sst 2.26.6 → 2.26.7

package/cli/commands/bind.js

@@ -42,7 +42,7 @@ export const bind = (program) => program
         if (!command) {
             throw new VisibleError("Command is required, e.g. sst bind npm run script");
         }
-        await useIOT();
+        useIOT();
         const bus = useBus();
         const project = useProject();
         let p;

package/config.js

@@ -179,6 +179,7 @@ async function* scanParameters(prefix) {
             Recursive: true,
             NextToken: token,
         }));
+        console.log("results", results.Parameters?.length);
         yield* results.Parameters || [];
         if (!results.NextToken)
             break;

package/constructs/App.js

@@ -257,7 +257,9 @@ export class App extends CDKApp {
                 // Tag stacks
                 Tags.of(child).add("sst:app", this.name);
                 Tags.of(child).add("sst:stage", this.stage);
-                if (child instanceof Stack && !this.isRunningSSTTest()) {
+                if (child instanceof Stack &&
+                    !this.isRunningSSTTest() &&
+                    this.mode !== "dev") {
                     const bootstrap = await useBootstrap();
                     const functions = useFunctions();
                     const sourcemaps = functions.sourcemaps.forStack(child.stackName);

package/node/auth/adapter/link.js

@@ -12,7 +12,7 @@ export const LinkAdapter = /* @__PURE__ */ createAdapter((config) => {
         const [step] = usePath().slice(-1);
         const callback = "https://" +
             [useDomainName(), ...usePath().slice(0, -1), "callback"].join("/");
-        if (step === "authorize") {
+        if (step === "authorize" || step === "connect") {
             const url = new URL(callback);
             const claims = useQueryParams();
             url.searchParams.append("token", signer(claims));

package/node/auth/adapter/oauth.js

@@ -12,7 +12,7 @@ export const OauthAdapter = /* @__PURE__ */ createAdapter((config) => {
             redirect_uris: [callback],
             response_types: ["code"],
         });
-        if (step === "authorize") {
+        if (step === "authorize" || step === "connect") {
             const code_verifier = generators.codeVerifier();
             const state = generators.state();
             const code_challenge = generators.codeChallenge(code_verifier);

package/node/auth/adapter/oidc.js

@@ -11,7 +11,7 @@ export const OidcAdapter = /* @__PURE__ */ createAdapter((config) => {
             redirect_uris: [callback],
             response_types: ["id_token"],
         });
-        if (step === "authorize") {
+        if (step === "authorize" || step === "connect") {
             const nonce = generators.nonce();
             const state = generators.state();
             const url = client.authorizationUrl({

package/node/future/auth/adapter/adapter.d.ts

@@ -7,4 +7,9 @@ export type Adapter<T = any> = (evt: APIGatewayProxyEventV2) => Promise<{
     properties: T;
 } | {
     type: "error";
-}>;
+    error: AdapterError;
+} | undefined>;
+export declare class AdapterError extends Error {
+}
+export declare class AdapterUnknownError extends AdapterError {
+}

package/node/future/auth/adapter/adapter.js

@@ -1 +1,4 @@
-export {};
+export class AdapterError extends Error {
+}
+export class AdapterUnknownError extends AdapterError {
+}

package/node/future/auth/adapter/code.d.ts

@@ -6,12 +6,9 @@ export declare function CodeAdapter(config: {
 }): () => Promise<{
     type: "step";
     properties: APIGatewayProxyStructuredResultV2;
-} | {
-    type: "error";
-    properties?: undefined;
 } | {
     type: "success";
     properties: {
         claims: any;
     };
-}>;
+} | undefined>;

package/node/future/auth/adapter/code.js

@@ -12,7 +12,7 @@ export function CodeAdapter(config) {
     }
     return async function () {
         const step = usePathParam("step");
-        if (step === "authorize") {
+        if (step === "authorize" || step === "connect") {
             const code = generate();
             const claims = useQueryParams();
             delete claims["client_id"];
@@ -39,7 +39,8 @@ export function CodeAdapter(config) {
             const { code, claims } = JSON.parse(decrypt(useCookie("authorization")));
             if (!code || !claims) {
                 return {
-                    type: "error",
+                    type: "step",
+                    properties: await config.onCodeInvalid(code, claims),
                 };
             }
             const compare = useQueryParam("code");
@@ -61,8 +62,5 @@ export function CodeAdapter(config) {
                 },
             };
         }
-        return {
-            type: "error",
-        };
     };
 }

package/node/future/auth/adapter/facebook.d.ts

@@ -13,4 +13,9 @@ export declare const FacebookAdapter: (config: OauthBasicConfig) => () => Promis
             location: string;
         };
     };
-}>;
+    error?: undefined;
+} | {
+    type: "error";
+    error: import("./oauth.js").OauthError;
+    properties?: undefined;
+} | undefined>;

package/node/future/auth/adapter/github.d.ts

@@ -5,7 +5,7 @@ type Config = ({
 } & OauthBasicConfig) | ({
     mode: "oidc";
 } & OidcBasicConfig);
-export declare const GithubAdapter: (config: Config) => () => Promise<{
+export declare const GithubAdapter: (config: Config) => (() => Promise<{
     type: "success";
     properties: {
         tokenset: import("openid-client").TokenSet;
@@ -19,5 +19,24 @@ export declare const GithubAdapter: (config: Config) => () => Promise<{
             location: string;
         };
     };
-}>;
+}>) | (() => Promise<{
+    type: "success";
+    properties: {
+        tokenset: import("openid-client").TokenSet;
+        client: import("openid-client").BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+    error?: undefined;
+} | {
+    type: "error";
+    error: import("./oauth.js").OauthError;
+    properties?: undefined;
+} | undefined>);
 export {};

package/node/future/auth/adapter/google.d.ts

@@ -10,7 +10,7 @@ type GoogleConfig = (OauthBasicConfig & {
     mode: "oidc";
     prompt?: GooglePrompt;
 });
-export declare function GoogleAdapter(config: GoogleConfig): () => Promise<{
+export declare function GoogleAdapter(config: GoogleConfig): (() => Promise<{
     type: "success";
     properties: {
         tokenset: import("openid-client").TokenSet;
@@ -24,5 +24,24 @@ export declare function GoogleAdapter(config: GoogleConfig): () => Promise<{
             location: string;
         };
     };
-}>;
+}>) | (() => Promise<{
+    type: "success";
+    properties: {
+        tokenset: import("openid-client").TokenSet;
+        client: import("openid-client").BaseClient;
+    };
+} | {
+    type: "step";
+    properties: {
+        statusCode: number;
+        headers: {
+            location: string;
+        };
+    };
+    error?: undefined;
+} | {
+    type: "error";
+    error: import("./oauth.js").OauthError;
+    properties?: undefined;
+} | undefined>);
 export {};

package/node/future/auth/adapter/link.d.ts

@@ -7,7 +7,4 @@ export declare function LinkAdapter(config: {
 } | {
     type: "success";
     properties: any;
-} | {
-    type: "error";
-    properties?: undefined;
-}>;
+} | undefined>;

package/node/future/auth/adapter/link.js

@@ -14,7 +14,7 @@ export function LinkAdapter(config) {
         });
         const callback = "https://" + useDomainName() + "/callback";
         const step = usePathParam("step");
-        if (step === "authorize") {
+        if (step === "authorize" || step === "connect") {
             const url = new URL(callback);
             const claims = useQueryParams();
             url.searchParams.append("token", signer(claims));
@@ -40,8 +40,5 @@ export function LinkAdapter(config) {
             }
             catch (ex) { }
         }
-        return {
-            type: "error",
-        };
     };
 }

package/node/future/auth/adapter/oauth.d.ts

@@ -1,4 +1,5 @@
 import { BaseClient, Issuer, TokenSet } from "openid-client";
+import { AdapterError } from "./adapter.js";
 export interface OauthBasicConfig {
     /**
      * The clientID provided by the third party oauth service
@@ -24,6 +25,8 @@ export interface OauthBasicConfig {
 export interface OauthConfig extends OauthBasicConfig {
     issuer: Issuer;
 }
+export declare class OauthError extends AdapterError {
+}
 export declare const OauthAdapter: (config: OauthConfig) => () => Promise<{
     type: "success";
     properties: {
@@ -38,4 +41,9 @@ export declare const OauthAdapter: (config: OauthConfig) => () => Promise<{
             location: string;
         };
     };
-}>;
+    error?: undefined;
+} | {
+    type: "error";
+    error: OauthError;
+    properties?: undefined;
+} | undefined>;

package/node/future/auth/adapter/oauth.js

@@ -1,18 +1,22 @@
 import { generators } from "openid-client";
 import { useCookie, useDomainName, usePathParam, useQueryParams, useResponse, } from "../../../api/index.js";
+import { AdapterError } from "./adapter.js";
+export class OauthError extends AdapterError {
+}
 export const OauthAdapter = 
 /* @__PURE__ */
 (config) => {
     return async function () {
         const step = usePathParam("step");
         const callback = "https://" + useDomainName() + "/callback";
+        console.log("callback", callback);
         const client = new config.issuer.Client({
             client_id: config.clientID,
             client_secret: config.clientSecret,
             redirect_uris: [callback],
             response_types: ["code"],
         });
-        if (step === "authorize") {
+        if (step === "authorize" || step === "connect") {
             const code_verifier = generators.codeVerifier();
             const state = generators.state();
             const code_challenge = generators.codeChallenge(code_verifier);
@@ -45,6 +49,12 @@ export const OauthAdapter =
         }
         if (step === "callback") {
             const params = useQueryParams();
+            if (params.error) {
+                return {
+                    type: "error",
+                    error: new OauthError(params.error),
+                };
+            }
             const code_verifier = useCookie("auth_code_verifier");
             const state = useCookie("auth_state");
             const tokenset = await client[config.issuer.metadata.userinfo_endpoint
@@ -62,6 +72,5 @@ export const OauthAdapter =
             };
             return x;
         }
-        throw new Error("Invalid auth request");
     };
 };

package/node/future/auth/adapter/oidc.js

@@ -9,7 +9,7 @@ export const OidcAdapter = /* @__PURE__ */ (config) => {
             redirect_uris: [callback],
             response_types: ["id_token"],
         });
-        if (step === "authorize") {
+        if (step === "authorize" || step === "connect") {
             const nonce = generators.nonce();
             const state = generators.state();
             const url = client.authorizationUrl({

package/node/future/auth/adapter/spotify.d.ts

@@ -20,4 +20,9 @@ export declare const SpotifyAdapter: (config: OauthBasicConfig) => () => Promise
             location: string;
         };
     };
-}>;
+    error?: undefined;
+} | {
+    type: "error";
+    error: import("./oauth.js").OauthError;
+    properties?: undefined;
+} | undefined>;

package/node/future/auth/handler.d.ts

@@ -1,8 +1,11 @@
 import { APIGatewayProxyEventV2, APIGatewayProxyStructuredResultV2 } from "aws-lambda";
 import { Adapter } from "./adapter/adapter.js";
 import { SignerOptions } from "fast-jwt";
-import { SessionBuilder, SessionValue } from "./session.js";
-interface OnSuccessResponder<T> {
+import { SessionBuilder } from "./session.js";
+interface OnSuccessResponder<T extends {
+    type: any;
+    properties: any;
+}> {
     session(input: T & Partial<SignerOptions>): {
         type: "session";
         properties: T;
@@ -12,10 +15,25 @@ interface OnSuccessResponder<T> {
         properties: typeof input;
     };
 }
-export declare class UnknownProviderError {
+export declare class UnknownProviderError extends Error {
     provider?: string | undefined;
     constructor(provider?: string | undefined);
 }
+export declare class MissingParameterError extends Error {
+    parameter: string;
+    constructor(parameter: string);
+}
+export declare class UnknownStateError extends Error {
+    constructor();
+}
+export declare class UnauthorizedClientError extends Error {
+    client: string;
+    redirect_uri: string;
+    constructor(client: string, redirect_uri: string);
+}
+export declare class InvalidSessionError extends Error {
+    constructor();
+}
 export declare function AuthHandler<Providers extends Record<string, Adapter<any>>, Sessions extends SessionBuilder, Result = {
     [key in keyof Providers]: {
         provider: key;
@@ -25,22 +43,32 @@ export declare function AuthHandler<Providers extends Record<string, Adapter<any
 }[keyof Providers]>(input: {
     providers: Providers;
     sessions?: Sessions;
-    /** @deprecated use allowClient callback instead */
+    /** @deprecated use on.auth.allowClient callback instead */
     clients?: () => Promise<Record<string, string>>;
+    /** @deprecated use on.auth.allowClient callback instead */
     allowClient?: (clientID: string, redirect: string) => Promise<boolean>;
+    /** @deprecated use on.auth.start callback instead */
     onAuthorize?: (event: APIGatewayProxyEventV2) => Promise<void | keyof Providers>;
-    onSuccess: (input: Result, response: OnSuccessResponder<SessionValue | {
-        [key in keyof Sessions["$type"]]: {
-            type: key;
-            properties: Sessions["$type"][key];
+    /** @deprecated use on.auth.success callback instead */
+    onSuccess?: (input: Result, response: OnSuccessResponder<Sessions["$typeValues"]>) => Promise<ReturnType<OnSuccessResponder<Sessions["$typeValues"]>[keyof OnSuccessResponder<any>]>>;
+    /** @deprecated on.index callback instead */
+    onIndex?: (event: APIGatewayProxyEventV2) => Promise<APIGatewayProxyStructuredResultV2>;
+    /** @deprecated use on.error callback instead */
+    onError?: (error: MissingParameterError | UnauthorizedClientError | UnknownProviderError) => Promise<APIGatewayProxyStructuredResultV2 | undefined>;
+    callbacks: {
+        index?(event: APIGatewayProxyEventV2): Promise<APIGatewayProxyStructuredResultV2>;
+        error?(error: UnknownStateError): Promise<APIGatewayProxyStructuredResultV2 | undefined>;
+        auth: {
+            error?(error: MissingParameterError | UnauthorizedClientError | UnknownProviderError): Promise<APIGatewayProxyStructuredResultV2 | undefined>;
+            start?(event: APIGatewayProxyEventV2): Promise<void>;
+            allowClient(clientID: string, redirect: string): Promise<boolean>;
+            success(input: Result, response: OnSuccessResponder<Sessions["$typeValues"]>): Promise<ReturnType<OnSuccessResponder<Sessions["$typeValues"]>[keyof OnSuccessResponder<any>]>>;
         };
-    }[keyof Sessions["$type"]]>) => Promise<ReturnType<OnSuccessResponder<SessionValue | {
-        [key in keyof Sessions["$type"]]: {
-            type: key;
-            properties: Sessions["$type"][key];
+        connect?: {
+            error?(error: InvalidSessionError | UnknownProviderError): Promise<APIGatewayProxyStructuredResultV2 | undefined>;
+            start?(session: Sessions["$typeValues"], event: APIGatewayProxyEventV2): Promise<void>;
+            success?(session: Sessions["$typeValues"], input: Result): Promise<APIGatewayProxyStructuredResultV2>;
         };
-    }[keyof Sessions["$type"]]>[keyof OnSuccessResponder<any>]>>;
-    onIndex?: (event: APIGatewayProxyEventV2) => Promise<APIGatewayProxyStructuredResultV2>;
-    onError?: (error: UnknownProviderError) => Promise<APIGatewayProxyStructuredResultV2 | undefined>;
+    };
 }): (event: APIGatewayProxyEventV2, context: import("aws-lambda").Context) => Promise<APIGatewayProxyStructuredResultV2>;
 export {};

package/node/future/auth/handler.js

@@ -1,18 +1,64 @@
 import { createSigner, createVerifier } from "fast-jwt";
 import { ApiHandler, useCookie, useCookies, useFormValue, usePathParam, useQueryParam, useQueryParams, useResponse, } from "../../api/index.js";
 import { Config } from "../../config/index.js";
-export class UnknownProviderError {
+export class UnknownProviderError extends Error {
     provider;
     constructor(provider) {
+        super("Unknown provider: " + provider);
         this.provider = provider;
     }
 }
+export class MissingParameterError extends Error {
+    parameter;
+    constructor(parameter) {
+        super("Missing parameter: " + parameter);
+        this.parameter = parameter;
+    }
+}
+export class UnknownStateError extends Error {
+    constructor() {
+        super("The user's browser was in an unknown state. This could be because certain cookies expired or the user switched browsers in the middle of an authentication flow");
+    }
+}
+export class UnauthorizedClientError extends Error {
+    client;
+    redirect_uri;
+    constructor(client, redirect_uri) {
+        super("Unauthorized client");
+        this.client = client;
+        this.redirect_uri = redirect_uri;
+    }
+}
+export class InvalidSessionError extends Error {
+    constructor() {
+        super("Invalid session");
+    }
+}
 export function AuthHandler(input) {
+    // Remap deprecrated stuff
+    const { allowClient, clients, onError, onSuccess, onAuthorize, onIndex } = input;
+    if (onError && !input.callbacks.auth.error)
+        input.callbacks.auth.error = onError;
+    if (onSuccess && !input.callbacks.auth.success)
+        input.callbacks.auth.success = onSuccess;
+    if (onIndex && !input.callbacks.index)
+        input.callbacks.index = onIndex;
+    if (onAuthorize && !input.callbacks.auth.start)
+        input.callbacks.auth.start = async (evt) => {
+            await onAuthorize(evt);
+        };
+    if (allowClient && !input.callbacks.auth.allowClient)
+        input.callbacks.auth.allowClient = allowClient;
+    if (clients && !input.callbacks.auth.allowClient)
+        input.callbacks.auth.allowClient = async (clientID, redirect) => {
+            const list = await clients();
+            return list[clientID].startsWith(redirect);
+        };
     return ApiHandler(async (evt) => {
         const step = usePathParam("step");
         if (!step) {
-            if (input.onIndex) {
-                return input.onIndex(evt);
+            if (input.callbacks.index) {
+                return input.callbacks.index(evt);
             }
             const clients = (await input.clients?.()) || {};
             return {
@@ -90,62 +136,75 @@ export function AuthHandler(input) {
             };
         }
         let provider = useCookie("provider");
-        if (step === "authorize") {
-            provider = useQueryParam("provider");
-            if (input.onAuthorize) {
-                const result = await input.onAuthorize(evt);
-                if (result)
-                    provider = result;
-            }
+        let response_type = useCookie("response_type");
+        let redirect_uri = useCookie("redirect_uri");
+        console.log("step", step);
+        if (step === "connect") {
+            provider = useFormValue("provider") || undefined;
             if (!provider) {
                 return {
                     statusCode: 400,
                     body: "Missing provider",
                 };
             }
-            const { response_type, client_id, redirect_uri, state } = {
+            const token = useFormValue("token");
+            const verified = input.sessions?.verify(token);
+            if (!verified) {
+                return ((await input.callbacks.connect?.error?.(new InvalidSessionError())) || {
+                    statusCode: 401,
+                    body: "Invalid session",
+                });
+            }
+            await input.callbacks.connect?.start?.(verified, evt);
+            response_type = "connect";
+            useResponse().cookies({
+                provider,
+                response_type: "connect",
+                sst_auth_token: token,
+            }, {
+                maxAge: 60 * 15,
+            });
+        }
+        if (step === "authorize") {
+            provider = useQueryParam("provider");
+            response_type = useQueryParam("response_type") || response_type;
+            redirect_uri = useQueryParam("redirect_uri") || redirect_uri;
+            const { client_id, state } = {
                 ...useCookies(),
                 ...useQueryParams(),
             };
-            if (!redirect_uri) {
-                return {
-                    statusCode: 400,
-                    body: "Missing redirect_uri",
-                };
-            }
             if (!provider) {
-                return {
+                return ((await input.callbacks.auth.error?.(new MissingParameterError("provider"))) || {
                     statusCode: 400,
                     body: "Missing provider",
-                };
+                });
+            }
+            if (!redirect_uri) {
+                return ((await input.callbacks.auth.error?.(new MissingParameterError("redirect_uri"))) || {
+                    statusCode: 400,
+                    body: "Missing redirect_uri",
+                });
             }
             if (!response_type) {
-                return {
+                return ((await input.callbacks.auth.error?.(new MissingParameterError("response_type"))) || {
                     statusCode: 400,
                     body: "Missing response_type",
-                };
+                });
             }
             if (!client_id) {
-                return {
+                return ((await input.callbacks.auth.error?.(new MissingParameterError("client_id"))) || {
                     statusCode: 400,
                     body: "Missing client_id",
-                };
-            }
-            if (input.clients) {
-                const clients = await input.clients();
-                if (clients[client_id] !== redirect_uri) {
-                    return {
-                        statusCode: 400,
-                        body: "Invalid redirect_uri",
-                    };
-                }
+                });
             }
-            if (input.allowClient &&
-                !(await input.allowClient(client_id, redirect_uri))) {
-                return {
+            if (!(await input.callbacks.auth.allowClient(client_id, redirect_uri))) {
+                return ((await input.callbacks.auth.error?.(new UnauthorizedClientError(client_id, redirect_uri))) || {
                     statusCode: 400,
                     body: "Invalid redirect_uri",
-                };
+                });
+            }
+            if (input.callbacks.auth.start) {
+                await input.callbacks.auth.start(evt);
             }
             useResponse().cookies({
                 provider: provider,
@@ -160,119 +219,166 @@ export function AuthHandler(input) {
                 httpOnly: true,
             });
         }
+        if (!response_type) {
+            return ((await input.callbacks.error?.(new UnknownStateError())) || {
+                statusCode: 400,
+                body: new UnknownStateError().message,
+            });
+        }
         if (!provider || !input.providers[provider]) {
-            const response = input.onError?.(new UnknownProviderError(provider));
-            if (response)
-                return response;
-            return {
+            const err = new UnknownProviderError(provider);
+            return ((response_type === "connect"
+                ? input.callbacks.connect?.error
+                : input.callbacks.auth.error)?.(err) || {
                 statusCode: 400,
-                body: `Was not able to find provider "${String(provider)}"`,
+                body: err.toString(),
                 headers: {
                     "Content-Type": "text/html",
                 },
-            };
+            });
         }
         const adapter = input.providers[provider];
         const result = await adapter(evt);
+        if (!result) {
+            return {
+                statusCode: 404,
+                body: "Not found",
+            };
+        }
         if (result.type === "step") {
             return result.properties;
         }
         if (result.type === "success") {
-            const onSuccess = await input.onSuccess({
-                provider,
-                ...result.properties,
-            }, {
-                http(input) {
-                    return {
-                        type: "http",
-                        properties: input,
-                    };
-                },
-                session(input) {
-                    return {
-                        type: "session",
-                        properties: input,
-                    };
-                },
-            });
-            if (onSuccess.type === "session") {
-                const { type, properties, ...rest } = onSuccess.properties;
-                // @ts-expect-error
-                const priv = Config[process.env.AUTH_ID + "PrivateKey"];
-                const signer = createSigner({
-                    ...rest,
-                    key: priv,
-                    algorithm: "RS512",
-                });
-                const token = signer({
-                    type,
-                    properties,
-                });
-                useResponse()
-                    .cookie({
-                    key: "sst_auth_token",
-                    value: token,
-                    maxAge: 10 * 365 * 24 * 60 * 60,
-                })
-                    .cookies({
+            if (response_type === "connect") {
+                const session = input.sessions?.use();
+                if (!session) {
+                    return ((await input.callbacks.connect?.error?.(new InvalidSessionError())) || {
+                        statusCode: 401,
+                        body: "Invalid session",
+                    });
+                }
+                useResponse().cookies({
                     provider: "",
                     response_type: "",
-                    client_id: "",
-                    redirect_uri: "",
-                    state: "",
+                    sst_auth_token: "",
                 }, {
                     expires: new Date(1),
                 });
-                const { client_id, response_type, redirect_uri, state } = {
-                    ...useCookies(),
-                    ...useQueryParams(),
-                };
-                if (response_type === "token") {
-                    const location = new URL(redirect_uri);
-                    location.hash = `access_token=${token}&state=${state || ""}`;
-                    return {
-                        statusCode: 302,
-                        headers: {
-                            Location: location.href,
-                        },
-                    };
-                }
-                if (response_type === "code") {
-                    // This allows the code to be reused within a 30 second window
-                    // The code should be single use but we're making this tradeoff to remain stateless
-                    // In the future can store this in a dynamo table to ensure single use
-                    const code = createSigner({
-                        expiresIn: 1000 * 60 * 5,
+                return input.callbacks.connect?.success(session, {
+                    provider,
+                    ...result.properties,
+                });
+            }
+            if (response_type === "token" || response_type === "code") {
+                const onSuccess = await input.callbacks.auth.success({
+                    provider,
+                    ...result.properties,
+                }, {
+                    http(input) {
+                        return {
+                            type: "http",
+                            properties: input,
+                        };
+                    },
+                    session(input) {
+                        return {
+                            type: "session",
+                            properties: input,
+                        };
+                    },
+                });
+                if (onSuccess.type === "session") {
+                    const { type, properties, ...rest } = onSuccess.properties;
+                    // @ts-expect-error
+                    const priv = Config[process.env.AUTH_ID + "PrivateKey"];
+                    const signer = createSigner({
+                        ...rest,
                         key: priv,
                         algorithm: "RS512",
-                    })({
-                        client_id,
-                        redirect_uri,
-                        token: token,
                     });
-                    const location = new URL(redirect_uri);
-                    location.searchParams.set("code", code);
-                    location.searchParams.set("state", state || "");
+                    const token = signer({
+                        type,
+                        properties,
+                    });
+                    useResponse()
+                        .cookie({
+                        key: "sst_auth_token",
+                        value: token,
+                        maxAge: 10 * 365 * 24 * 60 * 60,
+                    })
+                        .cookies({
+                        provider: "",
+                        response_type: "",
+                        client_id: "",
+                        redirect_uri: "",
+                        state: "",
+                    }, {
+                        expires: new Date(1),
+                    });
+                    const { client_id, redirect_uri, state } = useCookies();
+                    if (response_type === "token") {
+                        const location = new URL(redirect_uri);
+                        location.hash = `access_token=${token}&state=${state || ""}`;
+                        return {
+                            statusCode: 302,
+                            headers: {
+                                Location: location.href,
+                            },
+                        };
+                    }
+                    if (response_type === "code") {
+                        // This allows the code to be reused within a 30 second window
+                        // The code should be single use but we're making this tradeoff to remain stateless
+                        // In the future can store this in a dynamo table to ensure single use
+                        const code = createSigner({
+                            expiresIn: 1000 * 60 * 5,
+                            key: priv,
+                            algorithm: "RS512",
+                        })({
+                            client_id,
+                            redirect_uri,
+                            token: token,
+                        });
+                        const location = new URL(redirect_uri);
+                        location.searchParams.set("code", code);
+                        location.searchParams.set("state", state || "");
+                        return {
+                            statusCode: 302,
+                            headers: {
+                                Location: location.href,
+                            },
+                        };
+                    }
                     return {
-                        statusCode: 302,
-                        headers: {
-                            Location: location.href,
-                        },
+                        statusCode: 400,
+                        body: `Unsupported response_type: ${response_type}`,
                     };
                 }
-                return {
-                    statusCode: 400,
-                    body: `Unsupported response_type: ${response_type}`,
-                };
-            }
-            if (onSuccess.type === "http") {
-                return onSuccess.properties;
+                if (onSuccess.type === "http") {
+                    return onSuccess.properties;
+                }
             }
         }
         if (result.type === "error") {
+            if (response_type === "connect") {
+                return ((await input.callbacks.connect?.error?.(result.error)) || {
+                    statusCode: 400,
+                    body: result.error.message,
+                });
+            }
+            if (!redirect_uri) {
+                return ((await input.callbacks.auth.error?.(new UnknownStateError())) || {
+                    statusCode: 400,
+                    body: new UnknownStateError().message,
+                });
+            }
+            const location = new URL(redirect_uri);
+            location.searchParams.set("error", result.error.message);
             return {
-                statusCode: 400,
-                body: "an error has occured",
+                statusCode: 302,
+                headers: {
+                    Location: location.toString(),
+                },
             };
         }
     });

package/node/future/auth/session.d.ts

@@ -67,5 +67,12 @@ export declare function createSessionBuilder<SessionTypes extends Record<string,
         properties: {};
     };
     $type: SessionTypes;
+    $typeValues: { [type in keyof SessionTypes]: {
+        type: type;
+        properties: SessionTypes[type];
+    }; }[keyof SessionTypes] | {
+        type: "public";
+        properties: {};
+    };
 };
 export {};

package/node/future/auth/session.js

@@ -142,5 +142,6 @@ export function createSessionBuilder() {
             return ctx;
         },
         $type: {},
+        $typeValues: {},
     };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.26.6",
+  "version": "2.26.7",
   "bin": {
     "sst": "cli/sst.js"
   },