@absolutejs/auth 0.56.19 → 0.57.1

package/dist/agents/index.js

@@ -1261,35 +1261,6 @@ var secureUrl3 = (value) => {
     return false;
   }
 };
-var validateClientIdMetadataDocument = (document, expectedClientId) => {
-  const errors = [];
-  if (document.client_id !== expectedClientId)
-    errors.push("client_id does not match the metadata document URL");
-  if (!secureUrl3(document.client_id))
-    errors.push("client_id must use HTTPS");
-  if (!Array.isArray(document.redirect_uris) || document.redirect_uris.length === 0)
-    errors.push("redirect_uris is required");
-  for (const uri of document.redirect_uris ?? []) {
-    try {
-      const parsed = new URL(uri);
-      if (parsed.protocol !== "https:" && parsed.hostname !== "localhost")
-        errors.push("redirect URIs must use HTTPS or localhost");
-    } catch {
-      errors.push("redirect URI is invalid");
-    }
-  }
-  for (const [name, value] of [
-    ["client_uri", document.client_uri],
-    ["logo_uri", document.logo_uri],
-    ["policy_uri", document.policy_uri],
-    ["tos_uri", document.tos_uri],
-    ["jwks_uri", document.jwks_uri]
-  ]) {
-    if (value !== undefined && !secureUrl3(value))
-      errors.push(`${name} must use HTTPS`);
-  }
-  return errors;
-};
 var clientIdMetadataToOAuthClient = (document) => ({
   clientId: document.client_id,
   grantTypes: document.grant_types ?? ["authorization_code", "refresh_token"],
@@ -1338,6 +1309,43 @@ var createClientIdMetadataResolver = ({
     return client;
   };
 };
+var validateRedirectUri = (uri) => {
+  try {
+    const parsed = new URL(uri);
+    if (parsed.protocol === "https:" || parsed.hostname === "localhost")
+      return;
+    return "redirect URIs must use HTTPS or localhost";
+  } catch {
+    return "redirect URI is invalid";
+  }
+};
+var validateSecureMetadataUrl = (name, value) => value !== undefined && !secureUrl3(value) ? `${name} must use HTTPS` : undefined;
+var validateClientIdMetadataDocument = (document, expectedClientId) => {
+  const errors = [];
+  if (document.client_id !== expectedClientId)
+    errors.push("client_id does not match the metadata document URL");
+  if (!secureUrl3(document.client_id))
+    errors.push("client_id must use HTTPS");
+  if (!Array.isArray(document.redirect_uris) || document.redirect_uris.length === 0)
+    errors.push("redirect_uris is required");
+  for (const uri of document.redirect_uris ?? []) {
+    const error = validateRedirectUri(uri);
+    if (error !== undefined)
+      errors.push(error);
+  }
+  for (const [name, value] of [
+    ["client_uri", document.client_uri],
+    ["logo_uri", document.logo_uri],
+    ["policy_uri", document.policy_uri],
+    ["tos_uri", document.tos_uri],
+    ["jwks_uri", document.jwks_uri]
+  ]) {
+    const error = validateSecureMetadataUrl(name, value);
+    if (error !== undefined)
+      errors.push(error);
+  }
+  return errors;
+};
 // src/oidc/dpop.ts
 init_constants();
 var DEFAULT_MAX_AGE_MS = 60000;
@@ -1359,7 +1367,7 @@ var extractDpopNonceClaim = (proof) => {
     const payload = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
     if (typeof payload !== "object" || payload === null)
       return;
-    const value = payload.nonce;
+    const value = Reflect.get(payload, "nonce");
     return typeof value === "string" ? value : undefined;
   } catch {
     return;
@@ -13449,7 +13457,6 @@ var portableJsonb = customType({
   fromDriver: (value) => typeof value === "string" ? JSON.parse(value) : value,
   toDriver: (value) => JSON.stringify(value)
 });
-var encodedJsonb = (value) => sql`${JSON.stringify(value)}::text::jsonb`;
 var agentDelegationsTable = pgTable("auth_agent_delegations", {
   agent_id: varchar("agent_id", { length: ID_LENGTH }).notNull(),
   authorization_details: portableJsonb("authorization_details").$type(),
@@ -13551,7 +13558,7 @@ var toIdentityRegistration = (row) => ({
 });
 var identityRegistrationValues = (registration) => ({
   agent_id: registration.agentId,
-  claim_attempt: registration.claimAttempt === undefined ? null : encodedJsonb(registration.claimAttempt),
+  claim_attempt: registration.claimAttempt === undefined ? null : registration.claimAttempt,
   claim_attempt_token_hash: registration.claimAttempt?.tokenHash ?? null,
   claim_expires_at_ms: registration.claimExpiresAt,
   claim_token_hash: registration.claimTokenHash,
@@ -13595,12 +13602,12 @@ var createDrizzleAgentDelegationStore = (db) => ({
   saveDelegation: async (delegation) => {
     const values = {
       agent_id: delegation.agentId,
-      authorization_details: delegation.authorizationDetails === undefined ? null : encodedJsonb(delegation.authorizationDetails),
+      authorization_details: delegation.authorizationDetails === undefined ? null : delegation.authorizationDetails,
       created_at_ms: delegation.createdAt,
       delegation_id: delegation.delegationId,
       expires_at_ms: delegation.expiresAt ?? null,
       organization_id: delegation.organizationId ?? null,
-      scopes: encodedJsonb(delegation.scopes),
+      scopes: delegation.scopes,
       status: delegation.status,
       updated_at_ms: delegation.updatedAt,
       user_id: delegation.userId
@@ -13663,10 +13670,10 @@ var createPostgresAgentRegistrationStore = (db) => ({
   saveRegistration: async (registration) => {
     const values = {
       agent_id: registration.agentId,
-      allowed_scopes: encodedJsonb(registration.allowedScopes),
+      allowed_scopes: registration.allowedScopes,
       client_id: registration.clientId ?? null,
       created_at_ms: registration.createdAt,
-      metadata: registration.metadata === undefined ? null : encodedJsonb(registration.metadata),
+      metadata: registration.metadata === undefined ? null : registration.metadata,
       name: registration.name,
       status: registration.status,
       updated_at_ms: registration.updatedAt
@@ -13725,5 +13732,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=E730925598B6D00864756E2164756E21
+//# debugId=4DE3AC96009973EC64756E2164756E21
 //# sourceMappingURL=index.js.map