@absolutejs/auth 0.56.5 → 0.56.7

package/dist/oidc/types.d.ts

@@ -80,12 +80,17 @@ export type OidcRefreshToken = {
     tokenHash: string;
     userId: string;
 };
+export type OidcRefreshTokenConnection = {
+    clientId: string;
+    userId: string;
+};
 export type OidcRefreshTokenStore = {
     consumeToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
     deleteForUser: (userId: string) => Promise<void>;
     deleteForUserClient: (userId: string, clientId: string) => Promise<number>;
     getToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
     listClientIdsForUser: (userId: string) => Promise<string[]>;
+    listConnections: () => Promise<OidcRefreshTokenConnection[]>;
     saveToken: (token: OidcRefreshToken) => Promise<void>;
 };
 export type DeviceAuthorizationStatus = 'approved' | 'denied' | 'pending';

package/dist/server.js

@@ -8193,6 +8193,12 @@ var oidcProviderRoutes = (config) => {
       return errorRedirect("insufficient_user_authentication");
     }
     const code = generateSecureToken(TOKEN_BYTES4);
+    const userSub = getUserId(userSession.user);
+    await config.onAuthorizationCodeApproved?.({
+      clientId: client.clientId,
+      scopes: granted,
+      userSub
+    });
     await authorizationCodeStore.saveCode({
       acr: userAcr,
       audience: effectiveQuery.resource,
@@ -8205,7 +8211,7 @@ var oidcProviderRoutes = (config) => {
       nonce,
       redirectUri,
       scopes: granted,
-      userId: getUserId(userSession.user)
+      userId: userSub
     });
     const params = {
       code,
@@ -27164,6 +27170,20 @@ var createInMemoryOidcRefreshTokenStore = () => {
       const active = Array.from(tokens.values()).filter((token) => token.userId === userId && token.expiresAt > now);
       return Array.from(new Set(active.map((token) => token.clientId)));
     },
+    listConnections: async () => {
+      const now = Date.now();
+      const connections = new Map;
+      for (const token of tokens.values()) {
+        if (token.expiresAt <= now)
+          continue;
+        const connection = {
+          clientId: token.clientId,
+          userId: token.userId
+        };
+        connections.set(`${connection.userId}\x00${connection.clientId}`, connection);
+      }
+      return Array.from(connections.values());
+    },
     saveToken: async (token) => {
       tokens.set(token.tokenHash, { ...token });
     }
@@ -27584,6 +27604,13 @@ var createPostgresOidcRefreshTokenStore = (db) => ({
     const rows = await db.selectDistinct({ client_id: oauthRefreshTokensTable.client_id }).from(oauthRefreshTokensTable).where(and(eq(oauthRefreshTokensTable.user_id, userId), gt(oauthRefreshTokensTable.expires_at_ms, Date.now())));
     return rows.map((row) => row.client_id);
   },
+  listConnections: async () => {
+    const rows = await db.selectDistinct({
+      clientId: oauthRefreshTokensTable.client_id,
+      userId: oauthRefreshTokensTable.user_id
+    }).from(oauthRefreshTokensTable).where(gt(oauthRefreshTokensTable.expires_at_ms, Date.now()));
+    return rows;
+  },
   saveToken: async (token) => {
     await db.insert(oauthRefreshTokensTable).values(toRefreshValues(token));
   }
@@ -29427,6 +29454,34 @@ var validatePositiveOptions = (prefix, options) => {
     }
   }
 };
+var delegateAgentAuthorization = async (agentAuth, context, auditEmit) => {
+  if (agentAuth === undefined)
+    return;
+  const registration2 = await agentAuth.registrationStore.findByClientId(context.clientId);
+  if (registration2 === undefined || registration2.status !== "active")
+    return;
+  const now = Date.now();
+  const existing = await agentAuth.delegationStore.findActiveDelegation({
+    agentId: registration2.agentId,
+    now,
+    userId: context.userSub
+  });
+  await agentAuth.delegationStore.saveDelegation({
+    agentId: registration2.agentId,
+    createdAt: existing?.createdAt ?? now,
+    delegationId: existing?.delegationId ?? `agd_${crypto.randomUUID()}`,
+    scopes: context.scopes.filter((scope) => registration2.allowedScopes.includes(scope) && agentAuth.scopes.includes(scope)),
+    status: "active",
+    updatedAt: now,
+    userId: context.userSub
+  });
+  await auditEmit?.({
+    at: now,
+    metadata: { agentId: registration2.agentId },
+    type: "agent_delegated",
+    userId: context.userSub
+  });
+};
 var buildAuthApplications = async (configuration) => {
   const {
     providersConfiguration,
@@ -29550,6 +29605,10 @@ var buildAuthApplications = async (configuration) => {
       }
       return handleAgentTokenGrant(resolvedAgentAuth, context.body);
     },
+    onAuthorizationCodeApproved: async (context) => {
+      await oidc.onAuthorizationCodeApproved?.(context);
+      await delegateAgentAuthorization(agentAuth, context, auditEmit);
+    },
     onClientRegistered: async (context) => {
       await oidc.onClientRegistered?.(context);
       if (agentAuth?.registerDynamicClients !== true)
@@ -29572,33 +29631,7 @@ var buildAuthApplications = async (configuration) => {
     },
     onDeviceAuthorizationApproved: async (context) => {
       await oidc.onDeviceAuthorizationApproved?.(context);
-      if (agentAuth === undefined)
-        return;
-      const registration2 = await agentAuth.registrationStore.findByClientId(context.clientId);
-      if (registration2 === undefined || registration2.status !== "active") {
-        return;
-      }
-      const now = Date.now();
-      const existing = await agentAuth.delegationStore.findActiveDelegation({
-        agentId: registration2.agentId,
-        now,
-        userId: context.userSub
-      });
-      await agentAuth.delegationStore.saveDelegation({
-        agentId: registration2.agentId,
-        createdAt: existing?.createdAt ?? now,
-        delegationId: existing?.delegationId ?? `agd_${crypto.randomUUID()}`,
-        scopes: context.scopes.filter((scope) => registration2.allowedScopes.includes(scope) && agentAuth.scopes.includes(scope)),
-        status: "active",
-        updatedAt: now,
-        userId: context.userSub
-      });
-      await auditEmit?.({
-        at: now,
-        metadata: { agentId: registration2.agentId },
-        type: "agent_delegated",
-        userId: context.userSub
-      });
+      await delegateAgentAuthorization(agentAuth, context, auditEmit);
     }
   } : undefined;
   const credentialsConfig = credentials ? {
@@ -29771,5 +29804,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=C43C023A75E2E73A64756E2164756E21
+//# debugId=059E7E401823BC2864756E2164756E21
 //# sourceMappingURL=server.js.map