@adaptive-ds/project-registry 0.2.3

package/dist/zitadel/ZitadelJwk.d.ts

@@ -0,0 +1,12 @@
+export type ZitadelJwk = {
+    kty: string;
+    kid: string;
+    use?: string;
+    alg?: string;
+    n?: string;
+    e?: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+};
+//# sourceMappingURL=ZitadelJwk.d.ts.map

package/dist/zitadel/ZitadelJwk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelJwk.d.ts","sourceRoot":"","sources":["../../src/zitadel/ZitadelJwk.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;CACX,CAAA"}

package/dist/zitadel/ZitadelJwk.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ZitadelJwk.js.map

package/dist/zitadel/ZitadelJwk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelJwk.js","sourceRoot":"","sources":["../../src/zitadel/ZitadelJwk.ts"],"names":[],"mappings":""}

package/dist/zitadel/ZitadelJwks.d.ts

@@ -0,0 +1,5 @@
+import type { ZitadelJwk } from "./ZitadelJwk.js";
+export type ZitadelJwks = {
+    keys: readonly ZitadelJwk[];
+};
+//# sourceMappingURL=ZitadelJwks.d.ts.map

package/dist/zitadel/ZitadelJwks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelJwks.d.ts","sourceRoot":"","sources":["../../src/zitadel/ZitadelJwks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,SAAS,UAAU,EAAE,CAAA;CAC5B,CAAA"}

package/dist/zitadel/ZitadelJwks.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ZitadelJwks.js.map

package/dist/zitadel/ZitadelJwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelJwks.js","sourceRoot":"","sources":["../../src/zitadel/ZitadelJwks.ts"],"names":[],"mappings":""}

package/dist/zitadel/ZitadelLoginStartOptions.d.ts

@@ -0,0 +1,17 @@
+import type { Clock } from "../session/Clock.js";
+import type { RandomBytes } from "../session/RandomBytes.js";
+import type { LoginTransactionStore } from "./LoginTransactionStore.js";
+import type { ZitadelHttp } from "./ZitadelHttp.js";
+import type { ZitadelHttpOptions } from "./ZitadelHttpOptions.js";
+import type { ZitadelOidcConfig } from "./ZitadelOidcConfig.js";
+export type ZitadelLoginStartOptions = {
+    config: ZitadelOidcConfig;
+    http: ZitadelHttp;
+    transactions: LoginTransactionStore;
+    clock?: Clock;
+    randomBytes?: RandomBytes;
+    timeoutMs?: ZitadelHttpOptions["timeoutMs"];
+    signal?: ZitadelHttpOptions["signal"];
+    maxBodyBytes?: ZitadelHttpOptions["maxBodyBytes"];
+};
+//# sourceMappingURL=ZitadelLoginStartOptions.d.ts.map

package/dist/zitadel/ZitadelLoginStartOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelLoginStartOptions.d.ts","sourceRoot":"","sources":["../../src/zitadel/ZitadelLoginStartOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,EAAE,WAAW,CAAA;IACjB,YAAY,EAAE,qBAAqB,CAAA;IACnC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,SAAS,CAAC,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACrC,YAAY,CAAC,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAA;CAClD,CAAA"}

package/dist/zitadel/ZitadelLoginStartOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ZitadelLoginStartOptions.js.map

package/dist/zitadel/ZitadelLoginStartOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelLoginStartOptions.js","sourceRoot":"","sources":["../../src/zitadel/ZitadelLoginStartOptions.ts"],"names":[],"mappings":""}

package/dist/zitadel/ZitadelLoginStartResult.d.ts

@@ -0,0 +1,6 @@
+export type ZitadelLoginStartResult = {
+    authorizationUrl: string;
+    state: string;
+    setCookie: string;
+};
+//# sourceMappingURL=ZitadelLoginStartResult.d.ts.map

package/dist/zitadel/ZitadelLoginStartResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelLoginStartResult.d.ts","sourceRoot":"","sources":["../../src/zitadel/ZitadelLoginStartResult.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,uBAAuB,GAAG;IACpC,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA"}

package/dist/zitadel/ZitadelLoginStartResult.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ZitadelLoginStartResult.js.map

package/dist/zitadel/ZitadelLoginStartResult.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelLoginStartResult.js","sourceRoot":"","sources":["../../src/zitadel/ZitadelLoginStartResult.ts"],"names":[],"mappings":""}

package/dist/zitadel/ZitadelOidcConfig.d.ts

@@ -0,0 +1,10 @@
+export type ZitadelOidcConfig = {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    callbackUrl: string;
+    scope?: readonly string[];
+    clockSkewSeconds?: number;
+    loginTransactionMaxAgeSeconds?: number;
+};
+//# sourceMappingURL=ZitadelOidcConfig.d.ts.map

package/dist/zitadel/ZitadelOidcConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelOidcConfig.d.ts","sourceRoot":"","sources":["../../src/zitadel/ZitadelOidcConfig.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,6BAA6B,CAAC,EAAE,MAAM,CAAA;CACvC,CAAA"}

package/dist/zitadel/ZitadelOidcConfig.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ZitadelOidcConfig.js.map

package/dist/zitadel/ZitadelOidcConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelOidcConfig.js","sourceRoot":"","sources":["../../src/zitadel/ZitadelOidcConfig.ts"],"names":[],"mappings":""}

package/dist/zitadel/ZitadelPreAuthCookieOptions.d.ts

@@ -0,0 +1,4 @@
+export type ZitadelPreAuthCookieOptions = {
+    maxAgeSeconds?: number;
+};
+//# sourceMappingURL=ZitadelPreAuthCookieOptions.d.ts.map

package/dist/zitadel/ZitadelPreAuthCookieOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelPreAuthCookieOptions.d.ts","sourceRoot":"","sources":["../../src/zitadel/ZitadelPreAuthCookieOptions.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,2BAA2B,GAAG;IACxC,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA"}

package/dist/zitadel/ZitadelPreAuthCookieOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ZitadelPreAuthCookieOptions.js.map

package/dist/zitadel/ZitadelPreAuthCookieOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelPreAuthCookieOptions.js","sourceRoot":"","sources":["../../src/zitadel/ZitadelPreAuthCookieOptions.ts"],"names":[],"mappings":""}

package/dist/zitadel/ZitadelTokenExchangeOptions.d.ts

@@ -0,0 +1,17 @@
+import type { Clock } from "../session/Clock.js";
+import type { ZitadelDiscoveryDocument } from "./ZitadelDiscoveryDocument.js";
+import type { ZitadelHttp } from "./ZitadelHttp.js";
+import type { ZitadelHttpOptions } from "./ZitadelHttpOptions.js";
+import type { ZitadelOidcConfig } from "./ZitadelOidcConfig.js";
+export type ZitadelTokenExchangeOptions = {
+    config: ZitadelOidcConfig;
+    discovery: ZitadelDiscoveryDocument;
+    http: ZitadelHttp;
+    code: string;
+    codeVerifier: string;
+    clock?: Clock;
+    timeoutMs?: ZitadelHttpOptions["timeoutMs"];
+    signal?: ZitadelHttpOptions["signal"];
+    maxBodyBytes?: ZitadelHttpOptions["maxBodyBytes"];
+};
+//# sourceMappingURL=ZitadelTokenExchangeOptions.d.ts.map

package/dist/zitadel/ZitadelTokenExchangeOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelTokenExchangeOptions.d.ts","sourceRoot":"","sources":["../../src/zitadel/ZitadelTokenExchangeOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,iBAAiB,CAAA;IACzB,SAAS,EAAE,wBAAwB,CAAA;IACnC,IAAI,EAAE,WAAW,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,SAAS,CAAC,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACrC,YAAY,CAAC,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAA;CAClD,CAAA"}

package/dist/zitadel/ZitadelTokenExchangeOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ZitadelTokenExchangeOptions.js.map

package/dist/zitadel/ZitadelTokenExchangeOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelTokenExchangeOptions.js","sourceRoot":"","sources":["../../src/zitadel/ZitadelTokenExchangeOptions.ts"],"names":[],"mappings":""}

package/dist/zitadel/ZitadelTokens.d.ts

@@ -0,0 +1,7 @@
+export type ZitadelTokens = {
+    accessToken: string;
+    refreshToken?: string;
+    idToken: string;
+    expiresAt?: number;
+};
+//# sourceMappingURL=ZitadelTokens.d.ts.map

package/dist/zitadel/ZitadelTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelTokens.d.ts","sourceRoot":"","sources":["../../src/zitadel/ZitadelTokens.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA"}

package/dist/zitadel/ZitadelTokens.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ZitadelTokens.js.map

package/dist/zitadel/ZitadelTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZitadelTokens.js","sourceRoot":"","sources":["../../src/zitadel/ZitadelTokens.ts"],"names":[],"mappings":""}

package/dist/zitadel/zitadelCallbackHandle.d.ts

@@ -0,0 +1,5 @@
+import { type PromiseResult } from "#result";
+import type { ZitadelCallbackOptions } from "./ZitadelCallbackOptions.js";
+import type { ZitadelCallbackResult } from "./ZitadelCallbackResult.js";
+export declare function zitadelCallbackHandle(options: ZitadelCallbackOptions): PromiseResult<ZitadelCallbackResult>;
+//# sourceMappingURL=zitadelCallbackHandle.d.ts.map

package/dist/zitadel/zitadelCallbackHandle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadelCallbackHandle.d.ts","sourceRoot":"","sources":["../../src/zitadel/zitadelCallbackHandle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,aAAa,EAAE,MAAM,SAAS,CAAA;AAS7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAgGvE,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAgMjH"}

package/dist/zitadel/zitadelCallbackHandle.js

@@ -0,0 +1,255 @@
+import { createResult, createResultError } from "#result";
+import { preferredUsernameMap } from "../identity/preferredUsernameMap.js";
+import { userRoleResolve } from "../identity/userRoleResolve.js";
+import { clockNowResolve } from "../runtime/clockNowResolve.js";
+import { promiseBoundedRace } from "../runtime/promiseBoundedRace.js";
+import { timeMillisecondsValidate } from "../runtime/timeMillisecondsValidate.js";
+import { sessionCookieSerialize } from "../session/sessionCookieSerialize.js";
+import { sessionRecordValidate } from "../session/sessionRecordValidate.js";
+import { tokenReferenceIdValidate } from "../session/tokenReferenceIdValidate.js";
+import { zitadelConfigValidate } from "./zitadelConfigValidate.js";
+import { zitadelDiscoveryFetch } from "./zitadelDiscoveryFetch.js";
+import { zitadelIdTokenValidate } from "./zitadelIdTokenValidate.js";
+import { zitadelJwksFetch } from "./zitadelJwksFetch.js";
+import { zitadelPreAuthCookieClear } from "./zitadelPreAuthCookieClear.js";
+import { zitadelPreAuthCookieHash } from "./zitadelPreAuthCookieHash.js";
+import { zitadelPreAuthCookieParse } from "./zitadelPreAuthCookieParse.js";
+import { zitadelTokenExchange } from "./zitadelTokenExchange.js";
+function callbackError(op, message) {
+    const clearR = zitadelPreAuthCookieClear();
+    return createResultError(op, message, clearR.success ? clearR.data : null);
+}
+async function callbackCleanup(sessionId, tokenReference, options) {
+    const cleanupOperations = [];
+    if (sessionId !== undefined) {
+        cleanupOperations.push(promiseBoundedRace(Promise.resolve().then(() => options.sessions.revoke(sessionId)), options));
+    }
+    if (tokenReference !== undefined) {
+        cleanupOperations.push(promiseBoundedRace(Promise.resolve().then(() => options.tokenReferences.remove(tokenReference)), options));
+    }
+    await Promise.allSettled(cleanupOperations);
+}
+function callbackTokenReferenceResolve(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const result = value;
+    if (result.success !== true)
+        return undefined;
+    const referenceR = tokenReferenceIdValidate(result.data);
+    return referenceR.success ? referenceR.data : undefined;
+}
+function callbackSessionRecordResolve(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const result = value;
+    if (result.success !== true)
+        return undefined;
+    const sessionR = sessionRecordValidate(result.data);
+    return sessionR.success ? sessionR.data : undefined;
+}
+function callbackLateTokenReferenceCleanup(operation, options) {
+    void operation.then(async (value) => {
+        const reference = callbackTokenReferenceResolve(value);
+        if (reference === undefined)
+            return;
+        try {
+            await options.tokenReferences.remove(reference);
+        }
+        catch {
+            // Late cleanup is best effort.
+        }
+    }, () => undefined);
+}
+function callbackLateSessionCleanup(operation, tokenReference, options) {
+    void operation.then(async (value) => {
+        const session = callbackSessionRecordResolve(value);
+        if (session === undefined)
+            return;
+        void Promise.resolve()
+            .then(() => options.sessions.revoke(session.id))
+            .catch(() => undefined);
+        void Promise.resolve()
+            .then(() => options.tokenReferences.remove(tokenReference))
+            .catch(() => undefined);
+        if (session.tokenReference !== tokenReference) {
+            void Promise.resolve()
+                .then(() => options.tokenReferences.remove(session.tokenReference))
+                .catch(() => undefined);
+        }
+    }, () => undefined);
+}
+export async function zitadelCallbackHandle(options) {
+    const op = "zitadelCallbackHandle";
+    const configR = zitadelConfigValidate(options.config);
+    if (!configR.success)
+        return callbackError(op, "login configuration is invalid");
+    if (options.callbackUrl !== configR.data.callbackUrl || !(options.query instanceof URLSearchParams)) {
+        return callbackError(op, "login callback is invalid");
+    }
+    const state = options.query.get("state");
+    const code = options.query.get("code");
+    const error = options.query.get("error");
+    if (state === null || state.length !== 43 || !/^[A-Za-z0-9_-]{43}$/.test(state)) {
+        return callbackError(op, "login callback is invalid");
+    }
+    if (code !== null && (code.length === 0 || code.length > 4096))
+        return callbackError(op, "login callback is invalid");
+    if (error !== null && error.length > 256)
+        return callbackError(op, "login callback is invalid");
+    const clock = options.clock ?? Date.now;
+    const initialNowR = clockNowResolve(clock);
+    if (!initialNowR.success)
+        return callbackError(op, "login session could not be created");
+    let sessionId;
+    let tokenReference;
+    try {
+        const transactionR = await promiseBoundedRace(Promise.resolve().then(() => options.transactions.consume(state)), options);
+        if (!transactionR.success ||
+            transactionR.data.success !== true ||
+            transactionR.data.data.callbackUrl !== configR.data.callbackUrl) {
+            return callbackError(op, "login callback is invalid");
+        }
+        const preAuthCookieR = zitadelPreAuthCookieParse(options.cookieHeader);
+        if (!preAuthCookieR.success)
+            return callbackError(op, "login callback is invalid");
+        const preAuthCookieHashR = await zitadelPreAuthCookieHash(preAuthCookieR.data);
+        if (!preAuthCookieHashR.success || preAuthCookieHashR.data !== transactionR.data.data.preAuthCookieHash) {
+            return callbackError(op, "login callback is invalid");
+        }
+        if (error !== null || code === null || code.length === 0) {
+            return callbackError(op, "login callback is invalid");
+        }
+        const discoveryR = await zitadelDiscoveryFetch(configR.data, options.http, {
+            timeoutMs: options.timeoutMs,
+            signal: options.signal,
+            maxBodyBytes: options.maxBodyBytes,
+        });
+        if (!discoveryR.success)
+            return callbackError(op, "login provider is unavailable");
+        const tokensR = await zitadelTokenExchange({
+            config: configR.data,
+            discovery: discoveryR.data,
+            http: options.http,
+            code,
+            codeVerifier: transactionR.data.data.codeVerifier,
+            clock,
+            timeoutMs: options.timeoutMs,
+            signal: options.signal,
+            maxBodyBytes: options.maxBodyBytes,
+        });
+        if (!tokensR.success)
+            return callbackError(op, "login provider rejected the callback");
+        const jwksR = await zitadelJwksFetch(discoveryR.data.jwksUri, options.http, {
+            timeoutMs: options.timeoutMs,
+            signal: options.signal,
+            maxBodyBytes: options.maxBodyBytes,
+        });
+        if (!jwksR.success)
+            return callbackError(op, "login provider is unavailable");
+        const claimsR = await zitadelIdTokenValidate(tokensR.data.idToken, configR.data, transactionR.data.data.nonce, jwksR.data, clock);
+        if (!claimsR.success)
+            return callbackError(op, "login provider returned an invalid identity");
+        const tokenExpiresAt = tokensR.data.expiresAt ?? claimsR.data.expiresAt;
+        const expiresAt = Math.min(tokenExpiresAt, claimsR.data.expiresAt);
+        const tokenIsCurrent = () => {
+            const nowR = clockNowResolve(clock);
+            return nowR.success && timeMillisecondsValidate(expiresAt) && expiresAt > nowR.data;
+        };
+        const currentUsernameR = await promiseBoundedRace(Promise.resolve().then(() => options.identityDirectory.userPreferredUsernameResolve(claimsR.data.subject, tokensR.data.accessToken)), options);
+        if (!currentUsernameR.success || currentUsernameR.data.success !== true || !tokenIsCurrent()) {
+            return callbackError(op, "login user mapping is unavailable");
+        }
+        if (currentUsernameR.data.data !== claimsR.data.preferredUsername) {
+            return callbackError(op, "login user mapping is unavailable");
+        }
+        const usernameR = await preferredUsernameMap(claimsR.data.preferredUsername, options.posixUsers, options);
+        if (!usernameR.success || !tokenIsCurrent())
+            return callbackError(op, "login user mapping is unavailable");
+        const roleR = await userRoleResolve(claimsR.data.subject, tokensR.data.accessToken, options.identityDirectory, options);
+        if (!roleR.success || !tokenIsCurrent())
+            return callbackError(op, "login user role is unavailable");
+        if (!timeMillisecondsValidate(expiresAt)) {
+            return callbackError(op, "login session could not be created");
+        }
+        const tokenSaveOperation = Promise.resolve().then(() => options.tokenReferences.save({
+            accessToken: tokensR.data.accessToken,
+            refreshToken: tokensR.data.refreshToken,
+            expiresAt,
+        }, { signal: options.signal }));
+        const tokenR = await promiseBoundedRace(tokenSaveOperation, options);
+        if (!tokenR.success) {
+            callbackLateTokenReferenceCleanup(tokenSaveOperation, options);
+            return callbackError(op, "login session could not be created");
+        }
+        if (tokenR.data.success !== true)
+            return callbackError(op, "login session could not be created");
+        const tokenReferenceR = tokenReferenceIdValidate(tokenR.data.data);
+        if (!tokenReferenceR.success)
+            return callbackError(op, "login session could not be created");
+        const tokenReferenceValue = tokenReferenceR.data;
+        tokenReference = tokenReferenceValue;
+        if (!tokenIsCurrent()) {
+            await callbackCleanup(undefined, tokenReferenceValue, options);
+            return callbackError(op, "login session could not be created");
+        }
+        const sessionCreateOperation = Promise.resolve().then(() => options.sessions.create({
+            subject: claimsR.data.subject,
+            username: usernameR.data,
+            tokenReference: tokenReferenceValue,
+        }, { signal: options.signal }));
+        const sessionR = await promiseBoundedRace(sessionCreateOperation, options);
+        if (!sessionR.success) {
+            callbackLateSessionCleanup(sessionCreateOperation, tokenReferenceValue, options);
+            await callbackCleanup(undefined, tokenReferenceValue, options);
+            return callbackError(op, "login session could not be created");
+        }
+        if (sessionR.data.success !== true) {
+            await callbackCleanup(undefined, tokenReferenceValue, options);
+            return callbackError(op, "login session could not be created");
+        }
+        const sessionRecordR = sessionRecordValidate(sessionR.data.data);
+        if (!sessionRecordR.success ||
+            sessionRecordR.data.subject !== claimsR.data.subject ||
+            sessionRecordR.data.username !== usernameR.data ||
+            sessionRecordR.data.tokenReference !== tokenReferenceValue) {
+            await callbackCleanup(undefined, tokenReferenceValue, options);
+            return callbackError(op, "login session could not be created");
+        }
+        const sessionRecord = sessionRecordR.data;
+        sessionId = sessionRecord.id;
+        if (!tokenIsCurrent()) {
+            await callbackCleanup(sessionRecord.id, tokenReferenceValue, options);
+            return callbackError(op, "login session could not be created");
+        }
+        const sessionNowR = clockNowResolve(clock);
+        if (!sessionNowR.success || sessionRecord.expiresAt <= sessionNowR.data) {
+            await callbackCleanup(sessionRecord.id, tokenReferenceValue, options);
+            return callbackError(op, "login session could not be created");
+        }
+        const cookieR = sessionCookieSerialize(sessionRecord.id, {
+            ...options.cookie,
+            maxAgeSeconds: Math.max(1, Math.ceil((sessionRecord.expiresAt - sessionNowR.data) / 1000)),
+        });
+        if (!cookieR.success) {
+            await callbackCleanup(sessionRecord.id, tokenReferenceValue, options);
+            return callbackError(op, "login session could not be created");
+        }
+        const clearPreAuthCookieR = zitadelPreAuthCookieClear();
+        if (!clearPreAuthCookieR.success) {
+            await callbackCleanup(sessionRecord.id, tokenReferenceValue, options);
+            return callbackError(op, "login session could not be created");
+        }
+        return createResult({
+            setCookie: cookieR.data,
+            clearPreAuthCookie: clearPreAuthCookieR.data,
+            subject: claimsR.data.subject,
+            username: usernameR.data,
+            expiresAt: sessionRecord.expiresAt,
+        });
+    }
+    catch {
+        await callbackCleanup(sessionId, tokenReference, options);
+        return callbackError(op, "login callback could not be completed");
+    }
+}
+//# sourceMappingURL=zitadelCallbackHandle.js.map

package/dist/zitadel/zitadelCallbackHandle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadelCallbackHandle.js","sourceRoot":"","sources":["../../src/zitadel/zitadelCallbackHandle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAsB,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAA;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAA;AAGjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAEhE,SAAS,aAAa,CAAC,EAAU,EAAE,OAAe;IAChD,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAA;IAC1C,OAAO,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AAC5E,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAA6B,EAC7B,cAAkC,EAClC,OAA+B;IAE/B,MAAM,iBAAiB,GAAuB,EAAE,CAAA;IAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,iBAAiB,CAAC,IAAI,CACpB,kBAAkB,CAChB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAChE,OAAO,CACR,CACF,CAAA;IACH,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,iBAAiB,CAAC,IAAI,CACpB,kBAAkB,CAChB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAC5E,OAAO,CACR,CACF,CAAA;IACH,CAAC;IACD,MAAM,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzF,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC7C,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACzD,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzF,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC7C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACrD,CAAC;AAED,SAAS,iCAAiC,CAAC,SAA2B,EAAE,OAA+B;IACrG,KAAK,SAAS,CAAC,IAAI,CACjB,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,MAAM,SAAS,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,SAAS,KAAK,SAAS;YAAE,OAAM;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAA;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,SAA2B,EAC3B,cAAsB,EACtB,OAA+B;IAE/B,KAAK,SAAS,CAAC,IAAI,CACjB,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAM;QACjC,KAAK,OAAO,CAAC,OAAO,EAAE;aACnB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;aAC/C,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACzB,KAAK,OAAO,CAAC,OAAO,EAAE;aACnB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;aAC1D,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACzB,IAAI,OAAO,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;YAC9C,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;iBAClE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA+B;IACzE,MAAM,EAAE,GAAG,uBAAuB,CAAA;IAClC,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACrD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAA;IAChF,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,YAAY,eAAe,CAAC,EAAE,CAAC;QACpG,OAAO,aAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,aAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IACrH,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,aAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAA;IACvC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,CAAC,WAAW,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;IACxF,IAAI,SAA6B,CAAA;IACjC,IAAI,cAAkC,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EACjE,OAAO,CACR,CAAA;QACD,IACE,CAAC,YAAY,CAAC,OAAO;YACrB,YAAY,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;YAClC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW,EAC/D,CAAC;YACD,OAAO,aAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,cAAc,GAAG,yBAAyB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QACtE,IAAI,CAAC,cAAc,CAAC,OAAO;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;QAClF,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QAC9E,IAAI,CAAC,kBAAkB,CAAC,OAAO,IAAI,kBAAkB,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxG,OAAO,aAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,aAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YACzE,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAA;QAClF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;YACzC,MAAM,EAAE,OAAO,CAAC,IAAI;YACpB,SAAS,EAAE,UAAU,CAAC,IAAI;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI;YACJ,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY;YACjD,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,sCAAsC,CAAC,CAAA;QACtF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;YAC1E,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAA;QAC7E,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,OAAO,CAAC,IAAI,CAAC,OAAO,EACpB,OAAO,CAAC,IAAI,EACZ,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAC5B,KAAK,CAAC,IAAI,EACV,KAAK,CACN,CAAA;QACD,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,6CAA6C,CAAC,CAAA;QAC7F,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAA;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,MAAM,cAAc,GAAG,GAAY,EAAE;YACnC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;YACnC,OAAO,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,CAAA;QACrF,CAAC,CAAA;QACD,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAC/C,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAC1B,OAAO,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CACvG,EACD,OAAO,CACR,CAAA;QACD,IAAI,CAAC,gBAAgB,CAAC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7F,OAAO,aAAa,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACzG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;QAC1G,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,OAAO,CAAC,IAAI,CAAC,OAAO,EACpB,OAAO,CAAC,IAAI,CAAC,WAAW,EACxB,OAAO,CAAC,iBAAiB,EACzB,OAAO,CACR,CAAA;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAA;QACnG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CACrD,OAAO,CAAC,eAAe,CAAC,IAAI,CAC1B;YACE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;YACvC,SAAS;SACV,EACD,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAC3B,CACF,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;QACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,iCAAiC,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;YAC9D,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChG,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClE,IAAI,CAAC,eAAe,CAAC,OAAO;YAAE,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAC5F,MAAM,mBAAmB,GAAG,eAAe,CAAC,IAAI,CAAA;QAChD,cAAc,GAAG,mBAAmB,CAAA;QACpC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,MAAM,eAAe,CAAC,SAAS,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;YAC9D,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CACrB;YACE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;YAC7B,QAAQ,EAAE,SAAS,CAAC,IAAI;YACxB,cAAc,EAAE,mBAAmB;SACpC,EACD,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAC3B,CACF,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAA;QAC1E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,0BAA0B,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;YAChF,MAAM,eAAe,CAAC,SAAS,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;YAC9D,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,eAAe,CAAC,SAAS,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;YAC9D,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,IACE,CAAC,cAAc,CAAC,OAAO;YACvB,cAAc,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,OAAO;YACpD,cAAc,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI;YAC/C,cAAc,CAAC,IAAI,CAAC,cAAc,KAAK,mBAAmB,EAC1D,CAAC;YACD,MAAM,eAAe,CAAC,SAAS,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;YAC9D,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAA;QACzC,SAAS,GAAG,aAAa,CAAC,EAAE,CAAA;QAC5B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;YACrE,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QAC1C,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,aAAa,CAAC,SAAS,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;YACxE,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;YACrE,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,aAAa,CAAC,EAAE,EAAE;YACvD,GAAG,OAAO,CAAC,MAAM;YACjB,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;SAC3F,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;YACrE,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,mBAAmB,GAAG,yBAAyB,EAAE,CAAA;QACvD,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;YACrE,OAAO,aAAa,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,YAAY,CAAC;YAClB,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,kBAAkB,EAAE,mBAAmB,CAAC,IAAI;YAC5C,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;YAC7B,QAAQ,EAAE,SAAS,CAAC,IAAI;YACxB,SAAS,EAAE,aAAa,CAAC,SAAS;SACnC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,CAAA;QACzD,OAAO,aAAa,CAAC,EAAE,EAAE,uCAAuC,CAAC,CAAA;IACnE,CAAC;AACH,CAAC"}

package/dist/zitadel/zitadelConfigValidate.d.ts

@@ -0,0 +1,4 @@
+import { type Result } from "#result";
+import type { ZitadelOidcConfig } from "./ZitadelOidcConfig.js";
+export declare function zitadelConfigValidate(config: unknown): Result<ZitadelOidcConfig>;
+//# sourceMappingURL=zitadelConfigValidate.d.ts.map

package/dist/zitadel/zitadelConfigValidate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadelConfigValidate.d.ts","sourceRoot":"","sources":["../../src/zitadel/zitadelConfigValidate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AA4B/D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAuEhF"}

package/dist/zitadel/zitadelConfigValidate.js

@@ -0,0 +1,88 @@
+import { createResult, createResultError } from "#result";
+function urlIsExactOrigin(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === "https:" &&
+            url.username.length === 0 &&
+            url.password.length === 0 &&
+            url.hash.length === 0 &&
+            url.search.length === 0 &&
+            url.pathname === "/" &&
+            url.origin === value);
+    }
+    catch {
+        return false;
+    }
+}
+function callbackUrlIsValid(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && url.username.length === 0 && url.password.length === 0 && url.hash.length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function zitadelConfigValidate(config) {
+    const op = "zitadelConfigValidate";
+    if (typeof config !== "object" || config === null || Array.isArray(config)) {
+        return createResultError(op, "Zitadel configuration is invalid");
+    }
+    const values = config;
+    const issuer = values.issuer;
+    const clientId = values.clientId;
+    const clientSecret = values.clientSecret;
+    const callbackUrl = values.callbackUrl;
+    const scope = values.scope;
+    const clockSkewSeconds = values.clockSkewSeconds;
+    const loginTransactionMaxAgeSeconds = values.loginTransactionMaxAgeSeconds;
+    const validClockSkewSeconds = clockSkewSeconds === undefined ? undefined : typeof clockSkewSeconds === "number" ? clockSkewSeconds : null;
+    const validLoginTransactionMaxAgeSeconds = loginTransactionMaxAgeSeconds === undefined
+        ? undefined
+        : typeof loginTransactionMaxAgeSeconds === "number"
+            ? loginTransactionMaxAgeSeconds
+            : null;
+    if (typeof issuer !== "string" ||
+        issuer.length > 2048 ||
+        !urlIsExactOrigin(issuer) ||
+        typeof clientId !== "string" ||
+        clientId.length === 0 ||
+        clientId.length > 256 ||
+        (clientSecret !== undefined &&
+            (typeof clientSecret !== "string" || clientSecret.length === 0 || clientSecret.length > 4096)) ||
+        typeof callbackUrl !== "string" ||
+        callbackUrl.length > 2048 ||
+        !callbackUrlIsValid(callbackUrl)) {
+        return createResultError(op, "Zitadel configuration is invalid");
+    }
+    if (scope !== undefined &&
+        (!Array.isArray(scope) ||
+            scope.length === 0 ||
+            scope.length > 32 ||
+            scope.some((entry) => typeof entry !== "string" || entry.length === 0 || entry.length > 128) ||
+            !scope.includes("openid"))) {
+        return createResultError(op, "Zitadel configuration is invalid");
+    }
+    if (validClockSkewSeconds === null ||
+        (validClockSkewSeconds !== undefined &&
+            (!Number.isInteger(validClockSkewSeconds) || validClockSkewSeconds < 0 || validClockSkewSeconds > 3600))) {
+        return createResultError(op, "Zitadel configuration is invalid");
+    }
+    if (validLoginTransactionMaxAgeSeconds === null ||
+        (validLoginTransactionMaxAgeSeconds !== undefined &&
+            (!Number.isInteger(validLoginTransactionMaxAgeSeconds) ||
+                validLoginTransactionMaxAgeSeconds < 1 ||
+                validLoginTransactionMaxAgeSeconds > 900))) {
+        return createResultError(op, "Zitadel configuration is invalid");
+    }
+    return createResult({
+        issuer,
+        clientId,
+        clientSecret,
+        callbackUrl,
+        scope: scope,
+        clockSkewSeconds: validClockSkewSeconds ?? undefined,
+        loginTransactionMaxAgeSeconds: validLoginTransactionMaxAgeSeconds ?? undefined,
+    });
+}
+//# sourceMappingURL=zitadelConfigValidate.js.map

package/dist/zitadel/zitadelConfigValidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadelConfigValidate.js","sourceRoot":"","sources":["../../src/zitadel/zitadelConfigValidate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AAGtE,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YACvB,GAAG,CAAC,QAAQ,KAAK,GAAG;YACpB,GAAG,CAAC,MAAM,KAAK,KAAK,CACrB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAA;IACrH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,MAAM,EAAE,GAAG,uBAAuB,CAAA;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,iBAAiB,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAA;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAChC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAA;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;IAC1B,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAA;IAChD,MAAM,6BAA6B,GAAG,MAAM,CAAC,6BAA6B,CAAA;IAC1E,MAAM,qBAAqB,GACzB,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7G,MAAM,kCAAkC,GACtC,6BAA6B,KAAK,SAAS;QACzC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,6BAA6B,KAAK,QAAQ;YACjD,CAAC,CAAC,6BAA6B;YAC/B,CAAC,CAAC,IAAI,CAAA;IACZ,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,MAAM,GAAG,IAAI;QACpB,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACzB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,GAAG,GAAG;QACrB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAChG,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,CAAC,MAAM,GAAG,IAAI;QACzB,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAChC,CAAC;QACD,OAAO,iBAAiB,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAA;IAClE,CAAC;IACD,IACE,KAAK,KAAK,SAAS;QACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,KAAK,CAAC,MAAM,GAAG,EAAE;YACjB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;YAC5F,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAC5B,CAAC;QACD,OAAO,iBAAiB,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAA;IAClE,CAAC;IACD,IACE,qBAAqB,KAAK,IAAI;QAC9B,CAAC,qBAAqB,KAAK,SAAS;YAClC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,IAAI,qBAAqB,GAAG,CAAC,IAAI,qBAAqB,GAAG,IAAI,CAAC,CAAC,EAC1G,CAAC;QACD,OAAO,iBAAiB,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAA;IAClE,CAAC;IACD,IACE,kCAAkC,KAAK,IAAI;QAC3C,CAAC,kCAAkC,KAAK,SAAS;YAC/C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kCAAkC,CAAC;gBACpD,kCAAkC,GAAG,CAAC;gBACtC,kCAAkC,GAAG,GAAG,CAAC,CAAC,EAC9C,CAAC;QACD,OAAO,iBAAiB,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,MAAM;QACN,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,KAAK,EAAE,KAAsC;QAC7C,gBAAgB,EAAE,qBAAqB,IAAI,SAAS;QACpD,6BAA6B,EAAE,kCAAkC,IAAI,SAAS;KAC/E,CAAC,CAAA;AACJ,CAAC"}

package/dist/zitadel/zitadelDiscoveryFetch.d.ts

@@ -0,0 +1,7 @@
+import { type PromiseResult } from "#result";
+import type { ZitadelDiscoveryDocument } from "./ZitadelDiscoveryDocument.js";
+import type { ZitadelHttp } from "./ZitadelHttp.js";
+import type { ZitadelHttpOptions } from "./ZitadelHttpOptions.js";
+import type { ZitadelOidcConfig } from "./ZitadelOidcConfig.js";
+export declare function zitadelDiscoveryFetch(config: ZitadelOidcConfig, http: ZitadelHttp, options?: ZitadelHttpOptions): PromiseResult<ZitadelDiscoveryDocument>;
+//# sourceMappingURL=zitadelDiscoveryFetch.d.ts.map

package/dist/zitadel/zitadelDiscoveryFetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadelDiscoveryFetch.d.ts","sourceRoot":"","sources":["../../src/zitadel/zitadelDiscoveryFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAK/D,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE,kBAAuB,GAC/B,aAAa,CAAC,wBAAwB,CAAC,CAkDzC"}