@absolutejs/auth 0.76.2 → 0.77.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/dist/agents/index.js.map +2 -2
  2. package/dist/cli/migrate.js.map +1 -1
  3. package/dist/client/index.js +5 -3
  4. package/dist/client/index.js.map +4 -4
  5. package/dist/client/mobile.js +5 -3
  6. package/dist/client/mobile.js.map +4 -4
  7. package/dist/index.d.ts +2 -2
  8. package/dist/index.js +23 -14
  9. package/dist/index.js.map +12 -12
  10. package/dist/linkedProviders/index.d.ts +3 -1
  11. package/dist/linkedProviders/index.js +11983 -8
  12. package/dist/linkedProviders/index.js.map +103 -5
  13. package/dist/linkedProviders/neonStores.d.ts +8 -2
  14. package/dist/linkedProviders/resolver.d.ts +16 -1
  15. package/dist/oidc/index.js.map +2 -2
  16. package/dist/server.js +19 -14
  17. package/dist/server.js.map +12 -12
  18. package/dist/syncNamespace.d.ts +2 -1
  19. package/package.json +1 -1
package/dist/cli/migrate.js.map CHANGED
@@ -16,7 +16,7 @@
16
16
  "import { desc, eq, lt } from 'drizzle-orm';\nimport { bigint, jsonb, pgTable, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport { isAuditEventType, type AuditEvent, type AuditSink } from './types';\n\nconst ID_LENGTH = 255;\nconst IP_LENGTH = 64;\nconst TYPE_LENGTH = 64;\nconst DEFAULT_AUDIT_LIMIT = 100;\n\nexport const auditEventsTable = pgTable('auth_audit_events', {\n\tat_ms: bigint('at_ms', { mode: 'number' }).notNull(),\n\tid: varchar('id', { length: ID_LENGTH }).primaryKey(),\n\tip: varchar('ip', { length: IP_LENGTH }),\n\tmetadata_json: jsonb('metadata_json').$type<Record<string, unknown>>(),\n\torganization_id: varchar('organization_id', { length: ID_LENGTH }),\n\ttype: varchar('type', { length: TYPE_LENGTH }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH })\n});\n\ntype AuditRow = typeof auditEventsTable.$inferSelect;\n\nconst toEvent = (row: AuditRow): AuditEvent => {\n\tif (!isAuditEventType(row.type))\n\t\tthrow new Error(`Unknown persisted audit event type: ${row.type}`);\n\n\treturn {\n\t\tat: row.at_ms,\n\t\tip: row.ip ?? undefined,\n\t\tmetadata: row.metadata_json ?? undefined,\n\t\torganizationId: row.organization_id ?? undefined,\n\t\ttype: row.type,\n\t\tuserId: row.user_id ?? undefined\n\t};\n};\n\nexport const createNeonAuditSink = (databaseUrl: string) =>\n\tcreatePostgresAuditSink(createNeonDatabase(databaseUrl));\nexport const createPostgresAuditSink = <DB extends AnyPgDatabase>(\n\tdb: DB\n): AuditSink => ({\n\tappend: async (event) => {\n\t\tawait db.insert(auditEventsTable).values({\n\t\t\tat_ms: event.at,\n\t\t\tid: crypto.randomUUID(),\n\t\t\tip: event.ip ?? null,\n\t\t\tmetadata_json: event.metadata ?? null,\n\t\t\torganization_id: event.organizationId ?? null,\n\t\t\ttype: event.type,\n\t\t\tuser_id: event.userId ?? null\n\t\t});\n\t},\n\tlist: async (filter) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(auditEventsTable)\n\t\t\t.where(\n\t\t\t\tfilter?.userId\n\t\t\t\t\t? eq(auditEventsTable.user_id, filter.userId)\n\t\t\t\t\t: undefined\n\t\t\t)\n\t\t\t.orderBy(desc(auditEventsTable.at_ms))\n\t\t\t.limit(filter?.limit ?? DEFAULT_AUDIT_LIMIT);\n\n\t\treturn rows.map(toEvent);\n\t},\n\tprune: async (before) => {\n\t\tconst deleted = await db\n\t\t\t.delete(auditEventsTable)\n\t\t\t.where(lt(auditEventsTable.at_ms, before))\n\t\t\t.returning({ id: auditEventsTable.id });\n\n\t\treturn deleted.length;\n\t}\n});\n",
17
17
  "import { eq } from 'drizzle-orm';\nimport {\n\tbigint,\n\tboolean,\n\tjsonb,\n\tpgTable,\n\ttext,\n\tvarchar\n} from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type {\n\tCredentialRecord,\n\tCredentialStatus,\n\tCredentialStore,\n\tCredentialToken\n} from './types';\n\nconst EMAIL_LENGTH = 320;\nconst ID_LENGTH = 255;\nconst STATUS_LENGTH = 32;\nconst TOKEN_HASH_LENGTH = 255;\n\nexport const credentialsTable = pgTable('auth_credentials', {\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\temail: varchar('email', { length: EMAIL_LENGTH }).primaryKey(),\n\temail_verified: boolean('email_verified').notNull().default(false),\n\torganization_id: varchar('organization_id', { length: ID_LENGTH }),\n\tpassword_hash: text('password_hash').notNull(),\n\tregistration_data:\n\t\tjsonb('registration_data').$type<Record<string, unknown>>(),\n\tstatus: varchar('status', { length: STATUS_LENGTH })\n\t\t.notNull()\n\t\t.default('active'),\n\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH })\n});\n\nconst createTokenTable = (name: string) =>\n\tpgTable(name, {\n\t\temail: varchar('email', { length: EMAIL_LENGTH }).notNull(),\n\t\texpires_at_ms: bigint('expires_at_ms', { mode: 'number' }).notNull(),\n\t\ttoken_hash: varchar('token_hash', {\n\t\t\tlength: TOKEN_HASH_LENGTH\n\t\t}).primaryKey()\n\t});\n\nexport const credentialResetTokensTable = createTokenTable(\n\t'auth_credential_reset_tokens'\n);\nexport const credentialVerificationTokensTable = createTokenTable(\n\t'auth_credential_verification_tokens'\n);\n\ntype CredentialRow = typeof credentialsTable.$inferSelect;\ntype CredentialInsert = typeof credentialsTable.$inferInsert;\ntype TokenTable = ReturnType<typeof createTokenTable>;\ntype TokenRow = TokenTable['$inferSelect'];\ntype TokenInsert = TokenTable['$inferInsert'];\n\nconst CREDENTIAL_STATUSES: CredentialStatus[] = ['active', 'disabled'];\n\nconst isCredentialStatus = (value: string): value is CredentialStatus =>\n\tCREDENTIAL_STATUSES.some((status) => status === value);\n\nconst toCredentialRecord = (row: CredentialRow): CredentialRecord => ({\n\tcreatedAt: row.created_at_ms,\n\temail: row.email,\n\temailVerified: row.email_verified,\n\torganizationId: row.organization_id ?? undefined,\n\tpasswordHash: row.password_hash,\n\tregistrationData: row.registration_data ?? undefined,\n\tstatus: isCredentialStatus(row.status) ? row.status : 'active',\n\tupdatedAt: row.updated_at_ms,\n\tuserId: row.user_id ?? undefined\n});\n\nconst toToken = (row: TokenRow): CredentialToken => ({\n\temail: row.email,\n\texpiresAt: row.expires_at_ms,\n\ttokenHash: row.token_hash\n});\n\nconst saveToken = async <DB extends AnyPgDatabase>(\n\tdb: DB,\n\ttable: TokenTable,\n\ttoken: CredentialToken\n) => {\n\tconst values: TokenInsert = {\n\t\temail: token.email.toLowerCase(),\n\t\texpires_at_ms: token.expiresAt,\n\t\ttoken_hash: token.tokenHash\n\t};\n\tawait db\n\t\t.insert(table)\n\t\t.values(values)\n\t\t.onConflictDoUpdate({ set: values, target: table.token_hash });\n};\n\nconst consumeToken = async <DB extends AnyPgDatabase>(\n\tdb: DB,\n\ttable: TokenTable,\n\ttokenHash: string\n) => {\n\tconst [row] = await db\n\t\t.select()\n\t\t.from(table)\n\t\t.where(eq(table.token_hash, tokenHash))\n\t\t.limit(1);\n\tif (!row) return undefined;\n\n\tawait db.delete(table).where(eq(table.token_hash, tokenHash));\n\tif (row.expires_at_ms < Date.now()) return undefined;\n\n\treturn toToken(row);\n};\n\nexport const createNeonCredentialStore = (databaseUrl: string) =>\n\tcreatePostgresCredentialStore(createNeonDatabase(databaseUrl));\nexport const createPostgresCredentialStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): CredentialStore => ({\n\tconsumeResetToken: (tokenHash) =>\n\t\tconsumeToken(db, credentialResetTokensTable, tokenHash),\n\tconsumeVerificationToken: (tokenHash) =>\n\t\tconsumeToken(db, credentialVerificationTokensTable, tokenHash),\n\tgetCredentialByEmail: async (email) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(credentialsTable)\n\t\t\t.where(eq(credentialsTable.email, email.toLowerCase()))\n\t\t\t.limit(1);\n\n\t\treturn row ? toCredentialRecord(row) : undefined;\n\t},\n\tsaveCredential: async (credential) => {\n\t\tconst values: CredentialInsert = {\n\t\t\tcreated_at_ms: credential.createdAt,\n\t\t\temail: credential.email.toLowerCase(),\n\t\t\temail_verified: credential.emailVerified,\n\t\t\torganization_id: credential.organizationId ?? null,\n\t\t\tpassword_hash: credential.passwordHash,\n\t\t\tregistration_data: credential.registrationData ?? null,\n\t\t\tstatus: credential.status,\n\t\t\tupdated_at_ms: credential.updatedAt,\n\t\t\tuser_id: credential.userId ?? null\n\t\t};\n\t\tawait db.insert(credentialsTable).values(values).onConflictDoUpdate({\n\t\t\tset: values,\n\t\t\ttarget: credentialsTable.email\n\t\t});\n\t},\n\tsaveResetToken: (token) => saveToken(db, credentialResetTokensTable, token),\n\tsaveVerificationToken: (token) =>\n\t\tsaveToken(db, credentialVerificationTokensTable, token),\n\tsetEmailVerified: async (email) => {\n\t\tawait db\n\t\t\t.update(credentialsTable)\n\t\t\t.set({ email_verified: true, updated_at_ms: Date.now() })\n\t\t\t.where(eq(credentialsTable.email, email.toLowerCase()));\n\t}\n});\n",
18
18
  "import { and, eq } from 'drizzle-orm';\nimport { pgTable, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport { warrantKey } from './inMemoryStores';\nimport type { Warrant, WarrantStore } from './types';\n\nconst ID_LENGTH = 255;\n\nexport const warrantsTable = pgTable('auth_fga_warrants', {\n\tid: varchar('id', { length: ID_LENGTH }).primaryKey(),\n\trelation: varchar('relation', { length: ID_LENGTH }).notNull(),\n\tresource_id: varchar('resource_id', { length: ID_LENGTH }).notNull(),\n\tresource_type: varchar('resource_type', { length: ID_LENGTH }).notNull(),\n\tsubject_id: varchar('subject_id', { length: ID_LENGTH }).notNull(),\n\tsubject_relation: varchar('subject_relation', { length: ID_LENGTH }),\n\tsubject_type: varchar('subject_type', { length: ID_LENGTH }).notNull()\n});\n\ntype WarrantRow = typeof warrantsTable.$inferSelect;\n\nconst toWarrant = (row: WarrantRow): Warrant => ({\n\trelation: row.relation,\n\tresourceId: row.resource_id,\n\tresourceType: row.resource_type,\n\tsubjectId: row.subject_id,\n\tsubjectRelation: row.subject_relation ?? undefined,\n\tsubjectType: row.subject_type\n});\n\nexport const createNeonWarrantStore = (databaseUrl: string) =>\n\tcreatePostgresWarrantStore(createNeonDatabase(databaseUrl));\nexport const createPostgresWarrantStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): WarrantStore => ({\n\tdeleteWarrant: async (warrant) => {\n\t\tawait db\n\t\t\t.delete(warrantsTable)\n\t\t\t.where(eq(warrantsTable.id, warrantKey(warrant)));\n\t},\n\tlistForResource: async (resourceType, resourceId, relation) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(warrantsTable)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(warrantsTable.resource_type, resourceType),\n\t\t\t\t\teq(warrantsTable.resource_id, resourceId),\n\t\t\t\t\teq(warrantsTable.relation, relation)\n\t\t\t\t)\n\t\t\t);\n\n\t\treturn rows.map(toWarrant);\n\t},\n\tlistResourceIds: async (resourceType) => {\n\t\tconst rows = await db\n\t\t\t.selectDistinct({ resourceId: warrantsTable.resource_id })\n\t\t\t.from(warrantsTable)\n\t\t\t.where(eq(warrantsTable.resource_type, resourceType));\n\n\t\treturn rows.map((row) => row.resourceId);\n\t},\n\tsaveWarrant: async (warrant) => {\n\t\tawait db\n\t\t\t.insert(warrantsTable)\n\t\t\t.values({\n\t\t\t\tid: warrantKey(warrant),\n\t\t\t\trelation: warrant.relation,\n\t\t\t\tresource_id: warrant.resourceId,\n\t\t\t\tresource_type: warrant.resourceType,\n\t\t\t\tsubject_id: warrant.subjectId,\n\t\t\t\tsubject_relation: warrant.subjectRelation ?? null,\n\t\t\t\tsubject_type: warrant.subjectType\n\t\t\t})\n\t\t\t.onConflictDoNothing({ target: warrantsTable.id });\n\t}\n});\n",
19
- "import type {\n\tLinkedProviderBinding,\n\tLinkedProviderBindingStore,\n\tLinkedProviderGrant,\n\tLinkedProviderGrantStore,\n\tJsonObject\n} from '@absolutejs/linked-providers';\nimport { neon } from '@neondatabase/serverless';\nimport { desc, eq, sql as drizzleSql } from 'drizzle-orm';\nimport { drizzle } from 'drizzle-orm/neon-http';\nimport { jsonb, pgTable, text, timestamp, varchar } from 'drizzle-orm/pg-core';\nimport type { AnyPgDatabase } from '../stores/postgres';\nimport type { OAuth2ConfigurationOptions } from '../types';\nimport { createOAuthLinkedProviderCredentialResolver } from './oauthResolver';\n\nexport const linkedProviderBindingsTable = pgTable('linked_provider_bindings', {\n\tavailable_scopes: jsonb('available_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tcapabilities: jsonb('capabilities').$type<string[]>().default([]),\n\tconnector_provider: varchar('connector_provider', { length: 64 }).notNull(),\n\tcreated_at: timestamp('created_at').notNull().defaultNow(),\n\temail: varchar('email', { length: 320 }),\n\texternal_account_id: varchar('external_account_id', {\n\t\tlength: 255\n\t}).notNull(),\n\texternal_account_type: varchar('external_account_type', {\n\t\tlength: 64\n\t}).notNull(),\n\tgrant_id: varchar('grant_id', { length: 255 }).notNull(),\n\tid: varchar('id', { length: 255 }).primaryKey(),\n\tlabel: varchar('label', { length: 255 }),\n\tmetadata: jsonb('metadata').$type<JsonObject>().default({}),\n\tstatus: varchar('status', { length: 64 })\n\t\t.$type<LinkedProviderBinding['status']>()\n\t\t.notNull(),\n\tupdated_at: timestamp('updated_at').notNull().defaultNow(),\n\tusername: varchar('username', { length: 255 })\n});\nexport const linkedProviderGrantsTable = pgTable('linked_provider_grants', {\n\taccess_token_ciphertext: text('access_token_ciphertext'),\n\tauth_provider_key: varchar('auth_provider_key', { length: 64 }).notNull(),\n\tcreated_at: timestamp('created_at').notNull().defaultNow(),\n\texpires_at: timestamp('expires_at'),\n\tgranted_scopes: jsonb('granted_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tid: varchar('id', { length: 255 }).primaryKey(),\n\tlast_refresh_error: text('last_refresh_error'),\n\tlast_refreshed_at: timestamp('last_refreshed_at'),\n\tmetadata: jsonb('metadata').$type<JsonObject>().default({}),\n\towner_ref: varchar('owner_ref', { length: 255 }).notNull(),\n\tprovider_family: varchar('provider_family', { length: 64 }).notNull(),\n\tprovider_subject: varchar('provider_subject', { length: 255 }).notNull(),\n\trefresh_token_ciphertext: text('refresh_token_ciphertext'),\n\tstatus: varchar('status', { length: 64 })\n\t\t.$type<LinkedProviderGrant['status']>()\n\t\t.notNull(),\n\ttoken_type: varchar('token_type', { length: 64 }),\n\tupdated_at: timestamp('updated_at').notNull().defaultNow()\n});\nexport type LinkedProviderGrantRow =\n\ttypeof linkedProviderGrantsTable.$inferSelect;\nexport type LinkedProviderBindingRow =\n\ttypeof linkedProviderBindingsTable.$inferSelect;\n\nconst toTimestamp = (value: number | undefined) =>\n\tvalue === undefined ? null : new Date(value);\n\nconst fromTimestamp = (value: Date | null) =>\n\tvalue === null ? undefined : value.getTime();\n\nconst toGrant = (row: LinkedProviderGrantRow): LinkedProviderGrant => ({\n\taccessTokenCiphertext: row.access_token_ciphertext ?? undefined,\n\tauthProviderKey: row.auth_provider_key,\n\tcreatedAt: row.created_at.getTime(),\n\texpiresAt: fromTimestamp(row.expires_at),\n\tgrantedScopes: row.granted_scopes ?? [],\n\tid: row.id,\n\tlastRefreshedAt: fromTimestamp(row.last_refreshed_at),\n\tlastRefreshError: row.last_refresh_error ?? undefined,\n\tmetadata: row.metadata ?? undefined,\n\townerRef: row.owner_ref,\n\tproviderFamily: row.provider_family,\n\tproviderSubject: row.provider_subject,\n\trefreshTokenCiphertext: row.refresh_token_ciphertext ?? undefined,\n\tstatus: row.status,\n\ttokenType: row.token_type ?? undefined,\n\tupdatedAt: row.updated_at.getTime()\n});\n\nconst toBinding = (row: LinkedProviderBindingRow): LinkedProviderBinding => ({\n\tavailableScopes: row.available_scopes ?? [],\n\tcapabilities: row.capabilities ?? undefined,\n\tconnectorProvider: row.connector_provider,\n\tcreatedAt: row.created_at.getTime(),\n\temail: row.email ?? undefined,\n\texternalAccountId: row.external_account_id,\n\texternalAccountType: row.external_account_type,\n\tgrantId: row.grant_id,\n\tid: row.id,\n\tlabel: row.label ?? undefined,\n\tmetadata: row.metadata ?? undefined,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at.getTime(),\n\tusername: row.username ?? undefined\n});\n\nexport const createNeonLinkedProviderBindingStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LinkedProviderBindingStore => ({\n\tgetBinding: async (id) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.id, id))\n\t\t\t.limit(1);\n\n\t\treturn row ? toBinding(row) : undefined;\n\t},\n\tlistBindingsByGrant: async (grantId) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.grant_id, grantId))\n\t\t\t.orderBy(desc(linkedProviderBindingsTable.updated_at));\n\n\t\treturn rows.map(toBinding);\n\t},\n\tlistBindingsByOwner: async (ownerRef) => {\n\t\tconst rows = await db\n\t\t\t.select({ binding: linkedProviderBindingsTable })\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.innerJoin(\n\t\t\t\tlinkedProviderGrantsTable,\n\t\t\t\teq(\n\t\t\t\t\tlinkedProviderBindingsTable.grant_id,\n\t\t\t\t\tlinkedProviderGrantsTable.id\n\t\t\t\t)\n\t\t\t)\n\t\t\t.where(eq(linkedProviderGrantsTable.owner_ref, ownerRef))\n\t\t\t.orderBy(desc(linkedProviderBindingsTable.updated_at));\n\n\t\treturn rows.map(({ binding }) => toBinding(binding));\n\t},\n\tremoveBinding: async (id) => {\n\t\tawait db\n\t\t\t.delete(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.id, id));\n\t},\n\tsaveBinding: async (binding) => {\n\t\tawait db\n\t\t\t.insert(linkedProviderBindingsTable)\n\t\t\t.values({\n\t\t\t\tavailable_scopes: binding.availableScopes,\n\t\t\t\tcapabilities: binding.capabilities ?? [],\n\t\t\t\tconnector_provider: binding.connectorProvider,\n\t\t\t\tcreated_at: new Date(binding.createdAt),\n\t\t\t\temail: binding.email ?? null,\n\t\t\t\texternal_account_id: binding.externalAccountId,\n\t\t\t\texternal_account_type: binding.externalAccountType,\n\t\t\t\tgrant_id: binding.grantId,\n\t\t\t\tid: binding.id,\n\t\t\t\tlabel: binding.label ?? null,\n\t\t\t\tmetadata: binding.metadata ?? {},\n\t\t\t\tstatus: binding.status,\n\t\t\t\tupdated_at: new Date(binding.updatedAt),\n\t\t\t\tusername: binding.username ?? null\n\t\t\t})\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: {\n\t\t\t\t\tavailable_scopes: binding.availableScopes,\n\t\t\t\t\tcapabilities: binding.capabilities ?? [],\n\t\t\t\t\tconnector_provider: binding.connectorProvider,\n\t\t\t\t\temail: binding.email ?? null,\n\t\t\t\t\texternal_account_id: binding.externalAccountId,\n\t\t\t\t\texternal_account_type: binding.externalAccountType,\n\t\t\t\t\tgrant_id: binding.grantId,\n\t\t\t\t\tlabel: binding.label ?? null,\n\t\t\t\t\tmetadata: binding.metadata ?? {},\n\t\t\t\t\tstatus: binding.status,\n\t\t\t\t\tupdated_at: new Date(binding.updatedAt),\n\t\t\t\t\tusername: binding.username ?? null\n\t\t\t\t},\n\t\t\t\ttarget: linkedProviderBindingsTable.id\n\t\t\t});\n\t}\n});\nexport const createNeonLinkedProviderGrantStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LinkedProviderGrantStore => ({\n\tgetGrant: async (id) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.id, id))\n\t\t\t.limit(1);\n\n\t\treturn row ? toGrant(row) : undefined;\n\t},\n\tlistGrantsByOwner: async (ownerRef) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.owner_ref, ownerRef))\n\t\t\t.orderBy(desc(linkedProviderGrantsTable.updated_at));\n\n\t\treturn rows.map(toGrant);\n\t},\n\tremoveGrant: async (id) => {\n\t\tawait db\n\t\t\t.delete(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.grant_id, id));\n\t\tawait db\n\t\t\t.delete(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.id, id));\n\t},\n\tsaveGrant: async (grant) => {\n\t\tawait db\n\t\t\t.insert(linkedProviderGrantsTable)\n\t\t\t.values({\n\t\t\t\taccess_token_ciphertext: grant.accessTokenCiphertext ?? null,\n\t\t\t\tauth_provider_key: grant.authProviderKey,\n\t\t\t\tcreated_at: new Date(grant.createdAt),\n\t\t\t\texpires_at: toTimestamp(grant.expiresAt),\n\t\t\t\tgranted_scopes: grant.grantedScopes,\n\t\t\t\tid: grant.id,\n\t\t\t\tlast_refresh_error: grant.lastRefreshError ?? null,\n\t\t\t\tlast_refreshed_at: toTimestamp(grant.lastRefreshedAt),\n\t\t\t\tmetadata: grant.metadata ?? {},\n\t\t\t\towner_ref: grant.ownerRef,\n\t\t\t\tprovider_family: grant.providerFamily,\n\t\t\t\tprovider_subject: grant.providerSubject,\n\t\t\t\trefresh_token_ciphertext: grant.refreshTokenCiphertext ?? null,\n\t\t\t\tstatus: grant.status,\n\t\t\t\ttoken_type: grant.tokenType ?? null,\n\t\t\t\tupdated_at: new Date(grant.updatedAt)\n\t\t\t})\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: {\n\t\t\t\t\taccess_token_ciphertext:\n\t\t\t\t\t\tgrant.accessTokenCiphertext ?? null,\n\t\t\t\t\tauth_provider_key: grant.authProviderKey,\n\t\t\t\t\texpires_at: toTimestamp(grant.expiresAt),\n\t\t\t\t\tgranted_scopes: grant.grantedScopes,\n\t\t\t\t\tlast_refresh_error: grant.lastRefreshError ?? null,\n\t\t\t\t\tlast_refreshed_at: toTimestamp(grant.lastRefreshedAt),\n\t\t\t\t\tmetadata: grant.metadata ?? {},\n\t\t\t\t\towner_ref: grant.ownerRef,\n\t\t\t\t\tprovider_family: grant.providerFamily,\n\t\t\t\t\tprovider_subject: grant.providerSubject,\n\t\t\t\t\trefresh_token_ciphertext: drizzleSql`coalesce(excluded.refresh_token_ciphertext, ${linkedProviderGrantsTable.refresh_token_ciphertext})`,\n\t\t\t\t\tstatus: grant.status,\n\t\t\t\t\ttoken_type: grant.tokenType ?? null,\n\t\t\t\t\tupdated_at: new Date(grant.updatedAt)\n\t\t\t\t},\n\t\t\t\ttarget: linkedProviderGrantsTable.id\n\t\t\t});\n\t}\n});\nexport const createNeonLinkedProviderStores = (databaseUrl: string) => {\n\tconst sql = neon(databaseUrl);\n\tconst db = drizzle({ client: sql });\n\n\treturn {\n\t\tbindingStore: createNeonLinkedProviderBindingStore(db),\n\t\tdb,\n\t\tgrantStore: createNeonLinkedProviderGrantStore(db)\n\t};\n};\n\nexport type CreateNeonOAuthLinkedProviderCredentialResolverOptions = {\n\tdatabaseUrl: string;\n\tprovidersConfiguration: OAuth2ConfigurationOptions;\n\tnow?: () => number;\n};\n\nexport const createNeonOAuthLinkedProviderCredentialResolver = async ({\n\tdatabaseUrl,\n\tnow,\n\tprovidersConfiguration\n}: CreateNeonOAuthLinkedProviderCredentialResolverOptions) => {\n\tconst stores = createNeonLinkedProviderStores(databaseUrl);\n\n\treturn createOAuthLinkedProviderCredentialResolver({\n\t\t...stores,\n\t\tnow,\n\t\tprovidersConfiguration\n\t});\n};\n",
19
+ "import type {\n\tLinkedProviderBinding,\n\tLinkedProviderBindingStore,\n\tLinkedProviderGrant,\n\tLinkedProviderGrantStore,\n\tJsonObject\n} from '@absolutejs/linked-providers';\nimport { neon } from '@neondatabase/serverless';\nimport { desc, eq, sql as drizzleSql } from 'drizzle-orm';\nimport { drizzle } from 'drizzle-orm/neon-http';\nimport { jsonb, pgTable, text, timestamp, varchar } from 'drizzle-orm/pg-core';\nimport type { AnyPgDatabase } from '../stores/postgres';\nimport type { OAuth2ConfigurationOptions } from '../types';\nimport { createOAuthLinkedProviderCredentialResolver } from './oauthResolver';\n\nexport const linkedProviderBindingsTable = pgTable('linked_provider_bindings', {\n\tavailable_scopes: jsonb('available_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tcapabilities: jsonb('capabilities').$type<string[]>().default([]),\n\tconnector_provider: varchar('connector_provider', { length: 64 }).notNull(),\n\tcreated_at: timestamp('created_at').notNull().defaultNow(),\n\temail: varchar('email', { length: 320 }),\n\texternal_account_id: varchar('external_account_id', {\n\t\tlength: 255\n\t}).notNull(),\n\texternal_account_type: varchar('external_account_type', {\n\t\tlength: 64\n\t}).notNull(),\n\tgrant_id: varchar('grant_id', { length: 255 }).notNull(),\n\tid: varchar('id', { length: 255 }).primaryKey(),\n\tlabel: varchar('label', { length: 255 }),\n\tmetadata: jsonb('metadata').$type<JsonObject>().default({}),\n\tstatus: varchar('status', { length: 64 })\n\t\t.$type<LinkedProviderBinding['status']>()\n\t\t.notNull(),\n\tupdated_at: timestamp('updated_at').notNull().defaultNow(),\n\tusername: varchar('username', { length: 255 })\n});\nexport const linkedProviderGrantsTable = pgTable('linked_provider_grants', {\n\taccess_token_ciphertext: text('access_token_ciphertext'),\n\tauth_provider_key: varchar('auth_provider_key', { length: 64 }).notNull(),\n\tcreated_at: timestamp('created_at').notNull().defaultNow(),\n\texpires_at: timestamp('expires_at'),\n\tgranted_scopes: jsonb('granted_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tid: varchar('id', { length: 255 }).primaryKey(),\n\tlast_refresh_error: text('last_refresh_error'),\n\tlast_refreshed_at: timestamp('last_refreshed_at'),\n\tmetadata: jsonb('metadata').$type<JsonObject>().default({}),\n\towner_ref: varchar('owner_ref', { length: 255 }).notNull(),\n\tprovider_family: varchar('provider_family', { length: 64 }).notNull(),\n\tprovider_subject: varchar('provider_subject', { length: 255 }).notNull(),\n\trefresh_token_ciphertext: text('refresh_token_ciphertext'),\n\tstatus: varchar('status', { length: 64 })\n\t\t.$type<LinkedProviderGrant['status']>()\n\t\t.notNull(),\n\ttoken_type: varchar('token_type', { length: 64 }),\n\tupdated_at: timestamp('updated_at').notNull().defaultNow()\n});\nexport type LinkedProviderGrantRow =\n\ttypeof linkedProviderGrantsTable.$inferSelect;\nexport type LinkedProviderBindingRow =\n\ttypeof linkedProviderBindingsTable.$inferSelect;\n\nconst toTimestamp = (value: number | undefined) =>\n\tvalue === undefined ? null : new Date(value);\n\nconst fromTimestamp = (value: Date | null) =>\n\tvalue === null ? undefined : value.getTime();\n\nconst toGrant = (row: LinkedProviderGrantRow): LinkedProviderGrant => ({\n\taccessTokenCiphertext: row.access_token_ciphertext ?? undefined,\n\tauthProviderKey: row.auth_provider_key,\n\tcreatedAt: row.created_at.getTime(),\n\texpiresAt: fromTimestamp(row.expires_at),\n\tgrantedScopes: row.granted_scopes ?? [],\n\tid: row.id,\n\tlastRefreshedAt: fromTimestamp(row.last_refreshed_at),\n\tlastRefreshError: row.last_refresh_error ?? undefined,\n\tmetadata: row.metadata ?? undefined,\n\townerRef: row.owner_ref,\n\tproviderFamily: row.provider_family,\n\tproviderSubject: row.provider_subject,\n\trefreshTokenCiphertext: row.refresh_token_ciphertext ?? undefined,\n\tstatus: row.status,\n\ttokenType: row.token_type ?? undefined,\n\tupdatedAt: row.updated_at.getTime()\n});\n\nconst toBinding = (row: LinkedProviderBindingRow): LinkedProviderBinding => ({\n\tavailableScopes: row.available_scopes ?? [],\n\tcapabilities: row.capabilities ?? undefined,\n\tconnectorProvider: row.connector_provider,\n\tcreatedAt: row.created_at.getTime(),\n\temail: row.email ?? undefined,\n\texternalAccountId: row.external_account_id,\n\texternalAccountType: row.external_account_type,\n\tgrantId: row.grant_id,\n\tid: row.id,\n\tlabel: row.label ?? undefined,\n\tmetadata: row.metadata ?? undefined,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at.getTime(),\n\tusername: row.username ?? undefined\n});\n\n/**\n * These two take a database rather than a connection string, so an application\n * that already has one uses it instead of opening a second. Nothing in either\n * is specific to Neon -- the Neon helpers below are the convenience that opens\n * a connection for a caller who has none.\n */\nexport const createLinkedProviderBindingStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LinkedProviderBindingStore => ({\n\tgetBinding: async (id) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.id, id))\n\t\t\t.limit(1);\n\n\t\treturn row ? toBinding(row) : undefined;\n\t},\n\tlistBindingsByGrant: async (grantId) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.grant_id, grantId))\n\t\t\t.orderBy(desc(linkedProviderBindingsTable.updated_at));\n\n\t\treturn rows.map(toBinding);\n\t},\n\tlistBindingsByOwner: async (ownerRef) => {\n\t\tconst rows = await db\n\t\t\t.select({ binding: linkedProviderBindingsTable })\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.innerJoin(\n\t\t\t\tlinkedProviderGrantsTable,\n\t\t\t\teq(\n\t\t\t\t\tlinkedProviderBindingsTable.grant_id,\n\t\t\t\t\tlinkedProviderGrantsTable.id\n\t\t\t\t)\n\t\t\t)\n\t\t\t.where(eq(linkedProviderGrantsTable.owner_ref, ownerRef))\n\t\t\t.orderBy(desc(linkedProviderBindingsTable.updated_at));\n\n\t\treturn rows.map(({ binding }) => toBinding(binding));\n\t},\n\tremoveBinding: async (id) => {\n\t\tawait db\n\t\t\t.delete(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.id, id));\n\t},\n\tsaveBinding: async (binding) => {\n\t\tawait db\n\t\t\t.insert(linkedProviderBindingsTable)\n\t\t\t.values({\n\t\t\t\tavailable_scopes: binding.availableScopes,\n\t\t\t\tcapabilities: binding.capabilities ?? [],\n\t\t\t\tconnector_provider: binding.connectorProvider,\n\t\t\t\tcreated_at: new Date(binding.createdAt),\n\t\t\t\temail: binding.email ?? null,\n\t\t\t\texternal_account_id: binding.externalAccountId,\n\t\t\t\texternal_account_type: binding.externalAccountType,\n\t\t\t\tgrant_id: binding.grantId,\n\t\t\t\tid: binding.id,\n\t\t\t\tlabel: binding.label ?? null,\n\t\t\t\tmetadata: binding.metadata ?? {},\n\t\t\t\tstatus: binding.status,\n\t\t\t\tupdated_at: new Date(binding.updatedAt),\n\t\t\t\tusername: binding.username ?? null\n\t\t\t})\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: {\n\t\t\t\t\tavailable_scopes: binding.availableScopes,\n\t\t\t\t\tcapabilities: binding.capabilities ?? [],\n\t\t\t\t\tconnector_provider: binding.connectorProvider,\n\t\t\t\t\temail: binding.email ?? null,\n\t\t\t\t\texternal_account_id: binding.externalAccountId,\n\t\t\t\t\texternal_account_type: binding.externalAccountType,\n\t\t\t\t\tgrant_id: binding.grantId,\n\t\t\t\t\tlabel: binding.label ?? null,\n\t\t\t\t\tmetadata: binding.metadata ?? {},\n\t\t\t\t\tstatus: binding.status,\n\t\t\t\t\tupdated_at: new Date(binding.updatedAt),\n\t\t\t\t\tusername: binding.username ?? null\n\t\t\t\t},\n\t\t\t\ttarget: linkedProviderBindingsTable.id\n\t\t\t});\n\t}\n});\nexport const createLinkedProviderGrantStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LinkedProviderGrantStore => ({\n\tgetGrant: async (id) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.id, id))\n\t\t\t.limit(1);\n\n\t\treturn row ? toGrant(row) : undefined;\n\t},\n\tlistGrantsByOwner: async (ownerRef) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.owner_ref, ownerRef))\n\t\t\t.orderBy(desc(linkedProviderGrantsTable.updated_at));\n\n\t\treturn rows.map(toGrant);\n\t},\n\tremoveGrant: async (id) => {\n\t\tawait db\n\t\t\t.delete(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.grant_id, id));\n\t\tawait db\n\t\t\t.delete(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.id, id));\n\t},\n\tsaveGrant: async (grant) => {\n\t\tawait db\n\t\t\t.insert(linkedProviderGrantsTable)\n\t\t\t.values({\n\t\t\t\taccess_token_ciphertext: grant.accessTokenCiphertext ?? null,\n\t\t\t\tauth_provider_key: grant.authProviderKey,\n\t\t\t\tcreated_at: new Date(grant.createdAt),\n\t\t\t\texpires_at: toTimestamp(grant.expiresAt),\n\t\t\t\tgranted_scopes: grant.grantedScopes,\n\t\t\t\tid: grant.id,\n\t\t\t\tlast_refresh_error: grant.lastRefreshError ?? null,\n\t\t\t\tlast_refreshed_at: toTimestamp(grant.lastRefreshedAt),\n\t\t\t\tmetadata: grant.metadata ?? {},\n\t\t\t\towner_ref: grant.ownerRef,\n\t\t\t\tprovider_family: grant.providerFamily,\n\t\t\t\tprovider_subject: grant.providerSubject,\n\t\t\t\trefresh_token_ciphertext: grant.refreshTokenCiphertext ?? null,\n\t\t\t\tstatus: grant.status,\n\t\t\t\ttoken_type: grant.tokenType ?? null,\n\t\t\t\tupdated_at: new Date(grant.updatedAt)\n\t\t\t})\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: {\n\t\t\t\t\taccess_token_ciphertext:\n\t\t\t\t\t\tgrant.accessTokenCiphertext ?? null,\n\t\t\t\t\tauth_provider_key: grant.authProviderKey,\n\t\t\t\t\texpires_at: toTimestamp(grant.expiresAt),\n\t\t\t\t\tgranted_scopes: grant.grantedScopes,\n\t\t\t\t\tlast_refresh_error: grant.lastRefreshError ?? null,\n\t\t\t\t\tlast_refreshed_at: toTimestamp(grant.lastRefreshedAt),\n\t\t\t\t\tmetadata: grant.metadata ?? {},\n\t\t\t\t\towner_ref: grant.ownerRef,\n\t\t\t\t\tprovider_family: grant.providerFamily,\n\t\t\t\t\tprovider_subject: grant.providerSubject,\n\t\t\t\t\trefresh_token_ciphertext: drizzleSql`coalesce(excluded.refresh_token_ciphertext, ${linkedProviderGrantsTable.refresh_token_ciphertext})`,\n\t\t\t\t\tstatus: grant.status,\n\t\t\t\t\ttoken_type: grant.tokenType ?? null,\n\t\t\t\t\tupdated_at: new Date(grant.updatedAt)\n\t\t\t\t},\n\t\t\t\ttarget: linkedProviderGrantsTable.id\n\t\t\t});\n\t}\n});\nexport const createNeonLinkedProviderStores = (databaseUrl: string) => {\n\tconst sql = neon(databaseUrl);\n\tconst db = drizzle({ client: sql });\n\n\treturn {\n\t\tbindingStore: createLinkedProviderBindingStore(db),\n\t\tdb,\n\t\tgrantStore: createLinkedProviderGrantStore(db)\n\t};\n};\n\nexport type CreateNeonOAuthLinkedProviderCredentialResolverOptions = {\n\tdatabaseUrl: string;\n\tprovidersConfiguration: OAuth2ConfigurationOptions;\n\tnow?: () => number;\n};\n\nexport const createNeonOAuthLinkedProviderCredentialResolver = async ({\n\tdatabaseUrl,\n\tnow,\n\tprovidersConfiguration\n}: CreateNeonOAuthLinkedProviderCredentialResolverOptions) => {\n\tconst stores = createNeonLinkedProviderStores(databaseUrl);\n\n\treturn createOAuthLinkedProviderCredentialResolver({\n\t\t...stores,\n\t\tnow,\n\t\tprovidersConfiguration\n\t});\n};\n",
20
20
  "// @bun\n// src/constants.ts\nvar BASE64_BLOCK_SIZE = 4;\nvar NUM_GENERATOR_BYTES = 32;\n\n// src/graphqlQueries.ts\nvar anilistProfileQuery = `query {\n Viewer {\n id\n name\n about\n avatar {\n large\n medium\n }\n bannerImage\n siteUrl\n createdAt\n updatedAt\n donatorTier\n donatorBadge\n unreadNotificationCount\n options {\n titleLanguage\n displayAdultContent\n airingNotifications\n profileColor\n activityMergeTime\n staffNameLanguage\n }\n mediaListOptions {\n scoreFormat\n rowOrder\n animeList {\n sectionOrder\n customLists\n advancedScoringEnabled\n }\n mangaList {\n sectionOrder\n customLists\n advancedScoringEnabled\n }\n }\n statistics {\n anime {\n count\n meanScore\n minutesWatched\n episodesWatched\n }\n manga {\n count\n meanScore\n chaptersRead\n volumesRead\n }\n }\n favourites {\n anime {\n nodes {\n id\n title {\n romaji\n english\n }\n siteUrl\n }\n }\n manga {\n nodes {\n id\n title {\n romaji\n english\n }\n siteUrl\n }\n }\n characters {\n nodes {\n id\n name {\n full\n }\n image {\n large\n }\n }\n }\n staff {\n nodes {\n id\n name {\n full\n }\n image {\n large\n }\n }\n }\n studios {\n nodes {\n id\n name\n siteUrl\n }\n }\n }\n isFollower\n isFollowing\n }\n}`;\n\n// src/providers.ts\nvar defineProviders = (providers) => providers;\nvar providers = defineProviders({\n \"42\": {\n authorizationUrl: \"https://api.intra.42.fr/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.intra.42.fr/v2/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.intra.42.fr/oauth/token\"\n }\n },\n absolutejs: {\n authorizationUrl: (config) => `https://${config.baseURL ?? \"absolutejs.ai\"}/oauth2/authorize`,\n email: [\"email\"],\n fullName: [\"name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.baseURL ?? \"absolutejs.ai\"}/oauth2/userinfo`\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n tokenParamName: \"token\",\n url: (config) => `https://${config.baseURL ?? \"absolutejs.ai\"}/oauth2/revoke`\n },\n scopeRequired: false,\n subject: [\"sub\"],\n subjectBySource: {\n idToken: [\"sub\"],\n profile: [\"sub\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.baseURL ?? \"absolutejs.ai\"}/oauth2/token`\n }\n },\n amazoncognito: {\n authorizationUrl: \"https://${domain}/oauth2/authorize\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.domain}/oauth2/userInfo`\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `https://${config.domain}/oauth2/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.domain}/oauth2/token`\n }\n },\n anilist: {\n authorizationUrl: \"https://anilist.co/api/v2/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n body: {\n query: anilistProfileQuery\n },\n encoding: \"application/json\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\"\n },\n method: \"POST\",\n url: \"https://graphql.anilist.co\"\n },\n scopeRequired: false,\n subject: [\"data\", \"Viewer\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://anilist.co/api/v2/oauth/token\"\n }\n },\n apple: {\n authorizationUrl: \"https://appleid.apple.com/auth/authorize\",\n createAuthorizationURLSearchParams: {\n response_mode: \"form_post\"\n },\n createClientSecret: (config) => createAppleClientSecret(config),\n isOIDC: true,\n isRefreshable: true,\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n tokenParamName: \"token\",\n url: \"https://appleid.apple.com/auth/revoke\"\n },\n scopeRequired: false,\n subject: [\"sub\"],\n subjectBySource: {\n idToken: [\"sub\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://appleid.apple.com/auth/token\"\n }\n },\n atlassian: {\n authorizationUrl: \"https://auth.atlassian.com/authorize\",\n createAuthorizationURLSearchParams: {\n audience: \"api.atlassian.com\"\n },\n email: [\"email\"],\n fullName: [\"name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"picture\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.atlassian.com/me\"\n },\n scopeRequired: true,\n subject: [\"account_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://auth.atlassian.com/oauth/token\"\n }\n },\n attio: {\n authorizationUrl: \"https://app.attio.com/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.attio.com/v2/self\"\n },\n scopeRequired: true,\n subject: [\"workspace_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://app.attio.com/oauth/token\"\n }\n },\n auth0: {\n authorizationUrl: (config) => `https://${config.domain}/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.domain}/userinfo`\n },\n revocationRequest: {\n authIn: \"body\",\n body: new URLSearchParams({\n token_type_hint: \"refresh_token\"\n }),\n encoding: \"application/json\",\n inputSource: \"refreshToken\",\n tokenParamName: \"token\",\n url: (config) => `https://${config.domain}/oauth/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.domain}/oauth/token`\n }\n },\n authentik: {\n authorizationUrl: (config) => `https://${config.baseURL}/oauth/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.baseURL}/api/v3/user/`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.baseURL}/oauth/token`\n }\n },\n autodesk: {\n authorizationUrl: \"https://developer.api.autodesk.com/authentication/v2/authorize\",\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.userprofile.autodesk.com/userinfo\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://developer.api.autodesk.com/authentication/v2/token\"\n }\n },\n azureadb2c: {\n authorizationUrl: (config) => `https://${config.tenantSubdomain}.b2clogin.com/${config.tenantSubdomain}.onmicrosoft.com/${config.policy}/oauth2/v2.0/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n scopeRequired: false,\n subject: [\"sub\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.tenantSubdomain}.b2clogin.com/${config.tenantSubdomain}.onmicrosoft.com/${config.policy}/oauth2/v2.0/token`\n }\n },\n battlenet: {\n authorizationUrl: \"https://oauth.battle.net/authorize\",\n isOIDC: true,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://oauth.battle.net/userinfo\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.battle.net/token\"\n }\n },\n bitbucket: {\n authorizationUrl: \"https://bitbucket.org/site/oauth2/authorize\",\n fullName: [\"display_name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"links\", \"avatar\", \"href\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.bitbucket.org/2.0/user\"\n },\n scopeRequired: false,\n subject: [\"uuid\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://bitbucket.org/site/oauth2/access_token\"\n }\n },\n box: {\n authorizationUrl: \"https://account.box.com/api/oauth2/authorize\",\n email: [\"login\"],\n fullName: [\"name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"avatar_url\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.box.com/2.0/users/me\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://api.box.com/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.box.com/oauth2/token\"\n }\n },\n bungie: {\n authorizationUrl: \"https://www.bungie.net/en/OAuth/Authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n headers: {\n \"X-API-Key\": \"<YOUR_API_KEY>\"\n },\n method: \"GET\",\n url: \"https://www.bungie.net/Platform/User/GetCurrentBungieNetUser\"\n },\n scopeRequired: false,\n subject: [\"Response\", \"membershipId\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.bungie.net/Platform/App/OAuth/token\"\n }\n },\n calendly: {\n authorizationUrl: \"https://auth.calendly.com/oauth/authorize\",\n email: [\"resource\", \"email\"],\n fullName: [\"resource\", \"name\"],\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.calendly.com/users/me\"\n },\n scopeRequired: false,\n subject: [\"resource\", \"uri\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://auth.calendly.com/oauth/token\"\n }\n },\n close: {\n authorizationUrl: \"https://app.close.com/oauth2/authorize/\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.close.com/api/v1/me/\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.close.com/oauth2/token/\"\n }\n },\n coinbase: {\n authorizationUrl: \"https://www.coinbase.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.coinbase.com/v2/user\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.coinbase.com/oauth/token\"\n }\n },\n discord: {\n authorizationUrl: \"https://discord.com/api/oauth2/authorize\",\n email: [\"email\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"avatar\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://discord.com/api/users/@me\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://discord.com/api/oauth2/token\"\n }\n },\n donationalerts: {\n authorizationUrl: \"https://www.donationalerts.com/oauth/authorize\",\n email: [\"data\", \"email\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"data\", \"avatar\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.donationalerts.com/api/v1/user/oauth\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.donationalerts.com/oauth/token\"\n }\n },\n dribbble: {\n authorizationUrl: \"https://dribbble.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.dribbble.com/v2/user\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://dribbble.com/oauth/token\"\n }\n },\n dropbox: {\n authorizationUrl: \"https://www.dropbox.com/oauth2/authorize\",\n email: [\"email\"],\n familyName: [\"name\", \"surname\"],\n fullName: [\"name\", \"display_name\"],\n givenName: [\"name\", \"given_name\"],\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"POST\",\n url: \"https://api.dropboxapi.com/2/users/get_current_account\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.dropboxapi.com/2/auth/token/revoke\"\n },\n scopeRequired: false,\n subject: [\"account_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.dropboxapi.com/oauth2/token\"\n }\n },\n epicgames: {\n authorizationUrl: \"https://www.epicgames.com/id/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.epicgames.dev/epic/oauth/v2/userInfo\"\n },\n scopeRequired: false,\n subject: [\"account_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.epicgames.dev/epic/oauth/v1/token\"\n }\n },\n etsy: {\n authorizationUrl: \"https://www.etsy.com/oauth/connect\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://openapi.etsy.com/v3/application/users/me\"\n },\n scopeRequired: false,\n subject: [\"results\", \"0\", \"user_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.etsy.com/v3/public/oauth/token\"\n }\n },\n facebook: {\n authorizationUrl: \"https://www.facebook.com/v16.0/dialog/oauth\",\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: false,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n method: \"GET\",\n searchParams: [[\"fields\", \"id,name,email,picture\"]],\n url: \"https://graph.facebook.com/me\"\n },\n scopeRequired: false,\n subject: [\"sub\"],\n subjectBySource: {\n idToken: [\"sub\"],\n profile: [\"id\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://graph.facebook.com/v16.0/oauth/access_token\"\n }\n },\n figma: {\n authorizationUrl: \"https://www.figma.com/oauth\",\n email: [\"email\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"img_url\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.figma.com/v1/me\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.figma.com/v1/oauth/token\"\n }\n },\n gitea: {\n authorizationUrl: (config) => `${config.baseURL}/login/oauth/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `${config.baseURL}/api/v1/user`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.baseURL}/login/oauth/access_token`\n }\n },\n github: {\n authorizationUrl: \"https://github.com/login/oauth/authorize\",\n email: [\"email\"],\n isOIDC: false,\n isRefreshable: false,\n picture: [\"avatar_url\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.github.com/user\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://github.com/login/oauth/access_token\"\n }\n },\n gitlab: {\n authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,\n email: [\"email\"],\n fullName: [\"name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://gitlab.com/api/v4/user\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `${config.baseURL}/oauth/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.baseURL}/oauth/token`\n }\n },\n gohighlevel: {\n authorizationUrl: \"https://marketplace.gohighlevel.com/v2/oauth/chooselocation\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n headers: {\n Version: \"2021-07-28\"\n },\n method: \"GET\",\n url: \"https://services.leadconnectorhq.com/users/me\"\n },\n scopeRequired: true,\n subject: [\"locationId\"],\n subjectBySource: {\n tokenResponse: [\"locationId\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://services.leadconnectorhq.com/oauth/token\"\n }\n },\n google: {\n authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://openidconnect.googleapis.com/v1/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://oauth2.googleapis.com/revoke\"\n },\n scopeRequired: true,\n subject: [\"sub\"],\n subjectBySource: {\n idToken: [\"sub\"],\n profile: [\"sub\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth2.googleapis.com/token\"\n }\n },\n hubspot: {\n authorizationUrl: \"https://app.hubspot.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"path\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.hubapi.com/oauth/v1/access-tokens\"\n },\n scopeRequired: true,\n subject: [\"hub_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.hubapi.com/oauth/v1/token\"\n }\n },\n intuit: {\n authorizationUrl: \"https://appcenter.intuit.com/connect/oauth2\",\n isOIDC: true,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => config.environment === \"production\" ? \"https://accounts.platform.intuit.com/v1/openid_connect/userinfo\" : \"https://sandbox-accounts.platform.intuit.com/v1/openid_connect/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n headers: (config) => ({\n Authorization: `Basic ${encodeBase64(`${config.clientId}:${config.clientSecret}`)}`\n }),\n tokenParamName: \"token\",\n url: \"https://developer.api.intuit.com/v2/oauth2/tokens/revoke\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer\"\n }\n },\n kakao: {\n authorizationUrl: \"https://kauth.kakao.com/oauth/authorize\",\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://kapi.kakao.com/v2/user/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://kauth.kakao.com/oauth/token\"\n }\n },\n keycloak: {\n authorizationUrl: (config) => `${config.realmURL}/protocol/openid-connect/auth`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.kick.com/v1/user\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `${config.realmURL}/protocol/openid-connect/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.realmURL}/protocol/openid-connect/token`\n }\n },\n kick: {\n authorizationUrl: \"https://id.kick.com/oauth/authorize\",\n email: [\"data\", \"email\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"data\", \"profile_picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.kick.com/public/v1/users\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://id.kick.com/oauth/revoke\"\n },\n scopeRequired: true,\n subject: [\"data\", \"user_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://id.kick.com/oauth/token\"\n }\n },\n lichess: {\n authorizationUrl: \"https://lichess.org/oauth/authorize\",\n isOIDC: false,\n isRefreshable: false,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://lichess.org/api/account\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://lichess.org/api/token\"\n }\n },\n line: {\n authorizationUrl: \"https://access.line.me/oauth2/v2.1/authorize\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.line.me/v2/profile\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.line.me/oauth2/v2.1/token\"\n }\n },\n linear: {\n authorizationUrl: \"https://linear.app/oauth/authorize\",\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n body: {\n query: `query { viewer { id name } }`\n },\n encoding: \"application/json\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\"\n },\n method: \"POST\",\n url: \"https://api.linear.app/graphql\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.linear.app/oauth/revoke\"\n },\n scopeRequired: false,\n subject: [\"data\", \"viewer\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.linear.app/oauth/token\"\n }\n },\n linkedin: {\n authorizationUrl: \"https://www.linkedin.com/oauth/v2/authorization\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.linkedin.com/v2/me\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.linkedin.com/oauth/v2/accessToken\"\n }\n },\n mastodon: {\n authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,\n isOIDC: false,\n isRefreshable: false,\n picture: [\"avatar\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `${config.baseURL}/api/v1/accounts/verify_credentials`\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `${config.baseURL}/oauth/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.baseURL}/oauth/token`\n }\n },\n mercadolibre: {\n authorizationUrl: \"https://auth.mercadolibre.com/authorization\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.mercadolibre.com/users/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.mercadolibre.com/oauth/token\"\n }\n },\n mercadopago: {\n authorizationUrl: \"https://auth.mercadopago.com/authorization\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.mercadopago.com/v1/users/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.mercadopago.com/oauth/token\"\n }\n },\n microsoftentraexternalid: {\n authorizationUrl: (config) => `https://${config.tenantSubdomain}.ciamlogin.com/${config.tenantId}/oauth2/v2.0/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n scopeRequired: false,\n subject: [\"sub\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.tenantSubdomain}.ciamlogin.com/${config.tenantId}/oauth2/v2.0/token`\n }\n },\n microsoftentraid: {\n authorizationUrl: (config) => `https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://graph.microsoft.com/oidc/userinfo\"\n },\n scopeRequired: false,\n subject: [\"sub\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/token`\n }\n },\n monday: {\n authorizationUrl: \"https://auth.monday.com/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n body: {\n query: \"query { me { id name email } }\"\n },\n encoding: \"application/json\",\n headers: {\n \"Content-Type\": \"application/json\"\n },\n method: \"POST\",\n url: \"https://api.monday.com/v2\"\n },\n scopeRequired: true,\n subject: [\"data\", \"me\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://auth.monday.com/oauth2/token\"\n }\n },\n myanimelist: {\n authorizationUrl: \"https://myanimelist.net/v1/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"plain\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.myanimelist.net/v2/users/@me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://myanimelist.net/v1/oauth2/token\"\n }\n },\n naver: {\n authorizationUrl: \"https://nid.naver.com/oauth2.0/authorize\",\n email: [\"response\", \"email\"],\n fullName: [\"response\", \"name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"response\", \"profile_image\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://openapi.naver.com/v1/nid/me\"\n },\n scopeRequired: false,\n subject: [\"response\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://nid.naver.com/oauth2.0/token\"\n }\n },\n notion: {\n authorizationUrl: \"https://api.notion.com/v1/oauth/authorize\",\n email: [\"bot\", \"owner\", \"user\", \"person\", \"email\"],\n isOIDC: false,\n isRefreshable: false,\n picture: [\"bot\", \"owner\", \"user\", \"avatar_url\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n headers: {\n \"Notion-Version\": \"2022-06-28\"\n },\n method: \"GET\",\n url: \"https://api.notion.com/v1/users/me\"\n },\n scopeRequired: false,\n subject: [\"bot\", \"owner\", \"user\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.notion.com/v1/oauth/token\"\n }\n },\n okta: {\n authorizationUrl: (config) => `https://${config.domain}/oauth2/default/v1/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.domain}/oauth2/default/v1/userinfo`\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `https://${config.domain}/oauth2/default/v1/revoke`\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.domain}/oauth2/default/v1/token`\n }\n },\n onspark: {\n authorizationUrl: \"https://onspark.com/oauth2/authorize\",\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://onspark.com/oauth2/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n tokenParamName: \"token\",\n url: \"https://onspark.com/oauth2/revoke\"\n },\n scopeRequired: true,\n subject: [\"sub\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://onspark.com/oauth2/token\"\n }\n },\n osu: {\n authorizationUrl: \"https://osu.ppy.sh/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n picture: [\"avatar_url\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://osu.ppy.sh/api/v2/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://osu.ppy.sh/oauth/token\"\n }\n },\n patreon: {\n authorizationUrl: \"https://www.patreon.com/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.patreon.com/api/oauth2/v2/identity\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.patreon.com/api/oauth2/token\"\n }\n },\n pipedrive: {\n authorizationUrl: \"https://oauth.pipedrive.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.pipedrive.com/v1/users/me\"\n },\n scopeRequired: true,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.pipedrive.com/oauth/token\"\n }\n },\n polar: {\n authorizationUrl: \"https://polar.sh/oauth2/authorize\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.polar.sh/v1/oauth2/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://api.polar.sh/v1/oauth2/revoke\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.polar.sh/v1/oauth2/token\"\n }\n },\n polaraccesslink: {\n authorizationUrl: \"https://flow.polar.com/oauth2/authorization\",\n isOIDC: false,\n isRefreshable: false,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.polaraccesslink.com/v3/users/me\"\n },\n scopeRequired: false,\n subject: [\"x_user_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"header\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://polarremote.com/v2/oauth2/token\"\n }\n },\n polarteampro: {\n authorizationUrl: \"https://auth.polar.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.polaraccesslink.com/v3/users/<USER_ID>\"\n },\n scopeRequired: false,\n subject: [\"x_user_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"header\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://auth.polar.com/oauth/token\"\n }\n },\n reddit: {\n authorizationUrl: \"https://www.reddit.com/api/v1/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://oauth.reddit.com/api/v1/me\"\n },\n revocationRequest: {\n authIn: \"header\",\n body: new URLSearchParams({\n token_type_hint: \"refresh_token\"\n }),\n encoding: \"application/json\",\n inputSource: \"refreshToken\",\n url: \"https://www.reddit.com/api/v1/revoke_token\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"header\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.reddit.com/api/v1/access_token\"\n }\n },\n roblox: {\n authorizationUrl: \"https://apis.roblox.com/oauth/v1/authorize\",\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://apis.roblox.com/oauth/v1/userinfo\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://apis.roblox.com/oauth/v1/token\"\n }\n },\n salesforce: {\n authorizationUrl: \"https://login.salesforce.com/services/oauth2/authorize\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://login.salesforce.com/services/oauth2/userinfo\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://login.salesforce.com/services/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://login.salesforce.com/services/oauth2/token\"\n }\n },\n shikimori: {\n authorizationUrl: \"https://shikimori.org/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://shikimori.one/api/users/whoami\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://shikimori.org/oauth/token\"\n }\n },\n slack: {\n authorizationUrl: \"https://slack.com/openid/connect/authorize\",\n isOIDC: true,\n isRefreshable: true,\n profileRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://slack.com/api/users.identity\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://slack.com/api/auth.revoke\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://slack.com/api/openid.connect.token\"\n }\n },\n slackuser: {\n accessTokenPath: [\"authed_user\", \"access_token\"],\n authorizationUrl: \"https://slack.com/oauth/v2/authorize\",\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"POST\",\n url: \"https://slack.com/api/auth.test\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://slack.com/api/auth.revoke\"\n },\n scopeParamName: \"user_scope\",\n scopeRequired: true,\n subject: [\"user_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://slack.com/api/oauth.v2.access\"\n }\n },\n spotify: {\n authorizationUrl: \"https://accounts.spotify.com/authorize\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.spotify.com/v1/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://accounts.spotify.com/api/token\"\n }\n },\n startgg: {\n authorizationUrl: \"https://start.gg/oauth/authorize\",\n email: [\"data\", \"currentUser\", \"email\"],\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n body: {\n query: `query { currentUser { id slug email player { gamerTag } } }`\n },\n encoding: \"application/json\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\"\n },\n method: \"POST\",\n url: \"https://api.start.gg/gql/alpha\"\n },\n scopeRequired: false,\n subject: [\"data\", \"currentUser\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.start.gg/oauth/access_token\"\n }\n },\n strava: {\n authorizationUrl: \"https://www.strava.com/oauth/authorize\",\n familyName: [\"lastname\"],\n givenName: [\"firstname\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"profile\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.strava.com/api/v3/athlete\"\n },\n revocationRequest: {\n authIn: \"query\",\n body: new URLSearchParams({\n token_type_hint: \"access_token\"\n }),\n encoding: \"application/json\",\n tokenParamName: \"access_token\",\n url: \"https://www.strava.com/oauth/deauthorize\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.strava.com/oauth/token\"\n }\n },\n synology: {\n authorizationUrl: (config) => `${config.baseURL}/webman/sso/SSOOauth.cgi?client_id=${config.clientId}&response_type=code&redirect_uri=${config.redirectUri}`,\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `${config.baseURL}/webman/sso/SSOUserInfo.cgi?client_id=${config.clientId}&access_token=${config.accessToken}`\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.baseURL}/webman/sso/SSOAccessToken.cgi?client_id=${config.clientId}&client_secret=${config.clientSecret}`\n }\n },\n tiktok: {\n authorizationUrl: \"https://www.tiktok.com/v2/auth/authorize\",\n createAuthorizationURLSearchParams: (config) => ({\n client_key: config.clientId\n }),\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://open.douyin.com/oauth/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://open.tiktokapis.com/v2/oauth/revoke/\"\n },\n scopeRequired: false,\n subject: [\"data\", \"open_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://open.tiktokapis.com/v2/oauth/token/\"\n }\n },\n tiltify: {\n authorizationUrl: \"https://v5api.tiltify.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://v5api.tiltify.com/api/public/current-user\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://v5api.tiltify.com/oauth/token\"\n }\n },\n tumblr: {\n authorizationUrl: \"https://www.tumblr.com/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.tumblr.com/v2/user/info\"\n },\n scopeRequired: false,\n subject: [\"response\", \"user\", \"name\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.tumblr.com/v2/oauth2/token\"\n }\n },\n twitch: {\n authorizationUrl: \"https://id.twitch.tv/oauth2/authorize\",\n isOIDC: true,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n headers: (config) => ({\n \"Client-Id\": config.clientId\n }),\n method: \"GET\",\n url: \"https://api.twitch.tv/helix/users\"\n },\n revocationRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n headers: (config) => ({\n \"Client-Id\": config.clientId\n }),\n tokenParamName: \"token\",\n url: \"https://id.twitch.tv/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://id.twitch.tv/oauth2/token\"\n }\n },\n twitter: {\n authorizationUrl: \"https://twitter.com/i/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.twitter.com/2/users/me\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.twitter.com/2/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.twitter.com/2/oauth2/token\"\n }\n },\n vk: {\n authorizationUrl: \"https://oauth.vk.com/authorize\",\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.vk.com/method/users.get\"\n },\n scopeRequired: false,\n subject: [\"response\", \"0\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.vk.com/access_token\"\n }\n },\n withings: {\n accessTokenPath: [\"body\", \"access_token\"],\n authorizationUrl: \"https://account.withings.com/oauth2_user/authorize2\",\n isOIDC: false,\n isRefreshable: true,\n refreshAccessTokenBody: {\n action: \"requesttoken\"\n },\n revocationRequest: {\n authIn: \"body\",\n body: (config) => getWithingsSignatureParams(config, \"revoke\"),\n encoding: \"application/x-www-form-urlencoded\",\n includeClientCredentials: false,\n inputSource: \"subject\",\n inputType: \"number\",\n tokenParamName: \"userid\",\n url: \"https://wbsapi.withings.net/v2/oauth2\",\n validateResponse: (value) => assertWithingsSuccess(value)\n },\n scopeDelimiter: \",\",\n scopeRequired: true,\n subject: [\"userid\"],\n subjectBySource: {\n tokenResponse: [\"body\", \"userid\"]\n },\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://wbsapi.withings.net/v2/oauth2\"\n },\n validateAuthorizationCodeBody: {\n action: \"requesttoken\"\n }\n },\n workos: {\n authorizationUrl: (config) => `https://${config.domain}/oauth2/authorize`,\n createAuthorizationURLSearchParams: () => {\n const nonce = crypto.randomUUID();\n return {\n nonce\n };\n },\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"POST\",\n url: (config) => `https://${config.domain}/oauth2/userinfo`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.domain}/oauth2/token`\n }\n },\n yahoo: {\n authorizationUrl: \"https://api.login.yahoo.com/oauth2/request_auth\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.login.yahoo.com/openid/v1/userinfo\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.login.yahoo.com/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.login.yahoo.com/oauth2/get_token\"\n }\n },\n yandex: {\n authorizationUrl: \"https://oauth.yandex.com/authorize\",\n createAuthorizationURLSearchParams: {\n device_id: crypto.randomUUID(),\n device_name: `${navigator.platform ?? \"Unknown\"} \\u2014 ${(navigator.userAgent.split(\")\")[0] || \"\").split(\"(\").pop() || \"Unknown\"}`\n },\n email: [\"default_email\"],\n familyName: [\"last_name\"],\n fullName: [\"real_name\"],\n givenName: [\"first_name\"],\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://login.yandex.ru/info\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"access_token\",\n url: \"https://oauth.yandex.com/revoke_token\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.yandex.com/token\"\n }\n },\n zoho: {\n authorizationUrl: (config) => `https://accounts.zoho.${config.region ?? \"com\"}/oauth/v2/auth`,\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://accounts.zoho.${config.region ?? \"com\"}/oauth/user/info`\n },\n revocationRequest: {\n authIn: \"query\",\n encoding: \"application/x-www-form-urlencoded\",\n tokenParamName: \"token\",\n url: (config) => `https://accounts.zoho.${config.region ?? \"com\"}/oauth/v2/token/revoke`\n },\n scopeRequired: true,\n subject: [\"ZUID\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://accounts.zoho.${config.region ?? \"com\"}/oauth/v2/token`\n }\n },\n zoom: {\n authorizationUrl: \"https://zoom.us/oauth/authorize\",\n email: [\"email\"],\n familyName: [\"last_name\"],\n givenName: [\"first_name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"pic_url\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.zoom.us/v2/users/me\"\n },\n revocationRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n headers: (config) => ({\n Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`\n }),\n tokenParamName: \"token\",\n url: \"https://zoom.us/oauth/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://zoom.us/oauth/token\"\n }\n }\n});\nfunction defineProvider(config) {\n return config === undefined ? (providerConfig) => providerConfig : config;\n}\n\n// src/typeGuards.ts\nvar hasClientSecret = (credentials) => {\n if (typeof credentials !== \"object\" || credentials === null)\n return false;\n const secret = Reflect.get(credentials, \"clientSecret\");\n return typeof secret === \"string\";\n};\nvar isExpectedType = (value, kind) => {\n switch (kind) {\n case \"string\":\n return typeof value === \"string\";\n case \"number\":\n return typeof value === \"number\";\n case \"boolean\":\n return typeof value === \"boolean\";\n case \"object\":\n return typeof value === \"object\" && value !== null;\n default:\n return false;\n }\n};\nvar isObject = (value) => value !== null && typeof value === \"object\" && !Array.isArray(value) && Object.prototype.toString.call(value) === \"[object Object]\";\nvar isOIDCProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.isOIDC;\n};\nvar isPKCEProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.PKCEMethod !== undefined;\n};\nfunction isProfileOAuth2Client(providerOrClient, maybeClient) {\n const client = maybeClient ?? providerOrClient;\n if (maybeClient !== undefined && (typeof providerOrClient !== \"string\" || !isProfileProviderOption(providerOrClient))) {\n return false;\n }\n return typeof client === \"object\" && client !== null && \"fetchUserProfile\" in client && typeof client.fetchUserProfile === \"function\";\n}\nvar isProfileProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.profileRequest !== undefined;\n};\nfunction isRefreshableOAuth2Client(providerOrClient, maybeClient) {\n const client = maybeClient ?? providerOrClient;\n if (maybeClient !== undefined && (typeof providerOrClient !== \"string\" || !isRefreshableProviderOption(providerOrClient))) {\n return false;\n }\n return typeof client === \"object\" && client !== null && \"refreshAccessToken\" in client && typeof client.refreshAccessToken === \"function\";\n}\nvar isRefreshableProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.isRefreshable;\n};\nfunction isRevocableOAuth2Client(providerOrClient, maybeClient) {\n const client = maybeClient ?? providerOrClient;\n if (maybeClient !== undefined && (typeof providerOrClient !== \"string\" || !isRevocableProviderOption(providerOrClient))) {\n return false;\n }\n return typeof client === \"object\" && client !== null && \"resolveRevocationInput\" in client && typeof client.resolveRevocationInput === \"function\" && \"revokeToken\" in client && typeof client.revokeToken === \"function\";\n}\nvar isRevocableProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.revocationRequest !== undefined;\n};\nvar isScopeRequiredProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.scopeRequired;\n};\nvar isValidProviderOption = (option) => Object.hasOwn(providers, option);\n\n// src/utils.ts\nvar readPath = (value, path) => path.reduce((cursor, key) => cursor && typeof cursor === \"object\" ? Reflect.get(cursor, key) : undefined, value);\nvar assertWithingsSuccess = (value) => {\n if (!isObject(value) || value.status !== 0) {\n const status = isObject(value) ? value.status : \"invalid response\";\n const detail = isObject(value) && typeof value.error === \"string\" ? `: ${value.error}` : \"\";\n throw new Error(`Withings request failed (${String(status)})${detail}`);\n }\n};\nvar createOAuth2FetchError = async (response) => {\n const clone = response.clone();\n const prefix = `HTTP ${response.status} ${response.statusText} for ${response.url}`;\n const payload = await response.json().catch(() => null);\n if (payload && typeof payload === \"object\" && Object.keys(payload).length) {\n return new Error(`${prefix}\n${JSON.stringify(payload)}`);\n }\n const text = await clone.text().catch(() => \"\");\n if (text) {\n return new Error(`${prefix}\n${text}`);\n }\n return new Error(prefix);\n};\nvar createOAuth2Request = ({\n url,\n body,\n authIn,\n headers,\n encoding,\n clientId,\n clientSecret\n}) => {\n const oauthHeaders = new Headers(headers);\n oauthHeaders.set(\"Accept\", \"application/json\");\n oauthHeaders.set(\"User-Agent\", \"citra\");\n if (authIn === \"header\") {\n if (!clientSecret) {\n throw new Error(\"clientSecret required for header auth\");\n }\n oauthHeaders.set(\"Authorization\", `Basic ${encodeBase64(`${clientId}:${clientSecret}`)}`);\n }\n if (body === undefined && authIn !== \"body\") {\n return new Request(url, {\n headers: oauthHeaders,\n method: \"POST\"\n });\n }\n if (encoding === \"application/json\") {\n oauthHeaders.set(\"Content-Type\", \"application/json\");\n const jsonBody = body instanceof URLSearchParams ? Object.fromEntries(body.entries()) : { ...body };\n if (authIn === \"body\")\n jsonBody.client_id = clientId;\n if (authIn === \"body\" && clientSecret)\n jsonBody.client_secret = clientSecret;\n return new Request(url, {\n body: JSON.stringify(jsonBody),\n headers: oauthHeaders,\n method: \"POST\"\n });\n }\n oauthHeaders.set(\"Content-Type\", \"application/x-www-form-urlencoded\");\n const entries = body instanceof URLSearchParams ? Array.from(body.entries()) : Object.entries(body ?? {}).filter((entry) => typeof entry[1] === \"string\");\n const params = new URLSearchParams(entries);\n if (authIn === \"body\") {\n params.set(\"client_id\", clientId);\n clientSecret && params.set(\"client_secret\", clientSecret);\n }\n return new Request(url, {\n body: params.toString(),\n headers: oauthHeaders,\n method: \"POST\"\n });\n};\nvar decodeBase64 = (input, toUint8Array = false) => {\n const b64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (BASE64_BLOCK_SIZE - input.length % BASE64_BLOCK_SIZE) % BASE64_BLOCK_SIZE);\n const raw = atob(b64);\n if (!toUint8Array) {\n return raw;\n }\n const bytes = new Uint8Array(raw.length);\n for (let i = 0;i < raw.length; i++) {\n bytes[i] = raw.charCodeAt(i);\n }\n return bytes;\n};\nvar decodeJWT = (tokenString) => {\n const [headerSegment, payloadSegment, signatureSegment] = tokenString.split(\".\");\n if (!headerSegment || !payloadSegment || !signatureSegment) {\n throw new Error(\"Invalid JWT format\");\n }\n const decodedPayload = decodeBase64(payloadSegment);\n if (typeof decodedPayload !== \"string\") {\n throw new Error(\"Expected JWT payload to be a UTF-8 string\");\n }\n const claims = JSON.parse(decodedPayload);\n return claims;\n};\nvar encodeBase64 = (input) => {\n let raw;\n if (typeof input === \"string\") {\n raw = input;\n } else {\n const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);\n raw = bytes.reduce((acc, byte) => acc + String.fromCharCode(byte), \"\");\n }\n return btoa(raw);\n};\nvar getWithingsSignatureParams = async (config, action) => {\n const timestamp = Math.floor(Date.now() / 1000);\n const nonceSignature = await hmacSha256(`getnonce,${config.clientId},${timestamp}`, config.clientSecret);\n const nonceUrl = new URL(\"https://wbsapi.withings.net/v2/signature\");\n nonceUrl.searchParams.set(\"action\", \"getnonce\");\n nonceUrl.searchParams.set(\"client_id\", config.clientId);\n nonceUrl.searchParams.set(\"timestamp\", timestamp.toString());\n nonceUrl.searchParams.set(\"signature\", nonceSignature);\n const nonceTarget = nonceUrl.toString();\n const nonceResponse = await fetch(nonceTarget, { method: \"POST\" });\n if (!nonceResponse.ok) {\n throw await createOAuth2FetchError(nonceResponse);\n }\n const nonceData = await nonceResponse.json();\n if (!isObject(nonceData) || nonceData.status !== 0 || !isObject(nonceData.body) || typeof nonceData.body.nonce !== \"string\" || nonceData.body.nonce.length === 0) {\n throw new Error(\"Withings returned an invalid nonce response\");\n }\n const { nonce } = nonceData.body;\n const signature = await hmacSha256(`${action},${config.clientId},${nonce}`, config.clientSecret);\n return {\n action,\n client_id: config.clientId,\n nonce,\n signature\n };\n};\nvar hmacSha256 = async (message, secret) => {\n const encoder = new TextEncoder;\n const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), { hash: \"SHA-256\", name: \"HMAC\" }, false, [\"sign\"]);\n const sigBuffer = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message));\n return Array.from(new Uint8Array(sigBuffer)).map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n};\nvar parseOAuth2TokenResponse = (value, accessTokenPath) => {\n if (!isObject(value)) {\n throw new Error(\"OAuth token endpoint returned a non-object response\");\n }\n const oauthError = Reflect.get(value, \"error\");\n if (typeof oauthError === \"string\" && oauthError.length > 0) {\n throw new Error(`OAuth token exchange failed: ${oauthError}`);\n }\n const response = { ...value };\n const nestedToken = accessTokenPath ? readPath(value, accessTokenPath) : undefined;\n if (typeof nestedToken === \"string\" && nestedToken.length > 0) {\n response.access_token = nestedToken;\n }\n if (typeof response.access_token !== \"string\" || response.access_token.length === 0) {\n throw new Error(\"OAuth token endpoint returned no access_token\");\n }\n for (const key of [\"refresh_token\", \"token_type\", \"scope\", \"id_token\"]) {\n const field = response[key];\n if (field !== undefined && typeof field !== \"string\") {\n throw new Error(`OAuth token endpoint returned invalid ${key}: expected string`);\n }\n }\n const expiresIn = response.expires_in;\n if (typeof expiresIn === \"string\" && expiresIn.trim() !== \"\") {\n response.expires_in = Number(expiresIn);\n }\n if (response.expires_in !== undefined && (typeof response.expires_in !== \"number\" || !Number.isFinite(response.expires_in) || response.expires_in < 0)) {\n throw new Error(\"OAuth token endpoint returned invalid expires_in: expected a non-negative number\");\n }\n return response;\n};\nvar readIdentityKey = (value, key) => {\n if (Array.isArray(value)) {\n if (!/^\\d+$/.test(key)) {\n throw new Error(`Invalid identity data shape: expected an array index, got ${key}`);\n }\n return value[Number(key)];\n }\n if (!isObject(value)) {\n throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);\n }\n return value[key];\n};\nvar extractPropFromIdentity = (identity, keys, propType) => {\n let value = identity;\n for (const key of keys) {\n value = readIdentityKey(value, key);\n }\n if (propType !== undefined && !isExpectedType(value, propType)) {\n throw new Error(`Invalid identity data shape: expected ${propType}, got ${typeof value}`);\n }\n return value;\n};\nvar getProviderSubjectKeys = (providerConfiguration, source) => providerConfiguration.subjectBySource?.[source] ?? providerConfiguration.subject;\nvar setPropInIdentity = (identity, keys, value) => {\n if (keys.length === 0) {\n return identity;\n }\n let cursor = identity;\n for (const key of keys.slice(0, -1)) {\n const next = cursor[key];\n cursor[key] = isObject(next) ? next : {};\n cursor = cursor[key];\n }\n cursor[keys[keys.length - 1]] = value;\n return identity;\n};\nvar normalizeProviderIdentity = ({\n identity,\n providerConfiguration,\n source\n}) => {\n const sourceKeys = getProviderSubjectKeys(providerConfiguration, source);\n const canonicalKeys = providerConfiguration.subject;\n if (sourceKeys.join(\".\") === canonicalKeys.join(\".\")) {\n return identity;\n }\n const subject = extractPropFromIdentity(identity, sourceKeys, providerConfiguration.subjectType);\n const normalizedIdentity = structuredClone(identity);\n return setPropInIdentity(normalizedIdentity, canonicalKeys, subject);\n};\n\n// src/arctic-utils.ts\nvar DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME = 180;\nvar HOURS_PER_DAY = 24;\nvar MINUTES_PER_HOUR = 60;\nvar SECONDS_PER_MINUTE = 60;\nvar APPLE_CLIENT_SECRET_LIFETIME_SECONDS = SECONDS_PER_MINUTE * MINUTES_PER_HOUR * HOURS_PER_DAY * DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME;\nvar APPLE_ISSUER = \"https://appleid.apple.com\";\nvar MILLISECONDS_PER_SECOND = 1000;\nvar createS256CodeChallenge = async (codeVerifier) => {\n const data = new TextEncoder().encode(codeVerifier);\n const hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n return base64Url(hashBuffer);\n};\nvar createRandomBase64UrlGenerator = (length) => () => {\n const buffer = crypto.getRandomValues(new Uint8Array(length));\n return base64Url(buffer);\n};\nvar generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);\nvar generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);\nvar base64Url = (input) => encodeBase64(input).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\nvar encodeJwtPart = (value) => base64Url(new TextEncoder().encode(JSON.stringify(value)));\nvar createAppleClientSecret = async (credentials) => {\n const issuedAt = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);\n const header = encodeJwtPart({\n alg: \"ES256\",\n kid: credentials.keyId,\n typ: \"JWT\"\n });\n const payload = encodeJwtPart({\n aud: APPLE_ISSUER,\n exp: issuedAt + APPLE_CLIENT_SECRET_LIFETIME_SECONDS,\n iat: issuedAt,\n iss: credentials.teamId,\n sub: credentials.clientId\n });\n const signingInput = `${header}.${payload}`;\n const privateKey = await crypto.subtle.importKey(\"pkcs8\", Uint8Array.from(credentials.pkcs8PrivateKey), { name: \"ECDSA\", namedCurve: \"P-256\" }, false, [\"sign\"]);\n const signature = await crypto.subtle.sign({ hash: \"SHA-256\", name: \"ECDSA\" }, privateKey, new TextEncoder().encode(signingInput));\n return `${signingInput}.${base64Url(signature)}`;\n};\n// src/oidc.ts\nvar ALG_ES256 = \"ES256\";\nvar ALG_RS256 = \"RS256\";\nvar CLOCK_SKEW_SECONDS = 60;\nvar DEFAULT_SCOPES = [\"openid\", \"email\", \"profile\"];\nvar JWKS_REFETCH_COOLDOWN_MS = 60000;\nvar JWT_SEGMENT_COUNT = 3;\nvar MILLISECONDS_PER_SECOND2 = 1000;\nvar trimTrailingSlash = (value) => value.endsWith(\"/\") ? value.slice(0, -1) : value;\nvar fetchJson = async (url) => {\n const response = await fetch(url, {\n headers: { accept: \"application/json\" }\n });\n if (!response.ok) {\n throw await createOAuth2FetchError(response);\n }\n return response.json();\n};\nvar decodeJsonSegment = (segment) => {\n const decoded = decodeBase64(segment);\n if (typeof decoded !== \"string\") {\n throw new Error(\"Expected a base64url-encoded JWT segment\");\n }\n const parsed = JSON.parse(decoded);\n if (typeof parsed !== \"object\" || parsed === null) {\n throw new Error(\"Expected a JWT segment to decode to a JSON object\");\n }\n return parsed;\n};\nvar importVerificationKey = (jwk, alg) => {\n if (alg === ALG_RS256) {\n return crypto.subtle.importKey(\"jwk\", jwk, { hash: \"SHA-256\", name: \"RSASSA-PKCS1-v1_5\" }, false, [\"verify\"]);\n }\n if (alg === ALG_ES256) {\n return crypto.subtle.importKey(\"jwk\", jwk, { name: \"ECDSA\", namedCurve: \"P-256\" }, false, [\"verify\"]);\n }\n throw new Error(`Unsupported id_token signing algorithm \"${alg}\"`);\n};\nvar verifySignature = (key, alg, signingInput, signature) => {\n const algorithm = alg === ALG_ES256 ? { hash: \"SHA-256\", name: \"ECDSA\" } : { name: \"RSASSA-PKCS1-v1_5\" };\n return crypto.subtle.verify(algorithm, key, new Uint8Array(signature), new TextEncoder().encode(signingInput));\n};\nvar selectKey = (jwks, kid) => jwks.find((jwk) => kid === undefined || jwk.kid === kid);\nvar assertClaims = (payload, expected) => {\n const aud = Reflect.get(payload, \"aud\");\n const azp = Reflect.get(payload, \"azp\");\n const exp = Reflect.get(payload, \"exp\");\n const iat = Reflect.get(payload, \"iat\");\n const iss = Reflect.get(payload, \"iss\");\n const nbf = Reflect.get(payload, \"nbf\");\n const sub = Reflect.get(payload, \"sub\");\n const audiences = Array.isArray(aud) ? aud : [aud];\n const nowSeconds = Math.floor(Date.now() / MILLISECONDS_PER_SECOND2);\n if (iss !== expected.issuer) {\n throw new Error('id_token \"iss\" does not match the provider issuer');\n }\n if (typeof sub !== \"string\" || sub.length === 0) {\n throw new Error('id_token is missing \"sub\"');\n }\n if (!audiences.includes(expected.audience)) {\n throw new Error('id_token \"aud\" does not include the client id');\n }\n if (audiences.some((audience) => typeof audience !== \"string\") || typeof aud !== \"string\" && !Array.isArray(aud)) {\n throw new Error('id_token \"aud\" must be a string or string array');\n }\n if (audiences.length > 1 && (typeof azp !== \"string\" || azp !== expected.audience)) {\n throw new Error('id_token with multiple audiences requires matching \"azp\"');\n }\n if (typeof exp !== \"number\" || exp + CLOCK_SKEW_SECONDS < nowSeconds) {\n throw new Error(\"id_token has expired\");\n }\n if (typeof iat !== \"number\") {\n throw new Error('id_token is missing numeric \"iat\"');\n }\n if (iat > nowSeconds + CLOCK_SKEW_SECONDS) {\n throw new Error('id_token \"iat\" is in the future');\n }\n if (nbf !== undefined && (typeof nbf !== \"number\" || nbf > nowSeconds + CLOCK_SKEW_SECONDS)) {\n throw new Error(\"id_token is not active yet\");\n }\n if (expected.nonce !== undefined && Reflect.get(payload, \"nonce\") !== expected.nonce) {\n throw new Error('id_token \"nonce\" does not match');\n }\n const claims = { ...payload, aud, exp, iss, sub };\n return claims;\n};\nvar verifyIdToken = async ({\n audience,\n idToken,\n issuer,\n jwks,\n nonce\n}) => {\n const segments = idToken.split(\".\");\n const [headerSegment, payloadSegment, signatureSegment] = segments;\n if (segments.length !== JWT_SEGMENT_COUNT || headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {\n throw new Error(\"Invalid id_token: expected three segments\");\n }\n const header = decodeJsonSegment(headerSegment);\n const alg = Reflect.get(header, \"alg\");\n const kid = Reflect.get(header, \"kid\");\n if (typeof alg !== \"string\") {\n throw new Error('id_token header is missing \"alg\"');\n }\n const jwk = selectKey(jwks, typeof kid === \"string\" ? kid : undefined);\n if (jwk === undefined) {\n throw new Error('No JWKS key matches the id_token \"kid\"');\n }\n const key = await importVerificationKey(jwk, alg);\n const signature = decodeBase64(signatureSegment, true);\n if (typeof signature === \"string\") {\n throw new Error(\"Failed to decode the id_token signature\");\n }\n const isValid = await verifySignature(key, alg, `${headerSegment}.${payloadSegment}`, signature);\n if (!isValid) {\n throw new Error(\"id_token signature verification failed\");\n }\n return assertClaims(decodeJsonSegment(payloadSegment), {\n audience,\n issuer,\n nonce\n });\n};\nvar toDiscoveryDocument = (value, expectedIssuer) => {\n if (typeof value !== \"object\" || value === null) {\n throw new Error(\"OIDC discovery document is not a JSON object\");\n }\n const issuer = Reflect.get(value, \"issuer\");\n const authorizationEndpoint = Reflect.get(value, \"authorization_endpoint\");\n const tokenEndpoint = Reflect.get(value, \"token_endpoint\");\n const jwksUri = Reflect.get(value, \"jwks_uri\");\n const userinfoEndpoint = Reflect.get(value, \"userinfo_endpoint\");\n if (typeof issuer !== \"string\" || typeof authorizationEndpoint !== \"string\" || typeof tokenEndpoint !== \"string\" || typeof jwksUri !== \"string\") {\n throw new Error(\"OIDC discovery document is missing required endpoints\");\n }\n if (trimTrailingSlash(issuer) !== trimTrailingSlash(expectedIssuer)) {\n throw new Error(`OIDC discovery issuer \"${issuer}\" does not match configured issuer \"${expectedIssuer}\"`);\n }\n return {\n authorization_endpoint: authorizationEndpoint,\n issuer,\n jwks_uri: jwksUri,\n token_endpoint: tokenEndpoint,\n userinfo_endpoint: typeof userinfoEndpoint === \"string\" ? userinfoEndpoint : undefined\n };\n};\nvar fetchDiscoveryDocument = async (issuer) => {\n const base = trimTrailingSlash(issuer);\n const document = await fetchJson(`${base}/.well-known/openid-configuration`);\n return toDiscoveryDocument(document, issuer);\n};\nvar fetchJwks = async (jwksUri) => {\n const body = await fetchJson(jwksUri);\n const value = Reflect.get(body ?? {}, \"keys\");\n if (!Array.isArray(value)) {\n throw new Error('JWKS response is missing a \"keys\" array');\n }\n const keys = value;\n return keys;\n};\nvar createOIDCClient = async (config) => {\n const discovery = await fetchDiscoveryDocument(config.issuer);\n const scopes = config.scopes !== undefined && config.scopes.length > 0 ? config.scopes : DEFAULT_SCOPES;\n let cachedJwks;\n let jwksFetchedAtMs = 0;\n const resolveJwks = async (forceRefresh) => {\n const isStale = Date.now() - jwksFetchedAtMs > JWKS_REFETCH_COOLDOWN_MS;\n if (cachedJwks === undefined || forceRefresh && isStale) {\n cachedJwks = await fetchJwks(discovery.jwks_uri);\n jwksFetchedAtMs = Date.now();\n }\n return cachedJwks;\n };\n const createAuthorizationUrl = async (options) => {\n const url = new URL(discovery.authorization_endpoint);\n const challenge = await createS256CodeChallenge(options.codeVerifier);\n const { searchParams } = url;\n searchParams.set(\"client_id\", config.clientId);\n searchParams.set(\"code_challenge\", challenge);\n searchParams.set(\"code_challenge_method\", \"S256\");\n searchParams.set(\"redirect_uri\", config.redirectUri);\n searchParams.set(\"response_type\", \"code\");\n searchParams.set(\"scope\", (options.scope ?? scopes).join(\" \"));\n searchParams.set(\"state\", options.state);\n if (options.nonce !== undefined) {\n searchParams.set(\"nonce\", options.nonce);\n }\n return url;\n };\n const validateAuthorizationCode = async (options) => {\n const body = new URLSearchParams;\n body.set(\"client_id\", config.clientId);\n body.set(\"client_secret\", config.clientSecret);\n body.set(\"code\", options.code);\n body.set(\"code_verifier\", options.codeVerifier);\n body.set(\"grant_type\", \"authorization_code\");\n body.set(\"redirect_uri\", config.redirectUri);\n const response = await fetch(discovery.token_endpoint, {\n body,\n headers: {\n accept: \"application/json\",\n \"content-type\": \"application/x-www-form-urlencoded\"\n },\n method: \"POST\"\n });\n if (!response.ok) {\n throw await createOAuth2FetchError(response);\n }\n const tokens = parseOAuth2TokenResponse(await response.json());\n return tokens;\n };\n const verifyToken = async (idToken, options) => {\n const jwks = await resolveJwks(false);\n const params = {\n audience: config.clientId,\n idToken,\n issuer: discovery.issuer,\n nonce: options?.nonce\n };\n try {\n return await verifyIdToken({ ...params, jwks });\n } catch (error) {\n const refreshed = await resolveJwks(true);\n if (refreshed === jwks)\n throw error;\n return verifyIdToken({ ...params, jwks: refreshed });\n }\n };\n const fetchUserProfile = async (accessToken) => {\n if (discovery.userinfo_endpoint === undefined) {\n throw new Error(\"OIDC provider does not expose a userinfo endpoint\");\n }\n const response = await fetch(discovery.userinfo_endpoint, {\n headers: {\n accept: \"application/json\",\n authorization: `Bearer ${accessToken}`\n }\n });\n if (!response.ok) {\n throw new Error(`OIDC userinfo request failed with status ${response.status}`);\n }\n const profile = await response.json();\n return profile;\n };\n return {\n createAuthorizationUrl,\n discovery,\n fetchUserProfile,\n validateAuthorizationCode,\n verifyIdToken: verifyToken\n };\n};\n// src/providerOptions.ts\nvar oidcProviderOptions = Object.keys(providers).filter(isOIDCProviderOption);\nvar pkceProviderOptions = Object.keys(providers).filter(isPKCEProviderOption);\nvar profileProviderOptions = Object.keys(providers).filter(isProfileProviderOption);\nvar providerOptions = Object.keys(providers).filter(isValidProviderOption);\nvar refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProviderOption);\nvar revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);\nvar scopeRequiredProviderOptions = Object.keys(providers).filter(isScopeRequiredProviderOption);\n\n// src/index.ts\nvar buildOAuth2Client = async (meta, config) => {\n const isConfigPropertyFunction = (cfgProp) => typeof cfgProp === \"function\";\n const resolveConfigProp = async (cfgProp) => {\n const result = isConfigPropertyFunction(cfgProp) ? cfgProp(config) : cfgProp;\n return result;\n };\n const resolveClientSecret = async () => {\n if (meta.createClientSecret) {\n return resolveConfigProp(meta.createClientSecret);\n }\n return hasClientSecret(config) ? config.clientSecret : undefined;\n };\n const authorizationUrl = await resolveConfigProp(meta.authorizationUrl);\n const tokenUrl = await resolveConfigProp(meta.tokenRequest.url);\n const client = {\n async createAuthorizationUrl(opts) {\n const { state, scope = [], searchParams = [], codeVerifier } = opts;\n const url = new URL(authorizationUrl);\n url.searchParams.set(\"response_type\", \"code\");\n url.searchParams.set(\"client_id\", config.clientId);\n if (config.redirectUri)\n url.searchParams.set(\"redirect_uri\", config.redirectUri);\n if (state)\n url.searchParams.set(\"state\", state);\n if (scope.length !== 0) {\n url.searchParams.set(meta.scopeParamName ?? \"scope\", scope.join(meta.scopeDelimiter ?? \" \"));\n }\n if (meta.PKCEMethod !== undefined) {\n if (!codeVerifier) {\n throw new Error(\"`codeVerifier` is required when PKCE is enabled\");\n }\n const codeChallenge = meta.PKCEMethod === \"S256\" ? await createS256CodeChallenge(codeVerifier) : codeVerifier;\n url.searchParams.set(\"code_challenge_method\", meta.PKCEMethod);\n url.searchParams.set(\"code_challenge\", codeChallenge);\n }\n Object.entries(await resolveConfigProp(meta.createAuthorizationURLSearchParams) ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));\n searchParams.forEach(([key, value]) => url.searchParams.set(key, value));\n return url;\n },\n async fetchUserProfile(accessToken) {\n const { profileRequest } = meta;\n if (!profileRequest) {\n throw new Error(\"OIDC provider exposes identity through the id_token and does not define a UserInfo endpoint\");\n }\n const {\n url,\n method,\n authIn,\n searchParams,\n body: profileBody,\n headers,\n encoding\n } = profileRequest;\n const endpoint = new URL(await resolveConfigProp(url));\n const resolvedBody = await resolveConfigProp(profileBody);\n new URLSearchParams(await resolveConfigProp(searchParams)).forEach((value, key) => endpoint.searchParams.append(key, value));\n let headerEntries = [];\n const rawHeaders = headers ? await resolveConfigProp(headers) : undefined;\n if (rawHeaders instanceof Headers)\n headerEntries = Array.from(rawHeaders.entries());\n else if (Array.isArray(rawHeaders))\n headerEntries = rawHeaders;\n else if (rawHeaders && typeof rawHeaders === \"object\")\n headerEntries = Object.entries(rawHeaders);\n const profileHeaders = Object.fromEntries(headerEntries.filter(([, value]) => value !== \"\"));\n if (authIn === \"header\") {\n profileHeaders.Authorization = `Bearer ${accessToken}`;\n } else if (authIn === \"path\") {\n endpoint.pathname = `${endpoint.pathname.replace(/\\/+$/, \"\")}/${encodeURIComponent(accessToken)}`;\n } else {\n endpoint.searchParams.append(\"access_token\", accessToken);\n }\n const init = { headers: profileHeaders, method };\n if (method === \"POST\" && resolvedBody !== undefined) {\n profileHeaders[\"Content-Type\"] = encoding;\n init.body = encoding === \"application/json\" ? JSON.stringify(resolvedBody) : new URLSearchParams(resolvedBody).toString();\n }\n const profileTarget = endpoint.toString();\n const response = await fetch(profileTarget, init);\n if (!response.ok)\n throw await createOAuth2FetchError(response);\n return response.json();\n },\n async refreshAccessToken(refreshToken) {\n const { authIn, encoding } = meta.tokenRequest;\n const params = new URLSearchParams(meta.refreshAccessTokenBody);\n params.set(\"grant_type\", \"refresh_token\");\n params.set(\"refresh_token\", refreshToken);\n const { clientId } = config;\n const clientSecretValue = await resolveClientSecret();\n if (clientSecretValue) {\n params.set(\"client_id\", clientId);\n params.set(\"client_secret\", clientSecretValue);\n }\n const request = createOAuth2Request({\n authIn,\n body: params,\n clientId,\n clientSecret: clientSecretValue,\n encoding,\n url: tokenUrl\n });\n const response = await fetch(request);\n if (!response.ok)\n throw await createOAuth2FetchError(response);\n return parseOAuth2TokenResponse(await response.json());\n },\n resolveRevocationInput(context) {\n const { revocationRequest } = meta;\n if (!revocationRequest) {\n throw new Error(\"Token revocation not defined for this provider\");\n }\n const inputSource = revocationRequest.inputSource ?? \"accessToken\";\n const input = context[inputSource];\n if (input === undefined) {\n throw new Error(`Revocation requires ${inputSource}, but it was not provided`);\n }\n const expectsNumber = revocationRequest.authIn !== \"header\" && revocationRequest.inputType === \"number\";\n if (expectsNumber && (typeof input !== \"number\" || !Number.isFinite(input))) {\n throw new TypeError(\"This provider requires a numeric revocation input\");\n }\n if (!expectsNumber && typeof input !== \"string\") {\n throw new TypeError(\"This provider requires a string revocation input\");\n }\n return input;\n },\n async revokeToken(input) {\n const { revocationRequest } = meta;\n if (!revocationRequest) {\n throw new Error(\"Token revocation not defined for this provider\");\n }\n if (revocationRequest.authIn !== \"header\" && revocationRequest.inputType === \"number\" && (typeof input !== \"number\" || !Number.isFinite(input))) {\n throw new TypeError(\"This provider requires a numeric revocation input\");\n }\n const {\n url,\n authIn,\n body,\n encoding,\n headers,\n includeClientCredentials = true,\n tokenParamName,\n validateResponse\n } = revocationRequest;\n const endpoint = await resolveConfigProp(url);\n const resolvedBody = await resolveConfigProp(body);\n const revocationBody = resolvedBody === undefined ? undefined : new URLSearchParams(resolvedBody);\n const revocationHeaders = new Headers(headers && await resolveConfigProp(headers));\n const { clientId } = config;\n const clientSecret = await resolveClientSecret();\n let request;\n if (authIn === \"body\") {\n const bodyWithToken = revocationBody ?? new URLSearchParams;\n bodyWithToken.set(tokenParamName, String(input));\n const hasAuthorizationHeader = revocationHeaders.has(\"Authorization\");\n if (includeClientCredentials && !hasAuthorizationHeader)\n bodyWithToken.set(\"client_id\", clientId);\n if (includeClientCredentials && !hasAuthorizationHeader && clientSecret)\n bodyWithToken.set(\"client_secret\", clientSecret);\n request = createOAuth2Request({\n authIn: hasAuthorizationHeader || !includeClientCredentials ? \"query\" : \"body\",\n body: bodyWithToken,\n clientId,\n clientSecret,\n encoding,\n headers: revocationHeaders,\n url: endpoint.toString()\n });\n } else if (authIn === \"header\") {\n revocationHeaders.set(\"Authorization\", `Bearer ${String(input)}`);\n request = createOAuth2Request({\n authIn: \"query\",\n body: revocationBody,\n clientId,\n encoding,\n headers: revocationHeaders,\n url: endpoint.toString()\n });\n } else {\n const queryEndpoint = new URL(endpoint);\n queryEndpoint.searchParams.set(tokenParamName, String(input));\n request = createOAuth2Request({\n authIn: \"query\",\n body: revocationBody,\n clientId,\n encoding,\n headers: revocationHeaders,\n url: queryEndpoint.toString()\n });\n }\n const response = await fetch(request);\n if (!response.ok)\n throw await createOAuth2FetchError(response);\n if (validateResponse) {\n await validateResponse(await response.json().catch(() => {\n return;\n }));\n }\n },\n async validateAuthorizationCode(opts) {\n const { code, codeVerifier } = opts;\n const { authIn, encoding } = meta.tokenRequest;\n const bodyObj = {};\n for (const key in meta.validateAuthorizationCodeBody ?? {}) {\n const value = meta.validateAuthorizationCodeBody[key];\n if (typeof value === \"string\")\n bodyObj[key] = value;\n }\n bodyObj.grant_type = \"authorization_code\";\n bodyObj.code = code;\n if (config.redirectUri)\n bodyObj.redirect_uri = config.redirectUri;\n if (meta.PKCEMethod !== undefined) {\n if (!codeVerifier) {\n throw new Error(\"codeVerifier required when PKCE is enabled\");\n }\n bodyObj.code_verifier = codeVerifier;\n }\n const payload = encoding === \"application/json\" ? bodyObj : new URLSearchParams(bodyObj);\n const request = createOAuth2Request({\n authIn,\n body: payload,\n clientId: config.clientId,\n clientSecret: await resolveClientSecret(),\n encoding,\n url: tokenUrl\n });\n const response = await fetch(request);\n if (!response.ok)\n throw await createOAuth2FetchError(response);\n return parseOAuth2TokenResponse(await response.json(), meta.accessTokenPath);\n }\n };\n if (!meta.profileRequest) {\n Reflect.deleteProperty(client, \"fetchUserProfile\");\n }\n if (!meta.isRefreshable) {\n Reflect.deleteProperty(client, \"refreshAccessToken\");\n }\n if (!meta.revocationRequest) {\n Reflect.deleteProperty(client, \"resolveRevocationInput\");\n Reflect.deleteProperty(client, \"revokeToken\");\n }\n return client;\n};\nvar createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Client(providerConfig, credentials);\nvar createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);\nexport {\n verifyIdToken,\n scopeRequiredProviderOptions,\n revocableProviderOptions,\n refreshableProviderOptions,\n providers,\n providerOptions,\n profileProviderOptions,\n pkceProviderOptions,\n parseOAuth2TokenResponse,\n oidcProviderOptions,\n normalizeProviderIdentity,\n isValidProviderOption,\n isScopeRequiredProviderOption,\n isRevocableProviderOption,\n isRevocableOAuth2Client,\n isRefreshableProviderOption,\n isRefreshableOAuth2Client,\n isProfileProviderOption,\n isProfileOAuth2Client,\n isPKCEProviderOption,\n isObject,\n isOIDCProviderOption,\n isExpectedType,\n hmacSha256,\n hasClientSecret,\n getWithingsSignatureParams,\n getProviderSubjectKeys,\n generateState,\n generateCodeVerifier,\n extractPropFromIdentity,\n encodeBase64,\n defineProviders,\n defineProvider,\n decodeJWT,\n decodeBase64,\n createS256CodeChallenge,\n createOIDCClient,\n createOAuth2Request,\n createOAuth2FetchError,\n createOAuth2Client,\n createCustomOAuth2Client,\n createAppleClientSecret,\n base64Url,\n assertWithingsSuccess\n};\n",
21
21
  "import { eq } from 'drizzle-orm';\nimport { bigint, integer, pgTable, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type { LockoutRecord, LockoutStore } from './types';\n\nconst KEY_LENGTH = 320;\n\nexport const lockoutsTable = pgTable('auth_lockouts', {\n\tfailed_attempts: integer('failed_attempts').notNull().default(0),\n\tkey: varchar('key', { length: KEY_LENGTH }).primaryKey(),\n\tlocked_until_ms: bigint('locked_until_ms', { mode: 'number' }),\n\twindow_started_at_ms: bigint('window_started_at_ms', {\n\t\tmode: 'number'\n\t}).notNull()\n});\n\ntype LockoutRow = typeof lockoutsTable.$inferSelect;\ntype LockoutInsert = typeof lockoutsTable.$inferInsert;\n\nconst toRecord = (row: LockoutRow): LockoutRecord => ({\n\tfailedAttempts: row.failed_attempts,\n\tkey: row.key,\n\tlockedUntil: row.locked_until_ms ?? undefined,\n\twindowStartedAt: row.window_started_at_ms\n});\n\nexport const createNeonLockoutStore = (databaseUrl: string) =>\n\tcreatePostgresLockoutStore(createNeonDatabase(databaseUrl));\nexport const createPostgresLockoutStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LockoutStore => {\n\tconst get = async (key: string) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(lockoutsTable)\n\t\t\t.where(eq(lockoutsTable.key, key))\n\t\t\t.limit(1);\n\n\t\treturn row ? toRecord(row) : undefined;\n\t};\n\tconst save = async (record: LockoutRecord) => {\n\t\tconst values: LockoutInsert = {\n\t\t\tfailed_attempts: record.failedAttempts,\n\t\t\tkey: record.key,\n\t\t\tlocked_until_ms: record.lockedUntil ?? null,\n\t\t\twindow_started_at_ms: record.windowStartedAt\n\t\t};\n\t\tawait db\n\t\t\t.insert(lockoutsTable)\n\t\t\t.values(values)\n\t\t\t.onConflictDoUpdate({ set: values, target: lockoutsTable.key });\n\t};\n\n\treturn {\n\t\tget,\n\t\tincrement: async (key, windowMs) => {\n\t\t\tconst now = Date.now();\n\t\t\tconst existing = await get(key);\n\t\t\tconst next: LockoutRecord =\n\t\t\t\texisting !== undefined &&\n\t\t\t\tnow - existing.windowStartedAt <= windowMs\n\t\t\t\t\t? {\n\t\t\t\t\t\t\t...existing,\n\t\t\t\t\t\t\tfailedAttempts: existing.failedAttempts + 1\n\t\t\t\t\t\t}\n\t\t\t\t\t: { failedAttempts: 1, key, windowStartedAt: now };\n\t\t\tawait save(next);\n\n\t\t\treturn next;\n\t\t},\n\t\tlock: async (key, lockedUntil) => {\n\t\t\tconst existing = (await get(key)) ?? {\n\t\t\t\tfailedAttempts: 0,\n\t\t\t\tkey,\n\t\t\t\twindowStartedAt: Date.now()\n\t\t\t};\n\t\t\tawait save({ ...existing, lockedUntil });\n\t\t},\n\t\treset: async (key) => {\n\t\t\tawait db.delete(lockoutsTable).where(eq(lockoutsTable.key, key));\n\t\t}\n\t};\n};\n",
22
22
  "import { and, eq, isNull, lte, or, sql } from 'drizzle-orm';\nimport {\n\tbigint,\n\tboolean,\n\tjsonb,\n\tpgTable,\n\tsmallint,\n\ttext,\n\tvarchar\n} from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type { MfaEnrollment, MfaFactor, MFAStore } from './types';\n\nconst ID_LENGTH = 255;\nconst PHONE_LENGTH = 20;\n\nexport const mfaEnrollmentsTable = pgTable('auth_mfa_enrollments', {\n\tbackup_code_hashes: jsonb('backup_code_hashes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\tlast_used_at_ms: bigint('last_used_at_ms', { mode: 'number' }),\n\tmfa_factors: jsonb('mfa_factors').$type<MfaFactor[]>(),\n\tsms_challenge_id: text('sms_challenge_id'),\n\tsms_code_sent_at_ms: bigint('sms_code_sent_at_ms', { mode: 'number' }),\n\tsms_failed_attempts: smallint('sms_failed_attempts').notNull().default(0),\n\tsms_pending_code_expires_at_ms: bigint('sms_pending_code_expires_at_ms', {\n\t\tmode: 'number'\n\t}),\n\tsms_pending_code_hash: text('sms_pending_code_hash'),\n\tsms_pending_factor_id: text('sms_pending_factor_id'),\n\tsms_pending_purpose: text('sms_pending_purpose').$type<\n\t\tMfaEnrollment['smsPendingPurpose']\n\t>(),\n\tsms_phone: varchar('sms_phone', { length: PHONE_LENGTH }),\n\tsms_provider_reference: text('sms_provider_reference'),\n\tsms_verified: boolean('sms_verified').notNull().default(false),\n\ttotp_failed_attempts: smallint('totp_failed_attempts').notNull().default(0),\n\ttotp_secret_ciphertext: text('totp_secret_ciphertext'),\n\ttotp_verified: boolean('totp_verified').notNull().default(false),\n\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH }).primaryKey()\n});\n\ntype MfaRow = typeof mfaEnrollmentsTable.$inferSelect;\ntype MfaInsert = typeof mfaEnrollmentsTable.$inferInsert;\n\nconst toEnrollment = (row: MfaRow): MfaEnrollment => ({\n\tbackupCodeHashes: row.backup_code_hashes,\n\tcreatedAt: row.created_at_ms,\n\tfactors: row.mfa_factors ?? undefined,\n\tlastUsedAt: row.last_used_at_ms ?? undefined,\n\tsmsChallengeId: row.sms_challenge_id ?? undefined,\n\tsmsCodeSentAt: row.sms_code_sent_at_ms ?? undefined,\n\tsmsFailedAttempts: row.sms_failed_attempts,\n\tsmsPendingCodeExpiresAt: row.sms_pending_code_expires_at_ms ?? undefined,\n\tsmsPendingCodeHash: row.sms_pending_code_hash ?? undefined,\n\tsmsPendingFactorId: row.sms_pending_factor_id ?? undefined,\n\tsmsPendingPurpose: row.sms_pending_purpose ?? undefined,\n\tsmsPhone: row.sms_phone ?? undefined,\n\tsmsProviderReference: row.sms_provider_reference ?? undefined,\n\tsmsVerified: row.sms_verified,\n\ttotpFailedAttempts: row.totp_failed_attempts,\n\ttotpSecretCiphertext: row.totp_secret_ciphertext ?? undefined,\n\ttotpVerified: row.totp_verified,\n\tupdatedAt: row.updated_at_ms,\n\tuserId: row.user_id\n});\n\nexport const createNeonMfaStore = (databaseUrl: string) =>\n\tcreatePostgresMfaStore(createNeonDatabase(databaseUrl));\nexport const createPostgresMfaStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): MFAStore => {\n\tconst toValues = (enrollment: MfaEnrollment): MfaInsert => ({\n\t\tbackup_code_hashes: enrollment.backupCodeHashes,\n\t\tcreated_at_ms: enrollment.createdAt,\n\t\tlast_used_at_ms: enrollment.lastUsedAt ?? null,\n\t\tmfa_factors: enrollment.factors ?? null,\n\t\tsms_challenge_id: enrollment.smsChallengeId ?? null,\n\t\tsms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,\n\t\tsms_failed_attempts: enrollment.smsFailedAttempts ?? 0,\n\t\tsms_pending_code_expires_at_ms:\n\t\t\tenrollment.smsPendingCodeExpiresAt ?? null,\n\t\tsms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,\n\t\tsms_pending_factor_id: enrollment.smsPendingFactorId ?? null,\n\t\tsms_pending_purpose: enrollment.smsPendingPurpose ?? null,\n\t\tsms_phone: enrollment.smsPhone ?? null,\n\t\tsms_provider_reference: enrollment.smsProviderReference ?? null,\n\t\tsms_verified: enrollment.smsVerified,\n\t\ttotp_failed_attempts: enrollment.totpFailedAttempts ?? 0,\n\t\ttotp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,\n\t\ttotp_verified: enrollment.totpVerified,\n\t\tupdated_at_ms: enrollment.updatedAt,\n\t\tuser_id: enrollment.userId\n\t});\n\n\treturn {\n\t\tclaimSmsChallenge: async ({\n\t\t\tchallengeId,\n\t\t\tcooldownCutoff,\n\t\t\tenrollment\n\t\t}) => {\n\t\t\tconst values = toValues({\n\t\t\t\t...enrollment,\n\t\t\t\tsmsChallengeId: challengeId\n\t\t\t});\n\t\t\tconst rows = await db\n\t\t\t\t.insert(mfaEnrollmentsTable)\n\t\t\t\t.values(values)\n\t\t\t\t.onConflictDoUpdate({\n\t\t\t\t\tset: {\n\t\t\t\t\t\tmfa_factors: enrollment.factors ?? null,\n\t\t\t\t\t\tsms_challenge_id: challengeId,\n\t\t\t\t\t\tsms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,\n\t\t\t\t\t\tsms_failed_attempts: 0,\n\t\t\t\t\t\tsms_pending_code_expires_at_ms:\n\t\t\t\t\t\t\tenrollment.smsPendingCodeExpiresAt ?? null,\n\t\t\t\t\t\tsms_pending_code_hash: null,\n\t\t\t\t\t\tsms_pending_factor_id:\n\t\t\t\t\t\t\tenrollment.smsPendingFactorId ?? null,\n\t\t\t\t\t\tsms_pending_purpose:\n\t\t\t\t\t\t\tenrollment.smsPendingPurpose ?? null,\n\t\t\t\t\t\tsms_phone: enrollment.smsPhone ?? null,\n\t\t\t\t\t\tsms_provider_reference: null,\n\t\t\t\t\t\tsms_verified: enrollment.smsVerified,\n\t\t\t\t\t\tupdated_at_ms: enrollment.updatedAt\n\t\t\t\t\t},\n\t\t\t\t\tsetWhere: or(\n\t\t\t\t\t\tisNull(mfaEnrollmentsTable.sms_code_sent_at_ms),\n\t\t\t\t\t\tlte(\n\t\t\t\t\t\t\tmfaEnrollmentsTable.sms_code_sent_at_ms,\n\t\t\t\t\t\t\tcooldownCutoff\n\t\t\t\t\t\t)\n\t\t\t\t\t),\n\t\t\t\t\ttarget: mfaEnrollmentsTable.user_id\n\t\t\t\t})\n\t\t\t\t.returning({ userId: mfaEnrollmentsTable.user_id });\n\n\t\t\treturn rows.length === 1;\n\t\t},\n\t\tcompleteSmsChallenge: async ({\n\t\t\tchallengeId,\n\t\t\tfactors,\n\t\t\tlastUsedAt,\n\t\t\tsmsVerified,\n\t\t\tuserId\n\t\t}) => {\n\t\t\tconst rows = await db\n\t\t\t\t.update(mfaEnrollmentsTable)\n\t\t\t\t.set({\n\t\t\t\t\tlast_used_at_ms: lastUsedAt,\n\t\t\t\t\tmfa_factors: factors,\n\t\t\t\t\tsms_challenge_id: null,\n\t\t\t\t\tsms_failed_attempts: 0,\n\t\t\t\t\tsms_pending_code_expires_at_ms: null,\n\t\t\t\t\tsms_pending_code_hash: null,\n\t\t\t\t\tsms_pending_factor_id: null,\n\t\t\t\t\tsms_pending_purpose: null,\n\t\t\t\t\tsms_provider_reference: null,\n\t\t\t\t\tsms_verified: smsVerified,\n\t\t\t\t\tupdated_at_ms: Date.now()\n\t\t\t\t})\n\t\t\t\t.where(\n\t\t\t\t\tand(\n\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, userId),\n\t\t\t\t\t\teq(mfaEnrollmentsTable.sms_challenge_id, challengeId)\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t\t.returning({ userId: mfaEnrollmentsTable.user_id });\n\n\t\t\treturn rows.length === 1;\n\t\t},\n\t\tfinalizeSmsChallenge: async (input) => {\n\t\t\tconst rows = await db\n\t\t\t\t.update(mfaEnrollmentsTable)\n\t\t\t\t.set({\n\t\t\t\t\tsms_pending_code_expires_at_ms: input.expiresAt,\n\t\t\t\t\tsms_pending_code_hash: input.hash ?? null,\n\t\t\t\t\tsms_provider_reference: input.providerReference ?? null,\n\t\t\t\t\tupdated_at_ms: Date.now()\n\t\t\t\t})\n\t\t\t\t.where(\n\t\t\t\t\tand(\n\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, input.userId),\n\t\t\t\t\t\teq(\n\t\t\t\t\t\t\tmfaEnrollmentsTable.sms_challenge_id,\n\t\t\t\t\t\t\tinput.challengeId\n\t\t\t\t\t\t)\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t\t.returning({ userId: mfaEnrollmentsTable.user_id });\n\n\t\t\treturn rows.length === 1;\n\t\t},\n\t\tgetEnrollment: async (userId) => {\n\t\t\tconst [row] = await db\n\t\t\t\t.select()\n\t\t\t\t.from(mfaEnrollmentsTable)\n\t\t\t\t.where(eq(mfaEnrollmentsTable.user_id, userId))\n\t\t\t\t.limit(1);\n\n\t\t\treturn row ? toEnrollment(row) : undefined;\n\t\t},\n\t\tlistEnrollments: async () => {\n\t\t\tconst rows = await db.select().from(mfaEnrollmentsTable);\n\n\t\t\treturn rows.map(toEnrollment);\n\t\t},\n\t\trecordSmsFailure: async ({ challengeId, maxAttempts, userId }) => {\n\t\t\tconst rows = await db\n\t\t\t\t.update(mfaEnrollmentsTable)\n\t\t\t\t.set({\n\t\t\t\t\tsms_failed_attempts: sql`${mfaEnrollmentsTable.sms_failed_attempts} + 1`,\n\t\t\t\t\tupdated_at_ms: Date.now()\n\t\t\t\t})\n\t\t\t\t.where(\n\t\t\t\t\tand(\n\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, userId),\n\t\t\t\t\t\teq(mfaEnrollmentsTable.sms_challenge_id, challengeId),\n\t\t\t\t\t\tlte(\n\t\t\t\t\t\t\tmfaEnrollmentsTable.sms_failed_attempts,\n\t\t\t\t\t\t\tmaxAttempts - 1\n\t\t\t\t\t\t)\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t\t.returning({\n\t\t\t\t\tattempts: mfaEnrollmentsTable.sms_failed_attempts\n\t\t\t\t});\n\n\t\t\treturn rows[0]?.attempts;\n\t\t},\n\t\tremoveEnrollment: async (userId) => {\n\t\t\tawait db\n\t\t\t\t.delete(mfaEnrollmentsTable)\n\t\t\t\t.where(eq(mfaEnrollmentsTable.user_id, userId));\n\t\t},\n\t\trollbackSmsChallenge: async ({ challengeId, previous, userId }) => {\n\t\t\tif (previous) {\n\t\t\t\tawait db\n\t\t\t\t\t.update(mfaEnrollmentsTable)\n\t\t\t\t\t.set(toValues(previous))\n\t\t\t\t\t.where(\n\t\t\t\t\t\tand(\n\t\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, userId),\n\t\t\t\t\t\t\teq(\n\t\t\t\t\t\t\t\tmfaEnrollmentsTable.sms_challenge_id,\n\t\t\t\t\t\t\t\tchallengeId\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t)\n\t\t\t\t\t);\n\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait db\n\t\t\t\t.delete(mfaEnrollmentsTable)\n\t\t\t\t.where(\n\t\t\t\t\tand(\n\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, userId),\n\t\t\t\t\t\teq(mfaEnrollmentsTable.sms_challenge_id, challengeId)\n\t\t\t\t\t)\n\t\t\t\t);\n\t\t},\n\t\tsaveEnrollment: async (enrollment) => {\n\t\t\tconst values = toValues(enrollment);\n\t\t\tawait db\n\t\t\t\t.insert(mfaEnrollmentsTable)\n\t\t\t\t.values(values)\n\t\t\t\t.onConflictDoUpdate({\n\t\t\t\t\tset: values,\n\t\t\t\t\ttarget: mfaEnrollmentsTable.user_id\n\t\t\t\t});\n\t\t}\n\t};\n};\n",
package/dist/client/index.js CHANGED
@@ -57,14 +57,15 @@ var base64Url = (value) => {
57
57
  };
58
58
  var deriveAuthSyncNamespace = async ({
59
59
  clientId,
60
+ digestSha256 = async (value) => new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(value))),
60
61
  issuer,
61
62
  partition,
62
63
  subject
63
64
  }) => {
64
65
  if (clientId.length === 0 || issuer.length === 0 || subject.length === 0)
65
66
  throw new TypeError("Auth Sync namespace requires issuer, clientId, and subject.");
66
- const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify([issuer, clientId, subject, partition ?? null])));
67
- return `auth:v1:${base64Url(new Uint8Array(digest))}`;
67
+ const digest = await digestSha256(new TextEncoder().encode(JSON.stringify([issuer, clientId, subject, partition ?? null])));
68
+ return `auth:v1:${base64Url(digest)}`;
68
69
  };
69
70
  var readAuthSyncPartition = (user) => {
70
71
  if (typeof user !== "object" || user === null)
@@ -303,6 +304,7 @@ var createMobileAuthClient = (config) => {
303
304
  issuer,
304
305
  namespace: await deriveAuthSyncNamespace({
305
306
  clientId: config.clientId,
307
+ digestSha256: cryptoProvider.digestSha256,
306
308
  issuer,
307
309
  partition,
308
310
  subject: user.sub
@@ -1151,5 +1153,5 @@ export {
1151
1153
  toSafeLocalPath
1152
1154
  };
1153
1155
 
1154
- //# debugId=40B0D744DE96700564756E2164756E21
1156
+ //# debugId=B9D9AC1FA254C57B64756E2164756E21
1155
1157
  //# sourceMappingURL=index.js.map