@atlasauth/backend 0.23.0 → 0.25.0

package/dist/migration-presets-g4/authentik.d.ts

@@ -0,0 +1,14 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * authentik. An application's OAuth2/OpenID provider signs its ID and access
+ * tokens with the signing key chosen on the provider (RS256 / ES256). The
+ * issuer is per provider and ends in a slash — `iss` is compared as a string,
+ * so the template restores the slash the variable resolver trims:
+ *   https://auth.example.com/application/o/<application slug>/
+ * with the keys at `<issuer>jwks/`.
+ *
+ * `sub` depends on the provider's "Subject mode" (hashed user id by default);
+ * the export keys users by the same mode, so the two agree. `sid` is authentik's
+ * session id (a hash), shared by every token of one sign-in.
+ */
+export declare const AUTHENTIK_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/authentik.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHENTIK_BRIDGE_PRESETS = void 0;
+/**
+ * authentik. An application's OAuth2/OpenID provider signs its ID and access
+ * tokens with the signing key chosen on the provider (RS256 / ES256). The
+ * issuer is per provider and ends in a slash — `iss` is compared as a string,
+ * so the template restores the slash the variable resolver trims:
+ *   https://auth.example.com/application/o/<application slug>/
+ * with the keys at `<issuer>jwks/`.
+ *
+ * `sub` depends on the provider's "Subject mode" (hashed user id by default);
+ * the export keys users by the same mode, so the two agree. `sid` is authentik's
+ * session id (a hash), shared by every token of one sign-in.
+ */
+exports.AUTHENTIK_BRIDGE_PRESETS = [
+    {
+        id: 'authentik',
+        label: 'authentik (OAuth2 / OpenID provider tokens)',
+        mode: 'jwt',
+        vars: { issuer: "The provider's issuer URL without the trailing slash (https://auth.example.com/application/o/<application slug>)", client_id: "The provider's client id (the tokens' aud)" },
+        jwt: {
+            issuer: '{issuer}/',
+            keysUrl: '{issuer}/jwks/',
+            audience: ['{client_id}'],
+            // A provider without a signing key signs HS256 with its client secret: no public keys exist for it.
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256', 'ES384'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'amr:mfa' },
+        },
+        // authentik is the identity provider, not the app: the app's own OIDC client library keeps the token
+        // (next-auth, passport-openidconnect, oauth2-proxy). Pass it as a bearer token or from your own extractor.
+        cookies: [],
+        bearer: true,
+        notes: 'Set the provider\'s Subject mode to the one the export used (hashed user id by default; the export records it). The provider needs a signing key: tokens signed with the client secret (HS256) cannot be verified from public keys. With the "global" issuer mode, point the preset at the per-provider URL anyway: the keys are served there.',
+    },
+];
+//# sourceMappingURL=authentik.js.map

package/dist/migration-presets-g4/authentik.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik.js","sourceRoot":"","sources":["../../src/migration-presets-g4/authentik.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;GAWG;AACU,QAAA,wBAAwB,GAAqC;IACxE;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,6CAA6C;QACpD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,kHAAkH,EAAE,SAAS,EAAE,4CAA4C,EAAE;QAC7L,GAAG,EAAE;YACH,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,oGAAoG;YACpG,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;SAC7H;QACD,qGAAqG;QACrG,2GAA2G;QAC3G,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,gVAAgV;KACnV;CACF,CAAC"}

package/dist/migration-presets-g4/fusionauth.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+export declare const FUSIONAUTH_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/fusionauth.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FUSIONAUTH_BRIDGE_PRESETS = void 0;
+/**
+ * FusionAuth. The access token (`app.at` cookie, or the Bearer token an API
+ * client holds) is a JWT whose `iss` is the TENANT's issuer string: `acme.com`
+ * by default (what `issuer_name` takes), or an https URL when the tenant was
+ * set up that way (the `fusionauth_url_issuer` preset takes the base URL).
+ * Keys come from `/.well-known/jwks.json` and publish only asymmetric keys:
+ * a tenant still on the default HS256 signing key has to switch the
+ * application's access-token key to an RSA or EC key before the bridge can
+ * verify its tokens. `sub` is the FusionAuth user id the export keys users by,
+ * `sid` the SSO session, `amr` lists `mfa` after a second factor.
+ */
+const WEEK = 7 * 24 * 3600;
+const CLAIMS = { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'amr:mfa' };
+exports.FUSIONAUTH_BRIDGE_PRESETS = [
+    {
+        id: 'fusionauth',
+        label: 'FusionAuth (access token, tenant issuer such as acme.com)',
+        mode: 'jwt',
+        vars: { base_url: 'FusionAuth URL (https://auth.example.com)', issuer_name: 'The tenant issuer (Tenants → General → Issuer, `acme.com` by default)' },
+        jwt: {
+            issuer: '{issuer_name}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'],
+            claims: CLAIMS,
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: ['app.at'],
+        clearCookies: ['app.at', 'app.rt', 'app.idt', 'app.match_hint', 'app.locale', 'app.ssoToken'],
+        bearer: true,
+        notes: 'The application must sign access tokens with an RSA or EC key (a default HS256 key has no public JWKS entry).',
+    },
+    {
+        id: 'fusionauth_url_issuer',
+        label: 'FusionAuth (access token, tenant issuer is the https URL)',
+        mode: 'jwt',
+        vars: { base_url: 'FusionAuth URL, also the tenant issuer (https://auth.example.com)' },
+        jwt: {
+            issuer: '{base_url}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'],
+            claims: CLAIMS,
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: ['app.at'],
+        clearCookies: ['app.at', 'app.rt', 'app.idt', 'app.match_hint', 'app.locale', 'app.ssoToken'],
+        bearer: true,
+    },
+];
+//# sourceMappingURL=fusionauth.js.map

package/dist/migration-presets-g4/fusionauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fusionauth.js","sourceRoot":"","sources":["../../src/migration-presets-g4/fusionauth.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;GAUG;AACH,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3B,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAEvH,QAAA,yBAAyB,GAAqC;IACzE;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,2DAA2D;QAClE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,2CAA2C,EAAE,WAAW,EAAE,uEAAuE,EAAE;QACrJ,GAAG,EAAE;YACH,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,MAAM;YACd,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC;QAC7F,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,+GAA+G;KACvH;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,2DAA2D;QAClE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,mEAAmE,EAAE;QACvF,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,MAAM;YACd,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC;QAC7F,MAAM,EAAE,IAAI;KACb;CACF,CAAC"}

package/dist/migration-presets-g4/hanko.d.ts

@@ -0,0 +1,12 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * Hanko. The backend signs a session JWT (RS256, a rotating key set at
+ * `/.well-known/jwks.json` on the public API) and writes it to the `hanko`
+ * cookie (`cookie.name`); the frontend SDK and hanko-elements read the same
+ * token. Claims: `sub` (the user's id — what the export keys users by),
+ * `session_id`, `exp`, `iat`, `aud`, `iss` (when `session.issuer` is set) and
+ * `email` / `username`. `email` is an object (`address`, `is_primary`,
+ * `is_verified`), so it is not mapped to a claim; the imported user already
+ * holds the addresses.
+ */
+export declare const HANKO_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/hanko.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HANKO_BRIDGE_PRESETS = void 0;
+/**
+ * Hanko. The backend signs a session JWT (RS256, a rotating key set at
+ * `/.well-known/jwks.json` on the public API) and writes it to the `hanko`
+ * cookie (`cookie.name`); the frontend SDK and hanko-elements read the same
+ * token. Claims: `sub` (the user's id — what the export keys users by),
+ * `session_id`, `exp`, `iat`, `aud`, `iss` (when `session.issuer` is set) and
+ * `email` / `username`. `email` is an object (`address`, `is_primary`,
+ * `is_verified`), so it is not mapped to a claim; the imported user already
+ * holds the addresses.
+ */
+exports.HANKO_BRIDGE_PRESETS = [
+    {
+        id: 'hanko',
+        label: 'Hanko (session JWT, issuer = the API URL)',
+        mode: 'jwt',
+        vars: { base_url: 'The Hanko API URL (https://<project id>.hanko.io, or your own https://hanko.example.com)' },
+        jwt: {
+            issuer: '{base_url}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256'],
+            claims: { subject: 'sub', sessionKey: 'session_id' },
+        },
+        cookies: ['hanko'],
+        bearer: true,
+        sharesAtlasCookie: false,
+        notes: 'Hanko Cloud sets iss to the project URL. Self-hosted: use hanko_jwt when session.issuer is something else. The cookie is named by cookie.name in Hanko\'s config (default hanko).',
+    },
+    {
+        id: 'hanko_jwt',
+        label: 'Hanko (session JWT, custom issuer)',
+        mode: 'jwt',
+        vars: { base_url: 'The Hanko API URL (keys are read from /.well-known/jwks.json)', issuer: "The session.issuer you configured (the token's iss)" },
+        jwt: {
+            issuer: '{issuer}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256'],
+            claims: { subject: 'sub', sessionKey: 'session_id' },
+        },
+        cookies: ['hanko'],
+        bearer: true,
+    },
+];
+//# sourceMappingURL=hanko.js.map

package/dist/migration-presets-g4/hanko.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hanko.js","sourceRoot":"","sources":["../../src/migration-presets-g4/hanko.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAqC;IACpE;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,0FAA0F,EAAE;QAC9G,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE;SACrD;QACD,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,MAAM,EAAE,IAAI;QACZ,iBAAiB,EAAE,KAAK;QACxB,KAAK,EACH,mLAAmL;KACtL;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,oCAAoC;QAC3C,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,+DAA+D,EAAE,MAAM,EAAE,qDAAqD,EAAE;QAClJ,GAAG,EAAE;YACH,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE;SACrD;QACD,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,MAAM,EAAE,IAAI;KACb;CACF,CAAC"}

package/dist/migration-presets-g4/keycloak.d.ts

@@ -0,0 +1,16 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * Keycloak. Its browser adapter (keycloak-js) keeps the access / ID / refresh
+ * tokens in memory, and server adapters (keycloak-connect, NextAuth's Keycloak
+ * provider) keep them server-side or inside an encrypted cookie, so the token
+ * an integrator can hand the bridge is the access or ID token itself (Bearer
+ * header or the `exchangeMigrationBrowserSession` browser helper). The
+ * `KEYCLOAK_IDENTITY` cookie is signed with the realm's own HMAC secret and is
+ * never accepted.
+ *
+ * Access tokens live five minutes by default and nobody refreshes them after
+ * the switch, so a validly signed token is accepted (once) for a week past `exp`.
+ * Keycloak 16 and older serve under `/auth`: pass `base_url` as
+ * `https://sso.example.com/auth`.
+ */
+export declare const KEYCLOAK_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/keycloak.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEYCLOAK_BRIDGE_PRESETS = void 0;
+/**
+ * Keycloak. Its browser adapter (keycloak-js) keeps the access / ID / refresh
+ * tokens in memory, and server adapters (keycloak-connect, NextAuth's Keycloak
+ * provider) keep them server-side or inside an encrypted cookie, so the token
+ * an integrator can hand the bridge is the access or ID token itself (Bearer
+ * header or the `exchangeMigrationBrowserSession` browser helper). The
+ * `KEYCLOAK_IDENTITY` cookie is signed with the realm's own HMAC secret and is
+ * never accepted.
+ *
+ * Access tokens live five minutes by default and nobody refreshes them after
+ * the switch, so a validly signed token is accepted (once) for a week past `exp`.
+ * Keycloak 16 and older serve under `/auth`: pass `base_url` as
+ * `https://sso.example.com/auth`.
+ */
+exports.KEYCLOAK_BRIDGE_PRESETS = [
+    {
+        id: 'keycloak',
+        label: 'Keycloak (access or ID token)',
+        mode: 'jwt',
+        vars: { base_url: 'Keycloak base URL (https://sso.example.com; add /auth for Keycloak 16 and older)', realm: 'Realm name' },
+        jwt: {
+            issuer: '{base_url}/realms/{realm}',
+            keysUrl: '{base_url}/realms/{realm}/protocol/openid-connect/certs',
+            algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256', 'ES384'],
+            // sub = the Keycloak user id (what the realm export keys users by); sid = the SSO session id.
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'acr:2' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Use the access token or the ID token (both carry sub, email, sid). Realm keys must publish a signing algorithm from the list (the default RS256 does; HS512 keys are never accepted). A step-up login raises the acr claim to 2 when you map levels of authentication to "2"; otherwise an MFA sign-in is not marked.',
+    },
+];
+//# sourceMappingURL=keycloak.js.map

package/dist/migration-presets-g4/keycloak.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak.js","sourceRoot":"","sources":["../../src/migration-presets-g4/keycloak.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;GAaG;AACU,QAAA,uBAAuB,GAAqC;IACvE;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,kFAAkF,EAAE,KAAK,EAAE,YAAY,EAAE;QAC3H,GAAG,EAAE;YACH,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,yDAAyD;YAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAClE,8FAA8F;YAC9F,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;YAC1H,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,uTAAuT;KAC1T;CACF,CAAC"}

package/dist/migration-presets-g4/logto.d.ts

@@ -0,0 +1,12 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * Logto. The tenant's OIDC issuer is `{endpoint}/oidc` (`https://auth.example.com/oidc`,
+ * `https://abc123.logto.app/oidc` on Logto Cloud); its signing keys are at
+ * `/oidc/jwks` and default to ES384. The token to exchange is the application's
+ * ID token (`aud` = the Logto application id) — what `@logto/*` SDKs keep in
+ * the app's own session. The SDKs store that session encrypted with the app's
+ * cookie secret (or in the server's session store), so no cookie is named here:
+ * hand the middleware a token extractor that opens the session locally, or send
+ * the ID token as a bearer token from the client.
+ */
+export declare const LOGTO_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/logto.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOGTO_BRIDGE_PRESETS = void 0;
+/**
+ * Logto. The tenant's OIDC issuer is `{endpoint}/oidc` (`https://auth.example.com/oidc`,
+ * `https://abc123.logto.app/oidc` on Logto Cloud); its signing keys are at
+ * `/oidc/jwks` and default to ES384. The token to exchange is the application's
+ * ID token (`aud` = the Logto application id) — what `@logto/*` SDKs keep in
+ * the app's own session. The SDKs store that session encrypted with the app's
+ * cookie secret (or in the server's session store), so no cookie is named here:
+ * hand the middleware a token extractor that opens the session locally, or send
+ * the ID token as a bearer token from the client.
+ */
+exports.LOGTO_BRIDGE_PRESETS = [
+    {
+        id: 'logto',
+        label: 'Logto',
+        mode: 'jwt',
+        vars: {
+            base_url: 'Your Logto endpoint (https://auth.example.com or https://abc123.logto.app)',
+            client_id: 'The id of your Logto application (the audience of its ID tokens)',
+        },
+        jwt: {
+            issuer: '{base_url}/oidc',
+            keysUrl: '{base_url}/oidc/jwks',
+            audience: ['{client_id}'],
+            algorithms: ['ES384', 'ES256', 'RS256', 'PS256', 'EdDSA'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid' },
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Exchange the ID token. Logto SDK sessions are encrypted with your cookie secret (or kept in your session store): pass the middleware a token extractor that reads the idToken from the session locally. API access tokens carry the API resource as their audience and are not accepted here.',
+    },
+];
+//# sourceMappingURL=logto.js.map

package/dist/migration-presets-g4/logto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logto.js","sourceRoot":"","sources":["../../src/migration-presets-g4/logto.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAqC;IACpE;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,QAAQ,EAAE,4EAA4E;YACtF,SAAS,EAAE,kEAAkE;SAC9E;QACD,GAAG,EAAE;YACH,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;SAC7G;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,+RAA+R;KAClS;CACF,CAAC"}

package/dist/migration-presets-g4/ory.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+export declare const ORY_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/ory.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORY_BRIDGE_PRESETS = void 0;
+/**
+ * Ory Kratos bridge presets. A Kratos session is opaque: the token (or the
+ * cookie that wraps it, sealed with `secrets.cookie`) says nothing offline. So
+ * there are two ways to recognise one:
+ *
+ *   - `ory` (session_table): the session tokens (`ory_st_…`, the
+ *     `X-Session-Token` / bearer value API-flow clients hold) imported from a
+ *     database export, looked up by sha256. Self-hosted only; Ory Network has no
+ *     database access.
+ *   - `ory_whoami` / `ory_whoami_token` (remote): Atlas asks Kratos itself,
+ *     `GET /sessions/whoami`, with the cookie (or the session token) the browser
+ *     presented. Works on self-hosted Kratos and Ory Network, needs Kratos
+ *     running (and reachable from Atlas) for the bridge window, and needs no
+ *     export. The identity id in the answer is the user id the export keyed by.
+ *
+ * Kratos answers 401 for an unknown / expired session and 403
+ * (`session_aal2_required`) when a second factor is still owed: both are
+ * refusals, so a half-authenticated session never becomes an Atlas session.
+ * The remote preset reads the session's own identity: `identity.id`,
+ * `identity.traits.email` (the common schema; others rely on the imported
+ * user's email) and the first verifiable address.
+ */
+const WHOAMI_NOTES = 'Kratos stays up for the bridge window: Atlas calls its /sessions/whoami with the presented session. Point base_url at the public URL (https://<slug>.projects.oryapis.com on Ory Network). A session that still owes a second factor (aal2) is refused.';
+const IDENTITY = {
+    subjectPath: 'identity.id',
+    emailPath: 'identity.traits.email',
+    emailVerifiedPath: 'identity.verifiable_addresses.0.verified',
+    namePath: 'identity.traits.name',
+};
+exports.ORY_BRIDGE_PRESETS = [
+    {
+        id: 'ory',
+        label: 'Ory Kratos (session tokens imported from the database)',
+        mode: 'session_table',
+        // The browser cookie is sealed with Kratos' cookie secret and cannot be hashed
+        // to a stored token: only the raw session token (ory_st_…) matches.
+        cookies: [],
+        bearer: true,
+        notes: 'Matches the session tokens (ory_st_…) from a database export: API-flow clients (native apps, SPAs holding the token) send them as a bearer token. Browser cookies are sealed with Kratos\' cookie secret, so cookie sessions use the ory_whoami preset. If your app keeps the token in a cookie of its own, pass that name as cookieNames to the middleware.',
+    },
+    {
+        id: 'ory_whoami',
+        label: 'Ory Kratos (session cookie, checked with Kratos)',
+        mode: 'remote',
+        vars: {
+            base_url: 'Kratos public URL (https://auth.example.com, or https://<project slug>.projects.oryapis.com)',
+            cookie_name: 'The session cookie name (ory_kratos_session; ory_session_<project slug> on Ory Network)',
+        },
+        remote: { url: '{base_url}/sessions/whoami', method: 'GET', headers: { cookie: '{cookie_name}={token}' }, ...IDENTITY },
+        cookies: ['ory_kratos_session', 'ory_session_*'],
+        notes: `${WHOAMI_NOTES} The cookie must reach your app: serve it on a domain your app shares (Ory Network custom domain or Kratos behind your domain).`,
+    },
+    {
+        id: 'ory_whoami_token',
+        label: 'Ory Kratos (session token, checked with Kratos)',
+        mode: 'remote',
+        vars: { base_url: 'Kratos public URL (https://auth.example.com, or https://<project slug>.projects.oryapis.com)' },
+        remote: { url: '{base_url}/sessions/whoami', method: 'GET', headers: { 'x-session-token': '{token}' }, ...IDENTITY },
+        cookies: [],
+        bearer: true,
+        notes: WHOAMI_NOTES,
+    },
+];
+//# sourceMappingURL=ory.js.map

package/dist/migration-presets-g4/ory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ory.js","sourceRoot":"","sources":["../../src/migration-presets-g4/ory.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,YAAY,GAChB,yPAAyP,CAAC;AAE5P,MAAM,QAAQ,GAAG;IACf,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,uBAAuB;IAClC,iBAAiB,EAAE,0CAA0C;IAC7D,QAAQ,EAAE,sBAAsB;CACjC,CAAC;AAEW,QAAA,kBAAkB,GAAqC;IAClE;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,wDAAwD;QAC/D,IAAI,EAAE,eAAe;QACrB,+EAA+E;QAC/E,oEAAoE;QACpE,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,8VAA8V;KACjW;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,kDAAkD;QACzD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE;YACJ,QAAQ,EAAE,8FAA8F;YACxG,WAAW,EAAE,yFAAyF;SACvG;QACD,MAAM,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,GAAG,QAAQ,EAAE;QACvH,OAAO,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAChD,KAAK,EAAE,GAAG,YAAY,iIAAiI;KACxJ;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,iDAAiD;QACxD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,EAAE,QAAQ,EAAE,8FAA8F,EAAE;QAClH,MAAM,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE;QACpH,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,YAAY;KACpB;CACF,CAAC"}

package/dist/migration-presets-g4/supertokens.d.ts

@@ -0,0 +1,13 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+/**
+ * SuperTokens. The session's access token is a JWT signed with the core's
+ * dynamic keys; the backend SDK serves their public half at
+ * `{api_domain}{api_base_path}/jwt/jwks.json` (the core also at
+ * `/.well-known/jwks.json`) and stamps `iss` with `{api_domain}{api_base_path}`.
+ * The `sub` is the SuperTokens user id (what the export imports as the source
+ * id), `sessionHandle` identifies the session, so every token of one old
+ * session exchanges once. The access token lives an hour and is refreshed by
+ * the SuperTokens frontend SDK, which stops running after the switch: a token
+ * up to a week past `exp` is still accepted (each exchanges once).
+ */
+export declare const SUPERTOKENS_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/supertokens.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPERTOKENS_BRIDGE_PRESETS = void 0;
+/**
+ * SuperTokens. The session's access token is a JWT signed with the core's
+ * dynamic keys; the backend SDK serves their public half at
+ * `{api_domain}{api_base_path}/jwt/jwks.json` (the core also at
+ * `/.well-known/jwks.json`) and stamps `iss` with `{api_domain}{api_base_path}`.
+ * The `sub` is the SuperTokens user id (what the export imports as the source
+ * id), `sessionHandle` identifies the session, so every token of one old
+ * session exchanges once. The access token lives an hour and is refreshed by
+ * the SuperTokens frontend SDK, which stops running after the switch: a token
+ * up to a week past `exp` is still accepted (each exchanges once).
+ */
+exports.SUPERTOKENS_BRIDGE_PRESETS = [
+    {
+        id: 'supertokens',
+        label: 'SuperTokens',
+        mode: 'jwt',
+        vars: { base_url: 'Your SuperTokens API domain (https://api.example.com), the apiDomain of your backend config' },
+        defaults: { api_base_path: 'auth' },
+        jwt: {
+            issuer: '{base_url}/{api_base_path}',
+            keysUrl: '{base_url}/{api_base_path}/jwt/jwks.json',
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', sessionKey: 'sessionHandle' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['sAccessToken'],
+        clearCookies: ['sAccessToken', 'sRefreshToken', 'sIdRefreshToken', 'sFrontToken'],
+        bearer: true,
+        notes: 'Pass api_base_path (your apiBasePath without slashes, default auth) when you changed it. With header-based sessions send the access token as `Authorization: Bearer`. SuperTokens access tokens carry no email: the user is matched by the imported SuperTokens user id, so import users first.',
+    },
+];
+//# sourceMappingURL=supertokens.js.map

package/dist/migration-presets-g4/supertokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supertokens.js","sourceRoot":"","sources":["../../src/migration-presets-g4/supertokens.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;GAUG;AACU,QAAA,0BAA0B,GAAqC;IAC1E;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,6FAA6F,EAAE;QACjH,QAAQ,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE;QACnC,GAAG,EAAE;YACH,MAAM,EAAE,4BAA4B;YACpC,OAAO,EAAE,0CAA0C;YACnD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE;YACvD,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,CAAC;QACjF,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,iSAAiS;KACpS;CACF,CAAC"}

package/dist/migration-presets-g4/zitadel.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationBridgePreset } from '../migration-presets';
+export declare const ZITADEL_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4/zitadel.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZITADEL_BRIDGE_PRESETS = void 0;
+/**
+ * ZITADEL bridge preset (ZITADEL Cloud, self-hosted, custom domains). ZITADEL
+ * signs ID tokens, and access tokens of applications set to the JWT token
+ * type, with RS256 keys it publishes at `{issuer}/oauth/v2/keys`. The `iss` is
+ * the instance URL (`https://<instance>.zitadel.cloud`, or your custom domain
+ * exactly as users reach it), `sub` the ZITADEL user id, `sid` the session id.
+ * `amr` lists `mfa` after a second factor.
+ *
+ * Opaque access tokens (ZITADEL's default for new applications) cannot be
+ * verified offline: exchange the ID token, or switch the application's access
+ * token type to JWT.
+ */
+const WEEK = 7 * 24 * 3600;
+exports.ZITADEL_BRIDGE_PRESETS = [
+    {
+        id: 'zitadel',
+        label: 'ZITADEL (ID tokens and JWT access tokens)',
+        mode: 'jwt',
+        vars: { issuer: 'Your ZITADEL URL, exactly as the iss claim has it (https://<instance>.zitadel.cloud, or your custom domain)' },
+        jwt: {
+            issuer: '{issuer}',
+            keysUrl: '{issuer}/oauth/v2/keys',
+            algorithms: ['RS256', 'RS384', 'RS512', 'ES256'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'sid', mfa: 'amr:mfa' },
+            // Tokens live hours and the OIDC client that refreshed them is gone after the switch.
+            expiredGraceSeconds: WEEK,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Send the ID token (or a JWT access token) as an Authorization: Bearer header. Browser OIDC clients (oidc-client-ts, react-oidc-context) keep tokens in browser storage, so the browser has to send one request with it before they are cleared; server sessions (Auth.js, express-session) hold the ID token you can pass to the middleware with extractToken. Application access tokens are opaque unless the application is set to the JWT token type.',
+    },
+];
+//# sourceMappingURL=zitadel.js.map

package/dist/migration-presets-g4/zitadel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadel.js","sourceRoot":"","sources":["../../src/migration-presets-g4/zitadel.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;GAWG;AAEH,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEd,QAAA,sBAAsB,GAAqC;IACtE;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,6GAA6G,EAAE;QAC/H,GAAG,EAAE;YACH,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAChD,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;YAC5H,sFAAsF;YACtF,mBAAmB,EAAE,IAAI;SAC1B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,0bAA0b;KAC7b;CACF,CAAC"}

package/dist/migration-presets-g4.d.ts

@@ -0,0 +1,10 @@
+import type { MigrationBridgePreset } from './migration-presets';
+/**
+ * Bridge presets for the open-source identity providers — Keycloak, Ory
+ * (Kratos, Hydra, Ory Network), ZITADEL, Logto, SuperTokens, authentik,
+ * FusionAuth and Hanko — one module per vendor under ./migration-presets-g4/,
+ * each checked against the vendor's token documentation and a fixture token.
+ * Registered (replacing the starters) at the end of migration-presets.ts; the
+ * modules import only types from there, so there is no import cycle at runtime.
+ */
+export declare const G4_BRIDGE_PRESETS: readonly MigrationBridgePreset[];

package/dist/migration-presets-g4.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.G4_BRIDGE_PRESETS = void 0;
+const authentik_1 = require("./migration-presets-g4/authentik");
+const fusionauth_1 = require("./migration-presets-g4/fusionauth");
+const hanko_1 = require("./migration-presets-g4/hanko");
+const keycloak_1 = require("./migration-presets-g4/keycloak");
+const logto_1 = require("./migration-presets-g4/logto");
+const ory_1 = require("./migration-presets-g4/ory");
+const supertokens_1 = require("./migration-presets-g4/supertokens");
+const zitadel_1 = require("./migration-presets-g4/zitadel");
+/**
+ * Bridge presets for the open-source identity providers — Keycloak, Ory
+ * (Kratos, Hydra, Ory Network), ZITADEL, Logto, SuperTokens, authentik,
+ * FusionAuth and Hanko — one module per vendor under ./migration-presets-g4/,
+ * each checked against the vendor's token documentation and a fixture token.
+ * Registered (replacing the starters) at the end of migration-presets.ts; the
+ * modules import only types from there, so there is no import cycle at runtime.
+ */
+exports.G4_BRIDGE_PRESETS = [
+    ...keycloak_1.KEYCLOAK_BRIDGE_PRESETS,
+    ...ory_1.ORY_BRIDGE_PRESETS,
+    ...zitadel_1.ZITADEL_BRIDGE_PRESETS,
+    ...logto_1.LOGTO_BRIDGE_PRESETS,
+    ...supertokens_1.SUPERTOKENS_BRIDGE_PRESETS,
+    ...authentik_1.AUTHENTIK_BRIDGE_PRESETS,
+    ...fusionauth_1.FUSIONAUTH_BRIDGE_PRESETS,
+    ...hanko_1.HANKO_BRIDGE_PRESETS,
+];
+//# sourceMappingURL=migration-presets-g4.js.map

package/dist/migration-presets-g4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-presets-g4.js","sourceRoot":"","sources":["../src/migration-presets-g4.ts"],"names":[],"mappings":";;;AACA,gEAA4E;AAC5E,kEAA8E;AAC9E,wDAAoE;AACpE,8DAA0E;AAC1E,wDAAoE;AACpE,oDAAgE;AAChE,oEAAgF;AAChF,4DAAwE;AAExE;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAqC;IACjE,GAAG,kCAAuB;IAC1B,GAAG,wBAAkB;IACrB,GAAG,gCAAsB;IACzB,GAAG,4BAAoB;IACvB,GAAG,wCAA0B;IAC7B,GAAG,oCAAwB;IAC3B,GAAG,sCAAyB;IAC5B,GAAG,4BAAoB;CACxB,CAAC"}