feat: add basePath option

[finxol]

Fixes #125.

Still requires a rewrite from whatever runs at root (e.g. reverse proxy) to be able to serve the /.well-known routes, but I can't think of any way that would be technically possible since OpenAuth wouldn't be managing that root path.

Technical approach

Instead of refactoring all redirect calls, and requiring a special syntax or function call to avoid regression, I added a middleware to dynamically rewrite urls.
The DX simplicity should outweigh the minor performance cost.

This middleware is only added if the basePath option is specified.

The base path isn't passed onto Hono through app.basePath(), this assumes the different base path is managed by something else (router, reverse proxy, etc.)

[changeset-bot]

🦋 Changeset detected

Latest commit: b6999d9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@openauthjs/openauth	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[finxol]

EDIT: Misread spec, well-known paths still needs a rewrite

Since 448d354, no need to have router/reverse proxy redirection of .well-known since the issuer now includes the base path.

Example

With an issuer set up as

const app = issuer({
  basePath: `/auth`,
  ...
})

The resulting JWT payload will be

{
  "properties": {
    "userID": 123
  },
  "aud": "example",
  "iss": "http://localhost:3000/auth",
}

Spec compliance

[INCORRECT]

According to RFC 8414 (OAuth 2.0 Authorization Server Metadata) and OpenID Connect Discovery, the .well-known endpoints are found by appending /.well-known/... to the issuer identifier URL.
In our case, the client will correctly hit http://localhost:3000/auth/.well-known/oauth-authorization-server.
Which will then correctly lead to http://localhost:3000/auth/.well-known/jwks.json

[/INCORRECT]

[finxol]

I misread the spec, Well-Known URIs do need to be at root.
Moved back to actual spec compliance with .well-known.

Issuer still contains base path, but .well-known links don't include it.

[rumbcam]

Does this middleware handle lines 1130-1132 of this same file?

    if (provider) return c.redirect(`/${provider}/authorize`)
    const providers = Object.keys(input.providers)
    if (providers.length === 1) return c.redirect(`/${providers[0]}/authorize`)

Here it's redirecting and this needs to make sure it redirect with the correct basePath