@absolutejs/auth 0.75.1 → 0.75.3

package/dist/oidc/postgresStores.d.ts

@@ -654,6 +654,21 @@ export declare const oauthDeviceAuthorizationsTable: import("drizzle-orm/pg-core
     name: "auth_oauth_device_authorizations";
     schema: undefined;
     columns: {
+        audience: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_device_authorizations", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         client_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_device_authorizations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
             name: string;
             tableName: "auth_oauth_device_authorizations";

package/dist/oidc/routes.d.ts

@@ -234,6 +234,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             body: {
                 client_id?: string | undefined;
                 scope?: string | undefined;
+                resource?: string | undefined;
                 client_secret?: string | undefined;
             };
             params: {};

package/dist/oidc/types.d.ts

@@ -118,6 +118,7 @@ export type SocketTicketStore = {
 };
 export type DeviceAuthorizationStatus = 'approved' | 'denied' | 'pending';
 export type DeviceAuthorization = {
+    audience?: string;
     clientId: string;
     createdAt: number;
     deviceCodeHash: string;

package/dist/server.js

@@ -4256,6 +4256,7 @@ var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resour
 var agentProtectedResourceMetadata = (config) => ({
   authorization_servers: [config.authorizationServer],
   bearer_methods_supported: ["header"],
+  ...config.dpopBoundAccessTokensRequired === true ? { dpop_bound_access_tokens_required: true } : {},
   ...config.logoUri === undefined ? {} : { resource_logo_uri: config.logoUri },
   ...config.resourceName === undefined ? {} : { resource_name: config.resourceName },
   resource: config.resource,
@@ -8330,6 +8331,7 @@ var generateUserCode = () => {
   return `${code.slice(0, USER_CODE_HALF_LENGTH)}-${code.slice(USER_CODE_HALF_LENGTH)}`;
 };
 var issueDeviceAuthorization = async ({
+  audience,
   clientId,
   config,
   now = Date.now(),
@@ -8343,6 +8345,7 @@ var issueDeviceAuthorization = async ({
   const ttl = config.deviceCodeTtlMs ?? DEFAULT_DEVICE_CODE_TTL_MS;
   const interval = config.devicePollIntervalSeconds ?? DEFAULT_DEVICE_POLL_INTERVAL_SECONDS;
   await config.deviceAuthorizationStore.saveDeviceAuthorization({
+    audience,
     clientId,
     createdAt: now,
     deviceCodeHash: await hashToken(deviceCode),
@@ -8424,6 +8427,7 @@ var exchangeDeviceCode = async ({
   }
   await config.deviceAuthorizationStore.deleteByDeviceCodeHash(deviceCodeHash);
   const tokenSet = await issueTokenSet({
+    audience: record.audience,
     clientId,
     config,
     dpopJkt,
@@ -10665,6 +10669,7 @@ var oidcProviderRoutes = (config) => {
     body: t17.Object({
       client_id: t17.Optional(t17.String()),
       client_secret: t17.Optional(t17.String()),
+      resource: t17.Optional(t17.String()),
       scope: t17.Optional(t17.String())
     }),
     headers: t17.Object({
@@ -10686,6 +10691,7 @@ var oidcProviderRoutes = (config) => {
     }
     const requested = body.scope === undefined || body.scope.length === 0 ? client.scopes : body.scope.split(" ").filter((entry) => client.scopes.includes(entry));
     const response = await issueDeviceAuthorization({
+      audience: body.resource,
       clientId: client.clientId,
       config,
       now: Date.now(),
@@ -38756,6 +38762,7 @@ var oauthCodesTable = pgTable("auth_oauth_codes", {
   user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
 });
 var oauthDeviceAuthorizationsTable = pgTable("auth_oauth_device_authorizations", {
+  audience: varchar("audience", { length: 2048 }),
   client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   device_code_hash: varchar("device_code_hash", {
@@ -38871,6 +38878,7 @@ var toCodeValues = (code) => ({
   user_id: code.userId
 });
 var toDeviceAuth = (row) => ({
+  audience: row.audience ?? undefined,
   clientId: row.client_id,
   createdAt: row.created_at_ms,
   deviceCodeHash: row.device_code_hash,
@@ -39008,6 +39016,7 @@ var createPostgresDeviceAuthorizationStore = (db) => ({
   },
   saveDeviceAuthorization: async (deviceAuthorization) => {
     await db.insert(oauthDeviceAuthorizationsTable).values({
+      audience: deviceAuthorization.audience ?? null,
       client_id: deviceAuthorization.clientId,
       created_at_ms: deviceAuthorization.createdAt,
       device_code_hash: deviceAuthorization.deviceCodeHash,
@@ -40563,6 +40572,10 @@ var oidcSocketTicketsMigration = {
   id: "0004_socket_tickets",
   sql: tablesToInitSql([oauthSocketTicketsTable])
 };
+var oidcDeviceAudienceMigration = {
+  id: "0005_device_resource_audience",
+  sql: 'ALTER TABLE "auth_oauth_device_authorizations" ADD COLUMN IF NOT EXISTS "audience" varchar(2048);'
+};
 var sessionOAuthSubjectMigration = {
   id: "0002_oauth_subject",
   sql: [
@@ -40638,7 +40651,8 @@ var blockMigrations = {
       ]).migrations,
       oidcResourceAudienceMigration,
       oidcRefreshTokenFamiliesMigration,
-      oidcSocketTicketsMigration
+      oidcSocketTicketsMigration,
+      oidcDeviceAudienceMigration
     ]
   },
   organizations: initMigration("organizations", [
@@ -41658,5 +41672,5 @@ export {
   VerificationProviderError
 };
 
-//# debugId=77EFAA9D607737B964756E2164756E21
+//# debugId=A14F7F9FF66E9B8A64756E2164756E21
 //# sourceMappingURL=server.js.map