@absolutejs/auth 0.55.1 → 0.55.2

package/dist/oidc/routes.d.ts

@@ -201,8 +201,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             body: {
                 client_id?: string | undefined;
                 scope?: string | undefined;
-                login_hint?: string | undefined;
                 client_secret?: string | undefined;
+                login_hint?: string | undefined;
                 binding_message?: string | undefined;
             };
             params: {};

package/dist/server.js

@@ -3044,9 +3044,6 @@ var apiKeysRoutes = ({
   });
 };
 
-// src/agents/routes.ts
-import { Elysia as Elysia2 } from "elysia";
-
 // src/agents/config.ts
 var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resource";
 var agentProtectedResourceMetadata = (config) => ({
@@ -3058,6 +3055,9 @@ var agentProtectedResourceMetadata = (config) => ({
   scopes_supported: config.scopes
 });
 
+// src/agents/context.ts
+import { Elysia as Elysia2 } from "elysia";
+
 // src/agents/principal.ts
 var intersectScopes = (...sets) => {
   if (sets.length === 0)
@@ -3112,6 +3112,77 @@ var resolveAgentPrincipal = async (request, config) => {
   };
 };
 
+// src/agents/context.ts
+var DELETE_CODE_POINT = 127;
+var HTTP_FORBIDDEN = 403;
+var HTTP_UNAUTHORIZED2 = 401;
+var MINIMUM_PRINTABLE_CODE_POINT = 32;
+var quoteHeaderValue = (value) => {
+  const printable = [...value].filter((character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint >= MINIMUM_PRINTABLE_CODE_POINT && codePoint !== DELETE_CODE_POINT;
+  }).join("");
+  return `"${printable.replace(/[\\"]/g, "\\$&")}"`;
+};
+var agentAuthChallenge = ({
+  config,
+  error,
+  requiredScopes = []
+}) => {
+  const parameters = [
+    `resource_metadata=${quoteHeaderValue(agentResourceMetadataUrl(config))}`
+  ];
+  if (requiredScopes.length > 0) {
+    parameters.push(`scope=${quoteHeaderValue(requiredScopes.join(" "))}`);
+  }
+  if (error !== undefined) {
+    parameters.push(`error=${quoteHeaderValue(error)}`);
+  }
+  return `Bearer ${parameters.join(", ")}`;
+};
+var agentResourceMetadataUrl = (config) => new URL(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, config.resource).toString();
+var failureResponse = (config, failure, requiredScopes) => new Response(JSON.stringify({
+  error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
+  error_description: failure.message
+}), {
+  headers: {
+    "content-type": "application/json",
+    "www-authenticate": agentAuthChallenge({
+      config,
+      error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
+      requiredScopes
+    })
+  },
+  status: failure.code === "Forbidden" ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED2
+});
+var agentAuthContextPlugin = (config) => new Elysia2().derive(({ request }) => ({
+  protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
+    if (config === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: HTTP_UNAUTHORIZED2 });
+    }
+    const principal = await resolveAgentPrincipal(request, config);
+    if (principal === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    if (!agentHasScopes(principal, requiredScopes)) {
+      const failure = {
+        code: "Forbidden",
+        message: "Insufficient agent scopes"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    return handleAuth(principal);
+  }
+}));
+
 // src/agents/registration.ts
 init_constants();
 init_crypto();
@@ -3780,50 +3851,9 @@ var revokeAgentIdentityRegistration = async (config, registrationId, now = Date.
 };
 
 // src/agents/routes.ts
-var DELETE_CODE_POINT = 127;
 var HTTP_BAD_REQUEST2 = 400;
-var HTTP_FORBIDDEN = 403;
 var HTTP_OK2 = 200;
-var HTTP_UNAUTHORIZED2 = 401;
-var MINIMUM_PRINTABLE_CODE_POINT = 32;
-var quoteHeaderValue = (value) => {
-  const printable = [...value].filter((character) => {
-    const codePoint = character.codePointAt(0) ?? 0;
-    return codePoint >= MINIMUM_PRINTABLE_CODE_POINT && codePoint !== DELETE_CODE_POINT;
-  }).join("");
-  return `"${printable.replace(/[\\"]/g, "\\$&")}"`;
-};
-var agentAuthChallenge = ({
-  config,
-  error,
-  requiredScopes = []
-}) => {
-  const parameters = [
-    `resource_metadata=${quoteHeaderValue(agentResourceMetadataUrl(config))}`
-  ];
-  if (requiredScopes.length > 0) {
-    parameters.push(`scope=${quoteHeaderValue(requiredScopes.join(" "))}`);
-  }
-  if (error !== undefined) {
-    parameters.push(`error=${quoteHeaderValue(error)}`);
-  }
-  return `Bearer ${parameters.join(", ")}`;
-};
-var agentResourceMetadataUrl = (config) => new URL(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, config.resource).toString();
-var failureResponse = (config, failure, requiredScopes) => new Response(JSON.stringify({
-  error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
-  error_description: failure.message
-}), {
-  headers: {
-    "content-type": "application/json",
-    "www-authenticate": agentAuthChallenge({
-      config,
-      error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
-      requiredScopes
-    })
-  },
-  status: failure.code === "Forbidden" ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED2
-});
+var HTTP_UNAUTHORIZED3 = 401;
 var json = (value, status = HTTP_OK2) => new Response(JSON.stringify(value), {
   headers: {
     "cache-control": "no-store",
@@ -3858,7 +3888,7 @@ var registrationResponse = (result) => {
       ...body,
       error: "interaction_required",
       error_description: "Authenticate at the service and confirm the account link."
-    }, HTTP_UNAUTHORIZED2);
+    }, HTTP_UNAUTHORIZED3);
   }
   return json(body);
 };
@@ -3885,33 +3915,6 @@ var parseRegistrationInput = (value) => {
   return input;
 };
 var escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
-var agentAuthContextPlugin = (config) => new Elysia2().derive(({ request }) => ({
-  protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
-    if (config === undefined) {
-      const failure = {
-        code: "Unauthorized",
-        message: "Agent is not authenticated"
-      };
-      return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: 401 });
-    }
-    const principal = await resolveAgentPrincipal(request, config);
-    if (principal === undefined) {
-      const failure = {
-        code: "Unauthorized",
-        message: "Agent is not authenticated"
-      };
-      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-    }
-    if (!agentHasScopes(principal, requiredScopes)) {
-      const failure = {
-        code: "Forbidden",
-        message: "Insufficient agent scopes"
-      };
-      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-    }
-    return handleAuth(principal);
-  }
-}));
 var agentAuthPlugin = (config) => {
   const plugin = agentAuthContextPlugin(config);
   if (config === undefined)
@@ -7460,7 +7463,7 @@ var HTTP_OK3 = 200;
 var HTTP_NO_CONTENT = 204;
 var HTTP_FOUND = 302;
 var HTTP_BAD_REQUEST3 = 400;
-var HTTP_UNAUTHORIZED3 = 401;
+var HTTP_UNAUTHORIZED4 = 401;
 var HTTP_NOT_IMPLEMENTED = 501;
 var CODE_TTL_MINUTES = 10;
 var CODE_TTL_MS = MILLISECONDS_IN_A_MINUTE * CODE_TTL_MINUTES;
@@ -7634,7 +7637,7 @@ var oidcProviderRoutes = (config) => {
         "dpop-nonce": fresh,
         "www-authenticate": 'DPoP error="use_dpop_nonce"'
       },
-      status: HTTP_UNAUTHORIZED3
+      status: HTTP_UNAUTHORIZED4
     });
   };
   const grantAuthorizationCode = async (client, body, dpop, clientCertThumbprint) => {
@@ -8010,7 +8013,7 @@ var oidcProviderRoutes = (config) => {
       if (wantsSilent) {
         return errorRedirect(userSession === undefined ? "login_required" : "interaction_required");
       }
-      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED3) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
+      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED4) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
     if (config.consentUrl !== undefined && await config.needsConsent?.({
@@ -8131,7 +8134,7 @@ var oidcProviderRoutes = (config) => {
       requestHeaders: request.headers
     });
     if (auth === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const { client, clientCertThumbprint } = auth;
     const nonceChallenge = await dpopNonceChallenge(headers.dpop);
@@ -8190,7 +8193,7 @@ var oidcProviderRoutes = (config) => {
       requestHeaders: request.headers
     });
     if (auth === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const { client } = auth;
     const isAuthField = (key) => key === "client_assertion" || key === "client_assertion_type" || key === "client_secret";
@@ -8228,11 +8231,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const result = await introspectToken({
       config,
@@ -8256,11 +8259,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     if (body.token_type_hint !== "access_token") {
       await revokeRefreshToken(config, body.token);
@@ -8284,11 +8287,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     if (body.login_hint === undefined) {
       return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
@@ -8328,11 +8331,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const requested = body.scope === undefined || body.scope.length === 0 ? client.scopes : body.scope.split(" ").filter((entry) => client.scopes.includes(entry));
     const response = await issueDeviceAuthorization({
@@ -8361,7 +8364,7 @@ var oidcProviderRoutes = (config) => {
       userSessionId: user_session_id.value
     });
     if (userSession === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "login_required");
+      return oauthError2(HTTP_UNAUTHORIZED4, "login_required");
     }
     const result = body.action === "deny" ? await denyDeviceAuthorization({
       config,
@@ -8512,7 +8515,7 @@ var oidcProviderRoutes = (config) => {
           "content-type": "application/json",
           "www-authenticate": userInfoChallengeHeader(result.error)
         },
-        status: HTTP_UNAUTHORIZED3
+        status: HTTP_UNAUTHORIZED4
       });
     }
     return jsonResponse(result.body, HTTP_OK3);
@@ -8529,7 +8532,7 @@ var oidcProviderRoutes = (config) => {
           "content-type": "application/json",
           "www-authenticate": userInfoChallengeHeader(result.error)
         },
-        status: HTTP_UNAUTHORIZED3
+        status: HTTP_UNAUTHORIZED4
       });
     }
     return jsonResponse(result.body, HTTP_OK3);
@@ -25052,7 +25055,7 @@ var createInMemoryCredentialOfferStore = () => {
 import { Elysia as Elysia38, t as t33 } from "elysia";
 var HTTP_OK4 = 200;
 var HTTP_BAD_REQUEST4 = 400;
-var HTTP_UNAUTHORIZED4 = 401;
+var HTTP_UNAUTHORIZED5 = 401;
 var BEARER_PREFIX5 = "Bearer ";
 var errorBody = (error, status) => new Response(JSON.stringify({ error }), {
   headers: { "content-type": "application/json" },
@@ -25081,7 +25084,7 @@ var vciRoutes = ({
   }))).post(credentialRoute, async ({ body, headers }) => {
     const accessToken = extractBearer(headers.authorization);
     if (accessToken === undefined) {
-      return errorBody("invalid_token", HTTP_UNAUTHORIZED4);
+      return errorBody("invalid_token", HTTP_UNAUTHORIZED5);
     }
     const result = await issueCredential({
       config: vciConfig,
@@ -28652,7 +28655,7 @@ var blockMigrations = {
 // src/sso/samlIdpRoutes.ts
 import { Elysia as Elysia41, t as t36 } from "elysia";
 var HTTP_BAD_REQUEST6 = 400;
-var HTTP_UNAUTHORIZED5 = 401;
+var HTTP_UNAUTHORIZED6 = 401;
 var HTTP_FOUND2 = 302;
 var HTTP_OK7 = 200;
 var xmlResponse = (body) => new Response(body, {
@@ -28748,7 +28751,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined || parsed.forceAuthn === true) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED5, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED6, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -28813,7 +28816,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED5, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED6, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -29358,5 +29361,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=D6C26946999A57D364756E2164756E21
+//# debugId=1844495EF9D2CC3164756E2164756E21
 //# sourceMappingURL=server.js.map