servcraft 0.1.0 → 0.1.3

package/src/modules/oauth/providers/facebook.provider.ts

@@ -0,0 +1,181 @@
+import { randomBytes } from 'crypto';
+import { logger } from '../../../core/logger.js';
+import type { FacebookOAuthConfig, OAuthUser, OAuthTokens, OAuthState } from '../types.js';
+
+const FACEBOOK_AUTH_URL = 'https://www.facebook.com/v18.0/dialog/oauth';
+const FACEBOOK_TOKEN_URL = 'https://graph.facebook.com/v18.0/oauth/access_token';
+const FACEBOOK_USERINFO_URL = 'https://graph.facebook.com/v18.0/me';
+
+const DEFAULT_SCOPES = ['email', 'public_profile'];
+
+export class FacebookOAuthProvider {
+  private config: FacebookOAuthConfig;
+  private callbackUrl: string;
+
+  constructor(config: FacebookOAuthConfig, callbackBaseUrl: string) {
+    this.config = config;
+    this.callbackUrl = `${callbackBaseUrl}/auth/oauth/facebook/callback`;
+  }
+
+  /**
+   * Generate authorization URL
+   */
+  generateAuthUrl(state?: string): { url: string; state: OAuthState } {
+    const stateValue = state || randomBytes(32).toString('hex');
+    const scopes = this.config.scopes || DEFAULT_SCOPES;
+
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      redirect_uri: this.callbackUrl,
+      response_type: 'code',
+      scope: scopes.join(','),
+      state: stateValue,
+      auth_type: 'rerequest', // Re-request declined permissions
+    });
+
+    const oauthState: OAuthState = {
+      state: stateValue,
+      redirectUri: this.callbackUrl,
+      createdAt: Date.now(),
+    };
+
+    return {
+      url: `${FACEBOOK_AUTH_URL}?${params.toString()}`,
+      state: oauthState,
+    };
+  }
+
+  /**
+   * Exchange authorization code for tokens
+   */
+  async exchangeCode(code: string): Promise<OAuthTokens> {
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      client_secret: this.config.clientSecret,
+      code,
+      redirect_uri: this.callbackUrl,
+    });
+
+    const response = await fetch(`${FACEBOOK_TOKEN_URL}?${params.toString()}`);
+
+    if (!response.ok) {
+      const error = await response.text();
+      logger.error({ error }, 'Facebook token exchange failed');
+      throw new Error(`Failed to exchange code: ${error}`);
+    }
+
+    const data = (await response.json()) as {
+      access_token: string;
+      token_type: string;
+      expires_in: number;
+    };
+
+    return {
+      accessToken: data.access_token,
+      tokenType: data.token_type,
+      expiresIn: data.expires_in,
+    };
+  }
+
+  /**
+   * Get user information from Facebook
+   */
+  async getUser(accessToken: string): Promise<OAuthUser> {
+    const fields = 'id,email,name,first_name,last_name,picture.type(large)';
+    const url = `${FACEBOOK_USERINFO_URL}?fields=${fields}&access_token=${accessToken}`;
+
+    const response = await fetch(url);
+
+    if (!response.ok) {
+      const error = await response.text();
+      logger.error({ error }, 'Failed to get Facebook user info');
+      throw new Error(`Failed to get user info: ${error}`);
+    }
+
+    const data = (await response.json()) as {
+      id: string;
+      email?: string;
+      name: string;
+      first_name: string;
+      last_name: string;
+      picture?: { data: { url: string } };
+    };
+
+    return {
+      id: data.id,
+      email: data.email || null,
+      emailVerified: !!data.email, // Facebook only returns verified emails
+      name: data.name,
+      firstName: data.first_name,
+      lastName: data.last_name,
+      picture: data.picture?.data?.url || null,
+      provider: 'facebook',
+      providerAccountId: data.id,
+      accessToken,
+      raw: data,
+    };
+  }
+
+  /**
+   * Get long-lived access token (60 days instead of ~2 hours)
+   */
+  async getLongLivedToken(shortLivedToken: string): Promise<OAuthTokens> {
+    const params = new URLSearchParams({
+      grant_type: 'fb_exchange_token',
+      client_id: this.config.clientId,
+      client_secret: this.config.clientSecret,
+      fb_exchange_token: shortLivedToken,
+    });
+
+    const response = await fetch(`${FACEBOOK_TOKEN_URL}?${params.toString()}`);
+
+    if (!response.ok) {
+      throw new Error('Failed to get long-lived token');
+    }
+
+    const data = (await response.json()) as {
+      access_token: string;
+      token_type: string;
+      expires_in: number;
+    };
+
+    return {
+      accessToken: data.access_token,
+      tokenType: data.token_type,
+      expiresIn: data.expires_in,
+    };
+  }
+
+  /**
+   * Debug/inspect access token
+   */
+  async inspectToken(
+    accessToken: string
+  ): Promise<{ isValid: boolean; userId: string; expiresAt: number }> {
+    const appToken = `${this.config.clientId}|${this.config.clientSecret}`;
+    const url = `https://graph.facebook.com/debug_token?input_token=${accessToken}&access_token=${appToken}`;
+
+    const response = await fetch(url);
+    const data = (await response.json()) as {
+      data: {
+        is_valid: boolean;
+        user_id: string;
+        expires_at: number;
+      };
+    };
+
+    return {
+      isValid: data.data.is_valid,
+      userId: data.data.user_id,
+      expiresAt: data.data.expires_at,
+    };
+  }
+
+  /**
+   * Revoke access (user must re-authorize)
+   */
+  async revokeAccess(userId: string, accessToken: string): Promise<void> {
+    const url = `https://graph.facebook.com/v18.0/${userId}/permissions?access_token=${accessToken}`;
+    await fetch(url, { method: 'DELETE' });
+  }
+}

package/src/modules/oauth/providers/github.provider.ts

@@ -0,0 +1,248 @@
+import { randomBytes } from 'crypto';
+import { logger } from '../../../core/logger.js';
+import type { GitHubOAuthConfig, OAuthUser, OAuthTokens, OAuthState } from '../types.js';
+
+const GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize';
+const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token';
+const GITHUB_API_URL = 'https://api.github.com';
+
+const DEFAULT_SCOPES = ['read:user', 'user:email'];
+
+export class GitHubOAuthProvider {
+  private config: GitHubOAuthConfig;
+  private callbackUrl: string;
+
+  constructor(config: GitHubOAuthConfig, callbackBaseUrl: string) {
+    this.config = config;
+    this.callbackUrl = `${callbackBaseUrl}/auth/oauth/github/callback`;
+  }
+
+  /**
+   * Generate authorization URL
+   */
+  generateAuthUrl(state?: string): { url: string; state: OAuthState } {
+    const stateValue = state || randomBytes(32).toString('hex');
+    const scopes = this.config.scopes || DEFAULT_SCOPES;
+
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      redirect_uri: this.callbackUrl,
+      scope: scopes.join(' '),
+      state: stateValue,
+      allow_signup: 'true',
+    });
+
+    const oauthState: OAuthState = {
+      state: stateValue,
+      redirectUri: this.callbackUrl,
+      createdAt: Date.now(),
+    };
+
+    return {
+      url: `${GITHUB_AUTH_URL}?${params.toString()}`,
+      state: oauthState,
+    };
+  }
+
+  /**
+   * Exchange authorization code for tokens
+   */
+  async exchangeCode(code: string): Promise<OAuthTokens> {
+    const response = await fetch(GITHUB_TOKEN_URL, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+      body: JSON.stringify({
+        client_id: this.config.clientId,
+        client_secret: this.config.clientSecret,
+        code,
+        redirect_uri: this.callbackUrl,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      logger.error({ error }, 'GitHub token exchange failed');
+      throw new Error(`Failed to exchange code: ${error}`);
+    }
+
+    const data = (await response.json()) as {
+      access_token: string;
+      token_type: string;
+      scope: string;
+      error?: string;
+      error_description?: string;
+    };
+
+    if (data.error) {
+      throw new Error(data.error_description || data.error);
+    }
+
+    return {
+      accessToken: data.access_token,
+      tokenType: data.token_type,
+      scope: data.scope,
+    };
+  }
+
+  /**
+   * Get user information from GitHub
+   */
+  async getUser(accessToken: string): Promise<OAuthUser> {
+    // Get user profile
+    const userResponse = await fetch(`${GITHUB_API_URL}/user`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: 'application/vnd.github.v3+json',
+      },
+    });
+
+    if (!userResponse.ok) {
+      const error = await userResponse.text();
+      logger.error({ error }, 'Failed to get GitHub user info');
+      throw new Error(`Failed to get user info: ${error}`);
+    }
+
+    const userData = (await userResponse.json()) as {
+      id: number;
+      login: string;
+      name: string | null;
+      email: string | null;
+      avatar_url: string;
+      bio: string | null;
+      company: string | null;
+      location: string | null;
+      html_url: string;
+    };
+
+    // Get user emails (email might be private)
+    let primaryEmail: string | null = userData.email;
+    let emailVerified = false;
+
+    if (!primaryEmail) {
+      const emailsResponse = await fetch(`${GITHUB_API_URL}/user/emails`, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          Accept: 'application/vnd.github.v3+json',
+        },
+      });
+
+      if (emailsResponse.ok) {
+        const emails = (await emailsResponse.json()) as Array<{
+          email: string;
+          primary: boolean;
+          verified: boolean;
+        }>;
+
+        const primary = emails.find((e) => e.primary && e.verified);
+        if (primary) {
+          primaryEmail = primary.email;
+          emailVerified = primary.verified;
+        } else {
+          const verified = emails.find((e) => e.verified);
+          if (verified) {
+            primaryEmail = verified.email;
+            emailVerified = true;
+          }
+        }
+      }
+    } else {
+      emailVerified = true; // Public emails are verified
+    }
+
+    // Parse name into first/last
+    let firstName: string | null = null;
+    let lastName: string | null = null;
+    if (userData.name) {
+      const parts = userData.name.split(' ');
+      firstName = parts[0] ?? null;
+      lastName = parts.slice(1).join(' ') || null;
+    }
+
+    return {
+      id: userData.id.toString(),
+      email: primaryEmail,
+      emailVerified,
+      name: userData.name || userData.login,
+      firstName,
+      lastName,
+      picture: userData.avatar_url,
+      provider: 'github',
+      providerAccountId: userData.id.toString(),
+      accessToken,
+      raw: userData,
+    };
+  }
+
+  /**
+   * Get user's repositories
+   */
+  async getRepositories(
+    accessToken: string,
+    options: { page?: number; perPage?: number; sort?: 'created' | 'updated' | 'pushed' } = {}
+  ): Promise<Array<{ id: number; name: string; fullName: string; private: boolean; url: string }>> {
+    const params = new URLSearchParams({
+      page: (options.page || 1).toString(),
+      per_page: (options.perPage || 30).toString(),
+      sort: options.sort || 'updated',
+    });
+
+    const response = await fetch(`${GITHUB_API_URL}/user/repos?${params}`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: 'application/vnd.github.v3+json',
+      },
+    });
+
+    if (!response.ok) {
+      throw new Error('Failed to get repositories');
+    }
+
+    const repos = (await response.json()) as Array<{
+      id: number;
+      name: string;
+      full_name: string;
+      private: boolean;
+      html_url: string;
+    }>;
+
+    return repos.map((repo) => ({
+      id: repo.id,
+      name: repo.name,
+      fullName: repo.full_name,
+      private: repo.private,
+      url: repo.html_url,
+    }));
+  }
+
+  /**
+   * Check if user has access to a specific repository
+   */
+  async checkRepoAccess(accessToken: string, owner: string, repo: string): Promise<boolean> {
+    const response = await fetch(`${GITHUB_API_URL}/repos/${owner}/${repo}`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: 'application/vnd.github.v3+json',
+      },
+    });
+
+    return response.ok;
+  }
+
+  /**
+   * Revoke access token
+   */
+  async revokeToken(accessToken: string): Promise<void> {
+    await fetch(`https://api.github.com/applications/${this.config.clientId}/token`, {
+      method: 'DELETE',
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString('base64')}`,
+        Accept: 'application/vnd.github.v3+json',
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ access_token: accessToken }),
+    });
+  }
+}

package/src/modules/oauth/providers/google.provider.ts

@@ -0,0 +1,189 @@
+import { randomBytes, createHash } from 'crypto';
+import { logger } from '../../../core/logger.js';
+import type { GoogleOAuthConfig, OAuthUser, OAuthTokens, OAuthState } from '../types.js';
+
+const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const GOOGLE_USERINFO_URL = 'https://www.googleapis.com/oauth2/v2/userinfo';
+
+const DEFAULT_SCOPES = [
+  'openid',
+  'https://www.googleapis.com/auth/userinfo.email',
+  'https://www.googleapis.com/auth/userinfo.profile',
+];
+
+export class GoogleOAuthProvider {
+  private config: GoogleOAuthConfig;
+  private callbackUrl: string;
+
+  constructor(config: GoogleOAuthConfig, callbackBaseUrl: string) {
+    this.config = config;
+    this.callbackUrl = `${callbackBaseUrl}/auth/oauth/google/callback`;
+  }
+
+  /**
+   * Generate authorization URL with PKCE
+   */
+  generateAuthUrl(state?: string): { url: string; state: OAuthState } {
+    const stateValue = state || randomBytes(32).toString('hex');
+    const codeVerifier = randomBytes(32).toString('base64url');
+    const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');
+
+    const scopes = this.config.scopes || DEFAULT_SCOPES;
+
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      redirect_uri: this.callbackUrl,
+      response_type: 'code',
+      scope: scopes.join(' '),
+      state: stateValue,
+      code_challenge: codeChallenge,
+      code_challenge_method: 'S256',
+      access_type: 'offline',
+      prompt: 'consent',
+    });
+
+    const oauthState: OAuthState = {
+      state: stateValue,
+      codeVerifier,
+      redirectUri: this.callbackUrl,
+      createdAt: Date.now(),
+    };
+
+    return {
+      url: `${GOOGLE_AUTH_URL}?${params.toString()}`,
+      state: oauthState,
+    };
+  }
+
+  /**
+   * Exchange authorization code for tokens
+   */
+  async exchangeCode(code: string, codeVerifier?: string): Promise<OAuthTokens> {
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      client_secret: this.config.clientSecret,
+      code,
+      grant_type: 'authorization_code',
+      redirect_uri: this.callbackUrl,
+    });
+
+    if (codeVerifier) {
+      params.append('code_verifier', codeVerifier);
+    }
+
+    const response = await fetch(GOOGLE_TOKEN_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: params.toString(),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      logger.error({ error }, 'Google token exchange failed');
+      throw new Error(`Failed to exchange code: ${error}`);
+    }
+
+    const data = (await response.json()) as {
+      access_token: string;
+      refresh_token?: string;
+      expires_in: number;
+      token_type: string;
+      scope: string;
+      id_token?: string;
+    };
+
+    return {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+      expiresIn: data.expires_in,
+      tokenType: data.token_type,
+      scope: data.scope,
+      idToken: data.id_token,
+    };
+  }
+
+  /**
+   * Get user information from Google
+   */
+  async getUser(accessToken: string): Promise<OAuthUser> {
+    const response = await fetch(GOOGLE_USERINFO_URL, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      logger.error({ error }, 'Failed to get Google user info');
+      throw new Error(`Failed to get user info: ${error}`);
+    }
+
+    const data = (await response.json()) as {
+      id: string;
+      email: string;
+      verified_email: boolean;
+      name: string;
+      given_name: string;
+      family_name: string;
+      picture: string;
+    };
+
+    return {
+      id: data.id,
+      email: data.email,
+      emailVerified: data.verified_email,
+      name: data.name,
+      firstName: data.given_name,
+      lastName: data.family_name,
+      picture: data.picture,
+      provider: 'google',
+      providerAccountId: data.id,
+      accessToken,
+      raw: data,
+    };
+  }
+
+  /**
+   * Refresh access token
+   */
+  async refreshToken(refreshToken: string): Promise<OAuthTokens> {
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      client_secret: this.config.clientSecret,
+      refresh_token: refreshToken,
+      grant_type: 'refresh_token',
+    });
+
+    const response = await fetch(GOOGLE_TOKEN_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: params.toString(),
+    });
+
+    if (!response.ok) {
+      throw new Error('Failed to refresh token');
+    }
+
+    const data = (await response.json()) as {
+      access_token: string;
+      expires_in: number;
+      token_type: string;
+      scope: string;
+    };
+
+    return {
+      accessToken: data.access_token,
+      expiresIn: data.expires_in,
+      tokenType: data.token_type,
+      scope: data.scope,
+    };
+  }
+
+  /**
+   * Revoke access token
+   */
+  async revokeToken(token: string): Promise<void> {
+    await fetch(`https://oauth2.googleapis.com/revoke?token=${token}`, {
+      method: 'POST',
+    });
+  }
+}