sst 2.1.16 → 2.1.17

package/constructs/future/Auth.d.ts

@@ -0,0 +1,79 @@
+import { Construct } from "constructs";
+import { Api, ApiProps } from "../Api.js";
+import { FunctionDefinition } from "../Function.js";
+import { SSTConstruct } from "../Construct.js";
+import { FunctionBindingProps } from "../util/functionBinding.js";
+export interface AuthProps {
+    /**
+     * The function that will handle authentication
+     */
+    authenticator: FunctionDefinition;
+    customDomain?: ApiProps["customDomain"];
+    cdk?: {
+        /**
+         * Allows you to override default id for this construct.
+         */
+        id?: string;
+    };
+}
+export interface ApiAttachmentProps {
+    /**
+     * The API to attach auth routes to
+     *
+     * @example
+     * ```js
+     * const api = new Api(stack, "Api", {});
+     * const auth = new Auth(stack, "Auth", {
+     *   authenticator: "functions/authenticator.handler"
+     * })
+     * auth.attach(stack, {
+     *   api
+     * })
+     * ```
+     */
+    api: Api;
+    /**
+     * Optionally specify the prefix to mount authentication routes
+     *
+     * @default "/auth"
+     *
+     * @example
+     * ```js
+     * const api = new Api(stack, "Api", {});
+     * const auth = new Auth(stack, "Auth", {
+     *   authenticator: "functions/authenticator.handler"
+     * })
+     * auth.attach(stack, {
+     *   api,
+     *   prefix: "/custom/prefix"
+     * })
+     * ```
+     */
+    prefix?: string;
+}
+/**
+ * SST Auth is a lightweight authentication solution for your applications. With a simple set of configuration you can deploy a function attached to your API that can handle various authentication flows.  *
+ * @example
+ * ```
+ * import { Auth } from "@serverless-stack/resources"
+ *
+ * new Auth(stack, "auth", {
+ *   authenticator: "functions/authenticator.handler"
+ * })
+ */
+export declare class Auth extends Construct implements SSTConstruct {
+    readonly id: string;
+    private readonly authenticator;
+    private api;
+    private publicKey;
+    private privateKey;
+    constructor(scope: Construct, id: string, props: AuthProps);
+    get url(): string;
+    /** @internal */
+    getConstructMetadata(): {
+        type: "Auth";
+        data: {};
+    };
+    /** @internal */
+    getFunctionBinding(): FunctionBindingProps;
+}

package/constructs/future/Auth.js

@@ -0,0 +1,116 @@
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Construct } from "constructs";
+import { Api } from "../Api.js";
+import { Stack } from "../Stack.js";
+import { Secret } from "../Secret.js";
+import { getParameterPath, } from "../util/functionBinding.js";
+import { CustomResource } from "aws-cdk-lib";
+/**
+ * SST Auth is a lightweight authentication solution for your applications. With a simple set of configuration you can deploy a function attached to your API that can handle various authentication flows.  *
+ * @example
+ * ```
+ * import { Auth } from "@serverless-stack/resources"
+ *
+ * new Auth(stack, "auth", {
+ *   authenticator: "functions/authenticator.handler"
+ * })
+ */
+export class Auth extends Construct {
+    id;
+    authenticator;
+    api;
+    publicKey;
+    privateKey;
+    constructor(scope, id, props) {
+        super(scope, props.cdk?.id || id);
+        if (!props.authenticator ||
+            "defaults" in props ||
+            "login" in props ||
+            "triggers" in props ||
+            "identityPoolFederation" in props ||
+            "cdk" in props) {
+            throw new Error(`It looks like you may be passing in Cognito props to the Auth construct. The Auth construct was renamed to Cognito in version 1.10.0`);
+        }
+        this.id = id;
+        const stack = Stack.of(scope);
+        this.authenticator = props.authenticator;
+        this.api = new Api(this, id + "-api", {
+            routes: {
+                "ANY /{step}": {
+                    function: this.authenticator,
+                },
+                "ANY /": {
+                    function: this.authenticator,
+                },
+            },
+            customDomain: props.customDomain,
+        });
+        this.publicKey = new Secret(this, id + "PublicKey");
+        this.privateKey = new Secret(this, id + "PrivateKey");
+        const fn = this.api.getFunction("ANY /{step}");
+        fn.bind([this.publicKey, this.privateKey]);
+        const app = this.node.root;
+        fn.addEnvironment("AUTH_ID", id);
+        fn.attachPermissions([
+            new PolicyStatement({
+                actions: ["ssm:GetParameters"],
+                effect: Effect.ALLOW,
+                resources: [
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this.publicKey, "value")}`,
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this.privateKey, "value")}`,
+                ],
+            }),
+        ]);
+        const policy = new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    actions: [
+                        "ssm:GetParameter",
+                        "ssm:PutParameter",
+                        "ssm:DeleteParameter",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter/*`,
+                    ],
+                }),
+            ],
+        });
+        stack.customResourceHandler.role?.attachInlinePolicy(policy);
+        const resource = new CustomResource(this, "StackMetadata", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::AuthKeys",
+            properties: {
+                publicPath: getParameterPath(this.publicKey, "value"),
+                privatePath: getParameterPath(this.privateKey, "value"),
+            },
+        });
+        resource.node.addDependency(policy);
+    }
+    get url() {
+        return this.api.customDomainUrl || this.api.url;
+    }
+    /** @internal */
+    getConstructMetadata() {
+        return {
+            type: "Auth",
+            data: {},
+        };
+    }
+    /** @internal */
+    getFunctionBinding() {
+        return {
+            clientPackage: "future/auth",
+            variables: {
+                publicKey: {
+                    type: "secret_reference",
+                    secret: this.publicKey,
+                },
+                url: {
+                    type: "plain",
+                    value: this.url,
+                },
+            },
+            permissions: {},
+        };
+    }
+}

package/constructs/future/index.d.ts

@@ -0,0 +1 @@
+export * from "./Auth.js";

package/constructs/future/index.js

@@ -0,0 +1 @@
+export * from "./Auth.js";

package/context/handler.d.ts

@@ -2,7 +2,7 @@ import { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2, Context as L
 export interface Handlers {
     api: {
         event: APIGatewayProxyEventV2;
-        response: APIGatewayProxyStructuredResultV2;
+        response: APIGatewayProxyStructuredResultV2 | void;
     };
     sqs: {
         event: SQSEvent;

package/node/api/index.d.ts

@@ -2,6 +2,7 @@
 /// <reference types="node/url.js" />
 /// <reference types=".pnpm/@types+node@17.0.45/node_modules/@types/node/url.js" />
 import { Handler } from "../../context/handler.js";
+import { APIGatewayProxyStructuredResultV2 } from "aws-lambda";
 export interface ApiResources {
 }
 export interface AppSyncApiResources {
@@ -23,19 +24,41 @@ export declare const WebSocketApi: WebSocketApiResources;
  * })
  * ```
  */
-export declare function ApiHandler(cb: Parameters<typeof Handler<"api">>[1]): (event: import("aws-lambda").APIGatewayProxyEventV2, context: import("aws-lambda").Context) => Promise<import("aws-lambda").APIGatewayProxyStructuredResultV2>;
-export declare const useCookies: () => any;
-export declare function useCookie(name: string): any;
+export declare function ApiHandler(cb: Parameters<typeof Handler<"api">>[1]): (event: import("aws-lambda").APIGatewayProxyEventV2, context: import("aws-lambda").Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export declare const useCookies: () => {
+    [k: string]: string;
+};
+export declare function useCookie(name: string): string | undefined;
 export declare const useBody: () => string | undefined;
 export declare const useJsonBody: () => any;
 export declare const useFormData: () => import("url").URLSearchParams | undefined;
 export declare const usePath: () => string[];
+interface CookieOptions {
+    expires?: Date;
+    maxAge?: number;
+    domain?: string;
+    path?: string;
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: "Strict" | "Lax" | "None";
+}
+export declare const useResponse: () => {
+    cookies(values: Record<string, string>, options: CookieOptions): any;
+    cookie(input: {
+        key: string;
+        value: string;
+    } & CookieOptions): any;
+    status(code: number): any;
+    header(key: string, value: string): any;
+    serialize(input: APIGatewayProxyStructuredResultV2): APIGatewayProxyStructuredResultV2;
+};
 export declare function useDomainName(): string;
 export declare function useMethod(): string;
 export declare function useHeaders(): import("aws-lambda").APIGatewayProxyEventHeaders;
 export declare function useHeader(key: string): string | undefined;
 export declare function useFormValue(name: string): string | null | undefined;
 export declare function useQueryParams(): import("aws-lambda").APIGatewayProxyEventQueryStringParameters;
-export declare function useQueryParam(name: string): string | undefined;
+export declare function useQueryParam<T = string>(name: string): T | undefined;
 export declare function usePathParams(): import("aws-lambda").APIGatewayProxyEventPathParameters;
 export declare function usePathParam(name: string): string | undefined;
+export {};

package/node/api/index.js

@@ -19,12 +19,16 @@ Object.assign(WebSocketApi, getVariables("WebSocketApi"));
  * ```
  */
 export function ApiHandler(cb) {
-    return Handler("api", cb);
+    return Handler("api", async (evt, ctx) => {
+        const result = await cb(evt, ctx);
+        const serialized = useResponse().serialize(result || {});
+        return serialized;
+    });
 }
 export const useCookies = /* @__PURE__ */ Context.memo(() => {
     const evt = useEvent("api");
     const cookies = evt.cookies || [];
-    return Object.fromEntries(cookies.map((c) => c.split("=")));
+    return Object.fromEntries(cookies.map((c) => c.split("=")).map(([k, v]) => [k, decodeURIComponent(v)]));
 });
 export function useCookie(name) {
     const cookies = useCookies();
@@ -56,6 +60,64 @@ export const usePath = /* @__PURE__ */ Context.memo(() => {
     const evt = useEvent("api");
     return evt.rawPath.split("/").filter(Boolean);
 });
+export const useResponse = /* @__PURE__ */ Context.memo(() => {
+    const response = {
+        headers: {},
+        cookies: [],
+    };
+    const result = {
+        cookies(values, options) {
+            for (const [key, value] of Object.entries(values)) {
+                result.cookie({
+                    key,
+                    value,
+                    ...options,
+                });
+            }
+            return result;
+        },
+        cookie(input) {
+            const value = encodeURIComponent(input.value);
+            const parts = [input.key + "=" + value];
+            if (input.domain)
+                parts.push("Domain=" + input.domain);
+            if (input.path)
+                parts.push("Path=" + input.path);
+            if (input.expires)
+                parts.push("Expires=" + input.expires.toUTCString());
+            if (input.maxAge)
+                parts.push("Max-Age=" + input.maxAge);
+            if (input.httpOnly)
+                parts.push("HttpOnly");
+            if (input.secure)
+                parts.push("Secure");
+            if (input.sameSite)
+                parts.push("SameSite=" + input.sameSite);
+            response.cookies.push(parts.join("; "));
+            return result;
+        },
+        status(code) {
+            response.statusCode = code;
+            return result;
+        },
+        header(key, value) {
+            response.headers[key] = value;
+            return result;
+        },
+        serialize(input) {
+            return {
+                ...response,
+                ...input,
+                cookies: [...(input.cookies || []), ...response.cookies],
+                headers: {
+                    ...response.headers,
+                    ...input.headers,
+                },
+            };
+        },
+    };
+    return result;
+});
 export function useDomainName() {
     const evt = useEvent("api");
     return evt.requestContext.domainName;

package/node/auth/index.d.ts

@@ -8,3 +8,6 @@ export * from "./adapter/github.js";
 export * from "./adapter/oidc.js";
 export * from "./adapter/oauth.js";
 export * from "./adapter/link.js";
+export interface AuthResources {
+}
+export declare const Auth: AuthResources;

package/node/auth/index.js

@@ -8,3 +8,6 @@ export * from "./adapter/github.js";
 export * from "./adapter/oidc.js";
 export * from "./adapter/oauth.js";
 export * from "./adapter/link.js";
+import { createProxy, getVariables } from "../util/index.js";
+export const Auth = createProxy("Auth");
+Object.assign(Auth, await getVariables("Auth"));

package/node/future/auth/adapter/adapter.d.ts

@@ -0,0 +1,10 @@
+import { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2 } from "aws-lambda";
+export type Adapter<T = any> = (evt: APIGatewayProxyEventV2) => Promise<{
+    type: "step";
+    properties: APIGatewayProxyStructuredResultV2;
+} | {
+    type: "success";
+    properties: T;
+} | {
+    type: "error";
+}>;

package/node/future/auth/adapter/adapter.js

@@ -0,0 +1 @@
+export {};

package/node/future/auth/adapter/github.d.ts

@@ -0,0 +1,16 @@
+import { OauthBasicConfig } from "./oauth.js";
+export declare const GithubAdapter: (config: OauthBasicConfig) => () => Promise<{
+    type: "success";
+    properties: {
+        tokenset: import("openid-client").TokenSet;
+        client: import("openid-client").BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+}>;

package/node/future/auth/adapter/github.js

@@ -0,0 +1,22 @@
+import { Issuer } from "openid-client";
+import { OauthAdapter } from "./oauth.js";
+import { OidcAdapter } from "./oidc.js";
+const issuer = new Issuer({
+    issuer: "https://github.com",
+    authorization_endpoint: "https://github.com/login/oauth/authorize",
+    token_endpoint: "https://github.com/login/oauth/access_token",
+});
+export const GithubAdapter = 
+/* @__PURE__ */
+(config) => {
+    if (config.clientSecret) {
+        return OauthAdapter({
+            issuer,
+            ...config,
+        });
+    }
+    return OidcAdapter({
+        issuer,
+        ...config,
+    });
+};

package/node/future/auth/adapter/google.d.ts

@@ -0,0 +1,20 @@
+import { OidcBasicConfig } from "./oidc.js";
+type GoogleConfig = OidcBasicConfig & {
+    mode: "oidc";
+};
+export declare function GoogleAdapter(config: GoogleConfig): () => Promise<{
+    type: "success";
+    properties: {
+        tokenset: import("openid-client").TokenSet;
+        client: import("openid-client").BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+}>;
+export {};

package/node/future/auth/adapter/google.js

@@ -0,0 +1,10 @@
+import { Issuer } from "openid-client";
+import { OidcAdapter } from "./oidc.js";
+const issuer = await Issuer.discover("https://accounts.google.com");
+export function GoogleAdapter(config) {
+    return OidcAdapter({
+        issuer,
+        scope: "openid email profile",
+        ...config,
+    });
+}

package/node/future/auth/adapter/link.d.ts

@@ -0,0 +1,11 @@
+import { APIGatewayProxyStructuredResultV2 } from "aws-lambda";
+export declare function LinkAdapter(config: {
+    onLink: (link: string, claims: Record<string, any>) => Promise<APIGatewayProxyStructuredResultV2>;
+    onError: () => Promise<APIGatewayProxyStructuredResultV2>;
+}): () => Promise<{
+    type: "step";
+    properties: APIGatewayProxyStructuredResultV2;
+} | {
+    type: "success";
+    properties: any;
+}>;

package/node/future/auth/adapter/link.js

@@ -0,0 +1,48 @@
+import { createSigner, createVerifier } from "fast-jwt";
+import { Config } from "../../../config/index.js";
+import { useDomainName, usePathParam, useQueryParam, useQueryParams, } from "../../../api/index.js";
+export function LinkAdapter(config) {
+    // @ts-expect-error
+    const key = Config[process.env.AUTH_ID + "PrivateKey"];
+    const signer = createSigner({
+        expiresIn: 1000 * 60 * 10,
+        key,
+        algorithm: "RS512",
+    });
+    return async function () {
+        const callback = "https://" + useDomainName() + "/callback";
+        const step = usePathParam("step");
+        if (step === "authorize") {
+            const url = new URL(callback);
+            const claims = useQueryParams();
+            url.searchParams.append("token", signer(claims));
+            return {
+                type: "step",
+                properties: await config.onLink(url.toString(), claims),
+            };
+        }
+        if (step === "callback") {
+            const token = useQueryParam("token");
+            if (!token)
+                throw new Error("Missing token parameter");
+            try {
+                const verifier = createVerifier({
+                    algorithms: ["RS512"],
+                    key,
+                });
+                const jwt = verifier(token);
+                return {
+                    type: "success",
+                    properties: jwt,
+                };
+            }
+            catch {
+                return {
+                    type: "step",
+                    properties: await config.onError(),
+                };
+            }
+        }
+        throw new Error("Invalid auth request");
+    };
+}

package/node/future/auth/adapter/oauth.d.ts

@@ -0,0 +1,34 @@
+import { BaseClient, Issuer, TokenSet } from "openid-client";
+export interface OauthBasicConfig {
+    /**
+     * The clientID provided by the third party oauth service
+     */
+    clientID: string;
+    /**
+     * The clientSecret provided by the third party oauth service
+     */
+    clientSecret: string;
+    /**
+     * Various scopes requested for the access token
+     */
+    scope: string;
+    prompt?: string;
+}
+export interface OauthConfig extends OauthBasicConfig {
+    issuer: Issuer;
+}
+export declare const OauthAdapter: (config: OauthConfig) => () => Promise<{
+    type: "success";
+    properties: {
+        tokenset: TokenSet;
+        client: BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+}>;

package/node/future/auth/adapter/oauth.js

@@ -0,0 +1,66 @@
+import { generators } from "openid-client";
+import { useCookie, useDomainName, usePathParam, useQueryParams, useResponse, } from "../../../api/index.js";
+export const OauthAdapter = 
+/* @__PURE__ */
+(config) => {
+    return async function () {
+        const step = usePathParam("step");
+        const callback = "https://" + useDomainName() + "/callback";
+        const client = new config.issuer.Client({
+            client_id: config.clientID,
+            client_secret: config.clientSecret,
+            redirect_uris: [callback],
+            response_types: ["code"],
+        });
+        if (step === "authorize") {
+            const code_verifier = generators.codeVerifier();
+            const state = generators.state();
+            const code_challenge = generators.codeChallenge(code_verifier);
+            const url = client.authorizationUrl({
+                scope: config.scope,
+                code_challenge: code_challenge,
+                code_challenge_method: "S256",
+                state,
+                prompt: config.prompt,
+            });
+            useResponse().cookies({
+                auth_code_verifier: code_verifier,
+                auth_state: state,
+            }, {
+                httpOnly: true,
+                secure: true,
+                maxAge: 60 * 10,
+                sameSite: "None",
+            });
+            return {
+                type: "step",
+                properties: {
+                    statusCode: 302,
+                    headers: {
+                        location: url,
+                    },
+                },
+            };
+        }
+        if (step === "callback") {
+            const params = useQueryParams();
+            const code_verifier = useCookie("auth_code_verifier");
+            const state = useCookie("auth_state");
+            const tokenset = await client[config.issuer.metadata.userinfo_endpoint
+                ? "callback"
+                : "oauthCallback"](callback, params, {
+                code_verifier,
+                state,
+            });
+            const x = {
+                type: "success",
+                properties: {
+                    tokenset,
+                    client,
+                },
+            };
+            return x;
+        }
+        throw new Error("Invalid auth request");
+    };
+};

package/node/future/auth/adapter/oidc.d.ts

@@ -0,0 +1,26 @@
+import { Issuer } from "openid-client";
+export interface OidcBasicConfig {
+    /**
+     * The clientID provided by the third party oauth service
+     */
+    clientID: string;
+}
+export interface OidcConfig extends OidcBasicConfig {
+    issuer: Issuer;
+    scope: string;
+}
+export declare const OidcAdapter: (config: OidcConfig) => () => Promise<{
+    type: "success";
+    properties: {
+        tokenset: import("openid-client").TokenSet;
+        client: import("openid-client").BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+}>;

package/node/future/auth/adapter/oidc.js

@@ -0,0 +1,62 @@
+import { generators } from "openid-client";
+import { useCookie, useDomainName, useFormData, usePathParam, useResponse, } from "../../../api/index.js";
+export const OidcAdapter = /* @__PURE__ */ (config) => {
+    return async function () {
+        const step = usePathParam("step");
+        const callback = "https://" + useDomainName() + "/callback";
+        const client = new config.issuer.Client({
+            client_id: config.clientID,
+            redirect_uris: [callback],
+            response_types: ["id_token"],
+        });
+        if (step === "authorize") {
+            const nonce = generators.nonce();
+            const state = generators.state();
+            const url = client.authorizationUrl({
+                scope: config.scope,
+                response_mode: "form_post",
+                nonce,
+                state,
+            });
+            useResponse().cookies({
+                auth_nonce: nonce,
+                auth_state: state,
+            }, {
+                httpOnly: true,
+                secure: true,
+                maxAge: 60 * 10,
+                sameSite: "None",
+            });
+            return {
+                type: "step",
+                properties: {
+                    statusCode: 302,
+                    headers: {
+                        location: url,
+                    },
+                },
+            };
+        }
+        if (step === "callback") {
+            const form = useFormData();
+            if (!form)
+                throw new Error("Missing body");
+            const params = Object.fromEntries(form.entries());
+            const nonce = useCookie("auth_nonce");
+            const state = useCookie("auth_state");
+            const tokenset = await client.callback(callback, params, {
+                nonce,
+                state,
+            });
+            const x = {
+                type: "success",
+                properties: {
+                    tokenset,
+                    client,
+                },
+            };
+            return x;
+        }
+        throw new Error("Invalid auth request");
+    };
+};

package/node/future/auth/handler.d.ts

@@ -0,0 +1,18 @@
+import { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2 } from "aws-lambda";
+import { Adapter } from "./adapter/adapter.js";
+import { SignerOptions } from "fast-jwt";
+import { SessionValue } from "./session.js";
+export declare function AuthHandler<Providers extends Record<string, Adapter<any>>, Result = {
+    [key in keyof Providers]: {
+        provider: key;
+    } & Extract<Awaited<ReturnType<Providers[key]>>, {
+        type: "success";
+    }>["properties"];
+}[keyof Providers]>(input: {
+    providers: Providers;
+    clients: () => Promise<Record<string, string>>;
+    onAuthorize?: (event: APIGatewayProxyEventV2) => Promise<void | keyof Providers>;
+    onSuccess: (input: Result) => Promise<SessionCreateInput>;
+    onError: () => Promise<APIGatewayProxyStructuredResultV2>;
+}): (event: APIGatewayProxyEventV2, context: import("aws-lambda").Context) => Promise<APIGatewayProxyStructuredResultV2>;
+export type SessionCreateInput = SessionValue & Partial<SignerOptions>;

package/node/future/auth/handler.js

@@ -0,0 +1,189 @@
+import { createSigner, createVerifier } from "fast-jwt";
+import { ApiHandler, useCookie, useCookies, useFormValue, usePathParam, useQueryParam, useQueryParams, useResponse, } from "../../api/index.js";
+import { Config } from "../../config/index.js";
+export function AuthHandler(input) {
+    return ApiHandler(async (evt) => {
+        const step = usePathParam("step");
+        if (!step) {
+            return {
+                statusCode: 200,
+                headers: {
+                    "Content-Type": "text/html",
+                },
+                body: `
+          <html>
+            <body>
+            ${Object.keys(input.providers).map((name) => {
+                    return `<a href="/authorize?provider=${name}&response_type=code&client_id=local&redirect_uri=http://localhost:300">${name}</a>`;
+                })}
+            </body>
+          </html>
+        `,
+            };
+        }
+        if (step === "token") {
+            if (useFormValue("grant_type") !== "authorization_code") {
+                return {
+                    statusCode: 400,
+                    body: "Invalid grant_type",
+                };
+            }
+            const code = useFormValue("code");
+            if (!code) {
+                return {
+                    statusCode: 400,
+                    body: "Missing code",
+                };
+            }
+            // @ts-expect-error
+            const pub = Config[process.env.AUTH_ID + "PublicKey"];
+            const verified = createVerifier({
+                algorithms: ["RS512"],
+                key: pub,
+            })(code);
+            if (verified.redirect_uri !== useFormValue("redirect_uri")) {
+                return {
+                    statusCode: 400,
+                    body: "redirect_uri mismatch",
+                };
+            }
+            if (verified.client_id !== useFormValue("client_id")) {
+                return {
+                    statusCode: 400,
+                    body: "client_id mismatch",
+                };
+            }
+            return {
+                statusCode: 200,
+                headers: {
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    access_token: verified.token,
+                }),
+            };
+        }
+        let provider = useCookie("provider");
+        if (step === "authorize") {
+            provider = useQueryParam("provider");
+            if (input.onAuthorize) {
+                const result = await input.onAuthorize(evt);
+                if (result)
+                    provider = result;
+            }
+            if (!provider) {
+                return {
+                    statusCode: 400,
+                    body: "Missing provider",
+                };
+            }
+            const { response_type, client_id, redirect_uri, state } = useQueryParams();
+            if (!provider) {
+                return {
+                    statusCode: 400,
+                    body: "Missing provider",
+                };
+            }
+            if (!response_type) {
+                return {
+                    statusCode: 400,
+                    body: "Missing response_type",
+                };
+            }
+            if (!client_id) {
+                return {
+                    statusCode: 400,
+                    body: "Missing client_id",
+                };
+            }
+            if (!redirect_uri) {
+                return {
+                    statusCode: 400,
+                    body: "Missing redirect_uri",
+                };
+            }
+            useResponse().cookies({
+                provider: provider,
+                response_type: response_type,
+                client_id: client_id,
+                redirect_uri: redirect_uri,
+                state: state || "",
+            }, {
+                maxAge: 60 * 15,
+                secure: true,
+                sameSite: "None",
+                httpOnly: true,
+            });
+        }
+        if (!provider || !input.providers[provider]) {
+            return {
+                statusCode: 400,
+                body: `Was not able to find provider "${String(provider)}"`,
+                headers: {
+                    "Content-Type": "text/html",
+                },
+            };
+        }
+        const adapter = input.providers[provider];
+        const result = await adapter(evt);
+        if (result.type === "step") {
+            return result.properties;
+        }
+        if (result.type === "success") {
+            const { type, properties, ...rest } = await input.onSuccess({
+                provider,
+                ...result.properties,
+            });
+            // @ts-expect-error
+            const priv = Config[process.env.AUTH_ID + "PrivateKey"];
+            const signer = createSigner({
+                ...rest,
+                key: priv,
+                algorithm: "RS512",
+            });
+            const token = signer({
+                type,
+                properties,
+            });
+            const { client_id, response_type, redirect_uri, state } = {
+                ...useCookies(),
+                ...useQueryParams(),
+            };
+            if (response_type === "token") {
+                return {
+                    statusCode: 302,
+                    headers: {
+                        Location: `${redirect_uri}#access_token=${token}&state=${state || ""}`,
+                    },
+                };
+            }
+            if (response_type === "code") {
+                // This allows the code to be reused within a 30 second window
+                // The code should be single use but we're making this tradeoff to remain stateless
+                // In the future can store this in a dynamo table to ensure single use
+                const code = createSigner({
+                    expiresIn: 1000 * 60 * 5,
+                    key: priv,
+                    algorithm: "RS512",
+                })({
+                    client_id,
+                    redirect_uri,
+                    token: token,
+                });
+                return {
+                    statusCode: 302,
+                    headers: {
+                        Location: `${redirect_uri}?code=${code}&state=${state || ""}`,
+                    },
+                };
+            }
+            return {
+                statusCode: 400,
+                body: `Unsupported response_type: ${response_type}`,
+            };
+        }
+        if (result.type === "error") {
+            return input.onError();
+        }
+    });
+}

package/node/future/auth/index.d.ts

@@ -0,0 +1,10 @@
+export interface AuthResources {
+}
+export declare const Auth: AuthResources;
+export * from "./adapter/oidc.js";
+export * from "./adapter/google.js";
+export * from "./adapter/link.js";
+export * from "./adapter/github.js";
+export * from "./adapter/oauth.js";
+export * from "./session.js";
+export * from "./handler.js";

package/node/future/auth/index.js

@@ -0,0 +1,10 @@
+import { createProxy, getVariables } from "../../util/index.js";
+export const Auth = createProxy("Auth");
+Object.assign(Auth, getVariables("Auth"));
+export * from "./adapter/oidc.js";
+export * from "./adapter/google.js";
+export * from "./adapter/link.js";
+export * from "./adapter/github.js";
+export * from "./adapter/oauth.js";
+export * from "./session.js";
+export * from "./handler.js";

package/node/future/auth/session.d.ts

@@ -0,0 +1,46 @@
+import { SignerOptions } from "fast-jwt";
+export interface SessionTypes {
+    public: {};
+}
+export type SessionValue = {
+    [type in keyof SessionTypes]: {
+        type: type;
+        properties: SessionTypes[type];
+    };
+}[keyof SessionTypes];
+export declare function useSession<T = SessionValue>(): T;
+/**
+ * Creates a new session token with provided information
+ *
+ * @example
+ * ```js
+ * Session.create({
+ *   type: "user",
+ *   properties: {
+ *     userID: "123"
+ *   }
+ * })
+ * ```
+ */
+declare function create<T extends keyof SessionTypes>(input: {
+    type: T;
+    properties: SessionTypes[T];
+    options?: Partial<SignerOptions>;
+}): string;
+/**
+ * Verifies a session token and returns the session data
+ *
+ * @example
+ * ```js
+ * Session.verify()
+ * ```
+ */
+declare function verify<T = SessionValue>(token: string): T | {
+    type: string;
+    properties: {};
+};
+export declare const Session: {
+    create: typeof create;
+    verify: typeof verify;
+};
+export {};

package/node/future/auth/session.js

@@ -0,0 +1,99 @@
+import { createSigner, createVerifier } from "fast-jwt";
+import { Context } from "../../../context/context.js";
+import { useCookie, useHeader } from "../../api/index.js";
+import { Auth } from "../../auth/index.js";
+import { Config } from "../../config/index.js";
+const SessionMemo = /* @__PURE__ */ Context.memo(() => {
+    let token = "";
+    const header = useHeader("authorization");
+    if (header)
+        token = header.substring(7);
+    const cookie = useCookie("sst_auth_token");
+    if (cookie)
+        token = cookie;
+    if (token) {
+        try {
+            const jwt = createVerifier({
+                algorithms: ["RS512"],
+                key: getPublicKey(),
+            })(token);
+            return jwt;
+        }
+        catch {
+            return {
+                type: "public",
+                properties: {},
+            };
+        }
+    }
+    return {
+        type: "public",
+        properties: {},
+    };
+});
+// This is a crazy TS hack to prevent the types from being evaluated too soon
+export function useSession() {
+    const ctx = SessionMemo();
+    return ctx;
+}
+function getPublicKey() {
+    const [first] = Object.values(Auth);
+    if (!first)
+        throw new Error("No auth provider found. Did you forget to add one?");
+    return first.publicKey;
+}
+/**
+ * Creates a new session token with provided information
+ *
+ * @example
+ * ```js
+ * Session.create({
+ *   type: "user",
+ *   properties: {
+ *     userID: "123"
+ *   }
+ * })
+ * ```
+ */
+function create(input) {
+    // @ts-expect-error
+    const key = Config[process.env.AUTH_ID + "PrivateKey"];
+    const signer = createSigner({
+        ...input.options,
+        key,
+        algorithm: "RS512",
+    });
+    const token = signer({
+        type: input.type,
+        properties: input.properties,
+    });
+    return token;
+}
+/**
+ * Verifies a session token and returns the session data
+ *
+ * @example
+ * ```js
+ * Session.verify()
+ * ```
+ */
+function verify(token) {
+    if (token) {
+        try {
+            const jwt = createVerifier({
+                algorithms: ["RS512"],
+                key: getPublicKey(),
+            })(token);
+            return jwt;
+        }
+        catch { }
+    }
+    return {
+        type: "public",
+        properties: {},
+    };
+}
+export const Session = {
+    create,
+    verify,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.1.16",
+  "version": "2.1.17",
   "bin": {
     "sst": "cli/sst.js"
   },
@@ -14,8 +14,10 @@
   },
   "exports": {
     "./constructs/deprecated": "./constructs/deprecated/index.js",
+    "./constructs/future": "./constructs/future/index.js",
     "./constructs": "./constructs/index.js",
     "./context": "./context/index.js",
+    "./node/future/*": "./node/future/*/index.js",
     "./node/*": "./node/*/index.js",
     ".": "./index.js",
     "./*": "./*"
@@ -113,6 +115,7 @@
     "@types/ws": "^8.5.3",
     "@types/yargs": "^17.0.13",
     "tsx": "^3.12.1",
+    "typescript": "^4.9.5",
     "vitest": "^0.28.3"
   },
   "peerDependencies": {