slauthjs 1.0.0 → 2.0.0

package/src/index.d.ts

@@ -4,19 +4,80 @@ export interface Store {
   /** ttl is in seconds. */
   put(key: string, value: unknown, options?: { ttl?: number }): Promise<void>
   delete(key: string): Promise<void>
+  /** Optional: keys starting with `prefix`, in order. Only needed for auth.users.list(). */
+  list?(prefix: string, options?: { limit?: number; cursor?: string | null }): Promise<{ items: { key: string; value: any }[]; cursor: string | null }>
 }
 
-/** Sends the sign-in email. `subject`, `text` and `html` are ready to use. */
+export type EmailKind = 'sign-in' | 'email-change' | 'invite'
+
+/** Sends slauth's emails. `subject`, `text` and `html` are ready to use. */
 export interface EmailSender {
-  send(message: { to: string; code: string; appName: string; subject: string; text: string; html: string }): Promise<void>
+  send(message: { to: string; kind: EmailKind; code?: string; link?: string; appName: string; subject: string; text: string; html: string }): Promise<void>
 }
 
+/** What the browser, auth.user() and your event handlers see. */
 export interface SlauthUser {
   id: string
   email: string
+  name: string | null
+  image: string | null
+  /** Set on the server (auth.users.update); checked by requireUser(request, { role }). */
+  roles: string[]
+  /** Yours to fill on the server; sent to the browser. */
+  metadata: Record<string, unknown>
   createdAt: number
 }
 
+/** The whole record, for server code only. */
+export interface StoredUser extends SlauthUser {
+  /** Never sent to the browser. */
+  privateMetadata: Record<string, unknown>
+  updatedAt: number
+  bannedAt: number | null
+}
+
+export interface Profile {
+  id: string
+  email?: string | null
+  emailVerified?: boolean
+  name?: string | null
+  image?: string | null
+}
+
+/** A "Sign in with …" provider; make one with the helpers in 'slauthjs/providers'. */
+export interface Provider {
+  id: string
+  name: string
+  clientId: string
+  clientSecret?: string
+  authorization: string
+  token: string
+  scope?: string
+  params?: Record<string, string>
+  pkce?: boolean
+  tokenAuth?: 'post' | 'basic'
+  /** Count the provider's email as verified even when it doesn't say so. Only for providers you trust. */
+  trustEmail?: boolean
+  /** Save the provider's access and refresh tokens, for auth.accounts.list(). */
+  keepTokens?: boolean
+  profile(tokens: Record<string, any>, fetch: typeof globalThis.fetch): Promise<Profile>
+}
+
+export interface SignInContext {
+  method: 'email' | 'link' | 'password' | 'passkey' | 'oauth' | 'access' | 'session' | 'email-change'
+  provider?: string
+  profile?: Profile
+  user?: SlauthUser
+}
+
+export interface SlauthEvents {
+  signUp?(event: { user: SlauthUser; method: string; request?: Request }): unknown
+  signIn?(event: { user: SlauthUser; method: string; request: Request }): unknown
+  signOut?(event: { user: SlauthUser; request: Request }): unknown
+  userUpdated?(event: { user: SlauthUser }): unknown
+  userDeleted?(event: { user: SlauthUser }): unknown
+}
+
 export interface SlauthConfig {
   /** A random string of 16+ characters. Make one with: openssl rand -base64 32 */
   secret: string
@@ -24,16 +85,24 @@ export interface SlauthConfig {
   store: Store
   /** How codes are emailed. Defaults to printing them to the console. */
   email?: EmailSender
+  /** Your own wording for the emails. Return null to keep slauth's. */
+  emails?: (kind: EmailKind, data: { code?: string; link?: string; appName: string; minutes?: number; orgName?: string; inviter?: string }) => { subject: string; text: string; html: string } | null | Promise<{ subject: string; text: string; html: string } | null>
   /** Shown in emails and as the passkey's site name. */
   appName?: string
   /** Who may sign in: a list of emails ("@family.com" for a whole domain) or a function. Everyone, if left out. */
-  allow?: string[] | ((email: string) => boolean | Promise<boolean>)
+  allow?: string[] | ((email: string, context: SignInContext) => boolean | Promise<boolean>)
   /** Where the routes live. Default "/auth". */
   basePath?: string
+  /** Your site's address for links in emails and provider callbacks, e.g. "https://myapp.dev". Default: the request's origin. */
+  baseUrl?: string
+  /** The page with your sign-in box; provider errors and two-factor steps come back here. Default: the page the person started on. */
+  signInPage?: string
   /** Session cookie name. Default "slauth_session". */
   cookie?: string
   /** Sessions last this many days after the last visit. Default 30. */
   sessionDays?: number
+  /** Adding a passkey or password, changing email, turning on two-factor or deleting the account need a sign-in this recent. Default 15; false to skip. */
+  freshMinutes?: number | false
   /** Origins allowed to post to the routes (and to use passkeys). Default: the request's own origin. */
   origins?: string | string[]
   /** Passkey settings, or false to turn passkeys off. */
@@ -46,25 +115,171 @@ export interface SlauthConfig {
         origin?: string | string[]
         userVerification?: 'required' | 'preferred' | 'discouraged'
       }
+  /** "Sign in with …": github(), google(), oidc() and friends from 'slauthjs/providers'. */
+  providers?: Provider[]
+  /** Put a one-tap sign-in link in the code email too. */
+  magicLinks?: boolean
+  /** Let people sign in with a password (after proving their email once). */
+  passwords?: boolean | { minLength?: number; iterations?: number; validate?: (password: string) => string | null | Promise<string | null> }
+  /** Let people turn on an authenticator app (TOTP) with recovery codes. */
+  twoFactor?: boolean | { issuer?: string }
+  /** Short-lived JWTs for your other services, checked with /auth/jwks.json. */
+  tokens?: boolean | { minutes?: number; issuer?: string; audience?: string; claims?: (user: SlauthUser) => Record<string, unknown> | Promise<Record<string, unknown>> }
+  /** Teams with members, roles and email invitations. */
+  organizations?: boolean | { allowCreate?: boolean | ((user: SlauthUser) => boolean | Promise<boolean>); invitePage?: string }
+  /** Per-IP limits on code, password and two-factor routes; false to turn off. */
+  rateLimit?: false | { limits?: Record<string, [requests: number, seconds: number]>; ip?: (request: Request) => string | null }
+  /** Let people delete their own account at POST /auth/user/delete. Default true. */
+  allowDeletion?: boolean
+  /** Things to do when people sign up, sign in, and so on. */
+  on?: SlauthEvents
+  /** For providers' HTTP calls; handy in tests. */
+  fetch?: typeof globalThis.fetch
   /** Also accept people signed in by Cloudflare Access. */
   access?: { team: string; aud: string | string[]; devUser?: string; fetch?: typeof fetch }
   /** Turn on the PIN app lock. true = off by default for each person; or set their default. */
   lock?: true | { default?: Policy; cookie?: string }
 }
 
+export interface SessionInfo {
+  id: string
+  createdAt: number
+  lastActiveAt: number
+  method: string | null
+  userAgent: string | null
+  ip: string | null
+  impersonatorId: string | null
+}
+
+export interface LinkedAccount {
+  provider: string
+  accountId: string
+  userId: string
+  email: string | null
+  name: string | null
+  createdAt: number
+  updatedAt: number
+  tokens?: Record<string, any> & { savedAt: number }
+}
+
+export type OrgRole = 'owner' | 'admin' | 'member' | (string & {})
+
+export interface Org {
+  id: string
+  name: string
+  metadata: Record<string, unknown>
+  createdAt: number
+  createdBy: string | null
+}
+
+export interface OrgMember {
+  userId: string
+  role: OrgRole
+  joinedAt: number
+}
+
+export interface OrgInvite {
+  id: string
+  orgId: string
+  email: string
+  role: OrgRole
+  invitedBy: string | null
+  createdAt: number
+  expiresAt: number
+}
+
+export interface TokenClaims extends Record<string, unknown> {
+  sub: string
+  email: string
+  name: string | null
+  roles: string[]
+  iat: number
+  exp: number
+}
+
 export interface Slauth {
   /** Answers every request under basePath (404 for anything else). */
   handle(request: Request): Promise<Response>
-  /** The signed-in person, or null. Ignores the app lock. */
+  /** The signed-in person, or null. Ignores the app lock. Reads the cookie, a bearer session token, or (with tokens on) a JWT. */
   user(request: Request): Promise<SlauthUser | null>
-  /** The signed-in, unlocked person, or a 401 Response to return as it is. */
-  requireUser(request: Request): Promise<SlauthUser | Response>
+  /** The signed-in, unlocked person (with one of these roles), or a 401/403 Response to return as it is. */
+  requireUser(request: Request, options?: { role?: string | string[] }): Promise<SlauthUser | Response>
+  /** The user and their session (null for Access or a JWT), or null. */
+  session(request: Request): Promise<{ user: SlauthUser; session: { id: string; userId: string; createdAt: number; method: string | null; impersonatorId: string | null } | null } | null>
   store: Store
+
+  users: {
+    get(id: string): Promise<StoredUser | null>
+    byEmail(email: string): Promise<StoredUser | null>
+    /** Needs a store with list() (all the built-in ones have it). */
+    list(options?: { limit?: number; cursor?: string | null }): Promise<{ users: StoredUser[]; cursor: string | null }>
+    create(user: { email: string; name?: string | null; image?: string | null; roles?: string[]; metadata?: Record<string, unknown>; privateMetadata?: Record<string, unknown> }): Promise<StoredUser>
+    update(id: string, patch: Partial<Pick<StoredUser, 'email' | 'name' | 'image' | 'roles' | 'metadata' | 'privateMetadata'>>): Promise<StoredUser | null>
+    /** Removes the user and their sessions, passkeys, providers, password, two-factor and memberships. */
+    delete(id: string): Promise<boolean>
+    ban(id: string): Promise<StoredUser | null>
+    unban(id: string): Promise<StoredUser | null>
+  }
+
+  sessions: {
+    list(userId: string): Promise<SessionInfo[]>
+    revoke(userId: string, sessionId: string): Promise<boolean>
+    revokeAll(userId: string): Promise<void>
+    /** Signs someone in without asking: your own sign-in methods, tests, or impersonation. */
+    create(userId: string, request: Request, options?: { method?: string; impersonatorId?: string | null }): Promise<{ cookie: string; token: string }>
+  }
+
+  accounts: {
+    list(userId: string): Promise<LinkedAccount[]>
+  }
+
+  /** Null unless `passwords` is on. */
+  passwords: null | {
+    set(userId: string, password: string): Promise<void>
+    remove(userId: string): Promise<void>
+    has(userId: string): Promise<boolean>
+    hash(password: string): Promise<string>
+  }
+
+  /** Null unless `twoFactor` is on. */
+  twoFactor: null | {
+    enabled(userId: string): Promise<boolean>
+    /** For support: when someone has lost their phone and their recovery codes. */
+    disable(userId: string): Promise<void>
+  }
+
+  /** Null unless `organizations` is on. */
+  orgs: null | {
+    create(org: { name: string; metadata?: Record<string, unknown> }, ownerId?: string): Promise<Org>
+    get(orgId: string): Promise<Org | null>
+    update(orgId: string, patch: { name?: string; metadata?: Record<string, unknown> }): Promise<Org | null>
+    delete(orgId: string): Promise<void>
+    forUser(userId: string): Promise<(Org & { role: OrgRole })[]>
+    members(orgId: string): Promise<OrgMember[]>
+    role(orgId: string, userId: string): Promise<OrgRole | null>
+    addMember(orgId: string, userId: string, role?: OrgRole): Promise<boolean>
+    setRole(orgId: string, userId: string, role: OrgRole): Promise<boolean>
+    removeMember(orgId: string, userId: string): Promise<boolean>
+    /** Saves an invitation (it doesn't email it; POST /auth/orgs/<id>/invite does both). */
+    invite(orgId: string, email: string, role?: OrgRole, invitedBy?: string | null): Promise<OrgInvite>
+    revokeInvite(inviteId: string): Promise<boolean>
+    /** The signed-in member (with one of these org roles), or a 401/403 Response to return as it is. */
+    require(request: Request, orgId: string, options?: { role?: OrgRole | OrgRole[] }): Promise<(SlauthUser & { orgRole: OrgRole }) | Response>
+  }
+
+  /** Needs `tokens` on. */
+  createToken(user: SlauthUser, extra?: Record<string, unknown>): Promise<{ token: string; expiresAt: number }>
+  /** The claims of a token slauth signed that hasn't expired, or null. Needs `tokens` on. */
+  verifyToken(token: string): Promise<TokenClaims | null>
 }
 
 export function slauth(config: SlauthConfig): Slauth
 export function memory(): Store
 export function consoleEmail(): EmailSender
+export function hashPassword(password: string, iterations?: number): Promise<string>
+export function verifyPassword(password: string, hash: string): Promise<boolean>
+/** The TOTP code for a base32 secret at a 30-second step (default: now). */
+export function totp(secret: string, step?: number): Promise<string>
 
 /** What createAccess and createLock work with. */
 export interface User {

package/src/index.js

@@ -4,3 +4,6 @@ export { consoleEmail } from './email/console.js'
 // The Cloudflare Access check and the PIN lock, usable on their own too.
 export { createAccess, userIdFor } from './access.js'
 export { createLock, validPin, validPolicy, POLICIES } from './lock.js'
+// Building blocks for your own tools and tests.
+export { hashPassword, verifyPassword } from './password.js'
+export { totp } from './two-factor.js'

package/src/oauth/flow.js

@@ -0,0 +1,81 @@
+import { base64Url, randomToken, readCookie, serializeCookie, sha256 } from '../util.js'
+
+const STATE_SECONDS = 10 * 60
+const COOKIE = 'slauth_oauth'
+
+/**
+ * The OAuth 2.0 authorization-code flow with PKCE (RFC 7636) and a `state` that's tied
+ * to this browser by a short-lived cookie, so nobody can finish a sign-in someone else
+ * started (login CSRF).
+ *
+ *   oauth:<state>  { provider, verifier, redirect, returnTo, linkUserId }   (lives 10 minutes)
+ *
+ * @param {{ store: import('../index.js').Store, fetch?: typeof fetch }} options
+ */
+export function createOAuthFlow({ store, fetch: doFetch = (...args) => fetch(...args) }) {
+  async function endpoints(provider) {
+    if (!provider.discover) return { authorization: provider.authorization, token: provider.token }
+    const config = await provider.discover(doFetch)
+    return { authorization: config.authorization_endpoint, token: config.token_endpoint }
+  }
+
+  return {
+    fetch: doFetch,
+
+    /** Where to send the browser, and the cookie that ties the flow to it. */
+    async start(provider, { callbackUrl, redirect, returnTo, linkUserId = null, secure }) {
+      const state = randomToken()
+      const verifier = randomToken()
+      await store.put(`oauth:${state}`, { provider: provider.id, verifier, redirect, returnTo, linkUserId }, { ttl: STATE_SECONDS })
+      const url = new URL((await endpoints(provider)).authorization)
+      url.searchParams.set('response_type', 'code')
+      url.searchParams.set('client_id', provider.clientId)
+      url.searchParams.set('redirect_uri', callbackUrl)
+      url.searchParams.set('state', state)
+      if (provider.scope) url.searchParams.set('scope', provider.scope)
+      if (provider.pkce) {
+        url.searchParams.set('code_challenge', base64Url(await sha256(verifier)))
+        url.searchParams.set('code_challenge_method', 'S256')
+      }
+      for (const [key, value] of Object.entries(provider.params ?? {})) url.searchParams.set(key, value)
+      return { location: url.toString(), cookie: serializeCookie(COOKIE, state, { maxAge: STATE_SECONDS, secure }) }
+    },
+
+    /**
+     * Finishes the flow: checks state, swaps the code for tokens, reads the profile.
+     * @returns {Promise<{ ok: true, profile: object, tokens: object, state: object } | { ok: false, code: string, state?: object }>}
+     */
+    async finish(provider, request, { callbackUrl }) {
+      const url = new URL(request.url)
+      const state = url.searchParams.get('state')
+      const fromCookie = readCookie(request.headers.get('cookie'), COOKIE)
+      const saved = state ? await store.get(`oauth:${state}`) : null
+      if (state) await store.delete(`oauth:${state}`)
+      if (!saved || saved.provider !== provider.id || !fromCookie || fromCookie !== state) return { ok: false, code: 'oauth-state' }
+      if (url.searchParams.get('error')) return { ok: false, code: url.searchParams.get('error') === 'access_denied' ? 'oauth-cancelled' : 'oauth-failed', state: saved }
+      const code = url.searchParams.get('code')
+      if (!code) return { ok: false, code: 'oauth-failed', state: saved }
+
+      const body = new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: callbackUrl })
+      if (provider.pkce) body.set('code_verifier', saved.verifier)
+      const headers = { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' }
+      if (provider.tokenAuth === 'basic') headers.Authorization = `Basic ${btoa(`${encodeURIComponent(provider.clientId)}:${encodeURIComponent(provider.clientSecret ?? '')}`)}`
+      else {
+        body.set('client_id', provider.clientId)
+        if (provider.clientSecret) body.set('client_secret', provider.clientSecret)
+      }
+      const res = await doFetch((await endpoints(provider)).token, { method: 'POST', headers, body })
+      const tokens = await res.json().catch(() => ({}))
+      if (!res.ok || !tokens.access_token) {
+        console.error(`slauth: ${provider.id} wouldn't swap the code for a token:`, res.status, tokens.error ?? '')
+        return { ok: false, code: 'oauth-failed', state: saved }
+      }
+      const profile = await provider.profile(tokens, doFetch)
+      if (!profile?.id) return { ok: false, code: 'oauth-failed', state: saved }
+      if (provider.trustEmail && profile.email) profile.emailVerified = true
+      return { ok: true, profile, tokens, state: saved }
+    },
+
+    clearCookie: (secure) => serializeCookie(COOKIE, '', { maxAge: 0, secure }),
+  }
+}

package/src/oauth/providers.js

@@ -0,0 +1,171 @@
+/**
+ * "Sign in with …" providers. Each is a plain object, so adding your own is just
+ * oauth2({ ... }) or oidc({ ... }):
+ *
+ *   import { github, google } from 'slauthjs/providers'
+ *   slauth({ ..., providers: [github({ clientId, clientSecret }), google({ clientId, clientSecret })] })
+ *
+ * The callback URL to register with each provider is <your site>/auth/oauth/<id>/callback.
+ *
+ * A provider's `profile(tokens, fetch)` returns { id, email, emailVerified, name, image }.
+ * slauth only signs someone in by email when the provider says the email is verified,
+ * so nobody can claim your account by making a provider account with your address.
+ */
+
+/**
+ * Any OAuth 2.0 provider.
+ *
+ * @param {{
+ *   id: string, name: string, clientId: string, clientSecret?: string,
+ *   authorization: string, token: string, scope?: string, params?: Record<string, string>,
+ *   pkce?: boolean, tokenAuth?: 'post' | 'basic',
+ *   profile(tokens: Record<string, any>, fetch: typeof fetch): Promise<{ id: string, email?: string | null, emailVerified?: boolean, name?: string | null, image?: string | null }>,
+ *   trustEmail?: boolean, keepTokens?: boolean,
+ * }} options
+ */
+export function oauth2(options) {
+  for (const key of ['id', 'clientId', 'authorization', 'token', 'profile']) {
+    if (!options?.[key]) throw new Error(`slauth: the ${options?.id ?? 'OAuth'} provider needs \`${key}\`.`)
+  }
+  if (!/^[a-z0-9-]+$/.test(options.id)) throw new Error(`slauth: provider ids are lower-case letters, digits and dashes, not "${options.id}".`)
+  return { type: 'oauth2', name: options.id, pkce: true, tokenAuth: 'post', scope: '', params: {}, ...options }
+}
+
+/**
+ * Any OpenID Connect provider, found from its issuer's discovery document. The profile
+ * comes from the userinfo endpoint, using the access token we just got over TLS.
+ *
+ * @param {{ id: string, name: string, issuer: string, clientId: string, clientSecret?: string, scope?: string, params?: Record<string, string>, trustEmail?: boolean, keepTokens?: boolean, tokenAuth?: 'post' | 'basic' }} options
+ */
+export function oidc({ issuer, scope = 'openid email profile', ...options }) {
+  if (!issuer) throw new Error(`slauth: the ${options.id ?? 'OIDC'} provider needs \`issuer\`.`)
+  let discovered = null
+  const discover = (doFetch) =>
+    (discovered ??= doFetch(`${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`)
+      .then((res) => {
+        if (!res.ok) throw new Error(`slauth: couldn't read ${issuer}'s OpenID configuration (${res.status}).`)
+        return res.json()
+      })
+      .catch((error) => {
+        discovered = null
+        throw error
+      }))
+  return oauth2({
+    // Filled in from discovery when the flow starts (see flow.js).
+    authorization: 'discover',
+    token: 'discover',
+    discover,
+    scope,
+    async profile(tokens, doFetch) {
+      const config = await discover(doFetch)
+      const info = await getJson(doFetch, config.userinfo_endpoint, tokens.access_token)
+      return { id: String(info.sub), email: info.email ?? null, emailVerified: info.email_verified === true || info.email_verified === 'true', name: info.name ?? null, image: info.picture ?? null }
+    },
+    ...options,
+  })
+}
+
+/** GitHub. Make an OAuth app at github.com/settings/developers. */
+export function github({ clientId, clientSecret, scope = 'read:user user:email', ...rest }) {
+  return oauth2({
+    id: 'github',
+    name: 'GitHub',
+    clientId,
+    clientSecret,
+    scope,
+    authorization: 'https://github.com/login/oauth/authorize',
+    token: 'https://github.com/login/oauth/access_token',
+    async profile(tokens, doFetch) {
+      const me = await getJson(doFetch, 'https://api.github.com/user', tokens.access_token)
+      // The profile email can be hidden or unverified; /user/emails says which is which.
+      const emails = await getJson(doFetch, 'https://api.github.com/user/emails', tokens.access_token).catch(() => [])
+      const primary = emails.find((e) => e.primary && e.verified) ?? emails.find((e) => e.verified)
+      return { id: String(me.id), email: primary?.email ?? null, emailVerified: Boolean(primary), name: me.name || me.login, image: me.avatar_url ?? null }
+    },
+    ...rest,
+  })
+}
+
+/** Google. Make an OAuth client at console.cloud.google.com/apis/credentials. */
+export function google({ clientId, clientSecret, scope = 'openid email profile', ...rest }) {
+  return oauth2({
+    id: 'google',
+    name: 'Google',
+    clientId,
+    clientSecret,
+    scope,
+    authorization: 'https://accounts.google.com/o/oauth2/v2/auth',
+    token: 'https://oauth2.googleapis.com/token',
+    params: { prompt: 'select_account' },
+    async profile(tokens, doFetch) {
+      const info = await getJson(doFetch, 'https://openidconnect.googleapis.com/v1/userinfo', tokens.access_token)
+      return { id: String(info.sub), email: info.email ?? null, emailVerified: info.email_verified === true, name: info.name ?? null, image: info.picture ?? null }
+    },
+    ...rest,
+  })
+}
+
+/** Discord. Make an application at discord.com/developers/applications. */
+export function discord({ clientId, clientSecret, scope = 'identify email', ...rest }) {
+  return oauth2({
+    id: 'discord',
+    name: 'Discord',
+    clientId,
+    clientSecret,
+    scope,
+    authorization: 'https://discord.com/oauth2/authorize',
+    token: 'https://discord.com/api/oauth2/token',
+    async profile(tokens, doFetch) {
+      const me = await getJson(doFetch, 'https://discord.com/api/users/@me', tokens.access_token)
+      const image = me.avatar ? `https://cdn.discordapp.com/avatars/${me.id}/${me.avatar}.png` : null
+      return { id: String(me.id), email: me.email ?? null, emailVerified: me.verified === true, name: me.global_name ?? me.username, image }
+    },
+    ...rest,
+  })
+}
+
+/** GitLab (gitlab.com, or your own with `baseUrl`). */
+export function gitlab({ clientId, clientSecret, baseUrl = 'https://gitlab.com', ...rest }) {
+  return oidc({ id: 'gitlab', name: 'GitLab', issuer: baseUrl, clientId, clientSecret, scope: 'openid email profile', ...rest })
+}
+
+/**
+ * Microsoft (personal accounts, and work or school accounts with `tenant`). Microsoft
+ * doesn't promise a work account's email belongs to the person, so by default only
+ * personal accounts' emails count as verified. With a single `tenant` you control,
+ * set trustEmail: true.
+ */
+export function microsoft({ clientId, clientSecret, tenant = 'common', ...rest }) {
+  const CONSUMERS = '9188040d-6c67-4c5b-b112-36a304b66dad'
+  return oauth2({
+    id: 'microsoft',
+    name: 'Microsoft',
+    clientId,
+    clientSecret,
+    scope: 'openid email profile User.Read',
+    authorization: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
+    token: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+    async profile(tokens, doFetch) {
+      const info = await getJson(doFetch, 'https://graph.microsoft.com/oidc/userinfo', tokens.access_token)
+      const claims = decodeJwtPayload(tokens.id_token)
+      return { id: String(info.sub), email: info.email ?? null, emailVerified: claims?.tid === CONSUMERS, name: info.name ?? null, image: null }
+    },
+    ...rest,
+  })
+}
+
+async function getJson(doFetch, url, accessToken) {
+  const res = await doFetch(url, { headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/json', 'User-Agent': 'slauth' } })
+  if (!res.ok) throw new Error(`slauth: ${new URL(url).host} said ${res.status} when asked for the profile.`)
+  return res.json()
+}
+
+/** Reads (doesn't check) a JWT's claims; only for tokens we got straight from the provider. */
+function decodeJwtPayload(token) {
+  try {
+    const part = String(token).split('.')[1].replace(/-/g, '+').replace(/_/g, '/')
+    return JSON.parse(atob(part + '='.repeat((4 - (part.length % 4)) % 4)))
+  } catch {
+    return null
+  }
+}