?[\s,]+([\d.]+)%[\s,]+([\d.]+)%(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const h = (parseFloat(m[1]) % 360 + 360) % 360;
+    const s = parseFloat(m[2]) / 100;
+    const l = parseFloat(m[3]) / 100;
+    const f = (n) => {
+      const k = (n + h / 30) % 12;
+      return l - s * Math.min(l, 1 - l) * Math.max(-1, Math.min(k - 3, 9 - k, 1));
+    };
+    return out(f(0), f(8), f(4), alpha(m[4]));
+  }
+  m = /^oklch\(\s*([\d.]+%?)\s+([\d.]+%?)\s+([\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const L = m[1].endsWith("%") ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
+    const C = m[2].endsWith("%") ? parseFloat(m[2]) / 100 * 0.4 : parseFloat(m[2]);
+    const H = parseFloat(m[3]) * Math.PI / 180;
+    const a = C * Math.cos(H);
+    const b = C * Math.sin(H);
+    const l = Math.pow(L + 0.3963377774 * a + 0.2158037573 * b, 3);
+    const mm = Math.pow(L - 0.1055613458 * a - 0.0638541728 * b, 3);
+    const s = Math.pow(L - 0.0894841775 * a - 1.291485548 * b, 3);
+    return out(
+      gamma(4.0767416621 * l - 3.3077115913 * mm + 0.2309699292 * s),
+      gamma(-1.2684380046 * l + 2.6097574011 * mm - 0.3413193965 * s),
+      gamma(-0.0041960863 * l - 0.7034186147 * mm + 1.707614701 * s),
+      alpha(m[4])
+    );
+  }
+  return null;
+}
+function toRadius(value) {
+  const m = /^([\d.]+)(px|rem|em)?$/.exec(value.trim());
+  if (!m) return null;
+  const px = parseFloat(m[1]) * (m[2] === "rem" || m[2] === "em" ? 16 : 1);
+  return Number.isFinite(px) ? Math.min(MAX_RADIUS, Math.max(0, Math.round(px))) : null;
+}
+function toFont(value) {
+  const v = value.trim();
+  return /^[A-Za-z0-9 ,'"_-]{1,200}$/.test(v) && (v.match(/"/g)?.length ?? 0) % 2 === 0 && (v.match(/'/g)?.length ?? 0) % 2 === 0 ? v : null;
+}
+var COLORS = [
+  ["background", ["--sm-bg-surface", "--sm-surface"]],
+  ["surface", ["--sm-bg-surface-raised", "--sm-surface-raised"]],
+  ["text", ["--sm-text-primary", "--sm-surface-text"]],
+  ["textMuted", ["--sm-text-secondary"]],
+  ["border", ["--sm-border-default", "--sm-surface-border"]],
+  ["primary", ["--sm-primary", "--sm-bg-interactive"]],
+  ["primaryText", ["--sm-primary-text", "--sm-text-inverse"]],
+  ["accent", ["--sm-text-brand", "--sm-border-focus", "--sm-accent"]],
+  ["error", ["--sm-error-soft-text", "--sm-error"]],
+  ["errorBackground", ["--sm-error-soft"]],
+  ["success", ["--sm-success-soft-text", "--sm-success"]],
+  ["successBackground", ["--sm-success-soft"]]
+];
+function themeFromStackmyth(css, options = {}) {
+  const o = { mode: options.mode ?? "light", theme: options.theme };
+  const vars = /* @__PURE__ */ new Map();
+  for (const sheet of Array.isArray(css) ? css : [css]) {
+    for (const d of declarations(sheet)) if (applies(d, o)) vars.set(d.name, d.value);
+  }
+  const theme = {};
+  const warnings = [];
+  const read = (tokens, to, what) => {
+    for (const token of tokens) {
+      const raw = vars.get(token);
+      if (raw === void 0) continue;
+      const value = resolve(raw, vars);
+      const got = value === null ? null : to(value);
+      if (got !== null) return got;
+      warnings.push(`${token}: "${raw}" is not ${what} Cauthy can take`);
+    }
+    return void 0;
+  };
+  for (const [field, tokens] of COLORS) {
+    const c = read(tokens, toColor, "a colour");
+    if (c !== void 0) theme[field] = c;
+  }
+  const radius = read(["--sm-radius-container", "--sm-radius-md"], toRadius, "a length");
+  if (radius !== void 0) theme.radius = radius;
+  const button = read(["--sm-radius-interactive", "--sm-radius-sm"], toRadius, "a length");
+  if (button !== void 0) theme.buttonRadius = button;
+  const font = read(["--sm-font-family"], toFont, "a font list");
+  if (font !== void 0) theme.fontFamily = font;
+  if (options.logoUrl) theme.logoUrl = options.logoUrl;
+  if (vars.size === 0) warnings.push("no custom properties were found: is this the stylesheet that declares the --sm-* tokens?");
+  else if (![...vars.keys()].some((k) => k.startsWith("--sm-"))) warnings.push("no --sm-* token was found in these stylesheets");
+  return { theme, warnings };
+}
+function toWire(theme) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    textMuted: "text_muted",
+    border: "border",
+    primary: "primary",
+    primaryText: "primary_text",
+    accent: "accent",
+    error: "error",
+    errorBackground: "error_background",
+    success: "success",
+    successBackground: "success_background",
+    radius: "radius",
+    buttonRadius: "button_radius",
+    fontFamily: "font_family",
+    logoUrl: "logo_url"
+  };
+  const wire = {};
+  for (const [k, v] of Object.entries(theme)) if (v !== void 0 && v !== "") wire[names[k]] = v;
+  return wire;
+}
+async function pushTheme(o) {
+  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = o.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
+  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/oauth/clients/${encodeURIComponent(clientId)}/theme`, {
+    method: "PUT",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify(toWire(o.theme))
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(`cauthy-auth: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  }
+}
+
+// src/permissions.ts
+function matches(entry, resource, action) {
+  const i = entry.lastIndexOf(":");
+  if (i < 0) return false;
+  const r = entry.slice(0, i);
+  const a = entry.slice(i + 1);
+  return (r === "*" || r === resource) && (a === "*" || a === action);
+}
+function can(organization, resource, action) {
+  if (!organization?.permissions) return false;
+  if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
+  return organization.permissions.some((p) => matches(p, resource, action));
+}
+async function pushPolicy(o) {
+  const env2 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env2("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const system = o.system ?? env2("CAUTHY_SYSTEM") ?? "";
+  const tenant = o.tenant ?? env2("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env2("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a policy`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/systems/${encodeURIComponent(system)}/policy`, {
+    method: "PUT",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify({ roles: o.roles })
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(`cauthy-auth: Cauthy refused the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CauthyConfigError,
+  CauthyWebhookError,
+  can,
+  createCauthy,
+  pushPolicy,
+  pushTheme,
+  themeFromStackmyth,
+  verifyWebhook
+});
+//# sourceMappingURL=index.js.map