kavachos 0.1.3 → 0.1.5

package/dist/auth/index.js

@@ -5018,7 +5018,7 @@ function createOAuthModule(db, config) {
       throw new Error("OAuth callback: state has expired. Restart the authorization flow.");
     }
     await db.delete(oauthStates).where(eq(oauthStates.state, state));
-    const tokens = await provider.exchangeCode(stateRow.codeVerifier, code, redirectUri);
+    const tokens = await provider.exchangeCode(code, stateRow.codeVerifier, redirectUri);
     const userInfo = await provider.getUserInfo(tokens.accessToken);
     const existingRows = await db.select().from(oauthAccounts).where(
       and(
@@ -5128,8 +5128,6 @@ function createOAuthModule(db, config) {
     pruneExpiredStates
   };
 }
-
-// src/auth/oauth/plugin.ts
 function jsonResponse10(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
@@ -5148,6 +5146,8 @@ function oauth(config) {
     async init(ctx) {
       const module = createOAuthModule(ctx.db, config);
       const baseUrl = ctx.config.baseUrl ?? "";
+      const sessionConfig = ctx.config.auth?.session;
+      const sessionManager = sessionConfig ? createSessionManager(sessionConfig, ctx.db) : null;
       const authorizeLimiter = createRateLimiter({ max: 20, window: 60 });
       function getRedirectUri(provider) {
         if (config.buildRedirectUri) {
@@ -5198,6 +5198,38 @@ function oauth(config) {
           const redirectUri = getRedirectUri(provider);
           try {
             const result = await module.handleCallback(provider, code, state, redirectUri);
+            const email = result.userInfo.email;
+            let userId = result.account.userId;
+            if (userId === "__pending__" && email && ctx.db) {
+              const existing = await ctx.db.select().from(users).where(eq(users.email, email));
+              if (existing[0]) {
+                userId = existing[0].id;
+              } else {
+                const newId = crypto.randomUUID();
+                await ctx.db.insert(users).values({
+                  id: newId,
+                  email,
+                  name: result.userInfo.name ?? null,
+                  externalProvider: `oauth:${provider}`,
+                  externalId: result.userInfo.id,
+                  emailVerified: 1,
+                  createdAt: /* @__PURE__ */ new Date(),
+                  updatedAt: /* @__PURE__ */ new Date()
+                });
+                userId = newId;
+              }
+              await module.linkAccount(userId, provider, result.userInfo, {
+                accessToken: result.account.accessToken,
+                refreshToken: result.account.refreshToken ?? void 0,
+                tokenType: "Bearer",
+                raw: {}
+              });
+            }
+            if (sessionManager && userId !== "__pending__") {
+              const { session, token } = await sessionManager.create(userId);
+              const callbackUrl = `${baseUrl}/?session=${encodeURIComponent(JSON.stringify({ token, user: { id: userId, email }, expiresAt: session.expiresAt }))}`;
+              return redirectResponse(callbackUrl);
+            }
             return jsonResponse10({
               isNewAccount: result.isNewAccount,
               account: result.account,