import { getCookie, setCookie } from "npm:hono/cookie"; import { Lucia } from "npm:lucia@3.0.1"; import { ValTownAdapter } from "https://esm.town/v/yawnxyz/luciaValtownSqlite"; import { generateState, OAuth2RequestError, generateCodeVerifier, GitHub, Google } from "npm:arctic"; class LuciaAuthMiddleware { constructor(config = {}) { this.config = { userTable: "lucia_users_1", sessionTable: "lucia_sessions_1", adapter: ValTownAdapter, sessionCookie: { attributes: { sameSite: "none", }, }, getUserAttributes: (attributes) => ({ github_id: attributes.github_id, username: attributes.username, }), services: {}, ...config }; this.adapter = new this.config.adapter({ userTable: this.config.userTable, sessionTable: this.config.sessionTable }); this.lucia = new Lucia(this.adapter, { sessionCookie: this.config.sessionCookie, getUserAttributes: this.config.getUserAttributes, }); this.initializeOAuthServices(); } initializeOAuthServices() { this.oauthServices = {}; for (const [service, config] of Object.entries(this.config.services)) { switch (service) { case 'github': this.oauthServices.github = new GitHub(config.clientId, config.clientSecret); break; case 'google': this.oauthServices.google = new Google(config.clientId, config.clientSecret, config.redirectUri); break; // Add more services here as needed } } } middleware() { return async (c, next) => { const sessionId = getCookie(c, this.lucia.sessionCookieName) ?? null; if (!sessionId) { c.set("user", null); c.set("session", null); return next(); } const { session, user } = await this.lucia.validateSession(sessionId); if (session && session.fresh) { c.header("Set-Cookie", this.lucia.createSessionCookie(session.id).serialize(), { append: true, }); } if (!session) { c.header("Set-Cookie", this.lucia.createBlankSessionCookie().serialize(), { append: true, }); } c.set("user", user); c.set("session", session); return next(); }; } setupRoutes(app) { // Signup route app.get("/auth/signup", (c) => { return c.html(` `); }); app.post("/auth/signup", async (c) => { const { username, password } = await c.req.parseBody(); if (typeof username !== "string" || typeof password !== "string") { return c.text("Invalid input", 400); } try { const userId = await this.adapter.createUser({ username, password }); const session = await this.lucia.createSession(userId, {}); c.header("Set-Cookie", this.lucia.createSessionCookie(session.id).serialize(), { append: true }); return c.redirect("/"); } catch (err) { return c.text("User creation failed: " + err.message, 400); } }); // Login route app.get("/auth/login", (c) => { let html = ` `; for (const service of Object.keys(this.oauthServices)) { html += `Sign in with ${service.charAt(0).toUpperCase() + service.slice(1)}`; } return c.html(html); }); app.post("/auth/login", async (c) => { const { username, password } = await c.req.parseBody(); if (typeof username !== "string" || typeof password !== "string") { return c.text("Invalid input", 400); } const user = await this.adapter.getUser({ username }); if (!user) { return c.text("Invalid credentials", 400); } const validPassword = await this.adapter.verifyPassword(user.hashed_password, password); if (!validPassword) { return c.text("Invalid credentials", 400); } const session = await this.lucia.createSession(user.id, {}); c.header("Set-Cookie", this.lucia.createSessionCookie(session.id).serialize(), { append: true }); return c.redirect("/"); }); // OAuth routes for (const [service, oauthClient] of Object.entries(this.oauthServices)) { app.get(`/auth/${service}`, async (c) => { const state = generateState(); const codeVerifier = generateCodeVerifier(); // Log the redirect URI console.log(`Redirect URI for ${service}:`, `[${this.config.services[service].redirectUri}]`); const url = await oauthClient.createAuthorizationURL(state, codeVerifier, { scopes: ["profile", "email"] }); // Log the full authorization URL console.log(`Full authorization URL for ${service}:`, url.toString()); setCookie(c, `${service}_oauth_state`, state, { httpOnly: true, maxAge: 60 * 10, path: "/", }); setCookie(c, `${service}_oauth_code_verifier`, codeVerifier, { httpOnly: true, maxAge: 60 * 10, path: "/", }); return c.redirect(url.toString()); }); // Handle both with and without trailing slash const callbackHandler = async (c) => { console.log(`Incoming callback request for ${service}:`, c.req.url); const state = c.req.query("state"); const code = c.req.query("code"); const storedState = getCookie(c, `${service}_oauth_state`); const codeVerifier = getCookie(c, `${service}_oauth_code_verifier`); if (!state || !storedState || !code || !codeVerifier || storedState !== state) { return c.text("Invalid state or missing code verifier", 400); } try { const tokens = await oauthClient.validateAuthorizationCode(code, codeVerifier); const userInfoResponse = await fetch(this.config.services[service].userInfoUrl, { headers: { Authorization: `Bearer ${tokens.accessToken}` } }); const oauthUser = await userInfoResponse.json(); let user = await this.adapter.getUser({ username: oauthUser.email || oauthUser.login }); if (!user) { const userId = await this.adapter.createUser({ username: oauthUser.email || oauthUser.login, password: Math.random().toString(36).slice(-8), [`${service}_id`]: oauthUser.id || oauthUser.sub }); user = await this.adapter.getUser({ id: userId }); } const session = await this.lucia.createSession(user.id, {}); c.header("Set-Cookie", this.lucia.createSessionCookie(session.id).serialize(), { append: true }); return c.redirect("/"); } catch (e) { if (e instanceof OAuth2RequestError) { return c.text(`${service} OAuth2 request error: ` + e.message, 400); } return c.text("Authentication failed: " + e.message, 500); } }; // Register the callback route both with and without trailing slash app.get(`/auth/${service}/callback*`, callbackHandler); app.get(`/auth/${service}/callback/`, callbackHandler); } // Logout route app.get("/auth/logout", async (c) => { const sessionId = getCookie(c, this.lucia.sessionCookieName); if (sessionId) { await this.lucia.invalidateSession(sessionId); c.header("Set-Cookie", this.lucia.createBlankSessionCookie().serialize(), { append: true }); } return c.redirect("/"); }); // Add username to response headers if user is authenticated app.use("*", async (c, next) => { await next(); const user = c.get("user"); if (user) { c.res.headers.set("X-Lucia-Username", user.username); } }); } } export default LuciaAuthMiddleware;

hnCloneOAuth