@absolutejs/auth 0.55.0 → 0.55.2

package/dist/index.js

@@ -3044,9 +3044,6 @@ var apiKeysRoutes = ({
   });
 };
 
-// src/agents/routes.ts
-import { Elysia as Elysia2 } from "elysia";
-
 // src/agents/config.ts
 var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resource";
 var agentProtectedResourceMetadata = (config) => ({
@@ -3058,6 +3055,9 @@ var agentProtectedResourceMetadata = (config) => ({
   scopes_supported: config.scopes
 });
 
+// src/agents/context.ts
+import { Elysia as Elysia2 } from "elysia";
+
 // src/agents/principal.ts
 var intersectScopes = (...sets) => {
   if (sets.length === 0)
@@ -3112,6 +3112,77 @@ var resolveAgentPrincipal = async (request, config) => {
   };
 };
 
+// src/agents/context.ts
+var DELETE_CODE_POINT = 127;
+var HTTP_FORBIDDEN = 403;
+var HTTP_UNAUTHORIZED2 = 401;
+var MINIMUM_PRINTABLE_CODE_POINT = 32;
+var quoteHeaderValue = (value) => {
+  const printable = [...value].filter((character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint >= MINIMUM_PRINTABLE_CODE_POINT && codePoint !== DELETE_CODE_POINT;
+  }).join("");
+  return `"${printable.replace(/[\\"]/g, "\\$&")}"`;
+};
+var agentAuthChallenge = ({
+  config,
+  error,
+  requiredScopes = []
+}) => {
+  const parameters = [
+    `resource_metadata=${quoteHeaderValue(agentResourceMetadataUrl(config))}`
+  ];
+  if (requiredScopes.length > 0) {
+    parameters.push(`scope=${quoteHeaderValue(requiredScopes.join(" "))}`);
+  }
+  if (error !== undefined) {
+    parameters.push(`error=${quoteHeaderValue(error)}`);
+  }
+  return `Bearer ${parameters.join(", ")}`;
+};
+var agentResourceMetadataUrl = (config) => new URL(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, config.resource).toString();
+var failureResponse = (config, failure, requiredScopes) => new Response(JSON.stringify({
+  error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
+  error_description: failure.message
+}), {
+  headers: {
+    "content-type": "application/json",
+    "www-authenticate": agentAuthChallenge({
+      config,
+      error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
+      requiredScopes
+    })
+  },
+  status: failure.code === "Forbidden" ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED2
+});
+var agentAuthContextPlugin = (config) => new Elysia2().derive(({ request }) => ({
+  protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
+    if (config === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: HTTP_UNAUTHORIZED2 });
+    }
+    const principal = await resolveAgentPrincipal(request, config);
+    if (principal === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    if (!agentHasScopes(principal, requiredScopes)) {
+      const failure = {
+        code: "Forbidden",
+        message: "Insufficient agent scopes"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    return handleAuth(principal);
+  }
+}));
+
 // src/agents/registration.ts
 init_constants();
 init_crypto();
@@ -3780,45 +3851,10 @@ var revokeAgentIdentityRegistration = async (config, registrationId, now = Date.
 };
 
 // src/agents/routes.ts
-var quoteHeaderValue = (value) => {
-  const printable = [...value].filter((character) => {
-    const codePoint = character.codePointAt(0) ?? 0;
-    return codePoint >= 32 && codePoint !== 127;
-  }).join("");
-  return `"${printable.replace(/[\\"]/g, "\\$&")}"`;
-};
-var agentAuthChallenge = ({
-  config,
-  error,
-  requiredScopes = []
-}) => {
-  const parameters = [
-    `resource_metadata=${quoteHeaderValue(agentResourceMetadataUrl(config))}`
-  ];
-  if (requiredScopes.length > 0) {
-    parameters.push(`scope=${quoteHeaderValue(requiredScopes.join(" "))}`);
-  }
-  if (error !== undefined) {
-    parameters.push(`error=${quoteHeaderValue(error)}`);
-  }
-  return `Bearer ${parameters.join(", ")}`;
-};
-var agentResourceMetadataUrl = (config) => new URL(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, config.resource).toString();
-var failureResponse = (config, failure, requiredScopes) => new Response(JSON.stringify({
-  error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
-  error_description: failure.message
-}), {
-  headers: {
-    "content-type": "application/json",
-    "www-authenticate": agentAuthChallenge({
-      config,
-      error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
-      requiredScopes
-    })
-  },
-  status: failure.code === "Forbidden" ? 403 : 401
-});
-var json = (value, status = 200) => new Response(JSON.stringify(value), {
+var HTTP_BAD_REQUEST2 = 400;
+var HTTP_OK2 = 200;
+var HTTP_UNAUTHORIZED3 = 401;
+var json = (value, status = HTTP_OK2) => new Response(JSON.stringify(value), {
   headers: {
     "cache-control": "no-store",
     "content-type": "application/json"
@@ -3852,7 +3888,7 @@ var registrationResponse = (result) => {
       ...body,
       error: "interaction_required",
       error_description: "Authenticate at the service and confirm the account link."
-    }, 401);
+    }, HTTP_UNAUTHORIZED3);
   }
   return json(body);
 };
@@ -3880,33 +3916,7 @@ var parseRegistrationInput = (value) => {
 };
 var escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 var agentAuthPlugin = (config) => {
-  const plugin = new Elysia2().derive(({ request }) => ({
-    protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
-      if (config === undefined) {
-        const failure = {
-          code: "Unauthorized",
-          message: "Agent is not authenticated"
-        };
-        return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: 401 });
-      }
-      const principal = await resolveAgentPrincipal(request, config);
-      if (principal === undefined) {
-        const failure = {
-          code: "Unauthorized",
-          message: "Agent is not authenticated"
-        };
-        return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-      }
-      if (!agentHasScopes(principal, requiredScopes)) {
-        const failure = {
-          code: "Forbidden",
-          message: "Insufficient agent scopes"
-        };
-        return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-      }
-      return handleAuth(principal);
-    }
-  }));
+  const plugin = agentAuthContextPlugin(config);
   if (config === undefined)
     return plugin.as("global");
   if (config.agentRegistration === undefined) {
@@ -3937,11 +3947,11 @@ var agentAuthPlugin = (config) => {
   }).post(identityRoute, async ({ body }) => {
     const value = recordBody(body);
     if (value === undefined || typeof value.type !== "string") {
-      return json({ error: "invalid_request" }, 400);
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST2);
     }
     const input = parseRegistrationInput(value);
     if (input === undefined)
-      return json({ error: "invalid_request" }, 400);
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST2);
     const result = await startAgentRegistration(config, input);
     if ("error" in result) {
       return json({
@@ -3953,7 +3963,7 @@ var agentAuthPlugin = (config) => {
   }).post(claimRoute, async ({ body }) => {
     const value = recordBody(body);
     if (value === undefined || typeof value.claim_token !== "string" || typeof value.email !== "string") {
-      return json({ error: "invalid_request" }, 400);
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST2);
     }
     const result = await beginAgentClaim(config, {
       claimToken: value.claim_token,
@@ -3968,7 +3978,7 @@ var agentAuthPlugin = (config) => {
       value = Object.fromEntries(new URLSearchParams(body));
     }
     if (value === undefined || typeof value.claim_attempt_token !== "string" || typeof value.user_code !== "string") {
-      return json({ error: "invalid_request" }, 400);
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST2);
     }
     const result = await completeAgentClaim(config, {
       attemptToken: value.claim_attempt_token,
@@ -4281,6 +4291,11 @@ import { Elysia as Elysia5, t as t4 } from "elysia";
 
 // src/utils.ts
 init_constants();
+var MILLISECONDS_IN_A_SECOND2 = 1000;
+var readOptionalString = (value, property) => {
+  const candidate = Reflect.get(value, property);
+  return typeof candidate === "string" ? candidate : undefined;
+};
 var defineAuthConfig = (configuration) => configuration;
 var defineAuthHtmxConfig = (htmxConfig) => htmxConfig;
 var defineAuthSettings = (settings) => settings;
@@ -4376,14 +4391,10 @@ var resolveOAuthAuthorization = async ({
   let userIdentity;
   let accessToken = tokenResponse.access_token;
   let refreshToken = tokenResponse.refresh_token;
-  if (authProvider === "withings" && !accessToken) {
-    const body = Reflect.get(tokenResponse, "body");
-    if (body && typeof body === "object") {
-      const nestedAccessToken = Reflect.get(body, "access_token");
-      if (typeof nestedAccessToken === "string") {
-        accessToken = nestedAccessToken;
-      }
-    }
+  const withingsBody = Reflect.get(tokenResponse, "body");
+  const withingsAccessToken = authProvider === "withings" && withingsBody !== null && typeof withingsBody === "object" ? readOptionalString(withingsBody, "access_token") : undefined;
+  if (!accessToken && withingsAccessToken !== undefined) {
+    accessToken = withingsAccessToken;
   }
   if (typeof accessToken !== "string" || accessToken.length === 0) {
     throw new Error("OAuth authorization response contains no access_token");
@@ -4401,9 +4412,12 @@ var resolveOAuthAuthorization = async ({
       source: "tokenResponse"
     });
   } else if (authProvider === "withings") {
-    userIdentity = { userid: tokenResponse.body.userid };
-    accessToken = tokenResponse.body.access_token;
-    refreshToken = tokenResponse.body.refresh_token;
+    if (withingsBody === null || typeof withingsBody !== "object") {
+      throw new Error("Withings OAuth response contains no body");
+    }
+    userIdentity = { userid: Reflect.get(withingsBody, "userid") };
+    accessToken = readOptionalString(withingsBody, "access_token") ?? accessToken;
+    refreshToken = readOptionalString(withingsBody, "refresh_token") ?? refreshToken;
   } else {
     userIdentity = normalizeProviderIdentity({
       identity: await providerInstance.fetchUserProfile(accessToken),
@@ -4435,7 +4449,7 @@ var resolveOAuthTokenExpiresAt = (tokenResponse, now = Date.now()) => {
   if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
     return;
   }
-  return now + expiresInSeconds * 1000;
+  return now + expiresInSeconds * MILLISECONDS_IN_A_SECOND2;
 };
 var validateSession = ({
   user_session_id,
@@ -7445,11 +7459,11 @@ var updateRegisteredClient = async ({
 };
 
 // src/oidc/routes.ts
-var HTTP_OK2 = 200;
+var HTTP_OK3 = 200;
 var HTTP_NO_CONTENT = 204;
 var HTTP_FOUND = 302;
-var HTTP_BAD_REQUEST2 = 400;
-var HTTP_UNAUTHORIZED2 = 401;
+var HTTP_BAD_REQUEST3 = 400;
+var HTTP_UNAUTHORIZED4 = 401;
 var HTTP_NOT_IMPLEMENTED = 501;
 var CODE_TTL_MINUTES = 10;
 var CODE_TTL_MS = MILLISECONDS_IN_A_MINUTE * CODE_TTL_MINUTES;
@@ -7463,7 +7477,7 @@ var jsonResponse = (value, status) => new Response(JSON.stringify(value), {
   status
 });
 var oauthError2 = (status, error) => jsonResponse({ error }, status);
-var tokenResponse = (tokens) => jsonResponse(tokens, HTTP_OK2);
+var tokenResponse = (tokens) => jsonResponse(tokens, HTTP_OK3);
 var canonicalizeRequestUrl = (requestUrl, issuer) => {
   try {
     const url = new URL(requestUrl);
@@ -7485,7 +7499,7 @@ var formPostResponse = (redirectUri, params) => {
       "cache-control": "no-store",
       "content-type": "text/html;charset=UTF-8"
     },
-    status: HTTP_OK2
+    status: HTTP_OK3
   });
 };
 var respondToClient = (redirectUri, responseMode, params) => {
@@ -7623,7 +7637,7 @@ var oidcProviderRoutes = (config) => {
         "dpop-nonce": fresh,
         "www-authenticate": 'DPoP error="use_dpop_nonce"'
       },
-      status: HTTP_UNAUTHORIZED2
+      status: HTTP_UNAUTHORIZED4
     });
   };
   const grantAuthorizationCode = async (client, body, dpop, clientCertThumbprint) => {
@@ -7633,11 +7647,11 @@ var oidcProviderRoutes = (config) => {
       redirect_uri: redirectUri
     } = body;
     if (code === undefined || codeVerifier === undefined || redirectUri === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const record = await authorizationCodeStore.consumeCode(await hashToken(code));
     if (record === undefined || record.expiresAt < Date.now() || record.clientId !== client.clientId || record.redirectUri !== redirectUri || !await verifyPkce(codeVerifier, record.codeChallenge)) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_grant");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_grant");
     }
     const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
       htm: "POST",
@@ -7645,7 +7659,7 @@ var oidcProviderRoutes = (config) => {
       proof: dpop
     });
     if (dpop !== undefined && dpopResult === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
     }
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
@@ -7662,11 +7676,11 @@ var oidcProviderRoutes = (config) => {
   const grantRefreshToken = async (client, body, dpop, clientCertThumbprint) => {
     const presented = body.refresh_token;
     if (presented === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const record = await refreshTokenStore.consumeToken(await hashToken(presented));
     if (record === undefined || record.expiresAt < Date.now() || record.clientId !== client.clientId) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_grant");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_grant");
     }
     if (record.dpopJkt !== undefined) {
       const proof = await verifyDpopProof({
@@ -7675,7 +7689,7 @@ var oidcProviderRoutes = (config) => {
         proof: dpop
       });
       if (proof === undefined || proof.jkt !== record.dpopJkt) {
-        return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+        return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
       }
     }
     return tokenResponse(await issueTokenSet({
@@ -7691,7 +7705,7 @@ var oidcProviderRoutes = (config) => {
   };
   const grantTokenExchange = async (client, body, dpop) => {
     if (body.subject_token === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
       htm: "POST",
@@ -7699,7 +7713,7 @@ var oidcProviderRoutes = (config) => {
       proof: dpop
     });
     if (dpop !== undefined && dpopResult === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
     }
     const result = await exchangeToken({
       actorClientId: client.clientId,
@@ -7710,21 +7724,21 @@ var oidcProviderRoutes = (config) => {
       subjectToken: body.subject_token
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({
       access_token: result.accessToken,
       expires_in: result.expiresIn,
       issued_token_type: "urn:ietf:params:oauth:token-type:access_token",
       scope: result.scope,
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
-    }, HTTP_OK2);
+    }, HTTP_OK3);
   };
   const grantBackchannel = async (client, body, dpop, clientCertThumbprint) => {
     if (config.backchannelAuthStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     if (body.auth_req_id === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
       htm: "POST",
@@ -7732,7 +7746,7 @@ var oidcProviderRoutes = (config) => {
       proof: dpop
     });
     if (dpop !== undefined && dpopResult === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
     }
     const result = await exchangeBackchannelAuth({
       authReqId: body.auth_req_id,
@@ -7742,7 +7756,7 @@ var oidcProviderRoutes = (config) => {
       dpopJkt: dpopResult?.jkt
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({
       access_token: result.access_token,
       expires_in: result.expires_in,
@@ -7750,14 +7764,14 @@ var oidcProviderRoutes = (config) => {
       refresh_token: result.refresh_token,
       scope: result.scope,
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
-    }, HTTP_OK2);
+    }, HTTP_OK3);
   };
   const grantDeviceCode = async (client, body, dpop) => {
     if (config.deviceAuthorizationStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     if (body.device_code === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
       htm: "POST",
@@ -7765,7 +7779,7 @@ var oidcProviderRoutes = (config) => {
       proof: dpop
     });
     if (dpop !== undefined && dpopResult === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
     }
     const result = await exchangeDeviceCode({
       clientId: client.clientId,
@@ -7774,7 +7788,7 @@ var oidcProviderRoutes = (config) => {
       dpopJkt: dpopResult?.jkt
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({
       access_token: result.access_token,
       expires_in: result.expires_in,
@@ -7782,7 +7796,7 @@ var oidcProviderRoutes = (config) => {
       refresh_token: result.refresh_token,
       scope: result.scope,
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
-    }, HTTP_OK2);
+    }, HTTP_OK3);
   };
   const grantTypes = [
     "authorization_code",
@@ -7895,7 +7909,7 @@ var oidcProviderRoutes = (config) => {
       requestedUri: query.post_logout_redirect_uri
     });
     if (redirectUri === undefined) {
-      return jsonResponse({ ok: true }, HTTP_OK2);
+      return jsonResponse({ ok: true }, HTTP_OK3);
     }
     const url = new URL(redirectUri);
     if (query.state !== undefined)
@@ -7916,11 +7930,11 @@ var oidcProviderRoutes = (config) => {
         store: config.pushedAuthorizationRequestStore
       });
       if (pushed === undefined) {
-        return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
+        return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST3);
       }
       effectiveQuery = pushed;
     } else if (query.request_uri !== undefined && query.request_uri.startsWith(REQUEST_URI_PREFIX)) {
-      return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
+      return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST3);
     }
     const initialClientId = effectiveQuery.client_id;
     const initialClient = initialClientId === undefined ? undefined : await resolveClient(initialClientId);
@@ -7931,7 +7945,7 @@ var oidcProviderRoutes = (config) => {
         jwt: effectiveQuery.request
       });
       if (!parsed.ok) {
-        return jsonResponse({ error: parsed.error }, HTTP_BAD_REQUEST2);
+        return jsonResponse({ error: parsed.error }, HTTP_BAD_REQUEST3);
       }
       effectiveQuery = {
         ...parsed.params,
@@ -7951,11 +7965,11 @@ var oidcProviderRoutes = (config) => {
     } = effectiveQuery;
     const client = initialClient;
     if (client === undefined || clientId !== client.clientId || redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
-      return jsonResponse({ error: "invalid_client" }, HTTP_BAD_REQUEST2);
+      return jsonResponse({ error: "invalid_client" }, HTTP_BAD_REQUEST3);
     }
     const responseMode = requestedResponseMode === "form_post" ? "form_post" : "query";
     if (requestedResponseMode !== undefined && requestedResponseMode !== "query" && requestedResponseMode !== "form_post") {
-      return jsonResponse({ error: "unsupported_response_mode" }, HTTP_BAD_REQUEST2);
+      return jsonResponse({ error: "unsupported_response_mode" }, HTTP_BAD_REQUEST3);
     }
     const errorRedirect = (error) => {
       const params2 = {
@@ -7999,7 +8013,7 @@ var oidcProviderRoutes = (config) => {
       if (wantsSilent) {
         return errorRedirect(userSession === undefined ? "login_required" : "interaction_required");
       }
-      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
+      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED4) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
     if (config.consentUrl !== undefined && await config.needsConsent?.({
@@ -8082,7 +8096,7 @@ var oidcProviderRoutes = (config) => {
     if (body.grant_type === PRE_AUTHORIZED_CODE_GRANT && config.vciConfig !== undefined) {
       const preAuthorizedCode = body["pre-authorized_code"];
       if (typeof preAuthorizedCode !== "string") {
-        return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+        return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
       }
       const result = await exchangePreAuthorizedCode({
         config: config.vciConfig,
@@ -8091,14 +8105,14 @@ var oidcProviderRoutes = (config) => {
         signingKey: config.vciConfig.signingKey ?? config.signingKey
       });
       if (!result.ok)
-        return oauthError2(HTTP_BAD_REQUEST2, result.error);
+        return oauthError2(HTTP_BAD_REQUEST3, result.error);
       return jsonResponse({
         access_token: result.access_token,
         c_nonce: result.c_nonce,
         c_nonce_expires_in: result.c_nonce_expires_in,
         expires_in: result.expires_in,
         token_type: result.token_type
-      }, HTTP_OK2);
+      }, HTTP_OK3);
     }
     if (typeof body.grant_type === "string" && config.publicTokenGrantTypes?.includes(body.grant_type) === true && config.handlePublicTokenGrant !== undefined) {
       const result = await config.handlePublicTokenGrant({
@@ -8120,7 +8134,7 @@ var oidcProviderRoutes = (config) => {
       requestHeaders: request.headers
     });
     if (auth === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const { client, clientCertThumbprint } = auth;
     const nonceChallenge = await dpopNonceChallenge(headers.dpop);
@@ -8141,7 +8155,7 @@ var oidcProviderRoutes = (config) => {
     if (body.grant_type === CIBA_GRANT_TYPE) {
       return grantBackchannel(client, body, headers.dpop, clientCertThumbprint);
     }
-    return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+    return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
   }, {
     body: t14.Object({
       assertion: t14.Optional(t14.String()),
@@ -8179,7 +8193,7 @@ var oidcProviderRoutes = (config) => {
       requestHeaders: request.headers
     });
     if (auth === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const { client } = auth;
     const isAuthField = (key) => key === "client_assertion" || key === "client_assertion_type" || key === "client_secret";
@@ -8190,7 +8204,7 @@ var oidcProviderRoutes = (config) => {
       store: config.pushedAuthorizationRequestStore,
       ttlMs: config.pushedAuthorizationRequestTtlMs
     });
-    return jsonResponse(result.body, result.ok ? HTTP_OK2 : result.status);
+    return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
   }, {
     body: t14.Object({
       acr_values: t14.Optional(t14.String()),
@@ -8217,11 +8231,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const result = await introspectToken({
       config,
@@ -8229,7 +8243,7 @@ var oidcProviderRoutes = (config) => {
       now: Date.now(),
       token: body.token
     });
-    return jsonResponse(result, HTTP_OK2);
+    return jsonResponse(result, HTTP_OK3);
   }, {
     body: t14.Object({
       client_id: t14.Optional(t14.String()),
@@ -8245,16 +8259,16 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     if (body.token_type_hint !== "access_token") {
       await revokeRefreshToken(config, body.token);
     }
-    return new Response(null, { status: HTTP_OK2 });
+    return new Response(null, { status: HTTP_OK3 });
   }, {
     body: t14.Object({
       client_id: t14.Optional(t14.String()),
@@ -8267,20 +8281,20 @@ var oidcProviderRoutes = (config) => {
     })
   }).post(backchannelAuthorizationRoute, async ({ body, headers }) => {
     if (config.backchannelAuthStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     const basic = readBasicAuth2(headers.authorization);
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     if (body.login_hint === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const requested = body.scope === undefined || body.scope.length === 0 ? client.scopes : body.scope.split(" ").filter((entry) => client.scopes.includes(entry));
     const result = await issueBackchannelAuth({
@@ -8292,12 +8306,12 @@ var oidcProviderRoutes = (config) => {
       requestedScopes: requested
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({
       auth_req_id: result.auth_req_id,
       expires_in: result.expires_in,
       interval: result.interval
-    }, HTTP_OK2);
+    }, HTTP_OK3);
   }, {
     body: t14.Object({
       binding_message: t14.Optional(t14.String()),
@@ -8311,17 +8325,17 @@ var oidcProviderRoutes = (config) => {
     })
   }).post(deviceAuthorizationRoute, async ({ body, headers }) => {
     if (config.deviceAuthorizationStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     const basic = readBasicAuth2(headers.authorization);
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const requested = body.scope === undefined || body.scope.length === 0 ? client.scopes : body.scope.split(" ").filter((entry) => client.scopes.includes(entry));
     const response = await issueDeviceAuthorization({
@@ -8330,7 +8344,7 @@ var oidcProviderRoutes = (config) => {
       now: Date.now(),
       requestedScopes: requested
     });
-    return jsonResponse(response, HTTP_OK2);
+    return jsonResponse(response, HTTP_OK3);
   }, {
     body: t14.Object({
       client_id: t14.Optional(t14.String()),
@@ -8342,7 +8356,7 @@ var oidcProviderRoutes = (config) => {
     })
   }).post(deviceApproveRoute, async ({ body, cookie: { user_session_id }, store }) => {
     if (config.deviceAuthorizationStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     const userSession = await loadSessionFromSource({
       authSessionStore,
@@ -8350,7 +8364,7 @@ var oidcProviderRoutes = (config) => {
       userSessionId: user_session_id.value
     });
     if (userSession === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "login_required");
+      return oauthError2(HTTP_UNAUTHORIZED4, "login_required");
     }
     const result = body.action === "deny" ? await denyDeviceAuthorization({
       config,
@@ -8361,8 +8375,8 @@ var oidcProviderRoutes = (config) => {
       userSub: getUserId(userSession.user)
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
-    return jsonResponse({ ok: true }, HTTP_OK2);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
+    return jsonResponse({ ok: true }, HTTP_OK3);
   }, {
     body: t14.Object({
       action: t14.Optional(t14.Union([t14.Literal("approve"), t14.Literal("deny")])),
@@ -8414,7 +8428,7 @@ var oidcProviderRoutes = (config) => {
       registrationBaseUrl,
       registrationTokenStore: config.clientRegistrationTokenStore
     });
-    return jsonResponse(result.body, result.ok ? HTTP_OK2 : result.status);
+    return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
   }, {
     body: t14.Object({
       backchannel_logout_uri: t14.Optional(t14.String()),
@@ -8501,10 +8515,10 @@ var oidcProviderRoutes = (config) => {
           "content-type": "application/json",
           "www-authenticate": userInfoChallengeHeader(result.error)
         },
-        status: HTTP_UNAUTHORIZED2
+        status: HTTP_UNAUTHORIZED4
       });
     }
-    return jsonResponse(result.body, HTTP_OK2);
+    return jsonResponse(result.body, HTTP_OK3);
   }, {
     headers: t14.Object({
       authorization: t14.Optional(t14.String())
@@ -8518,10 +8532,10 @@ var oidcProviderRoutes = (config) => {
           "content-type": "application/json",
           "www-authenticate": userInfoChallengeHeader(result.error)
         },
-        status: HTTP_UNAUTHORIZED2
+        status: HTTP_UNAUTHORIZED4
       });
     }
-    return jsonResponse(result.body, HTTP_OK2);
+    return jsonResponse(result.body, HTTP_OK3);
   }, {
     body: t14.Object({
       access_token: t14.Optional(t14.String())
@@ -25039,9 +25053,9 @@ var createInMemoryCredentialOfferStore = () => {
 };
 // src/oidc/vciRoutes.ts
 import { Elysia as Elysia38, t as t33 } from "elysia";
-var HTTP_OK3 = 200;
-var HTTP_BAD_REQUEST3 = 400;
-var HTTP_UNAUTHORIZED3 = 401;
+var HTTP_OK4 = 200;
+var HTTP_BAD_REQUEST4 = 400;
+var HTTP_UNAUTHORIZED5 = 401;
 var BEARER_PREFIX5 = "Bearer ";
 var errorBody = (error, status) => new Response(JSON.stringify({ error }), {
   headers: { "content-type": "application/json" },
@@ -25070,7 +25084,7 @@ var vciRoutes = ({
   }))).post(credentialRoute, async ({ body, headers }) => {
     const accessToken = extractBearer(headers.authorization);
     if (accessToken === undefined) {
-      return errorBody("invalid_token", HTTP_UNAUTHORIZED3);
+      return errorBody("invalid_token", HTTP_UNAUTHORIZED5);
     }
     const result = await issueCredential({
       config: vciConfig,
@@ -25083,8 +25097,8 @@ var vciRoutes = ({
       signingKey: vciSigningKey
     });
     if (!result.ok)
-      return errorBody(result.error, HTTP_BAD_REQUEST3);
-    return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK3 });
+      return errorBody(result.error, HTTP_BAD_REQUEST4);
+    return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK4 });
   }, {
     body: t33.Object({
       format: t33.Optional(t33.Union([t33.Literal("vc+sd-jwt")])),
@@ -25095,7 +25109,7 @@ var vciRoutes = ({
     })
   }).post(nonceRoute, async () => {
     if (vciConfig.credentialNonceStore === undefined) {
-      return errorBody("not_supported", HTTP_BAD_REQUEST3);
+      return errorBody("not_supported", HTTP_BAD_REQUEST4);
     }
     const { generateSecureToken: generateSecureToken2, hashToken: hashToken2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
     const nonceBytes = 16;
@@ -25109,7 +25123,7 @@ var vciRoutes = ({
     return Response.json({
       c_nonce: nonce,
       c_nonce_expires_in: Math.floor(ttlMs / msPerSecond)
-    }, { status: HTTP_OK3 });
+    }, { status: HTTP_OK4 });
   });
 };
 // src/vc/statusList.ts
@@ -25213,7 +25227,7 @@ var verifyStatusListJwt = async ({
 };
 // src/vc/statusListRoutes.ts
 import { Elysia as Elysia39, t as t34 } from "elysia";
-var HTTP_OK4 = 200;
+var HTTP_OK5 = 200;
 var HTTP_NOT_FOUND = 404;
 var DEFAULT_STATUS_ROUTE = "/vc/status";
 var statusListRoutes = ({
@@ -25238,7 +25252,7 @@ var statusListRoutes = ({
     });
     return new Response(jwt, {
       headers: { "content-type": STATUS_LIST_SUB_TYP },
-      status: HTTP_OK4
+      status: HTTP_OK5
     });
   }, { params: t34.Object({ listId: t34.String() }) });
 };
@@ -25446,8 +25460,8 @@ var createInMemoryPresentationRequestStore = () => {
 };
 // src/vc/vpRoutes.ts
 import { Elysia as Elysia40, t as t35 } from "elysia";
-var HTTP_OK5 = 200;
-var HTTP_BAD_REQUEST4 = 400;
+var HTTP_OK6 = 200;
+var HTTP_BAD_REQUEST5 = 400;
 var HTTP_NOT_FOUND2 = 404;
 var errorBody2 = (error, status) => new Response(JSON.stringify({ error }), {
   headers: { "content-type": "application/json" },
@@ -25480,7 +25494,7 @@ var vpRoutes = ({
       nonce: result.nonce,
       request_uri: result.requestUri,
       requestId: result.request.requestId
-    }, { status: HTTP_OK5 });
+    }, { status: HTTP_OK6 });
   }, {
     body: t35.Object({
       client_id: t35.Optional(t35.String()),
@@ -25509,19 +25523,19 @@ var vpRoutes = ({
       headers: {
         "content-type": "application/oauth-authz-req+jwt"
       },
-      status: HTTP_OK5
+      status: HTTP_OK6
     });
   }, { params: t35.Object({ id: t35.String() }) }).post(responseRoute, async ({ body }) => {
     const requestId = body.state;
     if (requestId === undefined) {
-      return errorBody2("missing_state", HTTP_BAD_REQUEST4);
+      return errorBody2("missing_state", HTTP_BAD_REQUEST5);
     }
     const result = await verifyPresentationResponse({
       config: vpConfig,
       input: { requestId, vpToken: body.vp_token }
     });
     if (!result.ok)
-      return errorBody2(result.error, HTTP_BAD_REQUEST4);
+      return errorBody2(result.error, HTTP_BAD_REQUEST5);
     if (onVerifiedPresentation !== undefined) {
       await onVerifiedPresentation({ verified: result.verified });
     }
@@ -25530,7 +25544,7 @@ var vpRoutes = ({
       holder_jwk: result.verified.holderJwk,
       protected_claims: result.verified.protectedClaims,
       verified: true
-    }, { status: HTTP_OK5 });
+    }, { status: HTTP_OK6 });
   }, {
     body: t35.Object({
       presentation_submission: t35.Optional(t35.Unknown()),
@@ -28640,17 +28654,17 @@ var blockMigrations = {
 };
 // src/sso/samlIdpRoutes.ts
 import { Elysia as Elysia41, t as t36 } from "elysia";
-var HTTP_BAD_REQUEST5 = 400;
-var HTTP_UNAUTHORIZED4 = 401;
+var HTTP_BAD_REQUEST6 = 400;
+var HTTP_UNAUTHORIZED6 = 401;
 var HTTP_FOUND2 = 302;
-var HTTP_OK6 = 200;
+var HTTP_OK7 = 200;
 var xmlResponse = (body) => new Response(body, {
   headers: { "content-type": "application/samlmetadata+xml" },
-  status: HTTP_OK6
+  status: HTTP_OK7
 });
 var htmlResponse = (body) => new Response(body, {
   headers: { "content-type": "text/html; charset=utf-8" },
-  status: HTTP_OK6
+  status: HTTP_OK7
 });
 var redirectTo2 = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND2 });
 var errorJson = (status, error) => new Response(JSON.stringify({ error }), {
@@ -28702,7 +28716,7 @@ var samlIdpRoutes = ({
     userSessionIdValue
   }) => {
     if (body.SAMLRequest === undefined) {
-      return errorJson(HTTP_BAD_REQUEST5, "missing_saml_request");
+      return errorJson(HTTP_BAD_REQUEST6, "missing_saml_request");
     }
     let firstPass;
     try {
@@ -28711,11 +28725,11 @@ var samlIdpRoutes = ({
         samlRequest: body.SAMLRequest
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST5, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST6, "invalid_authn_request");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(firstPass.issuer);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST5, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST6, "unknown_service_provider");
     }
     let parsed;
     try {
@@ -28728,7 +28742,7 @@ var samlIdpRoutes = ({
         signedQueryString: binding === "Redirect" ? new URL(request.url).search.slice(1) : undefined
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST5, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST6, "invalid_authn_request");
     }
     const userSession = await loadSessionFromSource({
       authSessionStore,
@@ -28737,7 +28751,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined || parsed.forceAuthn === true) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED4, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED6, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -28786,11 +28800,11 @@ var samlIdpRoutes = ({
     store
   }) => {
     if (serviceProviderEntityId === undefined) {
-      return errorJson(HTTP_BAD_REQUEST5, "missing_sp");
+      return errorJson(HTTP_BAD_REQUEST6, "missing_sp");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(serviceProviderEntityId);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST5, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST6, "unknown_service_provider");
     }
     const userSession = authSessionStore === undefined ? await loadSessionFromSource({
       session: store.session,
@@ -28802,7 +28816,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED4, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED6, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -29815,5 +29829,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=8E4D1AD9D7CAB11764756E2164756E21
+//# debugId=394E6CA4C2DE944764756E2164756E21
 //# sourceMappingURL=index.js.map