@absolutejs/auth 0.11.3 → 0.13.0

package/dist/index.js

@@ -128,6 +128,113 @@ var createRandomBase64UrlGenerator = (length) => () => {
 var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var anilistProfileQuery = `query {
+  Viewer {
+    id
+    name
+    about
+    avatar {
+      large
+      medium
+    }
+    bannerImage
+    siteUrl
+    createdAt
+    updatedAt
+    donatorTier
+    donatorBadge
+    unreadNotificationCount
+    options {
+      titleLanguage
+      displayAdultContent
+      airingNotifications
+      profileColor
+      activityMergeTime
+      staffNameLanguage
+    }
+    mediaListOptions {
+      scoreFormat
+      rowOrder
+      animeList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+      mangaList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+    }
+    statistics {
+      anime {
+        count
+        meanScore
+        minutesWatched
+        episodesWatched
+      }
+      manga {
+        count
+        meanScore
+        chaptersRead
+        volumesRead
+      }
+    }
+    favourites {
+      anime {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      manga {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      characters {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      staff {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      studios {
+        nodes {
+          id
+          name
+          siteUrl
+        }
+      }
+    }
+    isFollower
+    isFollowing
+  }
+}`;
 var isValidProviderOption = (option) => Object.hasOwn(providers, option);
 var isRefreshableProviderOption = (option) => {
   if (!isValidProviderOption(option))
@@ -167,10 +274,29 @@ var hasClientSecret = (credentials) => {
   const secret = Reflect.get(credentials, "clientSecret");
   return typeof secret === "string";
 };
+var isObject = (x) => x !== null && typeof x === "object" && !Array.isArray(x) && Object.prototype.toString.call(x) === "[object Object]";
+var extractPropFromIdentity = (identity, keys) => {
+  let value = identity;
+  for (const key of keys) {
+    if (!isObject(value)) {
+      throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);
+    }
+    value = value[key];
+  }
+  return value;
+};
+var extractSubFromOIDCIdentity = (identity) => {
+  const sub = extractPropFromIdentity(identity, ["sub"]);
+  if (typeof sub !== "string") {
+    throw new Error("Invalid identity data shape");
+  }
+  return sub;
+};
 var defineProviders = (providers2) => providers2;
 var providers = defineProviders({
   "42": {
     authorizationUrl: "https://api.intra.42.fr/oauth/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -188,6 +314,7 @@ var providers = defineProviders({
   },
   amazoncognito: {
     authorizationUrl: "https://${domain}/oauth2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -212,12 +339,23 @@ var providers = defineProviders({
   },
   anilist: {
     authorizationUrl: "https://anilist.co/api/v2/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "Viewer",
+        "id"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
       authIn: "header",
       body: {
-        query: `query { Viewer { id name } }`
+        query: anilistProfileQuery
       },
       encoding: "application/json",
       headers: {
@@ -236,6 +374,7 @@ var providers = defineProviders({
   },
   apple: {
     authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -257,6 +396,13 @@ var providers = defineProviders({
     createAuthorizationURLSearchParams: {
       audience: "api.atlassian.com"
     },
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["account_id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -274,6 +420,7 @@ var providers = defineProviders({
   },
   auth0: {
     authorizationUrl: (config) => `https://${config.domain}/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -301,6 +448,7 @@ var providers = defineProviders({
   },
   authentik: {
     authorizationUrl: (config) => `https://${config.baseURL}/oauth/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -319,6 +467,7 @@ var providers = defineProviders({
   },
   autodesk: {
     authorizationUrl: "https://developer.api.autodesk.com/authentication/v2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -337,6 +486,7 @@ var providers = defineProviders({
   },
   battlenet: {
     authorizationUrl: "https://oauth.battle.net/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: false,
     profileRequest: {
@@ -354,6 +504,13 @@ var providers = defineProviders({
   },
   bitbucket: {
     authorizationUrl: "https://bitbucket.org/site/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["uuid"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -371,6 +528,13 @@ var providers = defineProviders({
   },
   box: {
     authorizationUrl: "https://account.box.com/api/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -394,6 +558,16 @@ var providers = defineProviders({
   },
   bungie: {
     authorizationUrl: "https://www.bungie.net/en/OAuth/Authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "Response",
+        "membershipId"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -414,6 +588,13 @@ var providers = defineProviders({
   },
   coinbase: {
     authorizationUrl: "https://www.coinbase.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -431,7 +612,8 @@ var providers = defineProviders({
   },
   discord: {
     authorizationUrl: "https://discord.com/api/oauth2/authorize",
-    isOIDC: false,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
+    isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
     profileRequest: {
@@ -449,6 +631,13 @@ var providers = defineProviders({
   },
   donationalerts: {
     authorizationUrl: "https://www.donationalerts.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -466,6 +655,13 @@ var providers = defineProviders({
   },
   dribbble: {
     authorizationUrl: "https://dribbble.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -483,6 +679,13 @@ var providers = defineProviders({
   },
   dropbox: {
     authorizationUrl: "https://www.dropbox.com/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["account_id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -505,6 +708,13 @@ var providers = defineProviders({
   },
   epicgames: {
     authorizationUrl: "https://www.epicgames.com/id/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["account_id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -522,6 +732,17 @@ var providers = defineProviders({
   },
   etsy: {
     authorizationUrl: "https://www.etsy.com/oauth/connect",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "results",
+        "0",
+        "user_id"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -539,6 +760,7 @@ var providers = defineProviders({
   },
   facebook: {
     authorizationUrl: "https://www.facebook.com/v16.0/dialog/oauth",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: false,
     PKCEMethod: "S256",
@@ -558,6 +780,15 @@ var providers = defineProviders({
   },
   figma: {
     authorizationUrl: "https://www.figma.com/oauth",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "user_id_string"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -576,6 +807,7 @@ var providers = defineProviders({
   },
   gitea: {
     authorizationUrl: (config) => `${config.baseURL}/login/oauth/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -594,6 +826,13 @@ var providers = defineProviders({
   },
   github: {
     authorizationUrl: "https://github.com/login/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -611,6 +850,7 @@ var providers = defineProviders({
   },
   gitlab: {
     authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -635,6 +875,7 @@ var providers = defineProviders({
   },
   google: {
     authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -660,6 +901,7 @@ var providers = defineProviders({
   },
   intuit: {
     authorizationUrl: "https://appcenter.intuit.com/connect/oauth2",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     profileRequest: {
@@ -686,6 +928,7 @@ var providers = defineProviders({
   },
   kakao: {
     authorizationUrl: "https://kauth.kakao.com/oauth/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -704,6 +947,7 @@ var providers = defineProviders({
   },
   keycloak: {
     authorizationUrl: (config) => `${config.realmURL}/protocol/openid-connect/auth`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -728,6 +972,16 @@ var providers = defineProviders({
   },
   kick: {
     authorizationUrl: "https://id.kick.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "user_id"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -735,7 +989,7 @@ var providers = defineProviders({
       authIn: "header",
       encoding: "application/json",
       method: "GET",
-      url: "https://id.kick.com/v1/user"
+      url: "https://api.kick.com/public/v1/users"
     },
     revocationRequest: {
       authIn: "body",
@@ -743,7 +997,7 @@ var providers = defineProviders({
       tokenParamName: "token",
       url: "https://id.kick.com/oauth/revoke"
     },
-    scopeRequired: false,
+    scopeRequired: true,
     tokenRequest: {
       authIn: "body",
       encoding: "application/x-www-form-urlencoded",
@@ -752,6 +1006,13 @@ var providers = defineProviders({
   },
   lichess: {
     authorizationUrl: "https://lichess.org/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     PKCEMethod: "S256",
@@ -770,6 +1031,7 @@ var providers = defineProviders({
   },
   line: {
     authorizationUrl: "https://access.line.me/oauth2/v2.1/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -788,6 +1050,17 @@ var providers = defineProviders({
   },
   linear: {
     authorizationUrl: "https://linear.app/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "viewer",
+        "id"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -817,6 +1090,7 @@ var providers = defineProviders({
   },
   linkedin: {
     authorizationUrl: "https://www.linkedin.com/oauth/v2/authorization",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -835,6 +1109,13 @@ var providers = defineProviders({
   },
   mastodon: {
     authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     PKCEMethod: "S256",
@@ -859,6 +1140,13 @@ var providers = defineProviders({
   },
   mercadolibre: {
     authorizationUrl: "https://auth.mercadolibre.com/authorization",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -877,6 +1165,13 @@ var providers = defineProviders({
   },
   mercadopago: {
     authorizationUrl: "https://auth.mercadopago.com/authorization",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -894,6 +1189,7 @@ var providers = defineProviders({
   },
   microsoftentraid: {
     authorizationUrl: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/oauth2/v2.0/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -912,6 +1208,13 @@ var providers = defineProviders({
   },
   myanimelist: {
     authorizationUrl: "https://myanimelist.net/v1/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "plain",
@@ -930,6 +1233,16 @@ var providers = defineProviders({
   },
   naver: {
     authorizationUrl: "https://nid.naver.com/oauth2.0/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "response",
+        "id"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -947,6 +1260,13 @@ var providers = defineProviders({
   },
   notion: {
     authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -967,6 +1287,7 @@ var providers = defineProviders({
   },
   okta: {
     authorizationUrl: (config) => `https://${config.domain}/oauth2/default/v1/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -991,6 +1312,13 @@ var providers = defineProviders({
   },
   osu: {
     authorizationUrl: "https://osu.ppy.sh/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1008,6 +1336,13 @@ var providers = defineProviders({
   },
   patreon: {
     authorizationUrl: "https://www.patreon.com/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1025,6 +1360,7 @@ var providers = defineProviders({
   },
   polar: {
     authorizationUrl: "https://polar.sh/oauth2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1049,6 +1385,13 @@ var providers = defineProviders({
   },
   polaraccesslink: {
     authorizationUrl: "https://flow.polar.com/oauth2/authorization",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["x_user_id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     PKCEMethod: "S256",
@@ -1067,6 +1410,13 @@ var providers = defineProviders({
   },
   polarteampro: {
     authorizationUrl: "https://auth.polar.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["x_user_id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1085,6 +1435,13 @@ var providers = defineProviders({
   },
   reddit: {
     authorizationUrl: "https://www.reddit.com/api/v1/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1110,6 +1467,7 @@ var providers = defineProviders({
   },
   roblox: {
     authorizationUrl: "https://apis.roblox.com/oauth/v1/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1128,6 +1486,7 @@ var providers = defineProviders({
   },
   salesforce: {
     authorizationUrl: "https://login.salesforce.com/services/oauth2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1151,6 +1510,13 @@ var providers = defineProviders({
   },
   shikimori: {
     authorizationUrl: "https://shikimori.org/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1168,6 +1534,7 @@ var providers = defineProviders({
   },
   slack: {
     authorizationUrl: "https://slack.com/openid/connect/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     profileRequest: {
@@ -1191,6 +1558,13 @@ var providers = defineProviders({
   },
   spotify: {
     authorizationUrl: "https://accounts.spotify.com/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1209,6 +1583,17 @@ var providers = defineProviders({
   },
   startgg: {
     authorizationUrl: "https://start.gg/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "currentUser",
+        "id"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1233,6 +1618,13 @@ var providers = defineProviders({
   },
   strava: {
     authorizationUrl: "https://www.strava.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1260,6 +1652,13 @@ var providers = defineProviders({
   },
   synology: {
     authorizationUrl: (config) => `${config.baseURL}/webman/sso/SSOOauth.cgi?client_id=${config.clientId}&response_type=code&redirect_uri=${config.redirectUri}`,
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -1280,6 +1679,16 @@ var providers = defineProviders({
     createAuthorizationURLSearchParams: (config) => ({
       client_key: config.clientId
     }),
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "open_id"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1304,6 +1713,13 @@ var providers = defineProviders({
   },
   tiltify: {
     authorizationUrl: "https://v5api.tiltify.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1321,6 +1737,17 @@ var providers = defineProviders({
   },
   tumblr: {
     authorizationUrl: "https://www.tumblr.com/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "response",
+        "user",
+        "name"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1338,6 +1765,7 @@ var providers = defineProviders({
   },
   twitch: {
     authorizationUrl: "https://id.twitch.tv/oauth2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     profileRequest: {
@@ -1367,6 +1795,13 @@ var providers = defineProviders({
   },
   twitter: {
     authorizationUrl: "https://twitter.com/i/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1390,6 +1825,17 @@ var providers = defineProviders({
   },
   vk: {
     authorizationUrl: "https://oauth.vk.com/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "response",
+        "0",
+        "id"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -1407,6 +1853,16 @@ var providers = defineProviders({
   },
   withings: {
     authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "body",
+        "userid"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1460,6 +1916,7 @@ var providers = defineProviders({
   },
   workos: {
     authorizationUrl: "https://api.workos.com/sso/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1478,6 +1935,7 @@ var providers = defineProviders({
   },
   yahoo: {
     authorizationUrl: "https://api.login.yahoo.com/oauth2/request_auth",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1505,6 +1963,13 @@ var providers = defineProviders({
       device_id: crypto.randomUUID(),
       device_name: `${navigator.platform ?? "Unknown"} \u2014 ${(navigator.userAgent.split(")")[0] || "").split("(").pop() || "Unknown"}`
     },
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1529,6 +1994,13 @@ var providers = defineProviders({
   },
   zoom: {
     authorizationUrl: "https://zoom.us/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1768,7 +2240,8 @@ var COOKIE_DURATION = SECONDS_IN_A_MINUTE * COOKIE_MINUTES;
 var authorize = ({
   clientProviders,
   authorizeRoute = "/oauth2/:provider/authorization",
-  onAuthorizeSuccess
+  onAuthorizeSuccess,
+  onAuthorizeError
 }) => new Elysia().get(authorizeRoute, async ({
   error,
   redirect,
@@ -1786,7 +2259,6 @@ var authorize = ({
   if (!providerConfig)
     return error("Unauthorized", "Client provider not found");
   const { providerInstance, scope, searchParams } = providerConfig;
-  const normalizedProvider = provider.toLowerCase();
   const referer = headers["referer"] ?? "/";
   origin_url.set({
     httpOnly: true,
@@ -1802,7 +2274,7 @@ var authorize = ({
     path: "/",
     sameSite: "lax",
     secure: true,
-    value: normalizedProvider
+    value: provider
   });
   const currentState = generateState();
   state.set({
@@ -1827,12 +2299,16 @@ var authorize = ({
   try {
     const authorizationURL = await providerInstance.createAuthorizationUrl(codeVerifier ? { codeVerifier, scope, state: currentState } : { scope, state: currentState });
     searchParams?.forEach(([key, value]) => authorizationURL.searchParams.set(key, value));
-    onAuthorizeSuccess?.({
+    await onAuthorizeSuccess?.({
       authorizationUrl: authorizationURL,
-      authProvider: normalizedProvider
+      authProvider: provider
     });
     return redirect(authorizationURL.toString());
   } catch (err) {
+    await onAuthorizeError?.({
+      authProvider: provider,
+      error: err
+    });
     if (err instanceof Error) {
       return error("Internal Server Error", `${err.message} - ${err.stack ?? ""}`);
     }
@@ -1860,7 +2336,8 @@ var isNonEmptyString = (str) => str !== null && str !== undefined && str.trim()
 var callback = ({
   clientProviders,
   callbackRoute = "/oauth2/callback",
-  onCallbackSuccess
+  onCallbackSuccess,
+  onCallbackError
 }) => new Elysia3().use(sessionStore()).get(callbackRoute, async ({
   error,
   redirect,
@@ -1921,6 +2398,11 @@ var callback = ({
     });
     return redirect(originUrl);
   } catch (err) {
+    await onCallbackError?.({
+      authProvider,
+      error: err,
+      originUrl
+    });
     return err instanceof Error ? error("Internal Server Error", `${err.message} - ${err.stack ?? ""}`) : error("Internal Server Error", `Failed to validate authorization code: Unknown error: ${err}`);
   }
 }, {
@@ -1934,7 +2416,8 @@ import { Elysia as Elysia4 } from "elysia";
 var profile = ({
   clientProviders,
   profileRoute = "/oauth2/profile",
-  onProfileSuccess
+  onProfileSuccess,
+  onProfileError
 }) => new Elysia4().use(sessionStore()).get(profileRoute, async ({
   error,
   store: { session },
@@ -1969,6 +2452,10 @@ var profile = ({
     });
     return new Response(JSON.stringify(userProfile));
   } catch (err) {
+    await onProfileError?.({
+      authProvider: auth_provider.value,
+      error: err
+    });
     return err instanceof Error ? error("Internal Server Error", `${err.message} - ${err.stack ?? ""}`) : error("Internal Server Error", `Failed to validate authorization code: Unknown error: ${err}`);
   }
 });
@@ -1995,7 +2482,8 @@ import { Elysia as Elysia6 } from "elysia";
 var refresh = ({
   clientProviders,
   refreshRoute = "/oauth2/tokens",
-  onRefreshSuccess
+  onRefreshSuccess,
+  onRefreshError
 }) => new Elysia6().use(sessionStore()).post(refreshRoute, async ({
   error,
   store: { session },
@@ -2030,7 +2518,7 @@ var refresh = ({
   }
   try {
     const tokenResponse = await providerInstance.refreshAccessToken(refreshToken);
-    onRefreshSuccess?.({
+    await onRefreshSuccess?.({
       authProvider: auth_provider.value,
       tokenResponse
     });
@@ -2038,6 +2526,10 @@ var refresh = ({
       status: 204
     });
   } catch (err) {
+    await onRefreshError?.({
+      authProvider: auth_provider.value,
+      error: err
+    });
     if (err instanceof Error) {
       return error("Internal Server Error", `Failed to refresh token: ${err.message}`);
     }
@@ -2050,7 +2542,8 @@ import { Elysia as Elysia7 } from "elysia";
 var revoke = ({
   clientProviders,
   revokeRoute = "/oauth2/revocation",
-  onRevocationSuccess
+  onRevocationSuccess,
+  onRevocationError
 }) => new Elysia7().use(sessionStore()).post(revokeRoute, async ({
   error,
   store: { session },
@@ -2082,7 +2575,7 @@ var revoke = ({
   const { accessToken } = userSession;
   try {
     await providerInstance.revokeToken(accessToken);
-    onRevocationSuccess?.({
+    await onRevocationSuccess?.({
       authProvider: auth_provider.value,
       tokenToRevoke: accessToken
     });
@@ -2090,6 +2583,10 @@ var revoke = ({
       status: 204
     });
   } catch (err) {
+    await onRevocationError?.({
+      authProvider: auth_provider.value,
+      error: err
+    });
     if (err instanceof Error) {
       return error("Internal Server Error", `Failed to revoke token: ${err.message}`);
     }
@@ -2117,7 +2614,7 @@ var signout = ({
     return error("Unauthorized", "No user session id found");
   }
   try {
-    onSignOut?.({
+    await onSignOut?.({
       authProvider: auth_provider.value,
       session,
       userSessionId: user_session_id.value
@@ -2172,16 +2669,16 @@ var instantiateUserSession = async ({
   getUser,
   createUser
 }) => {
-  let userProfile;
+  let userIdentity;
   if (tokenResponse.id_token) {
-    userProfile = decodeJWT(tokenResponse.id_token);
+    userIdentity = decodeJWT(tokenResponse.id_token);
   } else if (authProvider === "withings") {
-    userProfile = tokenResponse.body;
+    userIdentity = tokenResponse.body;
   } else {
-    userProfile = await providerInstance.fetchUserProfile(tokenResponse.access_token);
+    userIdentity = await providerInstance.fetchUserProfile(tokenResponse.access_token);
   }
-  let user = await getUser(userProfile);
-  user = user ?? await createUser(userProfile);
+  let user = await getUser(userIdentity);
+  user = user ?? await createUser(userIdentity);
   if (!isValidUser(user))
     throw new Error("Internal Server Error - Invalid user schema");
   session[userSessionId] = {
@@ -2258,5 +2755,5 @@ export {
   absoluteAuth
 };
 
-//# debugId=B486F3D0FFE798E364756E2164756E21
+//# debugId=2E7A925803CF255964756E2164756E21
 //# sourceMappingURL=index.js.map