@absolutejs/auth 0.76.3 → 0.77.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/dist/agents/index.js.map +2 -2
  2. package/dist/cli/migrate.js.map +1 -1
  3. package/dist/index.d.ts +2 -2
  4. package/dist/index.js +20 -12
  5. package/dist/index.js.map +11 -11
  6. package/dist/linkedProviders/index.d.ts +3 -1
  7. package/dist/linkedProviders/index.js +11983 -8
  8. package/dist/linkedProviders/index.js.map +103 -5
  9. package/dist/linkedProviders/neonStores.d.ts +8 -2
  10. package/dist/linkedProviders/resolver.d.ts +16 -1
  11. package/dist/oidc/index.js.map +2 -2
  12. package/dist/server.js +16 -12
  13. package/dist/server.js.map +11 -11
  14. package/package.json +1 -1
package/dist/cli/migrate.js.map CHANGED
@@ -16,7 +16,7 @@
16
16
  "import { desc, eq, lt } from 'drizzle-orm';\nimport { bigint, jsonb, pgTable, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport { isAuditEventType, type AuditEvent, type AuditSink } from './types';\n\nconst ID_LENGTH = 255;\nconst IP_LENGTH = 64;\nconst TYPE_LENGTH = 64;\nconst DEFAULT_AUDIT_LIMIT = 100;\n\nexport const auditEventsTable = pgTable('auth_audit_events', {\n\tat_ms: bigint('at_ms', { mode: 'number' }).notNull(),\n\tid: varchar('id', { length: ID_LENGTH }).primaryKey(),\n\tip: varchar('ip', { length: IP_LENGTH }),\n\tmetadata_json: jsonb('metadata_json').$type<Record<string, unknown>>(),\n\torganization_id: varchar('organization_id', { length: ID_LENGTH }),\n\ttype: varchar('type', { length: TYPE_LENGTH }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH })\n});\n\ntype AuditRow = typeof auditEventsTable.$inferSelect;\n\nconst toEvent = (row: AuditRow): AuditEvent => {\n\tif (!isAuditEventType(row.type))\n\t\tthrow new Error(`Unknown persisted audit event type: ${row.type}`);\n\n\treturn {\n\t\tat: row.at_ms,\n\t\tip: row.ip ?? undefined,\n\t\tmetadata: row.metadata_json ?? undefined,\n\t\torganizationId: row.organization_id ?? undefined,\n\t\ttype: row.type,\n\t\tuserId: row.user_id ?? undefined\n\t};\n};\n\nexport const createNeonAuditSink = (databaseUrl: string) =>\n\tcreatePostgresAuditSink(createNeonDatabase(databaseUrl));\nexport const createPostgresAuditSink = <DB extends AnyPgDatabase>(\n\tdb: DB\n): AuditSink => ({\n\tappend: async (event) => {\n\t\tawait db.insert(auditEventsTable).values({\n\t\t\tat_ms: event.at,\n\t\t\tid: crypto.randomUUID(),\n\t\t\tip: event.ip ?? null,\n\t\t\tmetadata_json: event.metadata ?? null,\n\t\t\torganization_id: event.organizationId ?? null,\n\t\t\ttype: event.type,\n\t\t\tuser_id: event.userId ?? null\n\t\t});\n\t},\n\tlist: async (filter) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(auditEventsTable)\n\t\t\t.where(\n\t\t\t\tfilter?.userId\n\t\t\t\t\t? eq(auditEventsTable.user_id, filter.userId)\n\t\t\t\t\t: undefined\n\t\t\t)\n\t\t\t.orderBy(desc(auditEventsTable.at_ms))\n\t\t\t.limit(filter?.limit ?? DEFAULT_AUDIT_LIMIT);\n\n\t\treturn rows.map(toEvent);\n\t},\n\tprune: async (before) => {\n\t\tconst deleted = await db\n\t\t\t.delete(auditEventsTable)\n\t\t\t.where(lt(auditEventsTable.at_ms, before))\n\t\t\t.returning({ id: auditEventsTable.id });\n\n\t\treturn deleted.length;\n\t}\n});\n",
17
17
  "import { eq } from 'drizzle-orm';\nimport {\n\tbigint,\n\tboolean,\n\tjsonb,\n\tpgTable,\n\ttext,\n\tvarchar\n} from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type {\n\tCredentialRecord,\n\tCredentialStatus,\n\tCredentialStore,\n\tCredentialToken\n} from './types';\n\nconst EMAIL_LENGTH = 320;\nconst ID_LENGTH = 255;\nconst STATUS_LENGTH = 32;\nconst TOKEN_HASH_LENGTH = 255;\n\nexport const credentialsTable = pgTable('auth_credentials', {\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\temail: varchar('email', { length: EMAIL_LENGTH }).primaryKey(),\n\temail_verified: boolean('email_verified').notNull().default(false),\n\torganization_id: varchar('organization_id', { length: ID_LENGTH }),\n\tpassword_hash: text('password_hash').notNull(),\n\tregistration_data:\n\t\tjsonb('registration_data').$type<Record<string, unknown>>(),\n\tstatus: varchar('status', { length: STATUS_LENGTH })\n\t\t.notNull()\n\t\t.default('active'),\n\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH })\n});\n\nconst createTokenTable = (name: string) =>\n\tpgTable(name, {\n\t\temail: varchar('email', { length: EMAIL_LENGTH }).notNull(),\n\t\texpires_at_ms: bigint('expires_at_ms', { mode: 'number' }).notNull(),\n\t\ttoken_hash: varchar('token_hash', {\n\t\t\tlength: TOKEN_HASH_LENGTH\n\t\t}).primaryKey()\n\t});\n\nexport const credentialResetTokensTable = createTokenTable(\n\t'auth_credential_reset_tokens'\n);\nexport const credentialVerificationTokensTable = createTokenTable(\n\t'auth_credential_verification_tokens'\n);\n\ntype CredentialRow = typeof credentialsTable.$inferSelect;\ntype CredentialInsert = typeof credentialsTable.$inferInsert;\ntype TokenTable = ReturnType<typeof createTokenTable>;\ntype TokenRow = TokenTable['$inferSelect'];\ntype TokenInsert = TokenTable['$inferInsert'];\n\nconst CREDENTIAL_STATUSES: CredentialStatus[] = ['active', 'disabled'];\n\nconst isCredentialStatus = (value: string): value is CredentialStatus =>\n\tCREDENTIAL_STATUSES.some((status) => status === value);\n\nconst toCredentialRecord = (row: CredentialRow): CredentialRecord => ({\n\tcreatedAt: row.created_at_ms,\n\temail: row.email,\n\temailVerified: row.email_verified,\n\torganizationId: row.organization_id ?? undefined,\n\tpasswordHash: row.password_hash,\n\tregistrationData: row.registration_data ?? undefined,\n\tstatus: isCredentialStatus(row.status) ? row.status : 'active',\n\tupdatedAt: row.updated_at_ms,\n\tuserId: row.user_id ?? undefined\n});\n\nconst toToken = (row: TokenRow): CredentialToken => ({\n\temail: row.email,\n\texpiresAt: row.expires_at_ms,\n\ttokenHash: row.token_hash\n});\n\nconst saveToken = async <DB extends AnyPgDatabase>(\n\tdb: DB,\n\ttable: TokenTable,\n\ttoken: CredentialToken\n) => {\n\tconst values: TokenInsert = {\n\t\temail: token.email.toLowerCase(),\n\t\texpires_at_ms: token.expiresAt,\n\t\ttoken_hash: token.tokenHash\n\t};\n\tawait db\n\t\t.insert(table)\n\t\t.values(values)\n\t\t.onConflictDoUpdate({ set: values, target: table.token_hash });\n};\n\nconst consumeToken = async <DB extends AnyPgDatabase>(\n\tdb: DB,\n\ttable: TokenTable,\n\ttokenHash: string\n) => {\n\tconst [row] = await db\n\t\t.select()\n\t\t.from(table)\n\t\t.where(eq(table.token_hash, tokenHash))\n\t\t.limit(1);\n\tif (!row) return undefined;\n\n\tawait db.delete(table).where(eq(table.token_hash, tokenHash));\n\tif (row.expires_at_ms < Date.now()) return undefined;\n\n\treturn toToken(row);\n};\n\nexport const createNeonCredentialStore = (databaseUrl: string) =>\n\tcreatePostgresCredentialStore(createNeonDatabase(databaseUrl));\nexport const createPostgresCredentialStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): CredentialStore => ({\n\tconsumeResetToken: (tokenHash) =>\n\t\tconsumeToken(db, credentialResetTokensTable, tokenHash),\n\tconsumeVerificationToken: (tokenHash) =>\n\t\tconsumeToken(db, credentialVerificationTokensTable, tokenHash),\n\tgetCredentialByEmail: async (email) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(credentialsTable)\n\t\t\t.where(eq(credentialsTable.email, email.toLowerCase()))\n\t\t\t.limit(1);\n\n\t\treturn row ? toCredentialRecord(row) : undefined;\n\t},\n\tsaveCredential: async (credential) => {\n\t\tconst values: CredentialInsert = {\n\t\t\tcreated_at_ms: credential.createdAt,\n\t\t\temail: credential.email.toLowerCase(),\n\t\t\temail_verified: credential.emailVerified,\n\t\t\torganization_id: credential.organizationId ?? null,\n\t\t\tpassword_hash: credential.passwordHash,\n\t\t\tregistration_data: credential.registrationData ?? null,\n\t\t\tstatus: credential.status,\n\t\t\tupdated_at_ms: credential.updatedAt,\n\t\t\tuser_id: credential.userId ?? null\n\t\t};\n\t\tawait db.insert(credentialsTable).values(values).onConflictDoUpdate({\n\t\t\tset: values,\n\t\t\ttarget: credentialsTable.email\n\t\t});\n\t},\n\tsaveResetToken: (token) => saveToken(db, credentialResetTokensTable, token),\n\tsaveVerificationToken: (token) =>\n\t\tsaveToken(db, credentialVerificationTokensTable, token),\n\tsetEmailVerified: async (email) => {\n\t\tawait db\n\t\t\t.update(credentialsTable)\n\t\t\t.set({ email_verified: true, updated_at_ms: Date.now() })\n\t\t\t.where(eq(credentialsTable.email, email.toLowerCase()));\n\t}\n});\n",
18
18
  "import { and, eq } from 'drizzle-orm';\nimport { pgTable, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport { warrantKey } from './inMemoryStores';\nimport type { Warrant, WarrantStore } from './types';\n\nconst ID_LENGTH = 255;\n\nexport const warrantsTable = pgTable('auth_fga_warrants', {\n\tid: varchar('id', { length: ID_LENGTH }).primaryKey(),\n\trelation: varchar('relation', { length: ID_LENGTH }).notNull(),\n\tresource_id: varchar('resource_id', { length: ID_LENGTH }).notNull(),\n\tresource_type: varchar('resource_type', { length: ID_LENGTH }).notNull(),\n\tsubject_id: varchar('subject_id', { length: ID_LENGTH }).notNull(),\n\tsubject_relation: varchar('subject_relation', { length: ID_LENGTH }),\n\tsubject_type: varchar('subject_type', { length: ID_LENGTH }).notNull()\n});\n\ntype WarrantRow = typeof warrantsTable.$inferSelect;\n\nconst toWarrant = (row: WarrantRow): Warrant => ({\n\trelation: row.relation,\n\tresourceId: row.resource_id,\n\tresourceType: row.resource_type,\n\tsubjectId: row.subject_id,\n\tsubjectRelation: row.subject_relation ?? undefined,\n\tsubjectType: row.subject_type\n});\n\nexport const createNeonWarrantStore = (databaseUrl: string) =>\n\tcreatePostgresWarrantStore(createNeonDatabase(databaseUrl));\nexport const createPostgresWarrantStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): WarrantStore => ({\n\tdeleteWarrant: async (warrant) => {\n\t\tawait db\n\t\t\t.delete(warrantsTable)\n\t\t\t.where(eq(warrantsTable.id, warrantKey(warrant)));\n\t},\n\tlistForResource: async (resourceType, resourceId, relation) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(warrantsTable)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(warrantsTable.resource_type, resourceType),\n\t\t\t\t\teq(warrantsTable.resource_id, resourceId),\n\t\t\t\t\teq(warrantsTable.relation, relation)\n\t\t\t\t)\n\t\t\t);\n\n\t\treturn rows.map(toWarrant);\n\t},\n\tlistResourceIds: async (resourceType) => {\n\t\tconst rows = await db\n\t\t\t.selectDistinct({ resourceId: warrantsTable.resource_id })\n\t\t\t.from(warrantsTable)\n\t\t\t.where(eq(warrantsTable.resource_type, resourceType));\n\n\t\treturn rows.map((row) => row.resourceId);\n\t},\n\tsaveWarrant: async (warrant) => {\n\t\tawait db\n\t\t\t.insert(warrantsTable)\n\t\t\t.values({\n\t\t\t\tid: warrantKey(warrant),\n\t\t\t\trelation: warrant.relation,\n\t\t\t\tresource_id: warrant.resourceId,\n\t\t\t\tresource_type: warrant.resourceType,\n\t\t\t\tsubject_id: warrant.subjectId,\n\t\t\t\tsubject_relation: warrant.subjectRelation ?? null,\n\t\t\t\tsubject_type: warrant.subjectType\n\t\t\t})\n\t\t\t.onConflictDoNothing({ target: warrantsTable.id });\n\t}\n});\n",
19
- "import type {\n\tLinkedProviderBinding,\n\tLinkedProviderBindingStore,\n\tLinkedProviderGrant,\n\tLinkedProviderGrantStore,\n\tJsonObject\n} from '@absolutejs/linked-providers';\nimport { neon } from '@neondatabase/serverless';\nimport { desc, eq, sql as drizzleSql } from 'drizzle-orm';\nimport { drizzle } from 'drizzle-orm/neon-http';\nimport { jsonb, pgTable, text, timestamp, varchar } from 'drizzle-orm/pg-core';\nimport type { AnyPgDatabase } from '../stores/postgres';\nimport type { OAuth2ConfigurationOptions } from '../types';\nimport { createOAuthLinkedProviderCredentialResolver } from './oauthResolver';\n\nexport const linkedProviderBindingsTable = pgTable('linked_provider_bindings', {\n\tavailable_scopes: jsonb('available_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tcapabilities: jsonb('capabilities').$type<string[]>().default([]),\n\tconnector_provider: varchar('connector_provider', { length: 64 }).notNull(),\n\tcreated_at: timestamp('created_at').notNull().defaultNow(),\n\temail: varchar('email', { length: 320 }),\n\texternal_account_id: varchar('external_account_id', {\n\t\tlength: 255\n\t}).notNull(),\n\texternal_account_type: varchar('external_account_type', {\n\t\tlength: 64\n\t}).notNull(),\n\tgrant_id: varchar('grant_id', { length: 255 }).notNull(),\n\tid: varchar('id', { length: 255 }).primaryKey(),\n\tlabel: varchar('label', { length: 255 }),\n\tmetadata: jsonb('metadata').$type<JsonObject>().default({}),\n\tstatus: varchar('status', { length: 64 })\n\t\t.$type<LinkedProviderBinding['status']>()\n\t\t.notNull(),\n\tupdated_at: timestamp('updated_at').notNull().defaultNow(),\n\tusername: varchar('username', { length: 255 })\n});\nexport const linkedProviderGrantsTable = pgTable('linked_provider_grants', {\n\taccess_token_ciphertext: text('access_token_ciphertext'),\n\tauth_provider_key: varchar('auth_provider_key', { length: 64 }).notNull(),\n\tcreated_at: timestamp('created_at').notNull().defaultNow(),\n\texpires_at: timestamp('expires_at'),\n\tgranted_scopes: jsonb('granted_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tid: varchar('id', { length: 255 }).primaryKey(),\n\tlast_refresh_error: text('last_refresh_error'),\n\tlast_refreshed_at: timestamp('last_refreshed_at'),\n\tmetadata: jsonb('metadata').$type<JsonObject>().default({}),\n\towner_ref: varchar('owner_ref', { length: 255 }).notNull(),\n\tprovider_family: varchar('provider_family', { length: 64 }).notNull(),\n\tprovider_subject: varchar('provider_subject', { length: 255 }).notNull(),\n\trefresh_token_ciphertext: text('refresh_token_ciphertext'),\n\tstatus: varchar('status', { length: 64 })\n\t\t.$type<LinkedProviderGrant['status']>()\n\t\t.notNull(),\n\ttoken_type: varchar('token_type', { length: 64 }),\n\tupdated_at: timestamp('updated_at').notNull().defaultNow()\n});\nexport type LinkedProviderGrantRow =\n\ttypeof linkedProviderGrantsTable.$inferSelect;\nexport type LinkedProviderBindingRow =\n\ttypeof linkedProviderBindingsTable.$inferSelect;\n\nconst toTimestamp = (value: number | undefined) =>\n\tvalue === undefined ? null : new Date(value);\n\nconst fromTimestamp = (value: Date | null) =>\n\tvalue === null ? undefined : value.getTime();\n\nconst toGrant = (row: LinkedProviderGrantRow): LinkedProviderGrant => ({\n\taccessTokenCiphertext: row.access_token_ciphertext ?? undefined,\n\tauthProviderKey: row.auth_provider_key,\n\tcreatedAt: row.created_at.getTime(),\n\texpiresAt: fromTimestamp(row.expires_at),\n\tgrantedScopes: row.granted_scopes ?? [],\n\tid: row.id,\n\tlastRefreshedAt: fromTimestamp(row.last_refreshed_at),\n\tlastRefreshError: row.last_refresh_error ?? undefined,\n\tmetadata: row.metadata ?? undefined,\n\townerRef: row.owner_ref,\n\tproviderFamily: row.provider_family,\n\tproviderSubject: row.provider_subject,\n\trefreshTokenCiphertext: row.refresh_token_ciphertext ?? undefined,\n\tstatus: row.status,\n\ttokenType: row.token_type ?? undefined,\n\tupdatedAt: row.updated_at.getTime()\n});\n\nconst toBinding = (row: LinkedProviderBindingRow): LinkedProviderBinding => ({\n\tavailableScopes: row.available_scopes ?? [],\n\tcapabilities: row.capabilities ?? undefined,\n\tconnectorProvider: row.connector_provider,\n\tcreatedAt: row.created_at.getTime(),\n\temail: row.email ?? undefined,\n\texternalAccountId: row.external_account_id,\n\texternalAccountType: row.external_account_type,\n\tgrantId: row.grant_id,\n\tid: row.id,\n\tlabel: row.label ?? undefined,\n\tmetadata: row.metadata ?? undefined,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at.getTime(),\n\tusername: row.username ?? undefined\n});\n\nexport const createNeonLinkedProviderBindingStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LinkedProviderBindingStore => ({\n\tgetBinding: async (id) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.id, id))\n\t\t\t.limit(1);\n\n\t\treturn row ? toBinding(row) : undefined;\n\t},\n\tlistBindingsByGrant: async (grantId) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.grant_id, grantId))\n\t\t\t.orderBy(desc(linkedProviderBindingsTable.updated_at));\n\n\t\treturn rows.map(toBinding);\n\t},\n\tlistBindingsByOwner: async (ownerRef) => {\n\t\tconst rows = await db\n\t\t\t.select({ binding: linkedProviderBindingsTable })\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.innerJoin(\n\t\t\t\tlinkedProviderGrantsTable,\n\t\t\t\teq(\n\t\t\t\t\tlinkedProviderBindingsTable.grant_id,\n\t\t\t\t\tlinkedProviderGrantsTable.id\n\t\t\t\t)\n\t\t\t)\n\t\t\t.where(eq(linkedProviderGrantsTable.owner_ref, ownerRef))\n\t\t\t.orderBy(desc(linkedProviderBindingsTable.updated_at));\n\n\t\treturn rows.map(({ binding }) => toBinding(binding));\n\t},\n\tremoveBinding: async (id) => {\n\t\tawait db\n\t\t\t.delete(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.id, id));\n\t},\n\tsaveBinding: async (binding) => {\n\t\tawait db\n\t\t\t.insert(linkedProviderBindingsTable)\n\t\t\t.values({\n\t\t\t\tavailable_scopes: binding.availableScopes,\n\t\t\t\tcapabilities: binding.capabilities ?? [],\n\t\t\t\tconnector_provider: binding.connectorProvider,\n\t\t\t\tcreated_at: new Date(binding.createdAt),\n\t\t\t\temail: binding.email ?? null,\n\t\t\t\texternal_account_id: binding.externalAccountId,\n\t\t\t\texternal_account_type: binding.externalAccountType,\n\t\t\t\tgrant_id: binding.grantId,\n\t\t\t\tid: binding.id,\n\t\t\t\tlabel: binding.label ?? null,\n\t\t\t\tmetadata: binding.metadata ?? {},\n\t\t\t\tstatus: binding.status,\n\t\t\t\tupdated_at: new Date(binding.updatedAt),\n\t\t\t\tusername: binding.username ?? null\n\t\t\t})\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: {\n\t\t\t\t\tavailable_scopes: binding.availableScopes,\n\t\t\t\t\tcapabilities: binding.capabilities ?? [],\n\t\t\t\t\tconnector_provider: binding.connectorProvider,\n\t\t\t\t\temail: binding.email ?? null,\n\t\t\t\t\texternal_account_id: binding.externalAccountId,\n\t\t\t\t\texternal_account_type: binding.externalAccountType,\n\t\t\t\t\tgrant_id: binding.grantId,\n\t\t\t\t\tlabel: binding.label ?? null,\n\t\t\t\t\tmetadata: binding.metadata ?? {},\n\t\t\t\t\tstatus: binding.status,\n\t\t\t\t\tupdated_at: new Date(binding.updatedAt),\n\t\t\t\t\tusername: binding.username ?? null\n\t\t\t\t},\n\t\t\t\ttarget: linkedProviderBindingsTable.id\n\t\t\t});\n\t}\n});\nexport const createNeonLinkedProviderGrantStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LinkedProviderGrantStore => ({\n\tgetGrant: async (id) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.id, id))\n\t\t\t.limit(1);\n\n\t\treturn row ? toGrant(row) : undefined;\n\t},\n\tlistGrantsByOwner: async (ownerRef) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.owner_ref, ownerRef))\n\t\t\t.orderBy(desc(linkedProviderGrantsTable.updated_at));\n\n\t\treturn rows.map(toGrant);\n\t},\n\tremoveGrant: async (id) => {\n\t\tawait db\n\t\t\t.delete(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.grant_id, id));\n\t\tawait db\n\t\t\t.delete(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.id, id));\n\t},\n\tsaveGrant: async (grant) => {\n\t\tawait db\n\t\t\t.insert(linkedProviderGrantsTable)\n\t\t\t.values({\n\t\t\t\taccess_token_ciphertext: grant.accessTokenCiphertext ?? null,\n\t\t\t\tauth_provider_key: grant.authProviderKey,\n\t\t\t\tcreated_at: new Date(grant.createdAt),\n\t\t\t\texpires_at: toTimestamp(grant.expiresAt),\n\t\t\t\tgranted_scopes: grant.grantedScopes,\n\t\t\t\tid: grant.id,\n\t\t\t\tlast_refresh_error: grant.lastRefreshError ?? null,\n\t\t\t\tlast_refreshed_at: toTimestamp(grant.lastRefreshedAt),\n\t\t\t\tmetadata: grant.metadata ?? {},\n\t\t\t\towner_ref: grant.ownerRef,\n\t\t\t\tprovider_family: grant.providerFamily,\n\t\t\t\tprovider_subject: grant.providerSubject,\n\t\t\t\trefresh_token_ciphertext: grant.refreshTokenCiphertext ?? null,\n\t\t\t\tstatus: grant.status,\n\t\t\t\ttoken_type: grant.tokenType ?? null,\n\t\t\t\tupdated_at: new Date(grant.updatedAt)\n\t\t\t})\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: {\n\t\t\t\t\taccess_token_ciphertext:\n\t\t\t\t\t\tgrant.accessTokenCiphertext ?? null,\n\t\t\t\t\tauth_provider_key: grant.authProviderKey,\n\t\t\t\t\texpires_at: toTimestamp(grant.expiresAt),\n\t\t\t\t\tgranted_scopes: grant.grantedScopes,\n\t\t\t\t\tlast_refresh_error: grant.lastRefreshError ?? null,\n\t\t\t\t\tlast_refreshed_at: toTimestamp(grant.lastRefreshedAt),\n\t\t\t\t\tmetadata: grant.metadata ?? {},\n\t\t\t\t\towner_ref: grant.ownerRef,\n\t\t\t\t\tprovider_family: grant.providerFamily,\n\t\t\t\t\tprovider_subject: grant.providerSubject,\n\t\t\t\t\trefresh_token_ciphertext: drizzleSql`coalesce(excluded.refresh_token_ciphertext, ${linkedProviderGrantsTable.refresh_token_ciphertext})`,\n\t\t\t\t\tstatus: grant.status,\n\t\t\t\t\ttoken_type: grant.tokenType ?? null,\n\t\t\t\t\tupdated_at: new Date(grant.updatedAt)\n\t\t\t\t},\n\t\t\t\ttarget: linkedProviderGrantsTable.id\n\t\t\t});\n\t}\n});\nexport const createNeonLinkedProviderStores = (databaseUrl: string) => {\n\tconst sql = neon(databaseUrl);\n\tconst db = drizzle({ client: sql });\n\n\treturn {\n\t\tbindingStore: createNeonLinkedProviderBindingStore(db),\n\t\tdb,\n\t\tgrantStore: createNeonLinkedProviderGrantStore(db)\n\t};\n};\n\nexport type CreateNeonOAuthLinkedProviderCredentialResolverOptions = {\n\tdatabaseUrl: string;\n\tprovidersConfiguration: OAuth2ConfigurationOptions;\n\tnow?: () => number;\n};\n\nexport const createNeonOAuthLinkedProviderCredentialResolver = async ({\n\tdatabaseUrl,\n\tnow,\n\tprovidersConfiguration\n}: CreateNeonOAuthLinkedProviderCredentialResolverOptions) => {\n\tconst stores = createNeonLinkedProviderStores(databaseUrl);\n\n\treturn createOAuthLinkedProviderCredentialResolver({\n\t\t...stores,\n\t\tnow,\n\t\tprovidersConfiguration\n\t});\n};\n",
19
+ "import type {\n\tLinkedProviderBinding,\n\tLinkedProviderBindingStore,\n\tLinkedProviderGrant,\n\tLinkedProviderGrantStore,\n\tJsonObject\n} from '@absolutejs/linked-providers';\nimport { neon } from '@neondatabase/serverless';\nimport { desc, eq, sql as drizzleSql } from 'drizzle-orm';\nimport { drizzle } from 'drizzle-orm/neon-http';\nimport { jsonb, pgTable, text, timestamp, varchar } from 'drizzle-orm/pg-core';\nimport type { AnyPgDatabase } from '../stores/postgres';\nimport type { OAuth2ConfigurationOptions } from '../types';\nimport { createOAuthLinkedProviderCredentialResolver } from './oauthResolver';\n\nexport const linkedProviderBindingsTable = pgTable('linked_provider_bindings', {\n\tavailable_scopes: jsonb('available_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tcapabilities: jsonb('capabilities').$type<string[]>().default([]),\n\tconnector_provider: varchar('connector_provider', { length: 64 }).notNull(),\n\tcreated_at: timestamp('created_at').notNull().defaultNow(),\n\temail: varchar('email', { length: 320 }),\n\texternal_account_id: varchar('external_account_id', {\n\t\tlength: 255\n\t}).notNull(),\n\texternal_account_type: varchar('external_account_type', {\n\t\tlength: 64\n\t}).notNull(),\n\tgrant_id: varchar('grant_id', { length: 255 }).notNull(),\n\tid: varchar('id', { length: 255 }).primaryKey(),\n\tlabel: varchar('label', { length: 255 }),\n\tmetadata: jsonb('metadata').$type<JsonObject>().default({}),\n\tstatus: varchar('status', { length: 64 })\n\t\t.$type<LinkedProviderBinding['status']>()\n\t\t.notNull(),\n\tupdated_at: timestamp('updated_at').notNull().defaultNow(),\n\tusername: varchar('username', { length: 255 })\n});\nexport const linkedProviderGrantsTable = pgTable('linked_provider_grants', {\n\taccess_token_ciphertext: text('access_token_ciphertext'),\n\tauth_provider_key: varchar('auth_provider_key', { length: 64 }).notNull(),\n\tcreated_at: timestamp('created_at').notNull().defaultNow(),\n\texpires_at: timestamp('expires_at'),\n\tgranted_scopes: jsonb('granted_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tid: varchar('id', { length: 255 }).primaryKey(),\n\tlast_refresh_error: text('last_refresh_error'),\n\tlast_refreshed_at: timestamp('last_refreshed_at'),\n\tmetadata: jsonb('metadata').$type<JsonObject>().default({}),\n\towner_ref: varchar('owner_ref', { length: 255 }).notNull(),\n\tprovider_family: varchar('provider_family', { length: 64 }).notNull(),\n\tprovider_subject: varchar('provider_subject', { length: 255 }).notNull(),\n\trefresh_token_ciphertext: text('refresh_token_ciphertext'),\n\tstatus: varchar('status', { length: 64 })\n\t\t.$type<LinkedProviderGrant['status']>()\n\t\t.notNull(),\n\ttoken_type: varchar('token_type', { length: 64 }),\n\tupdated_at: timestamp('updated_at').notNull().defaultNow()\n});\nexport type LinkedProviderGrantRow =\n\ttypeof linkedProviderGrantsTable.$inferSelect;\nexport type LinkedProviderBindingRow =\n\ttypeof linkedProviderBindingsTable.$inferSelect;\n\nconst toTimestamp = (value: number | undefined) =>\n\tvalue === undefined ? null : new Date(value);\n\nconst fromTimestamp = (value: Date | null) =>\n\tvalue === null ? undefined : value.getTime();\n\nconst toGrant = (row: LinkedProviderGrantRow): LinkedProviderGrant => ({\n\taccessTokenCiphertext: row.access_token_ciphertext ?? undefined,\n\tauthProviderKey: row.auth_provider_key,\n\tcreatedAt: row.created_at.getTime(),\n\texpiresAt: fromTimestamp(row.expires_at),\n\tgrantedScopes: row.granted_scopes ?? [],\n\tid: row.id,\n\tlastRefreshedAt: fromTimestamp(row.last_refreshed_at),\n\tlastRefreshError: row.last_refresh_error ?? undefined,\n\tmetadata: row.metadata ?? undefined,\n\townerRef: row.owner_ref,\n\tproviderFamily: row.provider_family,\n\tproviderSubject: row.provider_subject,\n\trefreshTokenCiphertext: row.refresh_token_ciphertext ?? undefined,\n\tstatus: row.status,\n\ttokenType: row.token_type ?? undefined,\n\tupdatedAt: row.updated_at.getTime()\n});\n\nconst toBinding = (row: LinkedProviderBindingRow): LinkedProviderBinding => ({\n\tavailableScopes: row.available_scopes ?? [],\n\tcapabilities: row.capabilities ?? undefined,\n\tconnectorProvider: row.connector_provider,\n\tcreatedAt: row.created_at.getTime(),\n\temail: row.email ?? undefined,\n\texternalAccountId: row.external_account_id,\n\texternalAccountType: row.external_account_type,\n\tgrantId: row.grant_id,\n\tid: row.id,\n\tlabel: row.label ?? undefined,\n\tmetadata: row.metadata ?? undefined,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at.getTime(),\n\tusername: row.username ?? undefined\n});\n\n/**\n * These two take a database rather than a connection string, so an application\n * that already has one uses it instead of opening a second. Nothing in either\n * is specific to Neon -- the Neon helpers below are the convenience that opens\n * a connection for a caller who has none.\n */\nexport const createLinkedProviderBindingStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LinkedProviderBindingStore => ({\n\tgetBinding: async (id) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.id, id))\n\t\t\t.limit(1);\n\n\t\treturn row ? toBinding(row) : undefined;\n\t},\n\tlistBindingsByGrant: async (grantId) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.grant_id, grantId))\n\t\t\t.orderBy(desc(linkedProviderBindingsTable.updated_at));\n\n\t\treturn rows.map(toBinding);\n\t},\n\tlistBindingsByOwner: async (ownerRef) => {\n\t\tconst rows = await db\n\t\t\t.select({ binding: linkedProviderBindingsTable })\n\t\t\t.from(linkedProviderBindingsTable)\n\t\t\t.innerJoin(\n\t\t\t\tlinkedProviderGrantsTable,\n\t\t\t\teq(\n\t\t\t\t\tlinkedProviderBindingsTable.grant_id,\n\t\t\t\t\tlinkedProviderGrantsTable.id\n\t\t\t\t)\n\t\t\t)\n\t\t\t.where(eq(linkedProviderGrantsTable.owner_ref, ownerRef))\n\t\t\t.orderBy(desc(linkedProviderBindingsTable.updated_at));\n\n\t\treturn rows.map(({ binding }) => toBinding(binding));\n\t},\n\tremoveBinding: async (id) => {\n\t\tawait db\n\t\t\t.delete(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.id, id));\n\t},\n\tsaveBinding: async (binding) => {\n\t\tawait db\n\t\t\t.insert(linkedProviderBindingsTable)\n\t\t\t.values({\n\t\t\t\tavailable_scopes: binding.availableScopes,\n\t\t\t\tcapabilities: binding.capabilities ?? [],\n\t\t\t\tconnector_provider: binding.connectorProvider,\n\t\t\t\tcreated_at: new Date(binding.createdAt),\n\t\t\t\temail: binding.email ?? null,\n\t\t\t\texternal_account_id: binding.externalAccountId,\n\t\t\t\texternal_account_type: binding.externalAccountType,\n\t\t\t\tgrant_id: binding.grantId,\n\t\t\t\tid: binding.id,\n\t\t\t\tlabel: binding.label ?? null,\n\t\t\t\tmetadata: binding.metadata ?? {},\n\t\t\t\tstatus: binding.status,\n\t\t\t\tupdated_at: new Date(binding.updatedAt),\n\t\t\t\tusername: binding.username ?? null\n\t\t\t})\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: {\n\t\t\t\t\tavailable_scopes: binding.availableScopes,\n\t\t\t\t\tcapabilities: binding.capabilities ?? [],\n\t\t\t\t\tconnector_provider: binding.connectorProvider,\n\t\t\t\t\temail: binding.email ?? null,\n\t\t\t\t\texternal_account_id: binding.externalAccountId,\n\t\t\t\t\texternal_account_type: binding.externalAccountType,\n\t\t\t\t\tgrant_id: binding.grantId,\n\t\t\t\t\tlabel: binding.label ?? null,\n\t\t\t\t\tmetadata: binding.metadata ?? {},\n\t\t\t\t\tstatus: binding.status,\n\t\t\t\t\tupdated_at: new Date(binding.updatedAt),\n\t\t\t\t\tusername: binding.username ?? null\n\t\t\t\t},\n\t\t\t\ttarget: linkedProviderBindingsTable.id\n\t\t\t});\n\t}\n});\nexport const createLinkedProviderGrantStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LinkedProviderGrantStore => ({\n\tgetGrant: async (id) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.id, id))\n\t\t\t.limit(1);\n\n\t\treturn row ? toGrant(row) : undefined;\n\t},\n\tlistGrantsByOwner: async (ownerRef) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.owner_ref, ownerRef))\n\t\t\t.orderBy(desc(linkedProviderGrantsTable.updated_at));\n\n\t\treturn rows.map(toGrant);\n\t},\n\tremoveGrant: async (id) => {\n\t\tawait db\n\t\t\t.delete(linkedProviderBindingsTable)\n\t\t\t.where(eq(linkedProviderBindingsTable.grant_id, id));\n\t\tawait db\n\t\t\t.delete(linkedProviderGrantsTable)\n\t\t\t.where(eq(linkedProviderGrantsTable.id, id));\n\t},\n\tsaveGrant: async (grant) => {\n\t\tawait db\n\t\t\t.insert(linkedProviderGrantsTable)\n\t\t\t.values({\n\t\t\t\taccess_token_ciphertext: grant.accessTokenCiphertext ?? null,\n\t\t\t\tauth_provider_key: grant.authProviderKey,\n\t\t\t\tcreated_at: new Date(grant.createdAt),\n\t\t\t\texpires_at: toTimestamp(grant.expiresAt),\n\t\t\t\tgranted_scopes: grant.grantedScopes,\n\t\t\t\tid: grant.id,\n\t\t\t\tlast_refresh_error: grant.lastRefreshError ?? null,\n\t\t\t\tlast_refreshed_at: toTimestamp(grant.lastRefreshedAt),\n\t\t\t\tmetadata: grant.metadata ?? {},\n\t\t\t\towner_ref: grant.ownerRef,\n\t\t\t\tprovider_family: grant.providerFamily,\n\t\t\t\tprovider_subject: grant.providerSubject,\n\t\t\t\trefresh_token_ciphertext: grant.refreshTokenCiphertext ?? null,\n\t\t\t\tstatus: grant.status,\n\t\t\t\ttoken_type: grant.tokenType ?? null,\n\t\t\t\tupdated_at: new Date(grant.updatedAt)\n\t\t\t})\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: {\n\t\t\t\t\taccess_token_ciphertext:\n\t\t\t\t\t\tgrant.accessTokenCiphertext ?? null,\n\t\t\t\t\tauth_provider_key: grant.authProviderKey,\n\t\t\t\t\texpires_at: toTimestamp(grant.expiresAt),\n\t\t\t\t\tgranted_scopes: grant.grantedScopes,\n\t\t\t\t\tlast_refresh_error: grant.lastRefreshError ?? null,\n\t\t\t\t\tlast_refreshed_at: toTimestamp(grant.lastRefreshedAt),\n\t\t\t\t\tmetadata: grant.metadata ?? {},\n\t\t\t\t\towner_ref: grant.ownerRef,\n\t\t\t\t\tprovider_family: grant.providerFamily,\n\t\t\t\t\tprovider_subject: grant.providerSubject,\n\t\t\t\t\trefresh_token_ciphertext: drizzleSql`coalesce(excluded.refresh_token_ciphertext, ${linkedProviderGrantsTable.refresh_token_ciphertext})`,\n\t\t\t\t\tstatus: grant.status,\n\t\t\t\t\ttoken_type: grant.tokenType ?? null,\n\t\t\t\t\tupdated_at: new Date(grant.updatedAt)\n\t\t\t\t},\n\t\t\t\ttarget: linkedProviderGrantsTable.id\n\t\t\t});\n\t}\n});\nexport const createNeonLinkedProviderStores = (databaseUrl: string) => {\n\tconst sql = neon(databaseUrl);\n\tconst db = drizzle({ client: sql });\n\n\treturn {\n\t\tbindingStore: createLinkedProviderBindingStore(db),\n\t\tdb,\n\t\tgrantStore: createLinkedProviderGrantStore(db)\n\t};\n};\n\nexport type CreateNeonOAuthLinkedProviderCredentialResolverOptions = {\n\tdatabaseUrl: string;\n\tprovidersConfiguration: OAuth2ConfigurationOptions;\n\tnow?: () => number;\n};\n\nexport const createNeonOAuthLinkedProviderCredentialResolver = async ({\n\tdatabaseUrl,\n\tnow,\n\tprovidersConfiguration\n}: CreateNeonOAuthLinkedProviderCredentialResolverOptions) => {\n\tconst stores = createNeonLinkedProviderStores(databaseUrl);\n\n\treturn createOAuthLinkedProviderCredentialResolver({\n\t\t...stores,\n\t\tnow,\n\t\tprovidersConfiguration\n\t});\n};\n",
20
20
  "// @bun\n// src/constants.ts\nvar BASE64_BLOCK_SIZE = 4;\nvar NUM_GENERATOR_BYTES = 32;\n\n// src/graphqlQueries.ts\nvar anilistProfileQuery = `query {\n Viewer {\n id\n name\n about\n avatar {\n large\n medium\n }\n bannerImage\n siteUrl\n createdAt\n updatedAt\n donatorTier\n donatorBadge\n unreadNotificationCount\n options {\n titleLanguage\n displayAdultContent\n airingNotifications\n profileColor\n activityMergeTime\n staffNameLanguage\n }\n mediaListOptions {\n scoreFormat\n rowOrder\n animeList {\n sectionOrder\n customLists\n advancedScoringEnabled\n }\n mangaList {\n sectionOrder\n customLists\n advancedScoringEnabled\n }\n }\n statistics {\n anime {\n count\n meanScore\n minutesWatched\n episodesWatched\n }\n manga {\n count\n meanScore\n chaptersRead\n volumesRead\n }\n }\n favourites {\n anime {\n nodes {\n id\n title {\n romaji\n english\n }\n siteUrl\n }\n }\n manga {\n nodes {\n id\n title {\n romaji\n english\n }\n siteUrl\n }\n }\n characters {\n nodes {\n id\n name {\n full\n }\n image {\n large\n }\n }\n }\n staff {\n nodes {\n id\n name {\n full\n }\n image {\n large\n }\n }\n }\n studios {\n nodes {\n id\n name\n siteUrl\n }\n }\n }\n isFollower\n isFollowing\n }\n}`;\n\n// src/providers.ts\nvar defineProviders = (providers) => providers;\nvar providers = defineProviders({\n \"42\": {\n authorizationUrl: \"https://api.intra.42.fr/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.intra.42.fr/v2/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.intra.42.fr/oauth/token\"\n }\n },\n absolutejs: {\n authorizationUrl: (config) => `https://${config.baseURL ?? \"absolutejs.ai\"}/oauth2/authorize`,\n email: [\"email\"],\n fullName: [\"name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.baseURL ?? \"absolutejs.ai\"}/oauth2/userinfo`\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n tokenParamName: \"token\",\n url: (config) => `https://${config.baseURL ?? \"absolutejs.ai\"}/oauth2/revoke`\n },\n scopeRequired: false,\n subject: [\"sub\"],\n subjectBySource: {\n idToken: [\"sub\"],\n profile: [\"sub\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.baseURL ?? \"absolutejs.ai\"}/oauth2/token`\n }\n },\n amazoncognito: {\n authorizationUrl: \"https://${domain}/oauth2/authorize\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.domain}/oauth2/userInfo`\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `https://${config.domain}/oauth2/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.domain}/oauth2/token`\n }\n },\n anilist: {\n authorizationUrl: \"https://anilist.co/api/v2/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n body: {\n query: anilistProfileQuery\n },\n encoding: \"application/json\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\"\n },\n method: \"POST\",\n url: \"https://graphql.anilist.co\"\n },\n scopeRequired: false,\n subject: [\"data\", \"Viewer\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://anilist.co/api/v2/oauth/token\"\n }\n },\n apple: {\n authorizationUrl: \"https://appleid.apple.com/auth/authorize\",\n createAuthorizationURLSearchParams: {\n response_mode: \"form_post\"\n },\n createClientSecret: (config) => createAppleClientSecret(config),\n isOIDC: true,\n isRefreshable: true,\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n tokenParamName: \"token\",\n url: \"https://appleid.apple.com/auth/revoke\"\n },\n scopeRequired: false,\n subject: [\"sub\"],\n subjectBySource: {\n idToken: [\"sub\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://appleid.apple.com/auth/token\"\n }\n },\n atlassian: {\n authorizationUrl: \"https://auth.atlassian.com/authorize\",\n createAuthorizationURLSearchParams: {\n audience: \"api.atlassian.com\"\n },\n email: [\"email\"],\n fullName: [\"name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"picture\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.atlassian.com/me\"\n },\n scopeRequired: true,\n subject: [\"account_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://auth.atlassian.com/oauth/token\"\n }\n },\n attio: {\n authorizationUrl: \"https://app.attio.com/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.attio.com/v2/self\"\n },\n scopeRequired: true,\n subject: [\"workspace_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://app.attio.com/oauth/token\"\n }\n },\n auth0: {\n authorizationUrl: (config) => `https://${config.domain}/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.domain}/userinfo`\n },\n revocationRequest: {\n authIn: \"body\",\n body: new URLSearchParams({\n token_type_hint: \"refresh_token\"\n }),\n encoding: \"application/json\",\n inputSource: \"refreshToken\",\n tokenParamName: \"token\",\n url: (config) => `https://${config.domain}/oauth/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.domain}/oauth/token`\n }\n },\n authentik: {\n authorizationUrl: (config) => `https://${config.baseURL}/oauth/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.baseURL}/api/v3/user/`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.baseURL}/oauth/token`\n }\n },\n autodesk: {\n authorizationUrl: \"https://developer.api.autodesk.com/authentication/v2/authorize\",\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.userprofile.autodesk.com/userinfo\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://developer.api.autodesk.com/authentication/v2/token\"\n }\n },\n azureadb2c: {\n authorizationUrl: (config) => `https://${config.tenantSubdomain}.b2clogin.com/${config.tenantSubdomain}.onmicrosoft.com/${config.policy}/oauth2/v2.0/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n scopeRequired: false,\n subject: [\"sub\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.tenantSubdomain}.b2clogin.com/${config.tenantSubdomain}.onmicrosoft.com/${config.policy}/oauth2/v2.0/token`\n }\n },\n battlenet: {\n authorizationUrl: \"https://oauth.battle.net/authorize\",\n isOIDC: true,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://oauth.battle.net/userinfo\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.battle.net/token\"\n }\n },\n bitbucket: {\n authorizationUrl: \"https://bitbucket.org/site/oauth2/authorize\",\n fullName: [\"display_name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"links\", \"avatar\", \"href\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.bitbucket.org/2.0/user\"\n },\n scopeRequired: false,\n subject: [\"uuid\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://bitbucket.org/site/oauth2/access_token\"\n }\n },\n box: {\n authorizationUrl: \"https://account.box.com/api/oauth2/authorize\",\n email: [\"login\"],\n fullName: [\"name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"avatar_url\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.box.com/2.0/users/me\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://api.box.com/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.box.com/oauth2/token\"\n }\n },\n bungie: {\n authorizationUrl: \"https://www.bungie.net/en/OAuth/Authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n headers: {\n \"X-API-Key\": \"<YOUR_API_KEY>\"\n },\n method: \"GET\",\n url: \"https://www.bungie.net/Platform/User/GetCurrentBungieNetUser\"\n },\n scopeRequired: false,\n subject: [\"Response\", \"membershipId\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.bungie.net/Platform/App/OAuth/token\"\n }\n },\n calendly: {\n authorizationUrl: \"https://auth.calendly.com/oauth/authorize\",\n email: [\"resource\", \"email\"],\n fullName: [\"resource\", \"name\"],\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.calendly.com/users/me\"\n },\n scopeRequired: false,\n subject: [\"resource\", \"uri\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://auth.calendly.com/oauth/token\"\n }\n },\n close: {\n authorizationUrl: \"https://app.close.com/oauth2/authorize/\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.close.com/api/v1/me/\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.close.com/oauth2/token/\"\n }\n },\n coinbase: {\n authorizationUrl: \"https://www.coinbase.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.coinbase.com/v2/user\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.coinbase.com/oauth/token\"\n }\n },\n discord: {\n authorizationUrl: \"https://discord.com/api/oauth2/authorize\",\n email: [\"email\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"avatar\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://discord.com/api/users/@me\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://discord.com/api/oauth2/token\"\n }\n },\n donationalerts: {\n authorizationUrl: \"https://www.donationalerts.com/oauth/authorize\",\n email: [\"data\", \"email\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"data\", \"avatar\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.donationalerts.com/api/v1/user/oauth\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.donationalerts.com/oauth/token\"\n }\n },\n dribbble: {\n authorizationUrl: \"https://dribbble.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.dribbble.com/v2/user\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://dribbble.com/oauth/token\"\n }\n },\n dropbox: {\n authorizationUrl: \"https://www.dropbox.com/oauth2/authorize\",\n email: [\"email\"],\n familyName: [\"name\", \"surname\"],\n fullName: [\"name\", \"display_name\"],\n givenName: [\"name\", \"given_name\"],\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"POST\",\n url: \"https://api.dropboxapi.com/2/users/get_current_account\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.dropboxapi.com/2/auth/token/revoke\"\n },\n scopeRequired: false,\n subject: [\"account_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.dropboxapi.com/oauth2/token\"\n }\n },\n epicgames: {\n authorizationUrl: \"https://www.epicgames.com/id/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.epicgames.dev/epic/oauth/v2/userInfo\"\n },\n scopeRequired: false,\n subject: [\"account_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.epicgames.dev/epic/oauth/v1/token\"\n }\n },\n etsy: {\n authorizationUrl: \"https://www.etsy.com/oauth/connect\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://openapi.etsy.com/v3/application/users/me\"\n },\n scopeRequired: false,\n subject: [\"results\", \"0\", \"user_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.etsy.com/v3/public/oauth/token\"\n }\n },\n facebook: {\n authorizationUrl: \"https://www.facebook.com/v16.0/dialog/oauth\",\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: false,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n method: \"GET\",\n searchParams: [[\"fields\", \"id,name,email,picture\"]],\n url: \"https://graph.facebook.com/me\"\n },\n scopeRequired: false,\n subject: [\"sub\"],\n subjectBySource: {\n idToken: [\"sub\"],\n profile: [\"id\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://graph.facebook.com/v16.0/oauth/access_token\"\n }\n },\n figma: {\n authorizationUrl: \"https://www.figma.com/oauth\",\n email: [\"email\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"img_url\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.figma.com/v1/me\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.figma.com/v1/oauth/token\"\n }\n },\n gitea: {\n authorizationUrl: (config) => `${config.baseURL}/login/oauth/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `${config.baseURL}/api/v1/user`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.baseURL}/login/oauth/access_token`\n }\n },\n github: {\n authorizationUrl: \"https://github.com/login/oauth/authorize\",\n email: [\"email\"],\n isOIDC: false,\n isRefreshable: false,\n picture: [\"avatar_url\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.github.com/user\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://github.com/login/oauth/access_token\"\n }\n },\n gitlab: {\n authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,\n email: [\"email\"],\n fullName: [\"name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://gitlab.com/api/v4/user\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `${config.baseURL}/oauth/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.baseURL}/oauth/token`\n }\n },\n gohighlevel: {\n authorizationUrl: \"https://marketplace.gohighlevel.com/v2/oauth/chooselocation\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n headers: {\n Version: \"2021-07-28\"\n },\n method: \"GET\",\n url: \"https://services.leadconnectorhq.com/users/me\"\n },\n scopeRequired: true,\n subject: [\"locationId\"],\n subjectBySource: {\n tokenResponse: [\"locationId\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://services.leadconnectorhq.com/oauth/token\"\n }\n },\n google: {\n authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://openidconnect.googleapis.com/v1/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://oauth2.googleapis.com/revoke\"\n },\n scopeRequired: true,\n subject: [\"sub\"],\n subjectBySource: {\n idToken: [\"sub\"],\n profile: [\"sub\"]\n },\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth2.googleapis.com/token\"\n }\n },\n hubspot: {\n authorizationUrl: \"https://app.hubspot.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"path\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.hubapi.com/oauth/v1/access-tokens\"\n },\n scopeRequired: true,\n subject: [\"hub_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.hubapi.com/oauth/v1/token\"\n }\n },\n intuit: {\n authorizationUrl: \"https://appcenter.intuit.com/connect/oauth2\",\n isOIDC: true,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => config.environment === \"production\" ? \"https://accounts.platform.intuit.com/v1/openid_connect/userinfo\" : \"https://sandbox-accounts.platform.intuit.com/v1/openid_connect/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n headers: (config) => ({\n Authorization: `Basic ${encodeBase64(`${config.clientId}:${config.clientSecret}`)}`\n }),\n tokenParamName: \"token\",\n url: \"https://developer.api.intuit.com/v2/oauth2/tokens/revoke\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer\"\n }\n },\n kakao: {\n authorizationUrl: \"https://kauth.kakao.com/oauth/authorize\",\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://kapi.kakao.com/v2/user/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://kauth.kakao.com/oauth/token\"\n }\n },\n keycloak: {\n authorizationUrl: (config) => `${config.realmURL}/protocol/openid-connect/auth`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.kick.com/v1/user\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `${config.realmURL}/protocol/openid-connect/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.realmURL}/protocol/openid-connect/token`\n }\n },\n kick: {\n authorizationUrl: \"https://id.kick.com/oauth/authorize\",\n email: [\"data\", \"email\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"data\", \"profile_picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.kick.com/public/v1/users\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://id.kick.com/oauth/revoke\"\n },\n scopeRequired: true,\n subject: [\"data\", \"user_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://id.kick.com/oauth/token\"\n }\n },\n lichess: {\n authorizationUrl: \"https://lichess.org/oauth/authorize\",\n isOIDC: false,\n isRefreshable: false,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://lichess.org/api/account\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://lichess.org/api/token\"\n }\n },\n line: {\n authorizationUrl: \"https://access.line.me/oauth2/v2.1/authorize\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.line.me/v2/profile\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.line.me/oauth2/v2.1/token\"\n }\n },\n linear: {\n authorizationUrl: \"https://linear.app/oauth/authorize\",\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n body: {\n query: `query { viewer { id name } }`\n },\n encoding: \"application/json\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\"\n },\n method: \"POST\",\n url: \"https://api.linear.app/graphql\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.linear.app/oauth/revoke\"\n },\n scopeRequired: false,\n subject: [\"data\", \"viewer\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.linear.app/oauth/token\"\n }\n },\n linkedin: {\n authorizationUrl: \"https://www.linkedin.com/oauth/v2/authorization\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.linkedin.com/v2/me\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.linkedin.com/oauth/v2/accessToken\"\n }\n },\n mastodon: {\n authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,\n isOIDC: false,\n isRefreshable: false,\n picture: [\"avatar\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `${config.baseURL}/api/v1/accounts/verify_credentials`\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `${config.baseURL}/oauth/revoke`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.baseURL}/oauth/token`\n }\n },\n mercadolibre: {\n authorizationUrl: \"https://auth.mercadolibre.com/authorization\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.mercadolibre.com/users/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.mercadolibre.com/oauth/token\"\n }\n },\n mercadopago: {\n authorizationUrl: \"https://auth.mercadopago.com/authorization\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.mercadopago.com/v1/users/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.mercadopago.com/oauth/token\"\n }\n },\n microsoftentraexternalid: {\n authorizationUrl: (config) => `https://${config.tenantSubdomain}.ciamlogin.com/${config.tenantId}/oauth2/v2.0/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n scopeRequired: false,\n subject: [\"sub\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.tenantSubdomain}.ciamlogin.com/${config.tenantId}/oauth2/v2.0/token`\n }\n },\n microsoftentraid: {\n authorizationUrl: (config) => `https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://graph.microsoft.com/oidc/userinfo\"\n },\n scopeRequired: false,\n subject: [\"sub\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/token`\n }\n },\n monday: {\n authorizationUrl: \"https://auth.monday.com/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n body: {\n query: \"query { me { id name email } }\"\n },\n encoding: \"application/json\",\n headers: {\n \"Content-Type\": \"application/json\"\n },\n method: \"POST\",\n url: \"https://api.monday.com/v2\"\n },\n scopeRequired: true,\n subject: [\"data\", \"me\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://auth.monday.com/oauth2/token\"\n }\n },\n myanimelist: {\n authorizationUrl: \"https://myanimelist.net/v1/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"plain\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.myanimelist.net/v2/users/@me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://myanimelist.net/v1/oauth2/token\"\n }\n },\n naver: {\n authorizationUrl: \"https://nid.naver.com/oauth2.0/authorize\",\n email: [\"response\", \"email\"],\n fullName: [\"response\", \"name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"response\", \"profile_image\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://openapi.naver.com/v1/nid/me\"\n },\n scopeRequired: false,\n subject: [\"response\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://nid.naver.com/oauth2.0/token\"\n }\n },\n notion: {\n authorizationUrl: \"https://api.notion.com/v1/oauth/authorize\",\n email: [\"bot\", \"owner\", \"user\", \"person\", \"email\"],\n isOIDC: false,\n isRefreshable: false,\n picture: [\"bot\", \"owner\", \"user\", \"avatar_url\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n headers: {\n \"Notion-Version\": \"2022-06-28\"\n },\n method: \"GET\",\n url: \"https://api.notion.com/v1/users/me\"\n },\n scopeRequired: false,\n subject: [\"bot\", \"owner\", \"user\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.notion.com/v1/oauth/token\"\n }\n },\n okta: {\n authorizationUrl: (config) => `https://${config.domain}/oauth2/default/v1/authorize`,\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://${config.domain}/oauth2/default/v1/userinfo`\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: (config) => `https://${config.domain}/oauth2/default/v1/revoke`\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.domain}/oauth2/default/v1/token`\n }\n },\n onspark: {\n authorizationUrl: \"https://onspark.com/oauth2/authorize\",\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://onspark.com/oauth2/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n tokenParamName: \"token\",\n url: \"https://onspark.com/oauth2/revoke\"\n },\n scopeRequired: true,\n subject: [\"sub\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://onspark.com/oauth2/token\"\n }\n },\n osu: {\n authorizationUrl: \"https://osu.ppy.sh/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n picture: [\"avatar_url\"],\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://osu.ppy.sh/api/v2/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://osu.ppy.sh/oauth/token\"\n }\n },\n patreon: {\n authorizationUrl: \"https://www.patreon.com/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.patreon.com/api/oauth2/v2/identity\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.patreon.com/api/oauth2/token\"\n }\n },\n pipedrive: {\n authorizationUrl: \"https://oauth.pipedrive.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.pipedrive.com/v1/users/me\"\n },\n scopeRequired: true,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.pipedrive.com/oauth/token\"\n }\n },\n polar: {\n authorizationUrl: \"https://polar.sh/oauth2/authorize\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.polar.sh/v1/oauth2/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://api.polar.sh/v1/oauth2/revoke\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.polar.sh/v1/oauth2/token\"\n }\n },\n polaraccesslink: {\n authorizationUrl: \"https://flow.polar.com/oauth2/authorization\",\n isOIDC: false,\n isRefreshable: false,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.polaraccesslink.com/v3/users/me\"\n },\n scopeRequired: false,\n subject: [\"x_user_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"header\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://polarremote.com/v2/oauth2/token\"\n }\n },\n polarteampro: {\n authorizationUrl: \"https://auth.polar.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.polaraccesslink.com/v3/users/<USER_ID>\"\n },\n scopeRequired: false,\n subject: [\"x_user_id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"header\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://auth.polar.com/oauth/token\"\n }\n },\n reddit: {\n authorizationUrl: \"https://www.reddit.com/api/v1/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://oauth.reddit.com/api/v1/me\"\n },\n revocationRequest: {\n authIn: \"header\",\n body: new URLSearchParams({\n token_type_hint: \"refresh_token\"\n }),\n encoding: \"application/json\",\n inputSource: \"refreshToken\",\n url: \"https://www.reddit.com/api/v1/revoke_token\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"header\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.reddit.com/api/v1/access_token\"\n }\n },\n roblox: {\n authorizationUrl: \"https://apis.roblox.com/oauth/v1/authorize\",\n isOIDC: true,\n isRefreshable: true,\n picture: [\"picture\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://apis.roblox.com/oauth/v1/userinfo\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://apis.roblox.com/oauth/v1/token\"\n }\n },\n salesforce: {\n authorizationUrl: \"https://login.salesforce.com/services/oauth2/authorize\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://login.salesforce.com/services/oauth2/userinfo\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://login.salesforce.com/services/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://login.salesforce.com/services/oauth2/token\"\n }\n },\n shikimori: {\n authorizationUrl: \"https://shikimori.org/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://shikimori.one/api/users/whoami\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://shikimori.org/oauth/token\"\n }\n },\n slack: {\n authorizationUrl: \"https://slack.com/openid/connect/authorize\",\n isOIDC: true,\n isRefreshable: true,\n profileRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://slack.com/api/users.identity\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://slack.com/api/auth.revoke\"\n },\n scopeRequired: true,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://slack.com/api/openid.connect.token\"\n }\n },\n slackuser: {\n accessTokenPath: [\"authed_user\", \"access_token\"],\n authorizationUrl: \"https://slack.com/oauth/v2/authorize\",\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"POST\",\n url: \"https://slack.com/api/auth.test\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://slack.com/api/auth.revoke\"\n },\n scopeParamName: \"user_scope\",\n scopeRequired: true,\n subject: [\"user_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://slack.com/api/oauth.v2.access\"\n }\n },\n spotify: {\n authorizationUrl: \"https://accounts.spotify.com/authorize\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.spotify.com/v1/me\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://accounts.spotify.com/api/token\"\n }\n },\n startgg: {\n authorizationUrl: \"https://start.gg/oauth/authorize\",\n email: [\"data\", \"currentUser\", \"email\"],\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n body: {\n query: `query { currentUser { id slug email player { gamerTag } } }`\n },\n encoding: \"application/json\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\"\n },\n method: \"POST\",\n url: \"https://api.start.gg/gql/alpha\"\n },\n scopeRequired: false,\n subject: [\"data\", \"currentUser\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.start.gg/oauth/access_token\"\n }\n },\n strava: {\n authorizationUrl: \"https://www.strava.com/oauth/authorize\",\n familyName: [\"lastname\"],\n givenName: [\"firstname\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"profile\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://www.strava.com/api/v3/athlete\"\n },\n revocationRequest: {\n authIn: \"query\",\n body: new URLSearchParams({\n token_type_hint: \"access_token\"\n }),\n encoding: \"application/json\",\n tokenParamName: \"access_token\",\n url: \"https://www.strava.com/oauth/deauthorize\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://www.strava.com/oauth/token\"\n }\n },\n synology: {\n authorizationUrl: (config) => `${config.baseURL}/webman/sso/SSOOauth.cgi?client_id=${config.clientId}&response_type=code&redirect_uri=${config.redirectUri}`,\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `${config.baseURL}/webman/sso/SSOUserInfo.cgi?client_id=${config.clientId}&access_token=${config.accessToken}`\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `${config.baseURL}/webman/sso/SSOAccessToken.cgi?client_id=${config.clientId}&client_secret=${config.clientSecret}`\n }\n },\n tiktok: {\n authorizationUrl: \"https://www.tiktok.com/v2/auth/authorize\",\n createAuthorizationURLSearchParams: (config) => ({\n client_key: config.clientId\n }),\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://open.douyin.com/oauth/userinfo\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"token\",\n url: \"https://open.tiktokapis.com/v2/oauth/revoke/\"\n },\n scopeRequired: false,\n subject: [\"data\", \"open_id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://open.tiktokapis.com/v2/oauth/token/\"\n }\n },\n tiltify: {\n authorizationUrl: \"https://v5api.tiltify.com/oauth/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://v5api.tiltify.com/api/public/current-user\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://v5api.tiltify.com/oauth/token\"\n }\n },\n tumblr: {\n authorizationUrl: \"https://www.tumblr.com/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.tumblr.com/v2/user/info\"\n },\n scopeRequired: false,\n subject: [\"response\", \"user\", \"name\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.tumblr.com/v2/oauth2/token\"\n }\n },\n twitch: {\n authorizationUrl: \"https://id.twitch.tv/oauth2/authorize\",\n isOIDC: true,\n isRefreshable: true,\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n headers: (config) => ({\n \"Client-Id\": config.clientId\n }),\n method: \"GET\",\n url: \"https://api.twitch.tv/helix/users\"\n },\n revocationRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n headers: (config) => ({\n \"Client-Id\": config.clientId\n }),\n tokenParamName: \"token\",\n url: \"https://id.twitch.tv/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://id.twitch.tv/oauth2/token\"\n }\n },\n twitter: {\n authorizationUrl: \"https://twitter.com/i/oauth2/authorize\",\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.twitter.com/2/users/me\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.twitter.com/2/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"data\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.twitter.com/2/oauth2/token\"\n }\n },\n vk: {\n authorizationUrl: \"https://oauth.vk.com/authorize\",\n isOIDC: false,\n isRefreshable: false,\n profileRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.vk.com/method/users.get\"\n },\n scopeRequired: false,\n subject: [\"response\", \"0\", \"id\"],\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.vk.com/access_token\"\n }\n },\n withings: {\n accessTokenPath: [\"body\", \"access_token\"],\n authorizationUrl: \"https://account.withings.com/oauth2_user/authorize2\",\n isOIDC: false,\n isRefreshable: true,\n refreshAccessTokenBody: {\n action: \"requesttoken\"\n },\n revocationRequest: {\n authIn: \"body\",\n body: (config) => getWithingsSignatureParams(config, \"revoke\"),\n encoding: \"application/x-www-form-urlencoded\",\n includeClientCredentials: false,\n inputSource: \"subject\",\n inputType: \"number\",\n tokenParamName: \"userid\",\n url: \"https://wbsapi.withings.net/v2/oauth2\",\n validateResponse: (value) => assertWithingsSuccess(value)\n },\n scopeDelimiter: \",\",\n scopeRequired: true,\n subject: [\"userid\"],\n subjectBySource: {\n tokenResponse: [\"body\", \"userid\"]\n },\n subjectType: \"number\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://wbsapi.withings.net/v2/oauth2\"\n },\n validateAuthorizationCodeBody: {\n action: \"requesttoken\"\n }\n },\n workos: {\n authorizationUrl: (config) => `https://${config.domain}/oauth2/authorize`,\n createAuthorizationURLSearchParams: () => {\n const nonce = crypto.randomUUID();\n return {\n nonce\n };\n },\n email: [\"email\"],\n familyName: [\"family_name\"],\n fullName: [\"name\"],\n givenName: [\"given_name\"],\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"POST\",\n url: (config) => `https://${config.domain}/oauth2/userinfo`\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://${config.domain}/oauth2/token`\n }\n },\n yahoo: {\n authorizationUrl: \"https://api.login.yahoo.com/oauth2/request_auth\",\n isOIDC: true,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.login.yahoo.com/openid/v1/userinfo\"\n },\n revocationRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n url: \"https://api.login.yahoo.com/oauth2/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://api.login.yahoo.com/oauth2/get_token\"\n }\n },\n yandex: {\n authorizationUrl: \"https://oauth.yandex.com/authorize\",\n createAuthorizationURLSearchParams: {\n device_id: crypto.randomUUID(),\n device_name: `${navigator.platform ?? \"Unknown\"} \\u2014 ${(navigator.userAgent.split(\")\")[0] || \"\").split(\"(\").pop() || \"Unknown\"}`\n },\n email: [\"default_email\"],\n familyName: [\"last_name\"],\n fullName: [\"real_name\"],\n givenName: [\"first_name\"],\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://login.yandex.ru/info\"\n },\n revocationRequest: {\n authIn: \"body\",\n encoding: \"application/json\",\n tokenParamName: \"access_token\",\n url: \"https://oauth.yandex.com/revoke_token\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://oauth.yandex.com/token\"\n }\n },\n zoho: {\n authorizationUrl: (config) => `https://accounts.zoho.${config.region ?? \"com\"}/oauth/v2/auth`,\n isOIDC: false,\n isRefreshable: true,\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: (config) => `https://accounts.zoho.${config.region ?? \"com\"}/oauth/user/info`\n },\n revocationRequest: {\n authIn: \"query\",\n encoding: \"application/x-www-form-urlencoded\",\n tokenParamName: \"token\",\n url: (config) => `https://accounts.zoho.${config.region ?? \"com\"}/oauth/v2/token/revoke`\n },\n scopeRequired: true,\n subject: [\"ZUID\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: (config) => `https://accounts.zoho.${config.region ?? \"com\"}/oauth/v2/token`\n }\n },\n zoom: {\n authorizationUrl: \"https://zoom.us/oauth/authorize\",\n email: [\"email\"],\n familyName: [\"last_name\"],\n givenName: [\"first_name\"],\n isOIDC: false,\n isRefreshable: true,\n picture: [\"pic_url\"],\n PKCEMethod: \"S256\",\n profileRequest: {\n authIn: \"header\",\n encoding: \"application/json\",\n method: \"GET\",\n url: \"https://api.zoom.us/v2/users/me\"\n },\n revocationRequest: {\n authIn: \"query\",\n encoding: \"application/json\",\n headers: (config) => ({\n Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`\n }),\n tokenParamName: \"token\",\n url: \"https://zoom.us/oauth/revoke\"\n },\n scopeRequired: false,\n subject: [\"id\"],\n subjectType: \"string\",\n tokenRequest: {\n authIn: \"body\",\n encoding: \"application/x-www-form-urlencoded\",\n url: \"https://zoom.us/oauth/token\"\n }\n }\n});\nfunction defineProvider(config) {\n return config === undefined ? (providerConfig) => providerConfig : config;\n}\n\n// src/typeGuards.ts\nvar hasClientSecret = (credentials) => {\n if (typeof credentials !== \"object\" || credentials === null)\n return false;\n const secret = Reflect.get(credentials, \"clientSecret\");\n return typeof secret === \"string\";\n};\nvar isExpectedType = (value, kind) => {\n switch (kind) {\n case \"string\":\n return typeof value === \"string\";\n case \"number\":\n return typeof value === \"number\";\n case \"boolean\":\n return typeof value === \"boolean\";\n case \"object\":\n return typeof value === \"object\" && value !== null;\n default:\n return false;\n }\n};\nvar isObject = (value) => value !== null && typeof value === \"object\" && !Array.isArray(value) && Object.prototype.toString.call(value) === \"[object Object]\";\nvar isOIDCProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.isOIDC;\n};\nvar isPKCEProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.PKCEMethod !== undefined;\n};\nfunction isProfileOAuth2Client(providerOrClient, maybeClient) {\n const client = maybeClient ?? providerOrClient;\n if (maybeClient !== undefined && (typeof providerOrClient !== \"string\" || !isProfileProviderOption(providerOrClient))) {\n return false;\n }\n return typeof client === \"object\" && client !== null && \"fetchUserProfile\" in client && typeof client.fetchUserProfile === \"function\";\n}\nvar isProfileProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.profileRequest !== undefined;\n};\nfunction isRefreshableOAuth2Client(providerOrClient, maybeClient) {\n const client = maybeClient ?? providerOrClient;\n if (maybeClient !== undefined && (typeof providerOrClient !== \"string\" || !isRefreshableProviderOption(providerOrClient))) {\n return false;\n }\n return typeof client === \"object\" && client !== null && \"refreshAccessToken\" in client && typeof client.refreshAccessToken === \"function\";\n}\nvar isRefreshableProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.isRefreshable;\n};\nfunction isRevocableOAuth2Client(providerOrClient, maybeClient) {\n const client = maybeClient ?? providerOrClient;\n if (maybeClient !== undefined && (typeof providerOrClient !== \"string\" || !isRevocableProviderOption(providerOrClient))) {\n return false;\n }\n return typeof client === \"object\" && client !== null && \"resolveRevocationInput\" in client && typeof client.resolveRevocationInput === \"function\" && \"revokeToken\" in client && typeof client.revokeToken === \"function\";\n}\nvar isRevocableProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.revocationRequest !== undefined;\n};\nvar isScopeRequiredProviderOption = (option) => {\n if (!isValidProviderOption(option))\n return false;\n const provider = providers[option];\n return provider.scopeRequired;\n};\nvar isValidProviderOption = (option) => Object.hasOwn(providers, option);\n\n// src/utils.ts\nvar readPath = (value, path) => path.reduce((cursor, key) => cursor && typeof cursor === \"object\" ? Reflect.get(cursor, key) : undefined, value);\nvar assertWithingsSuccess = (value) => {\n if (!isObject(value) || value.status !== 0) {\n const status = isObject(value) ? value.status : \"invalid response\";\n const detail = isObject(value) && typeof value.error === \"string\" ? `: ${value.error}` : \"\";\n throw new Error(`Withings request failed (${String(status)})${detail}`);\n }\n};\nvar createOAuth2FetchError = async (response) => {\n const clone = response.clone();\n const prefix = `HTTP ${response.status} ${response.statusText} for ${response.url}`;\n const payload = await response.json().catch(() => null);\n if (payload && typeof payload === \"object\" && Object.keys(payload).length) {\n return new Error(`${prefix}\n${JSON.stringify(payload)}`);\n }\n const text = await clone.text().catch(() => \"\");\n if (text) {\n return new Error(`${prefix}\n${text}`);\n }\n return new Error(prefix);\n};\nvar createOAuth2Request = ({\n url,\n body,\n authIn,\n headers,\n encoding,\n clientId,\n clientSecret\n}) => {\n const oauthHeaders = new Headers(headers);\n oauthHeaders.set(\"Accept\", \"application/json\");\n oauthHeaders.set(\"User-Agent\", \"citra\");\n if (authIn === \"header\") {\n if (!clientSecret) {\n throw new Error(\"clientSecret required for header auth\");\n }\n oauthHeaders.set(\"Authorization\", `Basic ${encodeBase64(`${clientId}:${clientSecret}`)}`);\n }\n if (body === undefined && authIn !== \"body\") {\n return new Request(url, {\n headers: oauthHeaders,\n method: \"POST\"\n });\n }\n if (encoding === \"application/json\") {\n oauthHeaders.set(\"Content-Type\", \"application/json\");\n const jsonBody = body instanceof URLSearchParams ? Object.fromEntries(body.entries()) : { ...body };\n if (authIn === \"body\")\n jsonBody.client_id = clientId;\n if (authIn === \"body\" && clientSecret)\n jsonBody.client_secret = clientSecret;\n return new Request(url, {\n body: JSON.stringify(jsonBody),\n headers: oauthHeaders,\n method: \"POST\"\n });\n }\n oauthHeaders.set(\"Content-Type\", \"application/x-www-form-urlencoded\");\n const entries = body instanceof URLSearchParams ? Array.from(body.entries()) : Object.entries(body ?? {}).filter((entry) => typeof entry[1] === \"string\");\n const params = new URLSearchParams(entries);\n if (authIn === \"body\") {\n params.set(\"client_id\", clientId);\n clientSecret && params.set(\"client_secret\", clientSecret);\n }\n return new Request(url, {\n body: params.toString(),\n headers: oauthHeaders,\n method: \"POST\"\n });\n};\nvar decodeBase64 = (input, toUint8Array = false) => {\n const b64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"==\".slice(0, (BASE64_BLOCK_SIZE - input.length % BASE64_BLOCK_SIZE) % BASE64_BLOCK_SIZE);\n const raw = atob(b64);\n if (!toUint8Array) {\n return raw;\n }\n const bytes = new Uint8Array(raw.length);\n for (let i = 0;i < raw.length; i++) {\n bytes[i] = raw.charCodeAt(i);\n }\n return bytes;\n};\nvar decodeJWT = (tokenString) => {\n const [headerSegment, payloadSegment, signatureSegment] = tokenString.split(\".\");\n if (!headerSegment || !payloadSegment || !signatureSegment) {\n throw new Error(\"Invalid JWT format\");\n }\n const decodedPayload = decodeBase64(payloadSegment);\n if (typeof decodedPayload !== \"string\") {\n throw new Error(\"Expected JWT payload to be a UTF-8 string\");\n }\n const claims = JSON.parse(decodedPayload);\n return claims;\n};\nvar encodeBase64 = (input) => {\n let raw;\n if (typeof input === \"string\") {\n raw = input;\n } else {\n const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);\n raw = bytes.reduce((acc, byte) => acc + String.fromCharCode(byte), \"\");\n }\n return btoa(raw);\n};\nvar getWithingsSignatureParams = async (config, action) => {\n const timestamp = Math.floor(Date.now() / 1000);\n const nonceSignature = await hmacSha256(`getnonce,${config.clientId},${timestamp}`, config.clientSecret);\n const nonceUrl = new URL(\"https://wbsapi.withings.net/v2/signature\");\n nonceUrl.searchParams.set(\"action\", \"getnonce\");\n nonceUrl.searchParams.set(\"client_id\", config.clientId);\n nonceUrl.searchParams.set(\"timestamp\", timestamp.toString());\n nonceUrl.searchParams.set(\"signature\", nonceSignature);\n const nonceTarget = nonceUrl.toString();\n const nonceResponse = await fetch(nonceTarget, { method: \"POST\" });\n if (!nonceResponse.ok) {\n throw await createOAuth2FetchError(nonceResponse);\n }\n const nonceData = await nonceResponse.json();\n if (!isObject(nonceData) || nonceData.status !== 0 || !isObject(nonceData.body) || typeof nonceData.body.nonce !== \"string\" || nonceData.body.nonce.length === 0) {\n throw new Error(\"Withings returned an invalid nonce response\");\n }\n const { nonce } = nonceData.body;\n const signature = await hmacSha256(`${action},${config.clientId},${nonce}`, config.clientSecret);\n return {\n action,\n client_id: config.clientId,\n nonce,\n signature\n };\n};\nvar hmacSha256 = async (message, secret) => {\n const encoder = new TextEncoder;\n const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), { hash: \"SHA-256\", name: \"HMAC\" }, false, [\"sign\"]);\n const sigBuffer = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message));\n return Array.from(new Uint8Array(sigBuffer)).map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n};\nvar parseOAuth2TokenResponse = (value, accessTokenPath) => {\n if (!isObject(value)) {\n throw new Error(\"OAuth token endpoint returned a non-object response\");\n }\n const oauthError = Reflect.get(value, \"error\");\n if (typeof oauthError === \"string\" && oauthError.length > 0) {\n throw new Error(`OAuth token exchange failed: ${oauthError}`);\n }\n const response = { ...value };\n const nestedToken = accessTokenPath ? readPath(value, accessTokenPath) : undefined;\n if (typeof nestedToken === \"string\" && nestedToken.length > 0) {\n response.access_token = nestedToken;\n }\n if (typeof response.access_token !== \"string\" || response.access_token.length === 0) {\n throw new Error(\"OAuth token endpoint returned no access_token\");\n }\n for (const key of [\"refresh_token\", \"token_type\", \"scope\", \"id_token\"]) {\n const field = response[key];\n if (field !== undefined && typeof field !== \"string\") {\n throw new Error(`OAuth token endpoint returned invalid ${key}: expected string`);\n }\n }\n const expiresIn = response.expires_in;\n if (typeof expiresIn === \"string\" && expiresIn.trim() !== \"\") {\n response.expires_in = Number(expiresIn);\n }\n if (response.expires_in !== undefined && (typeof response.expires_in !== \"number\" || !Number.isFinite(response.expires_in) || response.expires_in < 0)) {\n throw new Error(\"OAuth token endpoint returned invalid expires_in: expected a non-negative number\");\n }\n return response;\n};\nvar readIdentityKey = (value, key) => {\n if (Array.isArray(value)) {\n if (!/^\\d+$/.test(key)) {\n throw new Error(`Invalid identity data shape: expected an array index, got ${key}`);\n }\n return value[Number(key)];\n }\n if (!isObject(value)) {\n throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);\n }\n return value[key];\n};\nvar extractPropFromIdentity = (identity, keys, propType) => {\n let value = identity;\n for (const key of keys) {\n value = readIdentityKey(value, key);\n }\n if (propType !== undefined && !isExpectedType(value, propType)) {\n throw new Error(`Invalid identity data shape: expected ${propType}, got ${typeof value}`);\n }\n return value;\n};\nvar getProviderSubjectKeys = (providerConfiguration, source) => providerConfiguration.subjectBySource?.[source] ?? providerConfiguration.subject;\nvar setPropInIdentity = (identity, keys, value) => {\n if (keys.length === 0) {\n return identity;\n }\n let cursor = identity;\n for (const key of keys.slice(0, -1)) {\n const next = cursor[key];\n cursor[key] = isObject(next) ? next : {};\n cursor = cursor[key];\n }\n cursor[keys[keys.length - 1]] = value;\n return identity;\n};\nvar normalizeProviderIdentity = ({\n identity,\n providerConfiguration,\n source\n}) => {\n const sourceKeys = getProviderSubjectKeys(providerConfiguration, source);\n const canonicalKeys = providerConfiguration.subject;\n if (sourceKeys.join(\".\") === canonicalKeys.join(\".\")) {\n return identity;\n }\n const subject = extractPropFromIdentity(identity, sourceKeys, providerConfiguration.subjectType);\n const normalizedIdentity = structuredClone(identity);\n return setPropInIdentity(normalizedIdentity, canonicalKeys, subject);\n};\n\n// src/arctic-utils.ts\nvar DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME = 180;\nvar HOURS_PER_DAY = 24;\nvar MINUTES_PER_HOUR = 60;\nvar SECONDS_PER_MINUTE = 60;\nvar APPLE_CLIENT_SECRET_LIFETIME_SECONDS = SECONDS_PER_MINUTE * MINUTES_PER_HOUR * HOURS_PER_DAY * DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME;\nvar APPLE_ISSUER = \"https://appleid.apple.com\";\nvar MILLISECONDS_PER_SECOND = 1000;\nvar createS256CodeChallenge = async (codeVerifier) => {\n const data = new TextEncoder().encode(codeVerifier);\n const hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n return base64Url(hashBuffer);\n};\nvar createRandomBase64UrlGenerator = (length) => () => {\n const buffer = crypto.getRandomValues(new Uint8Array(length));\n return base64Url(buffer);\n};\nvar generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);\nvar generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);\nvar base64Url = (input) => encodeBase64(input).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\nvar encodeJwtPart = (value) => base64Url(new TextEncoder().encode(JSON.stringify(value)));\nvar createAppleClientSecret = async (credentials) => {\n const issuedAt = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);\n const header = encodeJwtPart({\n alg: \"ES256\",\n kid: credentials.keyId,\n typ: \"JWT\"\n });\n const payload = encodeJwtPart({\n aud: APPLE_ISSUER,\n exp: issuedAt + APPLE_CLIENT_SECRET_LIFETIME_SECONDS,\n iat: issuedAt,\n iss: credentials.teamId,\n sub: credentials.clientId\n });\n const signingInput = `${header}.${payload}`;\n const privateKey = await crypto.subtle.importKey(\"pkcs8\", Uint8Array.from(credentials.pkcs8PrivateKey), { name: \"ECDSA\", namedCurve: \"P-256\" }, false, [\"sign\"]);\n const signature = await crypto.subtle.sign({ hash: \"SHA-256\", name: \"ECDSA\" }, privateKey, new TextEncoder().encode(signingInput));\n return `${signingInput}.${base64Url(signature)}`;\n};\n// src/oidc.ts\nvar ALG_ES256 = \"ES256\";\nvar ALG_RS256 = \"RS256\";\nvar CLOCK_SKEW_SECONDS = 60;\nvar DEFAULT_SCOPES = [\"openid\", \"email\", \"profile\"];\nvar JWKS_REFETCH_COOLDOWN_MS = 60000;\nvar JWT_SEGMENT_COUNT = 3;\nvar MILLISECONDS_PER_SECOND2 = 1000;\nvar trimTrailingSlash = (value) => value.endsWith(\"/\") ? value.slice(0, -1) : value;\nvar fetchJson = async (url) => {\n const response = await fetch(url, {\n headers: { accept: \"application/json\" }\n });\n if (!response.ok) {\n throw await createOAuth2FetchError(response);\n }\n return response.json();\n};\nvar decodeJsonSegment = (segment) => {\n const decoded = decodeBase64(segment);\n if (typeof decoded !== \"string\") {\n throw new Error(\"Expected a base64url-encoded JWT segment\");\n }\n const parsed = JSON.parse(decoded);\n if (typeof parsed !== \"object\" || parsed === null) {\n throw new Error(\"Expected a JWT segment to decode to a JSON object\");\n }\n return parsed;\n};\nvar importVerificationKey = (jwk, alg) => {\n if (alg === ALG_RS256) {\n return crypto.subtle.importKey(\"jwk\", jwk, { hash: \"SHA-256\", name: \"RSASSA-PKCS1-v1_5\" }, false, [\"verify\"]);\n }\n if (alg === ALG_ES256) {\n return crypto.subtle.importKey(\"jwk\", jwk, { name: \"ECDSA\", namedCurve: \"P-256\" }, false, [\"verify\"]);\n }\n throw new Error(`Unsupported id_token signing algorithm \"${alg}\"`);\n};\nvar verifySignature = (key, alg, signingInput, signature) => {\n const algorithm = alg === ALG_ES256 ? { hash: \"SHA-256\", name: \"ECDSA\" } : { name: \"RSASSA-PKCS1-v1_5\" };\n return crypto.subtle.verify(algorithm, key, new Uint8Array(signature), new TextEncoder().encode(signingInput));\n};\nvar selectKey = (jwks, kid) => jwks.find((jwk) => kid === undefined || jwk.kid === kid);\nvar assertClaims = (payload, expected) => {\n const aud = Reflect.get(payload, \"aud\");\n const azp = Reflect.get(payload, \"azp\");\n const exp = Reflect.get(payload, \"exp\");\n const iat = Reflect.get(payload, \"iat\");\n const iss = Reflect.get(payload, \"iss\");\n const nbf = Reflect.get(payload, \"nbf\");\n const sub = Reflect.get(payload, \"sub\");\n const audiences = Array.isArray(aud) ? aud : [aud];\n const nowSeconds = Math.floor(Date.now() / MILLISECONDS_PER_SECOND2);\n if (iss !== expected.issuer) {\n throw new Error('id_token \"iss\" does not match the provider issuer');\n }\n if (typeof sub !== \"string\" || sub.length === 0) {\n throw new Error('id_token is missing \"sub\"');\n }\n if (!audiences.includes(expected.audience)) {\n throw new Error('id_token \"aud\" does not include the client id');\n }\n if (audiences.some((audience) => typeof audience !== \"string\") || typeof aud !== \"string\" && !Array.isArray(aud)) {\n throw new Error('id_token \"aud\" must be a string or string array');\n }\n if (audiences.length > 1 && (typeof azp !== \"string\" || azp !== expected.audience)) {\n throw new Error('id_token with multiple audiences requires matching \"azp\"');\n }\n if (typeof exp !== \"number\" || exp + CLOCK_SKEW_SECONDS < nowSeconds) {\n throw new Error(\"id_token has expired\");\n }\n if (typeof iat !== \"number\") {\n throw new Error('id_token is missing numeric \"iat\"');\n }\n if (iat > nowSeconds + CLOCK_SKEW_SECONDS) {\n throw new Error('id_token \"iat\" is in the future');\n }\n if (nbf !== undefined && (typeof nbf !== \"number\" || nbf > nowSeconds + CLOCK_SKEW_SECONDS)) {\n throw new Error(\"id_token is not active yet\");\n }\n if (expected.nonce !== undefined && Reflect.get(payload, \"nonce\") !== expected.nonce) {\n throw new Error('id_token \"nonce\" does not match');\n }\n const claims = { ...payload, aud, exp, iss, sub };\n return claims;\n};\nvar verifyIdToken = async ({\n audience,\n idToken,\n issuer,\n jwks,\n nonce\n}) => {\n const segments = idToken.split(\".\");\n const [headerSegment, payloadSegment, signatureSegment] = segments;\n if (segments.length !== JWT_SEGMENT_COUNT || headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {\n throw new Error(\"Invalid id_token: expected three segments\");\n }\n const header = decodeJsonSegment(headerSegment);\n const alg = Reflect.get(header, \"alg\");\n const kid = Reflect.get(header, \"kid\");\n if (typeof alg !== \"string\") {\n throw new Error('id_token header is missing \"alg\"');\n }\n const jwk = selectKey(jwks, typeof kid === \"string\" ? kid : undefined);\n if (jwk === undefined) {\n throw new Error('No JWKS key matches the id_token \"kid\"');\n }\n const key = await importVerificationKey(jwk, alg);\n const signature = decodeBase64(signatureSegment, true);\n if (typeof signature === \"string\") {\n throw new Error(\"Failed to decode the id_token signature\");\n }\n const isValid = await verifySignature(key, alg, `${headerSegment}.${payloadSegment}`, signature);\n if (!isValid) {\n throw new Error(\"id_token signature verification failed\");\n }\n return assertClaims(decodeJsonSegment(payloadSegment), {\n audience,\n issuer,\n nonce\n });\n};\nvar toDiscoveryDocument = (value, expectedIssuer) => {\n if (typeof value !== \"object\" || value === null) {\n throw new Error(\"OIDC discovery document is not a JSON object\");\n }\n const issuer = Reflect.get(value, \"issuer\");\n const authorizationEndpoint = Reflect.get(value, \"authorization_endpoint\");\n const tokenEndpoint = Reflect.get(value, \"token_endpoint\");\n const jwksUri = Reflect.get(value, \"jwks_uri\");\n const userinfoEndpoint = Reflect.get(value, \"userinfo_endpoint\");\n if (typeof issuer !== \"string\" || typeof authorizationEndpoint !== \"string\" || typeof tokenEndpoint !== \"string\" || typeof jwksUri !== \"string\") {\n throw new Error(\"OIDC discovery document is missing required endpoints\");\n }\n if (trimTrailingSlash(issuer) !== trimTrailingSlash(expectedIssuer)) {\n throw new Error(`OIDC discovery issuer \"${issuer}\" does not match configured issuer \"${expectedIssuer}\"`);\n }\n return {\n authorization_endpoint: authorizationEndpoint,\n issuer,\n jwks_uri: jwksUri,\n token_endpoint: tokenEndpoint,\n userinfo_endpoint: typeof userinfoEndpoint === \"string\" ? userinfoEndpoint : undefined\n };\n};\nvar fetchDiscoveryDocument = async (issuer) => {\n const base = trimTrailingSlash(issuer);\n const document = await fetchJson(`${base}/.well-known/openid-configuration`);\n return toDiscoveryDocument(document, issuer);\n};\nvar fetchJwks = async (jwksUri) => {\n const body = await fetchJson(jwksUri);\n const value = Reflect.get(body ?? {}, \"keys\");\n if (!Array.isArray(value)) {\n throw new Error('JWKS response is missing a \"keys\" array');\n }\n const keys = value;\n return keys;\n};\nvar createOIDCClient = async (config) => {\n const discovery = await fetchDiscoveryDocument(config.issuer);\n const scopes = config.scopes !== undefined && config.scopes.length > 0 ? config.scopes : DEFAULT_SCOPES;\n let cachedJwks;\n let jwksFetchedAtMs = 0;\n const resolveJwks = async (forceRefresh) => {\n const isStale = Date.now() - jwksFetchedAtMs > JWKS_REFETCH_COOLDOWN_MS;\n if (cachedJwks === undefined || forceRefresh && isStale) {\n cachedJwks = await fetchJwks(discovery.jwks_uri);\n jwksFetchedAtMs = Date.now();\n }\n return cachedJwks;\n };\n const createAuthorizationUrl = async (options) => {\n const url = new URL(discovery.authorization_endpoint);\n const challenge = await createS256CodeChallenge(options.codeVerifier);\n const { searchParams } = url;\n searchParams.set(\"client_id\", config.clientId);\n searchParams.set(\"code_challenge\", challenge);\n searchParams.set(\"code_challenge_method\", \"S256\");\n searchParams.set(\"redirect_uri\", config.redirectUri);\n searchParams.set(\"response_type\", \"code\");\n searchParams.set(\"scope\", (options.scope ?? scopes).join(\" \"));\n searchParams.set(\"state\", options.state);\n if (options.nonce !== undefined) {\n searchParams.set(\"nonce\", options.nonce);\n }\n return url;\n };\n const validateAuthorizationCode = async (options) => {\n const body = new URLSearchParams;\n body.set(\"client_id\", config.clientId);\n body.set(\"client_secret\", config.clientSecret);\n body.set(\"code\", options.code);\n body.set(\"code_verifier\", options.codeVerifier);\n body.set(\"grant_type\", \"authorization_code\");\n body.set(\"redirect_uri\", config.redirectUri);\n const response = await fetch(discovery.token_endpoint, {\n body,\n headers: {\n accept: \"application/json\",\n \"content-type\": \"application/x-www-form-urlencoded\"\n },\n method: \"POST\"\n });\n if (!response.ok) {\n throw await createOAuth2FetchError(response);\n }\n const tokens = parseOAuth2TokenResponse(await response.json());\n return tokens;\n };\n const verifyToken = async (idToken, options) => {\n const jwks = await resolveJwks(false);\n const params = {\n audience: config.clientId,\n idToken,\n issuer: discovery.issuer,\n nonce: options?.nonce\n };\n try {\n return await verifyIdToken({ ...params, jwks });\n } catch (error) {\n const refreshed = await resolveJwks(true);\n if (refreshed === jwks)\n throw error;\n return verifyIdToken({ ...params, jwks: refreshed });\n }\n };\n const fetchUserProfile = async (accessToken) => {\n if (discovery.userinfo_endpoint === undefined) {\n throw new Error(\"OIDC provider does not expose a userinfo endpoint\");\n }\n const response = await fetch(discovery.userinfo_endpoint, {\n headers: {\n accept: \"application/json\",\n authorization: `Bearer ${accessToken}`\n }\n });\n if (!response.ok) {\n throw new Error(`OIDC userinfo request failed with status ${response.status}`);\n }\n const profile = await response.json();\n return profile;\n };\n return {\n createAuthorizationUrl,\n discovery,\n fetchUserProfile,\n validateAuthorizationCode,\n verifyIdToken: verifyToken\n };\n};\n// src/providerOptions.ts\nvar oidcProviderOptions = Object.keys(providers).filter(isOIDCProviderOption);\nvar pkceProviderOptions = Object.keys(providers).filter(isPKCEProviderOption);\nvar profileProviderOptions = Object.keys(providers).filter(isProfileProviderOption);\nvar providerOptions = Object.keys(providers).filter(isValidProviderOption);\nvar refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProviderOption);\nvar revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);\nvar scopeRequiredProviderOptions = Object.keys(providers).filter(isScopeRequiredProviderOption);\n\n// src/index.ts\nvar buildOAuth2Client = async (meta, config) => {\n const isConfigPropertyFunction = (cfgProp) => typeof cfgProp === \"function\";\n const resolveConfigProp = async (cfgProp) => {\n const result = isConfigPropertyFunction(cfgProp) ? cfgProp(config) : cfgProp;\n return result;\n };\n const resolveClientSecret = async () => {\n if (meta.createClientSecret) {\n return resolveConfigProp(meta.createClientSecret);\n }\n return hasClientSecret(config) ? config.clientSecret : undefined;\n };\n const authorizationUrl = await resolveConfigProp(meta.authorizationUrl);\n const tokenUrl = await resolveConfigProp(meta.tokenRequest.url);\n const client = {\n async createAuthorizationUrl(opts) {\n const { state, scope = [], searchParams = [], codeVerifier } = opts;\n const url = new URL(authorizationUrl);\n url.searchParams.set(\"response_type\", \"code\");\n url.searchParams.set(\"client_id\", config.clientId);\n if (config.redirectUri)\n url.searchParams.set(\"redirect_uri\", config.redirectUri);\n if (state)\n url.searchParams.set(\"state\", state);\n if (scope.length !== 0) {\n url.searchParams.set(meta.scopeParamName ?? \"scope\", scope.join(meta.scopeDelimiter ?? \" \"));\n }\n if (meta.PKCEMethod !== undefined) {\n if (!codeVerifier) {\n throw new Error(\"`codeVerifier` is required when PKCE is enabled\");\n }\n const codeChallenge = meta.PKCEMethod === \"S256\" ? await createS256CodeChallenge(codeVerifier) : codeVerifier;\n url.searchParams.set(\"code_challenge_method\", meta.PKCEMethod);\n url.searchParams.set(\"code_challenge\", codeChallenge);\n }\n Object.entries(await resolveConfigProp(meta.createAuthorizationURLSearchParams) ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));\n searchParams.forEach(([key, value]) => url.searchParams.set(key, value));\n return url;\n },\n async fetchUserProfile(accessToken) {\n const { profileRequest } = meta;\n if (!profileRequest) {\n throw new Error(\"OIDC provider exposes identity through the id_token and does not define a UserInfo endpoint\");\n }\n const {\n url,\n method,\n authIn,\n searchParams,\n body: profileBody,\n headers,\n encoding\n } = profileRequest;\n const endpoint = new URL(await resolveConfigProp(url));\n const resolvedBody = await resolveConfigProp(profileBody);\n new URLSearchParams(await resolveConfigProp(searchParams)).forEach((value, key) => endpoint.searchParams.append(key, value));\n let headerEntries = [];\n const rawHeaders = headers ? await resolveConfigProp(headers) : undefined;\n if (rawHeaders instanceof Headers)\n headerEntries = Array.from(rawHeaders.entries());\n else if (Array.isArray(rawHeaders))\n headerEntries = rawHeaders;\n else if (rawHeaders && typeof rawHeaders === \"object\")\n headerEntries = Object.entries(rawHeaders);\n const profileHeaders = Object.fromEntries(headerEntries.filter(([, value]) => value !== \"\"));\n if (authIn === \"header\") {\n profileHeaders.Authorization = `Bearer ${accessToken}`;\n } else if (authIn === \"path\") {\n endpoint.pathname = `${endpoint.pathname.replace(/\\/+$/, \"\")}/${encodeURIComponent(accessToken)}`;\n } else {\n endpoint.searchParams.append(\"access_token\", accessToken);\n }\n const init = { headers: profileHeaders, method };\n if (method === \"POST\" && resolvedBody !== undefined) {\n profileHeaders[\"Content-Type\"] = encoding;\n init.body = encoding === \"application/json\" ? JSON.stringify(resolvedBody) : new URLSearchParams(resolvedBody).toString();\n }\n const profileTarget = endpoint.toString();\n const response = await fetch(profileTarget, init);\n if (!response.ok)\n throw await createOAuth2FetchError(response);\n return response.json();\n },\n async refreshAccessToken(refreshToken) {\n const { authIn, encoding } = meta.tokenRequest;\n const params = new URLSearchParams(meta.refreshAccessTokenBody);\n params.set(\"grant_type\", \"refresh_token\");\n params.set(\"refresh_token\", refreshToken);\n const { clientId } = config;\n const clientSecretValue = await resolveClientSecret();\n if (clientSecretValue) {\n params.set(\"client_id\", clientId);\n params.set(\"client_secret\", clientSecretValue);\n }\n const request = createOAuth2Request({\n authIn,\n body: params,\n clientId,\n clientSecret: clientSecretValue,\n encoding,\n url: tokenUrl\n });\n const response = await fetch(request);\n if (!response.ok)\n throw await createOAuth2FetchError(response);\n return parseOAuth2TokenResponse(await response.json());\n },\n resolveRevocationInput(context) {\n const { revocationRequest } = meta;\n if (!revocationRequest) {\n throw new Error(\"Token revocation not defined for this provider\");\n }\n const inputSource = revocationRequest.inputSource ?? \"accessToken\";\n const input = context[inputSource];\n if (input === undefined) {\n throw new Error(`Revocation requires ${inputSource}, but it was not provided`);\n }\n const expectsNumber = revocationRequest.authIn !== \"header\" && revocationRequest.inputType === \"number\";\n if (expectsNumber && (typeof input !== \"number\" || !Number.isFinite(input))) {\n throw new TypeError(\"This provider requires a numeric revocation input\");\n }\n if (!expectsNumber && typeof input !== \"string\") {\n throw new TypeError(\"This provider requires a string revocation input\");\n }\n return input;\n },\n async revokeToken(input) {\n const { revocationRequest } = meta;\n if (!revocationRequest) {\n throw new Error(\"Token revocation not defined for this provider\");\n }\n if (revocationRequest.authIn !== \"header\" && revocationRequest.inputType === \"number\" && (typeof input !== \"number\" || !Number.isFinite(input))) {\n throw new TypeError(\"This provider requires a numeric revocation input\");\n }\n const {\n url,\n authIn,\n body,\n encoding,\n headers,\n includeClientCredentials = true,\n tokenParamName,\n validateResponse\n } = revocationRequest;\n const endpoint = await resolveConfigProp(url);\n const resolvedBody = await resolveConfigProp(body);\n const revocationBody = resolvedBody === undefined ? undefined : new URLSearchParams(resolvedBody);\n const revocationHeaders = new Headers(headers && await resolveConfigProp(headers));\n const { clientId } = config;\n const clientSecret = await resolveClientSecret();\n let request;\n if (authIn === \"body\") {\n const bodyWithToken = revocationBody ?? new URLSearchParams;\n bodyWithToken.set(tokenParamName, String(input));\n const hasAuthorizationHeader = revocationHeaders.has(\"Authorization\");\n if (includeClientCredentials && !hasAuthorizationHeader)\n bodyWithToken.set(\"client_id\", clientId);\n if (includeClientCredentials && !hasAuthorizationHeader && clientSecret)\n bodyWithToken.set(\"client_secret\", clientSecret);\n request = createOAuth2Request({\n authIn: hasAuthorizationHeader || !includeClientCredentials ? \"query\" : \"body\",\n body: bodyWithToken,\n clientId,\n clientSecret,\n encoding,\n headers: revocationHeaders,\n url: endpoint.toString()\n });\n } else if (authIn === \"header\") {\n revocationHeaders.set(\"Authorization\", `Bearer ${String(input)}`);\n request = createOAuth2Request({\n authIn: \"query\",\n body: revocationBody,\n clientId,\n encoding,\n headers: revocationHeaders,\n url: endpoint.toString()\n });\n } else {\n const queryEndpoint = new URL(endpoint);\n queryEndpoint.searchParams.set(tokenParamName, String(input));\n request = createOAuth2Request({\n authIn: \"query\",\n body: revocationBody,\n clientId,\n encoding,\n headers: revocationHeaders,\n url: queryEndpoint.toString()\n });\n }\n const response = await fetch(request);\n if (!response.ok)\n throw await createOAuth2FetchError(response);\n if (validateResponse) {\n await validateResponse(await response.json().catch(() => {\n return;\n }));\n }\n },\n async validateAuthorizationCode(opts) {\n const { code, codeVerifier } = opts;\n const { authIn, encoding } = meta.tokenRequest;\n const bodyObj = {};\n for (const key in meta.validateAuthorizationCodeBody ?? {}) {\n const value = meta.validateAuthorizationCodeBody[key];\n if (typeof value === \"string\")\n bodyObj[key] = value;\n }\n bodyObj.grant_type = \"authorization_code\";\n bodyObj.code = code;\n if (config.redirectUri)\n bodyObj.redirect_uri = config.redirectUri;\n if (meta.PKCEMethod !== undefined) {\n if (!codeVerifier) {\n throw new Error(\"codeVerifier required when PKCE is enabled\");\n }\n bodyObj.code_verifier = codeVerifier;\n }\n const payload = encoding === \"application/json\" ? bodyObj : new URLSearchParams(bodyObj);\n const request = createOAuth2Request({\n authIn,\n body: payload,\n clientId: config.clientId,\n clientSecret: await resolveClientSecret(),\n encoding,\n url: tokenUrl\n });\n const response = await fetch(request);\n if (!response.ok)\n throw await createOAuth2FetchError(response);\n return parseOAuth2TokenResponse(await response.json(), meta.accessTokenPath);\n }\n };\n if (!meta.profileRequest) {\n Reflect.deleteProperty(client, \"fetchUserProfile\");\n }\n if (!meta.isRefreshable) {\n Reflect.deleteProperty(client, \"refreshAccessToken\");\n }\n if (!meta.revocationRequest) {\n Reflect.deleteProperty(client, \"resolveRevocationInput\");\n Reflect.deleteProperty(client, \"revokeToken\");\n }\n return client;\n};\nvar createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Client(providerConfig, credentials);\nvar createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);\nexport {\n verifyIdToken,\n scopeRequiredProviderOptions,\n revocableProviderOptions,\n refreshableProviderOptions,\n providers,\n providerOptions,\n profileProviderOptions,\n pkceProviderOptions,\n parseOAuth2TokenResponse,\n oidcProviderOptions,\n normalizeProviderIdentity,\n isValidProviderOption,\n isScopeRequiredProviderOption,\n isRevocableProviderOption,\n isRevocableOAuth2Client,\n isRefreshableProviderOption,\n isRefreshableOAuth2Client,\n isProfileProviderOption,\n isProfileOAuth2Client,\n isPKCEProviderOption,\n isObject,\n isOIDCProviderOption,\n isExpectedType,\n hmacSha256,\n hasClientSecret,\n getWithingsSignatureParams,\n getProviderSubjectKeys,\n generateState,\n generateCodeVerifier,\n extractPropFromIdentity,\n encodeBase64,\n defineProviders,\n defineProvider,\n decodeJWT,\n decodeBase64,\n createS256CodeChallenge,\n createOIDCClient,\n createOAuth2Request,\n createOAuth2FetchError,\n createOAuth2Client,\n createCustomOAuth2Client,\n createAppleClientSecret,\n base64Url,\n assertWithingsSuccess\n};\n",
21
21
  "import { eq } from 'drizzle-orm';\nimport { bigint, integer, pgTable, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type { LockoutRecord, LockoutStore } from './types';\n\nconst KEY_LENGTH = 320;\n\nexport const lockoutsTable = pgTable('auth_lockouts', {\n\tfailed_attempts: integer('failed_attempts').notNull().default(0),\n\tkey: varchar('key', { length: KEY_LENGTH }).primaryKey(),\n\tlocked_until_ms: bigint('locked_until_ms', { mode: 'number' }),\n\twindow_started_at_ms: bigint('window_started_at_ms', {\n\t\tmode: 'number'\n\t}).notNull()\n});\n\ntype LockoutRow = typeof lockoutsTable.$inferSelect;\ntype LockoutInsert = typeof lockoutsTable.$inferInsert;\n\nconst toRecord = (row: LockoutRow): LockoutRecord => ({\n\tfailedAttempts: row.failed_attempts,\n\tkey: row.key,\n\tlockedUntil: row.locked_until_ms ?? undefined,\n\twindowStartedAt: row.window_started_at_ms\n});\n\nexport const createNeonLockoutStore = (databaseUrl: string) =>\n\tcreatePostgresLockoutStore(createNeonDatabase(databaseUrl));\nexport const createPostgresLockoutStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LockoutStore => {\n\tconst get = async (key: string) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(lockoutsTable)\n\t\t\t.where(eq(lockoutsTable.key, key))\n\t\t\t.limit(1);\n\n\t\treturn row ? toRecord(row) : undefined;\n\t};\n\tconst save = async (record: LockoutRecord) => {\n\t\tconst values: LockoutInsert = {\n\t\t\tfailed_attempts: record.failedAttempts,\n\t\t\tkey: record.key,\n\t\t\tlocked_until_ms: record.lockedUntil ?? null,\n\t\t\twindow_started_at_ms: record.windowStartedAt\n\t\t};\n\t\tawait db\n\t\t\t.insert(lockoutsTable)\n\t\t\t.values(values)\n\t\t\t.onConflictDoUpdate({ set: values, target: lockoutsTable.key });\n\t};\n\n\treturn {\n\t\tget,\n\t\tincrement: async (key, windowMs) => {\n\t\t\tconst now = Date.now();\n\t\t\tconst existing = await get(key);\n\t\t\tconst next: LockoutRecord =\n\t\t\t\texisting !== undefined &&\n\t\t\t\tnow - existing.windowStartedAt <= windowMs\n\t\t\t\t\t? {\n\t\t\t\t\t\t\t...existing,\n\t\t\t\t\t\t\tfailedAttempts: existing.failedAttempts + 1\n\t\t\t\t\t\t}\n\t\t\t\t\t: { failedAttempts: 1, key, windowStartedAt: now };\n\t\t\tawait save(next);\n\n\t\t\treturn next;\n\t\t},\n\t\tlock: async (key, lockedUntil) => {\n\t\t\tconst existing = (await get(key)) ?? {\n\t\t\t\tfailedAttempts: 0,\n\t\t\t\tkey,\n\t\t\t\twindowStartedAt: Date.now()\n\t\t\t};\n\t\t\tawait save({ ...existing, lockedUntil });\n\t\t},\n\t\treset: async (key) => {\n\t\t\tawait db.delete(lockoutsTable).where(eq(lockoutsTable.key, key));\n\t\t}\n\t};\n};\n",
22
22
  "import { and, eq, isNull, lte, or, sql } from 'drizzle-orm';\nimport {\n\tbigint,\n\tboolean,\n\tjsonb,\n\tpgTable,\n\tsmallint,\n\ttext,\n\tvarchar\n} from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type { MfaEnrollment, MfaFactor, MFAStore } from './types';\n\nconst ID_LENGTH = 255;\nconst PHONE_LENGTH = 20;\n\nexport const mfaEnrollmentsTable = pgTable('auth_mfa_enrollments', {\n\tbackup_code_hashes: jsonb('backup_code_hashes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\tlast_used_at_ms: bigint('last_used_at_ms', { mode: 'number' }),\n\tmfa_factors: jsonb('mfa_factors').$type<MfaFactor[]>(),\n\tsms_challenge_id: text('sms_challenge_id'),\n\tsms_code_sent_at_ms: bigint('sms_code_sent_at_ms', { mode: 'number' }),\n\tsms_failed_attempts: smallint('sms_failed_attempts').notNull().default(0),\n\tsms_pending_code_expires_at_ms: bigint('sms_pending_code_expires_at_ms', {\n\t\tmode: 'number'\n\t}),\n\tsms_pending_code_hash: text('sms_pending_code_hash'),\n\tsms_pending_factor_id: text('sms_pending_factor_id'),\n\tsms_pending_purpose: text('sms_pending_purpose').$type<\n\t\tMfaEnrollment['smsPendingPurpose']\n\t>(),\n\tsms_phone: varchar('sms_phone', { length: PHONE_LENGTH }),\n\tsms_provider_reference: text('sms_provider_reference'),\n\tsms_verified: boolean('sms_verified').notNull().default(false),\n\ttotp_failed_attempts: smallint('totp_failed_attempts').notNull().default(0),\n\ttotp_secret_ciphertext: text('totp_secret_ciphertext'),\n\ttotp_verified: boolean('totp_verified').notNull().default(false),\n\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH }).primaryKey()\n});\n\ntype MfaRow = typeof mfaEnrollmentsTable.$inferSelect;\ntype MfaInsert = typeof mfaEnrollmentsTable.$inferInsert;\n\nconst toEnrollment = (row: MfaRow): MfaEnrollment => ({\n\tbackupCodeHashes: row.backup_code_hashes,\n\tcreatedAt: row.created_at_ms,\n\tfactors: row.mfa_factors ?? undefined,\n\tlastUsedAt: row.last_used_at_ms ?? undefined,\n\tsmsChallengeId: row.sms_challenge_id ?? undefined,\n\tsmsCodeSentAt: row.sms_code_sent_at_ms ?? undefined,\n\tsmsFailedAttempts: row.sms_failed_attempts,\n\tsmsPendingCodeExpiresAt: row.sms_pending_code_expires_at_ms ?? undefined,\n\tsmsPendingCodeHash: row.sms_pending_code_hash ?? undefined,\n\tsmsPendingFactorId: row.sms_pending_factor_id ?? undefined,\n\tsmsPendingPurpose: row.sms_pending_purpose ?? undefined,\n\tsmsPhone: row.sms_phone ?? undefined,\n\tsmsProviderReference: row.sms_provider_reference ?? undefined,\n\tsmsVerified: row.sms_verified,\n\ttotpFailedAttempts: row.totp_failed_attempts,\n\ttotpSecretCiphertext: row.totp_secret_ciphertext ?? undefined,\n\ttotpVerified: row.totp_verified,\n\tupdatedAt: row.updated_at_ms,\n\tuserId: row.user_id\n});\n\nexport const createNeonMfaStore = (databaseUrl: string) =>\n\tcreatePostgresMfaStore(createNeonDatabase(databaseUrl));\nexport const createPostgresMfaStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): MFAStore => {\n\tconst toValues = (enrollment: MfaEnrollment): MfaInsert => ({\n\t\tbackup_code_hashes: enrollment.backupCodeHashes,\n\t\tcreated_at_ms: enrollment.createdAt,\n\t\tlast_used_at_ms: enrollment.lastUsedAt ?? null,\n\t\tmfa_factors: enrollment.factors ?? null,\n\t\tsms_challenge_id: enrollment.smsChallengeId ?? null,\n\t\tsms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,\n\t\tsms_failed_attempts: enrollment.smsFailedAttempts ?? 0,\n\t\tsms_pending_code_expires_at_ms:\n\t\t\tenrollment.smsPendingCodeExpiresAt ?? null,\n\t\tsms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,\n\t\tsms_pending_factor_id: enrollment.smsPendingFactorId ?? null,\n\t\tsms_pending_purpose: enrollment.smsPendingPurpose ?? null,\n\t\tsms_phone: enrollment.smsPhone ?? null,\n\t\tsms_provider_reference: enrollment.smsProviderReference ?? null,\n\t\tsms_verified: enrollment.smsVerified,\n\t\ttotp_failed_attempts: enrollment.totpFailedAttempts ?? 0,\n\t\ttotp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,\n\t\ttotp_verified: enrollment.totpVerified,\n\t\tupdated_at_ms: enrollment.updatedAt,\n\t\tuser_id: enrollment.userId\n\t});\n\n\treturn {\n\t\tclaimSmsChallenge: async ({\n\t\t\tchallengeId,\n\t\t\tcooldownCutoff,\n\t\t\tenrollment\n\t\t}) => {\n\t\t\tconst values = toValues({\n\t\t\t\t...enrollment,\n\t\t\t\tsmsChallengeId: challengeId\n\t\t\t});\n\t\t\tconst rows = await db\n\t\t\t\t.insert(mfaEnrollmentsTable)\n\t\t\t\t.values(values)\n\t\t\t\t.onConflictDoUpdate({\n\t\t\t\t\tset: {\n\t\t\t\t\t\tmfa_factors: enrollment.factors ?? null,\n\t\t\t\t\t\tsms_challenge_id: challengeId,\n\t\t\t\t\t\tsms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,\n\t\t\t\t\t\tsms_failed_attempts: 0,\n\t\t\t\t\t\tsms_pending_code_expires_at_ms:\n\t\t\t\t\t\t\tenrollment.smsPendingCodeExpiresAt ?? null,\n\t\t\t\t\t\tsms_pending_code_hash: null,\n\t\t\t\t\t\tsms_pending_factor_id:\n\t\t\t\t\t\t\tenrollment.smsPendingFactorId ?? null,\n\t\t\t\t\t\tsms_pending_purpose:\n\t\t\t\t\t\t\tenrollment.smsPendingPurpose ?? null,\n\t\t\t\t\t\tsms_phone: enrollment.smsPhone ?? null,\n\t\t\t\t\t\tsms_provider_reference: null,\n\t\t\t\t\t\tsms_verified: enrollment.smsVerified,\n\t\t\t\t\t\tupdated_at_ms: enrollment.updatedAt\n\t\t\t\t\t},\n\t\t\t\t\tsetWhere: or(\n\t\t\t\t\t\tisNull(mfaEnrollmentsTable.sms_code_sent_at_ms),\n\t\t\t\t\t\tlte(\n\t\t\t\t\t\t\tmfaEnrollmentsTable.sms_code_sent_at_ms,\n\t\t\t\t\t\t\tcooldownCutoff\n\t\t\t\t\t\t)\n\t\t\t\t\t),\n\t\t\t\t\ttarget: mfaEnrollmentsTable.user_id\n\t\t\t\t})\n\t\t\t\t.returning({ userId: mfaEnrollmentsTable.user_id });\n\n\t\t\treturn rows.length === 1;\n\t\t},\n\t\tcompleteSmsChallenge: async ({\n\t\t\tchallengeId,\n\t\t\tfactors,\n\t\t\tlastUsedAt,\n\t\t\tsmsVerified,\n\t\t\tuserId\n\t\t}) => {\n\t\t\tconst rows = await db\n\t\t\t\t.update(mfaEnrollmentsTable)\n\t\t\t\t.set({\n\t\t\t\t\tlast_used_at_ms: lastUsedAt,\n\t\t\t\t\tmfa_factors: factors,\n\t\t\t\t\tsms_challenge_id: null,\n\t\t\t\t\tsms_failed_attempts: 0,\n\t\t\t\t\tsms_pending_code_expires_at_ms: null,\n\t\t\t\t\tsms_pending_code_hash: null,\n\t\t\t\t\tsms_pending_factor_id: null,\n\t\t\t\t\tsms_pending_purpose: null,\n\t\t\t\t\tsms_provider_reference: null,\n\t\t\t\t\tsms_verified: smsVerified,\n\t\t\t\t\tupdated_at_ms: Date.now()\n\t\t\t\t})\n\t\t\t\t.where(\n\t\t\t\t\tand(\n\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, userId),\n\t\t\t\t\t\teq(mfaEnrollmentsTable.sms_challenge_id, challengeId)\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t\t.returning({ userId: mfaEnrollmentsTable.user_id });\n\n\t\t\treturn rows.length === 1;\n\t\t},\n\t\tfinalizeSmsChallenge: async (input) => {\n\t\t\tconst rows = await db\n\t\t\t\t.update(mfaEnrollmentsTable)\n\t\t\t\t.set({\n\t\t\t\t\tsms_pending_code_expires_at_ms: input.expiresAt,\n\t\t\t\t\tsms_pending_code_hash: input.hash ?? null,\n\t\t\t\t\tsms_provider_reference: input.providerReference ?? null,\n\t\t\t\t\tupdated_at_ms: Date.now()\n\t\t\t\t})\n\t\t\t\t.where(\n\t\t\t\t\tand(\n\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, input.userId),\n\t\t\t\t\t\teq(\n\t\t\t\t\t\t\tmfaEnrollmentsTable.sms_challenge_id,\n\t\t\t\t\t\t\tinput.challengeId\n\t\t\t\t\t\t)\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t\t.returning({ userId: mfaEnrollmentsTable.user_id });\n\n\t\t\treturn rows.length === 1;\n\t\t},\n\t\tgetEnrollment: async (userId) => {\n\t\t\tconst [row] = await db\n\t\t\t\t.select()\n\t\t\t\t.from(mfaEnrollmentsTable)\n\t\t\t\t.where(eq(mfaEnrollmentsTable.user_id, userId))\n\t\t\t\t.limit(1);\n\n\t\t\treturn row ? toEnrollment(row) : undefined;\n\t\t},\n\t\tlistEnrollments: async () => {\n\t\t\tconst rows = await db.select().from(mfaEnrollmentsTable);\n\n\t\t\treturn rows.map(toEnrollment);\n\t\t},\n\t\trecordSmsFailure: async ({ challengeId, maxAttempts, userId }) => {\n\t\t\tconst rows = await db\n\t\t\t\t.update(mfaEnrollmentsTable)\n\t\t\t\t.set({\n\t\t\t\t\tsms_failed_attempts: sql`${mfaEnrollmentsTable.sms_failed_attempts} + 1`,\n\t\t\t\t\tupdated_at_ms: Date.now()\n\t\t\t\t})\n\t\t\t\t.where(\n\t\t\t\t\tand(\n\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, userId),\n\t\t\t\t\t\teq(mfaEnrollmentsTable.sms_challenge_id, challengeId),\n\t\t\t\t\t\tlte(\n\t\t\t\t\t\t\tmfaEnrollmentsTable.sms_failed_attempts,\n\t\t\t\t\t\t\tmaxAttempts - 1\n\t\t\t\t\t\t)\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t\t.returning({\n\t\t\t\t\tattempts: mfaEnrollmentsTable.sms_failed_attempts\n\t\t\t\t});\n\n\t\t\treturn rows[0]?.attempts;\n\t\t},\n\t\tremoveEnrollment: async (userId) => {\n\t\t\tawait db\n\t\t\t\t.delete(mfaEnrollmentsTable)\n\t\t\t\t.where(eq(mfaEnrollmentsTable.user_id, userId));\n\t\t},\n\t\trollbackSmsChallenge: async ({ challengeId, previous, userId }) => {\n\t\t\tif (previous) {\n\t\t\t\tawait db\n\t\t\t\t\t.update(mfaEnrollmentsTable)\n\t\t\t\t\t.set(toValues(previous))\n\t\t\t\t\t.where(\n\t\t\t\t\t\tand(\n\t\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, userId),\n\t\t\t\t\t\t\teq(\n\t\t\t\t\t\t\t\tmfaEnrollmentsTable.sms_challenge_id,\n\t\t\t\t\t\t\t\tchallengeId\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t)\n\t\t\t\t\t);\n\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait db\n\t\t\t\t.delete(mfaEnrollmentsTable)\n\t\t\t\t.where(\n\t\t\t\t\tand(\n\t\t\t\t\t\teq(mfaEnrollmentsTable.user_id, userId),\n\t\t\t\t\t\teq(mfaEnrollmentsTable.sms_challenge_id, challengeId)\n\t\t\t\t\t)\n\t\t\t\t);\n\t\t},\n\t\tsaveEnrollment: async (enrollment) => {\n\t\t\tconst values = toValues(enrollment);\n\t\t\tawait db\n\t\t\t\t.insert(mfaEnrollmentsTable)\n\t\t\t\t.values(values)\n\t\t\t\t.onConflictDoUpdate({\n\t\t\t\t\tset: values,\n\t\t\t\t\ttarget: mfaEnrollmentsTable.user_id\n\t\t\t\t});\n\t\t}\n\t};\n};\n",
package/dist/index.d.ts CHANGED
@@ -3942,10 +3942,10 @@ export { createInMemoryAuthSessionStore } from './session/inMemoryStore';
3942
3942
  export { createNeonAuthSessionStore } from './session/neonStore';
3943
3943
  export { providersFromEnv, type ProviderSelection } from './providersFromEnv';
3944
3944
  export { createRedisAuthSessionStore, type RedisSessionClient } from './session/redisStore';
3945
- export { createLinkedProviderCredentialResolver } from './linkedProviders/resolver';
3945
+ export { createLinkedProviderCredentialResolver, type CreateLinkedProviderCredentialResolverOptions, type LinkedProviderRefreshResult } from './linkedProviders/resolver';
3946
3946
  export { createOAuthLinkedProviderCredentialResolver } from './linkedProviders/oauthResolver';
3947
3947
  export { createOAuthAccountLinkedProviderCredentialResolver, type OAuthLinkedProviderAccount, type OAuthLinkedProviderAccountStore } from './linkedProviders/oauthAccountResolver';
3948
- export { createNeonLinkedProviderStores, createNeonOAuthLinkedProviderCredentialResolver } from './linkedProviders/neonStores';
3948
+ export { createLinkedProviderBindingStore, createLinkedProviderGrantStore, createNeonLinkedProviderStores, createNeonOAuthLinkedProviderCredentialResolver, linkedProviderBindingsTable, linkedProviderGrantsTable, type LinkedProviderBindingRow, type LinkedProviderGrantRow } from './linkedProviders/neonStores';
3949
3949
  export { createInMemoryLinkedProviderStores } from './linkedProviders/inMemoryStores';
3950
3950
  export { protectRoutePlugin } from './routes/protectRoute';
3951
3951
  export { requireAuthPlugin } from './routes/requireAuth';
package/dist/index.js CHANGED
@@ -7214,7 +7214,10 @@ var mfaTotpRoutes = ({
7214
7214
  verified: false
7215
7215
  };
7216
7216
  const factors = getMfaFactors(base).filter((existingFactor) => existingFactor.type !== "totp" || existingFactor.verified);
7217
- await mfaStore.saveEnrollment(withMfaFactors({ ...base, updatedAt: now }, [...factors, factor]));
7217
+ await mfaStore.saveEnrollment(withMfaFactors({ ...base, updatedAt: now }, [
7218
+ ...factors,
7219
+ factor
7220
+ ]));
7218
7221
  return status("OK", {
7219
7222
  factorId: factor.id,
7220
7223
  secret,
@@ -34022,17 +34025,17 @@ var resolveBindingFailureStatus = (binding, report) => {
34022
34025
  }
34023
34026
  return binding.status;
34024
34027
  };
34025
- var buildNextGrant = (grant, report, currentTime) => ({
34028
+ var buildNextGrant = (grant, report, currentTime, failurePolicy) => ({
34026
34029
  ...grant,
34027
34030
  lastRefreshError: report.message ?? report.code,
34028
34031
  metadata: annotateFailureMetadata(grant.metadata, report, currentTime),
34029
- status: resolveGrantFailureStatus(grant, report),
34032
+ status: failurePolicy === "record" ? grant.status : resolveGrantFailureStatus(grant, report),
34030
34033
  updatedAt: currentTime
34031
34034
  });
34032
- var buildNextBinding = (binding, report, currentTime) => ({
34035
+ var buildNextBinding = (binding, report, currentTime, failurePolicy) => ({
34033
34036
  ...binding,
34034
34037
  metadata: annotateFailureMetadata(binding.metadata, report, currentTime),
34035
- status: resolveBindingFailureStatus(binding, report),
34038
+ status: failurePolicy === "record" ? binding.status : resolveBindingFailureStatus(binding, report),
34036
34039
  updatedAt: currentTime
34037
34040
  });
34038
34041
  var resolveBindingCredential = async (grantStore, binding, input) => {
@@ -34049,6 +34052,7 @@ var resolveBindingCredential = async (grantStore, binding, input) => {
34049
34052
  var createLinkedProviderCredentialResolver = ({
34050
34053
  grantStore,
34051
34054
  bindingStore,
34055
+ failurePolicy = "latch",
34052
34056
  loadAccessTokenLease,
34053
34057
  refreshAccessTokenLease,
34054
34058
  now = () => Date.now(),
@@ -34094,10 +34098,10 @@ var createLinkedProviderCredentialResolver = ({
34094
34098
  const grant = await grantStore.getGrant(credential.grantId);
34095
34099
  const binding = await bindingStore.getBinding(credential.bindingId);
34096
34100
  if (grant) {
34097
- await grantStore.saveGrant(buildNextGrant(grant, report, currentTime));
34101
+ await grantStore.saveGrant(buildNextGrant(grant, report, currentTime, failurePolicy));
34098
34102
  }
34099
34103
  if (binding) {
34100
- await bindingStore.saveBinding(buildNextBinding(binding, report, currentTime));
34104
+ await bindingStore.saveBinding(buildNextBinding(binding, report, currentTime, failurePolicy));
34101
34105
  }
34102
34106
  await onReportFailure?.({
34103
34107
  binding: binding ?? undefined,
@@ -34396,7 +34400,7 @@ var toBinding2 = (row) => ({
34396
34400
  updatedAt: row.updated_at.getTime(),
34397
34401
  username: row.username ?? undefined
34398
34402
  });
34399
- var createNeonLinkedProviderBindingStore = (db) => ({
34403
+ var createLinkedProviderBindingStore = (db) => ({
34400
34404
  getBinding: async (id2) => {
34401
34405
  const [row] = await db.select().from(linkedProviderBindingsTable).where(eq(linkedProviderBindingsTable.id, id2)).limit(1);
34402
34406
  return row ? toBinding2(row) : undefined;
@@ -34447,7 +34451,7 @@ var createNeonLinkedProviderBindingStore = (db) => ({
34447
34451
  });
34448
34452
  }
34449
34453
  });
34450
- var createNeonLinkedProviderGrantStore = (db) => ({
34454
+ var createLinkedProviderGrantStore = (db) => ({
34451
34455
  getGrant: async (id2) => {
34452
34456
  const [row] = await db.select().from(linkedProviderGrantsTable).where(eq(linkedProviderGrantsTable.id, id2)).limit(1);
34453
34457
  return row ? toGrant2(row) : undefined;
@@ -34503,9 +34507,9 @@ var createNeonLinkedProviderStores = (databaseUrl) => {
34503
34507
  const sql2 = as(databaseUrl);
34504
34508
  const db = drizzle({ client: sql2 });
34505
34509
  return {
34506
- bindingStore: createNeonLinkedProviderBindingStore(db),
34510
+ bindingStore: createLinkedProviderBindingStore(db),
34507
34511
  db,
34508
- grantStore: createNeonLinkedProviderGrantStore(db)
34512
+ grantStore: createLinkedProviderGrantStore(db)
34509
34513
  };
34510
34514
  };
34511
34515
  var createNeonOAuthLinkedProviderCredentialResolver = async ({
@@ -41057,7 +41061,9 @@ export {
41057
41061
  createInMemoryWarrantStore,
41058
41062
  createInMemoryWebAuthnCredentialStore,
41059
41063
  createInMemoryWebhookDeliveryStore,
41064
+ createLinkedProviderBindingStore,
41060
41065
  createLinkedProviderCredentialResolver,
41066
+ createLinkedProviderGrantStore,
41061
41067
  createLockoutGuard,
41062
41068
  createMembershipPermissionResolver,
41063
41069
  createMfaGate,
@@ -41257,6 +41263,8 @@ export {
41257
41263
  issueTokenSet,
41258
41264
  jwkThumbprint,
41259
41265
  knownDevicesTable,
41266
+ linkedProviderBindingsTable,
41267
+ linkedProviderGrantsTable,
41260
41268
  listObjects,
41261
41269
  listRingSessions,
41262
41270
  listSubjects,
@@ -41423,5 +41431,5 @@ export {
41423
41431
  writeWarrant
41424
41432
  };
41425
41433
 
41426
- //# debugId=B86263B79140DD5464756E2164756E21
41434
+ //# debugId=D2745F53605E4E1E64756E2164756E21
41427
41435
  //# sourceMappingURL=index.js.map