@atlasauth/backend 0.14.1 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +23 -0
- package/dist/access-control.d.ts +53 -0
- package/dist/access-control.js +46 -0
- package/dist/access-control.js.map +1 -0
- package/dist/algs.d.ts +7 -0
- package/dist/algs.js +11 -0
- package/dist/algs.js.map +1 -0
- package/dist/client/api-keys.d.ts +49 -4
- package/dist/client/api-keys.js +6 -2
- package/dist/client/api-keys.js.map +1 -1
- package/dist/client/app-roles.d.ts +76 -0
- package/dist/client/app-roles.js +39 -0
- package/dist/client/app-roles.js.map +1 -0
- package/dist/client/email-templates.d.ts +1 -1
- package/dist/client/email-templates.js.map +1 -1
- package/dist/client/index.d.ts +49 -3
- package/dist/client/index.js +4 -0
- package/dist/client/index.js.map +1 -1
- package/dist/client/instance-security.d.ts +34 -0
- package/dist/client/instance-security.js +8 -0
- package/dist/client/instance-security.js.map +1 -1
- package/dist/client/notifications.d.ts +1 -1
- package/dist/client/notifications.js.map +1 -1
- package/dist/client/oauth-clients.d.ts +57 -2
- package/dist/client/oauth-clients.js +13 -0
- package/dist/client/oauth-clients.js.map +1 -1
- package/dist/client/referrals.d.ts +1 -1
- package/dist/client/resource-servers.d.ts +12 -3
- package/dist/client/resource-servers.js.map +1 -1
- package/dist/client/scim-tokens.d.ts +18 -0
- package/dist/client/scim-tokens.js +4 -0
- package/dist/client/scim-tokens.js.map +1 -1
- package/dist/client/sso-connections.d.ts +22 -0
- package/dist/client/sso-connections.js.map +1 -1
- package/dist/client/users.d.ts +40 -4
- package/dist/client/users.js +8 -3
- package/dist/client/users.js.map +1 -1
- package/dist/index.d.ts +3 -0
- package/dist/index.js +13 -1
- package/dist/index.js.map +1 -1
- package/dist/logout-token.d.ts +1 -1
- package/dist/logout-token.js +3 -2
- package/dist/logout-token.js.map +1 -1
- package/dist/oauth-resource.d.ts +145 -0
- package/dist/oauth-resource.js +294 -0
- package/dist/oauth-resource.js.map +1 -0
- package/dist/oidc.d.ts +1 -1
- package/dist/oidc.js +5 -3
- package/dist/oidc.js.map +1 -1
- package/dist/referral-test-calls.d.ts +7 -7
- package/dist/referral-test-calls.js +2 -2
- package/dist/testing.d.ts +6 -4
- package/dist/testing.js +7 -6
- package/dist/testing.js.map +1 -1
- package/dist/verify.d.ts +11 -0
- package/dist/verify.js +15 -1
- package/dist/verify.js.map +1 -1
- package/package.json +2 -2
|
@@ -4,6 +4,14 @@ exports.instanceSecurityResource = instanceSecurityResource;
|
|
|
4
4
|
const request_1 = require("./request");
|
|
5
5
|
function instanceSecurityResource(request) {
|
|
6
6
|
return {
|
|
7
|
+
/** The published token-signing keys, newest first. */
|
|
8
|
+
listSigningKeys() {
|
|
9
|
+
return request({ method: 'GET', path: '/v1/instance/signing_keys' });
|
|
10
|
+
},
|
|
11
|
+
/** Rotate the signing key (optionally switching between RS256 and ES256). */
|
|
12
|
+
rotateSigningKey(body = {}) {
|
|
13
|
+
return request({ method: 'POST', path: '/v1/instance/signing_keys/rotate', body });
|
|
14
|
+
},
|
|
7
15
|
get() {
|
|
8
16
|
return request({ method: 'GET', path: '/v1/instance/security' });
|
|
9
17
|
},
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AAwGA,4DAqEC;AA7KD,uCAAgD;AAwGhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,sDAAsD;QACtD,eAAe;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,6EAA6E;QAC7E,gBAAgB,CAAC,OAA6B,EAAE;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,iHAAiH;QACjH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,qEAAqE;QACrE,iBAAiB;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { type RequestFn } from './request';
|
|
2
2
|
/** Built-in notification templates `send` falls back to when no tenant template has the name. */
|
|
3
|
-
export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed';
|
|
3
|
+
export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed' | 'email_changed';
|
|
4
4
|
export interface SendNotificationBody {
|
|
5
5
|
/** The end-user to notify. */
|
|
6
6
|
user_id: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AAkEA,sDAqDC;AAvHD,uCAAgD;AAkEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -34,9 +34,46 @@ export interface OAuthClient {
|
|
|
34
34
|
* with no "Sign out?" page. First-party clients only.
|
|
35
35
|
*/
|
|
36
36
|
skip_logout_confirmation?: boolean;
|
|
37
|
+
/** Refused at every OAuth endpoint while true (kept, not deleted). */
|
|
38
|
+
disabled?: boolean;
|
|
39
|
+
/** PKCE required even though the client is confidential. */
|
|
40
|
+
require_pkce?: boolean;
|
|
41
|
+
/** OIDC Core §8: `pairwise` clients see a per-sector `sub` instead of the user id. */
|
|
42
|
+
subject_type?: 'public' | 'pairwise';
|
|
43
|
+
sector_identifier_uri?: string | null;
|
|
44
|
+
/** When the current secret stops authenticating (epoch ms); null = never. */
|
|
45
|
+
client_secret_expires_at?: number | null;
|
|
37
46
|
created_at: number;
|
|
38
47
|
updated_at: number;
|
|
39
48
|
}
|
|
49
|
+
/** OIDC Core §8 subject settings, accepted on create and update. */
|
|
50
|
+
export interface OAuthClientSubjectFields {
|
|
51
|
+
/** `public` (default): the user id. `pairwise`: a per-sector identifier. */
|
|
52
|
+
subject_type?: 'public' | 'pairwise';
|
|
53
|
+
/** https URL serving a JSON array of every redirect URI; its host is the sector. `null` clears it. */
|
|
54
|
+
sector_identifier_uri?: string | null;
|
|
55
|
+
}
|
|
56
|
+
/** An RFC 7591 §3 initial access token for dynamic client registration. */
|
|
57
|
+
export interface OAuthInitialAccessToken {
|
|
58
|
+
object: 'oauth_initial_access_token';
|
|
59
|
+
id: string;
|
|
60
|
+
token_prefix: string;
|
|
61
|
+
description: string | null;
|
|
62
|
+
status: 'active' | 'expired' | 'used_up' | 'revoked';
|
|
63
|
+
max_uses: number | null;
|
|
64
|
+
use_count: number;
|
|
65
|
+
expires_at: number | null;
|
|
66
|
+
revoked_at: number | null;
|
|
67
|
+
last_used_at: number | null;
|
|
68
|
+
created_at: number;
|
|
69
|
+
}
|
|
70
|
+
export interface CreateInitialAccessTokenBody {
|
|
71
|
+
description?: string;
|
|
72
|
+
/** Lifetime in seconds (60 – 31536000); omit for no expiry. */
|
|
73
|
+
expires_in_seconds?: number;
|
|
74
|
+
/** Registrations allowed (1 – 1000000); omit for unlimited. */
|
|
75
|
+
max_uses?: number;
|
|
76
|
+
}
|
|
40
77
|
/**
|
|
41
78
|
* OIDC logout registration (RP-Initiated, Back-Channel and Front-Channel
|
|
42
79
|
* Logout), accepted on create and update. On update, `null` clears a URI and
|
|
@@ -62,6 +99,8 @@ export interface RotateOAuthClientSecretBody {
|
|
|
62
99
|
* hours); 0 revokes it now (after a leak); at most 604800 (7 days).
|
|
63
100
|
*/
|
|
64
101
|
overlap_seconds?: number;
|
|
102
|
+
/** How long the NEW secret authenticates, in seconds; omit for no expiry. */
|
|
103
|
+
secret_expires_in_seconds?: number;
|
|
65
104
|
}
|
|
66
105
|
/** The rotate response: the new secret (shown once) and when the old one stops working. */
|
|
67
106
|
export interface OAuthClientSecretRotation extends OAuthClientWithSecret {
|
|
@@ -81,7 +120,7 @@ export interface ClientGrant {
|
|
|
81
120
|
created_at: number;
|
|
82
121
|
updated_at: number;
|
|
83
122
|
}
|
|
84
|
-
export interface CreateOAuthClientBody extends OAuthClientLogoutFields {
|
|
123
|
+
export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields {
|
|
85
124
|
name: string;
|
|
86
125
|
redirect_uris: string[];
|
|
87
126
|
allowed_scopes?: string[];
|
|
@@ -89,14 +128,20 @@ export interface CreateOAuthClientBody extends OAuthClientLogoutFields {
|
|
|
89
128
|
token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
|
|
90
129
|
logo_url?: string;
|
|
91
130
|
first_party?: boolean;
|
|
131
|
+
/** How long the issued secret authenticates, in seconds; omit for no expiry. */
|
|
132
|
+
secret_expires_in_seconds?: number;
|
|
92
133
|
}
|
|
93
|
-
export interface UpdateOAuthClientBody extends OAuthClientLogoutFields {
|
|
134
|
+
export interface UpdateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields {
|
|
94
135
|
name?: string;
|
|
95
136
|
redirect_uris?: string[];
|
|
96
137
|
allowed_scopes?: string[];
|
|
97
138
|
token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
|
|
98
139
|
logo_url?: string | null;
|
|
99
140
|
first_party?: boolean;
|
|
141
|
+
/** Refuse every OAuth flow for this client without deleting it. */
|
|
142
|
+
disabled?: boolean;
|
|
143
|
+
/** Require PKCE for this confidential client too. */
|
|
144
|
+
require_pkce?: boolean;
|
|
100
145
|
}
|
|
101
146
|
/** One client in a migration import. Idempotent per `client_id`. */
|
|
102
147
|
export interface ImportOAuthClientEntry {
|
|
@@ -197,6 +242,16 @@ export declare function oauthClientsResource(request: RequestFn): {
|
|
|
197
242
|
listBackchannelDeliveries(id: string, query?: BackchannelDeliveriesQuery): Promise<BackchannelLogoutDeliveryPage>;
|
|
198
243
|
/** Send a test back-channel logout now and return what the receiver answered. */
|
|
199
244
|
testBackchannelLogout(id: string): Promise<BackchannelLogoutTest>;
|
|
245
|
+
/** RFC 7591 §3 initial access tokens for dynamic client registration. */
|
|
246
|
+
initialAccessTokens: {
|
|
247
|
+
list(): Promise<ListPage<OAuthInitialAccessToken>>;
|
|
248
|
+
/** The `token` is in this response only. */
|
|
249
|
+
create(body?: CreateInitialAccessTokenBody): Promise<OAuthInitialAccessToken & {
|
|
250
|
+
token: string;
|
|
251
|
+
note: string;
|
|
252
|
+
}>;
|
|
253
|
+
revoke(id: string): Promise<OAuthInitialAccessToken>;
|
|
254
|
+
};
|
|
200
255
|
grants: {
|
|
201
256
|
list(clientId: string): Promise<ListPage<ClientGrant>>;
|
|
202
257
|
create(clientId: string, body: {
|
|
@@ -47,6 +47,19 @@ function oauthClientsResource(request) {
|
|
|
47
47
|
testBackchannelLogout(id) {
|
|
48
48
|
return request({ method: 'POST', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/backchannel_logout/test` });
|
|
49
49
|
},
|
|
50
|
+
/** RFC 7591 §3 initial access tokens for dynamic client registration. */
|
|
51
|
+
initialAccessTokens: {
|
|
52
|
+
list() {
|
|
53
|
+
return request({ method: 'GET', path: '/v1/oauth_initial_access_tokens' });
|
|
54
|
+
},
|
|
55
|
+
/** The `token` is in this response only. */
|
|
56
|
+
create(body = {}) {
|
|
57
|
+
return request({ method: 'POST', path: '/v1/oauth_initial_access_tokens', body });
|
|
58
|
+
},
|
|
59
|
+
revoke(id) {
|
|
60
|
+
return request({ method: 'DELETE', path: `/v1/oauth_initial_access_tokens/${(0, request_1.enc)(id)}` });
|
|
61
|
+
},
|
|
62
|
+
},
|
|
50
63
|
grants: {
|
|
51
64
|
list(clientId) {
|
|
52
65
|
return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/grants` });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA8OA,oDA+FC;AA7UD,uCAAgD;AA8OhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -12,7 +12,7 @@ import type { UserReferralResult } from './users';
|
|
|
12
12
|
*
|
|
13
13
|
* `provider` is `webhook` (the Atlas referral protocol, which any platform can
|
|
14
14
|
* implement; see {@link verifyReferralRequest}), `referally` (the built-in
|
|
15
|
-
*
|
|
15
|
+
* Referalli adapter: `endpoint_url` is your Referalli base URL, plus
|
|
16
16
|
* `connection_id`, `signing_secret` and optionally `tracking_token`) or
|
|
17
17
|
* another built-in vendor adapter.
|
|
18
18
|
* `signing_secret`, `api_key` and `inbound_secret` are write-only: reads
|
|
@@ -11,7 +11,10 @@ export interface ResourceServer {
|
|
|
11
11
|
name: string;
|
|
12
12
|
scopes: ResourceServerScope[];
|
|
13
13
|
token_ttl_seconds: number;
|
|
14
|
-
|
|
14
|
+
/** RS256 (default) or ES256: the algorithm of this API's access tokens. */
|
|
15
|
+
signing_alg: 'RS256' | 'ES256' | string;
|
|
16
|
+
/** RFC 9728: Atlas serves protected-resource metadata for this API. */
|
|
17
|
+
publish_resource_metadata?: boolean;
|
|
15
18
|
created_at: number;
|
|
16
19
|
updated_at: number;
|
|
17
20
|
}
|
|
@@ -21,13 +24,19 @@ export interface CreateResourceServerBody {
|
|
|
21
24
|
/** Each scope is a bare string or `{ value, description? }`. */
|
|
22
25
|
scopes?: Array<string | ResourceServerScope>;
|
|
23
26
|
token_ttl_seconds?: number;
|
|
24
|
-
|
|
27
|
+
/** RS256 (default) or ES256. */
|
|
28
|
+
signing_alg?: 'RS256' | 'ES256';
|
|
29
|
+
/** RFC 9728: serve protected-resource metadata for this API. */
|
|
30
|
+
publish_resource_metadata?: boolean;
|
|
25
31
|
}
|
|
26
32
|
export interface UpdateResourceServerBody {
|
|
27
33
|
name?: string;
|
|
28
34
|
scopes?: Array<string | ResourceServerScope>;
|
|
29
35
|
token_ttl_seconds?: number;
|
|
30
|
-
|
|
36
|
+
/** RS256 (default) or ES256. */
|
|
37
|
+
signing_alg?: 'RS256' | 'ES256';
|
|
38
|
+
/** RFC 9728: serve protected-resource metadata for this API. */
|
|
39
|
+
publish_resource_metadata?: boolean;
|
|
31
40
|
/** Immutable — supplying a different value is rejected. */
|
|
32
41
|
identifier?: string;
|
|
33
42
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resource-servers.js","sourceRoot":"","sources":["../../src/client/resource-servers.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"resource-servers.js","sourceRoot":"","sources":["../../src/client/resource-servers.ts"],"names":[],"mappings":";;AA+CA,0DAkBC;AAjED,uCAAgD;AA+ChD,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAA8B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA8B;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -7,6 +7,10 @@ export interface ScimToken {
|
|
|
7
7
|
organization_id: string;
|
|
8
8
|
connection_id: string | null;
|
|
9
9
|
prefix: string;
|
|
10
|
+
/** null = read and write; ['read'] = read-only. */
|
|
11
|
+
scopes?: Array<'read' | 'write'> | null;
|
|
12
|
+
/** SCIM user roles[].value → organization role key. */
|
|
13
|
+
role_mappings?: ScimRoleMapping[];
|
|
10
14
|
last_used_at: number | null;
|
|
11
15
|
expires_at: number | null;
|
|
12
16
|
revoked_at: number | null;
|
|
@@ -17,14 +21,28 @@ export interface ScimTokenWithSecret extends ScimToken {
|
|
|
17
21
|
secret: string;
|
|
18
22
|
note: string;
|
|
19
23
|
}
|
|
24
|
+
export interface ScimRoleMapping {
|
|
25
|
+
value: string;
|
|
26
|
+
role: string;
|
|
27
|
+
}
|
|
20
28
|
export interface CreateScimTokenBody {
|
|
21
29
|
organization_id: string;
|
|
22
30
|
name?: string;
|
|
23
31
|
connection_id?: string;
|
|
32
|
+
/** ['read'] mints a read-only token. */
|
|
33
|
+
scopes?: Array<'read' | 'write'>;
|
|
34
|
+
role_mappings?: ScimRoleMapping[];
|
|
35
|
+
}
|
|
36
|
+
export interface UpdateScimTokenBody {
|
|
37
|
+
name?: string | null;
|
|
38
|
+
scopes?: Array<'read' | 'write'> | null;
|
|
39
|
+
role_mappings?: ScimRoleMapping[] | null;
|
|
24
40
|
}
|
|
25
41
|
export declare function scimTokensResource(request: RequestFn): {
|
|
26
42
|
list(): Promise<ListPage<ScimToken>>;
|
|
27
43
|
create(body: CreateScimTokenBody, idempotencyKey?: string): Promise<ScimTokenWithSecret>;
|
|
44
|
+
/** Change a token's name, scopes or role mappings. */
|
|
45
|
+
update(id: string, body: UpdateScimTokenBody): Promise<ScimToken>;
|
|
28
46
|
revoke(id: string): Promise<{
|
|
29
47
|
object: "scim_token";
|
|
30
48
|
id: string;
|
|
@@ -10,6 +10,10 @@ function scimTokensResource(request) {
|
|
|
10
10
|
create(body, idempotencyKey) {
|
|
11
11
|
return request({ method: 'POST', path: '/v1/scim_tokens', body, idempotencyKey });
|
|
12
12
|
},
|
|
13
|
+
/** Change a token's name, scopes or role mappings. */
|
|
14
|
+
update(id, body) {
|
|
15
|
+
return request({ method: 'PATCH', path: `/v1/scim_tokens/${(0, request_1.enc)(id)}`, body });
|
|
16
|
+
},
|
|
13
17
|
revoke(id) {
|
|
14
18
|
return request({ method: 'POST', path: `/v1/scim_tokens/${(0, request_1.enc)(id)}/revoke` });
|
|
15
19
|
},
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scim-tokens.js","sourceRoot":"","sources":["../../src/client/scim-tokens.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"scim-tokens.js","sourceRoot":"","sources":["../../src/client/scim-tokens.ts"],"names":[],"mappings":";;AA8CA,gDAkBC;AAhED,uCAAgD;AA8ChD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAyB,EAAE,cAAuB;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,sDAAsD;QACtD,MAAM,CAAC,EAAU,EAAE,IAAyB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -27,6 +27,15 @@ export interface SsoConnection {
|
|
|
27
27
|
allowed_domains: string[];
|
|
28
28
|
claim_role_mappings: ClaimRoleMapping[];
|
|
29
29
|
default_role_id: string | null;
|
|
30
|
+
/** Which IdP claim/attribute carries each profile field (only the set keys). */
|
|
31
|
+
attribute_mapping?: SsoAttributeMapping;
|
|
32
|
+
/** OIDC: extra scopes requested on top of openid email profile. */
|
|
33
|
+
oidc_scopes?: string[];
|
|
34
|
+
/** Routing domains of an org-owned connection that the org has not verified. */
|
|
35
|
+
domain_warnings?: Array<{
|
|
36
|
+
domain: string;
|
|
37
|
+
code: 'unverified_organization_domain';
|
|
38
|
+
}>;
|
|
30
39
|
created_at: number;
|
|
31
40
|
updated_at: number;
|
|
32
41
|
}
|
|
@@ -58,6 +67,19 @@ export interface CreateSsoConnectionBody {
|
|
|
58
67
|
allowed_domains?: string[];
|
|
59
68
|
claim_role_mappings?: ClaimRoleMapping[];
|
|
60
69
|
default_role_id?: string | null;
|
|
70
|
+
/** null clears it. */
|
|
71
|
+
attribute_mapping?: SsoAttributeMapping | null;
|
|
72
|
+
/** OIDC only; null clears them. */
|
|
73
|
+
oidc_scopes?: string[] | null;
|
|
74
|
+
}
|
|
75
|
+
/** Claim (OIDC) or attribute (SAML) names for each profile field. */
|
|
76
|
+
export interface SsoAttributeMapping {
|
|
77
|
+
email?: string;
|
|
78
|
+
/** A remapped email is unverified unless this claim is mapped and true. */
|
|
79
|
+
email_verified?: string;
|
|
80
|
+
first_name?: string;
|
|
81
|
+
last_name?: string;
|
|
82
|
+
username?: string;
|
|
61
83
|
}
|
|
62
84
|
/** PATCH accepts everything create does except `type`, which is immutable. */
|
|
63
85
|
export type UpdateSsoConnectionBody = Omit<CreateSsoConnectionBody, 'type'>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sso-connections.js","sourceRoot":"","sources":["../../src/client/sso-connections.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"sso-connections.js","sourceRoot":"","sources":["../../src/client/sso-connections.ts"],"names":[],"mappings":";;AAyFA,wDAsBC;AA/GD,uCAAgD;AAyFhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA6B,EAAE,cAAuB;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,0EAA0E;QAC1E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/client/users.d.ts
CHANGED
|
@@ -11,6 +11,8 @@ export interface User {
|
|
|
11
11
|
public_metadata: Metadata;
|
|
12
12
|
mfa_enabled: boolean;
|
|
13
13
|
banned: boolean;
|
|
14
|
+
/** A timed ban's expiry (epoch ms); null for a permanent ban or none. */
|
|
15
|
+
ban_expires_at?: number | null;
|
|
14
16
|
locked: boolean;
|
|
15
17
|
/** Epoch milliseconds, or null if never signed in. */
|
|
16
18
|
last_sign_in_at: number | null;
|
|
@@ -175,7 +177,29 @@ export interface UserSession {
|
|
|
175
177
|
impersonated_by?: string | null;
|
|
176
178
|
created_at: number;
|
|
177
179
|
}
|
|
178
|
-
|
|
180
|
+
/** `GET /v1/users` search, filters and sort. Every filter is optional and they AND together. */
|
|
181
|
+
export interface ListUsersParams extends CursorParams {
|
|
182
|
+
/** Substring match over id, names, username, emails, phone numbers and external_id. */
|
|
183
|
+
query?: string;
|
|
184
|
+
/** Exact (case-insensitive) match on any of the user's email addresses. */
|
|
185
|
+
email_address?: string;
|
|
186
|
+
username?: string;
|
|
187
|
+
phone_number?: string;
|
|
188
|
+
external_id?: string;
|
|
189
|
+
banned?: boolean;
|
|
190
|
+
/** true = has at least one verified email; false = has none. */
|
|
191
|
+
email_verified?: boolean;
|
|
192
|
+
/** Only members of this organization. */
|
|
193
|
+
organization_id?: string;
|
|
194
|
+
/** Unix ms bounds on `created_at` (inclusive). */
|
|
195
|
+
created_after?: number;
|
|
196
|
+
created_before?: number;
|
|
197
|
+
/** Default `-created_at`. `last_sign_in_at` orders page with `offset`, not `starting_after`. */
|
|
198
|
+
order_by?: 'created_at' | '-created_at' | 'last_sign_in_at' | '-last_sign_in_at';
|
|
199
|
+
offset?: number;
|
|
200
|
+
/** Adds `total_count` (a COUNT over the filters) to the page. */
|
|
201
|
+
include_total_count?: boolean;
|
|
202
|
+
}
|
|
179
203
|
export interface CreateUserBody {
|
|
180
204
|
email_address: string;
|
|
181
205
|
password?: string;
|
|
@@ -218,8 +242,10 @@ export interface ReplaceUserMetadataBody {
|
|
|
218
242
|
unsafe_metadata?: Metadata;
|
|
219
243
|
}
|
|
220
244
|
export declare function usersResource(request: RequestFn): {
|
|
221
|
-
/** `GET /v1/users` — cursor-paginated. */
|
|
222
|
-
list(params?: ListUsersParams): Promise<CursorPage<User
|
|
245
|
+
/** `GET /v1/users` — search, filter and sort; cursor- (or offset-) paginated. */
|
|
246
|
+
list(params?: ListUsersParams): Promise<CursorPage<User> & {
|
|
247
|
+
total_count?: number;
|
|
248
|
+
}>;
|
|
223
249
|
get(id: string): Promise<User>;
|
|
224
250
|
create(body: CreateUserBody, idempotencyKey?: string): Promise<User>;
|
|
225
251
|
update(id: string, body: UpdateUserBody): Promise<User>;
|
|
@@ -232,7 +258,17 @@ export declare function usersResource(request: RequestFn): {
|
|
|
232
258
|
setExternalId(id: string, externalId: string | null): Promise<User>;
|
|
233
259
|
/** `PUT /v1/users/:id/metadata` — replaces the named bags wholesale. */
|
|
234
260
|
replaceMetadata(id: string, body: ReplaceUserMetadataBody): Promise<User>;
|
|
235
|
-
|
|
261
|
+
/**
|
|
262
|
+
* `POST /v1/users/:id/ban` — ban and revoke every session. Permanent unless
|
|
263
|
+
* `expires_in_seconds` or `expires_at` (Unix ms) is sent: a timed ban lifts
|
|
264
|
+
* itself (`user.unbanned` is sent when it does).
|
|
265
|
+
*/
|
|
266
|
+
ban(id: string, body?: {
|
|
267
|
+
reason?: string;
|
|
268
|
+
note?: string;
|
|
269
|
+
expires_in_seconds?: number;
|
|
270
|
+
expires_at?: number;
|
|
271
|
+
}): Promise<User>;
|
|
236
272
|
unban(id: string): Promise<User>;
|
|
237
273
|
lock(id: string, body?: {
|
|
238
274
|
duration_in_seconds?: number;
|
package/dist/client/users.js
CHANGED
|
@@ -4,7 +4,7 @@ exports.usersResource = usersResource;
|
|
|
4
4
|
const request_1 = require("./request");
|
|
5
5
|
function usersResource(request) {
|
|
6
6
|
return {
|
|
7
|
-
/** `GET /v1/users` — cursor-paginated. */
|
|
7
|
+
/** `GET /v1/users` — search, filter and sort; cursor- (or offset-) paginated. */
|
|
8
8
|
list(params = {}) {
|
|
9
9
|
return request({ method: 'GET', path: '/v1/users', query: { ...params } });
|
|
10
10
|
},
|
|
@@ -30,8 +30,13 @@ function usersResource(request) {
|
|
|
30
30
|
replaceMetadata(id, body) {
|
|
31
31
|
return request({ method: 'PUT', path: `/v1/users/${(0, request_1.enc)(id)}/metadata`, body });
|
|
32
32
|
},
|
|
33
|
-
|
|
34
|
-
|
|
33
|
+
/**
|
|
34
|
+
* `POST /v1/users/:id/ban` — ban and revoke every session. Permanent unless
|
|
35
|
+
* `expires_in_seconds` or `expires_at` (Unix ms) is sent: a timed ban lifts
|
|
36
|
+
* itself (`user.unbanned` is sent when it does).
|
|
37
|
+
*/
|
|
38
|
+
ban(id, body = {}) {
|
|
39
|
+
return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/ban`, body });
|
|
35
40
|
},
|
|
36
41
|
unban(id) {
|
|
37
42
|
return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/unban` });
|
package/dist/client/users.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/client/users.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/client/users.ts"],"names":[],"mappings":";;AA8PA,sCA+cC;AA7sBD,uCAAgD;AA8PhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,iFAAiF;QACjF,IAAI,CAAC,SAA0B,EAAE;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD;;;;;WAKG;QACH,aAAa,CAAC,EAAU,EAAE,UAAyB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,wEAAwE;QACxE,eAAe,CAAC,EAAU,EAAE,IAA6B;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD;;;;WAIG;QACH,GAAG,CACD,EAAU,EACV,OAA6F,EAAE;YAE/F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,EAAU,EAAE,OAAyC,EAAE;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD;;;;;;WAMG;QACH,YAAY,CACV,EAAU,EACV,OAA4B,EAAE,EAC9B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAC1C,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,eAAe,CACb,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,cAAc,CACZ,EAAU,EACV,UAAuC,EAAE;YAEzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,EAAU,EAAE,IAA+B;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,WAAW,CAAC,EAAU,EAAE,OAAe;YACrC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;aACpE,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,EAAU,EAAE,OAAe;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU;aACrE,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,EAAU,EAAE,QAAgB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,YAAY,CACV,EAAU,EACV,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD;;;;;;;;WAQG;QACH,sBAAsB,CACpB,EAAU,EACV,IAA8E,EAC9E,cAAuB;YASvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,4BAA4B;gBACtD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CACZ,EAAU,EACV,UAAkB;YAElB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,+EAA+E;QAC/E,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QACD;;;;WAIG;QACH,eAAe,CACb,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,WAAW,CACT,OAAe;YAEf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAAuB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6GAA6G;QAC7G,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,SAAuB,EAAE;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,2BAA2B,CACzB,EAAU,EACV,SAAuB,EAAE;YAEzB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;gBACrD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,EAAU,EAAE,IAAyB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,sEAAsE;QACtE,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,sFAAsF;QACtF,aAAa,CACX,EAAU,EACV,SAAiB;YAEjB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CAAC,EAAU,EAAE,IAAwB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;;WAIG;QACH,wBAAwB,CACtB,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,kBAAkB,CAChB,EAAU,EACV,IAAwB,EACxB,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe;gBACzC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,aAAa,CAAC,EAAU;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,sGAAsG;QACtG,QAAQ,EAAE;YACR,wGAAwG;YACxG,QAAQ,CACN,EAAU,EACV,OAAmC,EAAE,EACrC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,uFAAuF;YACvF,MAAM,CAAC,EAAU,EAAE,cAAuB;gBACxC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;oBAC5C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qGAAqG;YACrG,QAAQ,CACN,EAAU,EACV,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB;oBAC9C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,uEAAuE;QACvE,UAAU,EAAE;YACV,gFAAgF;YAChF,MAAM,CACJ,EAAU,EACV,IAA6B,EAC7B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;oBACvC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YAChF,CAAC;SACF;QACD,yEAAyE;QACzE,QAAQ,EAAE;YACR,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,wHAAwH;YACxH,MAAM,CACJ,EAAU,EACV,IAA2B,EAC3B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,sFAAsF;QACtF,gBAAgB,EAAE;YAChB;;;;eAIG;YACH,MAAM,CAAC,EAAU,EAAE,IAAmC;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,2EAA2E;YAC3E,GAAG,CAAC,EAAU,EAAE,UAAkB;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;QACD,yDAAyD;QACzD,uBAAuB,EAAE;YACvB,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;iBACtD,CAAC,CAAC;YACL,CAAC;YACD,iGAAiG;YACjG,MAAM,CACJ,EAAU,EACV,IAA2C;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;oBACrD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;QACD,wEAAwE;QACxE,YAAY,EAAE;YACZ,yBAAyB;YACzB,GAAG,CAAC,EAAU,EAAE,IAA8B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CAAC,EAAU,EAAE,OAAe;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;iBAClE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,EAAU,EACV,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;SACF;QACD,8BAA8B;QAC9B,WAAW,EAAE;YACX;;;eAGG;YACH,QAAQ,CAAC,EAAU,EAAE,IAA8B;gBACjD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
export * from './jwks-cache';
|
|
2
2
|
export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishableKey } from './discovery';
|
|
3
3
|
export * from './verify';
|
|
4
|
+
export * from './access-control';
|
|
4
5
|
export * from './handshake';
|
|
5
6
|
export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
|
|
6
7
|
export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
|
|
@@ -19,3 +20,5 @@ export { verifyPCActn } from './pca/verify';
|
|
|
19
20
|
export type { PcaVerdict, PcaContext, VerifyPCActnOptions } from './pca/verify';
|
|
20
21
|
export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';
|
|
21
22
|
export type { RequirePcaOptions, PcaGuardResult, PcaRequestLike, PcaStateStore } from './pca/require-pca';
|
|
23
|
+
export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, verifyAccessToken, } from './oauth-resource';
|
|
24
|
+
export type { AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopReplayStore, ResourceRequestLike, } from './oauth-resource';
|
package/dist/index.js
CHANGED
|
@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
|
14
14
|
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
15
|
};
|
|
16
16
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
-
exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
|
|
17
|
+
exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
|
|
18
18
|
// §7.3 token verification — the original surface, unchanged.
|
|
19
19
|
__exportStar(require("./jwks-cache"), exports);
|
|
20
20
|
// OIDC discovery of the JWKS URL when only `issuer` is configured.
|
|
@@ -24,6 +24,7 @@ Object.defineProperty(exports, "JwksDiscovery", { enumerable: true, get: functio
|
|
|
24
24
|
Object.defineProperty(exports, "discoveryUrlFor", { enumerable: true, get: function () { return discovery_1.discoveryUrlFor; } });
|
|
25
25
|
Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: true, get: function () { return discovery_1.instanceIdFromPublishableKey; } });
|
|
26
26
|
__exportStar(require("./verify"), exports);
|
|
27
|
+
__exportStar(require("./access-control"), exports);
|
|
27
28
|
__exportStar(require("./handshake"), exports);
|
|
28
29
|
// OIDC Back-Channel Logout: verify the logout_token Atlas POSTs to your app.
|
|
29
30
|
var logout_token_1 = require("./logout-token");
|
|
@@ -75,4 +76,15 @@ var require_pca_1 = require("./pca/require-pca");
|
|
|
75
76
|
Object.defineProperty(exports, "requirePCA", { enumerable: true, get: function () { return require_pca_1.requirePCA; } });
|
|
76
77
|
Object.defineProperty(exports, "defaultExtract", { enumerable: true, get: function () { return require_pca_1.defaultExtract; } });
|
|
77
78
|
Object.defineProperty(exports, "memoryPcaStore", { enumerable: true, get: function () { return require_pca_1.memoryPcaStore; } });
|
|
79
|
+
// Protecting your own API / MCP server with Atlas-issued OAuth access tokens:
|
|
80
|
+
// local verification (aud, scopes, DPoP) + RFC 6750/9728 challenges + metadata.
|
|
81
|
+
var oauth_resource_1 = require("./oauth-resource");
|
|
82
|
+
Object.defineProperty(exports, "ACCESS_TOKEN_CLOCK_SKEW_SECONDS", { enumerable: true, get: function () { return oauth_resource_1.ACCESS_TOKEN_CLOCK_SKEW_SECONDS; } });
|
|
83
|
+
Object.defineProperty(exports, "DPOP_PROOF_MAX_AGE_SECONDS", { enumerable: true, get: function () { return oauth_resource_1.DPOP_PROOF_MAX_AGE_SECONDS; } });
|
|
84
|
+
Object.defineProperty(exports, "buildWwwAuthenticate", { enumerable: true, get: function () { return oauth_resource_1.buildWwwAuthenticate; } });
|
|
85
|
+
Object.defineProperty(exports, "createAccessTokenVerifier", { enumerable: true, get: function () { return oauth_resource_1.createAccessTokenVerifier; } });
|
|
86
|
+
Object.defineProperty(exports, "memoryDpopReplayStore", { enumerable: true, get: function () { return oauth_resource_1.memoryDpopReplayStore; } });
|
|
87
|
+
Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadata; } });
|
|
88
|
+
Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadataPath; } });
|
|
89
|
+
Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return oauth_resource_1.verifyAccessToken; } });
|
|
78
90
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAS0B;AARxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
|
package/dist/logout-token.d.ts
CHANGED
|
@@ -3,7 +3,7 @@ import { JwksCache, type Jwks } from './jwks-cache';
|
|
|
3
3
|
* OpenID Connect Back-Channel Logout 1.0 — verifying the `logout_token` Atlas
|
|
4
4
|
* POSTs to your `backchannel_logout_uri` when a user's session ends.
|
|
5
5
|
*
|
|
6
|
-
* The checks are those of §2.6 of the spec: RS256 signature from the issuer's
|
|
6
|
+
* The checks are those of §2.6 of the spec: RS256 or ES256 signature from the issuer's
|
|
7
7
|
* JWKS, `iss`, `aud` containing your client id, `iat` present (and not in the
|
|
8
8
|
* future), `exp` when present, a `jti`, the back-channel-logout event, a `sid`
|
|
9
9
|
* and/or `sub`, NO `nonce`, and a `typ` of `logout+jwt` when the header has one.
|
package/dist/logout-token.js
CHANGED
|
@@ -7,11 +7,12 @@ exports.checkLogoutToken = checkLogoutToken;
|
|
|
7
7
|
const jose_1 = require("jose");
|
|
8
8
|
const jwks_cache_1 = require("./jwks-cache");
|
|
9
9
|
const discovery_1 = require("./discovery");
|
|
10
|
+
const algs_1 = require("./algs");
|
|
10
11
|
/**
|
|
11
12
|
* OpenID Connect Back-Channel Logout 1.0 — verifying the `logout_token` Atlas
|
|
12
13
|
* POSTs to your `backchannel_logout_uri` when a user's session ends.
|
|
13
14
|
*
|
|
14
|
-
* The checks are those of §2.6 of the spec: RS256 signature from the issuer's
|
|
15
|
+
* The checks are those of §2.6 of the spec: RS256 or ES256 signature from the issuer's
|
|
15
16
|
* JWKS, `iss`, `aud` containing your client id, `iat` present (and not in the
|
|
16
17
|
* future), `exp` when present, a `jti`, the back-channel-logout event, a `sid`
|
|
17
18
|
* and/or `sub`, NO `nonce`, and a `typ` of `logout+jwt` when the header has one.
|
|
@@ -122,7 +123,7 @@ async function checkLogoutToken(token, cache, options) {
|
|
|
122
123
|
let payload;
|
|
123
124
|
try {
|
|
124
125
|
const verified = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
|
|
125
|
-
algorithms:
|
|
126
|
+
algorithms: algs_1.ATLAS_SIGNING_ALGS,
|
|
126
127
|
issuer: options.issuer,
|
|
127
128
|
audience,
|
|
128
129
|
clockTolerance: exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS,
|
package/dist/logout-token.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"logout-token.js","sourceRoot":"","sources":["../src/logout-token.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"logout-token.js","sourceRoot":"","sources":["../src/logout-token.ts"],"names":[],"mappings":";;;AAoEA,0DAWC;AAiFD,8CAKC;AAGD,4CAoGC;AA5QD,+BAA2E;AAC3E,6CAA6D;AAC7D,2CAA0E;AAC1E,iCAA4C;AAE5C;;;;;;;;GAQG;AAEH,qEAAqE;AACxD,QAAA,wBAAwB,GAAG,oDAAoD,CAAC;AAE7F,wDAAwD;AAC3C,QAAA,+BAA+B,GAAG,CAAC,CAAC;AAEjD,wGAAwG;AAC3F,QAAA,4BAA4B,GAAG,GAAG,CAAC;AA6ChD,yFAAyF;AACzF,SAAgB,uBAAuB,CAAC,MAAoB,IAAI,CAAC,GAAG;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,QAAQ,CAAC,GAAG,EAAE,WAAW;YACvB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAgCD;;;GAGG;AACH,MAAa,mBAAmB;IAGD;IAFZ,KAAK,CAAY;IAElC,YAA6B,OAAmC;QAAnC,YAAO,GAAP,OAAO,CAA4B;QAC9D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,sBAAS,CAAC;YACzB,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAvCD,kDAuCC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,KAAa,EACb,OAAmC;IAEnC,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,KAAgB,EAChB,OAAgC;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,uBAAuB,GAC3B,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,SAAS;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;YAC5E,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACvD,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClF,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;YACxE,UAAU,EAAE,yBAAkB;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ;YACR,cAAc,EAAE,uCAA+B;YAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,IAAI,KAAK,iBAAiB;gBACxB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,KAAK,iCAAiC;oBAC1C,CAAC,CAAC,uBAAwB,KAA4B,CAAC,KAAK,IAAI,SAAS,EAAE;oBAC3E,CAAC,CAAC,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9G,IAAI,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,oCAA4B,CAAC;IACrE,IAAI,MAAM,GAAG,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEtH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAE,MAAkC,CAAC,gCAAwB,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mCAAmC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEnH,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,CAAC,GAAG,GAAG,MAAM,GAAG,uCAA+B,CAAC,GAAG,IAAI,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAsB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC/C,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}
|