@appweaver/core 1.2.1 → 1.3.1

package/prisma/client/models/ConnectedAccount.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/prisma/client/models.d.ts

@@ -1,4 +1,5 @@
 export type * from './models/ApiKey';
+export type * from './models/ConnectedAccount';
 export type * from './models/OneTimeToken';
 export type * from './models/Permission';
 export type * from './models/Role';

package/resources.d.ts

@@ -1,9 +1,11 @@
 export { default as apiKey } from './security/resources/api-key/model';
+export { default as connectedAccount } from './security/resources/connected-account/model';
 export { default as oneTimeToken } from './security/resources/one-time-token/model';
 export { default as role } from './security/resources/role/model';
 export { default as permission } from './security/resources/permission/model';
 export { default as seeder } from './seeder/resources/seeder/model';
 export { default as file } from './storage/resources/file/model';
 export { default as apiKeyService } from './security/resources/api-key/service';
+export { default as connectedAccountService } from './security/resources/connected-account/service';
 export { default as apiKeyRoutes } from './security/resources/api-key/routes';
 export { default as apiKeyPolicy } from './security/resources/api-key/policy';

package/resources.js

@@ -3,21 +3,25 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.apiKeyPolicy = exports.apiKeyRoutes = exports.apiKeyService = exports.file = exports.seeder = exports.permission = exports.role = exports.oneTimeToken = exports.apiKey = void 0;
+exports.apiKeyPolicy = exports.apiKeyRoutes = exports.connectedAccountService = exports.apiKeyService = exports.file = exports.seeder = exports.permission = exports.role = exports.oneTimeToken = exports.connectedAccount = exports.apiKey = void 0;
 var model_1 = require("./security/resources/api-key/model");
 Object.defineProperty(exports, "apiKey", { enumerable: true, get: function () { return __importDefault(model_1).default; } });
-var model_2 = require("./security/resources/one-time-token/model");
-Object.defineProperty(exports, "oneTimeToken", { enumerable: true, get: function () { return __importDefault(model_2).default; } });
-var model_3 = require("./security/resources/role/model");
-Object.defineProperty(exports, "role", { enumerable: true, get: function () { return __importDefault(model_3).default; } });
-var model_4 = require("./security/resources/permission/model");
-Object.defineProperty(exports, "permission", { enumerable: true, get: function () { return __importDefault(model_4).default; } });
-var model_5 = require("./seeder/resources/seeder/model");
-Object.defineProperty(exports, "seeder", { enumerable: true, get: function () { return __importDefault(model_5).default; } });
-var model_6 = require("./storage/resources/file/model");
-Object.defineProperty(exports, "file", { enumerable: true, get: function () { return __importDefault(model_6).default; } });
+var model_2 = require("./security/resources/connected-account/model");
+Object.defineProperty(exports, "connectedAccount", { enumerable: true, get: function () { return __importDefault(model_2).default; } });
+var model_3 = require("./security/resources/one-time-token/model");
+Object.defineProperty(exports, "oneTimeToken", { enumerable: true, get: function () { return __importDefault(model_3).default; } });
+var model_4 = require("./security/resources/role/model");
+Object.defineProperty(exports, "role", { enumerable: true, get: function () { return __importDefault(model_4).default; } });
+var model_5 = require("./security/resources/permission/model");
+Object.defineProperty(exports, "permission", { enumerable: true, get: function () { return __importDefault(model_5).default; } });
+var model_6 = require("./seeder/resources/seeder/model");
+Object.defineProperty(exports, "seeder", { enumerable: true, get: function () { return __importDefault(model_6).default; } });
+var model_7 = require("./storage/resources/file/model");
+Object.defineProperty(exports, "file", { enumerable: true, get: function () { return __importDefault(model_7).default; } });
 var service_1 = require("./security/resources/api-key/service");
 Object.defineProperty(exports, "apiKeyService", { enumerable: true, get: function () { return __importDefault(service_1).default; } });
+var service_2 = require("./security/resources/connected-account/service");
+Object.defineProperty(exports, "connectedAccountService", { enumerable: true, get: function () { return __importDefault(service_2).default; } });
 var routes_1 = require("./security/resources/api-key/routes");
 Object.defineProperty(exports, "apiKeyRoutes", { enumerable: true, get: function () { return __importDefault(routes_1).default; } });
 var policy_1 = require("./security/resources/api-key/policy");

package/security/auth-routes.js

@@ -63,8 +63,8 @@ function authRoutes(server) {
             }
         }
     }, async (request, reply) => {
-        const { token } = request.body;
-        const authResponse = await authService.exchangeToken(token);
+        const { token, password } = request.body;
+        const authResponse = await authService.exchangeToken(token, password);
         return reply.send(authResponse);
     });
     const authUserModel = (0, helper_1.resourceAuthModel)();

package/security/auth-schema.d.ts

@@ -19,6 +19,7 @@ export declare const LogoutResponse: TObject<{
 }>;
 export declare const ExchangeTokenRequest: TObject<{
     token: import("@sinclair/typebox").TString;
+    password: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 }>;
 export declare const loginSchema: {
     tags: string[];
@@ -208,6 +209,7 @@ export declare const exchangeTokenSchema: {
     };
     body: TObject<{
         token: import("@sinclair/typebox").TString;
+        password: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>;
 };
 export declare function authSchema(authTypes?: AuthType[]): any[];

package/security/auth-schema.js

@@ -30,7 +30,11 @@ exports.LogoutResponse = typebox_1.Type.Object({
     success: typebox_1.Type.Boolean({ example: true })
 }, { $id: 'LogoutResponse' });
 exports.ExchangeTokenRequest = typebox_1.Type.Object({
-    token: typebox_1.Type.String({ example: 'aBcDeFgHijkLMnO123456789' })
+    token: typebox_1.Type.String({ example: 'aBcDeFgHijkLMnO123456789' }),
+    password: typebox_1.Type.Optional(typebox_1.Type.String({
+        description: 'Account password, required when the OAuth2 redirect returned `passwordRequired=true`',
+        example: 'yourPassword123!'
+    }))
 }, { $id: 'ExchangeTokenRequest' });
 exports.loginSchema = {
     tags: ['Auth'],

package/security/auth-service.d.ts

@@ -1,5 +1,5 @@
 import { AuthScope, AuthSource, AuthUser, RouteConfig } from '@appweaver/common';
-import { AuthTokens, JwtPayload, UserAdditionalData, UserInfo } from '../types';
+import { AuthTokens, JwtPayload, UserAdditionalData } from '../types';
 export declare class AuthService {
     /**
      * Finds an authenticated user by their unique identifier.
@@ -40,21 +40,6 @@ export declare class AuthService {
      * @throws {HttpError} Throws an error if the registration process fails.
      */
     registerAuthUser(source: AuthSource, email: string, password?: string, data?: Partial<UserAdditionalData>): Promise<AuthUser>;
-    /**
-     * Checks whether a user is allowed to be registered and/or authenticated via OAuth2 by invoking the optional
-     * `checkOAuth2User` callback configured on the auth service. When the callback returns nothing, the OAuth2 flow
-     * proceeds normally (registration of a new user or login of an existing one). When it returns a string or an error,
-     * the flow is aborted by throwing an `HttpError`.
-     *
-     * @param {AuthSource} source - The OAuth2 authentication source, e.g., oauth2Google, oauth2Facebook, oauth2Custom.
-     * @param {UserInfo} userInfo - The user info extracted from the OAuth2 provider.
-     * @param {AuthUser | null} authUser - The existing authenticated user matched by email, or null when the user does
-     * not exist yet (i.e., a new user would be registered).
-     * @return {Promise<void>} A promise that resolves when the user is allowed to proceed.
-     * @throws {HttpError} If the configured callback returns a string or an error (status 403 unless an `HttpError` is
-     * returned, in which case it is thrown as-is).
-     */
-    checkOAuth2User(source: AuthSource, userInfo: UserInfo, authUser: AuthUser | null): Promise<void>;
     /**
      * Changes the password for the authenticated user.
      *
@@ -99,13 +84,16 @@ export declare class AuthService {
      */
     login(username: string, password: string): Promise<AuthTokens>;
     /**
-     * Exchanges an existing token for new authentication tokens.
+     * Exchanges an existing token for new authentication tokens. When the one-time token was issued for an OAuth2
+     * sign-in that needs confirming, the account password must be supplied alongside it.
      *
      * @param {string} token - The token to be exchanged for new authentication tokens.
+     * @param {string} [password] - The account password, required when the token was flagged for confirmation.
      * @return {Promise<AuthTokens>} A promise that resolves to a set of new authentication tokens.
-     * @throws {HttpError} If the token is invalid, expired, or associated with a non-existent or disabled user.
+     * @throws {HttpError} If the token is invalid, expired, associated with a non-existent or disabled user, or the
+     * required password confirmation is missing or wrong.
      */
-    exchangeToken(token: string): Promise<AuthTokens>;
+    exchangeToken(token: string, password?: string): Promise<AuthTokens>;
     /**
      * Generates authentication tokens (access and refresh tokens) for a given authenticated user.
      *

package/security/auth-service.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthService = void 0;
 const common_1 = require("@appweaver/common");
 const helper_1 = require("./helper");
+const oauth2_service_1 = require("./oauth2/oauth2-service");
 const context_1 = require("../context");
 const cache_1 = require("../cache");
 const errors_1 = require("../errors");
@@ -14,6 +15,9 @@ class AuthService {
     _cacheService = (0, context_1.inject)(cache_1.CacheService);
     /** @internal */
     _authUserService = (0, helper_1.resourceAuthService)();
+    /** Optional, since an application with no OAuth2 provider never registers it.
+     * @internal */
+    _oauth2Service = (0, context_1.inject)(oauth2_service_1.OAuth2Service, false);
     /**
      * Finds an authenticated user by their unique identifier.
      *
@@ -114,34 +118,6 @@ class AuthService {
             throw new errors_1.HttpError('Auth user registration error', 500, e);
         }
     }
-    /**
-     * Checks whether a user is allowed to be registered and/or authenticated via OAuth2 by invoking the optional
-     * `checkOAuth2User` callback configured on the auth service. When the callback returns nothing, the OAuth2 flow
-     * proceeds normally (registration of a new user or login of an existing one). When it returns a string or an error,
-     * the flow is aborted by throwing an `HttpError`.
-     *
-     * @param {AuthSource} source - The OAuth2 authentication source, e.g., oauth2Google, oauth2Facebook, oauth2Custom.
-     * @param {UserInfo} userInfo - The user info extracted from the OAuth2 provider.
-     * @param {AuthUser | null} authUser - The existing authenticated user matched by email, or null when the user does
-     * not exist yet (i.e., a new user would be registered).
-     * @return {Promise<void>} A promise that resolves when the user is allowed to proceed.
-     * @throws {HttpError} If the configured callback returns a string or an error (status 403 unless an `HttpError` is
-     * returned, in which case it is thrown as-is).
-     */
-    async checkOAuth2User(source, userInfo, authUser) {
-        const serviceConfig = this._authUserService[common_1.CONFIG];
-        if (!serviceConfig.checkOAuth2User) {
-            return;
-        }
-        const result = await serviceConfig.checkOAuth2User(source, userInfo, authUser);
-        if (!result) {
-            return;
-        }
-        if (result instanceof errors_1.HttpError) {
-            throw result;
-        }
-        throw new errors_1.HttpError(result instanceof Error ? result.message : result, 403, result instanceof Error ? result : undefined);
-    }
     /**
      * Changes the password for the authenticated user.
      *
@@ -236,21 +212,50 @@ class AuthService {
         return this.generateAuthTokens(authUser);
     }
     /**
-     * Exchanges an existing token for new authentication tokens.
+     * Exchanges an existing token for new authentication tokens. When the one-time token was issued for an OAuth2
+     * sign-in that needs confirming, the account password must be supplied alongside it.
      *
      * @param {string} token - The token to be exchanged for new authentication tokens.
+     * @param {string} [password] - The account password, required when the token was flagged for confirmation.
      * @return {Promise<AuthTokens>} A promise that resolves to a set of new authentication tokens.
-     * @throws {HttpError} If the token is invalid, expired, or associated with a non-existent or disabled user.
+     * @throws {HttpError} If the token is invalid, expired, associated with a non-existent or disabled user, or the
+     * required password confirmation is missing or wrong.
      */
-    async exchangeToken(token) {
-        const { authUserId, authSource } = await this._securityStore.useOneTimeToken(token, common_1.AuthOTTPurpose.Authentication);
+    async exchangeToken(token, password) {
+        const { authUserId, authSource, providerAccountId, scope, passwordRequired } = await this._securityStore.useOneTimeToken(token, common_1.AuthOTTPurpose.Authentication);
         const authUser = await this.findById(authUserId);
         if (!authUser || !authUser.enabled) {
             throw new errors_1.HttpError('Auth user does not exist or is disabled', 400);
         }
+        if (passwordRequired) {
+            await this.confirmPassword(authUser, password);
+        }
+        if (providerAccountId) {
+            await this._oauth2Service?.linkConnectedAccount(authUser, authSource, providerAccountId, scope);
+            // The provider confirmed the address, and ownership of the local account was proven by the password whenever it
+            // had one, so an address that was never verified locally is settled by this sign-in
+            if (!authUser.verifiedEmail) {
+                await this.updateAuthUser(authUser.id, { verifiedEmail: true });
+            }
+        }
         common_1.logger.debug({ id: authUser.id, token }, 'User token exchanged');
         return this.generateAuthTokens(authUser, common_1.AuthScope.Auth, authSource);
     }
+    /**
+     * Verifies the account password supplied to confirm linking an OAuth2 provider.
+     *
+     * @internal
+     */
+    async confirmPassword(authUser, password) {
+        if (!password) {
+            throw new errors_1.HttpError('Password confirmation is required to link this provider account', 401);
+        }
+        if (!authUser.passwordHash ||
+            !(await (0, helper_1.checkPassword)(password, authUser.passwordHash))) {
+            common_1.logger.debug({ id: authUser.id }, 'OAuth2 password confirmation rejected');
+            throw new errors_1.HttpError('Invalid user credentials', 401);
+        }
+    }
     /**
      * Generates authentication tokens (access and refresh tokens) for a given authenticated user.
      *

package/security/auth.js

@@ -48,6 +48,17 @@ const basic_1 = require("./basic");
 const api_key_1 = require("./api-key");
 const jwt_1 = require("./jwt");
 const oauth2Plugins = __importStar(require("./oauth2"));
+const PLUGIN_META = Symbol.for('plugin-meta');
+/**
+ * Tells the fastify plugins exported from the oauth2 directory apart from the user info extractors the same modules
+ * export, using the metadata `fastify-plugin` attaches to every plugin it wraps.
+ *
+ * @param {unknown} value - The exported value to check.
+ * @return {boolean} Whether the value is a fastify plugin.
+ */
+function isFastifyPlugin(value) {
+    return typeof value === 'function' && PLUGIN_META in value;
+}
 exports.default = (0, fastify_plugin_1.default)((server) => {
     server.register(auth_1.default);
     if (common_1.config.SECURITY_RECAPTCHA_ENABLED) {
@@ -62,8 +73,10 @@ exports.default = (0, fastify_plugin_1.default)((server) => {
     server.register(jwt_1.jwtAuth);
     // Load and register all plugins exported from oauth2 dir, plugin-enabled
     // status and required config values are checked at plugin initialization
-    for (const oauth2Plugin of Object.values(oauth2Plugins)) {
-        server.register(oauth2Plugin);
+    for (const exported of Object.values(oauth2Plugins)) {
+        if (isFastifyPlugin(exported)) {
+            server.register(exported);
+        }
     }
     server.register(auth_routes_1.authRoutes, { prefix: common_1.config.SECURITY_ROUTE_PREFIX });
     server.register(account_1.accountRoutes, {

package/security/create-auth-resources.js

@@ -85,6 +85,21 @@ function createAuthModel(config) {
                     }
                 }
             }
+            : {}),
+        ...((0, helper_1.isOAuth2Enabled)()
+            ? {
+                connectedAccounts: {
+                    model: 'ConnectedAccount',
+                    type: 'oneToMany',
+                    mappedBy: (0, common_1.uncapitalize)(config.name),
+                    input: {
+                        type: 'none'
+                    },
+                    output: {
+                        type: 'none'
+                    }
+                }
+            }
             : {})
     };
     const authModelInputOmit = ['verifiedEmail', 'logoutAt'];

package/security/helper.d.ts

@@ -71,6 +71,14 @@ export declare function updatePasswordHash(authUser: Partial<AuthUser>, password
  * @return {ValidationResult} An object with the validation result and message.
  */
 export declare function validatePasswordComplexity(password: string): ValidationResult;
+/**
+ * Checks whether at least one OAuth2 provider is enabled, by resolving each OAuth2 auth source to its
+ * `SECURITY_OAUTH2_<PROVIDER>_ENABLED` config flag. New providers are picked up automatically as long as they follow
+ * that naming convention.
+ *
+ * @return {boolean} True when any OAuth2 provider is enabled.
+ */
+export declare function isOAuth2Enabled(): boolean;
 /**
  * Validates a URL and checks if it's allowed based on the configured list of allowed hosts.
  *

package/security/helper.js

@@ -42,6 +42,7 @@ exports.hashPassword = hashPassword;
 exports.checkPassword = checkPassword;
 exports.updatePasswordHash = updatePasswordHash;
 exports.validatePasswordComplexity = validatePasswordComplexity;
+exports.isOAuth2Enabled = isOAuth2Enabled;
 exports.validateRedirectUrl = validateRedirectUrl;
 exports.checkScopeAccess = checkScopeAccess;
 exports.hasRole = hasRole;
@@ -203,6 +204,18 @@ function validatePasswordComplexity(password) {
     }
     return { valid: true, message: 'OK' };
 }
+/**
+ * Checks whether at least one OAuth2 provider is enabled, by resolving each OAuth2 auth source to its
+ * `SECURITY_OAUTH2_<PROVIDER>_ENABLED` config flag. New providers are picked up automatically as long as they follow
+ * that naming convention.
+ *
+ * @return {boolean} True when any OAuth2 provider is enabled.
+ */
+function isOAuth2Enabled() {
+    return Object.values(common_1.AuthSource)
+        .filter((source) => source.startsWith('oauth2'))
+        .some((source) => common_1.config[`SECURITY_OAUTH2_${source.replace('oauth2', '').toUpperCase()}_ENABLED`] === true);
+}
 /**
  * Validates a URL and checks if it's allowed based on the configured list of allowed hosts.
  *

package/security/index.d.ts

@@ -1,4 +1,6 @@
 export * from './oauth2/create-oauth2-plugin';
+export * from './oauth2/oauth2-service';
+export * from './oauth2/oauth2-util';
 export * from './auth-service';
 export * from './auth-schema';
 export * from './helper';

package/security/index.js

@@ -15,6 +15,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./oauth2/create-oauth2-plugin"), exports);
+__exportStar(require("./oauth2/oauth2-service"), exports);
+__exportStar(require("./oauth2/oauth2-util"), exports);
 __exportStar(require("./auth-service"), exports);
 __exportStar(require("./auth-schema"), exports);
 __exportStar(require("./helper"), exports);

package/security/oauth2/create-oauth2-plugin.d.ts

@@ -1,12 +1,27 @@
+import { ProviderConfiguration } from '@fastify/oauth2';
 import { AuthSource } from '@appweaver/common';
-import { Server, UserInfo } from '../../types';
-export type { UserInfo };
+import { OAuth2TokenSet, OAuth2UserInfoContext, Server, UserInfo } from '../../types';
+export type { UserInfo, OAuth2TokenSet, OAuth2UserInfoContext };
 export type OAuth2Config = {
     enabled: boolean;
     clientId?: string;
-    clientSecret?: string;
+    /** A function is resolved lazily, only once the provider is known to be enabled. */
+    clientSecret?: string | (() => string | undefined);
     issuer?: string;
     scope: string[];
-    extractUserInfo: (accessToken: string) => Promise<UserInfo>;
+    /** Provider endpoints. Defaults to the `@fastify/oauth2` preset matching the auth source name. */
+    auth?: ProviderConfiguration;
+    /** Human-readable provider name used in the generated OpenAPI schema. Defaults to the auth source name. */
+    displayName?: string;
+    /** Enables the PKCE extension, required by providers such as X. */
+    pkce?: 'S256' | 'plain';
+    /** Provider posts the authorization response as a form body instead of query parameters (`response_mode=form_post`). */
+    formPostCallback?: boolean;
+    /** `User-Agent` sent with the token request. Some providers reject the default one. */
+    userAgent?: string;
+    /** How client credentials are sent to the token endpoint. Defaults to `header` (HTTP Basic); providers such as
+     * Apple and LinkedIn only accept them in the request body. */
+    authorizationMethod?: 'header' | 'body';
+    extractUserInfo: (accessToken: string, context: OAuth2UserInfoContext) => Promise<UserInfo>;
 };
 export declare function createOAuth2Plugin(authSource: AuthSource, oAuth2Config: OAuth2Config): (server: Server) => Promise<void>;

package/security/oauth2/create-oauth2-plugin.js

@@ -10,45 +10,64 @@ const common_1 = require("@appweaver/common");
 const context_1 = require("../../context");
 const errors_1 = require("../../errors");
 const auth_service_1 = require("../auth-service");
+const oauth2_service_1 = require("./oauth2-service");
 const helper_1 = require("../helper");
 const oauth2_schema_1 = require("./oauth2-schema");
 function createOAuth2Plugin(authSource, oAuth2Config) {
     const name = authSource.replace('oauth2', '');
     const upperName = name.toUpperCase();
     const lowerName = name.toLowerCase();
+    const displayName = oAuth2Config.displayName ?? name;
     return (0, fastify_plugin_1.default)(async (server) => {
         if (!oAuth2Config.enabled) {
             return;
         }
-        if (!oAuth2Config.clientId || !oAuth2Config.clientSecret) {
+        const clientSecret = typeof oAuth2Config.clientSecret === 'function'
+            ? oAuth2Config.clientSecret()
+            : oAuth2Config.clientSecret;
+        if (!oAuth2Config.clientId || !clientSecret) {
             throw Error(`${name} OAuth2 configuration is missing`);
         }
         if (server[authSource] !== undefined) {
             throw Error(`${name} OAuth2 provider is already registered`);
         }
-        const authConfig = oauth2_1.default[`${upperName}_CONFIGURATION`];
+        const authConfig = oAuth2Config.auth ?? oauth2_1.default[`${upperName}_CONFIGURATION`];
         if (!authConfig && !oAuth2Config.issuer) {
             throw Error(`${name} OAuth2 provider is not supported`);
         }
         const authService = (0, context_1.inject)(auth_service_1.AuthService);
+        const oauth2Service = (0, context_1.inject)(oauth2_service_1.OAuth2Service);
         const securityStore = (0, context_1.inject)(common_1.SecurityStore);
         const prefix = common_1.config.SECURITY_ROUTE_PREFIX.replace(/\/$/, '');
+        const callbackPath = `${prefix}/login/${lowerName}/callback`;
+        // With `response_mode=form_post` the authorization response arrives in the request body, while
+        // @fastify/oauth2 always reads the `code` and `state` from the query string.
+        const authResponse = (request) => (oAuth2Config.formPostCallback
+            ? request.body
+            : request.query) ?? {};
         server.register(oauth2_1.default, {
             name: authSource,
             credentials: {
                 client: {
                     id: oAuth2Config.clientId,
-                    secret: oAuth2Config.clientSecret
+                    secret: clientSecret
                 },
-                auth: authConfig
+                auth: authConfig,
+                ...(oAuth2Config.authorizationMethod
+                    ? {
+                        options: { authorizationMethod: oAuth2Config.authorizationMethod }
+                    }
+                    : {})
             },
             ...(oAuth2Config.issuer
                 ? { discovery: { issuer: oAuth2Config.issuer } }
                 : {}),
             scope: oAuth2Config.scope,
-            schema: (0, oauth2_schema_1.createOAuth2RedirectSchema)(name),
+            schema: (0, oauth2_schema_1.createOAuth2RedirectSchema)(displayName),
             startRedirectPath: `${prefix}/login/${lowerName}`,
-            callbackUri: `${common_1.config.APP_HOSTNAME}${prefix}/login/${lowerName}/callback`,
+            callbackUri: `${common_1.config.APP_HOSTNAME}${callbackPath}`,
+            ...(oAuth2Config.pkce ? { pkce: oAuth2Config.pkce } : {}),
+            ...(oAuth2Config.userAgent ? { userAgent: oAuth2Config.userAgent } : {}),
             generateStateFunction: async (request) => {
                 const redirectToUrl = request.query.redirectToUrl;
                 const result = (0, helper_1.validateRedirectUrl)(redirectToUrl);
@@ -58,39 +77,63 @@ function createOAuth2Plugin(authSource, oAuth2Config) {
                 return securityStore.generateOneTimeToken(common_1.AuthOTTPurpose.OAuth2State, { redirectToUrl }, common_1.config.SECURITY_OAUTH2_STATE_TTL);
             },
             checkStateFunction: async (request) => {
-                const state = request.query.state;
+                const state = authResponse(request).state;
                 request.oauth2State =
                     await securityStore.useOneTimeToken(state, common_1.AuthOTTPurpose.OAuth2State);
                 return true;
             }
         });
-        server.get(`${prefix}/login/${lowerName}/callback`, {
-            schema: (0, oauth2_schema_1.createOAuth2CallbackSchema)(name)
-        }, async function (request, reply) {
+        const callbackHandler = async function (request, reply) {
             const { token } = await server[authSource].getAccessTokenFromAuthorizationCodeFlow(request);
-            const userInfo = await oAuth2Config.extractUserInfo(token.access_token);
+            const userInfo = await oAuth2Config.extractUserInfo(token.access_token, {
+                token: token,
+                request
+            });
             let authUser = await authService.findByUsername(userInfo.email);
-            await authService.checkOAuth2User(authSource, userInfo, authUser);
+            await oauth2Service.checkUser(authSource, userInfo, authUser);
+            // Decided before the user is (possibly) registered, so a freshly created account is never asked to confirm
+            const passwordRequired = !!authUser &&
+                (await oauth2Service.requiresPasswordConfirmation(authUser, authSource, userInfo.id));
             if (!authUser) {
                 if (!common_1.config.SECURITY_OAUTH2_REGISTRATION_ENABLED) {
                     throw new errors_1.HttpError('Auth user does not exist and OAuth2 registration is disabled', 403);
                 }
                 authUser = await authService.registerAuthUser(authSource, userInfo.email, undefined, {
-                    ...(0, common_1.pickProperties)(userInfo, [
-                        'firstName',
-                        'lastName',
-                        'avatarUrl'
-                    ]),
-                    avatarFile: await fetchAvatarFile(userInfo)
+                    ...(0, common_1.pickProperties)(userInfo, ['firstName', 'lastName', 'avatarUrl']),
+                    avatarFile: userInfo.avatarFile ?? (await fetchAvatarFile(userInfo))
                 });
             }
-            else if (!authUser.verifiedEmail) {
-                throw new errors_1.HttpError('Auth user email address is not verified', 403);
-            }
             const stateData = request.oauth2State;
-            const ott = await securityStore.generateOneTimeToken(common_1.AuthOTTPurpose.Authentication, { authUserId: authUser.id, authSource }, common_1.config.SECURITY_AUTH_OTT_TTL);
+            const ott = await securityStore.generateOneTimeToken(common_1.AuthOTTPurpose.Authentication, {
+                authUserId: authUser.id,
+                authSource,
+                providerAccountId: userInfo.id,
+                scope: token.scope ?? oAuth2Config.scope.join(' '),
+                passwordRequired
+            }, common_1.config.SECURITY_AUTH_OTT_TTL);
             const separator = stateData.redirectToUrl.includes('?') ? '&' : '?';
-            return reply.redirect(`${stateData.redirectToUrl}${separator}token=${ott}`);
+            // Tell the client upfront so it can collect the password before spending the single-use token
+            const confirmation = passwordRequired ? '&passwordRequired=true' : '';
+            return reply.redirect(`${stateData.redirectToUrl}${separator}token=${ott}${confirmation}`);
+        };
+        if (!oAuth2Config.formPostCallback) {
+            server.get(callbackPath, { schema: (0, oauth2_schema_1.createOAuth2CallbackSchema)(displayName) }, callbackHandler);
+            return;
+        }
+        // Register the form-post callback in an encapsulated scope so its urlencoded body parser and
+        // the query rewrite below stay local to this single route.
+        await server.register(async (scope) => {
+            if (!scope.hasContentTypeParser('application/x-www-form-urlencoded')) {
+                scope.addContentTypeParser('application/x-www-form-urlencoded', { parseAs: 'string' }, (_request, body, done) => done(null, Object.fromEntries(new URLSearchParams(body))));
+            }
+            scope.post(callbackPath, {
+                schema: (0, oauth2_schema_1.createOAuth2CallbackSchema)(displayName, true),
+                preHandler: async (request) => {
+                    // @fastify/oauth2 reads the authorization code off the query string only.
+                    const { code, state } = authResponse(request);
+                    request.query = { ...request.query, code, state };
+                }
+            }, callbackHandler);
         });
     });
 }

package/security/oauth2/index.d.ts

@@ -1,3 +1,9 @@
 export * from './oauth2-custom';
+export * from './oauth2-apple';
 export * from './oauth2-facebook';
+export * from './oauth2-github';
+export * from './oauth2-gitlab';
 export * from './oauth2-google';
+export * from './oauth2-linkedin';
+export * from './oauth2-microsoft';
+export * from './oauth2-x';

package/security/oauth2/index.js

@@ -15,5 +15,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./oauth2-custom"), exports);
+__exportStar(require("./oauth2-apple"), exports);
 __exportStar(require("./oauth2-facebook"), exports);
+__exportStar(require("./oauth2-github"), exports);
+__exportStar(require("./oauth2-gitlab"), exports);
 __exportStar(require("./oauth2-google"), exports);
+__exportStar(require("./oauth2-linkedin"), exports);
+__exportStar(require("./oauth2-microsoft"), exports);
+__exportStar(require("./oauth2-x"), exports);

package/security/oauth2/oauth2-apple.d.ts

@@ -0,0 +1,10 @@
+import { OAuth2UserInfoContext, UserInfo } from '../../types';
+export declare const oauth2Apple: (server: import("../../types").Server) => Promise<void>;
+/**
+ * Builds the user info from Apple's token response. Apple has no user info endpoint: the identity is carried by the
+ * `id_token`, and the display name is posted alongside the authorization code on the very first authorization only.
+ *
+ * @param {OAuth2UserInfoContext} context - The token set and callback request from the authorization code flow.
+ * @return {Promise<UserInfo>} A promise resolving to the extracted user info.
+ */
+export declare function extractAppleUser({ token, request }: OAuth2UserInfoContext): Promise<UserInfo>;