faire-auth 1.0.0

package/dist/cookies-B5xeA6i8.cjs

@@ -0,0 +1,456 @@
+const require_chunk = require('./chunk-oakRccI5.cjs');
+const require_crypto = require('./crypto-CcTxYH82.cjs');
+const require_json = require('./json-CcJ2HjGo.cjs');
+let __faire_auth_core_env = require("@faire-auth/core/env");
+let __faire_auth_core_error = require("@faire-auth/core/error");
+let __faire_auth_core_static = require("@faire-auth/core/static");
+let __faire_auth_core_utils = require("@faire-auth/core/utils");
+let __faire_auth_core_datatypes = require("@faire-auth/core/datatypes");
+let hono_cookie = require("hono/cookie");
+hono_cookie = require_chunk.__toESM(hono_cookie);
+let hono_utils_cookie = require("hono/utils/cookie");
+
+//#region src/utils/cookies.ts
+var cookies_exports = /* @__PURE__ */ require_chunk.__export({
+	checkAuthCookie: () => checkAuthCookie,
+	createCookieCapture: () => createCookieCapture,
+	createCookieCreator: () => createCookieCreator,
+	createCookieSetter: () => createCookieSetter,
+	deleteSessionCookie: () => deleteSessionCookie,
+	getCookieCache: () => getCookieCache,
+	getCookieKey: () => getCookieKey,
+	getCookies: () => getCookies,
+	getSessionCookie: () => getSessionCookie,
+	parse: () => hono_utils_cookie.parse,
+	parseCookies: () => parseCookies,
+	parseSetCookieHeader: () => parseSetCookieHeader,
+	parseSigned: () => hono_utils_cookie.parseSigned,
+	serialize: () => hono_utils_cookie.serialize,
+	serializeSigned: () => hono_utils_cookie.serializeSigned,
+	serializeSignedCookie: () => serializeSignedCookie,
+	setCookieCache: () => setCookieCache,
+	setSessionCookie: () => setSessionCookie
+});
+require_chunk.__reExport(cookies_exports, require("hono/cookie"));
+const tryDecode = (str) => {
+	try {
+		return str.includes("%") ? decodeURIComponent(str) : str;
+	} catch {
+		return str;
+	}
+};
+const getCookieKey = (key, prefix) => {
+	let finalKey = key;
+	if (prefix) if (prefix === "secure") finalKey = `__Secure-${key}`;
+	else if (prefix === "host") finalKey = `__Host-${key}`;
+	else return;
+	return finalKey;
+};
+/**
+* Parse an HTTP Cookie header string and returning an object of all cookie
+* name-value pairs.
+*
+* Inspired by https://github.com/unjs/cookie-es/blob/main/src/cookie/parse.ts
+*
+* @param str the string representing a `Cookie` header value
+*/
+const parseCookies = (str) => {
+	if (typeof str !== "string") throw new TypeError("argument str must be a string");
+	const cookies = /* @__PURE__ */ new Map();
+	let index = 0;
+	while (index < str.length) {
+		const eqIdx = str.indexOf("=", index);
+		if (eqIdx === -1) break;
+		let endIdx = str.indexOf(";", index);
+		if (endIdx === -1) endIdx = str.length;
+		else if (endIdx < eqIdx) {
+			index = str.lastIndexOf(";", eqIdx - 1) + 1;
+			continue;
+		}
+		const key = str.slice(index, eqIdx).trim();
+		if (!cookies.has(key)) {
+			let val = str.slice(eqIdx + 1, endIdx).trim();
+			if (val.codePointAt(0) === 34) val = val.slice(1, -1);
+			cookies.set(key, tryDecode(val));
+		}
+		index = endIdx + 1;
+	}
+	return cookies;
+};
+const _serialize = (key, value, opt = {}) => {
+	let cookie;
+	if (opt.prefix === "secure") cookie = `__Secure-${key}=${value}`;
+	else if (opt.prefix === "host") cookie = `__Host-${key}=${value}`;
+	else cookie = `${key}=${value}`;
+	if (key.startsWith("__Secure-") && !(opt.secure ?? false)) opt.secure = true;
+	if (key.startsWith("__Host-")) {
+		if (!(opt.secure ?? false)) opt.secure = true;
+		if (opt.path !== "/") opt.path = "/";
+		if (opt.domain != null) delete opt.domain;
+	}
+	if (opt != null && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
+		if (opt.maxAge > 3456e4) throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");
+		cookie += `; Max-Age=${Math.floor(opt.maxAge)}`;
+	}
+	if (opt.domain != null && opt.prefix !== "host") cookie += `; Domain=${opt.domain}`;
+	if (opt.path != null) cookie += `; Path=${opt.path}`;
+	if (opt.expires) {
+		if (opt.expires.getTime() - Date.now() > 3456e7) throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");
+		cookie += `; Expires=${opt.expires.toUTCString()}`;
+	}
+	if (opt.httpOnly === true) cookie += "; HttpOnly";
+	if (opt.secure === true) cookie += "; Secure";
+	if (opt.sameSite) cookie += `; SameSite=${opt.sameSite.charAt(0).toUpperCase() + opt.sameSite.slice(1)}`;
+	if (opt.partitioned === true) {
+		if (!(opt.secure ?? false)) opt.secure = true;
+		cookie += "; Partitioned";
+	}
+	return cookie;
+};
+const serializeSignedCookie = async (key, value, secret, opt) => {
+	value = await (0, require_crypto.crypto_exports.signCookieValue)(value, secret);
+	return _serialize(key, value, opt);
+};
+const checkAuthCookie = async (request, auth) => {
+	const cookies = (request instanceof Headers ? request : request.headers).get("cookie");
+	if (cookies == null) return null;
+	const cookieName = ((0, __faire_auth_core_static.isPromise)(auth.$context) ? await auth.$context : auth.$context).authCookies.sessionToken.name;
+	const sessionToken = parseCookies(cookies).get(cookieName);
+	if (sessionToken != null) return sessionToken;
+	return null;
+};
+/**
+* Split attributes by semicolon, but respect that semicolons
+* might appear in attribute values (though this is rare in practice)
+*/
+const splitAttributes = (str) => {
+	const attributes = [];
+	let current = "";
+	let inQuotes = false;
+	for (let i = 0; i < str.length; i++) {
+		const char = str[i];
+		if (char === "\"" && (i === 0 || str[i - 1] !== "\\")) {
+			inQuotes = !inQuotes;
+			current += char;
+		} else if (char === ";" && !inQuotes) {
+			if (current.trim()) attributes.push(current.trim());
+			current = "";
+		} else current += char;
+	}
+	if (current.trim()) attributes.push(current.trim());
+	return attributes;
+};
+/**
+* IMPORTANT - each Set-Cookie header should be a single cookie
+*/
+const parseSetCookieHeader = (setCookie) => {
+	if (Array.isArray(setCookie)) return new Map(setCookie.flatMap((c) => [...parseSetCookieHeader(c)]));
+	const cookies = /* @__PURE__ */ new Map();
+	const nameValueMatch = setCookie.match(/^([^=]+)=([^;]*)/);
+	if (!nameValueMatch) return cookies;
+	const name = nameValueMatch[1]?.trim();
+	let value = nameValueMatch[2]?.trim() || "";
+	if (!name) return cookies;
+	if (value.startsWith("\"") && value.endsWith("\"") && value.length >= 2) {
+		value = value.slice(1, -1);
+		value = value.replace(/\\"/g, "\"");
+	}
+	const attrObj = { value };
+	const firstSemicolon = setCookie.indexOf(";", nameValueMatch[0].length);
+	if (firstSemicolon === -1) {
+		cookies.set(name, attrObj);
+		return cookies;
+	}
+	splitAttributes(setCookie.slice(firstSemicolon + 1)).forEach((attribute) => {
+		const eqIndex = attribute.indexOf("=");
+		const attrName = eqIndex === -1 ? attribute.trim() : attribute.slice(0, eqIndex).trim();
+		const attrValue = eqIndex === -1 ? "" : attribute.slice(eqIndex + 1).trim();
+		const normalizedAttrName = attrName.toLowerCase();
+		switch (normalizedAttrName) {
+			case "max-age": {
+				const maxAge = attrValue ? Number.parseInt(attrValue, 10) : void 0;
+				if (!Number.isNaN(maxAge) && maxAge != null) attrObj["max-age"] = maxAge;
+				break;
+			}
+			case "expires": {
+				const expires = attrValue ? new Date(attrValue) : void 0;
+				if (expires && !Number.isNaN(expires.getTime())) attrObj.expires = expires;
+				break;
+			}
+			case "domain":
+				if (attrValue) attrObj.domain = attrValue;
+				break;
+			case "path":
+				if (attrValue) attrObj.path = attrValue;
+				break;
+			case "secure":
+				attrObj.secure = true;
+				break;
+			case "httponly":
+				attrObj.httponly = true;
+				break;
+			case "samesite": {
+				const samesite = attrValue.toLowerCase();
+				if ([
+					"lax",
+					"none",
+					"strict"
+				].includes(samesite)) attrObj.samesite = samesite;
+				break;
+			}
+			case "partitioned":
+				attrObj.partitioned = true;
+				break;
+			default:
+				if (normalizedAttrName) attrObj[normalizedAttrName] = attrValue || true;
+				break;
+		}
+	});
+	cookies.set(name, attrObj);
+	return cookies;
+};
+const createCookieCreator = (options) => {
+	const secureCookiePrefix = (options.advanced?.useSecureCookies !== void 0 ? options.advanced.useSecureCookies : options.baseURL !== void 0 ? options.baseURL.startsWith("https://") ? true : false : (0, __faire_auth_core_env.isProduction)()) ? "__Secure-" : "";
+	const crossSubdomainEnabled = options.advanced?.crossSubDomainCookies?.enabled === true;
+	const domain = crossSubdomainEnabled ? options.advanced?.crossSubDomainCookies?.domain ?? (options.baseURL != null ? new URL(options.baseURL).hostname : void 0) : void 0;
+	if (crossSubdomainEnabled && domain == null) throw new __faire_auth_core_error.FaireAuthError("baseURL is required when crossSubdomainCookies are enabled");
+	const createCookie = (cookieName, overrideAttributes = {}) => {
+		const prefix = options.advanced?.cookiePrefix ?? "faire-auth";
+		const name = options.advanced?.cookies?.[cookieName]?.name ?? `${prefix}.${cookieName}`;
+		const attributes = options.advanced?.cookies?.[cookieName]?.attributes;
+		return {
+			name: `${secureCookiePrefix}${name}`,
+			attributes: {
+				secure: !!secureCookiePrefix,
+				sameSite: "lax",
+				path: "/",
+				httpOnly: true,
+				...crossSubdomainEnabled ? { domain } : {},
+				...options.advanced?.defaultCookieAttributes,
+				...overrideAttributes,
+				...attributes
+			}
+		};
+	};
+	return createCookie;
+};
+const getCookies = (options) => {
+	const createCookie = createCookieCreator(options);
+	const sessionToken = createCookie("session_token", { maxAge: options.session?.expiresIn ?? (0, __faire_auth_core_utils.createTime)(7, "d").toSeconds() });
+	const sessionData = createCookie("session_data", { maxAge: options.session?.cookieCache?.maxAge ?? 300 });
+	const dontRememberToken = createCookie("dont_remember");
+	return {
+		sessionToken: {
+			name: sessionToken.name,
+			options: sessionToken.attributes
+		},
+		sessionData: {
+			name: sessionData.name,
+			options: sessionData.attributes
+		},
+		dontRememberToken: {
+			name: dontRememberToken.name,
+			options: dontRememberToken.attributes
+		}
+	};
+};
+const serializeCookies = (cookies) => Array.from(cookies, ([key, value]) => value ? `${key}=${value}` : "").filter(Boolean).join("; ");
+const createCookieSetter = (headers) => (name, value) => {
+	const cookieMap = parseCookies(headers.get("cookie") ?? "");
+	cookieMap.set(name, value);
+	headers.set("cookie", serializeCookies(cookieMap));
+};
+const createCookieCapture = (headers) => (callback) => (context) => {
+	const setCookieHeader = context.response.headers.getSetCookie();
+	if (setCookieHeader.length === 0) return;
+	const cookieMap = new Map([...parseCookies(headers.get("cookie") ?? ""), ...Array.from(parseSetCookieHeader(setCookieHeader), ([key, value]) => [key, value.value])]);
+	headers.set("cookie", serializeCookies(cookieMap));
+	if (callback) callback(cookieMap);
+};
+const getCookieCache = async (request, config) => {
+	const cookies = (request instanceof Headers ? request : request.headers).get("cookie");
+	if (cookies == null) return null;
+	const { cookieName = "session_data", cookiePrefix = "faire-auth" } = config ?? {};
+	const name = config?.isSecure !== void 0 ? config.isSecure ? `__Secure-${cookiePrefix}.${cookieName}` : `${cookiePrefix}.${cookieName}` : (0, __faire_auth_core_env.isProduction)() ? `__Secure-${cookiePrefix}.${cookieName}` : `${cookiePrefix}.${cookieName}`;
+	const sessionData = parseCookies(cookies).get(name);
+	if (sessionData != null) {
+		const sessionDataPayload = require_json.safeJSONParse(__faire_auth_core_datatypes.binary.decode(__faire_auth_core_datatypes.base64Url.decode(sessionData)));
+		if (!sessionDataPayload) return null;
+		const secret = config?.secret ?? __faire_auth_core_env.env["FAIRE_AUTH_SECRET"];
+		if (secret == null) throw new __faire_auth_core_error.FaireAuthError("getCookieCache requires a secret to be provided. Either pass it as an option or set the FAIRE_AUTH_SECRET environment variable");
+		if (!await (0, __faire_auth_core_datatypes.createHMAC)("SHA-256", "base64urlnopad").verify(secret, JSON.stringify({
+			...sessionDataPayload.session,
+			expiresAt: sessionDataPayload.expiresAt
+		}), sessionDataPayload.signature)) return null;
+		return sessionDataPayload.session;
+	}
+	return null;
+};
+const setCookieCache = async (ctx, options, session, dontRememberMe = false) => {
+	const context = ctx.get("context");
+	if (options.session?.cookieCache?.enabled === true) {
+		const sessionData = {
+			session: Object.entries(session.session).reduce((acc, [key, value]) => {
+				const fieldConfig = options.session?.additionalFields?.[key];
+				if (!fieldConfig || fieldConfig.returned !== false) acc[key] = value;
+				return acc;
+			}, {}),
+			user: session.user
+		};
+		const cookieOptions = {
+			...context.authCookies.sessionData.options,
+			...dontRememberMe && { maxAge: context.authCookies.sessionData.options.maxAge }
+		};
+		const expiresAtDate = (0, __faire_auth_core_utils.getDate)(cookieOptions.maxAge || 60, "sec").getTime();
+		const data = __faire_auth_core_datatypes.base64Url.encode(JSON.stringify({
+			session: sessionData,
+			expiresAt: expiresAtDate,
+			signature: await (0, __faire_auth_core_datatypes.createHMAC)("SHA-256", "base64urlnopad").sign(context.secret, JSON.stringify({
+				...sessionData,
+				expiresAt: expiresAtDate
+			}))
+		}), { padding: false });
+		if (data.length > 4093) throw new __faire_auth_core_error.FaireAuthError("Session data is too large to store in the cookie. Please disable session cookie caching or reduce the size of the session data");
+		hono_cookie.setCookie(ctx, context.authCookies.sessionData.name, data, cookieOptions);
+	}
+};
+const getSessionCookie = (request, config) => {
+	if (config?.cookiePrefix != null) if (config.cookieName != null) config.cookiePrefix = `${config.cookiePrefix}-`;
+	else config.cookiePrefix = `${config.cookiePrefix}.`;
+	const cookies = ("headers" in request ? request.headers : request).get("cookie");
+	if (cookies == null) return null;
+	const { cookieName = "session_token", cookiePrefix = "faire-auth." } = config ?? {};
+	const name = `${cookiePrefix}${cookieName}`;
+	const secureCookieName = `__Secure-${name}`;
+	const parsedCookie = parseCookies(cookies);
+	const sessionToken = parsedCookie.get(name) ?? parsedCookie.get(secureCookieName);
+	if (sessionToken != null) return sessionToken;
+	return null;
+};
+const setSessionCookie = (ctx, authOptions, session, dontRememberMe, overrides) => {
+	const context = ctx.get("context");
+	return hono_cookie.getSignedCookie(ctx, context.secret, context.authCookies.dontRememberToken.name).then((dontRememberMeCookie) => {
+		dontRememberMe ??= !!dontRememberMeCookie;
+		const options = { ...context.authCookies.sessionToken.options };
+		if (dontRememberMe === true) delete options.maxAge;
+		else options.maxAge = context.sessionConfig.expiresIn;
+		return hono_cookie.setSignedCookie(ctx, context.authCookies.sessionToken.name, session.session.token, context.secret, {
+			...options,
+			...overrides
+		});
+	}).then(() => {
+		if (dontRememberMe === true) return hono_cookie.setSignedCookie(ctx, context.authCookies.dontRememberToken.name, "true", context.secret, context.authCookies.dontRememberToken.options);
+		return Promise.resolve();
+	}).then(() => {
+		if (authOptions.session?.cookieCache?.enabled === true) return setCookieCache(ctx, authOptions, session, dontRememberMe);
+		return Promise.resolve();
+	}).then(() => {
+		context.newSession = session;
+		if (authOptions.secondaryStorage) {
+			const maybePromise = context.secondaryStorage?.set(session.session.token, JSON.stringify({
+				user: session.user,
+				session: session.session
+			}), Math.floor((new Date(session.session.expiresAt).getTime() - Date.now()) / 1e3));
+			if ((0, __faire_auth_core_static.isPromise)(maybePromise)) return maybePromise;
+		}
+		return Promise.resolve();
+	});
+};
+const deleteSessionCookie = (ctx, skipDontRememberMe) => {
+	const context = ctx.get("context");
+	hono_cookie.deleteCookie(ctx, context.authCookies.sessionToken.name, context.authCookies.sessionToken.options);
+	hono_cookie.deleteCookie(ctx, context.authCookies.sessionData.name, context.authCookies.sessionData.options);
+	if (!skipDontRememberMe) hono_cookie.deleteCookie(ctx, context.authCookies.dontRememberToken.name, context.authCookies.dontRememberToken.options);
+};
+
+//#endregion
+Object.defineProperty(exports, 'checkAuthCookie', {
+  enumerable: true,
+  get: function () {
+    return checkAuthCookie;
+  }
+});
+Object.defineProperty(exports, 'cookies_exports', {
+  enumerable: true,
+  get: function () {
+    return cookies_exports;
+  }
+});
+Object.defineProperty(exports, 'createCookieCapture', {
+  enumerable: true,
+  get: function () {
+    return createCookieCapture;
+  }
+});
+Object.defineProperty(exports, 'createCookieCreator', {
+  enumerable: true,
+  get: function () {
+    return createCookieCreator;
+  }
+});
+Object.defineProperty(exports, 'createCookieSetter', {
+  enumerable: true,
+  get: function () {
+    return createCookieSetter;
+  }
+});
+Object.defineProperty(exports, 'deleteSessionCookie', {
+  enumerable: true,
+  get: function () {
+    return deleteSessionCookie;
+  }
+});
+Object.defineProperty(exports, 'getCookieCache', {
+  enumerable: true,
+  get: function () {
+    return getCookieCache;
+  }
+});
+Object.defineProperty(exports, 'getCookieKey', {
+  enumerable: true,
+  get: function () {
+    return getCookieKey;
+  }
+});
+Object.defineProperty(exports, 'getCookies', {
+  enumerable: true,
+  get: function () {
+    return getCookies;
+  }
+});
+Object.defineProperty(exports, 'getSessionCookie', {
+  enumerable: true,
+  get: function () {
+    return getSessionCookie;
+  }
+});
+Object.defineProperty(exports, 'parseCookies', {
+  enumerable: true,
+  get: function () {
+    return parseCookies;
+  }
+});
+Object.defineProperty(exports, 'parseSetCookieHeader', {
+  enumerable: true,
+  get: function () {
+    return parseSetCookieHeader;
+  }
+});
+Object.defineProperty(exports, 'serializeSignedCookie', {
+  enumerable: true,
+  get: function () {
+    return serializeSignedCookie;
+  }
+});
+Object.defineProperty(exports, 'setCookieCache', {
+  enumerable: true,
+  get: function () {
+    return setCookieCache;
+  }
+});
+Object.defineProperty(exports, 'setSessionCookie', {
+  enumerable: true,
+  get: function () {
+    return setSessionCookie;
+  }
+});