palaryn 0.1.0 → 0.3.2

package/src/auth/providers.ts

@@ -0,0 +1,208 @@
+import * as https from 'https';
+import * as http from 'http';
+import { URL } from 'url';
+import { OAuthProvider, OAuthProfile, GoogleOAuthProvider, GitHubOAuthProvider } from '../types/user';
+import { generateCodeVerifier, generateCodeChallenge } from './pkce';
+
+// ---------------------------------------------------------------------------
+// Generic HTTP helper (no external deps)
+// ---------------------------------------------------------------------------
+
+interface HttpResponse {
+  statusCode: number;
+  body: string;
+}
+
+function httpRequest(url: string, options: {
+  method?: string;
+  headers?: Record<string, string>;
+  body?: string;
+}): Promise<HttpResponse> {
+  return new Promise((resolve, reject) => {
+    const parsed = new URL(url);
+    const mod = parsed.protocol === 'https:' ? https : http;
+    const req = mod.request(parsed, {
+      method: options.method || 'GET',
+      headers: options.headers || {},
+    }, (res) => {
+      const chunks: Buffer[] = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        resolve({
+          statusCode: res.statusCode || 0,
+          body: Buffer.concat(chunks).toString('utf-8'),
+        });
+      });
+    });
+    req.on('error', reject);
+    if (options.body) req.write(options.body);
+    req.end();
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Google OAuth
+// ---------------------------------------------------------------------------
+
+export function buildGoogleAuthUrl(config: GoogleOAuthProvider, redirectUri: string, state: string, codeVerifier: string): {
+  url: string;
+  code_verifier: string;
+  code_challenge: string;
+} {
+  const codeChallenge = generateCodeChallenge(codeVerifier);
+  const params = new URLSearchParams({
+    client_id: config.client_id,
+    redirect_uri: redirectUri,
+    response_type: 'code',
+    scope: 'openid email profile',
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: 'S256',
+    access_type: 'offline',
+    prompt: 'consent',
+  });
+  return {
+    url: `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`,
+    code_verifier: codeVerifier,
+    code_challenge: codeChallenge,
+  };
+}
+
+export async function exchangeGoogleCode(config: GoogleOAuthProvider, redirectUri: string, code: string, codeVerifier: string): Promise<{
+  access_token: string;
+  refresh_token?: string;
+  expires_in: number;
+  id_token?: string;
+}> {
+  const body = new URLSearchParams({
+    client_id: config.client_id,
+    client_secret: config.client_secret,
+    redirect_uri: redirectUri,
+    code,
+    grant_type: 'authorization_code',
+    code_verifier: codeVerifier,
+  }).toString();
+
+  const res = await httpRequest('https://oauth2.googleapis.com/token', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body,
+  });
+
+  if (res.statusCode !== 200) {
+    throw new Error(`Google token exchange failed (${res.statusCode}): ${res.body}`);
+  }
+  return JSON.parse(res.body);
+}
+
+export async function getGoogleUserInfo(accessToken: string): Promise<OAuthProfile> {
+  const res = await httpRequest('https://www.googleapis.com/oauth2/v2/userinfo', {
+    headers: { Authorization: `Bearer ${accessToken}` },
+  });
+  if (res.statusCode !== 200) {
+    throw new Error(`Google userinfo failed (${res.statusCode}): ${res.body}`);
+  }
+  const data = JSON.parse(res.body);
+  return {
+    provider: 'google',
+    provider_user_id: data.id,
+    email: data.email,
+    display_name: data.name || data.email,
+    avatar_url: data.picture,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// GitHub OAuth
+// ---------------------------------------------------------------------------
+
+export function buildGitHubAuthUrl(config: GitHubOAuthProvider, redirectUri: string, state: string): string {
+  const params = new URLSearchParams({
+    client_id: config.client_id,
+    redirect_uri: redirectUri,
+    scope: 'read:user user:email',
+    state,
+  });
+  return `https://github.com/login/oauth/authorize?${params.toString()}`;
+}
+
+export async function exchangeGitHubCode(config: GitHubOAuthProvider, code: string): Promise<{
+  access_token: string;
+  token_type: string;
+  scope: string;
+}> {
+  const body = new URLSearchParams({
+    client_id: config.client_id,
+    client_secret: config.client_secret,
+    code,
+  }).toString();
+
+  const res = await httpRequest('https://github.com/login/oauth/access_token', {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      'Accept': 'application/json',
+    },
+    body,
+  });
+
+  if (res.statusCode !== 200) {
+    throw new Error(`GitHub token exchange failed (${res.statusCode}): ${res.body}`);
+  }
+  const data = JSON.parse(res.body);
+  if (data.error) {
+    throw new Error(`GitHub token error: ${data.error_description || data.error}`);
+  }
+  return data;
+}
+
+export async function getGitHubUserInfo(accessToken: string): Promise<OAuthProfile> {
+  const res = await httpRequest('https://api.github.com/user', {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      'User-Agent': 'Palaryn',
+      'Accept': 'application/json',
+    },
+  });
+  if (res.statusCode !== 200) {
+    throw new Error(`GitHub user API failed (${res.statusCode}): ${res.body}`);
+  }
+  const data = JSON.parse(res.body);
+
+  // GitHub might not return email in user endpoint, fetch from emails API
+  let email = data.email;
+  if (!email) {
+    const emailRes = await httpRequest('https://api.github.com/user/emails', {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        'User-Agent': 'Palaryn',
+        'Accept': 'application/json',
+      },
+    });
+    if (emailRes.statusCode === 200) {
+      const emails = JSON.parse(emailRes.body);
+      const primary = emails.find((e: any) => e.primary) || emails[0];
+      if (primary) email = primary.email;
+    }
+  }
+
+  return {
+    provider: 'github',
+    provider_user_id: String(data.id),
+    email: email || `${data.login}@github.noreply.com`,
+    display_name: data.name || data.login,
+    avatar_url: data.avatar_url,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Unified provider interface
+// ---------------------------------------------------------------------------
+
+export type ProviderConfig = {
+  provider: 'google';
+  config: GoogleOAuthProvider;
+} | {
+  provider: 'github';
+  config: GitHubOAuthProvider;
+};