faire-auth 1.0.0

package/dist/oauth2-BLeOEi7Y.cjs

@@ -0,0 +1,177 @@
+const require_chunk = require('./chunk-oakRccI5.cjs');
+const require_crypto = require('./crypto-CcTxYH82.cjs');
+const require_email_verification = require('./email-verification-C-AsfJsb.cjs');
+let __faire_auth_core_env = require("@faire-auth/core/env");
+let __faire_auth_core_error = require("@faire-auth/core/error");
+
+//#region src/oauth2/utils.ts
+const decryptOAuthToken = (token, ctx, options) => {
+	if (!token) return token;
+	if (options.account?.encryptOAuthTokens) return (0, require_crypto.crypto_exports.symmetricDecrypt)({
+		key: ctx.get("context").secret,
+		data: token
+	});
+	return token;
+};
+const setTokenUtil = (token, ctx, options) => {
+	if (options.account?.encryptOAuthTokens && token) return (0, require_crypto.crypto_exports.symmetricEncrypt)({
+		key: ctx.get("context").secret,
+		data: token
+	});
+	return token;
+};
+
+//#endregion
+//#region src/oauth2/link-account.ts
+const handleOAuthUserInfo = async (ctx, { userInfo, account, callbackURL, disableSignUp, overrideUserInfo }, options) => {
+	const context = ctx.get("context");
+	const redirectOnError = (reason) => {
+		const errorURL = options.onAPIError?.errorURL ?? `${context.baseURL}/error`;
+		return {
+			type: "redirect",
+			response: ctx.redirect(`${errorURL}?error=${reason}`, 302)
+		};
+	};
+	const dbUser = await context.internalAdapter.findOAuthUser(userInfo.email.toLowerCase(), account.accountId, account.providerId).catch((e) => {
+		__faire_auth_core_env.logger.error("Better auth was unable to query your database.\nError: ", e);
+		return "error";
+	});
+	if (dbUser === "error") return redirectOnError("internal_server_error");
+	let user = dbUser?.user ?? null;
+	const isRegister = user == null;
+	if (dbUser) {
+		const hasBeenLinked = dbUser.accounts.find((a) => a.providerId === account.providerId && a.accountId === account.accountId);
+		if (!hasBeenLinked) {
+			if (!(options.account?.accountLinking?.trustedProviders)?.includes(account.providerId) && !userInfo.emailVerified || options.account?.accountLinking?.enabled === false) {
+				if ((0, __faire_auth_core_env.isDevelopment)()) __faire_auth_core_env.logger.warn(`User already exist but account isn't linked to ${account.providerId}. To read more about how account linking works in Faire Auth see https://www.faire-auth.com/docs/concepts/users-accounts#account-linking.`);
+				return {
+					type: "error",
+					reason: "account_not_linked"
+				};
+			}
+			try {
+				await context.internalAdapter.linkAccount({
+					providerId: account.providerId,
+					accountId: userInfo.id.toString(),
+					userId: dbUser.user.id,
+					accessToken: await setTokenUtil(account.accessToken, ctx, options),
+					refreshToken: await setTokenUtil(account.refreshToken, ctx, options),
+					idToken: account.idToken,
+					accessTokenExpiresAt: account.accessTokenExpiresAt,
+					refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+					scope: account.scope
+				});
+			} catch (e) {
+				__faire_auth_core_env.logger.error("Unable to link account", e);
+				return {
+					type: "error",
+					reason: "unable_to_link_account"
+				};
+			}
+			if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
+		} else {
+			if (options.account?.updateAccountOnSignIn !== false) {
+				const updateData = Object.fromEntries(Object.entries({
+					idToken: account.idToken,
+					accessToken: await setTokenUtil(account.accessToken, ctx, options),
+					refreshToken: await setTokenUtil(account.refreshToken, ctx, options),
+					accessTokenExpiresAt: account.accessTokenExpiresAt,
+					refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+					scope: account.scope
+				}).filter(([, value]) => value !== void 0 && value !== ""));
+				if (Object.keys(updateData).length > 0) await context.internalAdapter.updateAccount(hasBeenLinked.id, updateData);
+			}
+			if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
+		}
+		if (overrideUserInfo === true) {
+			const { id: _,...restUserInfo } = userInfo;
+			await context.internalAdapter.updateUser(dbUser.user.id, {
+				...restUserInfo,
+				email: userInfo.email.toLowerCase(),
+				emailVerified: userInfo.email.toLowerCase() === dbUser.user.email ? dbUser.user.emailVerified || userInfo.emailVerified : userInfo.emailVerified
+			});
+		}
+	} else {
+		if (disableSignUp === true) return {
+			type: "error",
+			reason: "signup_disabled",
+			isRegister: false
+		};
+		try {
+			const { id: _,...restUserInfo } = userInfo;
+			user = await context.internalAdapter.createOAuthUser({
+				...restUserInfo,
+				email: userInfo.email.toLowerCase()
+			}, {
+				accessToken: await setTokenUtil(account.accessToken, ctx, options),
+				refreshToken: await setTokenUtil(account.refreshToken, ctx, options),
+				idToken: account.idToken,
+				accessTokenExpiresAt: account.accessTokenExpiresAt,
+				refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+				scope: account.scope,
+				providerId: account.providerId,
+				accountId: userInfo.id.toString()
+			}).then((res) => res.user);
+			if (!userInfo.emailVerified && user && options.emailVerification?.sendOnSignUp === true) {
+				const token = await require_email_verification.createEmailVerificationToken(context.secret, user.email, void 0, options.emailVerification.expiresIn);
+				const url = `${context.baseURL}/verify-email?token=${token}${callbackURL ? `&callbackURL=${callbackURL}` : ""}`;
+				await options.emailVerification.sendVerificationEmail?.({
+					user,
+					url,
+					token
+				}, ctx);
+			}
+		} catch (e) {
+			__faire_auth_core_env.logger.error(e instanceof Error ? e.message : String(e), e);
+			if (e instanceof __faire_auth_core_error.APIError) return {
+				type: "error",
+				reason: e.message,
+				isRegister: false
+			};
+			return {
+				type: "error",
+				reason: "unable_to_create_user",
+				isRegister: false
+			};
+		}
+	}
+	if (!user) return {
+		type: "error",
+		reason: "unable_to_create_user",
+		isRegister: false
+	};
+	const session = await context.internalAdapter.createSession(user.id);
+	if (!session) return {
+		type: "error",
+		reason: "unable_to_create_session",
+		isRegister: false
+	};
+	return {
+		type: "success",
+		data: {
+			session,
+			user
+		},
+		isRegister
+	};
+};
+
+//#endregion
+Object.defineProperty(exports, 'decryptOAuthToken', {
+  enumerable: true,
+  get: function () {
+    return decryptOAuthToken;
+  }
+});
+Object.defineProperty(exports, 'handleOAuthUserInfo', {
+  enumerable: true,
+  get: function () {
+    return handleOAuthUserInfo;
+  }
+});
+Object.defineProperty(exports, 'setTokenUtil', {
+  enumerable: true,
+  get: function () {
+    return setTokenUtil;
+  }
+});

package/dist/origin-check-8Gajklvh.mjs

@@ -0,0 +1,228 @@
+import { a as getTrustedOrigins, i as getProtocol, n as getHost, r as getOrigin } from "./url-BoUuoIwZ.mjs";
+import { r as createMiddleware } from "./middleware-CE6OhDkq.mjs";
+import { logger } from "@faire-auth/core/env";
+import { False, isPromise } from "@faire-auth/core/static";
+
+//#region src/utils/wildcard.ts
+/**
+* Escapes a character if it has a special meaning in regular expressions
+* and returns the character as is if it doesn't
+*/
+const escapeRegExpChar = (char) => {
+	if (char === "-" || char === "^" || char === "$" || char === "+" || char === "." || char === "(" || char === ")" || char === "|" || char === "[" || char === "]" || char === "{" || char === "}" || char === "*" || char === "?" || char === "\\") return `\\${char}`;
+	return char;
+};
+/**
+* Escapes all characters in a given string that have a special meaning in regular expressions
+*/
+const escapeRegExpString = (str) => {
+	let result = "";
+	for (const char of str) result += escapeRegExpChar(char);
+	return result;
+};
+/**
+* Transforms one or more glob patterns into a RegExp pattern
+*/
+const transform = (pattern, separator = true) => {
+	if (Array.isArray(pattern)) return `(?:${pattern.map((p) => `^${transform(p, separator)}$`).join("|")})`;
+	const truthySeparator = typeof separator === "string" || separator;
+	let separatorSplitter = "";
+	let separatorMatcher = "";
+	let wildcard = ".";
+	if (separator === true) {
+		separatorSplitter = "/";
+		separatorMatcher = "[/\\\\]";
+		wildcard = "[^/\\\\]";
+	} else if (typeof separator === "string") {
+		separatorSplitter = separator;
+		separatorMatcher = escapeRegExpString(separatorSplitter);
+		if (separatorMatcher.length > 1) {
+			separatorMatcher = `(?:${separatorMatcher})`;
+			wildcard = `((?!${separatorMatcher}).)`;
+		} else wildcard = `[^${separatorMatcher}]`;
+	}
+	const requiredSeparator = truthySeparator ? `${separatorMatcher}+?` : "";
+	const optionalSeparator = truthySeparator ? `${separatorMatcher}*?` : "";
+	const segments = truthySeparator ? pattern.split(separatorSplitter) : [pattern];
+	let result = "";
+	for (let s = 0; s < segments.length; s++) {
+		const segment = segments[s];
+		const nextSegment = segments[s + 1];
+		let currentSeparator = "";
+		if (segment == null && s > 0) continue;
+		if (truthySeparator) if (s === segments.length - 1) currentSeparator = optionalSeparator;
+		else if (nextSegment !== "**") currentSeparator = requiredSeparator;
+		else currentSeparator = "";
+		if (truthySeparator && segment === "**") {
+			if (currentSeparator) {
+				result += s === 0 ? "" : currentSeparator;
+				result += `(?:${wildcard}*?${currentSeparator})*?`;
+			}
+			continue;
+		}
+		if (segment != null) for (let c = 0; c < segment.length; c++) {
+			const char = segment[c];
+			switch (char) {
+				case "\\":
+					if (c < segment.length - 1) {
+						result += escapeRegExpChar(segment[c + 1]);
+						c++;
+					}
+					break;
+				case "?":
+					result += wildcard;
+					break;
+				case "*":
+					result += `${wildcard}*?`;
+					break;
+				default: if (char != null) result += escapeRegExpChar(char);
+			}
+		}
+		result += currentSeparator;
+	}
+	return result;
+};
+const isMatch = (regexp, sample) => {
+	if (typeof sample !== "string") throw new TypeError(`Sample must be a string, but ${typeof sample} given`);
+	return regexp.test(sample);
+};
+/**
+* Compiles one or more glob patterns into a RegExp and returns an isMatch function.
+* The isMatch function takes a sample string as its only argument and returns `true`
+* if the string matches the pattern(s).
+*
+* ```js
+* wildcardMatch('src/*.js')('src/index.js') //=> true
+* ```
+*
+* ```js
+* const isMatch = wildcardMatch('*.example.com', '.')
+* isMatch('foo.example.com') //=> true
+* isMatch('foo.bar.com') //=> false
+* ```
+*/
+function wildcardMatch(pattern, options) {
+	if (typeof pattern !== "string" && !Array.isArray(pattern)) throw new TypeError(`The first argument must be a single pattern string or an array of patterns, but ${typeof pattern} given`);
+	if (typeof options === "string" || typeof options === "boolean") options = { separator: options };
+	if (arguments.length === 2 && !(typeof options === "undefined" || typeof options === "object" && options !== null && !Array.isArray(options))) throw new TypeError(`The second argument must be an options object or a string/boolean separator, but ${typeof options} given`);
+	options = options ?? {};
+	if (options.separator === "\\") throw new Error("\\ is not a valid separator because it is used for escaping. Try setting the separator to `true` instead");
+	const regexpPattern = transform(pattern, options.separator);
+	const regexp = new RegExp(`^${regexpPattern}$`, options.flags);
+	const fn = isMatch.bind(null, regexp);
+	fn.options = options;
+	fn.pattern = pattern;
+	fn.regexp = regexp;
+	return fn;
+}
+
+//#endregion
+//#region src/api/middleware/origin-check.ts
+const RELATIVE_PATH_RE = /^\/(?!\/|\\|%2f|%5c)[\w\-.\+/@]*(?:\?[\w\-.\+/=&%@]*)?$/;
+const matchesPattern = (url, pattern) => {
+	if (url.startsWith("/")) return false;
+	if (pattern.includes("*")) {
+		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
+		return wildcardMatch(pattern)(getHost(url));
+	}
+	const protocol = getProtocol(url);
+	return protocol === "http:" || protocol === "https:" || !protocol ? pattern === getOrigin(url) : url.startsWith(pattern);
+};
+const validateURL = (url, label, trustedOrigins, logger$1, ctx) => {
+	if (url == null) return null;
+	let isTrustedOrigin = false;
+	trustedOrigins.forEach((origin) => {
+		if (isTrustedOrigin === false && (matchesPattern(url, origin) || url.startsWith("/") && label !== "origin" && RELATIVE_PATH_RE.test(url))) isTrustedOrigin = true;
+	});
+	if (!isTrustedOrigin) {
+		logger$1.error(`Invalid ${label}: ${url}`);
+		logger$1.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${[...trustedOrigins].join(", ")}`);
+		return ctx.json({
+			success: False,
+			message: `Invalid ${label}`
+		}, 403);
+	}
+	return null;
+};
+/**
+* A middleware to validate callbackURL and origin against
+* trustedOrigins.
+*/
+const initOriginCheckMiddleware = (options, context) => {
+	const log = {
+		info: (message, ...args) => options.logger?.log?.("info", message, ...args) ?? logger.info,
+		error: (message, ...args) => options.logger?.log?.("error", message, ...args) ?? logger.error
+	};
+	return createMiddleware()(async (ctx, next) => {
+		if (ctx.get("isServer") === true || ctx.req.method !== "POST") return await next();
+		const needsBody = [
+			"POST",
+			"PUT",
+			"PATCH"
+		].includes(ctx.req.method);
+		const usesCookies = ctx.req.header("cookie") != null;
+		const originHeader = ctx.req.header("origin") ?? ctx.req.header("referer");
+		const queryCallbackURL = ctx.req.query("callbackURL");
+		const { ready, dynamicPromise, trustedOrigins } = getTrustedOrigins(options, context, ctx.req);
+		let body = null;
+		if (needsBody) try {
+			body = await ctx.req.raw.clone().json();
+		} catch {}
+		const callbackURL = body?.callbackURL ?? queryCallbackURL;
+		const redirectURL = body?.redirectTo;
+		const errorCallbackURL = body?.errorCallbackURL;
+		const newUserCallbackURL = body?.newUserCallbackURL;
+		let ret = null;
+		if (usesCookies && !options.advanced?.disableCSRFCheck) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(originHeader, "origin", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		if (callbackURL != null) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(callbackURL, "callbackURL", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		if (redirectURL != null) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(redirectURL, "redirectURL", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		if (errorCallbackURL != null) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(errorCallbackURL, "errorCallbackURL", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		if (newUserCallbackURL != null) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(newUserCallbackURL, "newUserCallbackURL", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		return await next();
+	});
+};
+/**
+* Validates callback URLs against trusted origins.
+* @template V - The context variables type.
+* @param getValue - Function to get the callback URL(s) from the context.
+* @returns The middleware function.
+*/
+const originCheck = (getValue) => {
+	return createMiddleware()(async (ctx, next) => {
+		if (ctx.get("isServer") === true) return await next();
+		const context = ctx.get("context");
+		let callbackURL = getValue(ctx);
+		if (isPromise(callbackURL)) callbackURL = await callbackURL;
+		if (!callbackURL) return await next();
+		const callbacks = Array.isArray(callbackURL) ? callbackURL : [callbackURL];
+		let ret;
+		for (const url of callbacks) {
+			ret = validateURL(url, "callbackURL", context.trustedOrigins, context.logger, ctx);
+			if (ret) return ret;
+		}
+		return await next();
+	});
+};
+
+//#endregion
+export { originCheck as n, wildcardMatch as r, initOriginCheckMiddleware as t };

package/dist/origin-check-id9lTnqZ.cjs

@@ -0,0 +1,246 @@
+const require_chunk = require('./chunk-oakRccI5.cjs');
+const require_url = require('./url-D2yvKaM7.cjs');
+const require_middleware = require('./middleware-CWvRH4EW.cjs');
+let __faire_auth_core_env = require("@faire-auth/core/env");
+let __faire_auth_core_static = require("@faire-auth/core/static");
+
+//#region src/utils/wildcard.ts
+/**
+* Escapes a character if it has a special meaning in regular expressions
+* and returns the character as is if it doesn't
+*/
+const escapeRegExpChar = (char) => {
+	if (char === "-" || char === "^" || char === "$" || char === "+" || char === "." || char === "(" || char === ")" || char === "|" || char === "[" || char === "]" || char === "{" || char === "}" || char === "*" || char === "?" || char === "\\") return `\\${char}`;
+	return char;
+};
+/**
+* Escapes all characters in a given string that have a special meaning in regular expressions
+*/
+const escapeRegExpString = (str) => {
+	let result = "";
+	for (const char of str) result += escapeRegExpChar(char);
+	return result;
+};
+/**
+* Transforms one or more glob patterns into a RegExp pattern
+*/
+const transform = (pattern, separator = true) => {
+	if (Array.isArray(pattern)) return `(?:${pattern.map((p) => `^${transform(p, separator)}$`).join("|")})`;
+	const truthySeparator = typeof separator === "string" || separator;
+	let separatorSplitter = "";
+	let separatorMatcher = "";
+	let wildcard = ".";
+	if (separator === true) {
+		separatorSplitter = "/";
+		separatorMatcher = "[/\\\\]";
+		wildcard = "[^/\\\\]";
+	} else if (typeof separator === "string") {
+		separatorSplitter = separator;
+		separatorMatcher = escapeRegExpString(separatorSplitter);
+		if (separatorMatcher.length > 1) {
+			separatorMatcher = `(?:${separatorMatcher})`;
+			wildcard = `((?!${separatorMatcher}).)`;
+		} else wildcard = `[^${separatorMatcher}]`;
+	}
+	const requiredSeparator = truthySeparator ? `${separatorMatcher}+?` : "";
+	const optionalSeparator = truthySeparator ? `${separatorMatcher}*?` : "";
+	const segments = truthySeparator ? pattern.split(separatorSplitter) : [pattern];
+	let result = "";
+	for (let s = 0; s < segments.length; s++) {
+		const segment = segments[s];
+		const nextSegment = segments[s + 1];
+		let currentSeparator = "";
+		if (segment == null && s > 0) continue;
+		if (truthySeparator) if (s === segments.length - 1) currentSeparator = optionalSeparator;
+		else if (nextSegment !== "**") currentSeparator = requiredSeparator;
+		else currentSeparator = "";
+		if (truthySeparator && segment === "**") {
+			if (currentSeparator) {
+				result += s === 0 ? "" : currentSeparator;
+				result += `(?:${wildcard}*?${currentSeparator})*?`;
+			}
+			continue;
+		}
+		if (segment != null) for (let c = 0; c < segment.length; c++) {
+			const char = segment[c];
+			switch (char) {
+				case "\\":
+					if (c < segment.length - 1) {
+						result += escapeRegExpChar(segment[c + 1]);
+						c++;
+					}
+					break;
+				case "?":
+					result += wildcard;
+					break;
+				case "*":
+					result += `${wildcard}*?`;
+					break;
+				default: if (char != null) result += escapeRegExpChar(char);
+			}
+		}
+		result += currentSeparator;
+	}
+	return result;
+};
+const isMatch = (regexp, sample) => {
+	if (typeof sample !== "string") throw new TypeError(`Sample must be a string, but ${typeof sample} given`);
+	return regexp.test(sample);
+};
+/**
+* Compiles one or more glob patterns into a RegExp and returns an isMatch function.
+* The isMatch function takes a sample string as its only argument and returns `true`
+* if the string matches the pattern(s).
+*
+* ```js
+* wildcardMatch('src/*.js')('src/index.js') //=> true
+* ```
+*
+* ```js
+* const isMatch = wildcardMatch('*.example.com', '.')
+* isMatch('foo.example.com') //=> true
+* isMatch('foo.bar.com') //=> false
+* ```
+*/
+function wildcardMatch(pattern, options) {
+	if (typeof pattern !== "string" && !Array.isArray(pattern)) throw new TypeError(`The first argument must be a single pattern string or an array of patterns, but ${typeof pattern} given`);
+	if (typeof options === "string" || typeof options === "boolean") options = { separator: options };
+	if (arguments.length === 2 && !(typeof options === "undefined" || typeof options === "object" && options !== null && !Array.isArray(options))) throw new TypeError(`The second argument must be an options object or a string/boolean separator, but ${typeof options} given`);
+	options = options ?? {};
+	if (options.separator === "\\") throw new Error("\\ is not a valid separator because it is used for escaping. Try setting the separator to `true` instead");
+	const regexpPattern = transform(pattern, options.separator);
+	const regexp = new RegExp(`^${regexpPattern}$`, options.flags);
+	const fn = isMatch.bind(null, regexp);
+	fn.options = options;
+	fn.pattern = pattern;
+	fn.regexp = regexp;
+	return fn;
+}
+
+//#endregion
+//#region src/api/middleware/origin-check.ts
+const RELATIVE_PATH_RE = /^\/(?!\/|\\|%2f|%5c)[\w\-.\+/@]*(?:\?[\w\-.\+/=&%@]*)?$/;
+const matchesPattern = (url, pattern) => {
+	if (url.startsWith("/")) return false;
+	if (pattern.includes("*")) {
+		if (pattern.includes("://")) return wildcardMatch(pattern)(require_url.getOrigin(url) || url);
+		return wildcardMatch(pattern)(require_url.getHost(url));
+	}
+	const protocol = require_url.getProtocol(url);
+	return protocol === "http:" || protocol === "https:" || !protocol ? pattern === require_url.getOrigin(url) : url.startsWith(pattern);
+};
+const validateURL = (url, label, trustedOrigins, logger$1, ctx) => {
+	if (url == null) return null;
+	let isTrustedOrigin = false;
+	trustedOrigins.forEach((origin) => {
+		if (isTrustedOrigin === false && (matchesPattern(url, origin) || url.startsWith("/") && label !== "origin" && RELATIVE_PATH_RE.test(url))) isTrustedOrigin = true;
+	});
+	if (!isTrustedOrigin) {
+		logger$1.error(`Invalid ${label}: ${url}`);
+		logger$1.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${[...trustedOrigins].join(", ")}`);
+		return ctx.json({
+			success: __faire_auth_core_static.False,
+			message: `Invalid ${label}`
+		}, 403);
+	}
+	return null;
+};
+/**
+* A middleware to validate callbackURL and origin against
+* trustedOrigins.
+*/
+const initOriginCheckMiddleware = (options, context) => {
+	const log = {
+		info: (message, ...args) => options.logger?.log?.("info", message, ...args) ?? __faire_auth_core_env.logger.info,
+		error: (message, ...args) => options.logger?.log?.("error", message, ...args) ?? __faire_auth_core_env.logger.error
+	};
+	return require_middleware.createMiddleware()(async (ctx, next) => {
+		if (ctx.get("isServer") === true || ctx.req.method !== "POST") return await next();
+		const needsBody = [
+			"POST",
+			"PUT",
+			"PATCH"
+		].includes(ctx.req.method);
+		const usesCookies = ctx.req.header("cookie") != null;
+		const originHeader = ctx.req.header("origin") ?? ctx.req.header("referer");
+		const queryCallbackURL = ctx.req.query("callbackURL");
+		const { ready, dynamicPromise, trustedOrigins } = require_url.getTrustedOrigins(options, context, ctx.req);
+		let body = null;
+		if (needsBody) try {
+			body = await ctx.req.raw.clone().json();
+		} catch {}
+		const callbackURL = body?.callbackURL ?? queryCallbackURL;
+		const redirectURL = body?.redirectTo;
+		const errorCallbackURL = body?.errorCallbackURL;
+		const newUserCallbackURL = body?.newUserCallbackURL;
+		let ret = null;
+		if (usesCookies && !options.advanced?.disableCSRFCheck) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(originHeader, "origin", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		if (callbackURL != null) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(callbackURL, "callbackURL", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		if (redirectURL != null) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(redirectURL, "redirectURL", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		if (errorCallbackURL != null) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(errorCallbackURL, "errorCallbackURL", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		if (newUserCallbackURL != null) {
+			if (!ready) await dynamicPromise;
+			ret = validateURL(newUserCallbackURL, "newUserCallbackURL", trustedOrigins, log, ctx);
+			if (ret) return ret;
+		}
+		return await next();
+	});
+};
+/**
+* Validates callback URLs against trusted origins.
+* @template V - The context variables type.
+* @param getValue - Function to get the callback URL(s) from the context.
+* @returns The middleware function.
+*/
+const originCheck = (getValue) => {
+	return require_middleware.createMiddleware()(async (ctx, next) => {
+		if (ctx.get("isServer") === true) return await next();
+		const context = ctx.get("context");
+		let callbackURL = getValue(ctx);
+		if ((0, __faire_auth_core_static.isPromise)(callbackURL)) callbackURL = await callbackURL;
+		if (!callbackURL) return await next();
+		const callbacks = Array.isArray(callbackURL) ? callbackURL : [callbackURL];
+		let ret;
+		for (const url of callbacks) {
+			ret = validateURL(url, "callbackURL", context.trustedOrigins, context.logger, ctx);
+			if (ret) return ret;
+		}
+		return await next();
+	});
+};
+
+//#endregion
+Object.defineProperty(exports, 'initOriginCheckMiddleware', {
+  enumerable: true,
+  get: function () {
+    return initOriginCheckMiddleware;
+  }
+});
+Object.defineProperty(exports, 'originCheck', {
+  enumerable: true,
+  get: function () {
+    return originCheck;
+  }
+});
+Object.defineProperty(exports, 'wildcardMatch', {
+  enumerable: true,
+  get: function () {
+    return wildcardMatch;
+  }
+});