@absolutejs/auth 0.74.0 → 0.75.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/README.md +21 -6
  2. package/dist/agents/index.js +46 -11
  3. package/dist/agents/index.js.map +4 -4
  4. package/dist/agents/oidcAdapter.d.ts +3 -1
  5. package/dist/apikeys/routes.d.ts +1 -1
  6. package/dist/compliance/routes.d.ts +1 -1
  7. package/dist/credentials/emailVerification.d.ts +1 -1
  8. package/dist/credentials/login.d.ts +1 -1
  9. package/dist/credentials/passwordReset.d.ts +1 -1
  10. package/dist/credentials/register.d.ts +1 -1
  11. package/dist/htmx/configuredRoutes.d.ts +1 -1
  12. package/dist/htmx/routes.d.ts +1 -1
  13. package/dist/index.d.ts +1 -1
  14. package/dist/index.js +166 -68
  15. package/dist/index.js.map +8 -8
  16. package/dist/mfa/challenge.d.ts +1 -1
  17. package/dist/mfa/management.d.ts +1 -1
  18. package/dist/mfa/sms.d.ts +1 -1
  19. package/dist/mfa/totp.d.ts +1 -1
  20. package/dist/nativePush.d.ts +500 -20
  21. package/dist/oidc/dpop.d.ts +6 -2
  22. package/dist/oidc/index.d.ts +1 -0
  23. package/dist/oidc/index.js +130 -1
  24. package/dist/oidc/index.js.map +4 -3
  25. package/dist/organizations/routes.d.ts +1 -1
  26. package/dist/portal/routes.d.ts +1 -1
  27. package/dist/roles/routes.d.ts +1 -1
  28. package/dist/routes/authorize.d.ts +1 -1
  29. package/dist/routes/callback.d.ts +1 -1
  30. package/dist/routes/profile.d.ts +1 -1
  31. package/dist/routes/refresh.d.ts +1 -1
  32. package/dist/routes/revoke.d.ts +1 -1
  33. package/dist/routes/sessions.d.ts +1 -1
  34. package/dist/routes/signout.d.ts +1 -1
  35. package/dist/routes/userStatus.d.ts +1 -1
  36. package/dist/scim/routes.d.ts +1 -1
  37. package/dist/server.js +164 -68
  38. package/dist/server.js.map +8 -8
  39. package/dist/sso/discoveryRoute.d.ts +1 -1
  40. package/dist/sso/oidcRoutes.d.ts +1 -1
  41. package/dist/sso/samlIdpRoutes.d.ts +1 -1
  42. package/dist/sso/samlRoutes.d.ts +1 -1
  43. package/dist/types.d.ts +3 -1
  44. package/dist/vc/statusListRoutes.d.ts +1 -1
  45. package/dist/vc/vpRoutes.d.ts +1 -1
  46. package/dist/webauthn/routes.d.ts +1 -1
  47. package/package.json +1 -1
package/dist/organizations/routes.d.ts CHANGED
@@ -281,7 +281,7 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
281
281
  status?: number | keyof import("elysia").StatusMap;
282
282
  cookie?: Record<string, import("elysia").BaseCookie>;
283
283
  };
284
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
284
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
285
285
  readonly 100: "Continue";
286
286
  readonly 101: "Switching Protocols";
287
287
  readonly 102: "Processing";
package/dist/portal/routes.d.ts CHANGED
@@ -127,7 +127,7 @@ export declare const portalRoutes: ({ emit, onScimTokenCreated, onSsoConnectionC
127
127
  status?: number | keyof import("elysia").StatusMap;
128
128
  cookie?: Record<string, import("elysia").BaseCookie>;
129
129
  };
130
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
130
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
131
131
  readonly 100: "Continue";
132
132
  readonly 101: "Switching Protocols";
133
133
  readonly 102: "Processing";
package/dist/roles/routes.d.ts CHANGED
@@ -78,7 +78,7 @@ export declare const roleRoutes: <UserType>({ authSessionStore, canManageRoles,
78
78
  status?: number | keyof import("elysia").StatusMap;
79
79
  cookie?: Record<string, import("elysia").BaseCookie>;
80
80
  };
81
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
81
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
82
82
  readonly 100: "Continue";
83
83
  readonly 101: "Switching Protocols";
84
84
  readonly 102: "Processing";
package/dist/routes/authorize.d.ts CHANGED
@@ -44,7 +44,7 @@ export declare const authorize: ({ clientProviders, authorizeRoute, cookieSecure
44
44
  status?: number | keyof import("elysia").StatusMap;
45
45
  cookie?: Record<string, import("elysia").BaseCookie>;
46
46
  };
47
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
47
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
48
48
  readonly 100: "Continue";
49
49
  readonly 101: "Switching Protocols";
50
50
  readonly 102: "Processing";
package/dist/routes/callback.d.ts CHANGED
@@ -58,7 +58,7 @@ export declare const callback: <UserType>({ authSessionStore, clientProviders, c
58
58
  status?: number | keyof import("elysia").StatusMap;
59
59
  cookie?: Record<string, import("elysia").BaseCookie>;
60
60
  };
61
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
61
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
62
62
  readonly 100: "Continue";
63
63
  readonly 101: "Switching Protocols";
64
64
  readonly 102: "Processing";
package/dist/routes/profile.d.ts CHANGED
@@ -46,7 +46,7 @@ export declare const profile: <UserType>({ authSessionStore, clientProviders, pr
46
46
  status?: number | keyof import("elysia").StatusMap;
47
47
  cookie?: Record<string, import("elysia").BaseCookie>;
48
48
  };
49
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
49
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
50
50
  readonly 100: "Continue";
51
51
  readonly 101: "Switching Protocols";
52
52
  readonly 102: "Processing";
package/dist/routes/refresh.d.ts CHANGED
@@ -47,7 +47,7 @@ export declare const refresh: <UserType>({ authSessionStore, clientProviders, re
47
47
  status?: number | keyof import("elysia").StatusMap;
48
48
  cookie?: Record<string, import("elysia").BaseCookie>;
49
49
  };
50
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
50
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
51
51
  readonly 100: "Continue";
52
52
  readonly 101: "Switching Protocols";
53
53
  readonly 102: "Processing";
package/dist/routes/revoke.d.ts CHANGED
@@ -46,7 +46,7 @@ export declare const revoke: <UserType>({ authSessionStore, clientProviders, rev
46
46
  status?: number | keyof import("elysia").StatusMap;
47
47
  cookie?: Record<string, import("elysia").BaseCookie>;
48
48
  };
49
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
49
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
50
50
  readonly 100: "Continue";
51
51
  readonly 101: "Switching Protocols";
52
52
  readonly 102: "Processing";
package/dist/routes/sessions.d.ts CHANGED
@@ -73,7 +73,7 @@ export declare const sessionRoutes: <UserType>({ authSessionStore, getUserId, se
73
73
  status?: number | keyof import("elysia").StatusMap;
74
74
  cookie?: Record<string, import("elysia").BaseCookie>;
75
75
  };
76
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
76
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
77
77
  readonly 100: "Continue";
78
78
  readonly 101: "Switching Protocols";
79
79
  readonly 102: "Processing";
package/dist/routes/signout.d.ts CHANGED
@@ -42,7 +42,7 @@ export declare const signout: <UserType>({ authSessionStore, signoutRoute, onSig
42
42
  status?: number | keyof import("elysia").StatusMap;
43
43
  cookie?: Record<string, import("elysia").BaseCookie>;
44
44
  };
45
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
45
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
46
46
  readonly 100: "Continue";
47
47
  readonly 101: "Switching Protocols";
48
48
  readonly 102: "Processing";
package/dist/routes/userStatus.d.ts CHANGED
@@ -40,7 +40,7 @@ export declare const userStatus: <UserType>({ authSessionStore, statusRoute, onS
40
40
  status?: number | keyof import("elysia").StatusMap;
41
41
  cookie?: Record<string, import("elysia").BaseCookie>;
42
42
  };
43
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
43
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
44
44
  readonly 100: "Continue";
45
45
  readonly 101: "Switching Protocols";
46
46
  readonly 102: "Processing";
package/dist/scim/routes.d.ts CHANGED
@@ -361,7 +361,7 @@ export declare const scimRoutes: ({ customAttributes, getScimGroup, getScimUser,
361
361
  status?: number | keyof import("elysia").StatusMap;
362
362
  cookie?: Record<string, import("elysia").BaseCookie>;
363
363
  };
364
- status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
364
+ status: <const Code extends number | keyof import("elysia").StatusMap, const T = Code extends 400 | 401 | 403 | 501 | 204 | 404 | 200 | 301 | 302 | 303 | 307 | 308 | 409 | 100 | 101 | 102 | 103 | 201 | 202 | 203 | 205 | 206 | 207 | 208 | 300 | 304 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 420 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 ? {
365
365
  readonly 100: "Continue";
366
366
  readonly 101: "Switching Protocols";
367
367
  readonly 102: "Processing";
package/dist/server.js CHANGED
@@ -7188,23 +7188,100 @@ var createMfaGate = ({ getUserId, mfaStore }) => async (user) => isMfaEnrolled(a
7188
7188
  // src/nativePush.ts
7189
7189
  import { Elysia as Elysia17, t as t11 } from "elysia";
7190
7190
  var DEFAULT_NATIVE_PUSH_ROUTE = "/auth/mobile/push";
7191
+ var DEFAULT_PUSH_ROUTE = "/auth/push";
7191
7192
  var requireServerText = (value, field) => {
7192
7193
  const normalized = value.trim();
7193
7194
  if (!normalized)
7194
- throw new TypeError(`Native push ${field} must not be empty.`);
7195
+ throw new TypeError(`Push ${field} must not be empty.`);
7195
7196
  return normalized;
7196
7197
  };
7197
7198
  var isInstallationOwnershipError = (error) => error instanceof Error && error.name === "PushInstallationOwnershipError";
7198
- var nativePushRoutes = ({
7199
+ var pushRoutes = ({
7199
7200
  accessTokens,
7200
7201
  authSessionStore,
7201
7202
  config
7202
7203
  }) => {
7203
- const resolveTenant = async (principal) => requireServerText(typeof config.tenant === "function" ? await config.tenant(principal) : config.tenant, "native tenant");
7204
+ const resolveTenant = async (principal) => requireServerText(typeof config.tenant === "function" ? await config.tenant(principal) : config.tenant, "tenant");
7204
7205
  const resolveTopics = async (principal) => [
7205
7206
  ...new Set((await config.topics?.(principal) ?? []).map((topic) => requireServerText(topic, "topic")))
7206
7207
  ].sort();
7207
- return new Elysia17({ name: "@absolutejs/auth/native-push" }).use(sessionStore()).guard({
7208
+ const register = async (body, principal) => {
7209
+ try {
7210
+ const registration = await config.registrar.registerInstallation({
7211
+ ...body.installationId ? { installationId: body.installationId } : {},
7212
+ ...body.locale ? { locale: body.locale } : {},
7213
+ ...body.platform === "webpush" ? {
7214
+ platform: body.platform,
7215
+ subscription: body.subscription
7216
+ } : { platform: body.platform, token: body.token },
7217
+ tenant: await resolveTenant(principal),
7218
+ topics: await resolveTopics(principal),
7219
+ userId: principal.subject
7220
+ });
7221
+ return {
7222
+ installationId: requireServerText(registration.installationId, "installation id"),
7223
+ registered: true
7224
+ };
7225
+ } catch (error) {
7226
+ if (isInstallationOwnershipError(error))
7227
+ return null;
7228
+ throw error;
7229
+ }
7230
+ };
7231
+ const remove = async (installationId, principal) => {
7232
+ try {
7233
+ await config.registrar.removeInstallation({
7234
+ installationId,
7235
+ tenant: await resolveTenant(principal),
7236
+ userId: principal.subject
7237
+ });
7238
+ } catch (error) {
7239
+ if (isInstallationOwnershipError(error))
7240
+ return false;
7241
+ throw error;
7242
+ }
7243
+ return true;
7244
+ };
7245
+ const installationIdSchema = t11.Optional(t11.String({ maxLength: 128, minLength: 1 }));
7246
+ const localeSchema = t11.Optional(t11.String({ maxLength: 64, minLength: 1 }));
7247
+ const commonRegistrationFields = {
7248
+ installationId: installationIdSchema,
7249
+ locale: localeSchema
7250
+ };
7251
+ const registrationBody = t11.Union([
7252
+ t11.Object({
7253
+ ...commonRegistrationFields,
7254
+ platform: t11.Union([t11.Literal("apns"), t11.Literal("fcm")]),
7255
+ token: t11.String({ maxLength: 8192, minLength: 1 })
7256
+ }),
7257
+ t11.Object({
7258
+ ...commonRegistrationFields,
7259
+ platform: t11.Literal("webpush"),
7260
+ subscription: t11.Object({
7261
+ endpoint: t11.String({ maxLength: 8192, minLength: 1 }),
7262
+ keys: t11.Object({
7263
+ auth: t11.String({ maxLength: 8192, minLength: 1 }),
7264
+ p256dh: t11.String({ maxLength: 8192, minLength: 1 })
7265
+ })
7266
+ })
7267
+ })
7268
+ ]);
7269
+ const requirePushPrincipal = ({
7270
+ pushPrincipal,
7271
+ status
7272
+ }) => pushPrincipal ? undefined : status("Unauthorized", "User is not authenticated");
7273
+ const registrationOptions = {
7274
+ beforeHandle: requirePushPrincipal,
7275
+ body: registrationBody
7276
+ };
7277
+ const removalBody = t11.Object({
7278
+ installationId: t11.String({ maxLength: 128, minLength: 1 })
7279
+ });
7280
+ const removalOptions = {
7281
+ beforeHandle: requirePushPrincipal,
7282
+ body: removalBody
7283
+ };
7284
+ return new Elysia17({ name: "@absolutejs/auth/push" }).use(sessionStore()).guard({
7208
7285
  cookie: t11.Cookie({ user_session_id: userSessionIdTypebox }),
7209
7286
  schema: "merge"
7210
7287
  }).derive(async ({
@@ -7225,56 +7302,36 @@ var nativePushRoutes = ({
7225
7302
  authorization: headers.authorization,
7226
7303
  config: accessTokens
7227
7304
  });
7228
- return { nativePushPrincipal: principal };
7229
- }).post(DEFAULT_NATIVE_PUSH_ROUTE, {
7230
- body: t11.Object({
7231
- installationId: t11.Optional(t11.String({ maxLength: 128, minLength: 1 })),
7232
- locale: t11.Optional(t11.String({ maxLength: 64, minLength: 1 })),
7233
- platform: t11.Union([t11.Literal("apns"), t11.Literal("fcm")]),
7234
- token: t11.String({ maxLength: 8192, minLength: 1 })
7235
- }),
7236
- beforeHandle: ({ nativePushPrincipal, status }) => nativePushPrincipal ? undefined : status("Unauthorized", "User is not authenticated")
7237
- }, async ({ body, nativePushPrincipal, status }) => {
7238
- if (!nativePushPrincipal)
7305
+ return { pushPrincipal: principal };
7306
+ }).post(DEFAULT_PUSH_ROUTE, registrationOptions, async ({ body, pushPrincipal, status }) => {
7307
+ if (!pushPrincipal)
7239
7308
  return status("Unauthorized", "User is not authenticated");
7240
- let registration;
7241
- try {
7242
- registration = await config.registrar.registerInstallation({
7243
- ...body.installationId ? { installationId: body.installationId } : {},
7244
- ...body.locale ? { locale: body.locale } : {},
7245
- platform: body.platform,
7246
- tenant: await resolveTenant(nativePushPrincipal),
7247
- token: body.token,
7248
- topics: await resolveTopics(nativePushPrincipal),
7249
- userId: nativePushPrincipal.subject
7250
- });
7251
- } catch (error) {
7252
- if (isInstallationOwnershipError(error))
7253
- return status("Conflict", {
7254
- code: "installation-ownership"
7255
- });
7256
- throw error;
7257
- }
7258
- return {
7259
- installationId: requireServerText(registration.installationId, "installation id"),
7260
- registered: true
7261
- };
7262
- }).delete(DEFAULT_NATIVE_PUSH_ROUTE, {
7263
- body: t11.Object({
7264
- installationId: t11.String({ maxLength: 128, minLength: 1 })
7265
- }),
7266
- beforeHandle: ({ nativePushPrincipal, status }) => nativePushPrincipal ? undefined : status("Unauthorized", "User is not authenticated")
7267
- }, async ({ body, nativePushPrincipal, status }) => {
7268
- if (!nativePushPrincipal)
7309
+ const result = await register(body, pushPrincipal);
7310
+ return result ?? status("Conflict", {
7311
+ code: "installation-ownership"
7312
+ });
7313
+ }).post(DEFAULT_NATIVE_PUSH_ROUTE, registrationOptions, async ({ body, pushPrincipal, status }) => {
7314
+ if (!pushPrincipal)
7269
7315
  return status("Unauthorized", "User is not authenticated");
7270
- await config.registrar.removeInstallation({
7271
- installationId: body.installationId,
7272
- tenant: await resolveTenant(nativePushPrincipal),
7273
- userId: nativePushPrincipal.subject
7316
+ const result = await register(body, pushPrincipal);
7317
+ return result ?? status("Conflict", {
7318
+ code: "installation-ownership"
7319
+ });
7320
+ }).delete(DEFAULT_PUSH_ROUTE, removalOptions, async ({ body, pushPrincipal, status }) => {
7321
+ if (!pushPrincipal)
7322
+ return status("Unauthorized", "User is not authenticated");
7323
+ return await remove(body.installationId, pushPrincipal) ? { removed: true } : status("Conflict", {
7324
+ code: "installation-ownership"
7325
+ });
7326
+ }).delete(DEFAULT_NATIVE_PUSH_ROUTE, removalOptions, async ({ body, pushPrincipal, status }) => {
7327
+ if (!pushPrincipal)
7328
+ return status("Unauthorized", "User is not authenticated");
7329
+ return await remove(body.installationId, pushPrincipal) ? { removed: true } : status("Conflict", {
7330
+ code: "installation-ownership"
7274
7331
  });
7275
- return { removed: true };
7276
7332
  });
7277
7333
  };
7334
+ var nativePushRoutes = pushRoutes;
7278
7335
 
7279
7336
  // src/mfa/routes.ts
7280
7337
  import { Elysia as Elysia22 } from "elysia";
@@ -9029,6 +9086,7 @@ var verifyCertificateBoundToken = async ({
9029
9086
  // src/oidc/dpop.ts
9030
9087
  init_constants();
9031
9088
  var DEFAULT_MAX_AGE_MS = 60000;
9089
+ var MAX_JTI_LENGTH = 128;
9032
9090
  var SECONDS_TO_MS = 1000;
9033
9091
  var NONCE_WINDOW_SECONDS = 120;
9034
9092
  var NONCE_WINDOW_MS = NONCE_WINDOW_SECONDS * MILLISECONDS_IN_A_SECOND;
@@ -9069,17 +9127,38 @@ var verifyDpopNonce = async ({
9069
9127
  const candidates = await Promise.all(Array.from({ length: NONCE_PREVIOUS_WINDOWS_ACCEPTED + 1 }, (_, offset) => hmacSha2562(secret, String(currentWindow - offset))));
9070
9128
  return candidates.some((expected) => expected === nonce);
9071
9129
  };
9072
- var decodeHeader = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
9073
- var normalizeHtu = (value) => {
9130
+ var decodeHeader = (segment) => {
9131
+ try {
9132
+ const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
9133
+ return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
9134
+ } catch {
9135
+ return;
9136
+ }
9137
+ };
9138
+ var normalizeHtu = (value, proofClaim = false) => {
9074
9139
  try {
9075
9140
  const url = new URL(String(value));
9141
+ if (url.username || url.password || proofClaim && (url.search.length > 0 || url.hash.length > 0))
9142
+ return;
9076
9143
  return `${url.origin}${url.pathname}`;
9077
9144
  } catch {
9078
- return "";
9145
+ return;
9079
9146
  }
9080
9147
  };
9148
+ var isPublicEs256Jwk = (value) => {
9149
+ if (typeof value !== "object" || value === null || Array.isArray(value))
9150
+ return false;
9151
+ const kty = Reflect.get(value, "kty");
9152
+ const crv = Reflect.get(value, "crv");
9153
+ const xCoordinate = Reflect.get(value, "x");
9154
+ const yCoordinate = Reflect.get(value, "y");
9155
+ const privateComponent = Reflect.get(value, "d");
9156
+ const alg = Reflect.get(value, "alg");
9157
+ return kty === "EC" && crv === "P-256" && typeof xCoordinate === "string" && xCoordinate.length > 0 && typeof yCoordinate === "string" && yCoordinate.length > 0 && privateComponent === undefined && (alg === undefined || alg === "ES256");
9158
+ };
9081
9159
  var verifyDpopProof = async ({
9082
9160
  accessToken,
9161
+ consumeJti,
9083
9162
  htm,
9084
9163
  htu,
9085
9164
  isUsedJti,
@@ -9089,14 +9168,20 @@ var verifyDpopProof = async ({
9089
9168
  }) => {
9090
9169
  if (proof === undefined)
9091
9170
  return;
9092
- const [headerSegment] = proof.split(".");
9171
+ const segments = proof.split(".");
9172
+ if (segments.length !== 3)
9173
+ return;
9174
+ const [headerSegment] = segments;
9093
9175
  if (headerSegment === undefined)
9094
9176
  return;
9095
9177
  const header = decodeHeader(headerSegment);
9096
- if (header?.typ !== "dpop+jwt" || header.alg !== "ES256" || header.jwk === undefined) {
9178
+ const publicJwk = header === undefined ? undefined : Reflect.get(header, "jwk");
9179
+ if (header === undefined || Reflect.get(header, "typ") !== "dpop+jwt" || Reflect.get(header, "alg") !== "ES256" || !isPublicEs256Jwk(publicJwk)) {
9097
9180
  return;
9098
9181
  }
9099
- const verified = await verifyJwt(proof, header.jwk);
9182
+ const verified = await verifyJwt(proof, publicJwk).catch(() => {
9183
+ return;
9184
+ });
9100
9185
  if (verified === undefined)
9101
9186
  return;
9102
9187
  const { payload } = verified;
@@ -9106,14 +9191,19 @@ var verifyDpopProof = async ({
9106
9191
  return;
9107
9192
  }
9108
9193
  const iatMs = typeof payload.iat === "number" ? payload.iat * SECONDS_TO_MS : 0;
9109
- if (payload.htm !== htm || normalizeHtu(payload.htu) !== normalizeHtu(htu) || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs) {
9194
+ const claimedHtu = normalizeHtu(payload.htu, true);
9195
+ const expectedHtu = normalizeHtu(htu);
9196
+ const jti = typeof payload.jti === "string" ? payload.jti : undefined;
9197
+ if (payload.htm !== htm || claimedHtu === undefined || expectedHtu === undefined || claimedHtu !== expectedHtu || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs || jti === undefined || jti.length === 0 || jti.length > MAX_JTI_LENGTH) {
9110
9198
  return;
9111
9199
  }
9112
- const jti = typeof payload.jti === "string" ? payload.jti : undefined;
9113
- if (jti !== undefined && isUsedJti !== undefined && await isUsedJti(jti)) {
9200
+ const jkt = await jwkThumbprint(publicJwk);
9201
+ if (isUsedJti !== undefined && await isUsedJti(jti)) {
9114
9202
  return;
9115
9203
  }
9116
- return { jkt: await jwkThumbprint(header.jwk), jti };
9204
+ if (consumeJti !== undefined && !await consumeJti({ expiresAt: iatMs + maxAgeMs, jkt, jti }))
9205
+ return;
9206
+ return { jkt, jti };
9117
9207
  };
9118
9208
 
9119
9209
  // src/oidc/logout.ts
@@ -9852,7 +9942,7 @@ var oidcProviderRoutes = (config) => {
9852
9942
  "dpop-nonce": fresh,
9853
9943
  "www-authenticate": 'DPoP error="use_dpop_nonce"'
9854
9944
  },
9855
- status: HTTP_UNAUTHORIZED4
9945
+ status: HTTP_BAD_REQUEST3
9856
9946
  });
9857
9947
  };
9858
9948
  const grantAuthorizationCode = async (client, body, dpop, clientCertThumbprint) => {
@@ -37549,6 +37639,7 @@ var readAudience = (audience) => {
37549
37639
  };
37550
37640
  var createOidcAgentCredentialVerifier = ({
37551
37641
  issuer,
37642
+ consumeDpopJti,
37552
37643
  isUsedDpopJti,
37553
37644
  maxDpopAgeMs,
37554
37645
  publicJwk,
@@ -37577,6 +37668,7 @@ var createOidcAgentCredentialVerifier = ({
37577
37668
  return;
37578
37669
  const proof = await verifyDpopProof({
37579
37670
  accessToken: token,
37671
+ consumeJti: consumeDpopJti,
37580
37672
  htm: request.method,
37581
37673
  htu: request.url,
37582
37674
  isUsedJti: isUsedDpopJti,
@@ -41043,6 +41135,7 @@ var buildAuthApplications = async (configuration) => {
41043
41135
  customProviders,
41044
41136
  mfa,
41045
41137
  nativePush: nativePush2,
41138
+ push,
41046
41139
  verificationProvider,
41047
41140
  passwordless,
41048
41141
  lockout,
@@ -41079,8 +41172,11 @@ var buildAuthApplications = async (configuration) => {
41079
41172
  onRevocationError,
41080
41173
  onSessionCleanup
41081
41174
  } = configuration;
41082
- if (nativePush2 && !oidc)
41083
- throw new Error("nativePush requires the OIDC provider");
41175
+ if (push && nativePush2)
41176
+ throw new Error("Configure `push`, not both `push` and `nativePush`");
41177
+ const pushConfig = push ?? nativePush2;
41178
+ if (pushConfig && !oidc)
41179
+ throw new Error("push requires the OIDC provider");
41084
41180
  if (agentAuth?.agentRegistration !== undefined) {
41085
41181
  if (oidc === undefined) {
41086
41182
  throw new Error("agentAuth.agentRegistration requires the OIDC provider");
@@ -41324,18 +41420,18 @@ var buildAuthApplications = async (configuration) => {
41324
41420
  emit: auditEmit
41325
41421
  }) : new Elysia48
41326
41422
  ]);
41327
- const nativePushApplication = new Elysia48;
41328
- if (nativePush2 && oidcConfig)
41329
- nativePushApplication.use(nativePushRoutes({
41423
+ const pushApplication = new Elysia48;
41424
+ if (pushConfig && oidcConfig)
41425
+ pushApplication.use(pushRoutes({
41330
41426
  accessTokens: {
41331
41427
  oidc: oidcConfig,
41332
41428
  getUser: async (subject) => await getUser(subject) ?? null
41333
41429
  },
41334
41430
  authSessionStore,
41335
- config: nativePush2
41431
+ config: pushConfig
41336
41432
  }));
41337
41433
  const extendedFeatureRoutes = new Elysia48().use([
41338
- nativePushApplication,
41434
+ pushApplication,
41339
41435
  portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia48,
41340
41436
  webauthn ? webauthnRoutes({
41341
41437
  ...webauthn,
@@ -41562,5 +41658,5 @@ export {
41562
41658
  VerificationProviderError
41563
41659
  };
41564
41660
 
41565
- //# debugId=67A260E7AE17ECB564756E2164756E21
41661
+ //# debugId=77EFAA9D607737B964756E2164756E21
41566
41662
  //# sourceMappingURL=server.js.map