\n\t\t\t\tTo get started, open the src/pages
\n\t\t\tsrc/pages
![\"OpenAuth](\"https://raw.githubusercontent.com/toolbeam/identity/main/openauth/logo-light.svg\"){kind=logo}
\n \n \n \n
\n ![\"Discord\"](\"https://img.shields.io/discord/983865673656705025?style=flat-square&label=Discord\")
![\"npm\"](\"https://img.shields.io/npm/v/%40openauthjs%2Fcore?style=flat-square\")
![\"Build](\"https://img.shields.io/github/actions/workflow/status/toolbeam/openauth/release.yml?style=flat-square&branch=master\")
![\"OpenAuth](\"https://raw.githubusercontent.com/toolbeam/identity/main/openauth/assets/themes-light.png\")
\nsrc/pages
{subject.properties.id}.\n app/page.tsx.\n app/page.tsx.\n \n Logged in\n {auth.userId && as {auth.userId}}\n
\n {status !== \"\" &&API call: {status}
}\n \n \n{subject.properties.id}.\n app/page.tsx.\n app/page.tsx.\n {subject.properties.id}.\n app/page.tsx.\n app/page.tsx.\n , )\n * ```\n *\n * You call this after the user has been redirected back to your app after the OAuth flow.\n *\n * :::tip\n * For SSR sites, the code is returned in the query parameter.\n * :::\n *\n * So the code comes from the query parameter in the redirect URI. The redirect URI here is\n * the one that you passed in to the `authorize` call when starting the flow.\n *\n * :::tip\n * For SPA sites, the code is returned through the URL hash.\n * :::\n *\n * If you used the PKCE flow for an SPA app, the code is returned as a part of the redirect URL\n * hash.\n *\n * ```ts {4}\n * const exchanged = await client.exchange(\n * ,\n * ,\n * \n * )\n * ```\n *\n * You also need to pass in the previously stored challenge verifier.\n *\n * This method returns the access and refresh tokens. Or if it fails, it returns an error that\n * you can handle depending on the error.\n *\n * ```ts\n * import { InvalidAuthorizationCodeError } from \"@openauthjs/openauth/error\"\n *\n * if (exchanged.err) {\n * if (exchanged.err instanceof InvalidAuthorizationCodeError) {\n * // handle invalid code error\n * }\n * else {\n * // handle other errors\n * }\n * }\n *\n * const { access, refresh } = exchanged.tokens\n * ```\n */\n exchange(\n code: string,\n redirectURI: string,\n verifier?: string,\n ): Promise\n /**\n * Refreshes the tokens if they have expired. This is used in an SPA app to maintain the\n * session, without logging the user out.\n *\n * ```ts\n * const next = await client.refresh()\n * ```\n *\n * Can optionally take the access token as well. If passed in, this will skip the refresh\n * if the access token is still valid.\n *\n * ```ts\n * const next = await client.refresh(, { access: })\n * ```\n *\n * This returns the refreshed tokens only if they've been refreshed.\n *\n * ```ts\n * if (!next.err) {\n * // tokens are still valid\n * }\n * if (next.tokens) {\n * const { access, refresh } = next.tokens\n * }\n * ```\n *\n * Or if it fails, it returns an error that you can handle depending on the error.\n *\n * ```ts\n * import { InvalidRefreshTokenError } from \"@openauthjs/openauth/error\"\n *\n * if (next.err) {\n * if (next.err instanceof InvalidRefreshTokenError) {\n * // handle invalid refresh token error\n * }\n * else {\n * // handle other errors\n * }\n * }\n * ```\n */\n refresh(\n refresh: string,\n opts?: RefreshOptions,\n ): Promise\n /**\n * Verify the token in the incoming request.\n *\n * This is typically used for SSR sites where the token is stored in an HTTP only cookie. And\n * is passed to the server on every request.\n *\n * ```ts\n * const verified = await client.verify(, )\n * ```\n *\n * This takes the subjects that you had previously defined when creating the issuer.\n *\n * :::tip\n * If the refresh token is passed in, it'll automatically refresh the access token.\n * :::\n *\n * This can optionally take the refresh token as well. If passed in, it'll automatically\n * refresh the access token if it has expired.\n *\n * ```ts\n * const verified = await client.verify(, , { refresh: })\n * ```\n *\n * This returns the decoded subjects from the access token. And the tokens if they've been\n * refreshed.\n *\n * ```ts\n * // based on the subjects you defined earlier\n * console.log(verified.subject.properties.userID)\n *\n * if (verified.tokens) {\n * const { access, refresh } = verified.tokens\n * }\n * ```\n *\n * Or if it fails, it returns an error that you can handle depending on the error.\n *\n * ```ts\n * import { InvalidRefreshTokenError } from \"@openauthjs/openauth/error\"\n *\n * if (verified.err) {\n * if (verified.err instanceof InvalidRefreshTokenError) {\n * // handle invalid refresh token error\n * }\n * else {\n * // handle other errors\n * }\n * }\n * ```\n */\n verify(\n subjects: T,\n token: string,\n options?: VerifyOptions,\n ): Promise | VerifyError>\n}\n\n/**\n * Create an OpenAuth client.\n *\n * @param input - Configure the client.\n */\nexport function createClient(input: ClientInput): Client {\n const jwksCache = new Map>()\n const issuerCache = new Map()\n const issuer = input.issuer || process.env.OPENAUTH_ISSUER\n if (!issuer) throw new Error(\"No issuer\")\n const f = input.fetch ?? fetch\n\n async function getIssuer() {\n const cached = issuerCache.get(issuer!)\n if (cached) return cached\n const wellKnown = (await (f || fetch)(\n `${issuer}/.well-known/oauth-authorization-server`,\n ).then((r) => r.json())) as WellKnown\n issuerCache.set(issuer!, wellKnown)\n return wellKnown\n }\n\n async function getJWKS() {\n const wk = await getIssuer()\n const cached = jwksCache.get(issuer!)\n if (cached) return cached\n const keyset = (await (f || fetch)(wk.jwks_uri).then((r) =>\n r.json(),\n )) as JSONWebKeySet\n const result = createLocalJWKSet(keyset)\n jwksCache.set(issuer!, result)\n return result\n }\n\n const result = {\n async authorize(\n redirectURI: string,\n response: \"code\" | \"token\",\n opts?: AuthorizeOptions,\n ) {\n const result = new URL(issuer + \"/authorize\")\n const challenge: Challenge = {\n state: crypto.randomUUID(),\n }\n result.searchParams.set(\"client_id\", input.clientID)\n result.searchParams.set(\"redirect_uri\", redirectURI)\n result.searchParams.set(\"response_type\", response)\n result.searchParams.set(\"state\", challenge.state)\n if (opts?.provider) result.searchParams.set(\"provider\", opts.provider)\n if (opts?.pkce && response === \"code\") {\n const pkce = await generatePKCE()\n result.searchParams.set(\"code_challenge_method\", \"S256\")\n result.searchParams.set(\"code_challenge\", pkce.challenge)\n challenge.verifier = pkce.verifier\n }\n return {\n challenge,\n url: result.toString(),\n }\n },\n /**\n * @deprecated use `authorize` instead, it will do pkce by default unless disabled with `opts.pkce = false`\n */\n async pkce(\n redirectURI: string,\n opts?: {\n provider?: string\n },\n ) {\n const result = new URL(issuer + \"/authorize\")\n if (opts?.provider) result.searchParams.set(\"provider\", opts.provider)\n result.searchParams.set(\"client_id\", input.clientID)\n result.searchParams.set(\"redirect_uri\", redirectURI)\n result.searchParams.set(\"response_type\", \"code\")\n const pkce = await generatePKCE()\n result.searchParams.set(\"code_challenge_method\", \"S256\")\n result.searchParams.set(\"code_challenge\", pkce.challenge)\n return [pkce.verifier, result.toString()]\n },\n async exchange(\n code: string,\n redirectURI: string,\n verifier?: string,\n ): Promise {\n const tokens = await f(issuer + \"/token\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n code,\n redirect_uri: redirectURI,\n grant_type: \"authorization_code\",\n client_id: input.clientID,\n code_verifier: verifier || \"\",\n }).toString(),\n })\n const json = (await tokens.json()) as any\n if (!tokens.ok) {\n return {\n err: new InvalidAuthorizationCodeError(),\n }\n }\n return {\n err: false,\n tokens: {\n access: json.access_token as string,\n refresh: json.refresh_token as string,\n expiresIn: json.expires_in as number,\n },\n }\n },\n async refresh(\n refresh: string,\n opts?: RefreshOptions,\n ): Promise {\n if (opts && opts.access) {\n const decoded = decodeJwt(opts.access)\n if (!decoded) {\n return {\n err: new InvalidAccessTokenError(),\n }\n }\n // allow 30s window for expiration\n if ((decoded.exp || 0) > Date.now() / 1000 + 30) {\n return {\n err: false,\n }\n }\n }\n const tokens = await f(issuer + \"/token\", {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({\n grant_type: \"refresh_token\",\n refresh_token: refresh,\n }).toString(),\n })\n const json = (await tokens.json()) as any\n if (!tokens.ok) {\n return {\n err: new InvalidRefreshTokenError(),\n }\n }\n return {\n err: false,\n tokens: {\n access: json.access_token as string,\n refresh: json.refresh_token as string,\n expiresIn: json.expires_in as number,\n },\n }\n },\n async verify(\n subjects: T,\n token: string,\n options?: VerifyOptions,\n ): Promise | VerifyError> {\n const jwks = await getJWKS()\n try {\n const result = await jwtVerify<{\n mode: \"access\"\n type: keyof T\n properties: v1.InferInput\n }>(token, jwks, {\n issuer,\n })\n const validated = await subjects[result.payload.type][\n \"~standard\"\n ].validate(result.payload.properties)\n if (!validated.issues && result.payload.mode === \"access\")\n return {\n aud: result.payload.aud as string,\n subject: {\n type: result.payload.type,\n properties: validated.value,\n } as any,\n }\n return {\n err: new InvalidSubjectError(),\n }\n } catch (e) {\n if (e instanceof errors.JWTExpired && options?.refresh) {\n const refreshed = await this.refresh(options.refresh)\n if (refreshed.err) return refreshed\n const verified = await result.verify(\n subjects,\n refreshed.tokens!.access,\n {\n refresh: refreshed.tokens!.refresh,\n issuer,\n fetch: options?.fetch,\n },\n )\n if (verified.err) return verified\n verified.tokens = refreshed.tokens\n return verified\n }\n return {\n err: new InvalidAccessTokenError(),\n }\n }\n },\n }\n return result\n}\n"
},
{
"path": "packages/openauth/src/css.d.ts",
"content": "declare module \"*.css\" {\n const css: string\n export default css\n}\n"
},
{
"path": "packages/openauth/src/error.ts",
"content": "/**\n * A list of errors that can be thrown by OpenAuth.\n *\n * You can use these errors to check the type of error and handle it. For example.\n *\n * ```ts\n * import { InvalidAuthorizationCodeError } from \"@openauthjs/openauth/error\"\n *\n * if (err instanceof InvalidAuthorizationCodeError) {\n * // handle invalid code error\n * }\n * ```\n *\n * @packageDocumentation\n */\n\n/**\n * The OAuth server returned an error.\n */\nexport class OauthError extends Error {\n constructor(\n public error:\n | \"invalid_request\"\n | \"invalid_grant\"\n | \"unauthorized_client\"\n | \"access_denied\"\n | \"unsupported_grant_type\"\n | \"server_error\"\n | \"temporarily_unavailable\",\n public description: string,\n ) {\n super(error + \" - \" + description)\n }\n}\n\n/**\n * The `provider` needs to be passed in.\n */\nexport class MissingProviderError extends OauthError {\n constructor() {\n super(\n \"invalid_request\",\n \"Must specify `provider` query parameter if `select` callback on issuer is not specified\",\n )\n }\n}\n\n/**\n * The given parameter is missing.\n */\nexport class MissingParameterError extends OauthError {\n constructor(public parameter: string) {\n super(\"invalid_request\", \"Missing parameter: \" + parameter)\n }\n}\n\n/**\n * The given client is not authorized to use the redirect URI that was passed in.\n */\nexport class UnauthorizedClientError extends OauthError {\n constructor(\n public clientID: string,\n redirectURI: string,\n ) {\n super(\n \"unauthorized_client\",\n `Client ${clientID} is not authorized to use this redirect_uri: ${redirectURI}`,\n )\n }\n}\n\n/**\n * The browser was in an unknown state.\n *\n * This can happen when certain cookies have expired. Or the browser was switched in the middle\n * of the authentication flow.\n */\nexport class UnknownStateError extends Error {\n constructor() {\n super(\n \"The browser was in an unknown state. This could be because certain cookies expired or the browser was switched in the middle of an authentication flow.\",\n )\n }\n}\n\n/**\n * The given subject is invalid.\n */\nexport class InvalidSubjectError extends Error {\n constructor() {\n super(\"Invalid subject\")\n }\n}\n\n/**\n * The given refresh token is invalid.\n */\nexport class InvalidRefreshTokenError extends Error {\n constructor() {\n super(\"Invalid refresh token\")\n }\n}\n\n/**\n * The given access token is invalid.\n */\nexport class InvalidAccessTokenError extends Error {\n constructor() {\n super(\"Invalid access token\")\n }\n}\n\n/**\n * The given authorization code is invalid.\n */\nexport class InvalidAuthorizationCodeError extends Error {\n constructor() {\n super(\"Invalid authorization code\")\n }\n}\n"
},
{
"path": "packages/openauth/src/index.ts",
"content": "export {\n /**\n * @deprecated\n * Use `import { createClient } from \"@openauthjs/openauth/client\"` instead - it will tree shake better\n */\n createClient,\n} from \"./client.js\"\n\nexport {\n /**\n * @deprecated\n * Use `import { createSubjects } from \"@openauthjs/openauth/subject\"` instead - it will tree shake better\n */\n createSubjects,\n} from \"./subject.js\"\n\nimport { issuer } from \"./issuer.js\"\n\nexport {\n /**\n * @deprecated\n * Use `import { issuer } from \"@openauthjs/openauth\"` instead, it was renamed\n */\n issuer as authorizer,\n issuer,\n}\n"
},
{
"path": "packages/openauth/src/issuer.ts",
"content": "/**\n * The `issuer` create an OpentAuth server, a [Hono](https://hono.dev) app that's\n * designed to run anywhere.\n *\n * The `issuer` function requires a few things:\n *\n * ```ts title=\"issuer.ts\"\n * import { issuer } from \"@openauthjs/openauth\"\n *\n * const app = issuer({\n * providers: { ... },\n * storage,\n * subjects,\n * success: async (ctx, value) => { ... }\n * })\n * ```\n *\n * #### Add providers\n *\n * You start by specifying the auth providers you are going to use. Let's say you want your users\n * to be able to authenticate with GitHub and with their email and password.\n *\n * ```ts title=\"issuer.ts\"\n * import { GithubProvider } from \"@openauthjs/openauth/provider/github\"\n * import { PasswordProvider } from \"@openauthjs/openauth/provider/password\"\n *\n * const app = issuer({\n * providers: {\n * github: GithubProvider({\n * // ...\n * }),\n * password: PasswordProvider({\n * // ...\n * }),\n * },\n * })\n * ```\n *\n * #### Handle success\n *\n * The `success` callback receives the payload when a user completes a provider's auth flow.\n *\n * ```ts title=\"issuer.ts\"\n * const app = issuer({\n * providers: { ... },\n * subjects,\n * async success(ctx, value) {\n * let userID\n * if (value.provider === \"password\") {\n * console.log(value.email)\n * userID = ... // lookup user or create them\n * }\n * if (value.provider === \"github\") {\n * console.log(value.tokenset.access)\n * userID = ... // lookup user or create them\n * }\n * return ctx.subject(\"user\", {\n * userID\n * })\n * }\n * })\n * ```\n *\n * Once complete, the `issuer` issues the access tokens that a client can use. The `ctx.subject`\n * call is what is placed in the access token as a JWT.\n *\n * #### Define subjects\n *\n * You define the shape of these in the `subjects` field.\n *\n * ```ts title=\"subjects.ts\"\n * import { object, string } from \"valibot\"\n * import { createSubjects } from \"@openauthjs/openauth/subject\"\n *\n * const subjects = createSubjects({\n * user: object({\n * userID: string()\n * })\n * })\n * ```\n *\n * It's good to place this in a separate file since this'll be used in your client apps as well.\n *\n * ```ts title=\"issuer.ts\"\n * import { subjects } from \"./subjects.js\"\n *\n * const app = issuer({\n * providers: { ... },\n * subjects,\n * // ...\n * })\n * ```\n *\n * #### Deploy\n *\n * Since `issuer` is a Hono app, you can deploy it anywhere Hono supports.\n *\n * \n * \n * ```ts title=\"issuer.ts\"\n * import { serve } from \"@hono/node-server\"\n *\n * serve(app)\n * ```\n * \n * \n * ```ts title=\"issuer.ts\"\n * import { handle } from \"hono/aws-lambda\"\n *\n * export const handler = handle(app)\n * ```\n * \n * \n * ```ts title=\"issuer.ts\"\n * export default app\n * ```\n * \n * \n * ```ts title=\"issuer.ts\"\n * export default app\n * ```\n * \n * \n *\n * @packageDocumentation\n */\nimport { Provider, ProviderOptions } from \"./provider/provider.js\"\nimport { SubjectPayload, SubjectSchema } from \"./subject.js\"\nimport { Hono } from \"hono/tiny\"\nimport { handle as awsHandle } from \"hono/aws-lambda\"\nimport { Context } from \"hono\"\nimport { deleteCookie, getCookie, setCookie } from \"hono/cookie\"\nimport type { v1 } from \"@standard-schema/spec\"\n\n/**\n * Sets the subject payload in the JWT token and returns the response.\n *\n * ```ts\n * ctx.subject(\"user\", {\n * userID\n * })\n * ```\n */\nexport interface OnSuccessResponder<\n T extends { type: string; properties: any },\n> {\n /**\n * The `type` is the type of the subject, that was defined in the `subjects` field.\n *\n * The `properties` are the properties of the subject. This is the shape of the subject that\n * you defined in the `subjects` field.\n */\n subject(\n type: Type,\n properties: Extract[\"properties\"],\n opts?: {\n ttl?: {\n access?: number\n refresh?: number\n }\n subject?: string\n },\n ): Promise\n}\n\n/**\n * @internal\n */\nexport interface AuthorizationState {\n redirect_uri: string\n response_type: string\n state: string\n client_id: string\n audience?: string\n pkce?: {\n challenge: string\n method: \"S256\"\n }\n}\n\n/**\n * @internal\n */\nexport type Prettify = {\n [K in keyof T]: T[K]\n} & {}\n\nimport {\n MissingParameterError,\n OauthError,\n UnauthorizedClientError,\n UnknownStateError,\n} from \"./error.js\"\nimport { compactDecrypt, CompactEncrypt, jwtVerify, SignJWT } from \"jose\"\nimport { Storage, StorageAdapter } from \"./storage/storage.js\"\nimport { encryptionKeys, legacySigningKeys, signingKeys } from \"./keys.js\"\nimport { validatePKCE } from \"./pkce.js\"\nimport { Select } from \"./ui/select.js\"\nimport { setTheme, Theme } from \"./ui/theme.js\"\nimport { getRelativeUrl, isDomainMatch, lazy } from \"./util.js\"\nimport { DynamoStorage } from \"./storage/dynamo.js\"\nimport { MemoryStorage } from \"./storage/memory.js\"\nimport { cors } from \"hono/cors\"\nimport { logger } from \"hono/logger\"\n\n/** @internal */\nexport const aws = awsHandle\n\nexport interface IssuerInput<\n Providers extends Record>,\n Subjects extends SubjectSchema,\n Result = {\n [key in keyof Providers]: Prettify<\n {\n provider: key\n } & (Providers[key] extends Provider ? T : {})\n >\n }[keyof Providers],\n> {\n /**\n * The shape of the subjects that you want to return.\n *\n * @example\n *\n * ```ts title=\"issuer.ts\"\n * import { object, string } from \"valibot\"\n * import { createSubjects } from \"@openauthjs/openauth/subject\"\n *\n * issuer({\n * subjects: createSubjects({\n * user: object({\n * userID: string()\n * })\n * })\n * // ...\n * })\n * ```\n */\n subjects: Subjects\n /**\n * The storage adapter that you want to use.\n *\n * @example\n * ```ts title=\"issuer.ts\"\n * import { DynamoStorage } from \"@openauthjs/openauth/storage/dynamo\"\n *\n * issuer({\n * storage: DynamoStorage()\n * // ...\n * })\n * ```\n */\n storage?: StorageAdapter\n /**\n * The providers that you want your OpenAuth server to support.\n *\n * @example\n *\n * ```ts title=\"issuer.ts\"\n * import { GithubProvider } from \"@openauthjs/openauth/provider/github\"\n *\n * issuer({\n * providers: {\n * github: GithubProvider()\n * }\n * })\n * ```\n *\n * The key is just a string that you can use to identify the provider. It's passed back to\n * the `success` callback.\n *\n * You can also specify multiple providers.\n *\n * ```ts\n * {\n * providers: {\n * github: GithubProvider(),\n * google: GoogleProvider()\n * }\n * }\n * ```\n */\n providers: Providers\n /**\n * The theme you want to use for the UI.\n *\n * This includes the UI the user sees when selecting a provider. And the `PasswordUI` and\n * `CodeUI` that are used by the `PasswordProvider` and `CodeProvider`.\n *\n * @example\n * ```ts title=\"issuer.ts\"\n * import { THEME_SST } from \"@openauthjs/openauth/ui/theme\"\n *\n * issuer({\n * theme: THEME_SST\n * // ...\n * })\n * ```\n *\n * Or define your own.\n *\n * ```ts title=\"issuer.ts\"\n * import type { Theme } from \"@openauthjs/openauth/ui/theme\"\n *\n * const MY_THEME: Theme = {\n * // ...\n * }\n *\n * issuer({\n * theme: MY_THEME\n * // ...\n * })\n * ```\n */\n theme?: Theme\n /**\n * Set the TTL, in seconds, for access and refresh tokens.\n *\n * @example\n * ```ts\n * {\n * ttl: {\n * access: 60 * 60 * 24 * 30,\n * refresh: 60 * 60 * 24 * 365\n * }\n * }\n * ```\n */\n ttl?: {\n /**\n * Interval in seconds where the access token is valid.\n * @default 30d\n */\n access?: number\n /**\n * Interval in seconds where the refresh token is valid.\n * @default 1y\n */\n refresh?: number\n /**\n * Interval in seconds where refresh token reuse is allowed. This helps mitigrate\n * concurrency issues.\n * @default 60s\n */\n reuse?: number\n /**\n * Interval in seconds to retain refresh tokens for reuse detection.\n * @default 0s\n */\n retention?: number\n }\n /**\n * Optionally, configure the UI that's displayed when the user visits the root URL of the\n * of the OpenAuth server.\n *\n * ```ts title=\"issuer.ts\"\n * import { Select } from \"@openauthjs/openauth/ui/select\"\n *\n * issuer({\n * select: Select({\n * providers: {\n * github: { hide: true },\n * google: { display: \"Google\" }\n * }\n * })\n * // ...\n * })\n * ```\n *\n * @default Select()\n */\n select?(providers: Record, req: Request): Promise\n /**\n * @internal\n */\n start?(req: Request): Promise\n /**\n * The success callback that's called when the user completes the flow.\n *\n * This is called after the user has been redirected back to your app after the OAuth flow.\n *\n * @example\n * ```ts\n * {\n * success: async (ctx, value) => {\n * let userID\n * if (value.provider === \"password\") {\n * console.log(value.email)\n * userID = ... // lookup user or create them\n * }\n * if (value.provider === \"github\") {\n * console.log(value.tokenset.access)\n * userID = ... // lookup user or create them\n * }\n * return ctx.subject(\"user\", {\n * userID\n * })\n * },\n * // ...\n * }\n * ```\n */\n success(\n response: OnSuccessResponder>,\n input: Result,\n req: Request,\n ): Promise\n /**\n * @internal\n */\n error?(error: UnknownStateError, req: Request): Promise\n /**\n * Override the logic for whether a client request is allowed to call the issuer.\n *\n * By default, it uses the following:\n *\n * - Allow if the `redirectURI` is localhost.\n * - Compare `redirectURI` to the request's hostname or the `x-forwarded-host` header. If they\n * are from the same sub-domain level, then allow.\n *\n * @example\n * ```ts\n * {\n * allow: async (input, req) => {\n * // Allow all clients\n * return true\n * }\n * }\n * ```\n */\n allow?(\n input: {\n clientID: string\n redirectURI: string\n audience?: string\n },\n req: Request,\n ): Promise\n}\n\n/**\n * Create an OpenAuth server, a Hono app.\n */\nexport function issuer<\n Providers extends Record>,\n Subjects extends SubjectSchema,\n Result = {\n [key in keyof Providers]: Prettify<\n {\n provider: key\n } & (Providers[key] extends Provider ? T : {})\n >\n }[keyof Providers],\n>(input: IssuerInput) {\n const error =\n input.error ??\n function (err) {\n return new Response(err.message, {\n status: 400,\n headers: {\n \"Content-Type\": \"text/plain\",\n },\n })\n }\n const ttlAccess = input.ttl?.access ?? 60 * 60 * 24 * 30\n const ttlRefresh = input.ttl?.refresh ?? 60 * 60 * 24 * 365\n const ttlRefreshReuse = input.ttl?.reuse ?? 60\n const ttlRefreshRetention = input.ttl?.retention ?? 0\n if (input.theme) {\n setTheme(input.theme)\n }\n\n const select = lazy(() => input.select ?? Select())\n const allow = lazy(\n () =>\n input.allow ??\n (async (input: any, req: Request) => {\n const redir = new URL(input.redirectURI).hostname\n if (redir === \"localhost\" || redir === \"127.0.0.1\") {\n return true\n }\n const forwarded = req.headers.get(\"x-forwarded-host\")\n const host = forwarded\n ? new URL(`https://${forwarded}`).hostname\n : new URL(req.url).hostname\n\n return isDomainMatch(redir, host)\n }),\n )\n\n let storage = input.storage\n if (process.env.OPENAUTH_STORAGE) {\n const parsed = JSON.parse(process.env.OPENAUTH_STORAGE)\n if (parsed.type === \"dynamo\") storage = DynamoStorage(parsed.options)\n if (parsed.type === \"memory\") storage = MemoryStorage()\n if (parsed.type === \"cloudflare\")\n throw new Error(\n \"Cloudflare storage cannot be configured through env because it requires bindings.\",\n )\n }\n if (!storage)\n throw new Error(\n \"Store is not configured. Either set the `storage` option or set `OPENAUTH_STORAGE` environment variable.\",\n )\n const allSigning = lazy(() =>\n Promise.all([signingKeys(storage), legacySigningKeys(storage)]).then(\n ([a, b]) => [...a, ...b],\n ),\n )\n const allEncryption = lazy(() => encryptionKeys(storage))\n const signingKey = lazy(() => allSigning().then((all) => all[0]))\n const encryptionKey = lazy(() => allEncryption().then((all) => all[0]))\n\n const auth: Omit, \"name\"> = {\n async success(ctx: Context, properties: any, successOpts) {\n return await input.success(\n {\n async subject(type, properties, subjectOpts) {\n const authorization = await getAuthorization(ctx)\n const subject = subjectOpts?.subject\n ? subjectOpts.subject\n : await resolveSubject(type, properties)\n await successOpts?.invalidate?.(\n await resolveSubject(type, properties),\n )\n if (authorization.response_type === \"token\") {\n const location = new URL(authorization.redirect_uri)\n const tokens = await generateTokens(ctx, {\n subject,\n type: type as string,\n properties,\n clientID: authorization.client_id,\n ttl: {\n access: subjectOpts?.ttl?.access ?? ttlAccess,\n refresh: subjectOpts?.ttl?.refresh ?? ttlRefresh,\n },\n })\n location.hash = new URLSearchParams({\n access_token: tokens.access,\n refresh_token: tokens.refresh,\n state: authorization.state || \"\",\n }).toString()\n await auth.unset(ctx, \"authorization\")\n return ctx.redirect(location.toString(), 302)\n }\n if (authorization.response_type === \"code\") {\n const code = crypto.randomUUID()\n await Storage.set(\n storage,\n [\"oauth:code\", code],\n {\n type,\n properties,\n subject,\n redirectURI: authorization.redirect_uri,\n clientID: authorization.client_id,\n pkce: authorization.pkce,\n ttl: {\n access: subjectOpts?.ttl?.access ?? ttlAccess,\n refresh: subjectOpts?.ttl?.refresh ?? ttlRefresh,\n },\n },\n 60,\n )\n const location = new URL(authorization.redirect_uri)\n location.searchParams.set(\"code\", code)\n location.searchParams.set(\"state\", authorization.state || \"\")\n await auth.unset(ctx, \"authorization\")\n return ctx.redirect(location.toString(), 302)\n }\n throw new OauthError(\n \"invalid_request\",\n `Unsupported response_type: ${authorization.response_type}`,\n )\n },\n },\n {\n provider: ctx.get(\"provider\"),\n ...properties,\n },\n ctx.req.raw,\n )\n },\n forward(ctx, response) {\n return ctx.newResponse(\n response.body,\n response.status as any,\n Object.fromEntries(response.headers.entries()),\n )\n },\n async set(ctx, key, maxAge, value) {\n setCookie(ctx, key, await encrypt(value), {\n maxAge,\n httpOnly: true,\n ...(ctx.req.url.startsWith(\"https://\")\n ? { secure: true, sameSite: \"None\" }\n : {}),\n })\n },\n async get(ctx: Context, key: string) {\n const raw = getCookie(ctx, key)\n if (!raw) return\n return decrypt(raw).catch((ex) => {\n console.error(\"failed to decrypt\", key, ex)\n })\n },\n async unset(ctx: Context, key: string) {\n deleteCookie(ctx, key)\n },\n async invalidate(subject: string) {\n // Resolve the scan in case modifications interfere with iteration\n const keys = await Array.fromAsync(\n Storage.scan(this.storage, [\"oauth:refresh\", subject]),\n )\n for (const [key] of keys) {\n await Storage.remove(this.storage, key)\n }\n },\n storage,\n }\n\n async function getAuthorization(ctx: Context) {\n const match =\n (await auth.get(ctx, \"authorization\")) || ctx.get(\"authorization\")\n if (!match) throw new UnknownStateError()\n return match as AuthorizationState\n }\n\n async function encrypt(value: any) {\n return await new CompactEncrypt(\n new TextEncoder().encode(JSON.stringify(value)),\n )\n .setProtectedHeader({ alg: \"RSA-OAEP-512\", enc: \"A256GCM\" })\n .encrypt(await encryptionKey().then((k) => k.public))\n }\n\n async function resolveSubject(type: string, properties: any) {\n const jsonString = JSON.stringify(properties)\n const encoder = new TextEncoder()\n const data = encoder.encode(jsonString)\n const hashBuffer = await crypto.subtle.digest(\"SHA-1\", data)\n const hashArray = Array.from(new Uint8Array(hashBuffer))\n const hashHex = hashArray\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\")\n return `${type}:${hashHex.slice(0, 16)}`\n }\n\n async function generateTokens(\n ctx: Context,\n value: {\n type: string\n properties: any\n subject: string\n clientID: string\n ttl: {\n access: number\n refresh: number\n }\n timeUsed?: number\n nextToken?: string\n },\n opts?: {\n generateRefreshToken?: boolean\n },\n ) {\n const refreshToken = value.nextToken ?? crypto.randomUUID()\n if (opts?.generateRefreshToken ?? true) {\n /**\n * Generate and store the next refresh token after the one we are currently returning.\n * Reserving these in advance avoids concurrency issues with multiple refreshes.\n * Similar treatment should be given to any other values that may have race conditions,\n * for example if a jti claim was added to the access token.\n */\n const refreshValue = {\n ...value,\n nextToken: crypto.randomUUID(),\n }\n delete refreshValue.timeUsed\n await Storage.set(\n storage!,\n [\"oauth:refresh\", value.subject, refreshToken],\n refreshValue,\n value.ttl.refresh,\n )\n }\n const accessTimeUsed = Math.floor((value.timeUsed ?? Date.now()) / 1000)\n return {\n access: await new SignJWT({\n mode: \"access\",\n type: value.type,\n properties: value.properties,\n aud: value.clientID,\n iss: issuer(ctx),\n sub: value.subject,\n })\n .setExpirationTime(Math.floor(accessTimeUsed + value.ttl.access))\n .setProtectedHeader(\n await signingKey().then((k) => ({\n alg: k.alg,\n kid: k.id,\n typ: \"JWT\",\n })),\n )\n .sign(await signingKey().then((item) => item.private)),\n expiresIn: Math.floor(\n accessTimeUsed + value.ttl.access - Date.now() / 1000,\n ),\n refresh: [value.subject, refreshToken].join(\":\"),\n }\n }\n\n async function decrypt(value: string) {\n return JSON.parse(\n new TextDecoder().decode(\n await compactDecrypt(\n value,\n await encryptionKey().then((v) => v.private),\n ).then((value) => value.plaintext),\n ),\n )\n }\n\n function issuer(ctx: Context) {\n return new URL(getRelativeUrl(ctx, \"/\")).origin\n }\n\n const app = new Hono<{\n Variables: {\n authorization: AuthorizationState\n }\n }>().use(logger())\n\n for (const [name, value] of Object.entries(input.providers)) {\n const route = new Hono()\n route.use(async (c, next) => {\n c.set(\"provider\", name)\n await next()\n })\n value.init(route, {\n name,\n ...auth,\n })\n app.route(`/${name}`, route)\n }\n\n app.get(\n \"/.well-known/jwks.json\",\n cors({\n origin: \"*\",\n allowHeaders: [\"*\"],\n allowMethods: [\"GET\"],\n credentials: false,\n }),\n async (c) => {\n const all = await allSigning()\n return c.json({\n keys: all.map((item) => ({\n ...item.jwk,\n alg: item.alg,\n exp: item.expired\n ? Math.floor(item.expired.getTime() / 1000)\n : undefined,\n })),\n })\n },\n )\n\n app.get(\n \"/.well-known/oauth-authorization-server\",\n cors({\n origin: \"*\",\n allowHeaders: [\"*\"],\n allowMethods: [\"GET\"],\n credentials: false,\n }),\n async (c) => {\n const iss = issuer(c)\n return c.json({\n issuer: iss,\n authorization_endpoint: `${iss}/authorize`,\n token_endpoint: `${iss}/token`,\n jwks_uri: `${iss}/.well-known/jwks.json`,\n response_types_supported: [\"code\", \"token\"],\n })\n },\n )\n\n app.post(\n \"/token\",\n cors({\n origin: \"*\",\n allowHeaders: [\"*\"],\n allowMethods: [\"POST\"],\n credentials: false,\n }),\n async (c) => {\n const form = await c.req.formData()\n const grantType = form.get(\"grant_type\")\n\n if (grantType === \"authorization_code\") {\n const code = form.get(\"code\")\n if (!code)\n return c.json(\n {\n error: \"invalid_request\",\n error_description: \"Missing code\",\n },\n 400,\n )\n const key = [\"oauth:code\", code.toString()]\n const payload = await Storage.get<{\n type: string\n properties: any\n clientID: string\n redirectURI: string\n subject: string\n ttl: {\n access: number\n refresh: number\n }\n pkce?: AuthorizationState[\"pkce\"]\n }>(storage, key)\n if (!payload) {\n return c.json(\n {\n error: \"invalid_grant\",\n error_description: \"Authorization code has been used or expired\",\n },\n 400,\n )\n }\n if (payload.redirectURI !== form.get(\"redirect_uri\")) {\n return c.json(\n {\n error: \"invalid_redirect_uri\",\n error_description: \"Redirect URI mismatch\",\n },\n 400,\n )\n }\n if (payload.clientID !== form.get(\"client_id\")) {\n return c.json(\n {\n error: \"unauthorized_client\",\n error_description:\n \"Client is not authorized to use this authorization code\",\n },\n 403,\n )\n }\n\n if (payload.pkce) {\n const codeVerifier = form.get(\"code_verifier\")?.toString()\n if (!codeVerifier)\n return c.json(\n {\n error: \"invalid_grant\",\n error_description: \"Missing code_verifier\",\n },\n 400,\n )\n\n if (\n !(await validatePKCE(\n codeVerifier,\n payload.pkce.challenge,\n payload.pkce.method,\n ))\n ) {\n return c.json(\n {\n error: \"invalid_grant\",\n error_description: \"Code verifier does not match\",\n },\n 400,\n )\n }\n }\n const tokens = await generateTokens(c, payload)\n await Storage.remove(storage, key)\n return c.json({\n access_token: tokens.access,\n expires_in: tokens.expiresIn,\n refresh_token: tokens.refresh,\n })\n }\n\n if (grantType === \"refresh_token\") {\n const refreshToken = form.get(\"refresh_token\")\n if (!refreshToken)\n return c.json(\n {\n error: \"invalid_request\",\n error_description: \"Missing refresh_token\",\n },\n 400,\n )\n const splits = refreshToken.toString().split(\":\")\n const token = splits.pop()!\n const subject = splits.join(\":\")\n const key = [\"oauth:refresh\", subject, token]\n const payload = await Storage.get<{\n type: string\n properties: any\n clientID: string\n subject: string\n ttl: {\n access: number\n refresh: number\n }\n nextToken: string\n timeUsed?: number\n }>(storage, key)\n if (!payload) {\n return c.json(\n {\n error: \"invalid_grant\",\n error_description: \"Refresh token has been used or expired\",\n },\n 400,\n )\n }\n const generateRefreshToken = !payload.timeUsed\n if (ttlRefreshReuse <= 0) {\n // no reuse interval, remove the refresh token immediately\n await Storage.remove(storage, key)\n } else if (!payload.timeUsed) {\n payload.timeUsed = Date.now()\n await Storage.set(\n storage,\n key,\n payload,\n ttlRefreshReuse + ttlRefreshRetention,\n )\n } else if (Date.now() > payload.timeUsed + ttlRefreshReuse * 1000) {\n // token was reused past the allowed interval\n await auth.invalidate(subject)\n return c.json(\n {\n error: \"invalid_grant\",\n error_description: \"Refresh token has been used or expired\",\n },\n 400,\n )\n }\n const tokens = await generateTokens(c, payload, {\n generateRefreshToken,\n })\n return c.json({\n access_token: tokens.access,\n refresh_token: tokens.refresh,\n expires_in: tokens.expiresIn,\n })\n }\n\n if (grantType === \"client_credentials\") {\n const provider = form.get(\"provider\")\n if (!provider)\n return c.json({ error: \"missing `provider` form value\" }, 400)\n const match = input.providers[provider.toString()]\n if (!match)\n return c.json({ error: \"invalid `provider` query parameter\" }, 400)\n if (!match.client)\n return c.json(\n { error: \"this provider does not support client_credentials\" },\n 400,\n )\n const clientID = form.get(\"client_id\")\n const clientSecret = form.get(\"client_secret\")\n if (!clientID)\n return c.json({ error: \"missing `client_id` form value\" }, 400)\n if (!clientSecret)\n return c.json({ error: \"missing `client_secret` form value\" }, 400)\n const response = await match.client({\n clientID: clientID.toString(),\n clientSecret: clientSecret.toString(),\n params: Object.fromEntries(form) as Record,\n })\n return input.success(\n {\n async subject(type, properties, opts) {\n const tokens = await generateTokens(c, {\n type: type as string,\n subject:\n opts?.subject || (await resolveSubject(type, properties)),\n properties,\n clientID: clientID.toString(),\n ttl: {\n access: opts?.ttl?.access ?? ttlAccess,\n refresh: opts?.ttl?.refresh ?? ttlRefresh,\n },\n })\n return c.json({\n access_token: tokens.access,\n refresh_token: tokens.refresh,\n })\n },\n },\n {\n provider: provider.toString(),\n ...response,\n },\n c.req.raw,\n )\n }\n\n throw new Error(\"Invalid grant_type\")\n },\n )\n\n app.get(\"/authorize\", async (c) => {\n const provider = c.req.query(\"provider\")\n const response_type = c.req.query(\"response_type\")\n const redirect_uri = c.req.query(\"redirect_uri\")\n const state = c.req.query(\"state\")\n const client_id = c.req.query(\"client_id\")\n const audience = c.req.query(\"audience\")\n const code_challenge = c.req.query(\"code_challenge\")\n const code_challenge_method = c.req.query(\"code_challenge_method\")\n const authorization: AuthorizationState = {\n response_type,\n redirect_uri,\n state,\n client_id,\n audience,\n pkce:\n code_challenge && code_challenge_method\n ? {\n challenge: code_challenge,\n method: code_challenge_method,\n }\n : undefined,\n } as AuthorizationState\n c.set(\"authorization\", authorization)\n\n if (!redirect_uri) {\n return c.text(\"Missing redirect_uri\", { status: 400 })\n }\n\n if (!response_type) {\n throw new MissingParameterError(\"response_type\")\n }\n\n if (!client_id) {\n throw new MissingParameterError(\"client_id\")\n }\n\n if (input.start) {\n await input.start(c.req.raw)\n }\n\n if (\n !(await allow()(\n {\n clientID: client_id,\n redirectURI: redirect_uri,\n audience,\n },\n c.req.raw,\n ))\n )\n throw new UnauthorizedClientError(client_id, redirect_uri)\n await auth.set(c, \"authorization\", 60 * 60 * 24, authorization)\n if (provider) return c.redirect(`/${provider}/authorize`)\n const providers = Object.keys(input.providers)\n if (providers.length === 1) return c.redirect(`/${providers[0]}/authorize`)\n return auth.forward(\n c,\n await select()(\n Object.fromEntries(\n Object.entries(input.providers).map(([key, value]) => [\n key,\n value.type,\n ]),\n ),\n c.req.raw,\n ),\n )\n })\n\n app.get(\"/userinfo\", async (c) => {\n const header = c.req.header(\"Authorization\")\n\n if (!header) {\n return c.json(\n {\n error: \"invalid_request\",\n error_description: \"Missing Authorization header\",\n },\n 400,\n )\n }\n\n const [type, token] = header.split(\" \")\n\n if (type !== \"Bearer\") {\n return c.json(\n {\n error: \"invalid_request\",\n error_description: \"Missing or invalid Authorization header\",\n },\n 400,\n )\n }\n\n if (!token) {\n return c.json(\n {\n error: \"invalid_request\",\n error_description: \"Missing token\",\n },\n 400,\n )\n }\n\n const result = await jwtVerify<{\n mode: \"access\"\n type: keyof SubjectSchema\n properties: v1.InferInput\n }>(token, () => signingKey().then((item) => item.public), {\n issuer: issuer(c),\n })\n\n const validated = await input.subjects[result.payload.type][\n \"~standard\"\n ].validate(result.payload.properties)\n\n if (!validated.issues && result.payload.mode === \"access\") {\n return c.json(validated.value as SubjectSchema)\n }\n\n return c.json({\n error: \"invalid_token\",\n error_description: \"Invalid token\",\n })\n })\n\n app.onError(async (err, c) => {\n console.error(err)\n if (err instanceof UnknownStateError) {\n return auth.forward(c, await error(err, c.req.raw))\n }\n const authorization = await getAuthorization(c)\n const url = new URL(authorization.redirect_uri)\n const oauth =\n err instanceof OauthError\n ? err\n : new OauthError(\"server_error\", err.message)\n url.searchParams.set(\"error\", oauth.error)\n url.searchParams.set(\"error_description\", oauth.description)\n return c.redirect(url.toString())\n })\n\n return app\n}\n"
},
{
"path": "packages/openauth/src/jwt.ts",
"content": "import { JWTPayload, jwtVerify, KeyLike, SignJWT } from \"jose\"\n\nexport namespace jwt {\n export function create(\n payload: JWTPayload,\n algorithm: string,\n privateKey: KeyLike,\n ) {\n return new SignJWT(payload)\n .setProtectedHeader({ alg: algorithm, typ: \"JWT\", kid: \"sst\" })\n .sign(privateKey)\n }\n\n export function verify(token: string, publicKey: KeyLike) {\n return jwtVerify(token, publicKey)\n }\n}\n"
},
{
"path": "packages/openauth/src/keys.ts",
"content": "import {\n exportJWK,\n exportPKCS8,\n exportSPKI,\n generateKeyPair,\n importPKCS8,\n importSPKI,\n JWK,\n KeyLike,\n} from \"jose\"\nimport { Storage, StorageAdapter } from \"./storage/storage.js\"\n\nconst signingAlg = \"ES256\"\nconst encryptionAlg = \"RSA-OAEP-512\"\n\ninterface SerializedKeyPair {\n id: string\n publicKey: string\n privateKey: string\n created: number\n alg: string\n expired?: number\n}\n\nexport interface KeyPair {\n id: string\n alg: string\n public: KeyLike\n private: KeyLike\n created: Date\n expired?: Date\n jwk: JWK\n}\n\n/**\n * @deprecated use `signingKeys` instead\n */\nexport async function legacySigningKeys(\n storage: StorageAdapter,\n): Promise {\n const alg = \"RS512\"\n const results = [] as KeyPair[]\n const scanner = Storage.scan(storage, [\"oauth:key\"])\n for await (const [_key, value] of scanner) {\n const publicKey = await importSPKI(value.publicKey, alg, {\n extractable: true,\n })\n const privateKey = await importPKCS8(value.privateKey, alg)\n const jwk = await exportJWK(publicKey)\n jwk.kid = value.id\n results.push({\n id: value.id,\n alg,\n created: new Date(value.created),\n public: publicKey,\n private: privateKey,\n expired: new Date(1735858114000),\n jwk,\n })\n }\n return results\n}\n\nexport async function signingKeys(storage: StorageAdapter): Promise {\n const results = [] as KeyPair[]\n const scanner = Storage.scan(storage, [\"signing:key\"])\n for await (const [_key, value] of scanner) {\n const publicKey = await importSPKI(value.publicKey, value.alg, {\n extractable: true,\n })\n const privateKey = await importPKCS8(value.privateKey, value.alg)\n const jwk = await exportJWK(publicKey)\n jwk.kid = value.id\n jwk.use = \"sig\"\n results.push({\n id: value.id,\n alg: signingAlg,\n created: new Date(value.created),\n expired: value.expired ? new Date(value.expired) : undefined,\n public: publicKey,\n private: privateKey,\n jwk,\n })\n }\n results.sort((a, b) => b.created.getTime() - a.created.getTime())\n if (results.filter((item) => !item.expired).length) return results\n\n const key = await generateKeyPair(signingAlg, {\n extractable: true,\n })\n const serialized: SerializedKeyPair = {\n id: crypto.randomUUID(),\n publicKey: await exportSPKI(key.publicKey),\n privateKey: await exportPKCS8(key.privateKey),\n created: Date.now(),\n alg: signingAlg,\n }\n await Storage.set(storage, [\"signing:key\", serialized.id], serialized)\n return signingKeys(storage)\n}\n\nexport async function encryptionKeys(\n storage: StorageAdapter,\n): Promise {\n const results = [] as KeyPair[]\n const scanner = Storage.scan(storage, [\"encryption:key\"])\n for await (const [_key, value] of scanner) {\n const publicKey = await importSPKI(value.publicKey, value.alg, {\n extractable: true,\n })\n const privateKey = await importPKCS8(value.privateKey, value.alg)\n const jwk = await exportJWK(publicKey)\n jwk.kid = value.id\n results.push({\n id: value.id,\n alg: encryptionAlg,\n created: new Date(value.created),\n expired: value.expired ? new Date(value.expired) : undefined,\n public: publicKey,\n private: privateKey,\n jwk,\n })\n }\n results.sort((a, b) => b.created.getTime() - a.created.getTime())\n if (results.filter((item) => !item.expired).length) return results\n\n const key = await generateKeyPair(encryptionAlg, {\n extractable: true,\n })\n const serialized: SerializedKeyPair = {\n id: crypto.randomUUID(),\n publicKey: await exportSPKI(key.publicKey),\n privateKey: await exportPKCS8(key.privateKey),\n created: Date.now(),\n alg: encryptionAlg,\n }\n await Storage.set(storage, [\"encryption:key\", serialized.id], serialized)\n return encryptionKeys(storage)\n}\n"
},
{
"path": "packages/openauth/src/pkce.ts",
"content": "import { base64url } from \"jose\"\n\nfunction generateVerifier(length: number): string {\n const buffer = new Uint8Array(length)\n crypto.getRandomValues(buffer)\n return base64url.encode(buffer)\n}\n\nasync function generateChallenge(verifier: string, method: \"S256\" | \"plain\") {\n if (method === \"plain\") return verifier\n const encoder = new TextEncoder()\n const data = encoder.encode(verifier)\n const hash = await crypto.subtle.digest(\"SHA-256\", data)\n return base64url.encode(new Uint8Array(hash))\n}\n\nexport async function generatePKCE(length: number = 64) {\n if (length < 43 || length > 128) {\n throw new Error(\n \"Code verifier length must be between 43 and 128 characters\",\n )\n }\n const verifier = generateVerifier(length)\n const challenge = await generateChallenge(verifier, \"S256\")\n return {\n verifier,\n challenge,\n method: \"S256\",\n }\n}\n\nexport async function validatePKCE(\n verifier: string,\n challenge: string,\n method: \"S256\" | \"plain\" = \"S256\",\n) {\n const generatedChallenge = await generateChallenge(verifier, method)\n // timing safe equals?\n return generatedChallenge === challenge\n}\n"
},
{
"path": "packages/openauth/src/provider/apple.ts",
"content": "/**\n * Use this provider to authenticate with Apple. Supports both OAuth2 and OIDC.\n *\n * #### Using OAuth\n *\n * ```ts {5-8}\n * import { AppleProvider } from \"@openauthjs/openauth/provider/apple\"\n *\n * export default issuer({\n * providers: {\n * apple: AppleProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * #### Using OAuth with form_post response mode\n *\n * When requesting name or email scopes from Apple, you must use form_post response mode:\n *\n * ```ts {5-9}\n * import { AppleProvider } from \"@openauthjs/openauth/provider/apple\"\n *\n * export default issuer({\n * providers: {\n * apple: AppleProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\",\n * responseMode: \"form_post\"\n * })\n * }\n * })\n * ```\n *\n * #### Using OIDC\n *\n * ```ts {5-7}\n * import { AppleOidcProvider } from \"@openauthjs/openauth/provider/apple\"\n *\n * export default issuer({\n * providers: {\n * apple: AppleOidcProvider({\n * clientID: \"1234567890\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\nimport { OidcProvider, OidcWrappedConfig } from \"./oidc.js\"\n\nexport interface AppleConfig extends Oauth2WrappedConfig {\n /**\n * The response mode to use for the authorization request.\n * Apple requires 'form_post' response mode when requesting name or email scopes.\n * @default \"query\"\n */\n responseMode?: \"query\" | \"form_post\"\n}\nexport interface AppleOidcConfig extends OidcWrappedConfig {}\n\n/**\n * Create an Apple OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * // Using default query response mode (GET callback)\n * AppleProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n *\n * // Using form_post response mode (POST callback)\n * // Required when requesting name or email scope\n * AppleProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\",\n * responseMode: \"form_post\",\n * scopes: [\"name\", \"email\"]\n * })\n * ```\n */\nexport function AppleProvider(config: AppleConfig) {\n const { responseMode, ...restConfig } = config\n const additionalQuery =\n responseMode === \"form_post\"\n ? { response_mode: \"form_post\", ...config.query }\n : config.query || {}\n\n return Oauth2Provider({\n ...restConfig,\n type: \"apple\" as const,\n endpoint: {\n authorization: \"https://appleid.apple.com/auth/authorize\",\n token: \"https://appleid.apple.com/auth/token\",\n jwks: \"https://appleid.apple.com/auth/keys\",\n },\n query: additionalQuery,\n })\n}\n\n/**\n * Create an Apple OIDC provider.\n *\n * This is useful if you just want to verify the user's email address.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * AppleOidcProvider({\n * clientID: \"1234567890\"\n * })\n * ```\n */\nexport function AppleOidcProvider(config: AppleOidcConfig) {\n return OidcProvider({\n ...config,\n type: \"apple\" as const,\n issuer: \"https://appleid.apple.com\",\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/arctic.ts",
"content": "import type { OAuth2Tokens } from \"arctic\"\nimport { Context } from \"hono\"\nimport { Provider } from \"./provider.js\"\nimport { OauthError } from \"../error.js\"\nimport { getRelativeUrl } from \"../util.js\"\n\nexport interface ArcticProviderOptions {\n scopes: string[]\n clientID: string\n clientSecret: string\n query?: Record\n}\n\ninterface ProviderState {\n state: string\n}\n\nexport function ArcticProvider(\n provider: new (\n clientID: string,\n clientSecret: string,\n callback: string,\n ) => {\n createAuthorizationURL(state: string, scopes: string[]): URL\n validateAuthorizationCode(code: string): Promise\n refreshAccessToken(refreshToken: string): Promise\n },\n config: ArcticProviderOptions,\n): Provider<{\n tokenset: OAuth2Tokens\n}> {\n function getClient(c: Context) {\n const callback = new URL(c.req.url)\n const pathname = callback.pathname.replace(/authorize.*$/, \"callback\")\n const url = getRelativeUrl(c, pathname)\n return new provider(config.clientID, config.clientSecret, url)\n }\n return {\n type: \"arctic\",\n init(routes, ctx) {\n routes.get(\"/authorize\", async (c) => {\n const client = getClient(c)\n const state = crypto.randomUUID()\n await ctx.set(c, \"provider\", 60 * 10, {\n state,\n })\n return c.redirect(client.createAuthorizationURL(state, config.scopes))\n })\n\n routes.get(\"/callback\", async (c) => {\n const client = getClient(c)\n const provider = (await ctx.get(c, \"provider\")) as ProviderState\n if (!provider) return c.redirect(\"../authorize\")\n const code = c.req.query(\"code\")\n const state = c.req.query(\"state\")\n if (!code) throw new Error(\"Missing code\")\n if (state !== provider.state)\n throw new OauthError(\"invalid_request\", \"Invalid state\")\n const tokens = await client.validateAuthorizationCode(code)\n return ctx.success(c, {\n tokenset: tokens,\n })\n })\n },\n }\n}\n"
},
{
"path": "packages/openauth/src/provider/code.ts",
"content": "/**\n * Configures a provider that supports pin code authentication. This is usually paired with the\n * `CodeUI`.\n *\n * ```ts\n * import { CodeUI } from \"@openauthjs/openauth/ui/code\"\n * import { CodeProvider } from \"@openauthjs/openauth/provider/code\"\n *\n * export default issuer({\n * providers: {\n * code: CodeProvider(\n * CodeUI({\n * copy: {\n * code_info: \"We'll send a pin code to your email\"\n * },\n * sendCode: (claims, code) => console.log(claims.email, code)\n * })\n * )\n * },\n * // ...\n * })\n * ```\n *\n * You can customize the provider using.\n *\n * ```ts {7-9}\n * const ui = CodeUI({\n * // ...\n * })\n *\n * export default issuer({\n * providers: {\n * code: CodeProvider(\n * { ...ui, length: 4 }\n * )\n * },\n * // ...\n * })\n * ```\n *\n * Behind the scenes, the `CodeProvider` expects callbacks that implements request handlers\n * that generate the UI for the following.\n *\n * ```ts\n * CodeProvider({\n * // ...\n * request: (req, state, form, error) => Promise\n * })\n * ```\n *\n * This allows you to create your own UI.\n *\n * @packageDocumentation\n */\nimport { Context } from \"hono\"\nimport { Provider } from \"./provider.js\"\nimport { generateUnbiasedDigits, timingSafeCompare } from \"../random.js\"\n\nexport interface CodeProviderConfig<\n Claims extends Record = Record,\n> {\n /**\n * The length of the pin code.\n *\n * @default 6\n */\n length?: number\n /**\n * The request handler to generate the UI for the code flow.\n *\n * Takes the standard [`Request`](https://developer.mozilla.org/en-US/docs/Web/API/Request)\n * and optionally [`FormData`](https://developer.mozilla.org/en-US/docs/Web/API/FormData)\n * ojects.\n *\n * Also passes in the current `state` of the flow and any `error` that occurred.\n *\n * Expects the [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response) object\n * in return.\n */\n request: (\n req: Request,\n state: CodeProviderState,\n form?: FormData,\n error?: CodeProviderError,\n ) => Promise\n /**\n * Callback to send the pin code to the user.\n *\n * @example\n * ```ts\n * {\n * sendCode: async (claims, code) => {\n * // Send the code through the email or phone number based on the claims\n * }\n * }\n * ```\n */\n sendCode: (claims: Claims, code: string) => Promise\n}\n\n/**\n * The state of the code flow.\n *\n * | State | Description |\n * | ----- | ----------- |\n * | `start` | The user is asked to enter their email address or phone number to start the flow. |\n * | `code` | The user needs to enter the pin code to verify their _claim_. |\n */\nexport type CodeProviderState =\n | {\n type: \"start\"\n }\n | {\n type: \"code\"\n resend?: boolean\n code: string\n claims: Record\n }\n\n/**\n * The errors that can happen on the code flow.\n *\n * | Error | Description |\n * | ----- | ----------- |\n * | `invalid_code` | The code is invalid. |\n * | `invalid_claim` | The _claim_, email or phone number, is invalid. |\n */\nexport type CodeProviderError =\n | {\n type: \"invalid_code\"\n }\n | {\n type: \"invalid_claim\"\n key: string\n value: string\n }\n\nexport function CodeProvider<\n Claims extends Record = Record,\n>(config: CodeProviderConfig): Provider<{ claims: Claims }> {\n const length = config.length || 6\n function generate() {\n return generateUnbiasedDigits(length)\n }\n\n return {\n type: \"code\",\n init(routes, ctx) {\n async function transition(\n c: Context,\n next: CodeProviderState,\n fd?: FormData,\n err?: CodeProviderError,\n ) {\n await ctx.set(c, \"provider\", 60 * 60 * 24, next)\n const resp = ctx.forward(\n c,\n await config.request(c.req.raw, next, fd, err),\n )\n return resp\n }\n routes.get(\"/authorize\", async (c) => {\n const resp = await transition(c, {\n type: \"start\",\n })\n return resp\n })\n\n routes.post(\"/authorize\", async (c) => {\n const code = generate()\n const fd = await c.req.formData()\n const state = await ctx.get(c, \"provider\")\n const action = fd.get(\"action\")?.toString()\n\n if (action === \"request\" || action === \"resend\") {\n const claims = Object.fromEntries(fd) as Claims\n delete claims.action\n const err = await config.sendCode(claims, code)\n if (err) return transition(c, { type: \"start\" }, fd, err)\n return transition(\n c,\n {\n type: \"code\",\n resend: action === \"resend\",\n claims,\n code,\n },\n fd,\n )\n }\n\n if (\n fd.get(\"action\")?.toString() === \"verify\" &&\n state.type === \"code\"\n ) {\n const fd = await c.req.formData()\n const compare = fd.get(\"code\")?.toString()\n if (\n !state.code ||\n !compare ||\n !timingSafeCompare(state.code, compare)\n ) {\n return transition(\n c,\n {\n ...state,\n resend: false,\n },\n fd,\n { type: \"invalid_code\" },\n )\n }\n await ctx.unset(c, \"provider\")\n return ctx.forward(\n c,\n await ctx.success(c, { claims: state.claims as Claims }),\n )\n }\n })\n },\n }\n}\n\n/**\n * @internal\n */\nexport type CodeProviderOptions = Parameters[0]\n"
},
{
"path": "packages/openauth/src/provider/cognito.ts",
"content": "/**\n * Use this provider to authenticate with a Cognito OAuth endpoint.\n *\n * ```ts {5-10}\n * import { CognitoProvider } from \"@openauthjs/openauth/provider/cognito\"\n *\n * export default issuer({\n * providers: {\n * cognito: CognitoProvider({\n * domain: \"your-domain.auth.us-east-1.amazoncognito.com\",\n * region: \"us-east-1\",\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface CognitoConfig extends Oauth2WrappedConfig {\n /**\n * The domain of the Cognito User Pool.\n *\n * @example\n * ```ts\n * {\n * domain: \"your-domain.auth.us-east-1.amazoncognito.com\"\n * }\n * ```\n */\n domain: string\n /**\n * The region the Cognito User Pool is in.\n *\n * @example\n * ```ts\n * {\n * region: \"us-east-1\"\n * }\n * ```\n */\n region: string\n}\n\n/**\n * Create a Cognito OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * CognitoProvider({\n * domain: \"your-domain.auth.us-east-1.amazoncognito.com\",\n * region: \"us-east-1\",\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function CognitoProvider(config: CognitoConfig) {\n const domain = `${config.domain}.auth.${config.region}.amazoncognito.com`\n\n return Oauth2Provider({\n type: \"cognito\",\n ...config,\n endpoint: {\n authorization: `https://${domain}/oauth2/authorize`,\n token: `https://${domain}/oauth2/token`,\n },\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/discord.ts",
"content": "/**\n * Use this provider to authenticate with Discord.\n *\n * ```ts {5-8}\n * import { DiscordProvider } from \"@openauthjs/openauth/provider/discord\"\n *\n * export default issuer({\n * providers: {\n * discord: DiscordProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface DiscordConfig extends Oauth2WrappedConfig {}\n\n/**\n * Create a Discord OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * DiscordProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function DiscordProvider(config: DiscordConfig) {\n return Oauth2Provider({\n type: \"discord\",\n ...config,\n endpoint: {\n authorization: \"https://discord.com/oauth2/authorize\",\n token: \"https://discord.com/api/oauth2/token\",\n },\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/facebook.ts",
"content": "/**\n * Use this provider to authenticate with Facebook. Supports both OAuth2 and OIDC.\n *\n * #### Using OAuth\n *\n * ```ts {5-8}\n * import { FacebookProvider } from \"@openauthjs/openauth/provider/facebook\"\n *\n * export default issuer({\n * providers: {\n * facebook: FacebookProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * #### Using OIDC\n *\n * ```ts {5-7}\n * import { FacebookOidcProvider } from \"@openauthjs/openauth/provider/facebook\"\n *\n * export default issuer({\n * providers: {\n * facebook: FacebookOidcProvider({\n * clientID: \"1234567890\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\nimport { OidcProvider, OidcWrappedConfig } from \"./oidc.js\"\n\nexport interface FacebookConfig extends Oauth2WrappedConfig {}\nexport interface FacebookOidcConfig extends OidcWrappedConfig {}\n\n/**\n * Create a Facebook OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * FacebookProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function FacebookProvider(config: FacebookConfig) {\n return Oauth2Provider({\n ...config,\n type: \"facebook\",\n endpoint: {\n authorization: \"https://www.facebook.com/v12.0/dialog/oauth\",\n token: \"https://graph.facebook.com/v12.0/oauth/access_token\",\n },\n })\n}\n\n/**\n * Create a Facebook OIDC provider.\n *\n * This is useful if you just want to verify the user's email address.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * FacebookOidcProvider({\n * clientID: \"1234567890\"\n * })\n * ```\n */\nexport function FacebookOidcProvider(config: FacebookOidcConfig) {\n return OidcProvider({\n ...config,\n type: \"facebook\",\n issuer: \"https://graph.facebook.com\",\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/github.ts",
"content": "/**\n * Use this provider to authenticate with Github.\n *\n * ```ts {5-8}\n * import { GithubProvider } from \"@openauthjs/openauth/provider/github\"\n *\n * export default issuer({\n * providers: {\n * github: GithubProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface GithubConfig extends Oauth2WrappedConfig {}\n\n/**\n * Create a Github OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * GithubProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function GithubProvider(config: GithubConfig) {\n return Oauth2Provider({\n ...config,\n type: \"github\",\n endpoint: {\n authorization: \"https://github.com/login/oauth/authorize\",\n token: \"https://github.com/login/oauth/access_token\",\n },\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/google.ts",
"content": "/**\n * Use this provider to authenticate with Google. Supports both OAuth2 and OIDC.\n *\n * #### Using OAuth\n *\n * ```ts {5-8}\n * import { GoogleProvider } from \"@openauthjs/openauth/provider/google\"\n *\n * export default issuer({\n * providers: {\n * google: GoogleProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * #### Using OIDC\n *\n * ```ts {5-7}\n * import { GoogleOidcProvider } from \"@openauthjs/openauth/provider/google\"\n *\n * export default issuer({\n * providers: {\n * google: GoogleOidcProvider({\n * clientID: \"1234567890\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\nimport { OidcProvider, OidcWrappedConfig } from \"./oidc.js\"\n\nexport interface GoogleConfig extends Oauth2WrappedConfig {}\nexport interface GoogleOidcConfig extends OidcWrappedConfig {}\n\n/**\n * Create a Google OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * GoogleProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function GoogleProvider(config: GoogleConfig) {\n return Oauth2Provider({\n ...config,\n type: \"google\",\n endpoint: {\n authorization: \"https://accounts.google.com/o/oauth2/v2/auth\",\n token: \"https://oauth2.googleapis.com/token\",\n jwks: \"https://www.googleapis.com/oauth2/v3/certs\",\n },\n })\n}\n\n/**\n * Create a Google OIDC provider.\n *\n * This is useful if you just want to verify the user's email address.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * GoogleOidcProvider({\n * clientID: \"1234567890\"\n * })\n * ```\n */\nexport function GoogleOidcProvider(config: GoogleOidcConfig) {\n return OidcProvider({\n ...config,\n type: \"google\",\n issuer: \"https://accounts.google.com\",\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/index.ts",
"content": "export * from \"./code.js\"\nexport type { Provider as Provider } from \"./provider.js\"\nexport * from \"./spotify.js\"\n"
},
{
"path": "packages/openauth/src/provider/jumpcloud.ts",
"content": "/**\n * Use this provider to authenticate with JumpCloud.\n *\n * ```ts {5-8}\n * import { JumpCloudProvider } from \"@openauthjs/openauth/provider/jumpcloud\"\n *\n * export default issuer({\n * providers: {\n * jumpcloud: JumpCloudProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface JumpCloudConfig extends Oauth2WrappedConfig {}\n\n/**\n * Create a JumpCloud OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * JumpCloudProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function JumpCloudProvider(config: JumpCloudConfig) {\n return Oauth2Provider({\n type: \"jumpcloud\",\n ...config,\n endpoint: {\n authorization: \"https://oauth.id.jumpcloud.com/oauth2/auth\",\n token: \"https://oauth.id.jumpcloud.com/oauth2/token\",\n },\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/keycloak.ts",
"content": "/**\n * Use this provider to authenticate with a Keycloak server.\n *\n * ```ts {5-10}\n * import { KeycloakProvider } from \"@openauthjs/openauth/provider/keycloak\"\n *\n * export default issuer({\n * providers: {\n * keycloak: KeycloakProvider({\n * baseUrl: \"https://your-keycloak-domain\",\n * realm: \"your-realm\",\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface KeycloakConfig extends Oauth2WrappedConfig {\n /**\n * The base URL of the Keycloak server.\n *\n * @example\n * ```ts\n * {\n * baseUrl: \"https://your-keycloak-domain\"\n * }\n * ```\n */\n baseUrl: string\n /**\n * The realm in the Keycloak server to authenticate against.\n *\n * A realm in Keycloak is like a tenant or namespace that manages a set of\n * users, credentials, roles, and groups.\n *\n * @example\n * ```ts\n * {\n * realm: \"your-realm\"\n * }\n * ```\n */\n realm: string\n}\n\n/**\n * Create a Keycloak OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * KeycloakProvider({\n * baseUrl: \"https://your-keycloak-domain\",\n * realm: \"your-realm\",\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function KeycloakProvider(config: KeycloakConfig) {\n const baseConfig = {\n ...config,\n endpoint: {\n authorization: `${config.baseUrl}/realms/${config.realm}/protocol/openid-connect/auth`,\n token: `${config.baseUrl}/realms/${config.realm}/protocol/openid-connect/token`,\n },\n }\n return Oauth2Provider(baseConfig)\n}\n"
},
{
"path": "packages/openauth/src/provider/linkedin.ts",
"content": "import { Oauth2Provider, type Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport function LinkedInAdapter(config: Oauth2WrappedConfig) {\n return Oauth2Provider({\n ...config,\n type: \"linkedin\",\n endpoint: {\n authorization: \"https://www.linkedin.com/oauth/v2/authorization\",\n token: \"https://www.linkedin.com/oauth/v2/accessToken\",\n },\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/microsoft.ts",
"content": "/**\n * Use this provider to authenticate with Microsoft. Supports both OAuth2 and OIDC.\n *\n * #### Using OAuth\n *\n * ```ts {5-9}\n * import { MicrosoftProvider } from \"@openauthjs/openauth/provider/microsoft\"\n *\n * export default issuer({\n * providers: {\n * microsoft: MicrosoftProvider({\n * tenant: \"1234567890\",\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * #### Using OIDC\n *\n * ```ts {5-7}\n * import { MicrosoftOidcProvider } from \"@openauthjs/openauth/provider/microsoft\"\n *\n * export default issuer({\n * providers: {\n * microsoft: MicrosoftOidcProvider({\n * clientID: \"1234567890\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\nimport { OidcProvider, OidcWrappedConfig } from \"./oidc.js\"\n\nexport interface MicrosoftConfig extends Oauth2WrappedConfig {\n /**\n * The tenant ID of the Microsoft account.\n *\n * This is usually the same as the client ID.\n *\n * @example\n * ```ts\n * {\n * tenant: \"1234567890\"\n * }\n * ```\n */\n tenant: string\n}\nexport interface MicrosoftOidcConfig extends OidcWrappedConfig {}\n\n/**\n * Create a Microsoft OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * MicrosoftProvider({\n * tenant: \"1234567890\",\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function MicrosoftProvider(config: MicrosoftConfig) {\n return Oauth2Provider({\n ...config,\n type: \"microsoft\",\n endpoint: {\n authorization: `https://login.microsoftonline.com/${config?.tenant}/oauth2/v2.0/authorize`,\n token: `https://login.microsoftonline.com/${config?.tenant}/oauth2/v2.0/token`,\n },\n })\n}\n\n/**\n * Create a Microsoft OIDC provider.\n *\n * This is useful if you just want to verify the user's email address.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * MicrosoftOidcProvider({\n * clientID: \"1234567890\"\n * })\n * ```\n */\nexport function MicrosoftOidcProvider(config: MicrosoftOidcConfig) {\n return OidcProvider({\n ...config,\n type: \"microsoft\",\n issuer: \"https://graph.microsoft.com/oidc/userinfo\",\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/oauth2.ts",
"content": "/**\n * Use this to connect authentication providers that support OAuth 2.0.\n *\n * ```ts {5-12}\n * import { Oauth2Provider } from \"@openauthjs/openauth/provider/oauth2\"\n *\n * export default issuer({\n * providers: {\n * oauth2: Oauth2Provider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\",\n * endpoint: {\n * authorization: \"https://auth.myserver.com/authorize\",\n * token: \"https://auth.myserver.com/token\"\n * }\n * })\n * }\n * })\n * ```\n *\n *\n * @packageDocumentation\n */\n\nimport { createRemoteJWKSet, jwtVerify } from \"jose\"\nimport { OauthError } from \"../error.js\"\nimport { generatePKCE } from \"../pkce.js\"\nimport { getRelativeUrl } from \"../util.js\"\nimport { Provider } from \"./provider.js\"\n\nexport interface Oauth2Config {\n /**\n * @internal\n */\n type?: string\n /**\n * The client ID.\n *\n * This is just a string to identify your app.\n *\n * @example\n * ```ts\n * {\n * clientID: \"my-client\"\n * }\n * ```\n */\n clientID: string\n /**\n * The client secret.\n *\n * This is a private key that's used to authenticate your app. It should be kept secret.\n *\n * @example\n * ```ts\n * {\n * clientSecret: \"0987654321\"\n * }\n * ```\n */\n clientSecret: string\n /**\n * The URLs of the authorization and token endpoints.\n *\n * @example\n * ```ts\n * {\n * endpoint: {\n * authorization: \"https://auth.myserver.com/authorize\",\n * token: \"https://auth.myserver.com/token\",\n * jwks: \"https://auth.myserver.com/auth/keys\"\n * }\n * }\n * ```\n */\n endpoint: {\n /**\n * The URL of the authorization endpoint.\n */\n authorization: string\n /**\n * The URL of the token endpoint.\n */\n token: string\n /**\n * The URL of the JWKS endpoint.\n */\n jwks?: string\n }\n /**\n * A list of OAuth scopes that you want to request.\n *\n * @example\n * ```ts\n * {\n * scopes: [\"email\", \"profile\"]\n * }\n * ```\n */\n scopes: string[]\n /**\n * Whether to use PKCE (Proof Key for Code Exchange) for the authorization code flow.\n * Some providers like x.com require this.\n * @default false\n */\n pkce?: boolean\n /**\n * Any additional parameters that you want to pass to the authorization endpoint.\n * @example\n * ```ts\n * {\n * query: {\n * access_type: \"offline\",\n * prompt: \"consent\"\n * }\n * }\n * ```\n */\n query?: Record\n}\n\n/**\n * @internal\n */\nexport type Oauth2WrappedConfig = Omit\n\n/**\n * @internal\n */\nexport interface Oauth2Token {\n access: string\n refresh: string\n expiry: number\n id?: Record\n raw: Record\n}\n\ninterface ProviderState {\n state: string\n redirect: string\n codeVerifier?: string\n}\n\nexport function Oauth2Provider(\n config: Oauth2Config,\n): Provider<{ tokenset: Oauth2Token; clientID: string }> {\n const query = config.query || {}\n\n // Helper function to handle token exchange and response building\n async function handleCallbackLogic(\n c: any,\n ctx: any,\n provider: ProviderState,\n code: string | undefined,\n ) {\n if (!provider || !code) {\n return c.redirect(getRelativeUrl(c, \"./authorize\"))\n }\n\n const body = new URLSearchParams({\n client_id: config.clientID,\n client_secret: config.clientSecret,\n code,\n grant_type: \"authorization_code\",\n redirect_uri: provider.redirect,\n ...(provider.codeVerifier\n ? { code_verifier: provider.codeVerifier }\n : {}),\n })\n\n const json: any = await fetch(config.endpoint.token, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n Accept: \"application/json\",\n },\n body: body.toString(),\n }).then((r) => r.json())\n\n if (\"error\" in json) {\n throw new OauthError(json.error, json.error_description)\n }\n\n let idTokenPayload: Record | null = null\n if (config.endpoint.jwks) {\n const jwksEndpoint = new URL(config.endpoint.jwks)\n // @ts-expect-error bun/node mismatch\n const jwks = createRemoteJWKSet(jwksEndpoint)\n const { payload } = await jwtVerify(json.id_token, jwks, {\n audience: config.clientID,\n })\n idTokenPayload = payload\n }\n\n return ctx.success(c, {\n clientID: config.clientID,\n tokenset: {\n get access() {\n return json.access_token\n },\n get refresh() {\n return json.refresh_token\n },\n get expiry() {\n return json.expires_in\n },\n get id() {\n if (!idTokenPayload) return null\n return idTokenPayload\n },\n get raw() {\n return json\n },\n },\n })\n }\n\n return {\n type: config.type || \"oauth2\",\n init(routes, ctx) {\n routes.get(\"/authorize\", async (c) => {\n const state = crypto.randomUUID()\n const pkce = config.pkce ? await generatePKCE() : undefined\n await ctx.set(c, \"provider\", 60 * 10, {\n state,\n redirect: getRelativeUrl(c, \"./callback\"),\n codeVerifier: pkce?.verifier,\n })\n const authorization = new URL(config.endpoint.authorization)\n authorization.searchParams.set(\"client_id\", config.clientID)\n authorization.searchParams.set(\n \"redirect_uri\",\n getRelativeUrl(c, \"./callback\"),\n )\n authorization.searchParams.set(\"response_type\", \"code\")\n authorization.searchParams.set(\"state\", state)\n authorization.searchParams.set(\"scope\", config.scopes.join(\" \"))\n if (pkce) {\n authorization.searchParams.set(\"code_challenge\", pkce.challenge)\n authorization.searchParams.set(\"code_challenge_method\", pkce.method)\n }\n for (const [key, value] of Object.entries(query)) {\n authorization.searchParams.set(key, value)\n }\n return c.redirect(authorization.toString())\n })\n\n routes.get(\"/callback\", async (c) => {\n const provider = (await ctx.get(c, \"provider\")) as ProviderState\n const code = c.req.query(\"code\")\n const state = c.req.query(\"state\")\n const error = c.req.query(\"error\")\n\n if (error)\n throw new OauthError(\n error.toString() as any,\n c.req.query(\"error_description\")?.toString() || \"\",\n )\n if (\n !provider ||\n !code ||\n (provider.state && state !== provider.state)\n ) {\n return c.redirect(getRelativeUrl(c, \"./authorize\"))\n }\n\n return handleCallbackLogic(c, ctx, provider, code)\n })\n\n routes.post(\"/callback\", async (c) => {\n const provider = (await ctx.get(c, \"provider\")) as ProviderState\n\n // Handle form data from POST request\n const formData = await c.req.formData()\n const code = formData.get(\"code\")?.toString()\n const state = formData.get(\"state\")?.toString()\n const error = formData.get(\"error\")?.toString()\n\n if (error)\n throw new OauthError(\n error as any,\n formData.get(\"error_description\")?.toString() || \"\",\n )\n\n if (\n !provider ||\n !code ||\n (provider.state && state !== provider.state)\n ) {\n return c.redirect(getRelativeUrl(c, \"./authorize\"))\n }\n\n return handleCallbackLogic(c, ctx, provider, code)\n })\n },\n }\n}\n"
},
{
"path": "packages/openauth/src/provider/oidc.ts",
"content": "/**\n * Use this to connect authentication providers that support OIDC.\n *\n * ```ts {5-8}\n * import { OidcProvider } from \"@openauthjs/openauth/provider/oidc\"\n *\n * export default issuer({\n * providers: {\n * oauth2: OidcProvider({\n * clientId: \"1234567890\",\n * issuer: \"https://auth.myserver.com\"\n * })\n * }\n * })\n * ```\n *\n *\n * @packageDocumentation\n */\n\nimport { createLocalJWKSet, JSONWebKeySet, jwtVerify } from \"jose\"\nimport { WellKnown } from \"../client.js\"\nimport { OauthError } from \"../error.js\"\nimport { Provider } from \"./provider.js\"\nimport { JWTPayload } from \"hono/utils/jwt/types\"\nimport { getRelativeUrl, lazy } from \"../util.js\"\n\nexport interface OidcConfig {\n /**\n * @internal\n */\n type?: string\n /**\n * The client ID.\n *\n * This is just a string to identify your app.\n *\n * @example\n * ```ts\n * {\n * clientID: \"my-client\"\n * }\n * ```\n */\n clientID: string\n /**\n * The URL of your authorization server.\n *\n * @example\n * ```ts\n * {\n * issuer: \"https://auth.myserver.com\"\n * }\n * ```\n */\n issuer: string\n /**\n * A list of OIDC scopes that you want to request.\n *\n * @example\n * ```ts\n * {\n * scopes: [\"openid\", \"profile\", \"email\"]\n * }\n * ```\n */\n scopes?: string[]\n /**\n * Any additional parameters that you want to pass to the authorization endpoint.\n * @example\n * ```ts\n * {\n * query: {\n * prompt: \"consent\"\n * }\n * }\n * ```\n */\n query?: Record\n}\n\n/**\n * @internal\n */\nexport type OidcWrappedConfig = Omit\n\ninterface ProviderState {\n state: string\n nonce: string\n redirect: string\n}\n\n/**\n * @internal\n */\nexport interface IdTokenResponse {\n idToken: string\n claims: Record\n raw: Record\n}\n\nexport function OidcProvider(\n config: OidcConfig,\n): Provider<{ id: JWTPayload; clientID: string }> {\n const query = config.query || {}\n const scopes = config.scopes || []\n\n const wk = lazy(() =>\n fetch(config.issuer + \"/.well-known/openid-configuration\").then(\n async (r) => {\n if (!r.ok) throw new Error(await r.text())\n return r.json() as Promise\n },\n ),\n )\n\n const jwks = lazy(() =>\n wk()\n .then((r) => r.jwks_uri)\n .then(async (uri) => {\n const r = await fetch(uri)\n if (!r.ok) throw new Error(await r.text())\n return createLocalJWKSet((await r.json()) as JSONWebKeySet)\n }),\n )\n\n return {\n type: config.type || \"oidc\",\n init(routes, ctx) {\n routes.get(\"/authorize\", async (c) => {\n const provider: ProviderState = {\n state: crypto.randomUUID(),\n nonce: crypto.randomUUID(),\n redirect: getRelativeUrl(c, \"./callback\"),\n }\n await ctx.set(c, \"provider\", 60 * 10, provider)\n const authorization = new URL(\n await wk().then((r) => r.authorization_endpoint),\n )\n authorization.searchParams.set(\"client_id\", config.clientID)\n authorization.searchParams.set(\"response_type\", \"id_token\")\n authorization.searchParams.set(\"response_mode\", \"form_post\")\n authorization.searchParams.set(\"state\", provider.state)\n authorization.searchParams.set(\"nonce\", provider.nonce)\n authorization.searchParams.set(\"redirect_uri\", provider.redirect)\n authorization.searchParams.set(\"scope\", [\"openid\", ...scopes].join(\" \"))\n for (const [key, value] of Object.entries(query)) {\n authorization.searchParams.set(key, value)\n }\n return c.redirect(authorization.toString())\n })\n\n routes.post(\"/callback\", async (c) => {\n const provider = await ctx.get(c, \"provider\")\n if (!provider) return c.redirect(getRelativeUrl(c, \"./authorize\"))\n const body = await c.req.formData()\n const error = body.get(\"error\")\n if (error)\n throw new OauthError(\n error.toString() as any,\n body.get(\"error_description\")?.toString() || \"\",\n )\n const idToken = body.get(\"id_token\")\n if (!idToken)\n throw new OauthError(\"invalid_request\", \"Missing id_token\")\n const result = await jwtVerify(idToken.toString(), await jwks(), {\n audience: config.clientID,\n })\n if (result.payload.nonce !== provider.nonce) {\n throw new OauthError(\"invalid_request\", \"Invalid nonce\")\n }\n return ctx.success(c, {\n id: result.payload,\n clientID: config.clientID,\n })\n })\n },\n }\n}\n"
},
{
"path": "packages/openauth/src/provider/password.ts",
"content": "/**\n * Configures a provider that supports username and password authentication. This is usually\n * paired with the `PasswordUI`.\n *\n * ```ts\n * import { PasswordUI } from \"@openauthjs/openauth/ui/password\"\n * import { PasswordProvider } from \"@openauthjs/openauth/provider/password\"\n *\n * export default issuer({\n * providers: {\n * password: PasswordProvider(\n * PasswordUI({\n * copy: {\n * error_email_taken: \"This email is already taken.\"\n * },\n * sendCode: (email, code) => console.log(email, code)\n * })\n * )\n * },\n * // ...\n * })\n * ```\n *\n * Behind the scenes, the `PasswordProvider` expects callbacks that implements request handlers\n * that generate the UI for the following.\n *\n * ```ts\n * PasswordProvider({\n * // ...\n * login: (req, form, error) => Promise\n * register: (req, state, form, error) => Promise\n * change: (req, state, form, error) => Promise\n * })\n * ```\n *\n * This allows you to create your own UI for each of these screens.\n *\n * @packageDocumentation\n */\nimport { UnknownStateError } from \"../error.js\"\nimport { Storage } from \"../storage/storage.js\"\nimport { Provider } from \"./provider.js\"\nimport { generateUnbiasedDigits, timingSafeCompare } from \"../random.js\"\nimport { v1 } from \"@standard-schema/spec\"\n\n/**\n * @internal\n */\nexport interface PasswordHasher {\n hash(password: string): Promise\n verify(password: string, compare: T): Promise\n}\n\nexport interface PasswordConfig {\n /**\n * @internal\n */\n length?: number\n /**\n * @internal\n */\n hasher?: PasswordHasher\n /**\n * The request handler to generate the UI for the login screen.\n *\n * Takes the standard [`Request`](https://developer.mozilla.org/en-US/docs/Web/API/Request)\n * and optionally [`FormData`](https://developer.mozilla.org/en-US/docs/Web/API/FormData)\n * ojects.\n *\n * In case of an error, this is called again with the `error`.\n *\n * Expects the [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response) object\n * in return.\n */\n login: (\n req: Request,\n form?: FormData,\n error?: PasswordLoginError,\n ) => Promise\n /**\n * The request handler to generate the UI for the register screen.\n *\n * Takes the standard [`Request`](https://developer.mozilla.org/en-US/docs/Web/API/Request)\n * and optionally [`FormData`](https://developer.mozilla.org/en-US/docs/Web/API/FormData)\n * ojects.\n *\n * Also passes in the current `state` of the flow and any `error` that occurred.\n *\n * Expects the [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response) object\n * in return.\n */\n register: (\n req: Request,\n state: PasswordRegisterState,\n form?: FormData,\n error?: PasswordRegisterError,\n ) => Promise\n /**\n * The request handler to generate the UI for the change password screen.\n *\n * Takes the standard [`Request`](https://developer.mozilla.org/en-US/docs/Web/API/Request)\n * and optionally [`FormData`](https://developer.mozilla.org/en-US/docs/Web/API/FormData)\n * ojects.\n *\n * Also passes in the current `state` of the flow and any `error` that occurred.\n *\n * Expects the [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response) object\n * in return.\n */\n change: (\n req: Request,\n state: PasswordChangeState,\n form?: FormData,\n error?: PasswordChangeError,\n ) => Promise\n /**\n * Callback to send the confirmation pin code to the user.\n *\n * @example\n * ```ts\n * {\n * sendCode: async (email, code) => {\n * // Send an email with the code\n * }\n * }\n * ```\n */\n sendCode: (email: string, code: string) => Promise\n /**\n * Callback to validate the password on sign up and password reset.\n *\n * @example\n * ```ts\n * {\n * validatePassword: (password) => {\n * return password.length < 8 ? \"Password must be at least 8 characters\" : undefined\n * }\n * }\n * ```\n */\n validatePassword?:\n | v1.StandardSchema\n | ((password: string) => Promise | string | undefined)\n}\n\n/**\n * The states that can happen on the register screen.\n *\n * | State | Description |\n * | ----- | ----------- |\n * | `start` | The user is asked to enter their email address and password to start the flow. |\n * | `code` | The user needs to enter the pin code to verify their email. |\n */\nexport type PasswordRegisterState =\n | {\n type: \"start\"\n }\n | {\n type: \"code\"\n code: string\n email: string\n password: string\n }\n\n/**\n * The errors that can happen on the register screen.\n *\n * | Error | Description |\n * | ----- | ----------- |\n * | `email_taken` | The email is already taken. |\n * | `invalid_email` | The email is invalid. |\n * | `invalid_code` | The code is invalid. |\n * | `invalid_password` | The password is invalid. |\n * | `password_mismatch` | The passwords do not match. |\n */\nexport type PasswordRegisterError =\n | {\n type: \"invalid_code\"\n }\n | {\n type: \"email_taken\"\n }\n | {\n type: \"invalid_email\"\n }\n | {\n type: \"invalid_password\"\n }\n | {\n type: \"password_mismatch\"\n }\n | {\n type: \"validation_error\"\n message?: string\n }\n\n/**\n * The state of the password change flow.\n *\n * | State | Description |\n * | ----- | ----------- |\n * | `start` | The user is asked to enter their email address to start the flow. |\n * | `code` | The user needs to enter the pin code to verify their email. |\n * | `update` | The user is asked to enter their new password and confirm it. |\n */\nexport type PasswordChangeState =\n | {\n type: \"start\"\n redirect: string\n }\n | {\n type: \"code\"\n code: string\n email: string\n redirect: string\n }\n | {\n type: \"update\"\n redirect: string\n email: string\n }\n\n/**\n * The errors that can happen on the change password screen.\n *\n * | Error | Description |\n * | ----- | ----------- |\n * | `invalid_email` | The email is invalid. |\n * | `invalid_code` | The code is invalid. |\n * | `invalid_password` | The password is invalid. |\n * | `password_mismatch` | The passwords do not match. |\n */\nexport type PasswordChangeError =\n | {\n type: \"invalid_email\"\n }\n | {\n type: \"invalid_code\"\n }\n | {\n type: \"invalid_password\"\n }\n | {\n type: \"password_mismatch\"\n }\n | {\n type: \"validation_error\"\n message: string\n }\n\n/**\n * The errors that can happen on the login screen.\n *\n * | Error | Description |\n * | ----- | ----------- |\n * | `invalid_email` | The email is invalid. |\n * | `invalid_password` | The password is invalid. |\n */\nexport type PasswordLoginError =\n | {\n type: \"invalid_password\"\n }\n | {\n type: \"invalid_email\"\n }\n\nexport function PasswordProvider(\n config: PasswordConfig,\n): Provider<{ email: string }> {\n const hasher = config.hasher ?? ScryptHasher()\n function generate() {\n return generateUnbiasedDigits(6)\n }\n return {\n type: \"password\",\n init(routes, ctx) {\n routes.get(\"/authorize\", async (c) =>\n ctx.forward(c, await config.login(c.req.raw)),\n )\n\n routes.post(\"/authorize\", async (c) => {\n const fd = await c.req.formData()\n async function error(err: PasswordLoginError) {\n return ctx.forward(c, await config.login(c.req.raw, fd, err))\n }\n const email = fd.get(\"email\")?.toString()?.toLowerCase()\n if (!email) return error({ type: \"invalid_email\" })\n const hash = await Storage.get(ctx.storage, [\n \"email\",\n email,\n \"password\",\n ])\n const password = fd.get(\"password\")?.toString()\n if (!password || !hash || !(await hasher.verify(password, hash)))\n return error({ type: \"invalid_password\" })\n return ctx.success(\n c,\n {\n email: email,\n },\n {\n invalidate: async (subject) => {\n await Storage.set(\n ctx.storage,\n [\"email\", email, \"subject\"],\n subject,\n )\n },\n },\n )\n })\n\n routes.get(\"/register\", async (c) => {\n const state: PasswordRegisterState = {\n type: \"start\",\n }\n await ctx.set(c, \"provider\", 60 * 60 * 24, state)\n return ctx.forward(c, await config.register(c.req.raw, state))\n })\n\n routes.post(\"/register\", async (c) => {\n const fd = await c.req.formData()\n const email = fd.get(\"email\")?.toString()?.toLowerCase()\n const action = fd.get(\"action\")?.toString()\n const provider = await ctx.get(c, \"provider\")\n\n async function transition(\n next: PasswordRegisterState,\n err?: PasswordRegisterError,\n ) {\n await ctx.set(\n c,\n \"provider\",\n 60 * 60 * 24,\n next,\n )\n return ctx.forward(c, await config.register(c.req.raw, next, fd, err))\n }\n\n if (action === \"register\" && provider.type === \"start\") {\n const password = fd.get(\"password\")?.toString()\n const repeat = fd.get(\"repeat\")?.toString()\n if (!email) return transition(provider, { type: \"invalid_email\" })\n if (!password)\n return transition(provider, { type: \"invalid_password\" })\n if (password !== repeat)\n return transition(provider, { type: \"password_mismatch\" })\n if (config.validatePassword) {\n let validationError: string | undefined\n try {\n if (typeof config.validatePassword === \"function\") {\n validationError = await config.validatePassword(password)\n } else {\n const res =\n await config.validatePassword[\"~standard\"].validate(password)\n\n if (res.issues?.length) {\n throw new Error(\n res.issues.map((issue) => issue.message).join(\", \"),\n )\n }\n }\n } catch (error) {\n validationError =\n error instanceof Error ? error.message : undefined\n }\n if (validationError)\n return transition(provider, {\n type: \"validation_error\",\n message: validationError,\n })\n }\n const existing = await Storage.get(ctx.storage, [\n \"email\",\n email,\n \"password\",\n ])\n if (existing) return transition(provider, { type: \"email_taken\" })\n const code = generate()\n await config.sendCode(email, code)\n return transition({\n type: \"code\",\n code,\n password: await hasher.hash(password),\n email,\n })\n }\n\n if (action === \"register\" && provider.type === \"code\") {\n const code = generate()\n await config.sendCode(provider.email, code)\n return transition({\n type: \"code\",\n code,\n password: provider.password,\n email: provider.email,\n })\n }\n\n if (action === \"verify\" && provider.type === \"code\") {\n const code = fd.get(\"code\")?.toString()\n if (!code || !timingSafeCompare(code, provider.code))\n return transition(provider, { type: \"invalid_code\" })\n const existing = await Storage.get(ctx.storage, [\n \"email\",\n provider.email,\n \"password\",\n ])\n if (existing)\n return transition({ type: \"start\" }, { type: \"email_taken\" })\n await Storage.set(\n ctx.storage,\n [\"email\", provider.email, \"password\"],\n provider.password,\n )\n return ctx.success(c, {\n email: provider.email,\n })\n }\n\n return transition({ type: \"start\" })\n })\n\n routes.get(\"/change\", async (c) => {\n let redirect =\n c.req.query(\"redirect_uri\") || getRelativeUrl(c, \"./authorize\")\n const state: PasswordChangeState = {\n type: \"start\",\n redirect,\n }\n await ctx.set(c, \"provider\", 60 * 60 * 24, state)\n return ctx.forward(c, await config.change(c.req.raw, state))\n })\n\n routes.post(\"/change\", async (c) => {\n const fd = await c.req.formData()\n const action = fd.get(\"action\")?.toString()\n const provider = await ctx.get(c, \"provider\")\n if (!provider) throw new UnknownStateError()\n\n async function transition(\n next: PasswordChangeState,\n err?: PasswordChangeError,\n ) {\n await ctx.set(c, \"provider\", 60 * 60 * 24, next)\n return ctx.forward(c, await config.change(c.req.raw, next, fd, err))\n }\n\n if (action === \"code\") {\n const email = fd.get(\"email\")?.toString()?.toLowerCase()\n if (!email)\n return transition(\n { type: \"start\", redirect: provider.redirect },\n { type: \"invalid_email\" },\n )\n const code = generate()\n await config.sendCode(email, code)\n\n return transition({\n type: \"code\",\n code,\n email,\n redirect: provider.redirect,\n })\n }\n\n if (action === \"verify\" && provider.type === \"code\") {\n const code = fd.get(\"code\")?.toString()\n if (!code || !timingSafeCompare(code, provider.code))\n return transition(provider, { type: \"invalid_code\" })\n return transition({\n type: \"update\",\n email: provider.email,\n redirect: provider.redirect,\n })\n }\n\n if (action === \"update\" && provider.type === \"update\") {\n const existing = await Storage.get(ctx.storage, [\n \"email\",\n provider.email,\n \"password\",\n ])\n if (!existing) return c.redirect(provider.redirect, 302)\n\n const password = fd.get(\"password\")?.toString()\n const repeat = fd.get(\"repeat\")?.toString()\n if (!password)\n return transition(provider, { type: \"invalid_password\" })\n if (password !== repeat)\n return transition(provider, { type: \"password_mismatch\" })\n\n if (config.validatePassword) {\n let validationError: string | undefined\n try {\n if (typeof config.validatePassword === \"function\") {\n validationError = await config.validatePassword(password)\n } else {\n const res =\n await config.validatePassword[\"~standard\"].validate(password)\n\n if (res.issues?.length) {\n throw new Error(\n res.issues.map((issue) => issue.message).join(\", \"),\n )\n }\n }\n } catch (error) {\n validationError =\n error instanceof Error ? error.message : undefined\n }\n if (validationError)\n return transition(provider, {\n type: \"validation_error\",\n message: validationError,\n })\n }\n\n await Storage.set(\n ctx.storage,\n [\"email\", provider.email, \"password\"],\n await hasher.hash(password),\n )\n const subject = await Storage.get(ctx.storage, [\n \"email\",\n provider.email,\n \"subject\",\n ])\n if (subject) await ctx.invalidate(subject)\n\n return c.redirect(provider.redirect, 302)\n }\n\n return transition({ type: \"start\", redirect: provider.redirect })\n })\n },\n }\n}\n\nimport * as jose from \"jose\"\nimport { TextEncoder } from \"node:util\"\n\ninterface HashedPassword {}\n\n/**\n * @internal\n */\nexport function PBKDF2Hasher(opts?: { iterations?: number }): PasswordHasher<{\n hash: string\n salt: string\n iterations: number\n}> {\n const iterations = opts?.iterations ?? 600000\n return {\n async hash(password) {\n const encoder = new TextEncoder()\n const bytes = encoder.encode(password)\n const salt = crypto.getRandomValues(new Uint8Array(16))\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n bytes,\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n )\n const hash = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n hash: \"SHA-256\",\n salt: salt,\n iterations,\n },\n keyMaterial,\n 256,\n )\n const hashBase64 = jose.base64url.encode(new Uint8Array(hash))\n const saltBase64 = jose.base64url.encode(salt)\n return {\n hash: hashBase64,\n salt: saltBase64,\n iterations,\n }\n },\n async verify(password, compare) {\n const encoder = new TextEncoder()\n const passwordBytes = encoder.encode(password)\n const salt = jose.base64url.decode(compare.salt)\n const params = {\n name: \"PBKDF2\",\n hash: \"SHA-256\",\n salt,\n iterations: compare.iterations,\n }\n const keyMaterial = await crypto.subtle.importKey(\n \"raw\",\n passwordBytes,\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n )\n const hash = await crypto.subtle.deriveBits(params, keyMaterial, 256)\n const hashBase64 = jose.base64url.encode(new Uint8Array(hash))\n return hashBase64 === compare.hash\n },\n }\n}\nimport { timingSafeEqual, randomBytes, scrypt } from \"node:crypto\"\nimport { getRelativeUrl } from \"../util.js\"\n\n/**\n * @internal\n */\nexport function ScryptHasher(opts?: {\n N?: number\n r?: number\n p?: number\n}): PasswordHasher<{\n hash: string\n salt: string\n N: number\n r: number\n p: number\n}> {\n const N = opts?.N ?? 16384\n const r = opts?.r ?? 8\n const p = opts?.p ?? 1\n\n return {\n async hash(password) {\n const salt = randomBytes(16)\n const keyLength = 32 // 256 bits\n\n const derivedKey = await new Promise((resolve, reject) => {\n scrypt(password, salt, keyLength, { N, r, p }, (err, derivedKey) => {\n if (err) reject(err)\n else resolve(derivedKey)\n })\n })\n\n const hashBase64 = derivedKey.toString(\"base64\")\n const saltBase64 = salt.toString(\"base64\")\n\n return {\n hash: hashBase64,\n salt: saltBase64,\n N,\n r,\n p,\n }\n },\n\n async verify(password, compare) {\n const salt = Buffer.from(compare.salt, \"base64\")\n const keyLength = 32 // 256 bits\n\n const derivedKey = await new Promise((resolve, reject) => {\n scrypt(\n password,\n salt,\n keyLength,\n { N: compare.N, r: compare.r, p: compare.p },\n (err, derivedKey) => {\n if (err) reject(err)\n else resolve(derivedKey)\n },\n )\n })\n\n return timingSafeEqual(derivedKey, Buffer.from(compare.hash, \"base64\"))\n },\n }\n}\n"
},
{
"path": "packages/openauth/src/provider/provider.ts",
"content": "import type { Context, Hono } from \"hono\"\nimport { StorageAdapter } from \"../storage/storage.js\"\n\nexport type ProviderRoute = Hono\n\nexport interface Provider {\n type: string\n init: (route: ProviderRoute, options: ProviderOptions) => void\n client?: (input: {\n clientID: string\n clientSecret: string\n params: Record\n }) => Promise\n}\n\nexport interface ProviderOptions {\n name: string\n success: (\n ctx: Context,\n properties: Properties,\n opts?: {\n invalidate?: (subject: string) => Promise\n },\n ) => Promise\n forward: (ctx: Context, response: Response) => Response\n set: (ctx: Context, key: string, maxAge: number, value: T) => Promise\n get: (ctx: Context, key: string) => Promise\n unset: (ctx: Context, key: string) => Promise\n invalidate: (subject: string) => Promise\n storage: StorageAdapter\n}\nexport class ProviderError extends Error {}\nexport class ProviderUnknownError extends ProviderError {}\n"
},
{
"path": "packages/openauth/src/provider/slack.ts",
"content": "/**\n * Use this provider to authenticate with Slack.\n *\n * ```ts {5-10}\n * import { SlackProvider } from \"@openauthjs/openauth/provider/slack\"\n *\n * export default issuer({\n * providers: {\n * slack: SlackProvider({\n * team: \"T1234567890\",\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\",\n * scopes: [\"openid\", \"email\", \"profile\"]\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface SlackConfig extends Oauth2WrappedConfig {\n /**\n * The workspace the user is intending to authenticate.\n *\n * If that workspace has been previously authenticated, the user will be signed in directly,\n * bypassing the consent screen.\n */\n team: string\n /**\n * The scopes to request from the user.\n *\n * | Scope | Description |\n * |-|-|\n * | `email` | Grants permission to access the user's email address. |\n * | `profile` | Grants permission to access the user's profile information. |\n * | `openid` | Grants permission to use OpenID Connect to verify the user's identity. |\n */\n scopes: (\"email\" | \"profile\" | \"openid\")[]\n}\n\n/**\n * Creates a [Slack OAuth2 provider](https://api.slack.com/authentication/sign-in-with-slack).\n *\n * @param {SlackConfig} config - The config for the provider.\n * @example\n * ```ts\n * SlackProvider({\n * team: \"T1234567890\",\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\",\n * scopes: [\"openid\", \"email\", \"profile\"]\n * })\n * ```\n */\nexport function SlackProvider(config: SlackConfig) {\n return Oauth2Provider({\n ...config,\n type: \"slack\",\n endpoint: {\n authorization: \"https://slack.com/openid/connect/authorize\",\n token: \"https://slack.com/api/openid.connect.token\",\n },\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/spotify.ts",
"content": "/**\n * Use this provider to authenticate with Spotify.\n *\n * ```ts {5-8}\n * import { SpotifyProvider } from \"@openauthjs/openauth/provider/spotify\"\n *\n * export default issuer({\n * providers: {\n * spotify: SpotifyProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, type Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface SpotifyConfig extends Oauth2WrappedConfig {}\n\n/**\n * Create a Spotify OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * SpotifyProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function SpotifyProvider(config: SpotifyConfig) {\n return Oauth2Provider({\n ...config,\n type: \"spotify\",\n endpoint: {\n authorization: \"https://accounts.spotify.com/authorize\",\n token: \"https://accounts.spotify.com/api/token\",\n },\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/twitch.ts",
"content": "/**\n * Use this provider to authenticate with Twitch.\n *\n * ```ts {5-8}\n * import { TwitchProvider } from \"@openauthjs/openauth/provider/twitch\"\n *\n * export default issuer({\n * providers: {\n * twitch: TwitchProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface TwitchConfig extends Oauth2WrappedConfig {}\n\n/**\n * Create a Twitch OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * TwitchProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function TwitchProvider(config: TwitchConfig) {\n return Oauth2Provider({\n type: \"twitch\",\n ...config,\n endpoint: {\n authorization: \"https://id.twitch.tv/oauth2/authorize\",\n token: \"https://id.twitch.tv/oauth2/token\",\n },\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/x.ts",
"content": "/**\n * Use this provider to authenticate with X.com.\n *\n * ```ts {5-8}\n * import { XProvider } from \"@openauthjs/openauth/provider/x\"\n *\n * export default issuer({\n * providers: {\n * x: XProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface XProviderConfig extends Oauth2WrappedConfig {}\n\n/**\n * Create a X.com OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * XProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function XProvider(config: XProviderConfig) {\n return Oauth2Provider({\n ...config,\n type: \"x\",\n endpoint: {\n authorization: \"https://twitter.com/i/oauth2/authorize\",\n token: \"https://api.x.com/2/oauth2/token\",\n },\n pkce: true,\n })\n}\n"
},
{
"path": "packages/openauth/src/provider/yahoo.ts",
"content": "/**\n * Use this provider to authenticate with Yahoo.\n *\n * ```ts {5-8}\n * import { YahooProvider } from \"@openauthjs/openauth/provider/yahoo\"\n *\n * export default issuer({\n * providers: {\n * yahoo: YahooProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * }\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { Oauth2Provider, Oauth2WrappedConfig } from \"./oauth2.js\"\n\nexport interface YahooConfig extends Oauth2WrappedConfig {}\n\n/**\n * Create a Yahoo OAuth2 provider.\n *\n * @param config - The config for the provider.\n * @example\n * ```ts\n * YahooProvider({\n * clientID: \"1234567890\",\n * clientSecret: \"0987654321\"\n * })\n * ```\n */\nexport function YahooProvider(config: YahooConfig) {\n return Oauth2Provider({\n ...config,\n type: \"yahoo\",\n endpoint: {\n authorization: \"https://api.login.yahoo.com/oauth2/request_auth\",\n token: \"https://api.login.yahoo.com/oauth2/get_token\",\n },\n })\n}\n"
},
{
"path": "packages/openauth/src/random.ts",
"content": "import { timingSafeEqual } from \"node:crypto\"\n\nexport function generateUnbiasedDigits(length: number): string {\n const result: number[] = []\n while (result.length < length) {\n const buffer = crypto.getRandomValues(new Uint8Array(length * 2))\n for (const byte of buffer) {\n if (byte < 250 && result.length < length) {\n result.push(byte % 10)\n }\n }\n }\n return result.join(\"\")\n}\n\nexport function timingSafeCompare(a: string, b: string): boolean {\n if (typeof a !== \"string\" || typeof b !== \"string\") {\n return false\n }\n if (a.length !== b.length) {\n return false\n }\n return timingSafeEqual(Buffer.from(a), Buffer.from(b))\n}\n"
},
{
"path": "packages/openauth/src/storage/aws.ts",
"content": "import { AwsClient } from \"aws4fetch\"\n\ninterface EC2Credentials {\n AccessKeyId: string\n SecretAccessKey: string\n Token: string\n Expiration: string\n Type: string\n}\n\nlet cachedCredentials: EC2Credentials | null = null\n\nasync function getCredentials(url: string): Promise {\n if (cachedCredentials) {\n const currentTime = new Date()\n const fiveMinutesFromNow = new Date(currentTime.getTime() + 5 * 60000)\n const expirationTime = new Date(cachedCredentials.Expiration)\n if (expirationTime > fiveMinutesFromNow) {\n return cachedCredentials\n }\n }\n\n const credentials = (await fetch(url).then((res) =>\n res.json(),\n )) as EC2Credentials\n cachedCredentials = credentials\n return credentials\n}\n\nexport async function client(): Promise {\n if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {\n return new AwsClient({\n accessKeyId: process.env.AWS_ACCESS_KEY_ID,\n secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,\n sessionToken: process.env.AWS_SESSION_TOKEN,\n region: process.env.AWS_REGION,\n })\n }\n\n if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {\n const credentials = await getCredentials(\n \"http://169.254.170.2\" +\n process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI,\n )\n return new AwsClient({\n accessKeyId: credentials.AccessKeyId,\n secretAccessKey: credentials.SecretAccessKey,\n sessionToken: credentials.Token,\n region: process.env.AWS_REGION,\n })\n }\n\n throw new Error(\"No AWS credentials found\")\n}\n\nexport type AwsOptions = Exclude<\n Parameters[1],\n null | undefined\n>[\"aws\"]\n"
},
{
"path": "packages/openauth/src/storage/cloudflare.ts",
"content": "/**\n * Configure OpenAuth to use [Cloudflare KV](https://developers.cloudflare.com/kv/) as a\n * storage adapter.\n *\n * ```ts\n * import { CloudflareStorage } from \"@openauthjs/openauth/storage/cloudflare\"\n *\n * const storage = CloudflareStorage({\n * namespace: \"my-namespace\"\n * })\n *\n *\n * export default issuer({\n * storage,\n * // ...\n * })\n * ```\n *\n * @packageDocumentation\n */\nimport type { KVNamespace } from \"@cloudflare/workers-types\"\nimport { joinKey, splitKey, StorageAdapter } from \"./storage.js\"\n\n/**\n * Configure the Cloudflare KV store that's created.\n */\nexport interface CloudflareStorageOptions {\n namespace: KVNamespace\n}\n/**\n * Creates a Cloudflare KV store.\n * @param options - The config for the adapter.\n */\nexport function CloudflareStorage(\n options: CloudflareStorageOptions,\n): StorageAdapter {\n return {\n async get(key: string[]) {\n const value = await options.namespace.get(joinKey(key), \"json\")\n if (!value) return\n return value as Record\n },\n\n async set(key: string[], value: any, expiry?: Date) {\n await options.namespace.put(joinKey(key), JSON.stringify(value), {\n expirationTtl: expiry\n ? Math.max(Math.floor((expiry.getTime() - Date.now()) / 1000), 60)\n : undefined,\n })\n },\n\n async remove(key: string[]) {\n await options.namespace.delete(joinKey(key))\n },\n\n async *scan(prefix: string[]) {\n let cursor: string | undefined\n while (true) {\n const result = await options.namespace.list({\n prefix: joinKey([...prefix, \"\"]),\n cursor,\n })\n\n for (const key of result.keys) {\n const value = await options.namespace.get(key.name, \"json\")\n if (value !== null) {\n yield [splitKey(key.name), value]\n }\n }\n if (result.list_complete) {\n break\n }\n cursor = result.cursor\n }\n },\n }\n}\n"
},
{
"path": "packages/openauth/src/storage/dynamo.ts",
"content": "/**\n * Configure OpenAuth to use [DynamoDB](https://aws.amazon.com/dynamodb/) as a storage adapter.\n *\n * ```ts\n * import { DynamoStorage } from \"@openauthjs/openauth/storage/dynamo\"\n *\n * const storage = DynamoStorage({\n * table: \"my-table\",\n * pk: \"pk\",\n * sk: \"sk\"\n * })\n *\n * export default issuer({\n * storage,\n * // ...\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport { client } from \"./aws.js\"\nimport { joinKey, StorageAdapter } from \"./storage.js\"\n\n/**\n * Configure the DynamoDB table that's created.\n *\n * @example\n * ```ts\n * {\n * table: \"my-table\",\n * pk: \"pk\",\n * sk: \"sk\"\n * }\n * ```\n */\nexport interface DynamoStorageOptions {\n /**\n * The name of the DynamoDB table.\n */\n table: string\n /**\n * The primary key column name.\n * @default \"pk\"\n */\n pk?: string\n /**\n * The sort key column name.\n * @default \"sk\"\n */\n sk?: string\n /**\n * Endpoint URL for the DynamoDB service. Useful for local testing.\n * @default \"https://dynamodb.{region}.amazonaws.com\"\n */\n endpoint?: string\n /**\n * The name of the time to live attribute.\n * @default \"expiry\"\n */\n ttl?: string\n}\n\n/**\n * Creates a DynamoDB store.\n * @param options - The config for the adapter.\n */\nexport function DynamoStorage(options: DynamoStorageOptions): StorageAdapter {\n const pk = options.pk || \"pk\"\n const sk = options.sk || \"sk\"\n const ttl = options.ttl || \"expiry\"\n const tableName = options.table\n\n function parseKey(key: string[]) {\n if (key.length === 2) {\n return {\n pk: key[0],\n sk: key[1],\n }\n }\n return {\n pk: joinKey(key.slice(0, 2)),\n sk: joinKey(key.slice(2)),\n }\n }\n\n async function dynamo(action: string, payload: any) {\n const c = await client()\n const endpoint =\n options.endpoint || `https://dynamodb.${c.region}.amazonaws.com`\n const response = await c.fetch(endpoint, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/x-amz-json-1.0\",\n \"X-Amz-Target\": `DynamoDB_20120810.${action}`,\n },\n body: JSON.stringify(payload),\n })\n\n if (!response.ok) {\n throw new Error(`DynamoDB request failed: ${response.statusText}`)\n }\n\n return response.json() as Promise\n }\n\n return {\n async get(key: string[]) {\n const { pk: keyPk, sk: keySk } = parseKey(key)\n const params = {\n TableName: tableName,\n Key: {\n [pk]: { S: keyPk },\n [sk]: { S: keySk },\n },\n }\n const result = await dynamo(\"GetItem\", params)\n if (!result.Item) return\n if (result.Item[ttl] && result.Item[ttl].N < Date.now() / 1000) {\n return\n }\n return JSON.parse(result.Item.value.S)\n },\n\n async set(key: string[], value: any, expiry?: Date) {\n const parsed = parseKey(key)\n const params = {\n TableName: tableName,\n Item: {\n [pk]: { S: parsed.pk },\n [sk]: { S: parsed.sk },\n ...(expiry\n ? {\n [ttl]: { N: Math.floor(expiry.getTime() / 1000).toString() },\n }\n : {}),\n value: { S: JSON.stringify(value) },\n },\n }\n await dynamo(\"PutItem\", params)\n },\n\n async remove(key: string[]) {\n const { pk: keyPk, sk: keySk } = parseKey(key)\n const params = {\n TableName: tableName,\n Key: {\n [pk]: { S: keyPk },\n [sk]: { S: keySk },\n },\n }\n\n await dynamo(\"DeleteItem\", params)\n },\n\n async *scan(prefix: string[]) {\n const prefixPk =\n prefix.length >= 2 ? joinKey(prefix.slice(0, 2)) : prefix[0]\n const prefixSk = prefix.length > 2 ? joinKey(prefix.slice(2)) : \"\"\n let lastEvaluatedKey = undefined\n const now = Date.now() / 1000\n while (true) {\n const params = {\n TableName: tableName,\n ExclusiveStartKey: lastEvaluatedKey,\n KeyConditionExpression: prefixSk\n ? `#pk = :pk AND begins_with(#sk, :sk)`\n : `#pk = :pk`,\n ExpressionAttributeNames: {\n \"#pk\": pk,\n ...(prefixSk && { \"#sk\": sk }),\n },\n ExpressionAttributeValues: {\n \":pk\": { S: prefixPk },\n ...(prefixSk && { \":sk\": { S: prefixSk } }),\n },\n }\n\n const result = await dynamo(\"Query\", params)\n\n for (const item of result.Items || []) {\n if (item[ttl] && item[ttl].N < now) {\n continue\n }\n yield [[item[pk].S, item[sk].S], JSON.parse(item.value.S)]\n }\n\n if (!result.LastEvaluatedKey) break\n lastEvaluatedKey = result.LastEvaluatedKey\n }\n },\n }\n}\n"
},
{
"path": "packages/openauth/src/storage/memory.ts",
"content": "/**\n * Configure OpenAuth to use a simple in-memory store.\n *\n * :::caution\n * This is not meant to be used in production.\n * :::\n *\n * This is useful for testing and development. It's not meant to be used in production.\n *\n * ```ts\n * import { MemoryStorage } from \"@openauthjs/openauth/storage/memory\"\n *\n * const storage = MemoryStorage()\n *\n * export default issuer({\n * storage,\n * // ...\n * })\n * ```\n *\n * Optionally, you can persist the store to a file.\n *\n * ```ts\n * MemoryStorage({\n * persist: \"./persist.json\"\n * })\n * ```\n *\n * @packageDocumentation\n */\nimport { joinKey, splitKey, StorageAdapter } from \"./storage.js\"\nimport { existsSync, readFileSync } from \"node:fs\"\nimport { writeFile } from \"node:fs/promises\"\n\n/**\n * Configure the memory store.\n */\nexport interface MemoryStorageOptions {\n /**\n * Optionally, backup the store to a file. So it'll be persisted when the issuer restarts.\n *\n * @example\n * ```ts\n * {\n * persist: \"./persist.json\"\n * }\n * ```\n */\n persist?: string\n}\nexport function MemoryStorage(input?: MemoryStorageOptions): StorageAdapter {\n const store = [] as [\n string,\n { value: Record; expiry?: number },\n ][]\n\n if (input?.persist) {\n if (existsSync(input.persist)) {\n const file = readFileSync(input?.persist)\n store.push(...JSON.parse(file.toString()))\n }\n }\n\n async function save() {\n if (!input?.persist) return\n const file = JSON.stringify(store)\n await writeFile(input.persist, file)\n }\n\n function search(key: string) {\n let left = 0\n let right = store.length - 1\n while (left <= right) {\n const mid = Math.floor((left + right) / 2)\n const comparison = key.localeCompare(store[mid][0])\n\n if (comparison === 0) {\n return { found: true, index: mid }\n } else if (comparison < 0) {\n right = mid - 1\n } else {\n left = mid + 1\n }\n }\n return { found: false, index: left }\n }\n return {\n async get(key: string[]) {\n const match = search(joinKey(key))\n if (!match.found) return undefined\n const entry = store[match.index][1]\n if (entry.expiry && Date.now() >= entry.expiry) {\n store.splice(match.index, 1)\n await save()\n return undefined\n }\n return entry.value\n },\n async set(key: string[], value: any, expiry?: Date) {\n const joined = joinKey(key)\n const match = search(joined)\n // Handle both Date objects and TTL numbers while maintaining Date type in signature\n const entry = [\n joined,\n {\n value,\n expiry: expiry ? expiry.getTime() : expiry,\n },\n ] as (typeof store)[number]\n if (!match.found) {\n store.splice(match.index, 0, entry)\n } else {\n store[match.index] = entry\n }\n await save()\n },\n async remove(key: string[]) {\n const joined = joinKey(key)\n const match = search(joined)\n if (match.found) {\n store.splice(match.index, 1)\n await save()\n }\n },\n async *scan(prefix: string[]) {\n const now = Date.now()\n const prefixStr = joinKey(prefix)\n for (const [key, entry] of store) {\n if (!key.startsWith(prefixStr)) continue\n if (entry.expiry && now >= entry.expiry) continue\n yield [splitKey(key), entry.value]\n }\n },\n }\n}\n"
},
{
"path": "packages/openauth/src/storage/storage.ts",
"content": "export interface StorageAdapter {\n get(key: string[]): Promise | undefined>\n remove(key: string[]): Promise\n set(key: string[], value: any, expiry?: Date): Promise\n scan(prefix: string[]): AsyncIterable<[string[], any]>\n}\n\nconst SEPERATOR = String.fromCharCode(0x1f)\n\nexport function joinKey(key: string[]) {\n return key.join(SEPERATOR)\n}\n\nexport function splitKey(key: string) {\n return key.split(SEPERATOR)\n}\n\nexport namespace Storage {\n function encode(key: string[]) {\n return key.map((k) => k.replaceAll(SEPERATOR, \"\"))\n }\n export function get(adapter: StorageAdapter, key: string[]) {\n return adapter.get(encode(key)) as Promise\n }\n\n export function set(\n adapter: StorageAdapter,\n key: string[],\n value: any,\n ttl?: number,\n ) {\n const expiry = ttl ? new Date(Date.now() + ttl * 1000) : undefined\n return adapter.set(encode(key), value, expiry)\n }\n\n export function remove(adapter: StorageAdapter, key: string[]) {\n return adapter.remove(encode(key))\n }\n\n export function scan(\n adapter: StorageAdapter,\n key: string[],\n ): AsyncIterable<[string[], T]> {\n return adapter.scan(encode(key))\n }\n}\n"
},
{
"path": "packages/openauth/src/subject.ts",
"content": "/**\n * Subjects are what the access token generated at the end of the auth flow will map to. Under\n * the hood, the access token is a JWT that contains this data.\n *\n * #### Define subjects\n *\n * ```ts title=\"subjects.ts\"\n * import { object, string } from \"valibot\"\n *\n * const subjects = createSubjects({\n * user: object({\n * userID: string()\n * })\n * })\n * ```\n *\n * We are using [valibot](https://github.com/fabian-hiller/valibot) here. You can use any\n * validation library that's following the\n * [standard-schema specification](https://github.com/standard-schema/standard-schema).\n *\n * :::tip\n * You typically want to place subjects in its own file so it can be imported by all of your apps.\n * :::\n *\n * You can start with one subject. Later you can add more for different types of users.\n *\n * #### Set the subjects\n *\n * Then you can pass it to the `issuer`.\n *\n * ```ts title=\"issuer.ts\"\n * import { subjects } from \"./subjects\"\n *\n * const app = issuer({\n * providers: { ... },\n * subjects,\n * // ...\n * })\n * ```\n *\n * #### Add the subject payload\n *\n * When your user completes the flow, you can add the subject payload in the `success` callback.\n *\n * ```ts title=\"issuer.ts\"\n * const app = issuer({\n * providers: { ... },\n * subjects,\n * async success(ctx, value) {\n * let userID\n * if (value.provider === \"password\") {\n * console.log(value.email)\n * userID = ... // lookup user or create them\n * }\n * return ctx.subject(\"user\", {\n * userID\n * })\n * },\n * // ...\n * })\n * ```\n *\n * Here we are looking up the userID from our database and adding it to the subject payload.\n *\n * :::caution\n * You should only store properties that won't change for the lifetime of the user.\n * :::\n *\n * Since these will be stored in the access token, you should avoid storing information\n * that'll change often. For example, if you store the user's username, you'll need to\n * revoke the access token when the user changes their username.\n *\n * #### Decode the subject\n *\n * Now when your user logs in, you can use the OpenAuth client to decode the subject. For\n * example, in our SSR app we can do the following.\n *\n * ```ts title=\"app/page.tsx\"\n * import { subjects } from \"../subjects\"\n *\n * const verified = await client.verify(subjects, cookies.get(\"access_token\")!)\n * console.log(verified.subject.properties.userID)\n * ```\n *\n * All this is typesafe based on the shape of the subjects you defined.\n *\n * @packageDocumentation\n */\nimport type { v1 } from \"@standard-schema/spec\"\nimport { Prettify } from \"./util.js\"\n\n/**\n * Subject schema is a map of types that are used to define the subjects.\n */\nexport type SubjectSchema = Record\n\n/** @internal */\nexport type SubjectPayload = Prettify<\n {\n [type in keyof T & string]: {\n type: type\n properties: v1.InferOutput\n }\n }[keyof T & string]\n>\n\n/**\n * Create a subject schema.\n *\n * @example\n * ```ts\n * const subjects = createSubjects({\n * user: object({\n * userID: string()\n * }),\n * admin: object({\n * workspaceID: string()\n * })\n * })\n * ```\n *\n * This is using [valibot](https://github.com/fabian-hiller/valibot) to define the shape of the\n * subjects. You can use any validation library that's following the\n * [standard-schema specification](https://github.com/standard-schema/standard-schema).\n */\nexport function createSubjects(\n types: Schema,\n): Schema {\n return { ...types }\n}\n"
},
{
"path": "packages/openauth/src/ui/base.tsx",
"content": "import { PropsWithChildren } from \"hono/jsx\"\nimport css from \"./ui.css\" assert { type: \"text\" }\nimport { getTheme } from \"./theme.js\"\n\nexport function Layout(\n props: PropsWithChildren<{\n size?: \"small\"\n }>,\n) {\n const theme = getTheme()\n function get(key: \"primary\" | \"background\" | \"logo\", mode: \"light\" | \"dark\") {\n if (!theme) return\n if (!theme[key]) return\n if (typeof theme[key] === \"string\") return theme[key]\n\n return theme[key][mode] as string | undefined\n }\n\n const radius = (() => {\n if (theme?.radius === \"none\") return \"0\"\n if (theme?.radius === \"sm\") return \"1\"\n if (theme?.radius === \"md\") return \"1.25\"\n if (theme?.radius === \"lg\") return \"1.5\"\n if (theme?.radius === \"full\") return \"1000000000001\"\n return \"1\"\n })()\n\n const hasLogo = get(\"logo\", \"light\") && get(\"logo\", \"dark\")\n\n return (\n \n \n {theme?.title || \"OpenAuthJS\"} \n \n \n {theme?.favicon ? (\n \n ) : (\n <>\n