@absolutejs/auth 0.12.0 → 0.13.1

package/dist/index.js

@@ -128,6 +128,113 @@ var createRandomBase64UrlGenerator = (length) => () => {
 var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var anilistProfileQuery = `query {
+  Viewer {
+    id
+    name
+    about
+    avatar {
+      large
+      medium
+    }
+    bannerImage
+    siteUrl
+    createdAt
+    updatedAt
+    donatorTier
+    donatorBadge
+    unreadNotificationCount
+    options {
+      titleLanguage
+      displayAdultContent
+      airingNotifications
+      profileColor
+      activityMergeTime
+      staffNameLanguage
+    }
+    mediaListOptions {
+      scoreFormat
+      rowOrder
+      animeList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+      mangaList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+    }
+    statistics {
+      anime {
+        count
+        meanScore
+        minutesWatched
+        episodesWatched
+      }
+      manga {
+        count
+        meanScore
+        chaptersRead
+        volumesRead
+      }
+    }
+    favourites {
+      anime {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      manga {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      characters {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      staff {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      studios {
+        nodes {
+          id
+          name
+          siteUrl
+        }
+      }
+    }
+    isFollower
+    isFollowing
+  }
+}`;
 var isValidProviderOption = (option) => Object.hasOwn(providers, option);
 var isRefreshableProviderOption = (option) => {
   if (!isValidProviderOption(option))
@@ -167,10 +274,29 @@ var hasClientSecret = (credentials) => {
   const secret = Reflect.get(credentials, "clientSecret");
   return typeof secret === "string";
 };
+var isObject = (x) => x !== null && typeof x === "object" && !Array.isArray(x) && Object.prototype.toString.call(x) === "[object Object]";
+var extractPropFromIdentity = (identity, keys) => {
+  let value = identity;
+  for (const key of keys) {
+    if (!isObject(value)) {
+      throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);
+    }
+    value = value[key];
+  }
+  return value;
+};
+var extractSubFromOIDCIdentity = (identity) => {
+  const sub = extractPropFromIdentity(identity, ["sub"]);
+  if (typeof sub !== "string") {
+    throw new Error("Invalid identity data shape");
+  }
+  return sub;
+};
 var defineProviders = (providers2) => providers2;
 var providers = defineProviders({
   "42": {
     authorizationUrl: "https://api.intra.42.fr/oauth/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -188,6 +314,7 @@ var providers = defineProviders({
   },
   amazoncognito: {
     authorizationUrl: "https://${domain}/oauth2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -212,12 +339,23 @@ var providers = defineProviders({
   },
   anilist: {
     authorizationUrl: "https://anilist.co/api/v2/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "Viewer",
+        "id"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
       authIn: "header",
       body: {
-        query: `query { Viewer { id name } }`
+        query: anilistProfileQuery
       },
       encoding: "application/json",
       headers: {
@@ -236,6 +374,7 @@ var providers = defineProviders({
   },
   apple: {
     authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -257,6 +396,13 @@ var providers = defineProviders({
     createAuthorizationURLSearchParams: {
       audience: "api.atlassian.com"
     },
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["account_id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -274,6 +420,7 @@ var providers = defineProviders({
   },
   auth0: {
     authorizationUrl: (config) => `https://${config.domain}/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -301,6 +448,7 @@ var providers = defineProviders({
   },
   authentik: {
     authorizationUrl: (config) => `https://${config.baseURL}/oauth/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -319,6 +467,7 @@ var providers = defineProviders({
   },
   autodesk: {
     authorizationUrl: "https://developer.api.autodesk.com/authentication/v2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -337,6 +486,7 @@ var providers = defineProviders({
   },
   battlenet: {
     authorizationUrl: "https://oauth.battle.net/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: false,
     profileRequest: {
@@ -354,6 +504,13 @@ var providers = defineProviders({
   },
   bitbucket: {
     authorizationUrl: "https://bitbucket.org/site/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["uuid"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -371,6 +528,13 @@ var providers = defineProviders({
   },
   box: {
     authorizationUrl: "https://account.box.com/api/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -394,6 +558,16 @@ var providers = defineProviders({
   },
   bungie: {
     authorizationUrl: "https://www.bungie.net/en/OAuth/Authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "Response",
+        "membershipId"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -414,6 +588,13 @@ var providers = defineProviders({
   },
   coinbase: {
     authorizationUrl: "https://www.coinbase.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -431,7 +612,8 @@ var providers = defineProviders({
   },
   discord: {
     authorizationUrl: "https://discord.com/api/oauth2/authorize",
-    isOIDC: false,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
+    isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
     profileRequest: {
@@ -449,6 +631,13 @@ var providers = defineProviders({
   },
   donationalerts: {
     authorizationUrl: "https://www.donationalerts.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -466,6 +655,13 @@ var providers = defineProviders({
   },
   dribbble: {
     authorizationUrl: "https://dribbble.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -483,6 +679,13 @@ var providers = defineProviders({
   },
   dropbox: {
     authorizationUrl: "https://www.dropbox.com/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["account_id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -505,6 +708,13 @@ var providers = defineProviders({
   },
   epicgames: {
     authorizationUrl: "https://www.epicgames.com/id/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["account_id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -522,6 +732,17 @@ var providers = defineProviders({
   },
   etsy: {
     authorizationUrl: "https://www.etsy.com/oauth/connect",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "results",
+        "0",
+        "user_id"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -539,6 +760,7 @@ var providers = defineProviders({
   },
   facebook: {
     authorizationUrl: "https://www.facebook.com/v16.0/dialog/oauth",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: false,
     PKCEMethod: "S256",
@@ -558,6 +780,15 @@ var providers = defineProviders({
   },
   figma: {
     authorizationUrl: "https://www.figma.com/oauth",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "user_id_string"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -576,6 +807,7 @@ var providers = defineProviders({
   },
   gitea: {
     authorizationUrl: (config) => `${config.baseURL}/login/oauth/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -594,6 +826,13 @@ var providers = defineProviders({
   },
   github: {
     authorizationUrl: "https://github.com/login/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -611,6 +850,7 @@ var providers = defineProviders({
   },
   gitlab: {
     authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -635,6 +875,7 @@ var providers = defineProviders({
   },
   google: {
     authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -660,6 +901,7 @@ var providers = defineProviders({
   },
   intuit: {
     authorizationUrl: "https://appcenter.intuit.com/connect/oauth2",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     profileRequest: {
@@ -686,6 +928,7 @@ var providers = defineProviders({
   },
   kakao: {
     authorizationUrl: "https://kauth.kakao.com/oauth/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -704,6 +947,7 @@ var providers = defineProviders({
   },
   keycloak: {
     authorizationUrl: (config) => `${config.realmURL}/protocol/openid-connect/auth`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -728,6 +972,16 @@ var providers = defineProviders({
   },
   kick: {
     authorizationUrl: "https://id.kick.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "user_id"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -735,7 +989,7 @@ var providers = defineProviders({
       authIn: "header",
       encoding: "application/json",
       method: "GET",
-      url: "https://id.kick.com/v1/user"
+      url: "https://api.kick.com/public/v1/users"
     },
     revocationRequest: {
       authIn: "body",
@@ -743,7 +997,7 @@ var providers = defineProviders({
       tokenParamName: "token",
       url: "https://id.kick.com/oauth/revoke"
     },
-    scopeRequired: false,
+    scopeRequired: true,
     tokenRequest: {
       authIn: "body",
       encoding: "application/x-www-form-urlencoded",
@@ -752,6 +1006,13 @@ var providers = defineProviders({
   },
   lichess: {
     authorizationUrl: "https://lichess.org/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     PKCEMethod: "S256",
@@ -770,6 +1031,7 @@ var providers = defineProviders({
   },
   line: {
     authorizationUrl: "https://access.line.me/oauth2/v2.1/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -788,6 +1050,17 @@ var providers = defineProviders({
   },
   linear: {
     authorizationUrl: "https://linear.app/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "viewer",
+        "id"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -817,6 +1090,7 @@ var providers = defineProviders({
   },
   linkedin: {
     authorizationUrl: "https://www.linkedin.com/oauth/v2/authorization",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -835,6 +1109,13 @@ var providers = defineProviders({
   },
   mastodon: {
     authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     PKCEMethod: "S256",
@@ -859,6 +1140,13 @@ var providers = defineProviders({
   },
   mercadolibre: {
     authorizationUrl: "https://auth.mercadolibre.com/authorization",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -877,6 +1165,13 @@ var providers = defineProviders({
   },
   mercadopago: {
     authorizationUrl: "https://auth.mercadopago.com/authorization",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -894,6 +1189,7 @@ var providers = defineProviders({
   },
   microsoftentraid: {
     authorizationUrl: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/oauth2/v2.0/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -912,6 +1208,13 @@ var providers = defineProviders({
   },
   myanimelist: {
     authorizationUrl: "https://myanimelist.net/v1/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "plain",
@@ -930,6 +1233,16 @@ var providers = defineProviders({
   },
   naver: {
     authorizationUrl: "https://nid.naver.com/oauth2.0/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "response",
+        "id"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -947,6 +1260,13 @@ var providers = defineProviders({
   },
   notion: {
     authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -967,6 +1287,7 @@ var providers = defineProviders({
   },
   okta: {
     authorizationUrl: (config) => `https://${config.domain}/oauth2/default/v1/authorize`,
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -991,6 +1312,13 @@ var providers = defineProviders({
   },
   osu: {
     authorizationUrl: "https://osu.ppy.sh/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1008,6 +1336,13 @@ var providers = defineProviders({
   },
   patreon: {
     authorizationUrl: "https://www.patreon.com/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1025,6 +1360,7 @@ var providers = defineProviders({
   },
   polar: {
     authorizationUrl: "https://polar.sh/oauth2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1049,6 +1385,13 @@ var providers = defineProviders({
   },
   polaraccesslink: {
     authorizationUrl: "https://flow.polar.com/oauth2/authorization",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["x_user_id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     PKCEMethod: "S256",
@@ -1067,6 +1410,13 @@ var providers = defineProviders({
   },
   polarteampro: {
     authorizationUrl: "https://auth.polar.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["x_user_id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1085,6 +1435,13 @@ var providers = defineProviders({
   },
   reddit: {
     authorizationUrl: "https://www.reddit.com/api/v1/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1110,6 +1467,7 @@ var providers = defineProviders({
   },
   roblox: {
     authorizationUrl: "https://apis.roblox.com/oauth/v1/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1128,6 +1486,7 @@ var providers = defineProviders({
   },
   salesforce: {
     authorizationUrl: "https://login.salesforce.com/services/oauth2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1151,6 +1510,13 @@ var providers = defineProviders({
   },
   shikimori: {
     authorizationUrl: "https://shikimori.org/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1168,6 +1534,7 @@ var providers = defineProviders({
   },
   slack: {
     authorizationUrl: "https://slack.com/openid/connect/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     profileRequest: {
@@ -1191,6 +1558,13 @@ var providers = defineProviders({
   },
   spotify: {
     authorizationUrl: "https://accounts.spotify.com/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1209,6 +1583,17 @@ var providers = defineProviders({
   },
   startgg: {
     authorizationUrl: "https://start.gg/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "currentUser",
+        "id"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1233,6 +1618,13 @@ var providers = defineProviders({
   },
   strava: {
     authorizationUrl: "https://www.strava.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1260,6 +1652,13 @@ var providers = defineProviders({
   },
   synology: {
     authorizationUrl: (config) => `${config.baseURL}/webman/sso/SSOOauth.cgi?client_id=${config.clientId}&response_type=code&redirect_uri=${config.redirectUri}`,
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -1280,6 +1679,16 @@ var providers = defineProviders({
     createAuthorizationURLSearchParams: (config) => ({
       client_key: config.clientId
     }),
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "data",
+        "open_id"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1304,6 +1713,13 @@ var providers = defineProviders({
   },
   tiltify: {
     authorizationUrl: "https://v5api.tiltify.com/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1321,6 +1737,17 @@ var providers = defineProviders({
   },
   tumblr: {
     authorizationUrl: "https://www.tumblr.com/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "response",
+        "user",
+        "name"
+      ]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1338,6 +1765,7 @@ var providers = defineProviders({
   },
   twitch: {
     authorizationUrl: "https://id.twitch.tv/oauth2/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     profileRequest: {
@@ -1367,6 +1795,13 @@ var providers = defineProviders({
   },
   twitter: {
     authorizationUrl: "https://twitter.com/i/oauth2/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["data", "id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1390,6 +1825,17 @@ var providers = defineProviders({
   },
   vk: {
     authorizationUrl: "https://oauth.vk.com/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "response",
+        "0",
+        "id"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: false,
     profileRequest: {
@@ -1407,6 +1853,16 @@ var providers = defineProviders({
   },
   withings: {
     authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, [
+        "body",
+        "userid"
+      ]);
+      if (typeof subject !== "number") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     profileRequest: {
@@ -1460,6 +1916,7 @@ var providers = defineProviders({
   },
   workos: {
     authorizationUrl: "https://api.workos.com/sso/authorize",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1478,6 +1935,7 @@ var providers = defineProviders({
   },
   yahoo: {
     authorizationUrl: "https://api.login.yahoo.com/oauth2/request_auth",
+    extractSubjectFromIdentity: extractSubFromOIDCIdentity,
     isOIDC: true,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1505,6 +1963,13 @@ var providers = defineProviders({
       device_id: crypto.randomUUID(),
       device_name: `${navigator.platform ?? "Unknown"} \u2014 ${(navigator.userAgent.split(")")[0] || "").split("(").pop() || "Unknown"}`
     },
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -1529,6 +1994,13 @@ var providers = defineProviders({
   },
   zoom: {
     authorizationUrl: "https://zoom.us/oauth/authorize",
+    extractSubjectFromIdentity(identity) {
+      const subject = extractPropFromIdentity(identity, ["id"]);
+      if (typeof subject !== "string") {
+        throw new Error("Invalid identity data shape");
+      }
+      return subject;
+    },
     isOIDC: false,
     isRefreshable: true,
     PKCEMethod: "S256",
@@ -2197,16 +2669,16 @@ var instantiateUserSession = async ({
   getUser,
   createUser
 }) => {
-  let userProfile;
+  let userIdentity;
   if (tokenResponse.id_token) {
-    userProfile = decodeJWT(tokenResponse.id_token);
+    userIdentity = decodeJWT(tokenResponse.id_token);
   } else if (authProvider === "withings") {
-    userProfile = tokenResponse.body;
+    userIdentity = tokenResponse.body;
   } else {
-    userProfile = await providerInstance.fetchUserProfile(tokenResponse.access_token);
+    userIdentity = await providerInstance.fetchUserProfile(tokenResponse.access_token);
   }
-  let user = await getUser(userProfile);
-  user = user ?? await createUser(userProfile);
+  let user = await getUser(userIdentity);
+  user = user ?? await createUser(userIdentity);
   if (!isValidUser(user))
     throw new Error("Internal Server Error - Invalid user schema");
   session[userSessionId] = {
@@ -2230,12 +2702,17 @@ var absoluteAuth = async ({
   refreshRoute,
   revokeRoute,
   onAuthorizeSuccess,
+  onAuthorizeError,
   onProfileSuccess,
+  onProfileError,
   onCallbackSuccess,
+  onCallbackError,
   onStatus,
   onRefreshSuccess,
+  onRefreshError,
   onSignOut,
-  onRevocationSuccess
+  onRevocationSuccess,
+  onRevocationError
 }) => {
   const entryPromises = [];
   for (const [providerName, providerConfig] of Object.entries(providersConfiguration)) {
@@ -2251,12 +2728,29 @@ var absoluteAuth = async ({
     ]));
   }
   const clientProviders = Object.fromEntries(await Promise.all(entryPromises));
-  return new Elysia10().use(signout({ onSignOut, signoutRoute })).use(revoke({ clientProviders, onRevocationSuccess, revokeRoute })).use(status({ onStatus, statusRoute })).use(refresh({ clientProviders, onRefreshSuccess, refreshRoute })).use(authorize({ authorizeRoute, clientProviders, onAuthorizeSuccess })).use(callback({
+  return new Elysia10().use(signout({ onSignOut, signoutRoute })).use(revoke({
+    clientProviders,
+    onRevocationError,
+    onRevocationSuccess,
+    revokeRoute
+  })).use(status({ onStatus, statusRoute })).use(refresh({
+    clientProviders,
+    onRefreshError,
+    onRefreshSuccess,
+    refreshRoute
+  })).use(authorize({
+    authorizeRoute,
+    clientProviders,
+    onAuthorizeError,
+    onAuthorizeSuccess
+  })).use(callback({
     callbackRoute,
     clientProviders,
+    onCallbackError,
     onCallbackSuccess
   })).use(profile({
     clientProviders,
+    onProfileError,
     onProfileSuccess,
     profileRoute
   })).use(protectRoute());
@@ -2283,5 +2777,5 @@ export {
   absoluteAuth
 };
 
-//# debugId=24F8F110745322BF64756E2164756E21
+//# debugId=93A2F2664C7B8CCC64756E2164756E21
 //# sourceMappingURL=index.js.map