@acmekit/acmekit 2.13.6 → 2.13.7

package/dist/api/auth/[actor_type]/[auth_provider]/register/route.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const generate_jwt_token_1 = require("../../../utils/generate-jwt-token");
+const POST = async (req, res) => {
+    const { actor_type, auth_provider } = req.params;
+    const config = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    const service = req.scope.resolve(utils_1.Modules.AUTH);
+    const authData = {
+        url: req.url,
+        headers: req.headers,
+        query: req.query,
+        body: req.body,
+        protocol: req.protocol,
+    };
+    const { success, error, authIdentity } = await service.register(auth_provider, authData);
+    if (success && authIdentity) {
+        const { http } = config.projectConfig;
+        const token = await (0, generate_jwt_token_1.generateJwtTokenForAuthIdentity)({
+            authIdentity,
+            actorType: actor_type,
+            authProvider: auth_provider,
+            container: req.scope,
+        }, {
+            secret: http.jwtSecret,
+            expiresIn: http.jwtExpiresIn,
+            options: http.jwtOptions,
+        });
+        return res.status(200).json({ token });
+    }
+    throw new utils_1.AcmeKitError(utils_1.AcmeKitError.Types.UNAUTHORIZED, error || "Authentication failed");
+};
+exports.POST = POST;
+//# sourceMappingURL=route.js.map

package/dist/api/auth/[actor_type]/[auth_provider]/register/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/auth/[actor_type]/[auth_provider]/register/route.ts"],"names":[],"mappings":";;;AAMA,oDAIiC;AACjC,0EAAmF;AAE5E,MAAM,IAAI,GAAG,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,EAAE;IACtE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,CAAA;IAChD,MAAM,MAAM,GAAiB,GAAG,CAAC,KAAK,CAAC,OAAO,CAC5C,iCAAyB,CAAC,aAAa,CACxC,CAAA;IAED,MAAM,OAAO,GAAuB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACA,CAAA;IAExB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAC7D,aAAa,EACb,QAAQ,CACT,CAAA;IAED,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,aAAa,CAAA;QAErC,MAAM,KAAK,GAAG,MAAM,IAAA,oDAA+B,EACjD;YACE,YAAY;YACZ,SAAS,EAAE,UAAU;YACrB,YAAY,EAAE,aAAa;YAC3B,SAAS,EAAE,GAAG,CAAC,KAAK;SACrB,EACD;YACE,MAAM,EAAE,IAAI,CAAC,SAAU;YACvB,SAAS,EAAE,IAAI,CAAC,YAAY;YAC5B,OAAO,EAAE,IAAI,CAAC,UAAU;SACzB,CACF,CAAA;QAED,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,IAAI,oBAAY,CACpB,oBAAY,CAAC,KAAK,CAAC,YAAY,EAC/B,KAAK,IAAI,uBAAuB,CACjC,CAAA;AACH,CAAC,CAAA;AA7CY,QAAA,IAAI,QA6ChB"}

package/dist/api/auth/[actor_type]/[auth_provider]/reset-password/route.d.ts

@@ -0,0 +1,4 @@
+import { AuthenticatedAcmeKitRequest, AcmeKitResponse } from "@acmekit/framework/http";
+import { ResetPasswordRequestType } from "../../../validators";
+export declare const POST: (req: AuthenticatedAcmeKitRequest<ResetPasswordRequestType>, res: AcmeKitResponse) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/auth/[actor_type]/[auth_provider]/reset-password/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/[actor_type]/[auth_provider]/reset-password/route.ts"],"names":[],"mappings":"AACA,OAAO,EACL,2BAA2B,EAC3B,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAE9D,eAAO,MAAM,IAAI,GACf,KAAK,2BAA2B,CAAC,wBAAwB,CAAC,EAC1D,KAAK,eAAe,kBAsBrB,CAAA"}

package/dist/api/auth/[actor_type]/[auth_provider]/reset-password/route.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const core_flows_1 = require("@acmekit/core-flows");
+const utils_1 = require("@acmekit/framework/utils");
+const POST = async (req, res) => {
+    const { auth_provider, actor_type } = req.params;
+    const { identifier, metadata } = req.validatedBody;
+    const { http } = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE).projectConfig;
+    await (0, core_flows_1.generateResetPasswordTokenWorkflow)(req.scope).run({
+        input: {
+            entityId: identifier,
+            actorType: actor_type,
+            provider: auth_provider,
+            secret: http.jwtSecret,
+            jwtOptions: http.jwtOptions,
+            metadata,
+        },
+        throwOnError: false, // we don't want to throw on error to avoid leaking information about non-existing identities
+    });
+    res.sendStatus(201);
+};
+exports.POST = POST;
+//# sourceMappingURL=route.js.map

package/dist/api/auth/[actor_type]/[auth_provider]/reset-password/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/auth/[actor_type]/[auth_provider]/reset-password/route.ts"],"names":[],"mappings":";;;AAAA,oDAAwE;AAKxE,oDAAoE;AAG7D,MAAM,IAAI,GAAG,KAAK,EACvB,GAA0D,EAC1D,GAAoB,EACpB,EAAE;IACF,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAA;IAChD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,aAAa,CAAA;IAElD,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAChC,iCAAyB,CAAC,aAAa,CACxC,CAAC,aAAa,CAAA;IAEf,MAAM,IAAA,+CAAkC,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QACtD,KAAK,EAAE;YACL,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,UAAU;YACrB,QAAQ,EAAE,aAAa;YACvB,MAAM,EAAE,IAAI,CAAC,SAAU;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;SACT;QACD,YAAY,EAAE,KAAK,EAAE,6FAA6F;KACnH,CAAC,CAAA;IAEF,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AACrB,CAAC,CAAA;AAxBY,QAAA,IAAI,QAwBhB"}

package/dist/api/auth/[actor_type]/[auth_provider]/route.d.ts

@@ -0,0 +1,4 @@
+import { AcmeKitRequest, AcmeKitResponse } from "@acmekit/framework/http";
+export declare const GET: (req: AcmeKitRequest, res: AcmeKitResponse) => Promise<AcmeKitResponse>;
+export declare const POST: (req: AcmeKitRequest, res: AcmeKitResponse) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/auth/[actor_type]/[auth_provider]/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/[actor_type]/[auth_provider]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAazE,eAAO,MAAM,GAAG,GAAU,KAAK,cAAc,EAAE,KAAK,eAAe,6BAiDlE,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,cAAc,EAAE,KAAK,eAAe,kBAEnE,CAAA"}

package/dist/api/auth/[actor_type]/[auth_provider]/route.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = exports.GET = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const generate_jwt_token_1 = require("../../utils/generate-jwt-token");
+const GET = async (req, res) => {
+    const { actor_type, auth_provider } = req.params;
+    const config = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    const service = req.scope.resolve(utils_1.Modules.AUTH);
+    const authData = {
+        url: req.url,
+        headers: req.headers,
+        query: req.query,
+        body: req.body,
+        protocol: req.protocol,
+    };
+    const { success, error, authIdentity, location } = await service.authenticate(auth_provider, authData);
+    if (location) {
+        return res.status(200).json({ location });
+    }
+    if (success && authIdentity) {
+        const { http } = config.projectConfig;
+        const token = await (0, generate_jwt_token_1.generateJwtTokenForAuthIdentity)({
+            authIdentity,
+            actorType: actor_type,
+            authProvider: auth_provider,
+            container: req.scope,
+        }, {
+            secret: http.jwtSecret,
+            expiresIn: http.jwtExpiresIn,
+            options: http.jwtOptions,
+        });
+        return res.status(200).json({ token });
+    }
+    throw new utils_1.AcmeKitError(utils_1.AcmeKitError.Types.UNAUTHORIZED, error || "Authentication failed");
+};
+exports.GET = GET;
+const POST = async (req, res) => {
+    await (0, exports.GET)(req, res);
+};
+exports.POST = POST;
+//# sourceMappingURL=route.js.map

package/dist/api/auth/[actor_type]/[auth_provider]/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/[actor_type]/[auth_provider]/route.ts"],"names":[],"mappings":";;;AAMA,oDAIiC;AACjC,uEAAgF;AAEzE,MAAM,GAAG,GAAG,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,EAAE;IACrE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,CAAA;IAChD,MAAM,MAAM,GAAiB,GAAG,CAAC,KAAK,CAAC,OAAO,CAC5C,iCAAyB,CAAC,aAAa,CACxC,CAAA;IAED,MAAM,OAAO,GAAuB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACA,CAAA;IAExB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,YAAY,CAC3E,aAAa,EACb,QAAQ,CACT,CAAA;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC3C,CAAC;IAED,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,aAAa,CAAA;QAErC,MAAM,KAAK,GAAG,MAAM,IAAA,oDAA+B,EACjD;YACE,YAAY;YACZ,SAAS,EAAE,UAAU;YACrB,YAAY,EAAE,aAAa;YAC3B,SAAS,EAAE,GAAG,CAAC,KAAK;SACrB,EACD;YACE,MAAM,EAAE,IAAI,CAAC,SAAU;YACvB,SAAS,EAAE,IAAI,CAAC,YAAY;YAC5B,OAAO,EAAE,IAAI,CAAC,UAAU;SACzB,CACF,CAAA;QAED,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,IAAI,oBAAY,CACpB,oBAAY,CAAC,KAAK,CAAC,YAAY,EAC/B,KAAK,IAAI,uBAAuB,CACjC,CAAA;AACH,CAAC,CAAA;AAjDY,QAAA,GAAG,OAiDf;AAEM,MAAM,IAAI,GAAG,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,EAAE;IACtE,MAAM,IAAA,WAAG,EAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AACrB,CAAC,CAAA;AAFY,QAAA,IAAI,QAEhB"}

package/dist/api/auth/[actor_type]/[auth_provider]/update/route.d.ts

@@ -0,0 +1,3 @@
+import { AuthenticatedAcmeKitRequest, AcmeKitResponse } from "@acmekit/framework/http";
+export declare const POST: (req: AuthenticatedAcmeKitRequest, res: AcmeKitResponse) => Promise<AcmeKitResponse>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/auth/[actor_type]/[auth_provider]/update/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/[actor_type]/[auth_provider]/update/route.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAIhC,eAAO,MAAM,IAAI,GACf,KAAK,2BAA2B,EAChC,KAAK,eAAe,6BAqBrB,CAAA"}

package/dist/api/auth/[actor_type]/[auth_provider]/update/route.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const POST = async (req, res) => {
+    const { auth_provider } = req.params;
+    const authService = req.scope.resolve(utils_1.Modules.AUTH);
+    const updateData = {
+        ...req.body,
+        entity_id: req.auth_context.actor_id, // comes from the validated token
+    };
+    const { authIdentity, success, error } = await authService.updateProvider(auth_provider, updateData);
+    if (success && authIdentity) {
+        return res.status(200).json({ success: true });
+    }
+    throw new utils_1.AcmeKitError(utils_1.AcmeKitError.Types.UNAUTHORIZED, error || "Unauthorized");
+};
+exports.POST = POST;
+//# sourceMappingURL=route.js.map

package/dist/api/auth/[actor_type]/[auth_provider]/update/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/auth/[actor_type]/[auth_provider]/update/route.ts"],"names":[],"mappings":";;;AAKA,oDAAgE;AAEzD,MAAM,IAAI,GAAG,KAAK,EACvB,GAAgC,EAChC,GAAoB,EACpB,EAAE;IACF,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,CAAA;IAEpC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;IAEvE,MAAM,UAAU,GAAG;QACjB,GAAI,GAAG,CAAC,IAAgC;QACxC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,iCAAiC;KACxE,CAAA;IAED,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,cAAc,CACvE,aAAa,EACb,UAAU,CACX,CAAA;IAED,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,IAAI,oBAAY,CAAC,oBAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,IAAI,cAAc,CAAC,CAAA;AAClF,CAAC,CAAA;AAvBY,QAAA,IAAI,QAuBhB"}

package/dist/api/auth/middlewares.d.ts

@@ -0,0 +1,3 @@
+import { MiddlewareRoute } from "@acmekit/framework/http";
+export declare const authRoutesMiddlewares: MiddlewareRoute[];
+//# sourceMappingURL=middlewares.d.ts.map

package/dist/api/auth/middlewares.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../../src/api/auth/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EAEhB,MAAM,yBAAyB,CAAA;AAKhC,eAAO,MAAM,qBAAqB,EAAE,eAAe,EAiDlD,CAAA"}

package/dist/api/auth/middlewares.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authRoutesMiddlewares = void 0;
+const http_1 = require("@acmekit/framework/http");
+const validate_scope_provider_association_1 = require("./utils/validate-scope-provider-association");
+const validate_token_1 = require("./utils/validate-token");
+const validators_1 = require("./validators");
+exports.authRoutesMiddlewares = [
+    {
+        method: ["POST"],
+        matcher: "/auth/session",
+        middlewares: [(0, http_1.authenticate)("*", "bearer", { allowUnregistered: true })],
+    },
+    {
+        method: ["DELETE"],
+        matcher: "/auth/session",
+        middlewares: [(0, http_1.authenticate)("*", ["session"])],
+    },
+    {
+        method: ["POST"],
+        matcher: "/auth/token/refresh",
+        middlewares: [(0, http_1.authenticate)("*", "bearer", { allowUnregistered: true })],
+    },
+    {
+        method: ["POST"],
+        matcher: "/auth/:actor_type/:auth_provider/callback",
+        middlewares: [(0, validate_scope_provider_association_1.validateScopeProviderAssociation)()],
+    },
+    {
+        method: ["POST"],
+        matcher: "/auth/:actor_type/:auth_provider/register",
+        middlewares: [(0, validate_scope_provider_association_1.validateScopeProviderAssociation)()],
+    },
+    {
+        method: ["POST"],
+        matcher: "/auth/:actor_type/:auth_provider",
+        middlewares: [(0, validate_scope_provider_association_1.validateScopeProviderAssociation)()],
+    },
+    {
+        method: ["GET"],
+        matcher: "/auth/:actor_type/:auth_provider",
+        middlewares: [(0, validate_scope_provider_association_1.validateScopeProviderAssociation)()],
+    },
+    {
+        method: ["POST"],
+        matcher: "/auth/:actor_type/:auth_provider/reset-password",
+        middlewares: [
+            (0, validate_scope_provider_association_1.validateScopeProviderAssociation)(),
+            (0, http_1.validateAndTransformBody)(validators_1.ResetPasswordRequest),
+        ],
+    },
+    {
+        method: ["POST"],
+        matcher: "/auth/:actor_type/:auth_provider/update",
+        middlewares: [(0, validate_scope_provider_association_1.validateScopeProviderAssociation)(), (0, validate_token_1.validateToken)()],
+    },
+];
+//# sourceMappingURL=middlewares.js.map

package/dist/api/auth/middlewares.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../../src/api/auth/middlewares.ts"],"names":[],"mappings":";;;AAAA,kDAIgC;AAChC,qGAA8F;AAC9F,2DAAsD;AACtD,6CAAmD;AAEtC,QAAA,qBAAqB,GAAsB;IACtD;QACE,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,eAAe;QACxB,WAAW,EAAE,CAAC,IAAA,mBAAY,EAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;KACxE;IACD;QACE,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,OAAO,EAAE,eAAe;QACxB,WAAW,EAAE,CAAC,IAAA,mBAAY,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;KAC9C;IACD;QACE,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,CAAC,IAAA,mBAAY,EAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;KACxE;IACD;QACE,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,CAAC,IAAA,sEAAgC,GAAE,CAAC;KAClD;IACD;QACE,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,CAAC,IAAA,sEAAgC,GAAE,CAAC;KAClD;IACD;QACE,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,CAAC,IAAA,sEAAgC,GAAE,CAAC;KAClD;IACD;QACE,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,CAAC,IAAA,sEAAgC,GAAE,CAAC;KAClD;IACD;QACE,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EAAE;YACX,IAAA,sEAAgC,GAAE;YAClC,IAAA,+BAAwB,EAAC,iCAAoB,CAAC;SAC/C;KACF;IACD;QACE,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,yCAAyC;QAClD,WAAW,EAAE,CAAC,IAAA,sEAAgC,GAAE,EAAE,IAAA,8BAAa,GAAE,CAAC;KACnE;CACF,CAAA"}

package/dist/api/auth/session/route.d.ts

@@ -0,0 +1,4 @@
+import { AuthenticatedAcmeKitRequest, AcmeKitResponse } from "@acmekit/framework/http";
+export declare const POST: (req: AuthenticatedAcmeKitRequest, res: AcmeKitResponse) => Promise<void>;
+export declare const DELETE: (req: AuthenticatedAcmeKitRequest, res: AcmeKitResponse) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/auth/session/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/session/route.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAEhC,eAAO,MAAM,IAAI,GACf,KAAK,2BAA2B,EAChC,KAAK,eAAe,kBAKrB,CAAA;AAED,eAAO,MAAM,MAAM,GACjB,KAAK,2BAA2B,EAChC,KAAK,eAAe,kBAIrB,CAAA"}

package/dist/api/auth/session/route.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DELETE = exports.POST = void 0;
+const POST = async (req, res) => {
+    req.session.auth_context = req.auth_context;
+    res.status(200).json({ user: req.auth_context });
+};
+exports.POST = POST;
+const DELETE = async (req, res) => {
+    req.session.destroy();
+    res.json({ success: true });
+};
+exports.DELETE = DELETE;
+//# sourceMappingURL=route.js.map

package/dist/api/auth/session/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/auth/session/route.ts"],"names":[],"mappings":";;;AAKO,MAAM,IAAI,GAAG,KAAK,EACvB,GAAgC,EAChC,GAAoB,EACpB,EAAE;IACF,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAA;IAE3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAA;AAClD,CAAC,CAAA;AAPY,QAAA,IAAI,QAOhB;AAEM,MAAM,MAAM,GAAG,KAAK,EACzB,GAAgC,EAChC,GAAoB,EACpB,EAAE;IACF,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACrB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AAC7B,CAAC,CAAA;AANY,QAAA,MAAM,UAMlB"}

package/dist/api/auth/token/refresh/route.d.ts

@@ -0,0 +1,3 @@
+import { AuthenticatedAcmeKitRequest, AcmeKitResponse } from "@acmekit/framework/http";
+export declare const POST: (req: AuthenticatedAcmeKitRequest, res: AcmeKitResponse) => Promise<AcmeKitResponse>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/auth/token/refresh/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/token/refresh/route.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAQhC,eAAO,MAAM,IAAI,GACf,KAAK,2BAA2B,EAChC,KAAK,eAAe,6BA0BrB,CAAA"}

package/dist/api/auth/token/refresh/route.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const generate_jwt_token_1 = require("../../utils/generate-jwt-token");
+// Retrieve a newly generated JWT token. All checks that the existing token is valid already happen in the auth middleware.
+// The token will include the actor ID, even if the token used to refresh didn't have one.
+// Note: We probably want to disallow refreshes if the password changes, and require reauth.
+const POST = async (req, res) => {
+    const service = req.scope.resolve(utils_1.Modules.AUTH);
+    const authIdentity = await service.retrieveAuthIdentity(req.auth_context.auth_identity_id);
+    const { http } = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE).projectConfig;
+    const token = await (0, generate_jwt_token_1.generateJwtTokenForAuthIdentity)({
+        authIdentity,
+        actorType: req.auth_context.actor_type,
+        container: req.scope,
+    }, {
+        secret: http.jwtSecret,
+        expiresIn: http.jwtExpiresIn,
+        options: http.jwtOptions,
+    });
+    return res.json({ token });
+};
+exports.POST = POST;
+//# sourceMappingURL=route.js.map

package/dist/api/auth/token/refresh/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/token/refresh/route.ts"],"names":[],"mappings":";;;AAKA,oDAA6E;AAC7E,uEAAgF;AAEhF,2HAA2H;AAC3H,0FAA0F;AAC1F,4FAA4F;AACrF,MAAM,IAAI,GAAG,KAAK,EACvB,GAAgC,EAChC,GAAoB,EACpB,EAAE;IACF,MAAM,OAAO,GAAuB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,oBAAoB,CACrD,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAClC,CAAA;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAChC,iCAAyB,CAAC,aAAa,CACxC,CAAC,aAAa,CAAA;IAEf,MAAM,KAAK,GAAG,MAAM,IAAA,oDAA+B,EACjD;QACE,YAAY;QACZ,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;QACtC,SAAS,EAAE,GAAG,CAAC,KAAK;KACrB,EACD;QACE,MAAM,EAAE,IAAI,CAAC,SAAU;QACvB,SAAS,EAAE,IAAI,CAAC,YAAY;QAC5B,OAAO,EAAE,IAAI,CAAC,UAAU;KACzB,CACF,CAAA;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AAC5B,CAAC,CAAA;AA5BY,QAAA,IAAI,QA4BhB"}

package/dist/api/auth/utils/generate-jwt-token.d.ts

@@ -0,0 +1,13 @@
+import { AuthIdentityDTO, AcmeKitContainer, ProjectConfigOptions } from "@acmekit/framework/types";
+import { type Secret } from "jsonwebtoken";
+export declare function generateJwtTokenForAuthIdentity({ authIdentity, actorType, authProvider, container, }: {
+    authIdentity: AuthIdentityDTO;
+    actorType: string;
+    authProvider?: string;
+    container?: AcmeKitContainer;
+}, { secret, expiresIn, options, }: {
+    secret: Secret;
+    expiresIn: string | undefined;
+    options?: ProjectConfigOptions["http"]["jwtOptions"];
+}): Promise<string>;
+//# sourceMappingURL=generate-jwt-token.d.ts.map

package/dist/api/auth/utils/generate-jwt-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-jwt-token.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/utils/generate-jwt-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAMjC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAG1C,wBAAsB,+BAA+B,CACnD,EACE,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,SAAS,GACV,EAAE;IACD,YAAY,EAAE,eAAe,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,gBAAgB,CAAA;CAC7B,EACD,EACE,MAAM,EACN,SAAS,EACT,OAAO,GACR,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,OAAO,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAA;CACrD,mBAsDF"}

package/dist/api/auth/utils/generate-jwt-token.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateJwtTokenForAuthIdentity = generateJwtTokenForAuthIdentity;
+const utils_1 = require("@acmekit/framework/utils");
+const rbac_1 = __importDefault(require("../../../feature-flags/rbac"));
+async function generateJwtTokenForAuthIdentity({ authIdentity, actorType, authProvider, container, }, { secret, expiresIn, options, }) {
+    const expiresIn_ = expiresIn ?? options?.expiresIn;
+    const entityIdKey = `${actorType}_id`;
+    const entityId = authIdentity?.app_metadata?.[entityIdKey];
+    const providerIdentity = !authProvider
+        ? undefined
+        : authIdentity.provider_identities?.filter((identity) => identity.provider === authProvider)[0];
+    let roles;
+    if (utils_1.FeatureFlag.isFeatureEnabled(rbac_1.default.key)) {
+        if (container && entityId) {
+            try {
+                const query = container.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+                const { data: userRoles } = await query.graph({
+                    entity: actorType,
+                    fields: ["rbac_roles.id"],
+                    filters: {
+                        id: entityId,
+                    },
+                });
+                if (userRoles?.[0]?.rbac_roles) {
+                    roles = userRoles[0].rbac_roles.map((role) => role.id);
+                }
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    return (0, utils_1.generateJwtToken)({
+        actor_id: entityId ?? "",
+        actor_type: actorType,
+        auth_identity_id: authIdentity?.id ?? "",
+        app_metadata: {
+            [entityIdKey]: entityId,
+            roles,
+        },
+        user_metadata: providerIdentity?.user_metadata ?? {},
+    }, {
+        secret,
+        expiresIn: expiresIn_,
+        jwtOptions: options,
+    });
+}
+//# sourceMappingURL=generate-jwt-token.js.map

package/dist/api/auth/utils/generate-jwt-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-jwt-token.js","sourceRoot":"","sources":["../../../../src/api/auth/utils/generate-jwt-token.ts"],"names":[],"mappings":";;;;;AAaA,0EA0EC;AAlFD,oDAIiC;AAEjC,uEAAyD;AAElD,KAAK,UAAU,+BAA+B,CACnD,EACE,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,SAAS,GAMV,EACD,EACE,MAAM,EACN,SAAS,EACT,OAAO,GAKR;IAED,MAAM,UAAU,GAAG,SAAS,IAAI,OAAO,EAAE,SAAS,CAAA;IAClD,MAAM,WAAW,GAAG,GAAG,SAAS,KAAK,CAAA;IACrC,MAAM,QAAQ,GAAG,YAAY,EAAE,YAAY,EAAE,CAAC,WAAW,CAE5C,CAAA;IAEb,MAAM,gBAAgB,GAAG,CAAC,YAAY;QACpC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,CAAC,mBAAmB,EAAE,MAAM,CACtC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,YAAY,CACjD,CAAC,CAAC,CAAC,CAAA;IAER,IAAI,KAA2B,CAAA;IAE/B,IAAI,mBAAW,CAAC,gBAAgB,CAAC,cAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,iCAAyB,CAAC,KAAK,CAAC,CAAA;gBAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC;oBAC5C,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,CAAC,eAAe,CAAC;oBACzB,OAAO,EAAE;wBACP,EAAE,EAAE,QAAQ;qBACb;iBACF,CAAC,CAAA;gBAEF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;oBAC/B,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACxD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAA,wBAAgB,EACrB;QACE,QAAQ,EAAE,QAAQ,IAAI,EAAE;QACxB,UAAU,EAAE,SAAS;QACrB,gBAAgB,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE;QACxC,YAAY,EAAE;YACZ,CAAC,WAAW,CAAC,EAAE,QAAQ;YACvB,KAAK;SACN;QACD,aAAa,EAAE,gBAAgB,EAAE,aAAa,IAAI,EAAE;KACrD,EACD;QACE,MAAM;QACN,SAAS,EAAE,UAAU;QACrB,UAAU,EAAE,OAAO;KACpB,CACF,CAAA;AACH,CAAC"}

package/dist/api/auth/utils/validate-scope-provider-association.d.ts

@@ -0,0 +1,3 @@
+import { AcmeKitNextFunction, AcmeKitRequest, AcmeKitResponse } from "@acmekit/framework/http";
+export declare const validateScopeProviderAssociation: () => (req: AcmeKitRequest, _: AcmeKitResponse, next: AcmeKitNextFunction) => Promise<void>;
+//# sourceMappingURL=validate-scope-provider-association.d.ts.map

package/dist/api/auth/utils/validate-scope-provider-association.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-scope-provider-association.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/utils/validate-scope-provider-association.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAQhC,eAAO,MAAM,gCAAgC,SAEzC,KAAK,cAAc,EACnB,GAAG,eAAe,EAClB,MAAM,mBAAmB,kBAqB5B,CAAA"}

package/dist/api/auth/utils/validate-scope-provider-association.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateScopeProviderAssociation = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+// Middleware to validate that a scope is associated with a provider
+const validateScopeProviderAssociation = () => {
+    return async (req, _, next) => {
+        const { actor_type, auth_provider } = req.params;
+        const config = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+        const authMethodsPerActor = config.projectConfig?.http?.authMethodsPerActor ?? {};
+        // Not having the config defined would allow for all auth providers for the particular actor.
+        if (authMethodsPerActor[actor_type]) {
+            if (!authMethodsPerActor[actor_type].includes(auth_provider)) {
+                throw new utils_1.AcmeKitError(utils_1.AcmeKitError.Types.NOT_ALLOWED, `The actor type ${actor_type} is not allowed to use the auth provider ${auth_provider}`);
+            }
+        }
+        next();
+    };
+};
+exports.validateScopeProviderAssociation = validateScopeProviderAssociation;
+//# sourceMappingURL=validate-scope-provider-association.js.map

package/dist/api/auth/utils/validate-scope-provider-association.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-scope-provider-association.js","sourceRoot":"","sources":["../../../../src/api/auth/utils/validate-scope-provider-association.ts"],"names":[],"mappings":";;;AAMA,oDAGiC;AAEjC,oEAAoE;AAC7D,MAAM,gCAAgC,GAAG,GAAG,EAAE;IACnD,OAAO,KAAK,EACV,GAAmB,EACnB,CAAkB,EAClB,IAAyB,EACzB,EAAE;QACF,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,CAAA;QAChD,MAAM,MAAM,GAAiB,GAAG,CAAC,KAAK,CAAC,OAAO,CAC5C,iCAAyB,CAAC,aAAa,CACxC,CAAA;QAED,MAAM,mBAAmB,GACvB,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,mBAAmB,IAAI,EAAE,CAAA;QACvD,6FAA6F;QAC7F,IAAI,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,oBAAY,CACpB,oBAAY,CAAC,KAAK,CAAC,WAAW,EAC9B,kBAAkB,UAAU,4CAA4C,aAAa,EAAE,CACxF,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAA;IACR,CAAC,CAAA;AACH,CAAC,CAAA;AAzBY,QAAA,gCAAgC,oCAyB5C"}

package/dist/api/auth/utils/validate-token.d.ts

@@ -0,0 +1,9 @@
+import { AcmeKitNextFunction, AcmeKitRequest, AcmeKitResponse } from "@acmekit/framework/http";
+import { HttpTypes } from "@acmekit/types";
+export interface UpdateProviderJwtPayload {
+    entity_id: string;
+    actor_type: string;
+    provider: string;
+}
+export declare const validateToken: () => (req: AcmeKitRequest<HttpTypes.AdminUpdateProvider>, res: AcmeKitResponse, next: AcmeKitNextFunction) => Promise<void>;
+//# sourceMappingURL=validate-token.d.ts.map

package/dist/api/auth/utils/validate-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-token.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/utils/validate-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,mBAAmB,EACnB,cAAc,EACd,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAOhC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAGD,eAAO,MAAM,aAAa,SAEtB,KAAK,cAAc,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAClD,KAAK,eAAe,EACpB,MAAM,mBAAmB,kBA+D5B,CAAA"}

package/dist/api/auth/utils/validate-token.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateToken = void 0;
+const http_1 = require("@acmekit/framework/http");
+const utils_1 = require("@acmekit/framework/utils");
+// Middleware to validate that a token is valid
+const validateToken = () => {
+    return async (req, res, next) => {
+        const { actor_type, auth_provider } = req.params;
+        const req_ = req;
+        const { http } = req_.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE).projectConfig;
+        const token = (0, http_1.getAuthContextFromJwtToken)(req.headers.authorization, http.jwtSecret, ["bearer"], [actor_type], http.jwtPublicKey, http.jwtVerifyOptions ?? http.jwtOptions);
+        const errorObject = new utils_1.AcmeKitError(utils_1.AcmeKitError.Types.UNAUTHORIZED, `Invalid token`);
+        if (!token) {
+            return next(errorObject);
+        }
+        const authModule = req.scope.resolve(utils_1.Modules.AUTH);
+        if (!token?.entity_id) {
+            return next(errorObject);
+        }
+        const [providerIdentity] = await authModule.listProviderIdentities({
+            entity_id: token.entity_id,
+            provider: auth_provider,
+        }, {
+            select: [
+                "provider_metadata",
+                "auth_identity_id",
+                "entity_id",
+                "user_metadata",
+            ],
+        });
+        if (!providerIdentity) {
+            return next(errorObject);
+        }
+        req_.auth_context = {
+            actor_type,
+            auth_identity_id: providerIdentity.auth_identity_id,
+            actor_id: providerIdentity.entity_id,
+            app_metadata: {},
+            user_metadata: providerIdentity.user_metadata ?? {},
+        };
+        return next();
+    };
+};
+exports.validateToken = validateToken;
+//# sourceMappingURL=validate-token.js.map

package/dist/api/auth/utils/validate-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-token.js","sourceRoot":"","sources":["../../../../src/api/auth/utils/validate-token.ts"],"names":[],"mappings":";;;AAAA,kDAMgC;AAEhC,oDAIiC;AASjC,+CAA+C;AACxC,MAAM,aAAa,GAAG,GAAG,EAAE;IAChC,OAAO,KAAK,EACV,GAAkD,EAClD,GAAoB,EACpB,IAAyB,EACzB,EAAE;QACF,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,CAAA;QAEhD,MAAM,IAAI,GAAG,GAAkC,CAAA;QAE/C,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CACjC,iCAAyB,CAAC,aAAa,CACxC,CAAC,aAAa,CAAA;QAEf,MAAM,KAAK,GAAG,IAAA,iCAA0B,EACtC,GAAG,CAAC,OAAO,CAAC,aAAa,EACzB,IAAI,CAAC,SAAU,EACf,CAAC,QAAQ,CAAC,EACV,CAAC,UAAU,CAAC,EACZ,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,UAAU,CACN,CAAA;QAEpC,MAAM,WAAW,GAAG,IAAI,oBAAY,CAClC,oBAAY,CAAC,KAAK,CAAC,YAAY,EAC/B,eAAe,CAChB,CAAA;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,CAAC,CAAA;QAC1B,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;QAEtE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,WAAW,CAAC,CAAA;QAC1B,CAAC;QAED,MAAM,CAAC,gBAAgB,CAAC,GAAG,MAAM,UAAU,CAAC,sBAAsB,CAChE;YACE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,aAAa;SACxB,EACD;YACE,MAAM,EAAE;gBACN,mBAAmB;gBACnB,kBAAkB;gBAClB,WAAW;gBACX,eAAe;aAChB;SACF,CACF,CAAA;QAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,WAAW,CAAC,CAAA;QAC1B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG;YAClB,UAAU;YACV,gBAAgB,EAAE,gBAAgB,CAAC,gBAAiB;YACpD,QAAQ,EAAE,gBAAgB,CAAC,SAAS;YACpC,YAAY,EAAE,EAAE;YAChB,aAAa,EAAE,gBAAgB,CAAC,aAAa,IAAI,EAAE;SACpD,CAAA;QAED,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC,CAAA;AAnEY,QAAA,aAAa,iBAmEzB"}

package/dist/api/auth/validators.d.ts

@@ -0,0 +1,13 @@
+import { z } from "@acmekit/framework/zod";
+export declare const ResetPasswordRequest: z.ZodObject<{
+    identifier: z.ZodString;
+    metadata: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+}, "strip", z.ZodTypeAny, {
+    metadata: Record<string, unknown>;
+    identifier: string;
+}, {
+    identifier: string;
+    metadata?: Record<string, unknown> | undefined;
+}>;
+export type ResetPasswordRequestType = z.infer<typeof ResetPasswordRequest>;
+//# sourceMappingURL=validators.d.ts.map

package/dist/api/auth/validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../../src/api/auth/validators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAA;AAE1C,eAAO,MAAM,oBAAoB;;;;;;;;;EAG/B,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/api/auth/validators.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResetPasswordRequest = void 0;
+const zod_1 = require("@acmekit/framework/zod");
+exports.ResetPasswordRequest = zod_1.z.object({
+    identifier: zod_1.z.string(),
+    metadata: zod_1.z.record(zod_1.z.unknown()).optional().default({}),
+});
+//# sourceMappingURL=validators.js.map

package/dist/api/auth/validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../../src/api/auth/validators.ts"],"names":[],"mappings":";;;AAAA,gDAA0C;AAE7B,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAA"}

package/dist/api/cloud/auth/route.d.ts

@@ -0,0 +1,3 @@
+import { AcmeKitRequest, AcmeKitResponse } from "@acmekit/framework";
+export declare const GET: (req: AcmeKitRequest, res: AcmeKitResponse) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/cloud/auth/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/cloud/auth/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGpE,eAAO,MAAM,GAAG,GAAU,KAAK,cAAc,EAAE,KAAK,eAAe,kBAOlE,CAAA"}

package/dist/api/cloud/auth/route.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const GET = async (req, res) => {
+    const config = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    res.status(200).json({
+        enabled: !!config.projectConfig.http.authMethodsPerActor?.user?.includes("cloud"),
+    });
+};
+exports.GET = GET;
+//# sourceMappingURL=route.js.map

package/dist/api/cloud/auth/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/cloud/auth/route.ts"],"names":[],"mappings":";;;AACA,oDAAoE;AAE7D,MAAM,GAAG,GAAG,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,EAAE;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,iCAAyB,CAAC,aAAa,CAAC,CAAA;IAEzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EACL,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC;KAC3E,CAAC,CAAA;AACJ,CAAC,CAAA;AAPY,QAAA,GAAG,OAOf"}

package/dist/api/cloud/auth/users/route.d.ts

@@ -0,0 +1,3 @@
+import { AuthenticatedAcmeKitRequest, AcmeKitResponse } from "@acmekit/framework/http";
+export declare const POST: (req: AuthenticatedAcmeKitRequest, res: AcmeKitResponse) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/cloud/auth/users/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/cloud/auth/users/route.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,2BAA2B,EAC3B,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAMhC,eAAO,MAAM,IAAI,GACf,KAAK,2BAA2B,EAChC,KAAK,eAAe,kBAuFrB,CAAA"}