@antelopejs/dms 0.0.1

package/dist/routes/auth/oauth/callback.d.ts

@@ -0,0 +1,11 @@
+import type { SessionModel, UserModel } from "@antelopejs/interface-dms/auth/db";
+import { type LoginOutcome } from "../session-response";
+export interface OAuthCallbackInput {
+    userModel: UserModel;
+    sessionModel: SessionModel;
+    providerId: string;
+    body: unknown;
+    userAgent: string;
+    ip: string;
+}
+export declare function oauthCallback({ userModel, sessionModel, providerId, body, userAgent, ip, }: OAuthCallbackInput): Promise<LoginOutcome>;

package/dist/routes/auth/oauth/callback.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthCallback = oauthCallback;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const account_notifications_1 = require("../../../utils/account-notifications");
+const auth_schema_1 = require("../../../validation/auth.schema");
+const invite_1 = require("../invite");
+const session_response_1 = require("../session-response");
+const config_1 = require("./config");
+const identity_resolution_1 = require("./identity-resolution");
+const state_1 = require("./state");
+const token_exchange_1 = require("./token-exchange");
+const HTTP_FORBIDDEN = 403;
+const EMAIL_NOT_VERIFIED_MESSAGE = "error.oauth.email_not_verified";
+async function oauthCallback({ userModel, sessionModel, providerId, body, userAgent, ip, }) {
+    const payload = (0, interface_api_util_1.assertValidation)(body, (v) => auth_schema_1.authSchema.oauthCallback.parse(v));
+    const enabled = (0, config_1.getEnabledOAuthProvider)(providerId);
+    (0, state_1.assertValidOAuthState)(payload.state, payload.state_cookie, providerId);
+    const accessToken = await (0, token_exchange_1.exchangeCodeForAccessToken)(enabled, payload.code);
+    const identity = await enabled.provider.fetchIdentity(accessToken);
+    if (payload.invite) {
+        (0, interface_api_util_1.assert)(identity.isEmailVerified, HTTP_FORBIDDEN, EMAIL_NOT_VERIFIED_MESSAGE);
+    }
+    const resolvedInvite = payload.invite
+        ? await (0, invite_1.resolveValidInvite)(payload.invite, identity.email)
+        : undefined;
+    const { user, isRegistration } = await (0, identity_resolution_1.resolveOAuthUser)(userModel, {
+        provider: providerId,
+        identity,
+        policy: (0, config_1.resolveOAuthPolicy)(),
+        hasValidInvitation: Boolean(resolvedInvite),
+        language: payload.language,
+    });
+    const { wasCreated } = await (0, auth_1.linkExternalIdentity)(user._id, {
+        provider: providerId,
+        providerAccountId: identity.providerAccountId,
+        email: identity.email,
+    });
+    if (wasCreated && !isRegistration) {
+        void (0, account_notifications_1.notifyLoginMethodAdded)(user._id, enabled.provider.displayName);
+    }
+    if (resolvedInvite) {
+        await (0, invite_1.consumeInvite)(userModel, user._id, resolvedInvite);
+        if (isRegistration) {
+            await (0, auth_1.announceRegistration)(userModel, user, resolvedInvite.tenantId);
+        }
+    }
+    return (0, session_response_1.resolveLoginOutcome)(sessionModel, user, userAgent, ip, resolvedInvite?.tenantId);
+}
+//# sourceMappingURL=callback.js.map

package/dist/routes/auth/oauth/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../../../src/routes/auth/oauth/callback.ts"],"names":[],"mappings":";;AAqDA,sCA4DC;AAjHD,uEAA0E;AAC1E,yDAGwC;AAKxC,gFAA8E;AAC9E,iEAA6D;AAC7D,sCAA8D;AAC9D,0DAA6E;AAC7E,qCAAuE;AACvE,+DAAyD;AACzD,mCAAgD;AAChD,qDAA8D;AAE9D,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAkC7D,KAAK,UAAU,aAAa,CAAC,EAClC,SAAS,EACT,YAAY,EACZ,UAAU,EACV,IAAI,EACJ,SAAS,EACT,EAAE,GACiB;IACnB,MAAM,OAAO,GAAG,IAAA,qCAAgB,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3C,wBAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAClC,CAAC;IACF,MAAM,OAAO,GAAG,IAAA,gCAAuB,EAAC,UAAU,CAAC,CAAC;IACpD,IAAA,6BAAqB,EAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAEvE,MAAM,WAAW,GAAG,MAAM,IAAA,2CAA0B,EAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IAEnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAA,2BAAM,EACJ,QAAQ,CAAC,eAAe,EACxB,cAAc,EACd,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM;QACnC,CAAC,CAAC,MAAM,IAAA,2BAAkB,EAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,IAAA,sCAAgB,EAAC,SAAS,EAAE;QACjE,QAAQ,EAAE,UAAU;QACpB,QAAQ;QACR,MAAM,EAAE,IAAA,2BAAkB,GAAE;QAC5B,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,CAAC,GAAG,EAAE;QAC1D,QAAQ,EAAE,UAAU;QACpB,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;IAEH,IAAI,UAAU,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,KAAK,IAAA,8CAAsB,EAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,IAAA,sBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,IAAA,2BAAoB,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,OAAO,IAAA,sCAAmB,EACxB,YAAY,EACZ,IAAI,EACJ,SAAS,EACT,EAAE,EACF,cAAc,EAAE,QAAQ,CACzB,CAAC;AACJ,CAAC"}

package/dist/routes/auth/oauth/config.d.ts

@@ -0,0 +1,21 @@
+import { type OAuthProviderCredentials } from "../../../config";
+import { type OAuthProvider } from "./providers";
+export declare const OAUTH_CALLBACK_PATH = "/auth/oauth";
+export interface OAuthPolicy {
+    allowAccountCreation: boolean;
+    linkByVerifiedEmail: boolean;
+}
+export interface EnabledOAuthProvider {
+    id: string;
+    provider: OAuthProvider;
+    credentials: OAuthProviderCredentials;
+}
+export declare function resolveOAuthPolicy(): OAuthPolicy;
+export interface OAuthProviderDescriptor {
+    id: string;
+    label: string;
+    icon: string;
+}
+export declare function listEnabledOAuthProviders(): OAuthProviderDescriptor[];
+export declare function getEnabledOAuthProvider(providerId: string): EnabledOAuthProvider;
+export declare function buildOAuthRedirectUri(providerId: string): string;

package/dist/routes/auth/oauth/config.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_CALLBACK_PATH = void 0;
+exports.resolveOAuthPolicy = resolveOAuthPolicy;
+exports.listEnabledOAuthProviders = listEnabledOAuthProviders;
+exports.getEnabledOAuthProvider = getEnabledOAuthProvider;
+exports.buildOAuthRedirectUri = buildOAuthRedirectUri;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const config_1 = require("../../../config");
+const providers_1 = require("./providers");
+const HTTP_NOT_FOUND = 404;
+const HTTP_INTERNAL_ERROR = 500;
+const PROVIDER_DISABLED_MESSAGE = "error.oauth.provider_disabled";
+const CALLBACK_BASE_URL_MISSING_MESSAGE = "error.oauth.callback_base_url_missing";
+const DEFAULT_ALLOW_ACCOUNT_CREATION = false;
+const DEFAULT_LINK_BY_VERIFIED_EMAIL = true;
+exports.OAUTH_CALLBACK_PATH = "/auth/oauth";
+const TRAILING_SLASH_PATTERN = /\/+$/;
+function hasCredentials(credentials) {
+    return Boolean(credentials?.clientId && credentials?.clientSecret);
+}
+function resolveOAuthPolicy() {
+    const oauth = (0, config_1.getAuthConfig)().oauth;
+    return {
+        allowAccountCreation: oauth?.allowAccountCreation ?? DEFAULT_ALLOW_ACCOUNT_CREATION,
+        linkByVerifiedEmail: oauth?.linkByVerifiedEmail ?? DEFAULT_LINK_BY_VERIFIED_EMAIL,
+    };
+}
+function listEnabledOAuthProviders() {
+    const configured = (0, config_1.getAuthConfig)().oauth?.providers ?? {};
+    return Object.entries(providers_1.OAUTH_PROVIDERS)
+        .filter(([id]) => hasCredentials(configured[id]))
+        .map(([id, provider]) => ({
+        id,
+        label: provider.displayName,
+        icon: provider.icon,
+    }));
+}
+function getEnabledOAuthProvider(providerId) {
+    const provider = providers_1.OAUTH_PROVIDERS[providerId];
+    const credentials = (0, config_1.getAuthConfig)().oauth?.providers?.[providerId];
+    (0, interface_api_util_1.assert)(provider && hasCredentials(credentials), HTTP_NOT_FOUND, PROVIDER_DISABLED_MESSAGE);
+    return {
+        id: providerId,
+        provider,
+        credentials: credentials,
+    };
+}
+function buildOAuthRedirectUri(providerId) {
+    const base = (0, config_1.getAuthConfig)().oauth?.callbackBaseUrl ?? (0, config_1.getClientBaseUrl)();
+    (0, interface_api_util_1.assert)(base, HTTP_INTERNAL_ERROR, CALLBACK_BASE_URL_MISSING_MESSAGE);
+    const origin = base.replace(TRAILING_SLASH_PATTERN, "");
+    return `${origin}${exports.OAUTH_CALLBACK_PATH}/${providerId}/callback`;
+}
+//# sourceMappingURL=config.js.map

package/dist/routes/auth/oauth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/routes/auth/oauth/config.ts"],"names":[],"mappings":";;;AAsCA,gDAQC;AAeD,8DASC;AAED,0DAiBC;AASD,sDAKC;AAvGD,uEAAwD;AACxD,4CAIyB;AACzB,2CAAkE;AAElE,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AAClE,MAAM,iCAAiC,GACrC,uCAAuC,CAAC;AAE1C,MAAM,8BAA8B,GAAG,KAAK,CAAC;AAC7C,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAK/B,QAAA,mBAAmB,GAAG,aAAa,CAAC;AACjD,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAatC,SAAS,cAAc,CAAC,WAAsC;IAC5D,OAAO,OAAO,CAAC,WAAW,EAAE,QAAQ,IAAI,WAAW,EAAE,YAAY,CAAC,CAAC;AACrE,CAAC;AAED,SAAgB,kBAAkB;IAChC,MAAM,KAAK,GAAG,IAAA,sBAAa,GAAE,CAAC,KAAK,CAAC;IACpC,OAAO;QACL,oBAAoB,EAClB,KAAK,EAAE,oBAAoB,IAAI,8BAA8B;QAC/D,mBAAmB,EACjB,KAAK,EAAE,mBAAmB,IAAI,8BAA8B;KAC/D,CAAC;AACJ,CAAC;AAeD,SAAgB,yBAAyB;IACvC,MAAM,UAAU,GAAG,IAAA,sBAAa,GAAE,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IAC1D,OAAO,MAAM,CAAC,OAAO,CAAC,2BAAe,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE;QACF,KAAK,EAAE,QAAQ,CAAC,WAAW;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAgB,uBAAuB,CACrC,UAAkB;IAElB,MAAM,QAAQ,GAAG,2BAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAA,sBAAa,GAAE,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;IAEnE,IAAA,2BAAM,EACJ,QAAQ,IAAI,cAAc,CAAC,WAAW,CAAC,EACvC,cAAc,EACd,yBAAyB,CAC1B,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,UAAU;QACd,QAAQ;QACR,WAAW,EAAE,WAAuC;KACrD,CAAC;AACJ,CAAC;AASD,SAAgB,qBAAqB,CAAC,UAAkB;IACtD,MAAM,IAAI,GAAG,IAAA,sBAAa,GAAE,CAAC,KAAK,EAAE,eAAe,IAAI,IAAA,yBAAgB,GAAE,CAAC;IAC1E,IAAA,2BAAM,EAAC,IAAI,EAAE,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,GAAG,MAAM,GAAG,2BAAmB,IAAI,UAAU,WAAW,CAAC;AAClE,CAAC"}

package/dist/routes/auth/oauth/identity-resolution.d.ts

@@ -0,0 +1,16 @@
+import { type User, type UserModel } from "@antelopejs/interface-dms/auth/db";
+import type { OAuthPolicy } from "./config";
+import type { ProviderIdentity } from "./providers";
+export interface ResolvedOAuthUser {
+    user: User;
+    isRegistration: boolean;
+}
+export interface OAuthResolutionRequest {
+    provider: string;
+    identity: ProviderIdentity;
+    policy: OAuthPolicy;
+    hasValidInvitation: boolean;
+    language?: string;
+}
+export declare function claimUnvalidatedAccount(userModel: UserModel, user: User, identity: ProviderIdentity, language: string): Promise<User>;
+export declare function resolveOAuthUser(userModel: UserModel, request: OAuthResolutionRequest): Promise<ResolvedOAuthUser>;

package/dist/routes/auth/oauth/identity-resolution.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claimUnvalidatedAccount = claimUnvalidatedAccount;
+exports.resolveOAuthUser = resolveOAuthUser;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const interface_database_1 = require("@antelopejs/interface-database");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const db_1 = require("@antelopejs/interface-dms/db");
+const db_2 = require("@antelopejs/interface-dms/auth/db");
+const auth_key_1 = require("../../../utils/auth-key");
+const linking_policy_1 = require("./linking-policy");
+const HTTP_INTERNAL_ERROR = 500;
+const USER_NOT_CREATED_MESSAGE = "error.oauth.user_not_created";
+const RESOLUTION_MISMATCH_MESSAGE = "error.oauth.resolution_mismatch";
+const DEFAULT_LANGUAGE = "en";
+async function findUserByIdentity(userModel, provider, providerAccountId) {
+    const identity = await (0, interface_database_decorators_1.GetModel)(db_2.UserExternalIdentityModel).getByProviderAccount(provider, providerAccountId);
+    if (!identity) {
+        return undefined;
+    }
+    return userModel.get(identity.userId);
+}
+async function claimUnvalidatedAccount(userModel, user, identity, language) {
+    await (0, interface_database_decorators_1.GetModel)(db_2.UserExternalIdentityModel).deleteByUserId(user._id);
+    user.name = identity.name;
+    user.language = language;
+    user.password = null;
+    user.authKey = (0, auth_key_1.generateAuthKey)();
+    user.isValidated = true;
+    user.validationToken = null;
+    user.validationRequestedAt = null;
+    user.forgotPasswordToken = null;
+    user.forgotPasswordRequestedAt = null;
+    user.twoFactorMethods = [];
+    user.twoFactorSecret = null;
+    user.twoFactorPendingSecret = null;
+    user.twoFactorBackupCodes = [];
+    user.twoFactorEmailCode = null;
+    user.twoFactorEmailCodeRequestedAt = null;
+    user.updatedAt = new Date();
+    await userModel.update(user);
+    return user;
+}
+async function createOAuthUser(userModel, email, identity, language) {
+    const now = new Date();
+    const ids = await userModel.insert({
+        createdAt: now,
+        updatedAt: now,
+        name: identity.name,
+        email,
+        password: null,
+        authKey: (0, auth_key_1.generateAuthKey)(),
+        isValidated: true,
+        owner: false,
+        language,
+    });
+    const user = ids[0] ? await userModel.get(ids[0]) : undefined;
+    (0, interface_api_util_1.assert)(user, HTTP_INTERNAL_ERROR, USER_NOT_CREATED_MESSAGE);
+    return user;
+}
+function requireResolvedUser(user) {
+    (0, interface_api_util_1.assert)(user, HTTP_INTERNAL_ERROR, RESOLUTION_MISMATCH_MESSAGE);
+    return user;
+}
+const RESOLUTION_HANDLERS = {
+    "use-linked": (context) => ({
+        user: requireResolvedUser(context.linkedUser),
+        isRegistration: false,
+    }),
+    "link-existing": (context) => ({
+        user: requireResolvedUser(context.sameEmailUser),
+        isRegistration: false,
+    }),
+    "claim-unvalidated": async (context) => ({
+        user: await claimUnvalidatedAccount(context.userModel, requireResolvedUser(context.sameEmailUser), context.identity, context.language),
+        isRegistration: true,
+    }),
+    create: async (context) => ({
+        user: await createOAuthUser(context.userModel, context.email, context.identity, context.language),
+        isRegistration: true,
+    }),
+};
+async function resolveOAuthUser(userModel, request) {
+    const { identity } = request;
+    const linkedUser = await findUserByIdentity(userModel, request.provider, identity.providerAccountId);
+    const email = identity.email.toLowerCase();
+    const sameEmailUser = linkedUser
+        ? undefined
+        : await userModel.getByEmail(email);
+    const belongsToWorkspace = !!sameEmailUser &&
+        (await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, interface_database_1.CROSS_INSTANCE).existsByUser(sameEmailUser._id));
+    const resolution = (0, linking_policy_1.decideOAuthResolution)({
+        hasLinkedAccount: Boolean(linkedUser),
+        hasAccountWithSameEmail: Boolean(sameEmailUser),
+        isSameEmailAccountValidated: Boolean(sameEmailUser?.isValidated),
+        hasValidInvitation: request.hasValidInvitation,
+        belongsToWorkspace,
+    }, identity, request.policy);
+    return RESOLUTION_HANDLERS[resolution]({
+        userModel,
+        identity,
+        email,
+        language: request.language || DEFAULT_LANGUAGE,
+        linkedUser,
+        sameEmailUser,
+    });
+}
+//# sourceMappingURL=identity-resolution.js.map

package/dist/routes/auth/oauth/identity-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-resolution.js","sourceRoot":"","sources":["../../../../src/routes/auth/oauth/identity-resolution.ts"],"names":[],"mappings":";;AA+EA,0DA2BC;AAyFD,4CA6CC;AAhPD,uEAAwD;AACxD,uEAAgE;AAChE,6FAAqE;AACrE,qDAAiE;AACjE,0DAI2C;AAC3C,sDAA0D;AAE1D,qDAA+E;AAG/E,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAChE,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AAEtE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AA0B9B,KAAK,UAAU,kBAAkB,CAC/B,SAAoB,EACpB,QAAgB,EAChB,iBAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAQ,EAC7B,8BAAyB,CAC1B,CAAC,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAEpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAqBM,KAAK,UAAU,uBAAuB,CAC3C,SAAoB,EACpB,IAAU,EACV,QAA0B,EAC1B,QAAgB;IAEhB,MAAM,IAAA,wCAAQ,EAAC,8BAAyB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEnE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,OAAO,GAAG,IAAA,0BAAe,GAAE,CAAC;IACjC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAClC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;IACtC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;IACnC,IAAI,CAAC,oBAAoB,GAAG,EAAE,CAAC;IAC/B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE5B,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAoB,EACpB,KAAa,EACb,QAA0B,EAC1B,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;QACjC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK;QACL,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAA,0BAAe,GAAE;QAC1B,WAAW,EAAE,IAAI;QACjB,KAAK,EAAE,KAAK;QACZ,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAA,2BAAM,EAAC,IAAI,EAAE,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAoBD,SAAS,mBAAmB,CAAC,IAAsB;IACjD,IAAA,2BAAM,EAAC,IAAI,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,mBAAmB,GAAoD;IAC3E,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7C,cAAc,EAAE,KAAK;KACtB,CAAC;IACF,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,cAAc,EAAE,KAAK;KACtB,CAAC;IACF,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,EAAE,MAAM,uBAAuB,CACjC,OAAO,CAAC,SAAS,EACjB,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,EAC1C,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,CACjB;QACD,cAAc,EAAE,IAAI;KACrB,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,MAAM,eAAe,CACzB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,CACjB;QACD,cAAc,EAAE,IAAI;KACrB,CAAC;CACH,CAAC;AAaK,KAAK,UAAU,gBAAgB,CACpC,SAAoB,EACpB,OAA+B;IAE/B,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,kBAAkB,CACzC,SAAS,EACT,OAAO,CAAC,QAAQ,EAChB,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;IAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,UAAU;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAKtC,MAAM,kBAAkB,GACtB,CAAC,CAAC,aAAa;QACf,CAAC,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,mCAAc,CAAC,CAAC,YAAY,CAC7D,aAAa,CAAC,GAAG,CAClB,CAAC,CAAC;IAEL,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC;QACE,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC;QACrC,uBAAuB,EAAE,OAAO,CAAC,aAAa,CAAC;QAC/C,2BAA2B,EAAE,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC;QAChE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,kBAAkB;KACnB,EACD,QAAQ,EACR,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACrC,SAAS;QACT,QAAQ;QACR,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB;QAC9C,UAAU;QACV,aAAa;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/auth/oauth/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./authorize-url";
+export * from "./callback";
+export * from "./config";
+export * from "./identity-resolution";
+export * from "./linking-policy";
+export * from "./providers";
+export * from "./relay";
+export * from "./state";
+export * from "./token-exchange";

package/dist/routes/auth/oauth/index.js

@@ -0,0 +1,26 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./authorize-url"), exports);
+__exportStar(require("./callback"), exports);
+__exportStar(require("./config"), exports);
+__exportStar(require("./identity-resolution"), exports);
+__exportStar(require("./linking-policy"), exports);
+__exportStar(require("./providers"), exports);
+__exportStar(require("./relay"), exports);
+__exportStar(require("./state"), exports);
+__exportStar(require("./token-exchange"), exports);
+//# sourceMappingURL=index.js.map

package/dist/routes/auth/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/routes/auth/oauth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,6CAA2B;AAC3B,2CAAyB;AACzB,wDAAsC;AACtC,mDAAiC;AACjC,8CAA4B;AAC5B,0CAAwB;AACxB,0CAAwB;AACxB,mDAAiC"}

package/dist/routes/auth/oauth/linking-policy.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthPolicy } from "./config";
+import type { ProviderIdentity } from "./providers";
+export type OAuthResolution = "use-linked" | "link-existing" | "claim-unvalidated" | "create";
+export interface OAuthAccountMatch {
+    hasLinkedAccount: boolean;
+    hasAccountWithSameEmail: boolean;
+    isSameEmailAccountValidated: boolean;
+    hasValidInvitation: boolean;
+    belongsToWorkspace: boolean;
+}
+export declare function decideOAuthResolution(match: OAuthAccountMatch, identity: ProviderIdentity, policy: OAuthPolicy): OAuthResolution;

package/dist/routes/auth/oauth/linking-policy.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decideOAuthResolution = decideOAuthResolution;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const HTTP_FORBIDDEN = 403;
+const REGISTRATION_DISABLED_MESSAGE = "error.oauth.registration_disabled";
+const EMAIL_NOT_VERIFIED_MESSAGE = "error.oauth.email_not_verified";
+const LINKING_DISABLED_MESSAGE = "error.oauth.linking_disabled";
+const ACCOUNT_NOT_VALIDATED_MESSAGE = "error.oauth.account_not_validated";
+function decideOAuthResolution(match, identity, policy) {
+    if (match.hasLinkedAccount) {
+        return "use-linked";
+    }
+    if (match.hasAccountWithSameEmail) {
+        (0, interface_api_util_1.assert)(identity.isEmailVerified, HTTP_FORBIDDEN, EMAIL_NOT_VERIFIED_MESSAGE);
+        if (!match.isSameEmailAccountValidated) {
+            (0, interface_api_util_1.assert)(match.hasValidInvitation, HTTP_FORBIDDEN, ACCOUNT_NOT_VALIDATED_MESSAGE);
+            (0, interface_api_util_1.assert)(!match.belongsToWorkspace, HTTP_FORBIDDEN, ACCOUNT_NOT_VALIDATED_MESSAGE);
+            return "claim-unvalidated";
+        }
+        (0, interface_api_util_1.assert)(policy.linkByVerifiedEmail, HTTP_FORBIDDEN, LINKING_DISABLED_MESSAGE);
+        return "link-existing";
+    }
+    (0, interface_api_util_1.assert)(policy.allowAccountCreation || match.hasValidInvitation, HTTP_FORBIDDEN, REGISTRATION_DISABLED_MESSAGE);
+    (0, interface_api_util_1.assert)(identity.isEmailVerified, HTTP_FORBIDDEN, EMAIL_NOT_VERIFIED_MESSAGE);
+    return "create";
+}
+//# sourceMappingURL=linking-policy.js.map

package/dist/routes/auth/oauth/linking-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linking-policy.js","sourceRoot":"","sources":["../../../../src/routes/auth/oauth/linking-policy.ts"],"names":[],"mappings":";;AA2EA,sDAqDC;AAhID,uEAAwD;AAIxD,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,6BAA6B,GAAG,mCAAmC,CAAC;AAC1E,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AACpE,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAChE,MAAM,6BAA6B,GAAG,mCAAmC,CAAC;AAmE1E,SAAgB,qBAAqB,CACnC,KAAwB,EACxB,QAA0B,EAC1B,MAAmB;IAEnB,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;QAClC,IAAA,2BAAM,EACJ,QAAQ,CAAC,eAAe,EACxB,cAAc,EACd,0BAA0B,CAC3B,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;YACvC,IAAA,2BAAM,EACJ,KAAK,CAAC,kBAAkB,EACxB,cAAc,EACd,6BAA6B,CAC9B,CAAC;YASF,IAAA,2BAAM,EACJ,CAAC,KAAK,CAAC,kBAAkB,EACzB,cAAc,EACd,6BAA6B,CAC9B,CAAC;YACF,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,IAAA,2BAAM,EACJ,MAAM,CAAC,mBAAmB,EAC1B,cAAc,EACd,wBAAwB,CACzB,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAA,2BAAM,EACJ,MAAM,CAAC,oBAAoB,IAAI,KAAK,CAAC,kBAAkB,EACvD,cAAc,EACd,6BAA6B,CAC9B,CAAC;IACF,IAAA,2BAAM,EAAC,QAAQ,CAAC,eAAe,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/routes/auth/oauth/providers.d.ts

@@ -0,0 +1,15 @@
+export interface ProviderIdentity {
+    providerAccountId: string;
+    email: string;
+    isEmailVerified: boolean;
+    name: string;
+}
+export interface OAuthProvider {
+    displayName: string;
+    icon: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    defaultScopes: string[];
+    fetchIdentity: (accessToken: string) => Promise<ProviderIdentity>;
+}
+export declare const OAUTH_PROVIDERS: Record<string, OAuthProvider>;

package/dist/routes/auth/oauth/providers.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_PROVIDERS = void 0;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const HTTP_BAD_GATEWAY = 502;
+const PROVIDER_UNREACHABLE_MESSAGE = "error.oauth.provider_unreachable";
+const EMAIL_UNAVAILABLE_MESSAGE = "error.oauth.email_unavailable";
+const IDENTITY_MALFORMED_MESSAGE = "error.oauth.identity_malformed";
+const GITHUB_API_URL = "https://api.github.com";
+const GITHUB_USER_AGENT = "AntelopeJS-DMS";
+const GITHUB_HEADERS = {
+    "User-Agent": GITHUB_USER_AGENT,
+    "X-GitHub-Api-Version": "2022-11-28",
+};
+const GOOGLE_USERINFO_URL = "https://openidconnect.googleapis.com/v1/userinfo";
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function requireAccountId(value) {
+    const isUsable = isNonEmptyString(value) ||
+        (typeof value === "number" && Number.isFinite(value));
+    (0, interface_api_util_1.assert)(isUsable, HTTP_BAD_GATEWAY, IDENTITY_MALFORMED_MESSAGE);
+    return String(value);
+}
+async function fetchProviderJson(url, accessToken, headers, failureMessage) {
+    const response = await fetch(url, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            Accept: "application/json",
+            ...headers,
+        },
+    });
+    (0, interface_api_util_1.assert)(response.ok, HTTP_BAD_GATEWAY, failureMessage);
+    return (await response.json());
+}
+async function fetchGithubIdentity(accessToken) {
+    const user = await fetchProviderJson(`${GITHUB_API_URL}/user`, accessToken, GITHUB_HEADERS, PROVIDER_UNREACHABLE_MESSAGE);
+    const providerAccountId = requireAccountId(user.id);
+    const emails = await fetchProviderJson(`${GITHUB_API_URL}/user/emails`, accessToken, GITHUB_HEADERS, EMAIL_UNAVAILABLE_MESSAGE);
+    (0, interface_api_util_1.assert)(Array.isArray(emails), HTTP_BAD_GATEWAY, EMAIL_UNAVAILABLE_MESSAGE);
+    const primary = emails.find((entry) => entry.primary === true) ?? emails[0];
+    (0, interface_api_util_1.assert)(primary && isNonEmptyString(primary.email), HTTP_BAD_GATEWAY, EMAIL_UNAVAILABLE_MESSAGE);
+    const name = [user.name, user.login].find(isNonEmptyString);
+    return {
+        providerAccountId,
+        email: primary.email,
+        isEmailVerified: primary.verified === true,
+        name: name ?? primary.email,
+    };
+}
+async function fetchGoogleIdentity(accessToken) {
+    const profile = await fetchProviderJson(GOOGLE_USERINFO_URL, accessToken, {}, PROVIDER_UNREACHABLE_MESSAGE);
+    const providerAccountId = requireAccountId(profile.sub);
+    (0, interface_api_util_1.assert)(isNonEmptyString(profile.email), HTTP_BAD_GATEWAY, EMAIL_UNAVAILABLE_MESSAGE);
+    return {
+        providerAccountId,
+        email: profile.email,
+        isEmailVerified: profile.email_verified === true,
+        name: isNonEmptyString(profile.name) ? profile.name : profile.email,
+    };
+}
+exports.OAUTH_PROVIDERS = {
+    github: {
+        displayName: "GitHub",
+        icon: "i-ph-github-logo",
+        authorizeUrl: "https://github.com/login/oauth/authorize",
+        tokenUrl: "https://github.com/login/oauth/access_token",
+        defaultScopes: ["read:user", "user:email"],
+        fetchIdentity: fetchGithubIdentity,
+    },
+    google: {
+        displayName: "Google",
+        icon: "i-ph-google-logo",
+        authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+        tokenUrl: "https://oauth2.googleapis.com/token",
+        defaultScopes: ["openid", "email", "profile"],
+        fetchIdentity: fetchGoogleIdentity,
+    },
+};
+//# sourceMappingURL=providers.js.map

package/dist/routes/auth/oauth/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../../src/routes/auth/oauth/providers.ts"],"names":[],"mappings":";;;AAAA,uEAAwD;AAExD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,4BAA4B,GAAG,kCAAkC,CAAC;AACxE,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AAClE,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAEpE,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,cAAc,GAA2B;IAC7C,YAAY,EAAE,iBAAiB;IAC/B,sBAAsB,EAAE,YAAY;CACrC,CAAC;AACF,MAAM,mBAAmB,GAAG,kDAAkD,CAAC;AA+C/E,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAOD,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,QAAQ,GACZ,gBAAgB,CAAC,KAAK,CAAC;QACvB,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAA,2BAAM,EAAC,QAAQ,EAAE,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,WAAmB,EACnB,OAA+B,EAC/B,cAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,kBAAkB;YAC1B,GAAG,OAAO;SACX;KACF,CAAC,CAAC;IAEH,IAAA,2BAAM,EAAC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAClC,GAAG,cAAc,OAAO,EACxB,WAAW,EACX,cAAc,EACd,4BAA4B,CAC7B,CAAC;IACF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,GAAG,cAAc,cAAc,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,CAC1B,CAAC;IACF,IAAA,2BAAM,EAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAA,2BAAM,EACJ,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAC1C,gBAAgB,EAChB,yBAAyB,CAC1B,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5D,OAAO;QACL,iBAAiB;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,eAAe,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI;QAC1C,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,KAAK;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,mBAAmB,EACnB,WAAW,EACX,EAAE,EACF,4BAA4B,CAC7B,CAAC;IACF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxD,IAAA,2BAAM,EACJ,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAC/B,gBAAgB,EAChB,yBAAyB,CAC1B,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,eAAe,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;QAChD,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;KACpE,CAAC;AACJ,CAAC;AAMY,QAAA,eAAe,GAAkC;IAC5D,MAAM,EAAE;QACN,WAAW,EAAE,QAAQ;QACrB,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,0CAA0C;QACxD,QAAQ,EAAE,6CAA6C;QACvD,aAAa,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;QAC1C,aAAa,EAAE,mBAAmB;KACnC;IACD,MAAM,EAAE;QACN,WAAW,EAAE,QAAQ;QACrB,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,8CAA8C;QAC5D,QAAQ,EAAE,qCAAqC;QAC/C,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAC7C,aAAa,EAAE,mBAAmB;KACnC;CACF,CAAC"}

package/dist/routes/auth/oauth/relay.d.ts

@@ -0,0 +1,2 @@
+export declare function deriveOAuthRelaySecret(): string;
+export declare function assertOAuthRelay(relayHeader: string | undefined): void;

package/dist/routes/auth/oauth/relay.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveOAuthRelaySecret = deriveOAuthRelaySecret;
+exports.assertOAuthRelay = assertOAuthRelay;
+const node_crypto_1 = require("node:crypto");
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const config_1 = require("../../../config");
+const HTTP_UNAUTHORIZED = 401;
+const HTTP_INTERNAL_ERROR = 500;
+const RELAY_REQUIRED_MESSAGE = "error.oauth.relay_required";
+const JWT_SECRET_MISSING_MESSAGE = "error.oauth.jwt_secret_missing";
+const RELAY_DERIVATION_MESSAGE = "oauth-relay";
+function deriveOAuthRelaySecret() {
+    return (0, node_crypto_1.createHmac)("sha256", (0, config_1.getAuthConfig)().jwtSecret)
+        .update(RELAY_DERIVATION_MESSAGE)
+        .digest("hex");
+}
+function assertOAuthRelay(relayHeader) {
+    (0, interface_api_util_1.assert)((0, config_1.getAuthConfig)().jwtSecret, HTTP_INTERNAL_ERROR, JWT_SECRET_MISSING_MESSAGE);
+    const expected = Buffer.from(deriveOAuthRelaySecret());
+    const presented = Buffer.from(relayHeader ?? "");
+    (0, interface_api_util_1.assert)(expected.length === presented.length &&
+        (0, node_crypto_1.timingSafeEqual)(expected, presented), HTTP_UNAUTHORIZED, RELAY_REQUIRED_MESSAGE);
+}
+//# sourceMappingURL=relay.js.map

package/dist/routes/auth/oauth/relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../../../src/routes/auth/oauth/relay.ts"],"names":[],"mappings":";;AA0BA,wDAIC;AAQD,4CAeC;AArDD,6CAA0D;AAC1D,uEAAwD;AACxD,4CAAgD;AAEhD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAEpE,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAiB/C,SAAgB,sBAAsB;IACpC,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAA,sBAAa,GAAE,CAAC,SAAS,CAAC;SACnD,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAQD,SAAgB,gBAAgB,CAAC,WAA+B;IAC9D,IAAA,2BAAM,EACJ,IAAA,sBAAa,GAAE,CAAC,SAAS,EACzB,mBAAmB,EACnB,0BAA0B,CAC3B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACjD,IAAA,2BAAM,EACJ,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAClC,IAAA,6BAAe,EAAC,QAAQ,EAAE,SAAS,CAAC,EACtC,iBAAiB,EACjB,sBAAsB,CACvB,CAAC;AACJ,CAAC"}

package/dist/routes/auth/oauth/state.d.ts

@@ -0,0 +1,2 @@
+export declare function signOAuthState(providerId: string): string;
+export declare function assertValidOAuthState(state: string, cookieState: string, providerId: string): void;

package/dist/routes/auth/oauth/state.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signOAuthState = signOAuthState;
+exports.assertValidOAuthState = assertValidOAuthState;
+const node_crypto_1 = require("node:crypto");
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const jsonwebtoken_1 = require("jsonwebtoken");
+const config_1 = require("../../../config");
+const HTTP_BAD_REQUEST = 400;
+const HTTP_INTERNAL_ERROR = 500;
+const INVALID_STATE_MESSAGE = "error.oauth.invalid_state";
+const JWT_SECRET_MISSING_MESSAGE = "error.oauth.jwt_secret_missing";
+const STATE_PURPOSE = "oauth-state";
+const STATE_NONCE_BYTES = 16;
+const SECONDS_IN_MINUTE = 60;
+const STATE_LIFETIME_MINUTES = 10;
+const STATE_LIFETIME_SECONDS = STATE_LIFETIME_MINUTES * SECONDS_IN_MINUTE;
+const MILLISECONDS_IN_SECOND = 1000;
+const CONSUMED_NONCE_TTL_MS = STATE_LIFETIME_SECONDS * MILLISECONDS_IN_SECOND;
+const consumedNonces = new Map();
+function sweepConsumedNonces(now) {
+    for (const [nonce, expiresAt] of consumedNonces) {
+        if (expiresAt <= now) {
+            consumedNonces.delete(nonce);
+        }
+    }
+}
+function consumeNonce(nonce) {
+    const now = Date.now();
+    sweepConsumedNonces(now);
+    if (consumedNonces.has(nonce)) {
+        return false;
+    }
+    consumedNonces.set(nonce, now + CONSUMED_NONCE_TTL_MS);
+    return true;
+}
+function getStateSecret() {
+    const { jwtSecret } = (0, config_1.getAuthConfig)();
+    (0, interface_api_util_1.assert)(jwtSecret, HTTP_INTERNAL_ERROR, JWT_SECRET_MISSING_MESSAGE);
+    return `${STATE_PURPOSE}:${jwtSecret}`;
+}
+function isSameState(state, cookieState) {
+    const left = Buffer.from(state);
+    const right = Buffer.from(cookieState);
+    return left.length === right.length && (0, node_crypto_1.timingSafeEqual)(left, right);
+}
+function decodeState(state) {
+    try {
+        return (0, jsonwebtoken_1.verify)(state, getStateSecret());
+    }
+    catch {
+        return undefined;
+    }
+}
+function signOAuthState(providerId) {
+    const claims = {
+        provider: providerId,
+        nonce: (0, node_crypto_1.randomBytes)(STATE_NONCE_BYTES).toString("hex"),
+        purpose: STATE_PURPOSE,
+    };
+    return (0, jsonwebtoken_1.sign)(claims, getStateSecret(), { expiresIn: STATE_LIFETIME_SECONDS });
+}
+function assertValidOAuthState(state, cookieState, providerId) {
+    (0, interface_api_util_1.assert)(isSameState(state, cookieState), HTTP_BAD_REQUEST, INVALID_STATE_MESSAGE);
+    const claims = decodeState(state);
+    (0, interface_api_util_1.assert)(claims?.purpose === STATE_PURPOSE &&
+        claims.provider === providerId &&
+        claims.nonce, HTTP_BAD_REQUEST, INVALID_STATE_MESSAGE);
+    (0, interface_api_util_1.assert)(consumeNonce(claims.nonce), HTTP_BAD_REQUEST, INVALID_STATE_MESSAGE);
+}
+//# sourceMappingURL=state.js.map

package/dist/routes/auth/oauth/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../../src/routes/auth/oauth/state.ts"],"names":[],"mappings":";;AAqFA,wCAOC;AAiBD,sDAoBC;AAjID,6CAA2D;AAC3D,uEAAwD;AACxD,+CAA4C;AAC5C,4CAAgD;AAEhD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAC1D,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAEpE,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,sBAAsB,GAAG,sBAAsB,GAAG,iBAAiB,CAAC;AAQ1E,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,qBAAqB,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAE9E,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEjD,SAAS,mBAAmB,CAAC,GAAW;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,cAAc,EAAE,CAAC;QAChD,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAQD,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAEzB,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,qBAAqB,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sBAAa,GAAE,CAAC;IACtC,IAAA,2BAAM,EAAC,SAAS,EAAE,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;IACnE,OAAO,GAAG,aAAa,IAAI,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,WAAmB;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QAKH,OAAO,IAAA,qBAAM,EAAC,KAAK,EAAE,cAAc,EAAE,CAAgC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAUD,SAAgB,cAAc,CAAC,UAAkB;IAC/C,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,IAAA,yBAAW,EAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrD,OAAO,EAAE,aAAa;KACvB,CAAC;IACF,OAAO,IAAA,mBAAI,EAAC,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAC/E,CAAC;AAiBD,SAAgB,qBAAqB,CACnC,KAAa,EACb,WAAmB,EACnB,UAAkB;IAElB,IAAA,2BAAM,EACJ,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAC/B,gBAAgB,EAChB,qBAAqB,CACtB,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAA,2BAAM,EACJ,MAAM,EAAE,OAAO,KAAK,aAAa;QAC/B,MAAM,CAAC,QAAQ,KAAK,UAAU;QAC9B,MAAM,CAAC,KAAK,EACd,gBAAgB,EAChB,qBAAqB,CACtB,CAAC;IACF,IAAA,2BAAM,EAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;AAC9E,CAAC"}

package/dist/routes/auth/oauth/token-exchange.d.ts

@@ -0,0 +1,2 @@
+import type { EnabledOAuthProvider } from "./config";
+export declare function exchangeCodeForAccessToken(enabled: EnabledOAuthProvider, code: string): Promise<string>;

package/dist/routes/auth/oauth/token-exchange.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangeCodeForAccessToken = exchangeCodeForAccessToken;
+const interface_api_1 = require("@antelopejs/interface-api");
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const logging_1 = require("@antelopejs/interface-core/logging");
+const config_1 = require("./config");
+const HTTP_BAD_GATEWAY = 502;
+const TOKEN_EXCHANGE_FAILED_MESSAGE = "error.oauth.token_exchange_failed";
+async function exchangeCodeForAccessToken(enabled, code) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: enabled.credentials.clientId,
+        client_secret: enabled.credentials.clientSecret,
+        redirect_uri: (0, config_1.buildOAuthRedirectUri)(enabled.id),
+        code,
+    });
+    const response = await fetch(enabled.provider.tokenUrl, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+    (0, interface_api_util_1.assert)(response.ok, HTTP_BAD_GATEWAY, TOKEN_EXCHANGE_FAILED_MESSAGE);
+    const tokens = (await response.json());
+    if (tokens.access_token) {
+        return tokens.access_token;
+    }
+    logging_1.Logging.Error(`[DMS] OAuth token exchange rejected by "${enabled.id}": ${tokens.error ?? "unknown error"}`);
+    throw new interface_api_1.HTTPResult(HTTP_BAD_GATEWAY, TOKEN_EXCHANGE_FAILED_MESSAGE);
+}
+//# sourceMappingURL=token-exchange.js.map