@absolutejs/auth 0.57.6 → 0.57.8

package/dist/server.js

@@ -1363,17 +1363,23 @@ var providers = defineProviders({
   },
   apple: {
     authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    createAuthorizationURLSearchParams: {
+      response_mode: "form_post"
+    },
+    createClientSecret: (config) => createAppleClientSecret(config),
     isOIDC: true,
     isRefreshable: true,
-    PKCEMethod: "S256",
-    profileRequest: {
-      authIn: "header",
-      encoding: "application/json",
-      method: "GET",
-      url: "https://appleid.apple.com/auth/userinfo"
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://appleid.apple.com/auth/revoke"
     },
     scopeRequired: false,
-    subject: ["id"],
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"]
+    },
     subjectType: "string",
     tokenRequest: {
       authIn: "body",
@@ -1442,6 +1448,7 @@ var providers = defineProviders({
         token_type_hint: "refresh_token"
       }),
       encoding: "application/json",
+      inputSource: "refreshToken",
       tokenParamName: "token",
       url: (config) => `https://${config.domain}/oauth/revoke`
     },
@@ -2573,6 +2580,7 @@ var providers = defineProviders({
         token_type_hint: "refresh_token"
       }),
       encoding: "application/json",
+      inputSource: "refreshToken",
       url: "https://www.reddit.com/api/v1/revoke_token"
     },
     scopeRequired: true,
@@ -2946,49 +2954,27 @@ var providers = defineProviders({
     authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
     isOIDC: false,
     isRefreshable: true,
-    profileRequest: {
-      authIn: "header",
-      body: async (config) => {
-        const props = await getWithingsProps(config);
-        if (props === undefined)
-          throw new Error("Failed to get Withings search properties");
-        const { nonce, hashedSignature } = props;
-        return [
-          ["action", "getuser"],
-          ["nonce", nonce],
-          ["client_id", config.clientId],
-          ["signature", hashedSignature]
-        ];
-      },
-      encoding: "application/x-www-form-urlencoded",
-      method: "POST",
-      url: "https://wbsapi.withings.net/v2/oauth2"
-    },
     refreshAccessTokenBody: {
       action: "requesttoken"
     },
     revocationRequest: {
-      authIn: "header",
-      body: async (config) => {
-        const props = await getWithingsProps(config);
-        if (!props)
-          throw new Error("Failed to get Withings props");
-        const { nonce, hashedSignature } = props;
-        return [
-          ["action", "revoke"],
-          ["client_id", config.clientId],
-          ["nonce", nonce],
-          ["signature", hashedSignature]
-        ];
-      },
+      authIn: "body",
+      body: (config) => getWithingsSignatureParams(config, "revoke"),
       encoding: "application/x-www-form-urlencoded",
-      method: "POST",
-      url: "https://wbsapi.withings.net/v2/oauth2"
+      includeClientCredentials: false,
+      inputSource: "subject",
+      inputType: "number",
+      tokenParamName: "userid",
+      url: "https://wbsapi.withings.net/v2/oauth2",
+      validateResponse: (value) => assertWithingsSuccess(value)
     },
     scopeDelimiter: ",",
     scopeRequired: true,
     subject: ["userid"],
-    subjectType: "string",
+    subjectBySource: {
+      tokenResponse: ["body", "userid"]
+    },
+    subjectType: "number",
     tokenRequest: {
       authIn: "body",
       encoding: "application/x-www-form-urlencoded",
@@ -3180,14 +3166,39 @@ var isPKCEProviderOption = (option) => {
   const provider = providers[option];
   return provider.PKCEMethod !== undefined;
 };
-var isRefreshableOAuth2Client = (providerName, _client) => isRefreshableProviderOption(providerName);
+function isProfileOAuth2Client(providerOrClient, maybeClient) {
+  const client = maybeClient ?? providerOrClient;
+  if (maybeClient !== undefined && (typeof providerOrClient !== "string" || !isProfileProviderOption(providerOrClient))) {
+    return false;
+  }
+  return typeof client === "object" && client !== null && "fetchUserProfile" in client && typeof client.fetchUserProfile === "function";
+}
+var isProfileProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.profileRequest !== undefined;
+};
+function isRefreshableOAuth2Client(providerOrClient, maybeClient) {
+  const client = maybeClient ?? providerOrClient;
+  if (maybeClient !== undefined && (typeof providerOrClient !== "string" || !isRefreshableProviderOption(providerOrClient))) {
+    return false;
+  }
+  return typeof client === "object" && client !== null && "refreshAccessToken" in client && typeof client.refreshAccessToken === "function";
+}
 var isRefreshableProviderOption = (option) => {
   if (!isValidProviderOption(option))
     return false;
   const provider = providers[option];
   return provider.isRefreshable;
 };
-var isRevocableOAuth2Client = (providerName, _client) => isRevocableProviderOption(providerName);
+function isRevocableOAuth2Client(providerOrClient, maybeClient) {
+  const client = maybeClient ?? providerOrClient;
+  if (maybeClient !== undefined && (typeof providerOrClient !== "string" || !isRevocableProviderOption(providerOrClient))) {
+    return false;
+  }
+  return typeof client === "object" && client !== null && "resolveRevocationInput" in client && typeof client.resolveRevocationInput === "function" && "revokeToken" in client && typeof client.revokeToken === "function";
+}
 var isRevocableProviderOption = (option) => {
   if (!isValidProviderOption(option))
     return false;
@@ -3201,6 +3212,14 @@ var isScopeRequiredProviderOption = (option) => {
   return provider.scopeRequired;
 };
 var isValidProviderOption = (option) => Object.hasOwn(providers, option);
+var readPath = (value, path) => path.reduce((cursor, key) => cursor && typeof cursor === "object" ? Reflect.get(cursor, key) : undefined, value);
+var assertWithingsSuccess = (value) => {
+  if (!isObject(value) || value.status !== 0) {
+    const status = isObject(value) ? value.status : "invalid response";
+    const detail = isObject(value) && typeof value.error === "string" ? `: ${value.error}` : "";
+    throw new Error(`Withings request failed (${String(status)})${detail}`);
+  }
+};
 var createOAuth2FetchError = async (response) => {
   const clone = response.clone();
   const prefix = `HTTP ${response.status} ${response.statusText} for ${response.url}`;
@@ -3234,16 +3253,27 @@ var createOAuth2Request = ({
     }
     oauthHeaders.set("Authorization", `Basic ${encodeBase64(`${clientId}:${clientSecret}`)}`);
   }
+  if (body === undefined && authIn !== "body") {
+    return new Request(url, {
+      headers: oauthHeaders,
+      method: "POST"
+    });
+  }
   if (encoding === "application/json") {
     oauthHeaders.set("Content-Type", "application/json");
+    const jsonBody = body instanceof URLSearchParams ? Object.fromEntries(body.entries()) : { ...body };
+    if (authIn === "body")
+      jsonBody.client_id = clientId;
+    if (authIn === "body" && clientSecret)
+      jsonBody.client_secret = clientSecret;
     return new Request(url, {
-      body: JSON.stringify(body),
+      body: JSON.stringify(jsonBody),
       headers: oauthHeaders,
       method: "POST"
     });
   }
   oauthHeaders.set("Content-Type", "application/x-www-form-urlencoded");
-  const entries = body instanceof URLSearchParams ? Array.from(body.entries()) : Object.entries(body).filter((entry) => typeof entry[1] === "string");
+  const entries = body instanceof URLSearchParams ? Array.from(body.entries()) : Object.entries(body ?? {}).filter((entry) => typeof entry[1] === "string");
   const params = new URLSearchParams(entries);
   if (authIn === "body") {
     params.set("client_id", clientId);
@@ -3289,25 +3319,31 @@ var encodeBase64 = (input) => {
   }
   return btoa(raw);
 };
-var getWithingsProps = async (config) => {
+var getWithingsSignatureParams = async (config, action) => {
   const timestamp = Math.floor(Date.now() / 1000);
-  const signature = `getnonce,${config.clientId},${timestamp}`;
-  const hashedSignature = await hmacSha256(signature, config.clientSecret);
+  const nonceSignature = await hmacSha256(`getnonce,${config.clientId},${timestamp}`, config.clientSecret);
   const nonceUrl = new URL("https://wbsapi.withings.net/v2/signature");
   nonceUrl.searchParams.set("action", "getnonce");
   nonceUrl.searchParams.set("client_id", config.clientId);
   nonceUrl.searchParams.set("timestamp", timestamp.toString());
-  nonceUrl.searchParams.set("signature", hashedSignature);
+  nonceUrl.searchParams.set("signature", nonceSignature);
   const nonceTarget = nonceUrl.toString();
   const nonceResponse = await fetch(nonceTarget, { method: "POST" });
+  if (!nonceResponse.ok) {
+    throw await createOAuth2FetchError(nonceResponse);
+  }
   const nonceData = await nonceResponse.json();
-  if (nonceData.status === 0) {
-    return {
-      hashedSignature,
-      nonce: nonceData.body.nonce
-    };
+  if (!isObject(nonceData) || nonceData.status !== 0 || !isObject(nonceData.body) || typeof nonceData.body.nonce !== "string" || nonceData.body.nonce.length === 0) {
+    throw new Error("Withings returned an invalid nonce response");
   }
-  return;
+  const { nonce } = nonceData.body;
+  const signature = await hmacSha256(`${action},${config.clientId},${nonce}`, config.clientSecret);
+  return {
+    action,
+    client_id: config.clientId,
+    nonce,
+    signature
+  };
 };
 var hmacSha256 = async (message, secret) => {
   const encoder = new TextEncoder;
@@ -3315,15 +3351,53 @@ var hmacSha256 = async (message, secret) => {
   const sigBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
   return Array.from(new Uint8Array(sigBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
 };
+var parseOAuth2TokenResponse = (value, accessTokenPath) => {
+  if (!isObject(value)) {
+    throw new Error("OAuth token endpoint returned a non-object response");
+  }
+  const oauthError = Reflect.get(value, "error");
+  if (typeof oauthError === "string" && oauthError.length > 0) {
+    throw new Error(`OAuth token exchange failed: ${oauthError}`);
+  }
+  const response = { ...value };
+  const nestedToken = accessTokenPath ? readPath(value, accessTokenPath) : undefined;
+  if (typeof nestedToken === "string" && nestedToken.length > 0) {
+    response.access_token = nestedToken;
+  }
+  if (typeof response.access_token !== "string" || response.access_token.length === 0) {
+    throw new Error("OAuth token endpoint returned no access_token");
+  }
+  for (const key of ["refresh_token", "token_type", "scope", "id_token"]) {
+    const field = response[key];
+    if (field !== undefined && typeof field !== "string") {
+      throw new Error(`OAuth token endpoint returned invalid ${key}: expected string`);
+    }
+  }
+  const expiresIn = response.expires_in;
+  if (typeof expiresIn === "string" && expiresIn.trim() !== "") {
+    response.expires_in = Number(expiresIn);
+  }
+  if (response.expires_in !== undefined && (typeof response.expires_in !== "number" || !Number.isFinite(response.expires_in) || response.expires_in < 0)) {
+    throw new Error("OAuth token endpoint returned invalid expires_in: expected a non-negative number");
+  }
+  return response;
+};
+var readIdentityKey = (value, key) => {
+  if (Array.isArray(value)) {
+    if (!/^\d+$/.test(key)) {
+      throw new Error(`Invalid identity data shape: expected an array index, got ${key}`);
+    }
+    return value[Number(key)];
+  }
+  if (!isObject(value)) {
+    throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);
+  }
+  return value[key];
+};
 var extractPropFromIdentity = (identity, keys, propType) => {
   let value = identity;
   for (const key of keys) {
-    if (Array.isArray(value))
-      value = value[Number(key)];
-    if (!isObject(value)) {
-      throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);
-    }
-    value = value[key];
+    value = readIdentityKey(value, key);
   }
   if (propType !== undefined && !isExpectedType(value, propType)) {
     throw new Error(`Invalid identity data shape: expected ${propType}, got ${typeof value}`);
@@ -3358,6 +3432,13 @@ var normalizeProviderIdentity = ({
   const normalizedIdentity = structuredClone(identity);
   return setPropInIdentity(normalizedIdentity, canonicalKeys, subject);
 };
+var DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME = 180;
+var HOURS_PER_DAY = 24;
+var MINUTES_PER_HOUR = 60;
+var SECONDS_PER_MINUTE = 60;
+var APPLE_CLIENT_SECRET_LIFETIME_SECONDS = SECONDS_PER_MINUTE * MINUTES_PER_HOUR * HOURS_PER_DAY * DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME;
+var APPLE_ISSUER = "https://appleid.apple.com";
+var MILLISECONDS_PER_SECOND = 1000;
 var createS256CodeChallenge = async (codeVerifier) => {
   const data = new TextEncoder().encode(codeVerifier);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -3370,20 +3451,40 @@ var createRandomBase64UrlGenerator = (length) => () => {
 var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var encodeJwtPart = (value) => base64Url(new TextEncoder().encode(JSON.stringify(value)));
+var createAppleClientSecret = async (credentials) => {
+  const issuedAt = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+  const header = encodeJwtPart({
+    alg: "ES256",
+    kid: credentials.keyId,
+    typ: "JWT"
+  });
+  const payload = encodeJwtPart({
+    aud: APPLE_ISSUER,
+    exp: issuedAt + APPLE_CLIENT_SECRET_LIFETIME_SECONDS,
+    iat: issuedAt,
+    iss: credentials.teamId,
+    sub: credentials.clientId
+  });
+  const signingInput = `${header}.${payload}`;
+  const privateKey = await crypto.subtle.importKey("pkcs8", Uint8Array.from(credentials.pkcs8PrivateKey), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign({ hash: "SHA-256", name: "ECDSA" }, privateKey, new TextEncoder().encode(signingInput));
+  return `${signingInput}.${base64Url(signature)}`;
+};
 var ALG_ES256 = "ES256";
 var ALG_RS256 = "RS256";
 var CLOCK_SKEW_SECONDS = 60;
 var DEFAULT_SCOPES = ["openid", "email", "profile"];
 var JWKS_REFETCH_COOLDOWN_MS = 60000;
 var JWT_SEGMENT_COUNT = 3;
-var MILLISECONDS_PER_SECOND = 1000;
+var MILLISECONDS_PER_SECOND2 = 1000;
 var trimTrailingSlash = (value) => value.endsWith("/") ? value.slice(0, -1) : value;
 var fetchJson = async (url) => {
   const response = await fetch(url, {
     headers: { accept: "application/json" }
   });
   if (!response.ok) {
-    throw new Error(`Request to ${url} failed with status ${response.status}`);
+    throw await createOAuth2FetchError(response);
   }
   return response.json();
 };
@@ -3414,11 +3515,14 @@ var verifySignature = (key, alg, signingInput, signature) => {
 var selectKey = (jwks, kid) => jwks.find((jwk) => kid === undefined || jwk.kid === kid);
 var assertClaims = (payload, expected) => {
   const aud = Reflect.get(payload, "aud");
+  const azp = Reflect.get(payload, "azp");
   const exp = Reflect.get(payload, "exp");
+  const iat = Reflect.get(payload, "iat");
   const iss = Reflect.get(payload, "iss");
+  const nbf = Reflect.get(payload, "nbf");
   const sub = Reflect.get(payload, "sub");
   const audiences = Array.isArray(aud) ? aud : [aud];
-  const nowSeconds = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+  const nowSeconds = Math.floor(Date.now() / MILLISECONDS_PER_SECOND2);
   if (iss !== expected.issuer) {
     throw new Error('id_token "iss" does not match the provider issuer');
   }
@@ -3428,9 +3532,24 @@ var assertClaims = (payload, expected) => {
   if (!audiences.includes(expected.audience)) {
     throw new Error('id_token "aud" does not include the client id');
   }
+  if (audiences.some((audience) => typeof audience !== "string") || typeof aud !== "string" && !Array.isArray(aud)) {
+    throw new Error('id_token "aud" must be a string or string array');
+  }
+  if (audiences.length > 1 && (typeof azp !== "string" || azp !== expected.audience)) {
+    throw new Error('id_token with multiple audiences requires matching "azp"');
+  }
   if (typeof exp !== "number" || exp + CLOCK_SKEW_SECONDS < nowSeconds) {
     throw new Error("id_token has expired");
   }
+  if (typeof iat !== "number") {
+    throw new Error('id_token is missing numeric "iat"');
+  }
+  if (iat > nowSeconds + CLOCK_SKEW_SECONDS) {
+    throw new Error('id_token "iat" is in the future');
+  }
+  if (nbf !== undefined && (typeof nbf !== "number" || nbf > nowSeconds + CLOCK_SKEW_SECONDS)) {
+    throw new Error("id_token is not active yet");
+  }
   if (expected.nonce !== undefined && Reflect.get(payload, "nonce") !== expected.nonce) {
     throw new Error('id_token "nonce" does not match');
   }
@@ -3557,9 +3676,9 @@ var createOIDCClient = async (config) => {
       method: "POST"
     });
     if (!response.ok) {
-      throw new Error(`OIDC token request failed with status ${response.status}`);
+      throw await createOAuth2FetchError(response);
     }
-    const tokens = await response.json();
+    const tokens = parseOAuth2TokenResponse(await response.json());
     return tokens;
   };
   const verifyToken = async (idToken, options) => {
@@ -3605,20 +3724,26 @@ var createOIDCClient = async (config) => {
 };
 var oidcProviderOptions = Object.keys(providers).filter(isOIDCProviderOption);
 var pkceProviderOptions = Object.keys(providers).filter(isPKCEProviderOption);
+var profileProviderOptions = Object.keys(providers).filter(isProfileProviderOption);
 var providerOptions = Object.keys(providers).filter(isValidProviderOption);
 var refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProviderOption);
 var revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);
 var scopeRequiredProviderOptions = Object.keys(providers).filter(isScopeRequiredProviderOption);
-var readPath = (value, path) => path.reduce((cursor, key) => cursor && typeof cursor === "object" ? Reflect.get(cursor, key) : undefined, value);
 var buildOAuth2Client = async (meta, config) => {
   const isConfigPropertyFunction = (cfgProp) => typeof cfgProp === "function";
   const resolveConfigProp = async (cfgProp) => {
     const result = isConfigPropertyFunction(cfgProp) ? cfgProp(config) : cfgProp;
     return result;
   };
+  const resolveClientSecret = async () => {
+    if (meta.createClientSecret) {
+      return resolveConfigProp(meta.createClientSecret);
+    }
+    return hasClientSecret(config) ? config.clientSecret : undefined;
+  };
   const authorizationUrl = await resolveConfigProp(meta.authorizationUrl);
   const tokenUrl = await resolveConfigProp(meta.tokenRequest.url);
-  return {
+  const client = {
     async createAuthorizationUrl(opts) {
       const { state, scope = [], searchParams = [], codeVerifier } = opts;
       const url = new URL(authorizationUrl);
@@ -3639,7 +3764,7 @@ var buildOAuth2Client = async (meta, config) => {
         url.searchParams.set("code_challenge_method", meta.PKCEMethod);
         url.searchParams.set("code_challenge", codeChallenge);
       }
-      Object.entries(resolveConfigProp(meta.createAuthorizationURLSearchParams) ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));
+      Object.entries(await resolveConfigProp(meta.createAuthorizationURLSearchParams) ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));
       searchParams.forEach(([key, value]) => url.searchParams.set(key, value));
       return url;
     },
@@ -3672,7 +3797,7 @@ var buildOAuth2Client = async (meta, config) => {
       if (authIn === "header") {
         profileHeaders.Authorization = `Bearer ${accessToken}`;
       } else if (authIn === "path") {
-        endpoint.pathname = `${endpoint.pathname.replace(/\/+$/, "")}/${accessToken}`;
+        endpoint.pathname = `${endpoint.pathname.replace(/\/+$/, "")}/${encodeURIComponent(accessToken)}`;
       } else {
         endpoint.searchParams.append("access_token", accessToken);
       }
@@ -3693,9 +3818,8 @@ var buildOAuth2Client = async (meta, config) => {
       params.set("grant_type", "refresh_token");
       params.set("refresh_token", refreshToken);
       const { clientId } = config;
-      let clientSecretValue;
-      if (hasClientSecret(config)) {
-        clientSecretValue = config.clientSecret;
+      const clientSecretValue = await resolveClientSecret();
+      if (clientSecretValue) {
         params.set("client_id", clientId);
         params.set("client_secret", clientSecretValue);
       }
@@ -3710,60 +3834,99 @@ var buildOAuth2Client = async (meta, config) => {
       const response = await fetch(request);
       if (!response.ok)
         throw await createOAuth2FetchError(response);
-      return response.json();
+      return parseOAuth2TokenResponse(await response.json());
+    },
+    resolveRevocationInput(context) {
+      const { revocationRequest } = meta;
+      if (!revocationRequest) {
+        throw new Error("Token revocation not defined for this provider");
+      }
+      const inputSource = revocationRequest.inputSource ?? "accessToken";
+      const input = context[inputSource];
+      if (input === undefined) {
+        throw new Error(`Revocation requires ${inputSource}, but it was not provided`);
+      }
+      const expectsNumber = revocationRequest.authIn !== "header" && revocationRequest.inputType === "number";
+      if (expectsNumber && (typeof input !== "number" || !Number.isFinite(input))) {
+        throw new TypeError("This provider requires a numeric revocation input");
+      }
+      if (!expectsNumber && typeof input !== "string") {
+        throw new TypeError("This provider requires a string revocation input");
+      }
+      return input;
     },
-    async revokeToken(token) {
+    async revokeToken(input) {
       const { revocationRequest } = meta;
       if (!revocationRequest) {
         throw new Error("Token revocation not defined for this provider");
       }
-      const { url, authIn, body, headers, tokenParamName } = revocationRequest;
+      if (revocationRequest.authIn !== "header" && revocationRequest.inputType === "number" && (typeof input !== "number" || !Number.isFinite(input))) {
+        throw new TypeError("This provider requires a numeric revocation input");
+      }
+      const {
+        url,
+        authIn,
+        body,
+        encoding,
+        headers,
+        includeClientCredentials = true,
+        tokenParamName,
+        validateResponse
+      } = revocationRequest;
       const endpoint = await resolveConfigProp(url);
       const resolvedBody = await resolveConfigProp(body);
-      const revocationBody = new URLSearchParams(resolvedBody);
+      const revocationBody = resolvedBody === undefined ? undefined : new URLSearchParams(resolvedBody);
       const revocationHeaders = new Headers(headers && await resolveConfigProp(headers));
       const { clientId } = config;
-      const clientSecret = hasClientSecret(config) ? config.clientSecret : undefined;
+      const clientSecret = await resolveClientSecret();
       let request;
       if (authIn === "body") {
-        revocationBody.set(tokenParamName, token);
-        revocationBody.set("client_id", clientId);
-        if (clientSecret)
-          revocationBody.set("client_secret", clientSecret);
+        const bodyWithToken = revocationBody ?? new URLSearchParams;
+        bodyWithToken.set(tokenParamName, String(input));
+        const hasAuthorizationHeader = revocationHeaders.has("Authorization");
+        if (includeClientCredentials && !hasAuthorizationHeader)
+          bodyWithToken.set("client_id", clientId);
+        if (includeClientCredentials && !hasAuthorizationHeader && clientSecret)
+          bodyWithToken.set("client_secret", clientSecret);
         request = createOAuth2Request({
-          authIn: "body",
-          body: revocationBody,
+          authIn: hasAuthorizationHeader || !includeClientCredentials ? "query" : "body",
+          body: bodyWithToken,
           clientId,
           clientSecret,
-          encoding: "application/x-www-form-urlencoded",
+          encoding,
           headers: revocationHeaders,
           url: endpoint.toString()
         });
       } else if (authIn === "header") {
-        revocationHeaders.set("Authorization", `Bearer ${token}`);
+        revocationHeaders.set("Authorization", `Bearer ${String(input)}`);
         request = createOAuth2Request({
-          authIn: "header",
+          authIn: "query",
           body: revocationBody,
           clientId,
-          clientSecret,
-          encoding: "application/x-www-form-urlencoded",
+          encoding,
           headers: revocationHeaders,
           url: endpoint.toString()
         });
       } else {
+        const queryEndpoint = new URL(endpoint);
+        queryEndpoint.searchParams.set(tokenParamName, String(input));
         request = createOAuth2Request({
           authIn: "query",
           body: revocationBody,
           clientId,
-          clientSecret,
-          encoding: "application/x-www-form-urlencoded",
+          encoding,
           headers: revocationHeaders,
-          url: `${endpoint.toString()}?${tokenParamName}=${token}`
+          url: queryEndpoint.toString()
         });
       }
       const response = await fetch(request);
       if (!response.ok)
         throw await createOAuth2FetchError(response);
+      if (validateResponse) {
+        await validateResponse(await response.json().catch(() => {
+          return;
+        }));
+      }
     },
     async validateAuthorizationCode(opts) {
       const { code, codeVerifier } = opts;
@@ -3789,32 +3952,27 @@ var buildOAuth2Client = async (meta, config) => {
         authIn,
         body: payload,
         clientId: config.clientId,
-        clientSecret: hasClientSecret(config) ? config.clientSecret : undefined,
+        clientSecret: await resolveClientSecret(),
         encoding,
         url: tokenUrl
       });
       const response = await fetch(request);
       if (!response.ok)
         throw await createOAuth2FetchError(response);
-      const tokenResponse = await response.json();
-      if (!tokenResponse || typeof tokenResponse !== "object") {
-        throw new Error("OAuth token endpoint returned a non-object response");
-      }
-      const oauthError = Reflect.get(tokenResponse, "error");
-      if (typeof oauthError === "string" && oauthError.length > 0) {
-        throw new Error(`OAuth token exchange failed: ${oauthError}`);
-      }
-      const nestedToken = meta.accessTokenPath ? readPath(tokenResponse, meta.accessTokenPath) : undefined;
-      if (typeof nestedToken === "string" && nestedToken.length > 0 && tokenResponse && typeof tokenResponse === "object") {
-        tokenResponse.access_token = nestedToken;
-      }
-      const accessToken = Reflect.get(tokenResponse, "access_token");
-      if (typeof accessToken !== "string" || accessToken.length === 0) {
-        throw new Error("OAuth token endpoint returned no access_token");
-      }
-      return tokenResponse;
+      return parseOAuth2TokenResponse(await response.json(), meta.accessTokenPath);
     }
   };
+  if (!meta.profileRequest) {
+    Reflect.deleteProperty(client, "fetchUserProfile");
+  }
+  if (!meta.isRefreshable) {
+    Reflect.deleteProperty(client, "refreshAccessToken");
+  }
+  if (!meta.revocationRequest) {
+    Reflect.deleteProperty(client, "resolveRevocationInput");
+    Reflect.deleteProperty(client, "revokeToken");
+  }
+  return client;
 };
 var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Client(providerConfig, credentials);
 var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
@@ -5572,7 +5730,15 @@ var instantiateUserSession = async ({
     providerInstance,
     tokenResponse
   });
-  const { accessToken, refreshToken, userIdentity } = authorization;
+  const {
+    accessToken,
+    oauthSubject: resolvedOAuthSubject,
+    refreshToken,
+    userIdentity
+  } = authorization;
+  const providerMeta = providerConfiguration ?? (isValidProviderOption(authProvider) ? providers[authProvider] : undefined);
+  const extractedSubject = providerMeta ? extractPropFromIdentity(userIdentity, providerMeta.subject, providerMeta.subjectType) : Reflect.get(userIdentity, "sub");
+  const oauthSubject = resolvedOAuthSubject ?? (typeof extractedSubject === "string" || typeof extractedSubject === "number" ? extractedSubject : undefined);
   const userSession = validateSession({ session, user_session_id });
   const userSessionId = getUserSessionId({
     cookieSecure,
@@ -5589,6 +5755,7 @@ var instantiateUserSession = async ({
       accessToken,
       authenticatedAt: Date.now(),
       expiresAt: Date.now() + sessionDurationMs,
+      oauthSubject,
       refreshToken,
       user
     };
@@ -5598,6 +5765,7 @@ var instantiateUserSession = async ({
   if (existingUnregistered) {
     existingUnregistered.accessToken = accessToken;
     existingUnregistered.expiresAt = Date.now() + unregisteredSessionDurationMs;
+    existingUnregistered.oauthSubject = oauthSubject;
     existingUnregistered.refreshToken = refreshToken;
     existingUnregistered.userIdentity = userIdentity;
     return response;
@@ -5605,6 +5773,7 @@ var instantiateUserSession = async ({
   unregisteredSession[userSessionId] = {
     accessToken,
     expiresAt: Date.now() + unregisteredSessionDurationMs,
+    oauthSubject,
     refreshToken,
     userIdentity
   };
@@ -5653,6 +5822,9 @@ var resolveOAuthAuthorization = async ({
     accessToken = readOptionalString(withingsBody, "access_token") ?? accessToken;
     refreshToken = readOptionalString(withingsBody, "refresh_token") ?? refreshToken;
   } else {
+    if (!isProfileOAuth2Client(providerInstance)) {
+      throw new Error(`Provider "${authProvider}" returned no identity and has no profile endpoint`);
+    }
     userIdentity = normalizeProviderIdentity({
       identity: await providerInstance.fetchUserProfile(accessToken),
       providerConfiguration: meta,
@@ -5660,9 +5832,14 @@ var resolveOAuthAuthorization = async ({
     });
   }
   const tokenType = Reflect.get(tokenResponse, "token_type");
+  const oauthSubject = extractPropFromIdentity(userIdentity, meta.subject, meta.subjectType);
+  if (typeof oauthSubject !== "string" && typeof oauthSubject !== "number") {
+    throw new Error(`Provider "${authProvider}" returned an invalid OAuth subject`);
+  }
   return {
     accessToken,
     expiresAt: resolveOAuthTokenExpiresAt(tokenResponse, now),
+    oauthSubject,
     refreshToken,
     tokenType: typeof tokenType === "string" ? tokenType : undefined,
     userIdentity
@@ -7610,10 +7787,10 @@ var exchangeBackchannelAuth = async ({
 init_constants();
 var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
 var MAX_ASSERTION_LIFETIME_MINUTES = 5;
-var SECONDS_PER_MINUTE = 60;
-var MAX_ASSERTION_LIFETIME_MS = MAX_ASSERTION_LIFETIME_MINUTES * SECONDS_PER_MINUTE * MILLISECONDS_IN_A_SECOND;
+var SECONDS_PER_MINUTE2 = 60;
+var MAX_ASSERTION_LIFETIME_MS = MAX_ASSERTION_LIFETIME_MINUTES * SECONDS_PER_MINUTE2 * MILLISECONDS_IN_A_SECOND;
 var jwksCache = new Map;
-var JWKS_CACHE_TTL_MS = SECONDS_PER_MINUTE * MILLISECONDS_IN_A_SECOND;
+var JWKS_CACHE_TTL_MS = SECONDS_PER_MINUTE2 * MILLISECONDS_IN_A_SECOND;
 var JWKS_FETCH_TIMEOUT_SECONDS = 5;
 var JWKS_FETCH_TIMEOUT_MS = JWKS_FETCH_TIMEOUT_SECONDS * MILLISECONDS_IN_A_SECOND;
 var fetchJwksUri = async (jwksUri) => {
@@ -11170,6 +11347,7 @@ var callback = ({
 // src/routes/profile.ts
 import { Elysia as Elysia29, t as t22 } from "elysia";
 var profile = ({
+  authSessionStore,
   clientProviders,
   profileRoute = "/oauth2/profile",
   onProfileSuccess,
@@ -11184,9 +11362,6 @@ var profile = ({
   if (auth_provider.value === undefined) {
     return status("Unauthorized", "No auth provider found");
   }
-  if (!isValidProviderOption(auth_provider.value)) {
-    return status("Unauthorized", "Invalid provider");
-  }
   if (user_session_id.value === undefined) {
     return status("Unauthorized", "No user session found");
   }
@@ -11199,7 +11374,14 @@ var profile = ({
     return status("Unauthorized", resolvedProvider.error);
   }
   const { clientName, providerInstance } = resolvedProvider.entry;
-  const userSession = session[user_session_id.value];
+  if (!isProfileOAuth2Client(providerInstance)) {
+    return status("Not Implemented", "Provider does not expose a profile endpoint");
+  }
+  const userSession = await loadSessionFromSource({
+    authSessionStore,
+    session,
+    userSessionId: user_session_id.value
+  });
   if (userSession === undefined) {
     return status("Unauthorized", "No user session found");
   }
@@ -11251,9 +11433,6 @@ var refresh = ({
   if (auth_provider.value === undefined) {
     return status("Unauthorized", "No auth provider found");
   }
-  if (!isValidProviderOption(auth_provider.value)) {
-    return status("Bad Request", "Invalid provider");
-  }
   if (user_session_id.value === undefined) {
     return status("Unauthorized", "No user session found");
   }
@@ -11275,7 +11454,7 @@ var refresh = ({
     return status("Unauthorized", "No user session found");
   }
   const { refreshToken } = userSession;
-  if (!isRefreshableOAuth2Client(auth_provider.value, providerInstance)) {
+  if (!isRefreshableOAuth2Client(providerInstance)) {
     return status("Not Implemented", "Provider is not refreshable");
   }
   if (refreshToken === undefined) {
@@ -11335,9 +11514,6 @@ var revoke = ({
   if (auth_provider.value === undefined) {
     return status("Unauthorized", "No auth provider found");
   }
-  if (!isValidProviderOption(auth_provider.value)) {
-    return status("Bad Request", "Invalid provider");
-  }
   if (user_session_id.value === undefined) {
     return status("Unauthorized", "No user session found");
   }
@@ -11350,7 +11526,7 @@ var revoke = ({
     return status("Unauthorized", resolvedProvider.error);
   }
   const { clientName, providerInstance } = resolvedProvider.entry;
-  if (!isRevocableOAuth2Client(auth_provider.value, providerInstance)) {
+  if (!isRevocableOAuth2Client(providerInstance)) {
     return status("Not Implemented", "Provider does not support revocation");
   }
   const userSession = await loadSessionFromSource({
@@ -11361,16 +11537,21 @@ var revoke = ({
   if (userSession === undefined) {
     return status("Unauthorized", "No user session found");
   }
-  const { accessToken } = userSession;
+  const { accessToken, oauthSubject, refreshToken } = userSession;
   if (accessToken === undefined) {
     return status("Bad Request", "Session has no access token to revoke");
   }
   try {
-    await providerInstance.revokeToken(accessToken);
+    const tokenToRevoke = providerInstance.resolveRevocationInput({
+      accessToken,
+      refreshToken,
+      subject: oauthSubject
+    });
+    await providerInstance.revokeToken(tokenToRevoke);
     await onRevocationSuccess?.({
       authClient: clientName,
       authProvider: auth_provider.value,
-      tokenToRevoke: accessToken
+      tokenToRevoke
     });
     return new Response("Token revoked", {
       status: 204
@@ -25210,6 +25391,7 @@ var authSessionsTable = pgTable("auth_sessions", {
   created_at: timestamp("created_at").notNull().defaultNow(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   id: varchar("id", { length: 255 }).primaryKey(),
+  oauth_subject_json: jsonb("oauth_subject_json").$type(),
   refresh_token: text("refresh_token"),
   updated_at: timestamp("updated_at").notNull().defaultNow(),
   user_json: jsonb("user_json").$type().notNull()
@@ -25219,6 +25401,7 @@ var authUnregisteredSessionsTable = pgTable("auth_unregistered_sessions", {
   created_at: timestamp("created_at").notNull().defaultNow(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   id: varchar("id", { length: 255 }).primaryKey(),
+  oauth_subject_json: jsonb("oauth_subject_json").$type(),
   refresh_token: text("refresh_token"),
   session_information_json: jsonb("session_information_json").$type(),
   updated_at: timestamp("updated_at").notNull().defaultNow(),
@@ -25236,12 +25419,14 @@ var toSessionData = (row, decodeUser) => ({
   accessToken: row.access_token ?? undefined,
   authenticatedAt: row.authenticated_at_ms ?? undefined,
   expiresAt: row.expires_at_ms,
+  oauthSubject: row.oauth_subject_json ?? undefined,
   refreshToken: row.refresh_token ?? undefined,
   user: cloneUser(decodeUser(row.user_json))
 });
 var toUnregisteredSessionData = (row) => ({
   accessToken: row.access_token ?? undefined,
   expiresAt: row.expires_at_ms,
+  oauthSubject: row.oauth_subject_json ?? undefined,
   refreshToken: row.refresh_token ?? undefined,
   sessionInformation: cloneRecord(row.session_information_json ?? undefined),
   userIdentity: cloneRecord(row.user_identity_json ?? undefined)
@@ -25286,6 +25471,7 @@ var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
         authenticated_at_ms: value.authenticatedAt ?? null,
         expires_at_ms: value.expiresAt,
         id,
+        oauth_subject_json: value.oauthSubject ?? null,
         refresh_token: value.refreshToken ?? null,
         updated_at: new Date,
         user_json: value.user ?? {}
@@ -25294,6 +25480,7 @@ var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
           access_token: value.accessToken ?? null,
           authenticated_at_ms: value.authenticatedAt ?? null,
           expires_at_ms: value.expiresAt,
+          oauth_subject_json: value.oauthSubject ?? null,
           refresh_token: value.refreshToken ?? null,
           updated_at: new Date,
           user_json: value.user ?? {}
@@ -25306,6 +25493,7 @@ var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
         access_token: value.accessToken ?? null,
         expires_at_ms: value.expiresAt,
         id,
+        oauth_subject_json: value.oauthSubject ?? null,
         refresh_token: value.refreshToken ?? null,
         session_information_json: value.sessionInformation ?? null,
         updated_at: new Date,
@@ -25314,6 +25502,7 @@ var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
         set: {
           access_token: value.accessToken ?? null,
           expires_at_ms: value.expiresAt,
+          oauth_subject_json: value.oauthSubject ?? null,
           refresh_token: value.refreshToken ?? null,
           session_information_json: value.sessionInformation ?? null,
           updated_at: new Date,
@@ -31353,6 +31542,7 @@ var sessionSchema = Type.Object({
   authenticatedAt: Type.Optional(Type.Number()),
   expiresAt: Type.Number(),
   impersonator: Type.Optional(impersonatorSchema),
+  oauthSubject: Type.Optional(Type.Union([Type.String(), Type.Number()])),
   refreshToken: Type.Optional(Type.String()),
   samlLogout: Type.Optional(Type.Object({
     connectionId: Type.String(),
@@ -31364,6 +31554,7 @@ var sessionSchema = Type.Object({
 var unregisteredSessionSchema = Type.Object({
   accessToken: Type.Optional(Type.String()),
   expiresAt: Type.Number(),
+  oauthSubject: Type.Optional(Type.Union([Type.String(), Type.Number()])),
   refreshToken: Type.Optional(Type.String()),
   sessionInformation: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
   userIdentity: Type.Optional(Type.Record(Type.String(), Type.Unknown()))
@@ -36948,30 +37139,40 @@ var JOURNAL_DDL = `CREATE TABLE IF NOT EXISTS "auth_migrations" (
 var isJournalRow = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "id") === "string";
 var isBlockName = (value) => Object.hasOwn(blockMigrations, value);
 var allBlockNames = () => Object.keys(blockMigrations).filter(isBlockName);
-var applyOne = async (pool, id, sql2, log) => {
-  await pool.query(sql2);
-  await pool.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
+var applyOne = async (client, id, sql2, log) => {
+  await client.query(sql2);
+  await client.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
   log(`apply  ${id}`);
 };
-var runOne = async (pool, id, sql2, applied, result, log) => {
+var runOne = async (client, id, sql2, applied, result, log) => {
   if (applied.has(id)) {
     result.skipped.push(id);
     log(`skip   ${id}`);
     return;
   }
-  await applyOne(pool, id, sql2, log);
+  await applyOne(client, id, sql2, log);
   result.applied.push(id);
 };
 var runMigrations = async ({
   blocks,
+  client,
   databaseUrl,
   log = console.log
 }) => {
-  const pool = new Ln({ connectionString: databaseUrl });
+  let ownedPool;
+  let migrationClient;
+  if (client !== undefined) {
+    migrationClient = client;
+  } else {
+    if (databaseUrl === undefined)
+      throw new Error("runMigrations requires databaseUrl or client");
+    ownedPool = new Ln({ connectionString: databaseUrl });
+    migrationClient = ownedPool;
+  }
   const result = { applied: [], skipped: [] };
   try {
-    await pool.query(JOURNAL_DDL);
-    const journal = await pool.query(`SELECT "id" FROM "auth_migrations"`);
+    await migrationClient.query(JOURNAL_DDL);
+    const journal = await migrationClient.query(`SELECT "id" FROM "auth_migrations"`);
     const applied = new Set(journal.rows.filter(isJournalRow).map((row) => row.id));
     const selected = blocks ?? allBlockNames();
     const flat = selected.flatMap((block) => blockMigrations[block].migrations.map((migration) => ({
@@ -36980,10 +37181,10 @@ var runMigrations = async ({
     })));
     await flat.reduce(async (prior, item) => {
       await prior;
-      return runOne(pool, item.id, item.sql, applied, result, log);
+      return runOne(migrationClient, item.id, item.sql, applied, result, log);
     }, Promise.resolve());
   } finally {
-    await pool.end();
+    await ownedPool?.end();
   }
   return result;
 };
@@ -37016,6 +37217,14 @@ var oidcResourceAudienceMigration = {
   ].join(`
 `)
 };
+var sessionOAuthSubjectMigration = {
+  id: "0002_oauth_subject",
+  sql: [
+    'ALTER TABLE "auth_sessions" ADD COLUMN IF NOT EXISTS "oauth_subject_json" jsonb;',
+    'ALTER TABLE "auth_unregistered_sessions" ADD COLUMN IF NOT EXISTS "oauth_subject_json" jsonb;'
+  ].join(`
+`)
+};
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
   agents: {
@@ -37084,10 +37293,16 @@ var blockMigrations = {
   portal: initMigration("portal", [setupSessionsTable]),
   roles: initMigration("roles", [rolesTable]),
   scim: initMigration("scim", [scimTokensTable]),
-  sessions: initMigration("sessions", [
-    authSessionsTable,
-    authUnregisteredSessionsTable
-  ]),
+  sessions: {
+    block: "sessions",
+    migrations: [
+      ...initMigration("sessions", [
+        authSessionsTable,
+        authUnregisteredSessionsTable
+      ]).migrations,
+      sessionOAuthSubjectMigration
+    ]
+  },
   sso: initMigration("sso", [ssoConnectionsTable, samlServiceProvidersTable]),
   vault: initMigration("vault", [vaultEntriesTable]),
   vc: initMigration("vc", [
@@ -37773,6 +37988,7 @@ var buildAuthApplications = async (configuration) => {
       resolveAuthIntent
     }),
     profile({
+      authSessionStore,
       clientProviders,
       onProfileError,
       onProfileSuccess,
@@ -38042,5 +38258,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=56D8E62C3DDCAF8364756E2164756E21
+//# debugId=52D884157E2599DD64756E2164756E21
 //# sourceMappingURL=server.js.map