@atlasauth/backend 0.23.0 → 0.25.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,gDAA8B;AAC9B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,iDAA+B;AAC/B,gDAA8B;AAC9B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,qFAAqF;AACrF,sDAAoC;AACpC,qDAAmC;AACnC,kDAAgC;AAChC,yCAA6E;AAApE,mHAAA,sBAAsB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AACvD,mDAA+D;AAAtD,6HAAA,2BAA2B,OAAA;AACpC,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAEzC,0DAAwC;AACxC,+EAA+E;AAC/E,4DAA4D;AAC5D,uDAAqC;AACrC,gFAAgF;AAChF,qDAAmC;AAEnC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA;AAYnB,kDAAgC"}

package/dist/legacy-issuer-presets.d.ts

@@ -0,0 +1,85 @@
+import type { LegacyIssuer } from './legacy-issuers';
+/**
+ * `legacyIssuers` presets for the JWT-issuing auth vendors, so a cutover only
+ * names the old tenant and the end of the window:
+ *
+ *   new AtlasBackend({
+ *     ...,
+ *     legacyIssuers: [
+ *       ...clerkLegacyIssuer({ publishableKey: process.env.CLERK_PUBLISHABLE_KEY!, until: '2027-01-31' }),
+ *     ],
+ *   });
+ *
+ * Each preset returns an array (Descope tokens carry one of two `iss` shapes)
+ * of entries with the vendor's issuer, key-set URL, algorithms and subject
+ * claim filled in. The old user id maps to the Atlas user through
+ * `external_id`, which every Atlas importer sets to the vendor's user id.
+ */
+type Window = Pick<LegacyIssuer, 'until' | 'resolveSubject'>;
+/** `example.com` / `https://example.com/` → `https://example.com`. */
+export declare function httpsOrigin(domainOrUrl: string): string;
+/**
+ * The Frontend API host a Clerk publishable key encodes: `pk_(test|live)_` +
+ * base64(`<host>$`).
+ */
+export declare function clerkFrontendApiFromPublishableKey(publishableKey: string): string | null;
+/**
+ * Clerk session tokens (the `__session` cookie / `getToken()`): RS256, `iss` =
+ * the Frontend API origin, keys at `<iss>/.well-known/jwks.json`, `sub` = the
+ * Clerk user id (`user_…`). `authorizedParties` checks `azp` like Clerk's own
+ * `authorizedParties`; a pending session (`sts: "pending"`) is refused.
+ */
+export declare function clerkLegacyIssuer(opts: Window & ({
+    publishableKey: string;
+} | {
+    frontendApi: string;
+}) & {
+    authorizedParties?: readonly string[];
+}): LegacyIssuer[];
+/**
+ * Auth0 (and Okta Customer Identity Cloud) access or ID tokens: `iss` =
+ * `https://<tenant domain>/` WITH the trailing slash, keys at
+ * `/.well-known/jwks.json`, `sub` = the Auth0 user id (`auth0|…`,
+ * `google-oauth2|…`). `audience` is the API identifier (access tokens) or the
+ * client id (ID tokens) — required, since an Auth0 tenant mints tokens for many.
+ */
+export declare function auth0LegacyIssuer(opts: Window & {
+    domain: string;
+    audience: string | readonly string[];
+    algorithms?: readonly string[];
+}): LegacyIssuer[];
+/**
+ * Okta (Workforce Identity Cloud, Customer Identity Solution) tokens from a
+ * CUSTOM authorization server: `iss` = `https://<okta domain>/oauth2/<id>`
+ * (`default` unless set), keys at `<iss>/v1/keys`. Access tokens put the login
+ * in `sub` and the Okta user id in `uid`; ID tokens put the user id in `sub`.
+ * Tokens from the org authorization server (`iss` = the bare domain) are not
+ * meant for resource servers and are not accepted here.
+ */
+export declare function oktaLegacyIssuer(opts: Window & {
+    domain: string;
+    authorizationServerId?: string;
+    /** Access tokens: `api://default` unless the server says otherwise. ID tokens: the client id. */
+    audience?: string | readonly string[];
+    token?: 'access' | 'id';
+}): LegacyIssuer[];
+/**
+ * Kinde access or ID tokens: `iss` = `https://<business>.kinde.com` (or the
+ * custom domain), keys at `/.well-known/jwks`, `sub` = the Kinde user id
+ * (`kp_…`). Set `audience` when the app registered an API audience.
+ */
+export declare function kindeLegacyIssuer(opts: Window & {
+    issuerUrl: string;
+    audience?: string | readonly string[];
+}): LegacyIssuer[];
+/**
+ * Descope session tokens (the `DS` cookie / `sessionToken`): RS256, keys at
+ * `<base>/v2/keys/<project id>`, `sub` = the Descope user id. Projects issue
+ * either `https://api.descope.com/<project id>` or the bare project id as
+ * `iss`, so both are accepted. Refresh tokens (`drn: "DSR"`) are refused.
+ */
+export declare function descopeLegacyIssuer(opts: Window & {
+    projectId: string;
+    baseUrl?: string;
+}): LegacyIssuer[];
+export {};

package/dist/legacy-issuer-presets.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.httpsOrigin = httpsOrigin;
+exports.clerkFrontendApiFromPublishableKey = clerkFrontendApiFromPublishableKey;
+exports.clerkLegacyIssuer = clerkLegacyIssuer;
+exports.auth0LegacyIssuer = auth0LegacyIssuer;
+exports.oktaLegacyIssuer = oktaLegacyIssuer;
+exports.kindeLegacyIssuer = kindeLegacyIssuer;
+exports.descopeLegacyIssuer = descopeLegacyIssuer;
+const RSA_ALGS = ['RS256'];
+function stripSlash(url) {
+    return url.replace(/\/+$/, '');
+}
+/** `example.com` / `https://example.com/` → `https://example.com`. */
+function httpsOrigin(domainOrUrl) {
+    const raw = domainOrUrl.trim();
+    const url = new URL(/^[a-z]+:\/\//i.test(raw) ? raw : `https://${raw}`);
+    if (url.protocol !== 'https:')
+        throw new Error(`legacyIssuers: ${domainOrUrl} must be https.`);
+    return `https://${url.host}`;
+}
+/**
+ * The Frontend API host a Clerk publishable key encodes: `pk_(test|live)_` +
+ * base64(`<host>$`).
+ */
+function clerkFrontendApiFromPublishableKey(publishableKey) {
+    const m = /^pk_(?:test|live)_([A-Za-z0-9+/=_-]+)$/.exec(publishableKey.trim());
+    if (!m)
+        return null;
+    let decoded;
+    try {
+        decoded = Buffer.from(m[1].replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    if (!decoded.endsWith('$'))
+        return null;
+    const host = decoded.slice(0, -1);
+    return /^[a-z0-9.-]+(?::\d+)?$/i.test(host) ? host : null;
+}
+/**
+ * Clerk session tokens (the `__session` cookie / `getToken()`): RS256, `iss` =
+ * the Frontend API origin, keys at `<iss>/.well-known/jwks.json`, `sub` = the
+ * Clerk user id (`user_…`). `authorizedParties` checks `azp` like Clerk's own
+ * `authorizedParties`; a pending session (`sts: "pending"`) is refused.
+ */
+function clerkLegacyIssuer(opts) {
+    const host = 'publishableKey' in opts ? clerkFrontendApiFromPublishableKey(opts.publishableKey) : opts.frontendApi;
+    if (!host)
+        throw new Error('clerkLegacyIssuer: the publishable key does not encode a Frontend API host.');
+    const issuer = httpsOrigin(host);
+    const parties = opts.authorizedParties?.map((p) => stripSlash(p));
+    return [
+        {
+            kind: 'clerk',
+            issuer,
+            jwksUrl: `${issuer}/.well-known/jwks.json`,
+            algorithms: RSA_ALGS,
+            until: opts.until,
+            resolveSubject: opts.resolveSubject,
+            checkClaims: (claims) => {
+                if (claims.sts === 'pending')
+                    return false;
+                if (parties && parties.length > 0 && typeof claims.azp === 'string' && !parties.includes(stripSlash(claims.azp))) {
+                    return false;
+                }
+                return true;
+            },
+        },
+    ];
+}
+/**
+ * Auth0 (and Okta Customer Identity Cloud) access or ID tokens: `iss` =
+ * `https://<tenant domain>/` WITH the trailing slash, keys at
+ * `/.well-known/jwks.json`, `sub` = the Auth0 user id (`auth0|…`,
+ * `google-oauth2|…`). `audience` is the API identifier (access tokens) or the
+ * client id (ID tokens) — required, since an Auth0 tenant mints tokens for many.
+ */
+function auth0LegacyIssuer(opts) {
+    const origin = httpsOrigin(opts.domain);
+    return [
+        {
+            kind: 'auth0',
+            issuer: `${origin}/`,
+            jwksUrl: `${origin}/.well-known/jwks.json`,
+            audience: opts.audience,
+            algorithms: opts.algorithms ?? ['RS256', 'PS256'],
+            until: opts.until,
+            resolveSubject: opts.resolveSubject,
+        },
+    ];
+}
+/**
+ * Okta (Workforce Identity Cloud, Customer Identity Solution) tokens from a
+ * CUSTOM authorization server: `iss` = `https://<okta domain>/oauth2/<id>`
+ * (`default` unless set), keys at `<iss>/v1/keys`. Access tokens put the login
+ * in `sub` and the Okta user id in `uid`; ID tokens put the user id in `sub`.
+ * Tokens from the org authorization server (`iss` = the bare domain) are not
+ * meant for resource servers and are not accepted here.
+ */
+function oktaLegacyIssuer(opts) {
+    const server = opts.authorizationServerId ?? 'default';
+    if (!/^[A-Za-z0-9_-]+$/.test(server))
+        throw new Error('oktaLegacyIssuer: authorizationServerId is not an Okta id.');
+    const issuer = `${httpsOrigin(opts.domain)}/oauth2/${server}`;
+    const token = opts.token ?? 'access';
+    if (token === 'id' && !opts.audience)
+        throw new Error('oktaLegacyIssuer: ID tokens need audience (the client id).');
+    return [
+        {
+            kind: 'okta',
+            issuer,
+            jwksUrl: `${issuer}/v1/keys`,
+            audience: opts.audience ?? (server === 'default' ? 'api://default' : undefined),
+            algorithms: RSA_ALGS,
+            subjectClaim: token === 'access' ? 'uid' : 'sub',
+            until: opts.until,
+            resolveSubject: opts.resolveSubject,
+        },
+    ];
+}
+/**
+ * Kinde access or ID tokens: `iss` = `https://<business>.kinde.com` (or the
+ * custom domain), keys at `/.well-known/jwks`, `sub` = the Kinde user id
+ * (`kp_…`). Set `audience` when the app registered an API audience.
+ */
+function kindeLegacyIssuer(opts) {
+    const issuer = httpsOrigin(opts.issuerUrl);
+    return [
+        {
+            kind: 'kinde',
+            issuer,
+            jwksUrl: `${issuer}/.well-known/jwks`,
+            audience: opts.audience,
+            algorithms: RSA_ALGS,
+            until: opts.until,
+            resolveSubject: opts.resolveSubject,
+        },
+    ];
+}
+/**
+ * Descope session tokens (the `DS` cookie / `sessionToken`): RS256, keys at
+ * `<base>/v2/keys/<project id>`, `sub` = the Descope user id. Projects issue
+ * either `https://api.descope.com/<project id>` or the bare project id as
+ * `iss`, so both are accepted. Refresh tokens (`drn: "DSR"`) are refused.
+ */
+function descopeLegacyIssuer(opts) {
+    if (!/^P[A-Za-z0-9]{20,40}$/.test(opts.projectId))
+        throw new Error('descopeLegacyIssuer: projectId is not a Descope project id.');
+    const base = httpsOrigin(opts.baseUrl ?? 'https://api.descope.com');
+    const shared = {
+        kind: 'descope',
+        jwksUrl: `${base}/v2/keys/${opts.projectId}`,
+        algorithms: RSA_ALGS,
+        until: opts.until,
+        resolveSubject: opts.resolveSubject,
+        checkClaims: (claims) => claims.drn === undefined || claims.drn === 'DS',
+    };
+    return [
+        { ...shared, issuer: `${base}/${opts.projectId}` },
+        { ...shared, issuer: opts.projectId },
+    ];
+}
+//# sourceMappingURL=legacy-issuer-presets.js.map

package/dist/legacy-issuer-presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-issuer-presets.js","sourceRoot":"","sources":["../src/legacy-issuer-presets.ts"],"names":[],"mappings":";;AA4BA,kCAKC;AAMD,gFAYC;AAQD,8CAyBC;AASD,8CAeC;AAUD,4CA0BC;AAOD,8CAeC;AAQD,kDAiBC;AA1KD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC;AAE3B,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,sEAAsE;AACtE,SAAgB,WAAW,CAAC,WAAmB;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,WAAW,iBAAiB,CAAC,CAAC;IAC/F,OAAO,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAgB,kCAAkC,CAAC,cAAsB;IACvE,MAAM,CAAC,GAAG,wCAAwC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,IAAiH;IAEjH,MAAM,IAAI,GACR,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,kCAAkC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACxG,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO;QACL;YACE,IAAI,EAAE,OAAO;YACb,MAAM;YACN,OAAO,EAAE,GAAG,MAAM,wBAAwB;YAC1C,UAAU,EAAE,QAAQ;YACpB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE;gBACtB,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC3C,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACjH,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAC/B,IAAuG;IAEvG,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL;YACE,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG,MAAM,GAAG;YACpB,OAAO,EAAE,GAAG,MAAM,wBAAwB;YAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YACjD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAC9B,IAMC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,SAAS,CAAC;IACvD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,MAAM,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACpH,OAAO;QACL;YACE,IAAI,EAAE,MAAM;YACZ,MAAM;YACN,OAAO,EAAE,GAAG,MAAM,UAAU;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,UAAU,EAAE,QAAQ;YACpB,YAAY,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;YAChD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,IAA2E;IAE3E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO;QACL;YACE,IAAI,EAAE,OAAO;YACb,MAAM;YACN,OAAO,EAAE,GAAG,MAAM,mBAAmB;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,QAAQ;YACpB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,IAAsD;IAEtD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAClI,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAiC;QAC3C,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,GAAG,IAAI,YAAY,IAAI,CAAC,SAAS,EAAE;QAC5C,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;KACzE,CAAC;IACF,OAAO;QACL,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE;QAClD,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/legacy-issuers.d.ts

@@ -12,8 +12,11 @@ import { type Jwks } from './jwks-cache';
  * After `until`, those tokens are refused like any other foreign token.
  */
 export interface LegacyIssuer {
-    /** The old provider. Only `better_auth` today. */
-    kind?: 'better_auth';
+    /**
+     * The old provider: `better_auth`, or one of the JWT vendors with a preset
+     * in legacy-issuer-presets.ts (`clerk`, `auth0`, `okta`, `kinde`, `descope`).
+     */
+    kind?: LegacyIssuerKind;
     /** The `iss` the old tokens carry (Better Auth: its `baseURL`, unless `jwt.issuer` was set). */
     issuer: string;
     /** The imported key set. Exactly one of `jwks` / `jwksUrl`. */
@@ -32,7 +35,18 @@ export interface LegacyIssuer {
      * on the backend), cached in memory. Return null to refuse the token.
      */
     resolveSubject?: (legacySub: string, claims: Record<string, unknown>) => Promise<string | null> | string | null;
+    /**
+     * The claim that carries the old provider's user id. Default `sub`. Okta
+     * access tokens put the login in `sub` and the user id in `uid`.
+     */
+    subjectClaim?: string;
+    /**
+     * Extra vendor checks on the verified claims (Clerk's `azp` against the
+     * authorized parties, say). Return false to refuse the token.
+     */
+    checkClaims?: (claims: Record<string, unknown>) => boolean;
 }
+export type LegacyIssuerKind = 'better_auth' | 'clerk' | 'auth0' | 'okta' | 'kinde' | 'descope';
 /** Better Auth's `jwt` plugin key algorithms. */
 export declare const BETTER_AUTH_JWT_ALGS: string[];
 export interface LegacyVerifierDeps {

package/dist/legacy-issuers.js

@@ -20,6 +20,14 @@ function peekIssuer(token) {
         return undefined;
     }
 }
+function safeCheck(check, claims) {
+    try {
+        return check(claims) === true;
+    }
+    catch {
+        return false;
+    }
+}
 function untilMs(until) {
     const t = until instanceof Date ? until.getTime() : typeof until === 'number' ? until : Date.parse(until);
     return Number.isFinite(t) ? t : 0;
@@ -84,7 +92,14 @@ class LegacyIssuerVerifier {
         // A legacy token without an expiry would outlive the window it is accepted in.
         if (typeof payload.exp !== 'number')
             return { ok: false, reason: 'invalid' };
-        const legacySub = typeof payload.sub === 'string' && payload.sub ? payload.sub : typeof payload.id === 'string' ? payload.id : '';
+        if (entry.checkClaims && !safeCheck(entry.checkClaims, payload))
+            return { ok: false, reason: 'invalid' };
+        const subject = payload[entry.subjectClaim ?? 'sub'];
+        const legacySub = typeof subject === 'string' && subject
+            ? subject
+            : !entry.subjectClaim && typeof payload.id === 'string'
+                ? payload.id
+                : '';
         if (!legacySub)
             return { ok: false, reason: 'invalid' };
         const atlasId = await this.resolve(legacySub, payload, entry);

package/dist/legacy-issuers.js.map

@@ -1 +1 @@
-{"version":3,"file":"legacy-issuers.js","sourceRoot":"","sources":["../src/legacy-issuers.ts"],"names":[],"mappings":";;;AA4DA,gCAOC;AAnED,+BAA+D;AAC/D,6CAA6D;AAqC7D,iDAAiD;AACpC,QAAA,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAElF,4DAA4D;AAC5D,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAejC,0FAA0F;AAC1F,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QACjC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAA4B;IAC3C,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,oBAAoB;IAIF;IAHZ,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IACtC,QAAQ,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEjF,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,iDAAiD,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACjF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,oDAAoD,CAAC,CAAC;YAChI,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,MAAM,uKAAuK,CACvM,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,KAAK,CAAC,MAAM,EACZ,IAAI,sBAAS,CAAC;gBACZ,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvC,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,GAAuB;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAmB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBACxE,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,4BAAoB,CAAC,CAAC;gBAC3D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;gBAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,+EAA+E;QAC/E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClI,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEtD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,GAAG,OAAO;gBACV,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBACvD,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE;aACpF;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,MAA+B,EAAE,KAAmB;QAC3F,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,SAAS,SAAS,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,cAAc;YAAE,OAAO,GAAG,CAAC,EAAE,CAAC;QAE7D,IAAI,EAAE,GAAkB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAY,CAAC,CAAC;YACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,SAAU,EAAE,EAAE;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;YAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;YACrE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,iBAAiB;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AA7GD,oDA6GC"}
+{"version":3,"file":"legacy-issuers.js","sourceRoot":"","sources":["../src/legacy-issuers.ts"],"names":[],"mappings":";;;AA2EA,gCAOC;AAlFD,+BAA+D;AAC/D,6CAA6D;AAoD7D,iDAAiD;AACpC,QAAA,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAElF,4DAA4D;AAC5D,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAejC,0FAA0F;AAC1F,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QACjC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAmD,EAAE,MAA+B;IACrG,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAA4B;IAC3C,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,oBAAoB;IAIF;IAHZ,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IACtC,QAAQ,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEjF,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,iDAAiD,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACjF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,oDAAoD,CAAC,CAAC;YAChI,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,MAAM,uKAAuK,CACvM,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,KAAK,CAAC,MAAM,EACZ,IAAI,sBAAS,CAAC;gBACZ,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvC,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,GAAuB;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAmB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBACxE,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,4BAAoB,CAAC,CAAC;gBAC3D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;gBAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,+EAA+E;QAC/E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEzG,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC;QACrD,MAAM,SAAS,GACb,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;YACpC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;gBACrD,CAAC,CAAC,OAAO,CAAC,EAAE;gBACZ,CAAC,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEtD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,GAAG,OAAO;gBACV,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBACvD,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE;aACpF;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,MAA+B,EAAE,KAAmB;QAC3F,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,SAAS,SAAS,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,cAAc;YAAE,OAAO,GAAG,CAAC,EAAE,CAAC;QAE7D,IAAI,EAAE,GAAkB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAY,CAAC,CAAC;YACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,SAAU,EAAE,EAAE;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;YAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;YACrE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,iBAAiB;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AArHD,oDAqHC"}

package/dist/legacy-verify.d.ts

@@ -0,0 +1,103 @@
+/**
+ * LAZY MIGRATION, the half that runs on YOUR server.
+ *
+ * With a legacy-auth connection enabled, Atlas asks your `verify_url` whether
+ * an unknown identifier + password is valid in the old system, then creates
+ * the user with that password on success. This module is that endpoint for
+ * the vendors that will not export password hashes (or whose hashes you chose
+ * not to move): it checks Atlas's signature, asks the OLD vendor with YOUR
+ * vendor credentials and answers with the profile. Vendor credentials stay on
+ * your server; Atlas never sees them.
+ *
+ *   const verify = oktaPasswordVerifier({ domain: 'acme.okta.com' });
+ *   app.post('/atlas/legacy-verify', express.text({ type: '*\/*' }), async (req, res) => {
+ *     const out = await handleLegacyVerify({ body: req.body, headers: req.headers, secret, verify });
+ *     res.status(out.status).json(out.body);
+ *   });
+ *
+ * Every verifier FAILS CLOSED: a transport error, a timeout or an answer it
+ * does not recognise is "not verified", never "verified".
+ */
+/** What Atlas needs to create the user. `external_id` keeps the old id for token bridges. */
+export interface LegacyVerifiedProfile {
+    email: string;
+    email_verified?: boolean;
+    name?: string;
+    external_id?: string;
+    metadata?: Record<string, unknown>;
+}
+export type LegacyPasswordVerifier = (input: {
+    identifier: string;
+    password: string;
+}) => Promise<LegacyVerifiedProfile | null>;
+interface VerifierTransport {
+    fetchImpl?: typeof fetch;
+    /** Per-call budget; Atlas's own call times out at the connection's `timeout_ms`. */
+    timeoutMs?: number;
+}
+/**
+ * Check Atlas's signature on the request and run `verify`. Returns the status
+ * and JSON body to send: 200 `{ user }` on a valid credential, 401 when the
+ * old system rejected it, 400 on a bad signature or body.
+ */
+export declare function handleLegacyVerify(input: {
+    body: string | Buffer;
+    headers: Headers | Record<string, string | string[] | undefined>;
+    secret: string;
+    verify: LegacyPasswordVerifier;
+    now?: Date;
+}): Promise<{
+    status: number;
+    body: Record<string, unknown>;
+}>;
+/**
+ * Okta (Workforce Identity Cloud / Customer Identity Solution): the Authn API,
+ * `POST /api/v1/authn`, needs no API token. A primary-authentication result of
+ * SUCCESS, or any state that is only reached after a correct password
+ * (MFA_REQUIRED, MFA_ENROLL, PASSWORD_WARN, PASSWORD_EXPIRED), counts as
+ * verified; 401 (E0000004) and LOCKED_OUT do not.
+ *
+ * Orgs where the Authn API is turned off can verify with the resource-owner
+ * password grant of an app that allows it: pass `passwordGrant`.
+ */
+export declare function oktaPasswordVerifier(opts: VerifierTransport & {
+    domain: string;
+    passwordGrant?: {
+        authorizationServerId?: string;
+        clientId: string;
+        clientSecret?: string;
+    };
+}): LegacyPasswordVerifier;
+/**
+ * Auth0 (and Okta Customer Identity Cloud): the resource-owner password grant
+ * against ONE database connection (`realm`), from an application with the
+ * Password grant enabled. `mfa_required` means the password was right (Auth0
+ * only asks for the second factor after it). Use a dedicated application for
+ * this and keep its secret on your server.
+ */
+export declare function auth0PasswordVerifier(opts: VerifierTransport & {
+    domain: string;
+    clientId: string;
+    clientSecret?: string;
+    realm: string;
+    audience?: string;
+}): LegacyPasswordVerifier;
+/**
+ * Descope: `POST /v1/auth/password/signin` with the project id (public — no
+ * management key). A 200 with a `user` means the password is right.
+ */
+export declare function descopePasswordVerifier(opts: VerifierTransport & {
+    projectId: string;
+    baseUrl?: string;
+}): LegacyPasswordVerifier;
+/**
+ * Clerk exports bcrypt digests, so most moves need no lazy step. For users
+ * whose digest could not move (a peppered or Cognito-backed hasher), look the
+ * user up by email and call `POST /v1/users/{id}/verify_password` with your
+ * Clerk secret key.
+ */
+export declare function clerkPasswordVerifier(opts: VerifierTransport & {
+    secretKey: string;
+    apiUrl?: string;
+}): LegacyPasswordVerifier;
+export {};