exisjs 0.5.10 → 0.5.12

package/dist/auth/index.d.ts

@@ -1,6 +1,8 @@
 import * as Password from './password';
 import * as JWT from './jwt';
+import * as OAuth from './oauth';
 export * from './rbac';
 export * from './session';
-export { Password, JWT };
+export * from './oauth';
+export { Password, JWT, OAuth };
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,GAAG,MAAM,OAAO,CAAA;AAE5B,cAAc,QAAQ,CAAA;AACtB,cAAc,WAAW,CAAA;AACzB,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,GAAG,MAAM,OAAO,CAAA;AAC5B,OAAO,KAAK,KAAK,MAAM,SAAS,CAAA;AAEhC,cAAc,QAAQ,CAAA;AACtB,cAAc,WAAW,CAAA;AACzB,cAAc,SAAS,CAAA;AACvB,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA"}

package/dist/auth/index.js

@@ -36,11 +36,14 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWT = exports.Password = void 0;
+exports.OAuth = exports.JWT = exports.Password = void 0;
 const Password = __importStar(require("./password"));
 exports.Password = Password;
 const JWT = __importStar(require("./jwt"));
 exports.JWT = JWT;
+const OAuth = __importStar(require("./oauth"));
+exports.OAuth = OAuth;
 __exportStar(require("./rbac"), exports);
 __exportStar(require("./session"), exports);
+__exportStar(require("./oauth"), exports);
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qDAAsC;AAK7B,4BAAQ;AAJjB,2CAA4B;AAIT,kBAAG;AAFtB,yCAAsB;AACtB,4CAAyB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qDAAsC;AAO7B,4BAAQ;AANjB,2CAA4B;AAMT,kBAAG;AALtB,+CAAgC;AAKR,sBAAK;AAH7B,yCAAsB;AACtB,4CAAyB;AACzB,0CAAuB"}

package/dist/auth/oauth/core.d.ts

@@ -0,0 +1,96 @@
+/**
+ * OAuth Manager — The core orchestration engine.
+ *
+ * Manages OAuth provider registrations, generates authorization URLs with
+ * PKCE + state, handles the token exchange callback, and normalizes user profiles.
+ *
+ * Usage:
+ *   import { OAuth } from 'exisjs/auth'
+ *
+ *   OAuth.configure({
+ *     google: { clientId: '...', clientSecret: '...', redirectUri: '...' },
+ *     github: { clientId: '...', clientSecret: '...', redirectUri: '...' },
+ *   })
+ *
+ *   const { url, state, codeVerifier } = OAuth.getAuthUrl('google')
+ *   const { profile, tokens } = await OAuth.handleCallback('google', code, codeVerifier)
+ */
+import type { OAuthProviderConfig, OAuthProviderAdapter, OAuthTokens, OAuthUserProfile, OAuthFlowState, CustomOAuthProviderConfig } from './types';
+/**
+ * Generate a cryptographically random code verifier for PKCE.
+ */
+declare function generateCodeVerifier(): string;
+/**
+ * Derive the code challenge from a code verifier using S256 method.
+ */
+declare function generateCodeChallenge(verifier: string): string;
+/**
+ * Generate a cryptographically random state token for CSRF protection.
+ */
+declare function generateState(): string;
+export declare class OAuthManager {
+    private providers;
+    /**
+     * Configure multiple OAuth providers at once.
+     */
+    configure(providers: Record<string, OAuthProviderConfig>): this;
+    /**
+     * Register a single OAuth provider.
+     */
+    register(name: string, config: OAuthProviderConfig): this;
+    /**
+     * Register a custom OAuth provider.
+     */
+    custom(config: CustomOAuthProviderConfig): this;
+    /**
+     * Register a fully custom provider adapter directly.
+     */
+    registerAdapter(name: string, adapter: OAuthProviderAdapter): this;
+    /**
+     * Generate the authorization URL for a provider.
+     * Returns the URL, state token, and PKCE code verifier.
+     */
+    getAuthUrl(provider: string, options?: {
+        usePKCE?: boolean;
+        additionalParams?: Record<string, string>;
+    }): {
+        url: string;
+        state: string;
+        codeVerifier?: string;
+        flowState: OAuthFlowState;
+    };
+    /**
+     * Handle the OAuth callback — exchange the authorization code for tokens
+     * and fetch the user profile.
+     */
+    handleCallback(provider: string, code: string, codeVerifier?: string): Promise<{
+        profile: OAuthUserProfile;
+        tokens: OAuthTokens;
+    }>;
+    /**
+     * Refresh an expired access token.
+     */
+    refreshAccessToken(provider: string, refreshToken: string): Promise<OAuthTokens>;
+    /**
+     * Revoke a token.
+     */
+    revokeToken(provider: string, token: string): Promise<void>;
+    /**
+     * Get a registered provider adapter.
+     */
+    getProvider(name: string): OAuthProviderAdapter;
+    /**
+     * Check if a provider is registered.
+     */
+    hasProvider(name: string): boolean;
+    /**
+     * Get all registered provider names.
+     */
+    getProviderNames(): string[];
+}
+/**
+ * Default global OAuthManager instance.
+ */
+export declare const OAuth: OAuthManager;
+export { generateCodeVerifier, generateCodeChallenge, generateState };
+//# sourceMappingURL=core.d.ts.map

package/dist/auth/oauth/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAEV,mBAAmB,EACnB,oBAAoB,EACpB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EAC1B,MAAM,SAAS,CAAA;AA2ChB;;GAEG;AACH,iBAAS,oBAAoB,IAAI,MAAM,CAEtC;AAED;;GAEG;AACH,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;GAEG;AACH,iBAAS,aAAa,IAAI,MAAM,CAE/B;AAID,qBAAa,YAAY;IACvB,OAAO,CAAC,SAAS,CAA0C;IAE3D;;OAEG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,IAAI;IAO/D;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,IAAI;IAMzD;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI;IAQ/C;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAKlE;;;OAGG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACzE;QACD,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,cAAc,CAAA;KAC1B;IAkCD;;;OAGG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,OAAO,EAAE,gBAAgB,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAY9D;;OAEG;IACG,kBAAkB,CACtB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC;IAKvB;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjE;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB;IAU/C;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIlC;;OAEG;IACH,gBAAgB,IAAI,MAAM,EAAE;CAG7B;AAID;;GAEG;AACH,eAAO,MAAM,KAAK,cAAqB,CAAA;AAGvC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAA"}

package/dist/auth/oauth/core.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * OAuth Manager — The core orchestration engine.
+ *
+ * Manages OAuth provider registrations, generates authorization URLs with
+ * PKCE + state, handles the token exchange callback, and normalizes user profiles.
+ *
+ * Usage:
+ *   import { OAuth } from 'exisjs/auth'
+ *
+ *   OAuth.configure({
+ *     google: { clientId: '...', clientSecret: '...', redirectUri: '...' },
+ *     github: { clientId: '...', clientSecret: '...', redirectUri: '...' },
+ *   })
+ *
+ *   const { url, state, codeVerifier } = OAuth.getAuthUrl('google')
+ *   const { profile, tokens } = await OAuth.handleCallback('google', code, codeVerifier)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth = exports.OAuthManager = void 0;
+exports.generateCodeVerifier = generateCodeVerifier;
+exports.generateCodeChallenge = generateCodeChallenge;
+exports.generateState = generateState;
+const node_crypto_1 = require("node:crypto");
+// ─── Provider Factories ──────────────────────────────────────────────────────
+function createBuiltInProvider(name, config) {
+    switch (name) {
+        case 'google': {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const { GoogleProvider } = require('./providers/google');
+            return new GoogleProvider(config);
+        }
+        case 'github': {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const { GithubProvider } = require('./providers/github');
+            return new GithubProvider(config);
+        }
+        case 'microsoft': {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const { MicrosoftProvider } = require('./providers/microsoft');
+            return new MicrosoftProvider(config);
+        }
+        case 'discord': {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const { DiscordProvider } = require('./providers/discord');
+            return new DiscordProvider(config);
+        }
+        case 'facebook': {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const { FacebookProvider } = require('./providers/facebook');
+            return new FacebookProvider(config);
+        }
+        default:
+            throw new Error(`Unknown OAuth provider '${name}'. Use OAuth.custom() for custom providers.`);
+    }
+}
+// ─── PKCE Helpers ────────────────────────────────────────────────────────────
+/**
+ * Generate a cryptographically random code verifier for PKCE.
+ */
+function generateCodeVerifier() {
+    return (0, node_crypto_1.randomBytes)(32).toString('base64url');
+}
+/**
+ * Derive the code challenge from a code verifier using S256 method.
+ */
+function generateCodeChallenge(verifier) {
+    return (0, node_crypto_1.createHash)('sha256').update(verifier).digest('base64url');
+}
+/**
+ * Generate a cryptographically random state token for CSRF protection.
+ */
+function generateState() {
+    return (0, node_crypto_1.randomBytes)(24).toString('base64url');
+}
+// ─── OAuth Manager ───────────────────────────────────────────────────────────
+class OAuthManager {
+    constructor() {
+        this.providers = new Map();
+    }
+    /**
+     * Configure multiple OAuth providers at once.
+     */
+    configure(providers) {
+        for (const [name, config] of Object.entries(providers)) {
+            this.register(name, config);
+        }
+        return this;
+    }
+    /**
+     * Register a single OAuth provider.
+     */
+    register(name, config) {
+        const adapter = createBuiltInProvider(name, config);
+        this.providers.set(name, adapter);
+        return this;
+    }
+    /**
+     * Register a custom OAuth provider.
+     */
+    custom(config) {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { CustomProvider } = require('./providers/custom');
+        const adapter = new CustomProvider(config);
+        this.providers.set(config.name, adapter);
+        return this;
+    }
+    /**
+     * Register a fully custom provider adapter directly.
+     */
+    registerAdapter(name, adapter) {
+        this.providers.set(name, adapter);
+        return this;
+    }
+    /**
+     * Generate the authorization URL for a provider.
+     * Returns the URL, state token, and PKCE code verifier.
+     */
+    getAuthUrl(provider, options) {
+        const adapter = this.getProvider(provider);
+        const state = generateState();
+        const usePKCE = options?.usePKCE !== false; // PKCE on by default
+        let codeVerifier;
+        let url;
+        if (usePKCE) {
+            codeVerifier = generateCodeVerifier();
+            url = adapter.getAuthorizationUrl(state, codeVerifier);
+        }
+        else {
+            url = adapter.getAuthorizationUrl(state);
+        }
+        // Append any additional query params
+        if (options?.additionalParams) {
+            const urlObj = new URL(url);
+            for (const [key, value] of Object.entries(options.additionalParams)) {
+                urlObj.searchParams.set(key, value);
+            }
+            url = urlObj.toString();
+        }
+        const flowState = {
+            state,
+            codeVerifier,
+            provider,
+            createdAt: Date.now(),
+        };
+        return { url, state, codeVerifier, flowState };
+    }
+    /**
+     * Handle the OAuth callback — exchange the authorization code for tokens
+     * and fetch the user profile.
+     */
+    async handleCallback(provider, code, codeVerifier) {
+        const adapter = this.getProvider(provider);
+        // Exchange the code for tokens
+        const tokens = await adapter.exchangeCode(code, codeVerifier);
+        // Fetch the user profile
+        const profile = await adapter.getUserProfile(tokens);
+        return { profile, tokens };
+    }
+    /**
+     * Refresh an expired access token.
+     */
+    async refreshAccessToken(provider, refreshToken) {
+        const adapter = this.getProvider(provider);
+        return adapter.refreshToken(refreshToken);
+    }
+    /**
+     * Revoke a token.
+     */
+    async revokeToken(provider, token) {
+        const adapter = this.getProvider(provider);
+        return adapter.revokeToken(token);
+    }
+    /**
+     * Get a registered provider adapter.
+     */
+    getProvider(name) {
+        const adapter = this.providers.get(name);
+        if (!adapter) {
+            throw new Error(`OAuth provider '${name}' is not registered. Call OAuth.register() or OAuth.configure() first.`);
+        }
+        return adapter;
+    }
+    /**
+     * Check if a provider is registered.
+     */
+    hasProvider(name) {
+        return this.providers.has(name);
+    }
+    /**
+     * Get all registered provider names.
+     */
+    getProviderNames() {
+        return Array.from(this.providers.keys());
+    }
+}
+exports.OAuthManager = OAuthManager;
+// ─── Singleton & Exports ─────────────────────────────────────────────────────
+/**
+ * Default global OAuthManager instance.
+ */
+exports.OAuth = new OAuthManager();
+//# sourceMappingURL=core.js.map

package/dist/auth/oauth/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/auth/oauth/core.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AA+OM,oDAAoB;AAAE,sDAAqB;AAAE,sCAAa;AA7OnE,6CAAqD;AAWrD,gFAAgF;AAEhF,SAAS,qBAAqB,CAC5B,IAAmB,EACnB,MAA2B;IAE3B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,iEAAiE;YACjE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;YACxD,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,iEAAiE;YACjE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;YACxD,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,iEAAiE;YACjE,MAAM,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;YAC9D,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAA;QACtC,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,iEAAiE;YACjE,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;YAC1D,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,iEAAiE;YACjE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;YAC5D,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAA;QACrC,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,6CAA6C,CAC7E,CAAA;IACL,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,SAAS,oBAAoB;IAC3B,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClE,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED,gFAAgF;AAEhF,MAAa,YAAY;IAAzB;QACU,cAAS,GAAG,IAAI,GAAG,EAAgC,CAAA;IAuJ7D,CAAC;IArJC;;OAEG;IACH,SAAS,CAAC,SAA8C;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,IAAY,EAAE,MAA2B;QAChD,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAiC;QACtC,iEAAiE;QACjE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACxC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAY,EAAE,OAA6B;QACzD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACH,UAAU,CACR,QAAgB,EAChB,OAA0E;QAO1E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;QAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,KAAK,KAAK,CAAA,CAAC,qBAAqB;QAEhE,IAAI,YAAgC,CAAA;QACpC,IAAI,GAAW,CAAA;QAEf,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,GAAG,oBAAoB,EAAE,CAAA;YACrC,GAAG,GAAG,OAAO,CAAC,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QACxD,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC1C,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACrC,CAAC;YACD,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;QAED,MAAM,SAAS,GAAmB;YAChC,KAAK;YACL,YAAY;YACZ,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAA;QAED,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,IAAY,EACZ,YAAqB;QAErB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QAE1C,+BAA+B;QAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAE7D,yBAAyB;QACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAEpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,QAAgB,EAChB,YAAoB;QAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC1C,OAAO,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,KAAa;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC1C,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,IAAY;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,wEAAwE,CAChG,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1C,CAAC;CACF;AAxJD,oCAwJC;AAED,gFAAgF;AAEhF;;GAEG;AACU,QAAA,KAAK,GAAG,IAAI,YAAY,EAAE,CAAA"}

package/dist/auth/oauth/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * ExisJS OAuth Provider System
+ *
+ * A complete OAuth 2.0 / OpenID Connect implementation with built-in providers
+ * for Google, GitHub, Microsoft, Discord, and Facebook. Includes PKCE support,
+ * state validation, profile normalization, and route middleware helpers.
+ *
+ * @example
+ * ```ts
+ * import { OAuth } from 'exisjs/auth'
+ *
+ * // Configure providers
+ * OAuth.configure({
+ *   google: {
+ *     clientId: process.env.GOOGLE_CLIENT_ID!,
+ *     clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+ *     redirectUri: 'http://localhost:3000/auth/google/callback',
+ *   },
+ *   github: {
+ *     clientId: process.env.GITHUB_CLIENT_ID!,
+ *     clientSecret: process.env.GITHUB_CLIENT_SECRET!,
+ *     redirectUri: 'http://localhost:3000/auth/github/callback',
+ *   },
+ * })
+ *
+ * // Use middleware
+ * app.get('/auth/google', oauthRedirect('google'))
+ * app.get('/auth/google/callback', oauthCallback('google', {
+ *   onSuccess: async (req, res, profile) => {
+ *     req.session.userId = profile.id
+ *     res.redirect('/dashboard')
+ *   },
+ * }))
+ * ```
+ */
+export { OAuthManager, OAuth, generateCodeVerifier, generateCodeChallenge, generateState, } from './core';
+export { oauthRedirect, oauthCallback, requireAuth } from './middleware';
+export { GoogleProvider } from './providers/google';
+export { GithubProvider } from './providers/github';
+export { MicrosoftProvider } from './providers/microsoft';
+export { DiscordProvider } from './providers/discord';
+export { FacebookProvider } from './providers/facebook';
+export { CustomProvider } from './providers/custom';
+export type { OAuthProvider, OAuthProviderConfig, OAuthProviderAdapter, OAuthTokens, OAuthUserProfile, OAuthCallbackOptions, OAuthFlowState, CustomOAuthProviderConfig, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EACL,YAAY,EACZ,KAAK,EACL,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,GACd,MAAM,QAAQ,CAAA;AAGf,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAGxE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAGnD,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,yBAAyB,GAC1B,MAAM,SAAS,CAAA"}

package/dist/auth/oauth/index.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * ExisJS OAuth Provider System
+ *
+ * A complete OAuth 2.0 / OpenID Connect implementation with built-in providers
+ * for Google, GitHub, Microsoft, Discord, and Facebook. Includes PKCE support,
+ * state validation, profile normalization, and route middleware helpers.
+ *
+ * @example
+ * ```ts
+ * import { OAuth } from 'exisjs/auth'
+ *
+ * // Configure providers
+ * OAuth.configure({
+ *   google: {
+ *     clientId: process.env.GOOGLE_CLIENT_ID!,
+ *     clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+ *     redirectUri: 'http://localhost:3000/auth/google/callback',
+ *   },
+ *   github: {
+ *     clientId: process.env.GITHUB_CLIENT_ID!,
+ *     clientSecret: process.env.GITHUB_CLIENT_SECRET!,
+ *     redirectUri: 'http://localhost:3000/auth/github/callback',
+ *   },
+ * })
+ *
+ * // Use middleware
+ * app.get('/auth/google', oauthRedirect('google'))
+ * app.get('/auth/google/callback', oauthCallback('google', {
+ *   onSuccess: async (req, res, profile) => {
+ *     req.session.userId = profile.id
+ *     res.redirect('/dashboard')
+ *   },
+ * }))
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomProvider = exports.FacebookProvider = exports.DiscordProvider = exports.MicrosoftProvider = exports.GithubProvider = exports.GoogleProvider = exports.requireAuth = exports.oauthCallback = exports.oauthRedirect = exports.generateState = exports.generateCodeChallenge = exports.generateCodeVerifier = exports.OAuth = exports.OAuthManager = void 0;
+// ─── Core ────────────────────────────────────────────────────────────────────
+var core_1 = require("./core");
+Object.defineProperty(exports, "OAuthManager", { enumerable: true, get: function () { return core_1.OAuthManager; } });
+Object.defineProperty(exports, "OAuth", { enumerable: true, get: function () { return core_1.OAuth; } });
+Object.defineProperty(exports, "generateCodeVerifier", { enumerable: true, get: function () { return core_1.generateCodeVerifier; } });
+Object.defineProperty(exports, "generateCodeChallenge", { enumerable: true, get: function () { return core_1.generateCodeChallenge; } });
+Object.defineProperty(exports, "generateState", { enumerable: true, get: function () { return core_1.generateState; } });
+// ─── Middleware ───────────────────────────────────────────────────────────────
+var middleware_1 = require("./middleware");
+Object.defineProperty(exports, "oauthRedirect", { enumerable: true, get: function () { return middleware_1.oauthRedirect; } });
+Object.defineProperty(exports, "oauthCallback", { enumerable: true, get: function () { return middleware_1.oauthCallback; } });
+Object.defineProperty(exports, "requireAuth", { enumerable: true, get: function () { return middleware_1.requireAuth; } });
+// ─── Providers ───────────────────────────────────────────────────────────────
+var google_1 = require("./providers/google");
+Object.defineProperty(exports, "GoogleProvider", { enumerable: true, get: function () { return google_1.GoogleProvider; } });
+var github_1 = require("./providers/github");
+Object.defineProperty(exports, "GithubProvider", { enumerable: true, get: function () { return github_1.GithubProvider; } });
+var microsoft_1 = require("./providers/microsoft");
+Object.defineProperty(exports, "MicrosoftProvider", { enumerable: true, get: function () { return microsoft_1.MicrosoftProvider; } });
+var discord_1 = require("./providers/discord");
+Object.defineProperty(exports, "DiscordProvider", { enumerable: true, get: function () { return discord_1.DiscordProvider; } });
+var facebook_1 = require("./providers/facebook");
+Object.defineProperty(exports, "FacebookProvider", { enumerable: true, get: function () { return facebook_1.FacebookProvider; } });
+var custom_1 = require("./providers/custom");
+Object.defineProperty(exports, "CustomProvider", { enumerable: true, get: function () { return custom_1.CustomProvider; } });
+//# sourceMappingURL=index.js.map

package/dist/auth/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/oauth/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;AAEH,gFAAgF;AAChF,+BAMe;AALb,oGAAA,YAAY,OAAA;AACZ,6FAAA,KAAK,OAAA;AACL,4GAAA,oBAAoB,OAAA;AACpB,6GAAA,qBAAqB,OAAA;AACrB,qGAAA,aAAa,OAAA;AAGf,iFAAiF;AACjF,2CAAwE;AAA/D,2GAAA,aAAa,OAAA;AAAE,2GAAA,aAAa,OAAA;AAAE,yGAAA,WAAW,OAAA;AAElD,gFAAgF;AAChF,6CAAmD;AAA1C,wGAAA,cAAc,OAAA;AACvB,6CAAmD;AAA1C,wGAAA,cAAc,OAAA;AACvB,mDAAyD;AAAhD,8GAAA,iBAAiB,OAAA;AAC1B,+CAAqD;AAA5C,0GAAA,eAAe,OAAA;AACxB,iDAAuD;AAA9C,4GAAA,gBAAgB,OAAA;AACzB,6CAAmD;AAA1C,wGAAA,cAAc,OAAA"}

package/dist/auth/oauth/middleware.d.ts

@@ -0,0 +1,63 @@
+/**
+ * OAuth Middleware Helpers.
+ *
+ * Express-style middleware functions for handling OAuth redirects, callbacks,
+ * and authentication guards in ExisJS route handlers.
+ *
+ * @example
+ * ```ts
+ * import { oauthRedirect, oauthCallback, requireAuth } from 'exisjs/auth/oauth'
+ *
+ * app.get('/auth/google', oauthRedirect('google'))
+ * app.get('/auth/google/callback', oauthCallback('google', {
+ *   onSuccess: async (req, res, profile, tokens) => {
+ *     // Create or update user in your database
+ *     req.session.userId = profile.id
+ *     res.redirect('/dashboard')
+ *   },
+ * }))
+ *
+ * // Protect routes
+ * app.get('/dashboard', requireAuth(), (req, res) => {
+ *   res.json({ user: req.user })
+ * })
+ * ```
+ */
+import type { Request, Response, NextFunction } from '../../types';
+import type { OAuthCallbackOptions } from './types';
+/**
+ * Middleware that redirects the user to an OAuth provider's login page.
+ * Stores the state and code verifier in the user's session for validation on callback.
+ *
+ * @param provider The OAuth provider name (e.g. 'google', 'github')
+ * @param options Optional settings like additional params or disabling PKCE
+ */
+export declare function oauthRedirect(provider: string, options?: {
+    usePKCE?: boolean;
+    additionalParams?: Record<string, string>;
+    stateKey?: string;
+}): (req: Request, res: Response, _next: NextFunction) => void;
+/**
+ * Middleware that handles the OAuth callback from a provider.
+ * Validates the state, exchanges the authorization code for tokens,
+ * fetches the user profile, and calls the onSuccess callback.
+ *
+ * @param provider The OAuth provider name
+ * @param options Callback options including onSuccess and onError handlers
+ */
+export declare function oauthCallback(provider: string, options: OAuthCallbackOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/**
+ * Guard middleware that ensures the user is authenticated.
+ * Checks for `req.user` or `req.session.userId` to determine authentication status.
+ *
+ * @param options Configuration options
+ */
+export declare function requireAuth(options?: {
+    /** Custom function to check if the request is authenticated */
+    isAuthenticated?: (req: Request) => boolean;
+    /** URL to redirect to if not authenticated (for browser requests). If not set, returns 401 JSON */
+    redirectTo?: string;
+    /** Custom error message */
+    message?: string;
+}): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/oauth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAGlE,OAAO,KAAK,EAAE,oBAAoB,EAAkB,MAAM,SAAS,CAAA;AAKnE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,IAEO,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,OAAO,YAAY,UAuBzD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,IAG7D,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAkF9D;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE;IACpC,+DAA+D;IAC/D,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAA;IAC3C,mGAAmG;IACnG,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,IACS,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UA0BxD"}