@absolutejs/auth 0.56.0 → 0.56.2

package/README.md

@@ -4,6 +4,8 @@ Server applications should import the primary authentication contract from
 `@absolutejs/auth/server`. This declaration-stable entry point exposes `auth`,
 session types, route protection, provider configuration, and the other core
 server utilities without loading declarations for every optional Auth feature.
+OIDC provider integrations should likewise import signing keys, token
+verification, provider stores, and provider types from `@absolutejs/auth/oidc`.
 The root entry point remains available for applications that need the complete
 feature export surface. `auth()` exposes the complete reusable request context
 (`protectRoute`, `requireRecentAuth`, optional `protectPermission`, and

package/dist/cli/migrate.js

@@ -2617,6 +2617,16 @@ import {
 } from "drizzle-orm/pg-core";
 var URL_LENGTH = 2048;
 var ID_LENGTH8 = 255;
+var BACKCHANNEL_AUTH_STATUSES = new Set([
+  "approved",
+  "denied",
+  "pending"
+]);
+var DEVICE_AUTHORIZATION_STATUSES = new Set([
+  "approved",
+  "denied",
+  "pending"
+]);
 var oauthBackchannelAuthRequestsTable = pgTable10("auth_oauth_backchannel_auth_requests", {
   auth_req_id: varchar10("auth_req_id", { length: ID_LENGTH8 }).primaryKey(),
   binding_message: text5("binding_message"),
@@ -2661,6 +2671,7 @@ var oauthClientsTable = pgTable10("auth_oauth_clients", {
 });
 var oauthCodesTable = pgTable10("auth_oauth_codes", {
   acr: varchar10("acr", { length: ID_LENGTH8 }),
+  audience: varchar10("audience", { length: URL_LENGTH }),
   claims_json: jsonb5("claims_json").$type(),
   client_id: varchar10("client_id", { length: ID_LENGTH8 }).notNull(),
   code_challenge: varchar10("code_challenge", { length: ID_LENGTH8 }).notNull(),
@@ -2713,6 +2724,7 @@ var oauthPushedAuthorizationRequestsTable = pgTable10("auth_oauth_pushed_authori
 });
 var oauthRefreshTokensTable = pgTable10("auth_oauth_refresh_tokens", {
   acr: varchar10("acr", { length: ID_LENGTH8 }),
+  audience: varchar10("audience", { length: URL_LENGTH }),
   claims_json: jsonb5("claims_json").$type(),
   client_id: varchar10("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint8("created_at_ms", { mode: "number" }).notNull(),
@@ -3118,6 +3130,14 @@ var mfaTotpLockoutMigration = {
   id: "0003_totp_lockout",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
 };
+var oidcResourceAudienceMigration = {
+  id: "0002_resource_audience",
+  sql: [
+    'ALTER TABLE "auth_oauth_codes" ADD COLUMN IF NOT EXISTS "audience" varchar(2048);',
+    'ALTER TABLE "auth_oauth_refresh_tokens" ADD COLUMN IF NOT EXISTS "audience" varchar(2048);'
+  ].join(`
+`)
+};
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
   agents: {
@@ -3159,18 +3179,24 @@ var blockMigrations = {
       mfaTotpLockoutMigration
     ]
   },
-  oidc: initMigration("oidc", [
-    oauthBackchannelAuthRequestsTable,
-    oauthClientAssertionJtisTable,
-    oauthClientRegistrationTokensTable,
-    oauthClientsTable,
-    oauthCodesTable,
-    oauthDeviceAuthorizationsTable,
-    oauthInitialAccessTokensTable,
-    oauthLogoutDeliveriesTable,
-    oauthPushedAuthorizationRequestsTable,
-    oauthRefreshTokensTable
-  ]),
+  oidc: {
+    block: "oidc",
+    migrations: [
+      ...initMigration("oidc", [
+        oauthBackchannelAuthRequestsTable,
+        oauthClientAssertionJtisTable,
+        oauthClientRegistrationTokensTable,
+        oauthClientsTable,
+        oauthCodesTable,
+        oauthDeviceAuthorizationsTable,
+        oauthInitialAccessTokensTable,
+        oauthLogoutDeliveriesTable,
+        oauthPushedAuthorizationRequestsTable,
+        oauthRefreshTokensTable
+      ]).migrations,
+      oidcResourceAudienceMigration
+    ]
+  },
   organizations: initMigration("organizations", [
     organizationsTable,
     organizationMembershipsTable,
@@ -3362,5 +3388,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=2CDEAF9E7315372064756E2164756E21
+//# debugId=8A2517B7159F359864756E2164756E21
 //# sourceMappingURL=migrate.js.map