@absolutejs/auth 0.56.6 → 0.56.7

package/dist/oidc/config.d.ts

@@ -90,6 +90,13 @@ export type OidcProviderConfig<UserType> = {
     onClientRegistration?: OnClientRegistration;
     /** Fires after RFC 7591 registration has been persisted and has a generated client id. */
     onClientRegistered?: OnClientRegistered;
+    /** Fires after an authenticated user authorizes an OAuth authorization-code
+     * request and the final granted scopes are known, before the code is issued. */
+    onAuthorizationCodeApproved?: (context: {
+        clientId: string;
+        scopes: string[];
+        userSub: string;
+    }) => void | Promise<void>;
     /** Fires after the authenticated user approves an RFC 8628 device request. */
     onDeviceAuthorizationApproved?: (context: {
         clientId: string;

package/dist/server.js

@@ -8193,6 +8193,12 @@ var oidcProviderRoutes = (config) => {
       return errorRedirect("insufficient_user_authentication");
     }
     const code = generateSecureToken(TOKEN_BYTES4);
+    const userSub = getUserId(userSession.user);
+    await config.onAuthorizationCodeApproved?.({
+      clientId: client.clientId,
+      scopes: granted,
+      userSub
+    });
     await authorizationCodeStore.saveCode({
       acr: userAcr,
       audience: effectiveQuery.resource,
@@ -8205,7 +8211,7 @@ var oidcProviderRoutes = (config) => {
       nonce,
       redirectUri,
       scopes: granted,
-      userId: getUserId(userSession.user)
+      userId: userSub
     });
     const params = {
       code,
@@ -29448,6 +29454,34 @@ var validatePositiveOptions = (prefix, options) => {
     }
   }
 };
+var delegateAgentAuthorization = async (agentAuth, context, auditEmit) => {
+  if (agentAuth === undefined)
+    return;
+  const registration2 = await agentAuth.registrationStore.findByClientId(context.clientId);
+  if (registration2 === undefined || registration2.status !== "active")
+    return;
+  const now = Date.now();
+  const existing = await agentAuth.delegationStore.findActiveDelegation({
+    agentId: registration2.agentId,
+    now,
+    userId: context.userSub
+  });
+  await agentAuth.delegationStore.saveDelegation({
+    agentId: registration2.agentId,
+    createdAt: existing?.createdAt ?? now,
+    delegationId: existing?.delegationId ?? `agd_${crypto.randomUUID()}`,
+    scopes: context.scopes.filter((scope) => registration2.allowedScopes.includes(scope) && agentAuth.scopes.includes(scope)),
+    status: "active",
+    updatedAt: now,
+    userId: context.userSub
+  });
+  await auditEmit?.({
+    at: now,
+    metadata: { agentId: registration2.agentId },
+    type: "agent_delegated",
+    userId: context.userSub
+  });
+};
 var buildAuthApplications = async (configuration) => {
   const {
     providersConfiguration,
@@ -29571,6 +29605,10 @@ var buildAuthApplications = async (configuration) => {
       }
       return handleAgentTokenGrant(resolvedAgentAuth, context.body);
     },
+    onAuthorizationCodeApproved: async (context) => {
+      await oidc.onAuthorizationCodeApproved?.(context);
+      await delegateAgentAuthorization(agentAuth, context, auditEmit);
+    },
     onClientRegistered: async (context) => {
       await oidc.onClientRegistered?.(context);
       if (agentAuth?.registerDynamicClients !== true)
@@ -29593,33 +29631,7 @@ var buildAuthApplications = async (configuration) => {
     },
     onDeviceAuthorizationApproved: async (context) => {
       await oidc.onDeviceAuthorizationApproved?.(context);
-      if (agentAuth === undefined)
-        return;
-      const registration2 = await agentAuth.registrationStore.findByClientId(context.clientId);
-      if (registration2 === undefined || registration2.status !== "active") {
-        return;
-      }
-      const now = Date.now();
-      const existing = await agentAuth.delegationStore.findActiveDelegation({
-        agentId: registration2.agentId,
-        now,
-        userId: context.userSub
-      });
-      await agentAuth.delegationStore.saveDelegation({
-        agentId: registration2.agentId,
-        createdAt: existing?.createdAt ?? now,
-        delegationId: existing?.delegationId ?? `agd_${crypto.randomUUID()}`,
-        scopes: context.scopes.filter((scope) => registration2.allowedScopes.includes(scope) && agentAuth.scopes.includes(scope)),
-        status: "active",
-        updatedAt: now,
-        userId: context.userSub
-      });
-      await auditEmit?.({
-        at: now,
-        metadata: { agentId: registration2.agentId },
-        type: "agent_delegated",
-        userId: context.userSub
-      });
+      await delegateAgentAuthorization(agentAuth, context, auditEmit);
     }
   } : undefined;
   const credentialsConfig = credentials ? {
@@ -29792,5 +29804,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=D8EC85FAD0A8B9D564756E2164756E21
+//# debugId=059E7E401823BC2864756E2164756E21
 //# sourceMappingURL=server.js.map