@absolutejs/auth 0.65.0 → 0.65.1

package/dist/oidc/types.d.ts

@@ -1,157 +0,0 @@
-export type OAuthClient = {
-    backchannelLogoutUri?: string;
-    clientId: string;
-    /** Grant types this dynamically registered client declared. Undefined preserves
-     * the historical authorization-code default for statically configured clients. */
-    grantTypes?: string[];
-    hashedSecret?: string;
-    jwks?: JsonWebKey[];
-    jwksUri?: string;
-    name: string;
-    postLogoutRedirectUris?: string[];
-    redirectUris: string[];
-    requirePushedAuthorizationRequests?: boolean;
-    requireSignedRequestObject?: boolean;
-    scopes: string[];
-    tlsCertificateBoundThumbprints?: string[];
-};
-export type ClientAssertionJtiStore = {
-    recordIfFresh: (clientId: string, jti: string, expiresAt: number) => Promise<boolean>;
-};
-export type PushedAuthorizationRequest = {
-    clientId: string;
-    createdAt: number;
-    expiresAt: number;
-    params: Record<string, string>;
-    requestUriHash: string;
-};
-export type PushedAuthorizationRequestStore = {
-    consumeRequest: (requestUriHash: string) => Promise<PushedAuthorizationRequest | undefined>;
-    saveRequest: (request: PushedAuthorizationRequest) => Promise<void>;
-};
-export type OAuthClientStore = {
-    deleteClient?: (clientId: string) => Promise<void>;
-    findClient: (clientId: string) => Promise<OAuthClient | undefined>;
-    saveClient?: (client: OAuthClient) => Promise<void>;
-    updateClient?: (clientId: string, client: OAuthClient) => Promise<void>;
-};
-export type ClientRegistrationToken = {
-    clientId: string;
-    createdAt: number;
-    tokenHash: string;
-};
-export type ClientRegistrationTokenStore = {
-    deleteByClientId: (clientId: string) => Promise<void>;
-    deleteForClient?: (clientId: string) => Promise<number>;
-    findByTokenHash: (tokenHash: string) => Promise<ClientRegistrationToken | undefined>;
-    saveToken: (token: ClientRegistrationToken) => Promise<void>;
-};
-export type InitialAccessTokenStore = {
-    consumeToken: (tokenHash: string) => Promise<boolean>;
-};
-export type AuthorizationCode = {
-    acr?: string;
-    audience?: string;
-    claims?: Record<string, unknown>;
-    clientId: string;
-    codeChallenge: string;
-    codeHash: string;
-    createdAt: number;
-    dpopJkt?: string;
-    expiresAt: number;
-    nonce?: string;
-    redirectUri: string;
-    scopes: string[];
-    userId: string;
-};
-export type AuthorizationCodeStore = {
-    consumeCode: (codeHash: string) => Promise<AuthorizationCode | undefined>;
-    deleteForClient?: (clientId: string) => Promise<number>;
-    deleteForUserClient: (userId: string, clientId: string) => Promise<number>;
-    saveCode: (code: AuthorizationCode) => Promise<void>;
-};
-export type OidcRefreshToken = {
-    acr?: string;
-    audience?: string;
-    claims?: Record<string, unknown>;
-    clientId: string;
-    createdAt: number;
-    dpopJkt?: string;
-    expiresAt: number;
-    scopes: string[];
-    tokenHash: string;
-    userId: string;
-};
-export type OidcRefreshTokenConnection = {
-    clientId: string;
-    userId: string;
-};
-export type OidcRefreshTokenStore = {
-    consumeToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
-    deleteForUser: (userId: string) => Promise<void>;
-    deleteForClient?: (clientId: string) => Promise<number>;
-    deleteForUserClient: (userId: string, clientId: string) => Promise<number>;
-    getToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
-    listClientIdsForUser: (userId: string) => Promise<string[]>;
-    listConnections: () => Promise<OidcRefreshTokenConnection[]>;
-    saveToken: (token: OidcRefreshToken) => Promise<void>;
-};
-export type DeviceAuthorizationStatus = 'approved' | 'denied' | 'pending';
-export type DeviceAuthorization = {
-    clientId: string;
-    createdAt: number;
-    deviceCodeHash: string;
-    expiresAt: number;
-    intervalSeconds: number;
-    scopes: string[];
-    status: DeviceAuthorizationStatus;
-    userCode: string;
-    userSub?: string;
-};
-export type LogoutDelivery = {
-    attempts: number;
-    clientId: string;
-    createdAt: number;
-    endpointUrl: string;
-    id: string;
-    lastError?: string;
-    lastStatus?: number;
-    logoutToken: string;
-    userId: string;
-};
-export type LogoutDeliveryStore = {
-    listFailed: (limit?: number) => Promise<LogoutDelivery[]>;
-    recordFailure: (delivery: LogoutDelivery) => Promise<void>;
-    removeFailure: (deliveryId: string) => Promise<void>;
-};
-export type DeviceAuthorizationStore = {
-    deleteByDeviceCodeHash: (deviceCodeHash: string) => Promise<void>;
-    deleteForClient?: (clientId: string) => Promise<number>;
-    deleteForUserClient: (userId: string, clientId: string) => Promise<number>;
-    findByDeviceCodeHash: (deviceCodeHash: string) => Promise<DeviceAuthorization | undefined>;
-    findByUserCode: (userCode: string) => Promise<DeviceAuthorization | undefined>;
-    saveDeviceAuthorization: (deviceAuthorization: DeviceAuthorization) => Promise<void>;
-    updateStatus: (deviceCodeHash: string, status: DeviceAuthorizationStatus, userSub?: string) => Promise<void>;
-};
-export type BackchannelAuthStatus = 'approved' | 'denied' | 'pending';
-export type BackchannelAuthRequest = {
-    authReqId: string;
-    bindingMessage?: string;
-    clientId: string;
-    createdAt: number;
-    expiresAt: number;
-    /** Poll-mode interval seconds. Bumped by 5 each time the client polls faster than
-     *  allowed (returns `slow_down` until the new interval has elapsed). */
-    intervalSeconds: number;
-    lastPolledAt?: number;
-    scopes: string[];
-    status: BackchannelAuthStatus;
-    userSub?: string;
-};
-export type BackchannelAuthStore = {
-    deleteByAuthReqId: (authReqId: string) => Promise<void>;
-    findByAuthReqId: (authReqId: string) => Promise<BackchannelAuthRequest | undefined>;
-    recordPoll: (authReqId: string, at: number) => Promise<void>;
-    saveBackchannelAuth: (request: BackchannelAuthRequest) => Promise<void>;
-    updateStatus: (authReqId: string, status: BackchannelAuthStatus, userSub?: string) => Promise<void>;
-};

package/dist/oidc/userinfo.d.ts

@@ -1,21 +0,0 @@
-import type { OidcProviderConfig } from './config';
-export type UserInfoResult = {
-    body: Record<string, unknown> & {
-        sub: string;
-    };
-    ok: true;
-} | {
-    body: {
-        error: string;
-        error_description?: string;
-    };
-    error: 'invalid_request' | 'invalid_token';
-    ok: false;
-};
-export declare const readUserInfoBearer: (authorization: string | undefined) => string | undefined;
-export declare const fetchUserInfo: <UserType>({ config, now, token }: {
-    config: OidcProviderConfig<UserType>;
-    now?: number;
-    token: string | undefined;
-}) => Promise<UserInfoResult>;
-export declare const userInfoChallengeHeader: (error: "invalid_request" | "invalid_token") => string;

package/dist/oidc/vci.d.ts

@@ -1,159 +0,0 @@
-import type { RouteString } from '../types';
-import { type SigningKey } from './keys';
-export declare const PRE_AUTHORIZED_CODE_GRANT = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
-export type CredentialConfiguration = {
-    format: 'vc+sd-jwt';
-    id: string;
-    display?: Array<{
-        locale?: string;
-        name: string;
-    }>;
-    order?: string[];
-    claims?: Record<string, {
-        display?: Array<{
-            locale?: string;
-            name: string;
-        }>;
-    }>;
-    vct: string;
-};
-export type CredentialOffer = {
-    clientId: string;
-    configurationId: string;
-    createdAt: number;
-    expiresAt: number;
-    preAuthorizedCodeHash: string;
-    redeemed: boolean;
-    userId: string;
-};
-export type CredentialOfferStore = {
-    consumeOffer: (preAuthorizedCodeHash: string) => Promise<CredentialOffer | undefined>;
-    saveOffer: (offer: CredentialOffer) => Promise<void>;
-};
-export type CredentialNonceRecord = {
-    expiresAt: number;
-    nonceHash: string;
-};
-export type CredentialNonceStore = {
-    consumeNonce: (nonceHash: string) => Promise<CredentialNonceRecord | undefined>;
-    saveNonce: (record: CredentialNonceRecord) => Promise<void>;
-};
-export type VciConfig = {
-    accessTokenTtlMs?: number;
-    credentialConfigurations: CredentialConfiguration[];
-    credentialNonceStore?: CredentialNonceStore;
-    credentialOfferStore: CredentialOfferStore;
-    nonceTtlMs?: number;
-    offerTtlMs?: number;
-    resolveCredentialClaims: (context: {
-        configurationId: string;
-        userId: string;
-    }) => Promise<Record<string, unknown>> | Record<string, unknown>;
-    resolveProtectedClaims?: (context: {
-        configurationId: string;
-        userId: string;
-    }) => Promise<Record<string, unknown>> | Record<string, unknown>;
-    signingKey?: SigningKey;
-    vciRoute?: RouteString;
-};
-export declare const DEFAULT_VCI_ROUTE: RouteString;
-export declare const createCredentialOffer: ({ clientId, configurationId, now, store, ttlMs, userId }: {
-    clientId: string;
-    configurationId: string;
-    now?: number;
-    store: CredentialOfferStore;
-    ttlMs?: number;
-    userId: string;
-}) => Promise<{
-    offer: CredentialOffer;
-    preAuthorizedCode: string;
-}>;
-export type PreAuthExchangeResult = {
-    error: 'expired_token' | 'invalid_grant';
-    ok: false;
-} | {
-    access_token: string;
-    c_nonce?: string;
-    c_nonce_expires_in?: number;
-    expires_in: number;
-    ok: true;
-    token_type: 'Bearer';
-};
-export declare const exchangePreAuthorizedCode: ({ config, issuer, now, preAuthorizedCode, signingKey }: {
-    config: VciConfig;
-    issuer: string;
-    now?: number;
-    preAuthorizedCode: string;
-    signingKey: SigningKey;
-}) => Promise<{
-    error: "expired_token" | "invalid_grant";
-    ok: false;
-} | {
-    access_token: string;
-    c_nonce?: string;
-    c_nonce_expires_in?: number;
-    expires_in: number;
-    ok: true;
-    token_type: "Bearer";
-}>;
-export type CredentialIssueInput = {
-    accessToken: string;
-    proofJwt?: string;
-    requestedFormat?: string;
-};
-export type CredentialIssueResult = {
-    credential: string;
-    format: 'vc+sd-jwt';
-    ok: true;
-} | {
-    error: 'invalid_credential_request' | 'invalid_proof' | 'invalid_token' | 'unsupported_credential_format';
-    ok: false;
-};
-export declare const buildIssuerMetadata: ({ config, issuer, vciRoute }: {
-    config: VciConfig;
-    issuer: string;
-    vciRoute: RouteString;
-}) => {
-    credential_configurations_supported: {
-        [k: string]: {
-            claims: Record<string, {
-                display?: Array<{
-                    locale?: string;
-                    name: string;
-                }>;
-            }> | undefined;
-            credential_signing_alg_values_supported: string[];
-            cryptographic_binding_methods_supported: string[];
-            display: {
-                locale?: string;
-                name: string;
-            }[] | undefined;
-            format: "vc+sd-jwt";
-            order: string[] | undefined;
-            proof_types_supported: {
-                jwt: {
-                    proof_signing_alg_values_supported: string[];
-                };
-            };
-            vct: string;
-        };
-    };
-    credential_endpoint: string;
-    credential_issuer: string;
-    nonce_endpoint: string | undefined;
-    token_endpoint: string;
-};
-export declare const issueCredential: ({ config, input, issuer, now, signingKey }: {
-    config: VciConfig;
-    input: CredentialIssueInput;
-    issuer: string;
-    now?: number;
-    signingKey: SigningKey;
-}) => Promise<{
-    credential: string;
-    format: "vc+sd-jwt";
-    ok: true;
-} | {
-    error: "invalid_credential_request" | "invalid_proof" | "invalid_token" | "unsupported_credential_format";
-    ok: false;
-}>;

package/dist/oidc/vciRoutes.d.ts

@@ -1,92 +0,0 @@
-import { Elysia } from 'elysia';
-import type { SigningKey } from './keys';
-import { type VciConfig } from './vci';
-export declare const vciRoutes: ({ issuerUrl, signingKey, vciConfig }: {
-    issuerUrl: string;
-    signingKey: SigningKey;
-    vciConfig: VciConfig;
-}) => Elysia<"", {
-    decorator: {};
-    store: {};
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    ".well-known": {
-        "openid-credential-issuer": {
-            get: {
-                body: unknown;
-                params: {};
-                query: unknown;
-                headers: unknown;
-                response: {
-                    200: Response;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        credential: {
-            post: {
-                body: {
-                    format?: "vc+sd-jwt" | undefined;
-                    proof?: {
-                        jwt: string;
-                        proof_type: "jwt";
-                    } | undefined;
-                };
-                params: {};
-                query: unknown;
-                headers: unknown;
-                response: {
-                    200: Response;
-                    422: {
-                        type: "validation";
-                        on: string;
-                        summary?: string;
-                        message?: string;
-                        found?: unknown;
-                        property?: string;
-                        expected?: string;
-                    };
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        nonce: {
-            post: {
-                body: unknown;
-                params: {};
-                query: unknown;
-                headers: unknown;
-                response: {
-                    200: Response;
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/organizations/config.d.ts

@@ -1,46 +0,0 @@
-import type { AuditEmitter } from '../audit/config';
-import type { AuthSessionStore } from '../session/types';
-import type { OrganizationId } from '../tenancy';
-import type { RouteString } from '../types';
-import type { OrganizationMembership, OrganizationStore } from './types';
-export declare const DEFAULT_INVITATION_TTL_MS: number;
-export declare const DEFAULT_ORGANIZATIONS_ROUTE: RouteString;
-export declare const DEFAULT_OWNER_ROLES: string[];
-export type OrganizationInvitationMessage = {
-    email: string;
-    expiresAt: number;
-    inviterUserId?: string;
-    organizationId: OrganizationId;
-    token: string;
-};
-export type OrganizationsConfig<UserType> = {
-    getUserId: (user: UserType) => string;
-    organizationStore: OrganizationStore;
-    canCreateOrganization?: (user: UserType) => boolean | Promise<boolean>;
-    canManageMembers?: (context: {
-        membership?: OrganizationMembership;
-        organizationId: OrganizationId;
-        user: UserType;
-    }) => boolean | Promise<boolean>;
-    invitationDurationMs?: number;
-    onMembershipAdded?: (context: {
-        organizationId: OrganizationId;
-        roles: string[];
-        userId: string;
-    }) => void | Promise<void>;
-    onMembershipRemoved?: (context: {
-        organizationId: OrganizationId;
-        userId: string;
-    }) => void | Promise<void>;
-    onOrganizationCreated?: (context: {
-        organizationId: OrganizationId;
-        ownerUserId: string;
-    }) => void | Promise<void>;
-    onSendInvitation?: (message: OrganizationInvitationMessage) => void | Promise<void>;
-    organizationsRoute?: RouteString;
-    ownerRoles?: string[];
-};
-export type OrganizationsRouteProps<UserType> = OrganizationsConfig<UserType> & {
-    authSessionStore?: AuthSessionStore<UserType>;
-    emit?: AuditEmitter;
-};

package/dist/organizations/inMemoryOrganizationStore.d.ts

@@ -1,2 +0,0 @@
-import type { OrganizationStore } from './types';
-export declare const createInMemoryOrganizationStore: () => OrganizationStore;

package/dist/organizations/operations.d.ts

@@ -1,39 +0,0 @@
-import type { OrganizationId } from '../tenancy';
-import type { Organization, OrganizationInvitation, OrganizationMembership, OrganizationStore } from './types';
-export declare const acceptInvitation: ({ organizationStore, token, userId }: {
-    organizationStore: OrganizationStore;
-    token: string;
-    userId: string;
-}) => Promise<OrganizationMembership | undefined>;
-export declare const autoAssignOrgsByEmail: ({ email, getOrgsForDomain, organizationStore, roles, userId }: {
-    email: string;
-    getOrgsForDomain: (domain: string) => Promise<OrganizationId[]> | OrganizationId[];
-    organizationStore: OrganizationStore;
-    roles?: string[];
-    userId: string;
-}) => Promise<string[]>;
-export declare const createOrganization: ({ metadata, name, organizationStore, ownerRoles, ownerUserId }: {
-    metadata?: Record<string, unknown>;
-    name: string;
-    organizationStore: OrganizationStore;
-    ownerRoles?: string[];
-    ownerUserId: string;
-}) => Promise<Organization>;
-export declare const inviteToOrganization: ({ email, invitationDurationMs, inviterUserId, organizationId, organizationStore, roles }: {
-    email: string;
-    invitationDurationMs?: number;
-    inviterUserId?: string;
-    organizationId: OrganizationId;
-    organizationStore: OrganizationStore;
-    roles?: string[];
-}) => Promise<{
-    invitation: OrganizationInvitation;
-    token: string;
-}>;
-export declare const listUserOrganizations: ({ organizationStore, userId }: {
-    organizationStore: OrganizationStore;
-    userId: string;
-}) => Promise<{
-    membership: OrganizationMembership;
-    organization: Organization | undefined;
-}[]>;