@absolutejs/auth 0.29.2 → 0.30.0-beta.0

package/dist/index.d.ts

@@ -13458,6 +13458,9 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
                 acr_values?: string | undefined;
                 code_challenge?: string | undefined;
                 code_challenge_method?: string | undefined;
+                id_token_hint?: string | undefined;
+                max_age?: string | undefined;
+                prompt?: string | undefined;
                 request_uri?: string | undefined;
                 response_type?: string | undefined;
                 state?: string | undefined;
@@ -13667,8 +13670,8 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
             params: {};
             query: {
                 client_id?: string | undefined;
-                state?: string | undefined;
                 id_token_hint?: string | undefined;
+                state?: string | undefined;
                 post_logout_redirect_uri?: string | undefined;
             };
             headers: unknown;
@@ -13691,8 +13694,8 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
         post: {
             body: {
                 client_id?: string | undefined;
-                state?: string | undefined;
                 id_token_hint?: string | undefined;
+                state?: string | undefined;
                 post_logout_redirect_uri?: string | undefined;
             };
             params: {};
@@ -13832,6 +13835,54 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
             };
         };
     };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                access_token?: string | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         get: {
@@ -15067,6 +15118,8 @@ export type { DpopResult } from './oidc/dpop';
 export { CLIENT_ASSERTION_TYPE, verifyClientAssertion } from './oidc/clientAuth';
 export { createInMemoryAuthorizationCodeStore, createInMemoryClientAssertionJtiStore, createInMemoryClientRegistrationTokenStore, createInMemoryDeviceAuthorizationStore, createInMemoryInitialAccessTokenStore, createInMemoryLogoutDeliveryStore, createInMemoryOAuthClientStore, createInMemoryOidcRefreshTokenStore, createInMemoryPushedAuthorizationRequestStore } from './oidc/inMemoryStores';
 export { consumePushedRequest, pushAuthorizationRequest, DEFAULT_PAR_TTL_MS, REQUEST_URI_PREFIX } from './oidc/par';
+export { fetchUserInfo, readUserInfoBearer, userInfoChallengeHeader } from './oidc/userinfo';
+export type { UserInfoResult } from './oidc/userinfo';
 export { fanOutBackchannelLogout, mintLogoutToken, resolvePostLogoutRedirect, verifyIdTokenHint } from './oidc/logout';
 export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonLogoutDeliveryStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createNeonPushedAuthorizationRequestStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresLogoutDeliveryStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore, createPostgresPushedAuthorizationRequestStore, oauthClientAssertionJtisTable, oauthClientRegistrationTokensTable, oauthClientsTable, oauthCodesTable, oauthDeviceAuthorizationsTable, oauthInitialAccessTokensTable, oauthLogoutDeliveriesTable, oauthPushedAuthorizationRequestsTable, oauthRefreshTokensTable } from './oidc/postgresStores';
 export { deleteRegisteredClient, getRegisteredClient, registerClient, updateRegisteredClient, type ClientRegistrationDecision, type ClientRegistrationMetadata, type OnClientRegistration, type RegisterClientResult } from './oidc/registration';

package/dist/index.js

@@ -3467,7 +3467,7 @@ var credentialsLogin = ({
   });
   const mfaContext = {
     headers: headerBag,
-    ip: headerBag["cf-connecting-ip"] ?? headerBag["x-forwarded-for"]?.split(",")[0]?.trim() ?? undefined
+    ip: headerBag["cf-connecting-ip"] ?? headerBag["do-connecting-ip"] ?? headerBag["x-forwarded-for"]?.split(",")[0]?.trim() ?? undefined
   };
   const normalizedEmail = email.trim().toLowerCase();
   const lockState = lockoutGuard ? await lockoutGuard.check(normalizedEmail) : undefined;
@@ -4843,6 +4843,51 @@ var pushAuthorizationRequest = async ({
   };
 };
 
+// src/oidc/userinfo.ts
+var BEARER_PREFIX2 = "Bearer ";
+var readBearer = (authorization) => {
+  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX2)) {
+    return;
+  }
+  return authorization.slice(BEARER_PREFIX2.length).trim();
+};
+var readUserInfoBearer = readBearer;
+var fetchUserInfo = async ({
+  config,
+  now = Date.now(),
+  token
+}) => {
+  if (token === undefined) {
+    return {
+      body: { error: "invalid_request" },
+      error: "invalid_request",
+      ok: false
+    };
+  }
+  const verified = await verifyJwt(token, config.signingKey.publicJwk);
+  if (verified === undefined) {
+    return {
+      body: { error: "invalid_token" },
+      error: "invalid_token",
+      ok: false
+    };
+  }
+  const { payload } = verified;
+  if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.exp * 1000 <= now) {
+    return {
+      body: { error: "invalid_token" },
+      error: "invalid_token",
+      ok: false
+    };
+  }
+  const enriched = await config.getUserInfo?.(payload.sub);
+  return {
+    body: { ...enriched ?? {}, sub: payload.sub },
+    ok: true
+  };
+};
+var userInfoChallengeHeader = (error) => `Bearer realm="userinfo", error="${error}"`;
+
 // src/oidc/registration.ts
 var REG_TOKEN_BYTES = 32;
 var CLIENT_ID_BYTES = 16;
@@ -5106,6 +5151,7 @@ var oidcProviderRoutes = (config) => {
   const endSessionRoute = `${oidcRoute}/end_session`;
   const parRoute = `${oidcRoute}/par`;
   const registrationRoute = `${oidcRoute}/register`;
+  const userinfoRoute = `${oidcRoute}/userinfo`;
   const registrationBaseUrl = `${issuer}${registrationRoute}`;
   const tokenUrl = `${issuer}${oidcRoute}/token`;
   const authenticateClient = async (clientId, clientSecret) => {
@@ -5317,7 +5363,8 @@ var oidcProviderRoutes = (config) => {
       "none",
       "private_key_jwt"
     ],
-    token_endpoint_auth_signing_alg_values_supported: ["ES256"]
+    token_endpoint_auth_signing_alg_values_supported: ["ES256"],
+    userinfo_endpoint: `${issuer}${userinfoRoute}`
   };
   if (config.deviceAuthorizationStore) {
     discovery.device_authorization_endpoint = `${issuer}${deviceAuthorizationRoute}`;
@@ -5422,7 +5469,21 @@ var oidcProviderRoutes = (config) => {
       session: store.session,
       userSessionId: user_session_id.value
     });
-    if (userSession === undefined) {
+    const promptValues = effectiveQuery.prompt === undefined ? [] : effectiveQuery.prompt.split(" ");
+    const wantsSilent = promptValues.includes("none");
+    const wantsLogin = promptValues.includes("login") || promptValues.includes("consent");
+    const maxAge = effectiveQuery.max_age === undefined ? undefined : Number(effectiveQuery.max_age);
+    const sessionStaleByMaxAge = userSession !== undefined && maxAge !== undefined && !Number.isNaN(maxAge) && maxAge >= 0 && (userSession.authenticatedAt ?? 0) < Date.now() - maxAge * 1000;
+    const hintSub = effectiveQuery.id_token_hint === undefined ? undefined : (await verifyIdTokenHint({
+      config,
+      idTokenHint: effectiveQuery.id_token_hint
+    }))?.sub;
+    const hintMismatch = userSession !== undefined && hintSub !== undefined && hintSub !== getUserId(userSession.user);
+    const needsReauth = wantsLogin || sessionStaleByMaxAge || hintMismatch;
+    if (userSession === undefined || needsReauth) {
+      if (wantsSilent) {
+        return errorRedirect(userSession === undefined ? "login_required" : "interaction_required");
+      }
       return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
@@ -5472,7 +5533,10 @@ var oidcProviderRoutes = (config) => {
       client_id: t12.Optional(t12.String()),
       code_challenge: t12.Optional(t12.String()),
       code_challenge_method: t12.Optional(t12.String()),
+      id_token_hint: t12.Optional(t12.String()),
+      max_age: t12.Optional(t12.String()),
       nonce: t12.Optional(t12.String()),
+      prompt: t12.Optional(t12.String()),
       redirect_uri: t12.Optional(t12.String()),
       request_uri: t12.Optional(t12.String()),
       response_type: t12.Optional(t12.String()),
@@ -5813,6 +5877,43 @@ var oidcProviderRoutes = (config) => {
       authorization: t12.Optional(t12.String())
     }),
     params: t12.Object({ clientId: t12.String() })
+  }).get(userinfoRoute, async ({ headers }) => {
+    const token = readUserInfoBearer(headers.authorization);
+    const result = await fetchUserInfo({ config, token });
+    if (!result.ok) {
+      return new Response(JSON.stringify(result.body), {
+        headers: {
+          "content-type": "application/json",
+          "www-authenticate": userInfoChallengeHeader(result.error)
+        },
+        status: HTTP_UNAUTHORIZED2
+      });
+    }
+    return jsonResponse(result.body, HTTP_OK2);
+  }, {
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    })
+  }).post(userinfoRoute, async ({ headers, body }) => {
+    const token = readUserInfoBearer(headers.authorization) ?? body.access_token;
+    const result = await fetchUserInfo({ config, token });
+    if (!result.ok) {
+      return new Response(JSON.stringify(result.body), {
+        headers: {
+          "content-type": "application/json",
+          "www-authenticate": userInfoChallengeHeader(result.error)
+        },
+        status: HTTP_UNAUTHORIZED2
+      });
+    }
+    return jsonResponse(result.body, HTTP_OK2);
+  }, {
+    body: t12.Object({
+      access_token: t12.Optional(t12.String())
+    }),
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    })
   }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery);
 };
 
@@ -6314,7 +6415,7 @@ import { Elysia as Elysia18, t as t15 } from "elysia";
 // src/scim/config.ts
 var DEFAULT_SCIM_ROUTE = "/scim/v2";
 var SCIM_TOKEN_BYTES = 32;
-var BEARER_PREFIX2 = "Bearer ";
+var BEARER_PREFIX3 = "Bearer ";
 var createScimToken = async (scimTokenStore, organizationId) => {
   const token = generateSecureToken(SCIM_TOKEN_BYTES);
   const record = {
@@ -6327,10 +6428,10 @@ var createScimToken = async (scimTokenStore, organizationId) => {
   return { token, tokenId: record.tokenId };
 };
 var resolveScimOrganization = async (scimTokenStore, authorization) => {
-  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX2)) {
+  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX3)) {
     return;
   }
-  const token = authorization.slice(BEARER_PREFIX2.length).trim();
+  const token = authorization.slice(BEARER_PREFIX3.length).trim();
   if (token.length === 0)
     return;
   const record = await scimTokenStore.findByHashedToken(await hashToken(token));
@@ -6347,7 +6448,7 @@ var DEFAULT_PORTAL_ROUTE = "/auth/portal";
 var DEFAULT_SETUP_SESSION_TTL_MS = MILLISECONDS_IN_A_DAY * SETUP_TTL_DAYS;
 
 // src/portal/operations.ts
-var BEARER_PREFIX3 = "Bearer ";
+var BEARER_PREFIX4 = "Bearer ";
 var createSetupSession = async ({
   capabilities,
   createdBy,
@@ -6373,10 +6474,10 @@ var resolveSetupSession = async ({
   authorization,
   setupSessionStore
 }) => {
-  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX3)) {
+  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX4)) {
     return;
   }
-  const token = authorization.slice(BEARER_PREFIX3.length).trim();
+  const token = authorization.slice(BEARER_PREFIX4.length).trim();
   if (token.length === 0)
     return;
   const session = await setupSessionStore.getSetupSessionByTokenHash(await hashToken(token));
@@ -22904,6 +23005,7 @@ export {
   validateSession,
   validateEmailDeliverability,
   userSessionIdTypebox,
+  userInfoChallengeHeader,
   updateRegisteredClient,
   trustDevice,
   toPublicJwk,
@@ -22945,6 +23047,7 @@ export {
   registerClient,
   refreshableProviderOptions,
   recordLoginAttempt,
+  readUserInfoBearer,
   readSessionRing,
   pushAuthorizationRequest,
   providers,
@@ -23023,6 +23126,7 @@ export {
   generateEncryptionKey,
   generateBackupCodes,
   fingerprintDevice,
+  fetchUserInfo,
   fanOutBackchannelLogout,
   extractPropFromIdentity,
   extractDpopNonceClaim,
@@ -23226,5 +23330,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=0505C47D5BDEC10764756E2164756E21
+//# debugId=BAAEA91F75FEB49E64756E2164756E21
 //# sourceMappingURL=index.js.map