@absolutejs/auth 0.57.7 → 0.57.9

package/dist/cli/migrate.js

@@ -381,23 +381,28 @@ var portableJsonb = customType({
   fromDriver: (value) => typeof value === "string" ? JSON.parse(value) : value,
   toDriver: (value) => JSON.stringify(value)
 });
-var agentDelegationsTable = pgTable3("auth_agent_delegations", {
+var bunSqlJsonb = customType({
+  dataType: () => "jsonb",
+  fromDriver: (value) => typeof value === "string" ? JSON.parse(value) : value,
+  toDriver: (value) => value
+});
+var createAgentDelegationsTable = (json) => pgTable3("auth_agent_delegations", {
   agent_id: varchar3("agent_id", { length: ID_LENGTH3 }).notNull(),
-  authorization_details: portableJsonb("authorization_details").$type(),
+  authorization_details: json("authorization_details").$type(),
   created_at_ms: bigint3("created_at_ms", { mode: "number" }).notNull(),
   delegation_id: varchar3("delegation_id", {
     length: ID_LENGTH3
   }).primaryKey(),
   expires_at_ms: bigint3("expires_at_ms", { mode: "number" }),
   organization_id: varchar3("organization_id", { length: ID_LENGTH3 }),
-  scopes: portableJsonb("scopes").$type().notNull().default([]),
+  scopes: json("scopes").$type().notNull().default([]),
   status: varchar3("status", { length: STATUS_LENGTH }).$type().notNull(),
   updated_at_ms: bigint3("updated_at_ms", { mode: "number" }).notNull(),
   user_id: varchar3("user_id", { length: ID_LENGTH3 }).notNull()
 });
-var agentIdentityRegistrationsTable = pgTable3("auth_agent_identity_registrations", {
+var createAgentIdentityRegistrationsTable = (json) => pgTable3("auth_agent_identity_registrations", {
   agent_id: varchar3("agent_id", { length: ID_LENGTH3 }).notNull().unique(),
-  claim_attempt: portableJsonb("claim_attempt").$type(),
+  claim_attempt: json("claim_attempt").$type(),
   claim_attempt_token_hash: varchar3("claim_attempt_token_hash", {
     length: ID_LENGTH3
   }).unique(),
@@ -407,8 +412,12 @@ var agentIdentityRegistrationsTable = pgTable3("auth_agent_identity_registration
   claim_token_hash: varchar3("claim_token_hash", {
     length: ID_LENGTH3
   }).notNull().unique(),
-  created_at_ms: bigint3("created_at_ms", { mode: "number" }).notNull(),
-  expires_at_ms: bigint3("expires_at_ms", { mode: "number" }).notNull(),
+  created_at_ms: bigint3("created_at_ms", {
+    mode: "number"
+  }).notNull(),
+  expires_at_ms: bigint3("expires_at_ms", {
+    mode: "number"
+  }).notNull(),
   kind: varchar3("kind", { length: 32 }).$type().notNull(),
   last_polled_at_ms: bigint3("last_polled_at_ms", { mode: "number" }),
   login_hint: varchar3("login_hint", { length: ID_LENGTH3 }),
@@ -416,27 +425,37 @@ var agentIdentityRegistrationsTable = pgTable3("auth_agent_identity_registration
     length: ID_LENGTH3
   }).primaryKey(),
   status: varchar3("status", { length: STATUS_LENGTH }).$type().notNull(),
-  updated_at_ms: bigint3("updated_at_ms", { mode: "number" }).notNull(),
+  updated_at_ms: bigint3("updated_at_ms", {
+    mode: "number"
+  }).notNull(),
   upstream_client_id: varchar3("upstream_client_id", {
     length: ID_LENGTH3
   }),
   upstream_issuer: varchar3("upstream_issuer", { length: ID_LENGTH3 }),
-  upstream_subject: varchar3("upstream_subject", { length: ID_LENGTH3 }),
+  upstream_subject: varchar3("upstream_subject", {
+    length: ID_LENGTH3
+  }),
   user_id: varchar3("user_id", { length: ID_LENGTH3 }),
   version: integer("version").notNull()
 }, (table) => [
   uniqueIndex("auth_agent_identity_upstream_unique").on(table.upstream_issuer, table.upstream_subject, table.upstream_client_id)
 ]);
-var agentRegistrationsTable = pgTable3("auth_agent_registrations", {
+var createAgentRegistrationsTable = (json) => pgTable3("auth_agent_registrations", {
   agent_id: varchar3("agent_id", { length: ID_LENGTH3 }).primaryKey(),
-  allowed_scopes: portableJsonb("allowed_scopes").$type().notNull().default([]),
+  allowed_scopes: json("allowed_scopes").$type().notNull().default([]),
   client_id: varchar3("client_id", { length: ID_LENGTH3 }).unique(),
   created_at_ms: bigint3("created_at_ms", { mode: "number" }).notNull(),
-  metadata: portableJsonb("metadata").$type(),
+  metadata: json("metadata").$type(),
   name: varchar3("name", { length: NAME_LENGTH }).notNull(),
   status: varchar3("status", { length: STATUS_LENGTH }).$type().notNull(),
   updated_at_ms: bigint3("updated_at_ms", { mode: "number" }).notNull()
 });
+var agentDelegationsBunSqlTable = createAgentDelegationsTable(bunSqlJsonb);
+var agentDelegationsTable = createAgentDelegationsTable(portableJsonb);
+var agentIdentityRegistrationsBunSqlTable = createAgentIdentityRegistrationsTable(bunSqlJsonb);
+var agentIdentityRegistrationsTable = createAgentIdentityRegistrationsTable(portableJsonb);
+var agentRegistrationsBunSqlTable = createAgentRegistrationsTable(bunSqlJsonb);
+var agentRegistrationsTable = createAgentRegistrationsTable(portableJsonb);
 
 // src/audit/postgresAuditStore.ts
 import { desc as desc4, eq as eq4, lt as lt2 } from "drizzle-orm";
@@ -685,17 +704,23 @@ var providers = defineProviders({
   },
   apple: {
     authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    createAuthorizationURLSearchParams: {
+      response_mode: "form_post"
+    },
+    createClientSecret: (config) => createAppleClientSecret(config),
     isOIDC: true,
     isRefreshable: true,
-    PKCEMethod: "S256",
-    profileRequest: {
-      authIn: "header",
-      encoding: "application/json",
-      method: "GET",
-      url: "https://appleid.apple.com/auth/userinfo"
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://appleid.apple.com/auth/revoke"
     },
     scopeRequired: false,
-    subject: ["id"],
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"]
+    },
     subjectType: "string",
     tokenRequest: {
       authIn: "body",
@@ -764,6 +789,7 @@ var providers = defineProviders({
         token_type_hint: "refresh_token"
       }),
       encoding: "application/json",
+      inputSource: "refreshToken",
       tokenParamName: "token",
       url: (config) => `https://${config.domain}/oauth/revoke`
     },
@@ -1895,6 +1921,7 @@ var providers = defineProviders({
         token_type_hint: "refresh_token"
       }),
       encoding: "application/json",
+      inputSource: "refreshToken",
       url: "https://www.reddit.com/api/v1/revoke_token"
     },
     scopeRequired: true,
@@ -2268,49 +2295,27 @@ var providers = defineProviders({
     authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
     isOIDC: false,
     isRefreshable: true,
-    profileRequest: {
-      authIn: "header",
-      body: async (config) => {
-        const props = await getWithingsProps(config);
-        if (props === undefined)
-          throw new Error("Failed to get Withings search properties");
-        const { nonce, hashedSignature } = props;
-        return [
-          ["action", "getuser"],
-          ["nonce", nonce],
-          ["client_id", config.clientId],
-          ["signature", hashedSignature]
-        ];
-      },
-      encoding: "application/x-www-form-urlencoded",
-      method: "POST",
-      url: "https://wbsapi.withings.net/v2/oauth2"
-    },
     refreshAccessTokenBody: {
       action: "requesttoken"
     },
     revocationRequest: {
-      authIn: "header",
-      body: async (config) => {
-        const props = await getWithingsProps(config);
-        if (!props)
-          throw new Error("Failed to get Withings props");
-        const { nonce, hashedSignature } = props;
-        return [
-          ["action", "revoke"],
-          ["client_id", config.clientId],
-          ["nonce", nonce],
-          ["signature", hashedSignature]
-        ];
-      },
+      authIn: "body",
+      body: (config) => getWithingsSignatureParams(config, "revoke"),
       encoding: "application/x-www-form-urlencoded",
-      method: "POST",
-      url: "https://wbsapi.withings.net/v2/oauth2"
+      includeClientCredentials: false,
+      inputSource: "subject",
+      inputType: "number",
+      tokenParamName: "userid",
+      url: "https://wbsapi.withings.net/v2/oauth2",
+      validateResponse: (value) => assertWithingsSuccess(value)
     },
     scopeDelimiter: ",",
     scopeRequired: true,
     subject: ["userid"],
-    subjectType: "string",
+    subjectBySource: {
+      tokenResponse: ["body", "userid"]
+    },
+    subjectType: "number",
     tokenRequest: {
       authIn: "body",
       encoding: "application/x-www-form-urlencoded",
@@ -2469,6 +2474,7 @@ var providers = defineProviders({
     }
   }
 });
+var isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.prototype.toString.call(value) === "[object Object]";
 var isOIDCProviderOption = (option) => {
   if (!isValidProviderOption(option))
     return false;
@@ -2481,6 +2487,12 @@ var isPKCEProviderOption = (option) => {
   const provider = providers[option];
   return provider.PKCEMethod !== undefined;
 };
+var isProfileProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.profileRequest !== undefined;
+};
 var isRefreshableProviderOption = (option) => {
   if (!isValidProviderOption(option))
     return false;
@@ -2500,6 +2512,28 @@ var isScopeRequiredProviderOption = (option) => {
   return provider.scopeRequired;
 };
 var isValidProviderOption = (option) => Object.hasOwn(providers, option);
+var assertWithingsSuccess = (value) => {
+  if (!isObject(value) || value.status !== 0) {
+    const status = isObject(value) ? value.status : "invalid response";
+    const detail = isObject(value) && typeof value.error === "string" ? `: ${value.error}` : "";
+    throw new Error(`Withings request failed (${String(status)})${detail}`);
+  }
+};
+var createOAuth2FetchError = async (response) => {
+  const clone = response.clone();
+  const prefix = `HTTP ${response.status} ${response.statusText} for ${response.url}`;
+  const payload = await response.json().catch(() => null);
+  if (payload && typeof payload === "object" && Object.keys(payload).length) {
+    return new Error(`${prefix}
+${JSON.stringify(payload)}`);
+  }
+  const text3 = await clone.text().catch(() => "");
+  if (text3) {
+    return new Error(`${prefix}
+${text3}`);
+  }
+  return new Error(prefix);
+};
 var encodeBase64 = (input) => {
   let raw;
   if (typeof input === "string") {
@@ -2510,25 +2544,31 @@ var encodeBase64 = (input) => {
   }
   return btoa(raw);
 };
-var getWithingsProps = async (config) => {
+var getWithingsSignatureParams = async (config, action) => {
   const timestamp = Math.floor(Date.now() / 1000);
-  const signature = `getnonce,${config.clientId},${timestamp}`;
-  const hashedSignature = await hmacSha256(signature, config.clientSecret);
+  const nonceSignature = await hmacSha256(`getnonce,${config.clientId},${timestamp}`, config.clientSecret);
   const nonceUrl = new URL("https://wbsapi.withings.net/v2/signature");
   nonceUrl.searchParams.set("action", "getnonce");
   nonceUrl.searchParams.set("client_id", config.clientId);
   nonceUrl.searchParams.set("timestamp", timestamp.toString());
-  nonceUrl.searchParams.set("signature", hashedSignature);
+  nonceUrl.searchParams.set("signature", nonceSignature);
   const nonceTarget = nonceUrl.toString();
   const nonceResponse = await fetch(nonceTarget, { method: "POST" });
+  if (!nonceResponse.ok) {
+    throw await createOAuth2FetchError(nonceResponse);
+  }
   const nonceData = await nonceResponse.json();
-  if (nonceData.status === 0) {
-    return {
-      hashedSignature,
-      nonce: nonceData.body.nonce
-    };
+  if (!isObject(nonceData) || nonceData.status !== 0 || !isObject(nonceData.body) || typeof nonceData.body.nonce !== "string" || nonceData.body.nonce.length === 0) {
+    throw new Error("Withings returned an invalid nonce response");
   }
-  return;
+  const { nonce } = nonceData.body;
+  const signature = await hmacSha256(`${action},${config.clientId},${nonce}`, config.clientSecret);
+  return {
+    action,
+    client_id: config.clientId,
+    nonce,
+    signature
+  };
 };
 var hmacSha256 = async (message, secret) => {
   const encoder = new TextEncoder;
@@ -2536,6 +2576,13 @@ var hmacSha256 = async (message, secret) => {
   const sigBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
   return Array.from(new Uint8Array(sigBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
 };
+var DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME = 180;
+var HOURS_PER_DAY = 24;
+var MINUTES_PER_HOUR = 60;
+var SECONDS_PER_MINUTE = 60;
+var APPLE_CLIENT_SECRET_LIFETIME_SECONDS = SECONDS_PER_MINUTE * MINUTES_PER_HOUR * HOURS_PER_DAY * DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME;
+var APPLE_ISSUER = "https://appleid.apple.com";
+var MILLISECONDS_PER_SECOND = 1000;
 var createRandomBase64UrlGenerator = (length) => () => {
   const buffer = crypto.getRandomValues(new Uint8Array(length));
   return base64Url(buffer);
@@ -2543,8 +2590,29 @@ var createRandomBase64UrlGenerator = (length) => () => {
 var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var encodeJwtPart = (value) => base64Url(new TextEncoder().encode(JSON.stringify(value)));
+var createAppleClientSecret = async (credentials) => {
+  const issuedAt = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+  const header = encodeJwtPart({
+    alg: "ES256",
+    kid: credentials.keyId,
+    typ: "JWT"
+  });
+  const payload = encodeJwtPart({
+    aud: APPLE_ISSUER,
+    exp: issuedAt + APPLE_CLIENT_SECRET_LIFETIME_SECONDS,
+    iat: issuedAt,
+    iss: credentials.teamId,
+    sub: credentials.clientId
+  });
+  const signingInput = `${header}.${payload}`;
+  const privateKey = await crypto.subtle.importKey("pkcs8", Uint8Array.from(credentials.pkcs8PrivateKey), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign({ hash: "SHA-256", name: "ECDSA" }, privateKey, new TextEncoder().encode(signingInput));
+  return `${signingInput}.${base64Url(signature)}`;
+};
 var oidcProviderOptions = Object.keys(providers).filter(isOIDCProviderOption);
 var pkceProviderOptions = Object.keys(providers).filter(isPKCEProviderOption);
+var profileProviderOptions = Object.keys(providers).filter(isProfileProviderOption);
 var providerOptions = Object.keys(providers).filter(isValidProviderOption);
 var refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProviderOption);
 var revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);
@@ -2893,6 +2961,7 @@ var authSessionsTable = pgTable16("auth_sessions", {
   created_at: timestamp2("created_at").notNull().defaultNow(),
   expires_at_ms: bigint14("expires_at_ms", { mode: "number" }).notNull(),
   id: varchar16("id", { length: 255 }).primaryKey(),
+  oauth_subject_json: jsonb8("oauth_subject_json").$type(),
   refresh_token: text6("refresh_token"),
   updated_at: timestamp2("updated_at").notNull().defaultNow(),
   user_json: jsonb8("user_json").$type().notNull()
@@ -2902,6 +2971,7 @@ var authUnregisteredSessionsTable = pgTable16("auth_unregistered_sessions", {
   created_at: timestamp2("created_at").notNull().defaultNow(),
   expires_at_ms: bigint14("expires_at_ms", { mode: "number" }).notNull(),
   id: varchar16("id", { length: 255 }).primaryKey(),
+  oauth_subject_json: jsonb8("oauth_subject_json").$type(),
   refresh_token: text6("refresh_token"),
   session_information_json: jsonb8("session_information_json").$type(),
   updated_at: timestamp2("updated_at").notNull().defaultNow(),
@@ -3178,6 +3248,14 @@ var oidcResourceAudienceMigration = {
   ].join(`
 `)
 };
+var sessionOAuthSubjectMigration = {
+  id: "0002_oauth_subject",
+  sql: [
+    'ALTER TABLE "auth_sessions" ADD COLUMN IF NOT EXISTS "oauth_subject_json" jsonb;',
+    'ALTER TABLE "auth_unregistered_sessions" ADD COLUMN IF NOT EXISTS "oauth_subject_json" jsonb;'
+  ].join(`
+`)
+};
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
   agents: {
@@ -3246,10 +3324,16 @@ var blockMigrations = {
   portal: initMigration("portal", [setupSessionsTable]),
   roles: initMigration("roles", [rolesTable]),
   scim: initMigration("scim", [scimTokensTable]),
-  sessions: initMigration("sessions", [
-    authSessionsTable,
-    authUnregisteredSessionsTable
-  ]),
+  sessions: {
+    block: "sessions",
+    migrations: [
+      ...initMigration("sessions", [
+        authSessionsTable,
+        authUnregisteredSessionsTable
+      ]).migrations,
+      sessionOAuthSubjectMigration
+    ]
+  },
   sso: initMigration("sso", [ssoConnectionsTable, samlServiceProvidersTable]),
   vault: initMigration("vault", [vaultEntriesTable]),
   vc: initMigration("vc", [
@@ -3447,5 +3531,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=C8D20760311031E264756E2164756E21
+//# debugId=CF3F65D5B7AF923D64756E2164756E21
 //# sourceMappingURL=migrate.js.map