remix-auth-oauth2
Version:
A strategy to use and implement OAuth2 framework for authentication with federated services like Google, Facebook, GitHub, etc.
158 lines (157 loc) • 7.29 kB
TypeScript
import { type SetCookieInit } from "@mjackson/headers";
import { CodeChallengeMethod, OAuth2Client, OAuth2RequestError, type OAuth2Tokens, UnexpectedErrorResponseBodyError, UnexpectedResponseError } from "arctic";
import { Strategy } from "remix-auth/strategy";
type URLConstructor = ConstructorParameters<typeof URL>[0];
export { OAuth2RequestError, CodeChallengeMethod, UnexpectedResponseError, UnexpectedErrorResponseBodyError, };
export declare class OAuth2Strategy<User> extends Strategy<User, OAuth2Strategy.VerifyOptions> {
protected options: OAuth2Strategy.ConstructorOptions;
name: string;
protected client: OAuth2Client;
constructor(options: OAuth2Strategy.ConstructorOptions, verify: Strategy.VerifyFunction<User, OAuth2Strategy.VerifyOptions>);
private get cookieName();
private get cookieOptions();
authenticate(request: Request): Promise<User>;
protected createAuthorizationURL(): {
state: string;
codeVerifier: string;
url: URL;
};
protected validateAuthorizationCode(code: string, codeVerifier: string): Promise<OAuth2Tokens>;
/**
* Return extra parameters to be included in the authorization request.
*
* Some OAuth 2.0 providers allow additional, non-standard parameters to be
* included when requesting authorization. Since these parameters are not
* standardized by the OAuth 2.0 specification, OAuth 2.0-based authentication
* strategies can override this function in order to populate these
* parameters as required by the provider.
*/
protected authorizationParams(params: URLSearchParams, request: Request): URLSearchParams;
/**
* Get a new OAuth2 Tokens object using the refresh token once the previous
* access token has expired.
* @param refreshToken The refresh token to use to get a new access token
* @returns The new OAuth2 tokens object
* @example
* ```ts
* let tokens = await strategy.refreshToken(refreshToken);
* console.log(tokens.accessToken());
* ```
*/
refreshToken(refreshToken: string): Promise<OAuth2Tokens>;
/**
* Users the token revocation endpoint of the identity provider to revoke the
* access token and make it invalid.
*
* @param token The access token to revoke
* @example
* ```ts
* // Get it from where you stored it
* let accessToken = await getAccessToken();
* await strategy.revokeToken(tokens.access_token);
* ```
*/
revokeToken(token: string): Promise<void>;
/**
* Discover the OAuth2 issuer and create a new OAuth2Strategy instance from
* the OIDC configuration that is returned.
*
* This method will fetch the OIDC configuration from the issuer and create a
* new OAuth2Strategy instance with the provided options and verify function.
*
* @param uri The URI of the issuer, this can be a full URL or just the domain
* @param options The rest of the options to pass to the OAuth2Strategy constructor, clientId, clientSecret, redirectURI, and scopes are required.
* @param verify The verify function to use with the OAuth2Strategy instance
* @returns A new OAuth2Strategy instance
* @example
* ```ts
* let strategy = await OAuth2Strategy.discover(
* "https://accounts.google.com",
* {
* clientId: "your-client-id",
* clientSecret: "your-client-secret",
* redirectURI: "https://your-app.com/auth/callback",
* scopes: ["openid", "email", "profile"],
* },
* async ({ tokens }) => {
* return getUserProfile(tokens.access_token);
* },
* );
*/
static discover<U, M extends OAuth2Strategy<U> = OAuth2Strategy<U>>(this: new (options: OAuth2Strategy.ConstructorOptions, verify: Strategy.VerifyFunction<U, OAuth2Strategy.VerifyOptions>) => M, uri: string | URL, options: Pick<OAuth2Strategy.ConstructorOptions, "clientId" | "clientSecret" | "cookie" | "redirectURI" | "scopes"> & Partial<Omit<OAuth2Strategy.ConstructorOptions, "clientId" | "clientSecret" | "cookie" | "redirectURI" | "scopes">>, verify: Strategy.VerifyFunction<U, OAuth2Strategy.VerifyOptions>): Promise<M>;
}
export declare namespace OAuth2Strategy {
interface VerifyOptions {
/** The request that triggered the verification flow */
request: Request;
/** The OAuth2 tokens retrivied from the identity provider */
tokens: OAuth2Tokens;
}
interface ConstructorOptions {
/**
* The name of the cookie used to keep state and code verifier around.
*
* The OAuth2 flow requires generating a random state and code verifier, and
* then checking that the state matches when the user is redirected back to
* the application. This is done to prevent CSRF attacks.
*
* The state and code verifier are stored in a cookie, and this option
* allows you to customize the name of that cookie if needed.
* @default "oauth2"
*/
cookie?: string | (Omit<SetCookieInit, "value"> & {
name: string;
});
/**
* This is the Client ID of your application, provided to you by the Identity
* Provider you're using to authenticate users.
*/
clientId: string;
/**
* This is the Client Secret of your application, provided to you by the
* Identity Provider you're using to authenticate users.
*/
clientSecret: string | null;
/**
* The endpoint the Identity Provider asks you to send users to log in, or
* authorize your application.
*/
authorizationEndpoint: URLConstructor;
/**
* The endpoint the Identity Provider uses to let's you exchange an access
* code for an access and refresh token.
*/
tokenEndpoint: URLConstructor;
/**
* The URL of your application where the Identity Provider will redirect the
* user after they've logged in or authorized your application.
*/
redirectURI: URLConstructor | null;
/**
* The endpoint the Identity Provider uses to revoke an access or refresh
* token, this can be useful to log out the user.
*/
tokenRevocationEndpoint?: URLConstructor;
/**
* The scopes you want to request from the Identity Provider, this is a list
* of strings that represent the permissions you want to request from the
* user.
*/
scopes?: string[];
/**
* The code challenge method to use when sending the authorization request.
* This is used when the Identity Provider requires a code challenge to be
* sent with the authorization request.
* @default "CodeChallengeMethod.S256"
*/
codeChallengeMethod?: CodeChallengeMethod;
/**
* The audience of the token to request from the Identity Provider. This is
* used when the Identity Provider requires a specific audience to be set on
* the token.
*
* This can be a string or an array of strings.
*/
audience?: string | string[];
}
}