@absolutejs/auth 0.54.4 → 0.54.6

package/dist/migrations/index.d.ts

@@ -1,5 +1,5 @@
 import type { BlockMigrations } from './types';
-export type BlockName = 'adaptive' | 'apikeys' | 'audit' | 'credentials' | 'fga' | 'linkedProviders' | 'lockout' | 'mfa' | 'oidc' | 'organizations' | 'passwordless' | 'portal' | 'roles' | 'scim' | 'sessions' | 'sso' | 'vault' | 'vc' | 'webauthn' | 'webhooks';
+export type BlockName = 'adaptive' | 'agents' | 'apikeys' | 'audit' | 'credentials' | 'fga' | 'linkedProviders' | 'lockout' | 'mfa' | 'oidc' | 'organizations' | 'passwordless' | 'portal' | 'roles' | 'scim' | 'sessions' | 'sso' | 'vault' | 'vc' | 'webauthn' | 'webhooks';
 export declare const blockMigrations: Record<BlockName, BlockMigrations>;
 export { runMigrations } from './runner';
 export type { Migration, BlockMigrations } from './types';

package/dist/oidc/config.d.ts

@@ -1,6 +1,6 @@
 import type { RouteString } from '../types';
 import { type SigningKey } from './keys';
-import type { OnClientRegistration } from './registration';
+import type { OnClientRegistered, OnClientRegistration } from './registration';
 import type { VciConfig } from './vci';
 import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
@@ -73,6 +73,14 @@ export type OidcProviderConfig<UserType> = {
     logoutDeliveryStore?: LogoutDeliveryStore;
     oidcRoute?: RouteString;
     onClientRegistration?: OnClientRegistration;
+    /** Fires after RFC 7591 registration has been persisted and has a generated client id. */
+    onClientRegistered?: OnClientRegistered;
+    /** Fires after the authenticated user approves an RFC 8628 device request. */
+    onDeviceAuthorizationApproved?: (context: {
+        clientId: string;
+        scopes: string[];
+        userSub: string;
+    }) => void | Promise<void>;
     pushedAuthorizationRequestStore?: PushedAuthorizationRequestStore;
     pushedAuthorizationRequestTtlMs?: number;
     refreshTokenStore: OidcRefreshTokenStore;

package/dist/oidc/registration.d.ts

@@ -2,6 +2,7 @@ import type { ClientRegistrationTokenStore, InitialAccessTokenStore, OAuthClient
 export type ClientRegistrationMetadata = {
     backchannel_logout_uri?: string;
     client_name?: string;
+    grant_types?: string[];
     jwks?: JsonWebKey[];
     jwks_uri?: string;
     post_logout_redirect_uris?: string[];
@@ -18,6 +19,10 @@ export type ClientRegistrationDecision = {
 export type OnClientRegistration = (context: {
     metadata: ClientRegistrationMetadata;
 }) => ClientRegistrationDecision | Promise<ClientRegistrationDecision>;
+export type OnClientRegistered = (context: {
+    client: OAuthClient;
+    metadata: ClientRegistrationMetadata;
+}) => void | Promise<void>;
 export type RegisterClientResult = {
     body: {
         error: string;
@@ -73,11 +78,12 @@ export declare const getRegisteredClient: ({ authorization, clientId, clientStor
     };
     readonly status: 200;
 }>;
-export declare const registerClient: ({ clientStore, initialAccessTokenStore, metadata, onClientRegistration, presentedInitialAccessToken, registrationBaseUrl, registrationTokenStore }: {
+export declare const registerClient: ({ clientStore, initialAccessTokenStore, metadata, onClientRegistration, onClientRegistered, presentedInitialAccessToken, registrationBaseUrl, registrationTokenStore }: {
     clientStore: OAuthClientStore;
     initialAccessTokenStore?: InitialAccessTokenStore;
     metadata: ClientRegistrationMetadata;
     onClientRegistration?: OnClientRegistration;
+    onClientRegistered?: OnClientRegistered;
     presentedInitialAccessToken?: string;
     registrationBaseUrl: string;
     registrationTokenStore: ClientRegistrationTokenStore;
@@ -118,6 +124,7 @@ export declare const updateRegisteredClient: ({ authorization, clientId, clientS
         readonly registration_access_token: string;
         readonly backchannel_logout_uri?: string;
         readonly client_name?: string;
+        readonly grant_types?: string[];
         readonly jwks?: JsonWebKey[];
         readonly jwks_uri?: string;
         readonly post_logout_redirect_uris?: string[];

package/dist/oidc/routes.d.ts

@@ -63,10 +63,10 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
+                resource?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
                 audience?: string | undefined;
-                resource?: string | undefined;
                 refresh_token?: string | undefined;
                 device_code?: string | undefined;
                 auth_req_id?: string | undefined;
@@ -102,12 +102,12 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
+                resource?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
                 nonce?: string | undefined;
                 audience?: string | undefined;
                 claims?: string | undefined;
-                resource?: string | undefined;
                 client_secret?: string | undefined;
                 redirect_uri?: string | undefined;
                 acr_values?: string | undefined;
@@ -333,6 +333,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 scope?: string | undefined;
                 backchannel_logout_uri?: string | undefined;
                 client_name?: string | undefined;
+                grant_types?: string[] | undefined;
                 jwks_uri?: string | undefined;
                 post_logout_redirect_uris?: string[] | undefined;
                 redirect_uris?: string[] | undefined;
@@ -392,6 +393,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                     scope?: string | undefined;
                     backchannel_logout_uri?: string | undefined;
                     client_name?: string | undefined;
+                    grant_types?: string[] | undefined;
                     jwks_uri?: string | undefined;
                     post_logout_redirect_uris?: string[] | undefined;
                     redirect_uris?: string[] | undefined;

package/dist/oidc/types.d.ts

@@ -1,6 +1,9 @@
 export type OAuthClient = {
     backchannelLogoutUri?: string;
     clientId: string;
+    /** Grant types this dynamically registered client declared. Undefined preserves
+     * the historical authorization-code default for statically configured clients. */
+    grantTypes?: string[];
     hashedSecret?: string;
     jwks?: JsonWebKey[];
     jwksUri?: string;

package/dist/providers/clients.d.ts

@@ -1591,6 +1591,7 @@ export declare const buildClientProviders: (providersConfiguration: OAuth2Config
                         url: string;
                     };
                 } & import("citra").ProviderConfig) | ({
+                    accessTokenPath: string[];
                     authorizationUrl: string;
                     isOIDC: false;
                     isRefreshable: true;

package/dist/providers/index.js

@@ -1811,6 +1811,7 @@ var providers = defineProviders({
     }
   },
   withings: {
+    accessTokenPath: ["body", "access_token"],
     authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
     isOIDC: false,
     isRefreshable: true,
@@ -2665,10 +2666,21 @@ var buildOAuth2Client = async (meta, config) => {
       if (!response.ok)
         throw await createOAuth2FetchError(response);
       const tokenResponse = await response.json();
+      if (!tokenResponse || typeof tokenResponse !== "object") {
+        throw new Error("OAuth token endpoint returned a non-object response");
+      }
+      const oauthError = Reflect.get(tokenResponse, "error");
+      if (typeof oauthError === "string" && oauthError.length > 0) {
+        throw new Error(`OAuth token exchange failed: ${oauthError}`);
+      }
       const nestedToken = meta.accessTokenPath ? readPath(tokenResponse, meta.accessTokenPath) : undefined;
       if (typeof nestedToken === "string" && nestedToken.length > 0 && tokenResponse && typeof tokenResponse === "object") {
         tokenResponse.access_token = nestedToken;
       }
+      const accessToken = Reflect.get(tokenResponse, "access_token");
+      if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new Error("OAuth token endpoint returned no access_token");
+      }
       return tokenResponse;
     }
   };
@@ -2694,5 +2706,5 @@ export {
   decodeJWT
 };
 
-//# debugId=C6E61233F0CEF1EA64756E2164756E21
+//# debugId=902C18A45F6C2D7A64756E2164756E21
 //# sourceMappingURL=index.js.map