/** @jsxImportSource npm:hono/jsx **/ import { thisWebURL } from "https://esm.town/v/stevekrouse/thisWebURL?v=2"; import { ValTownAdapter } from "https://esm.town/v/yawnxyz/lucia_adapter_valtown"; import { createUser, getUser, verifyPassword } from "https://esm.town/v/yawnxyz/lucia_sqlite"; import { Hono } from "npm:hono"; import { getCookie, setCookie } from "npm:hono/cookie"; import { HTTPException } from "npm:hono/http-exception"; import { jsxRenderer } from "npm:hono/jsx-renderer"; import { Lucia, Session, User, verifyRequestOrigin } from "npm:lucia@3.0.1"; import { createDate, isWithinExpirationDate, TimeSpan } from "npm:oslo"; // TODO - make these configurable const userTable = "lucia_users_1"; const sessionTable = "lucia_sessions_1"; const adapter = new ValTownAdapter({ userTable, sessionTable }); // adding Github + Google Oauth support import { generateId } from "npm:lucia@3.0.1"; // somehow generateIdFromEntropySize doesn't exist in npm:lucia import { generateState, OAuth2RequestError, generateCodeVerifier, GitHub, Google } from "npm:arctic"; import { serializeCookie, parseCookies } from "npm:oslo/cookie"; const githubClientId = Deno.env.get("GITHUB_OAUTH_COVERSHEET_CLIENT"); const githubClientSecret = Deno.env.get("GITHUB_OAUTH_COVERSHEET_SECRET"); export const github = new GitHub(githubClientId, githubClientSecret); const googleClientId = Deno.env.get("GOOGLE_OAUTH_COVERSHEET_CLIENT"); const googleClientSecret = Deno.env.get("GOOGLE_OAUTH_COVERSHEET_SECRET"); const google = new Google(googleClientId, googleClientSecret, `https://yawnxyz-hncloneluciaoauth.web.val.run/auth/google/callback`); // TODO: need to be able to set these dynamically from the requester app export const lucia = new Lucia(adapter, { sessionCookie: { attributes: { sameSite: "none", }, }, getUserAttributes: (attributes) => { return { github_id: attributes.github_id, username: attributes.username, }; }, }); declare module "npm:lucia" { interface Register { Lucia: typeof lucia; DatabaseUserAttributes: DatabaseUserAttributes; } } interface DatabaseUserAttributes { github_id: number; username: string; } interface GitHubUserResult { id: number; login: string; // username } export const luciaMiddleware = (handler: (req: Request) => Response | Promise) => { const app = new Hono<{ Variables: { user: User | null; session: Session | null; }; }>(); app.use("*", async (c, next) => { const sessionId = getCookie(c, lucia.sessionCookieName) ?? null; if (!sessionId) { c.set("user", null); c.set("session", null); return next(); } const { session, user } = await lucia.validateSession(sessionId); if (session && session.fresh) { c.header("Set-Cookie", lucia.createSessionCookie(session.id).serialize(), { append: true, }); } if (!session) { c.header("Set-Cookie", lucia.createBlankSessionCookie().serialize(), { append: true, }); } c.set("user", user); c.set("session", session); return next(); }); app.get("/auth/signup", c => c.render(

Sign up

< form method="post" action="/auth/signup" style="display: flex; flex-direction: column; gap: 0.5rem; align-items: center;" >

< div >

< input type="submit" value="Sign up" /> , )); app.post("/auth/signup", async c => { const body = await c.req.parseBody(); if (typeof body.username !== "string" || typeof body.password !== "string") { return new Response("Invalid login", { status: 400, }); } const username = body.username; const password = body.password; if ( username.length < 3 || username.length > 31 || !/^[a-z0-9_-]+$/.test(username) ) { return new Response("Invalid username: needs to be > 3 and < 31 characters and match regex: ^[a-z0-9_-]+$", { status: 400, }); } if (password.length < 6 || password.length > 255) { return new Response("Invalid password: needs to be > 6 and < 255 characters", { status: 400, }); } try { const userID = await createUser({ userTable, sessionTable, username, password, }); const session = await lucia.createSession(userID, {}); c.header("Set-Cookie", lucia.createSessionCookie(session.id).serialize(), { append: true, }); console.log("Created user", userID); } catch (err) { c.status(400); return c.body("User already exists // " + err.message); } return c.redirect("/"); }); app.get("/auth/login", c => c.render(

Sign in

< form method="post" action="/auth/login" style="display: flex; flex-direction: column; gap: 0.5rem; align-items: center;" >

< div >

< input type="submit" value="Sign in" />

, )); app.post("/auth/login", async c => { const body = await c.req.parseBody(); if (typeof body.username !== "string" || typeof body.password !== "string") { return new Response("Bad login", { status: 400, }); } const user = await getUser({ userTable, sessionTable, username: body.username }); if (!user) { return new Response("Bad login", { status: 400, }); } const validPassword = await verifyPassword(user.hashed_password, body.password); if (!validPassword) { return new Response("Bad login", { status: 400, }); } const session = await lucia.createSession(user.id, {}); const sessionCookie = lucia.createSessionCookie(session.id); c.header("Set-Cookie", sessionCookie.serialize(), { append: true, }); return c.redirect("/"); }); app.get("/auth/github", async (c): Promise => { try { console.log('trying github') const state = generateState(); const url = await github.createAuthorizationURL(state); c.header("Set-Cookie", serializeCookie("github_oauth_state", state, { httpOnly: true, maxAge: 60 * 10, // 10 minutes path: "/" })); return c.redirect(url.toString()); } catch (e) { console.error(e); return new Response(e.message, { status: 500 }); } }); app.get("/auth/github/callback", async (c) => { const stateCookie = getCookie(c, "github_oauth_state") ?? null; const state = c.req.query("state"); const code = c.req.query("code"); // verify state if (!state || !stateCookie || !code || stateCookie !== state) { return c.text("No github state?", 400); } try { const tokens = await github.validateAuthorizationCode(code); const githubUserResponse = await fetch("https://api.github.com/user", { headers: { Authorization: `Bearer ${tokens.accessToken}` } }); const githubUserResult: GitHubUserResult = await githubUserResponse.json(); const existingUser = await getUser({ userTable, sessionTable, username: githubUserResult.login }); if (existingUser) { const session = await lucia.createSession(existingUser.id, {}); const sessionCookie = lucia.createSessionCookie(session.id); c.header("Set-Cookie", sessionCookie.serialize(), { append: true, }); return c.redirect("/"); } const userId = await createUser({ userTable, sessionTable, username: githubUserResult.login, password: Math.random().toString(36).slice(-8), github_id: githubUserResult.id }); const session = await lucia.createSession(userId, {}); c.header("Set-Cookie", lucia.createSessionCookie(session.id).serialize(), { append: true, }); return c.redirect("/"); } catch (e) { console.log(e); if (e instanceof OAuth2RequestError) { return c.text(`Github Oauth2 request error? ${e.message}`, 400); } return c.text(e.message, 500); } }); app.get("/what", (c) => { try { const cookieOptions = { httpOnly: true, maxAge: 60 * 10, // 10 minutes path: "/", // Ensure path is set to root }; setCookie(c, 'chocolate', 'no??', cookieOptions); setCookie(c, 'banana', 'yes!!!', cookieOptions); return c.text("what") } catch (e) { console.error(e); return new Response(e.message, { status: 500 }); } }); app.get("/auth/google", async (c) => { try { const state = generateState(); const codeVerifier = generateCodeVerifier(); const url = await google.createAuthorizationURL(state, codeVerifier, { scopes: ["profile", "email"] }); // url.searchParams.set("access_type", "offline"); const cookieOptions = { httpOnly: true, maxAge: 60 * 10, // 10 minutes path: "/", // Ensure path is set to root }; setCookie(c, 'google_oauth_code_verifier', codeVerifier, cookieOptions); setCookie(c, 'google_oauth_state', state, cookieOptions); return c.redirect(url.toString()); } catch (e) { console.error(e); return new Response(e.message, { status: 500 }); } }); app.get("/auth/google/callback", async (c) => { const stateCookie = getCookie(c, "google_oauth_state") ?? null; const codeVerifier = getCookie(c, "google_oauth_code_verifier") ?? null; const state = c.req.query("state"); const code = c.req.query("code"); // https://yawnxyz-hncloneluciaoauth.web.val.run/auth/google/callback?state=e1ntsxqPFLaBZe9tXQ7SwwGHJ5Cr2nAvwNtWtQNtRVk&code=4%2F0AQlEd8yAzO8cETotI28YAdDu7kMaWfwsBY6mBLtA3Mz0dO0-REGYfsHQcNsQzw1bE1mNyA&scope=email+profile+openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&authuser=0&prompt=consent // verify state // if (!state || !stateCookie || !code || stateCookie !== state || !codeVerifier) { if (!state || !stateCookie || !code || !codeVerifier) { // return c.json(null, 400); return c.json({ message: `Google Auth callback no state?`, state, stateCookie, code, codeVerifier }, 400); } try { console.log('code: ', stateCookie, codeVerifier) const tokens = await google.validateAuthorizationCode(code, codeVerifier); console.log('trying to get the user info: ', tokens) const userInfoResponse = await fetch("https://openidconnect.googleapis.com/v1/userinfo", { headers: { Authorization: `Bearer ${tokens.accessToken}` } }); const googleUserResult = await userInfoResponse.json(); const existingUser = await getUser({ userTable, sessionTable, username: googleUserResult.email }); if (existingUser) { const session = await lucia.createSession(existingUser.id, {}); const sessionCookie = lucia.createSessionCookie(session.id); c.header("Set-Cookie", sessionCookie.serialize(), { append: true, }); return c.redirect("/"); } const userId = await createUser({ userTable, sessionTable, username: googleUserResult.email, password: Math.random().toString(36).slice(-8), google_id: googleUserResult.sub }); const session = await lucia.createSession(userId, {}); c.header("Set-Cookie", lucia.createSessionCookie(session.id).serialize(), { append: true, }); return c.redirect("/"); } catch (e) { console.log(e); if (e instanceof OAuth2RequestError) { return c.json({ message: "Google OAuth2 error: " + e.message, state, stateCookie, code, codeVerifier }, 400); } return c.text("Google Oauth callback general error:" + e.message, 500); } }); app.all("/auth/logout", async c => { const session = c.get("session"); if (!session) { c.redirect("/"); } await lucia.invalidateSession(session.id); c.header("Set-Cookie", lucia.createBlankSessionCookie().serialize(), { append: true, }); return c.redirect("/"); }); app.all("*", async (c) => { const rawRequest = c.req.raw.clone(); if (c.get("user")) { rawRequest.headers.set("X-Lucia-Username", c.get("user").username); } const response = await handler(rawRequest); // Copy headers from Hono context to the response c.res.headers.forEach((value, key) => { response.headers.append(key, value); }); return response; }); return app.fetch; };

lucia_middleware