@absolutejs/auth 0.51.0 → 0.52.1

package/dist/index.js

@@ -6435,6 +6435,17 @@ var jsonResponse = (value, status) => new Response(JSON.stringify(value), {
 });
 var oauthError2 = (status, error) => jsonResponse({ error }, status);
 var tokenResponse = (tokens) => jsonResponse(tokens, HTTP_OK2);
+var canonicalizeRequestUrl = (requestUrl, issuer) => {
+  try {
+    const url = new URL(requestUrl);
+    const base = new URL(issuer);
+    url.protocol = base.protocol;
+    url.host = base.host;
+    return url.toString();
+  } catch {
+    return requestUrl;
+  }
+};
 var redirectTo = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND });
 var escapeHtmlAttr = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 var formPostResponse = (redirectUri, params) => {
@@ -6948,9 +6959,24 @@ var oidcProviderRoutes = (config) => {
       if (wantsSilent) {
         return errorRedirect(userSession === undefined ? "login_required" : "interaction_required");
       }
-      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
+      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
+    if (config.consentUrl !== undefined && await config.needsConsent?.({
+      client: {
+        clientId: client.clientId,
+        name: client.name
+      },
+      requestedScopes: requested,
+      user: userSession.user
+    }) === true) {
+      const consentTarget = new URL(config.consentUrl, issuer);
+      consentTarget.searchParams.set("return_to", canonicalizeRequestUrl(request.url, issuer));
+      consentTarget.searchParams.set("client_id", client.clientId);
+      consentTarget.searchParams.set("client_name", client.name);
+      consentTarget.searchParams.set("scope", requested.join(" "));
+      return redirectTo(consentTarget.toString());
+    }
     const granted = getGrantedScopes === undefined ? requested : await getGrantedScopes({
       client: {
         clientId: client.clientId,
@@ -7449,7 +7475,7 @@ var oidcProviderRoutes = (config) => {
     headers: t13.Object({
       authorization: t13.Optional(t13.String())
     })
-  }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery);
+  }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
 };
 
 // src/organizations/routes.ts
@@ -28028,5 +28054,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=CF57DC7D601D3EC464756E2164756E21
+//# debugId=9E1C46257073267B64756E2164756E21
 //# sourceMappingURL=index.js.map