@atlasauth/backend 0.8.0 → 0.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +22 -0
- package/README.md +147 -0
- package/dist/client/branding.d.ts +20 -0
- package/dist/client/branding.js.map +1 -1
- package/dist/client/diagnostics.d.ts +16 -0
- package/dist/client/diagnostics.js.map +1 -1
- package/dist/client/email-templates.d.ts +1 -1
- package/dist/client/email-templates.js.map +1 -1
- package/dist/client/error.d.ts +10 -0
- package/dist/client/error.js +10 -0
- package/dist/client/error.js.map +1 -1
- package/dist/client/index.d.ts +11 -1
- package/dist/client/instance.d.ts +30 -2
- package/dist/client/instance.js.map +1 -1
- package/dist/client/messaging.d.ts +85 -8
- package/dist/client/messaging.js +19 -1
- package/dist/client/messaging.js.map +1 -1
- package/dist/client/oauth-clients.d.ts +25 -1
- package/dist/client/oauth-clients.js +11 -2
- package/dist/client/oauth-clients.js.map +1 -1
- package/dist/client/platform.d.ts +22 -5
- package/dist/client/platform.js.map +1 -1
- package/dist/client/users.d.ts +15 -0
- package/dist/client/users.js.map +1 -1
- package/dist/index.d.ts +4 -2
- package/dist/index.js +15 -1
- package/dist/index.js.map +1 -1
- package/dist/oidc.d.ts +225 -0
- package/dist/oidc.js +631 -0
- package/dist/oidc.js.map +1 -0
- package/dist/testing.d.ts +90 -1
- package/dist/testing.js +202 -3
- package/dist/testing.js.map +1 -1
- package/dist/verify.d.ts +21 -0
- package/dist/verify.js +20 -0
- package/dist/verify.js.map +1 -1
- package/dist/webhooks.js +32 -7
- package/dist/webhooks.js.map +1 -1
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAydA,8CAuGC;AAhkBD,uCAAgD;AAydhD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,wDAAwD;YACxD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,mCAAmC;YACnC,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -11,6 +11,11 @@ export interface OAuthClient {
|
|
|
11
11
|
grant_types: string[];
|
|
12
12
|
token_endpoint_auth_method: 'client_secret_basic' | 'client_secret_post' | 'none';
|
|
13
13
|
secret_prefix: string | null;
|
|
14
|
+
/**
|
|
15
|
+
* After a rotation with overlap: when the previous secret stops working (epoch
|
|
16
|
+
* ms). Null when only the current secret is accepted.
|
|
17
|
+
*/
|
|
18
|
+
previous_secret_expires_at?: number | null;
|
|
14
19
|
is_public: boolean;
|
|
15
20
|
first_party: boolean;
|
|
16
21
|
/** Where the client may send users after an RP-initiated logout. */
|
|
@@ -51,6 +56,21 @@ export interface OAuthClientWithSecret extends OAuthClient {
|
|
|
51
56
|
client_secret?: string;
|
|
52
57
|
note: string;
|
|
53
58
|
}
|
|
59
|
+
export interface RotateOAuthClientSecretBody {
|
|
60
|
+
/**
|
|
61
|
+
* How long the previous secret keeps working, in seconds. Default 86400 (24
|
|
62
|
+
* hours); 0 revokes it now (after a leak); at most 604800 (7 days).
|
|
63
|
+
*/
|
|
64
|
+
overlap_seconds?: number;
|
|
65
|
+
}
|
|
66
|
+
/** The rotate response: the new secret (shown once) and when the old one stops working. */
|
|
67
|
+
export interface OAuthClientSecretRotation extends OAuthClientWithSecret {
|
|
68
|
+
client_secret: string;
|
|
69
|
+
/** The overlap applied, in seconds. */
|
|
70
|
+
overlap_seconds: number;
|
|
71
|
+
/** When the previous secret stops working (epoch ms), or null when it already has. */
|
|
72
|
+
previous_secret_expires_at: number | null;
|
|
73
|
+
}
|
|
54
74
|
export interface ClientGrant {
|
|
55
75
|
object: 'client_grant';
|
|
56
76
|
id: string;
|
|
@@ -162,7 +182,11 @@ export declare function oauthClientsResource(request: RequestFn): {
|
|
|
162
182
|
get(id: string): Promise<OAuthClient>;
|
|
163
183
|
create(body: CreateOAuthClientBody, idempotencyKey?: string): Promise<OAuthClientWithSecret>;
|
|
164
184
|
update(id: string, body: UpdateOAuthClientBody): Promise<OAuthClient>;
|
|
165
|
-
|
|
185
|
+
/**
|
|
186
|
+
* Mint a new secret. The previous one keeps working for `overlap_seconds`
|
|
187
|
+
* (default 24 hours, max 7 days; 0 = revoke it now).
|
|
188
|
+
*/
|
|
189
|
+
rotateSecret(id: string, body?: RotateOAuthClientSecretBody, idempotencyKey?: string): Promise<OAuthClientSecretRotation>;
|
|
166
190
|
delete(id: string): Promise<{
|
|
167
191
|
object: "oauth_client";
|
|
168
192
|
id: string;
|
|
@@ -20,8 +20,17 @@ function oauthClientsResource(request) {
|
|
|
20
20
|
update(id, body) {
|
|
21
21
|
return request({ method: 'PATCH', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}`, body });
|
|
22
22
|
},
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
/**
|
|
24
|
+
* Mint a new secret. The previous one keeps working for `overlap_seconds`
|
|
25
|
+
* (default 24 hours, max 7 days; 0 = revoke it now).
|
|
26
|
+
*/
|
|
27
|
+
rotateSecret(id, body = {}, idempotencyKey) {
|
|
28
|
+
return request({
|
|
29
|
+
method: 'POST',
|
|
30
|
+
path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/rotate_secret`,
|
|
31
|
+
body,
|
|
32
|
+
idempotencyKey,
|
|
33
|
+
});
|
|
25
34
|
},
|
|
26
35
|
delete(id) {
|
|
27
36
|
return request({ method: 'DELETE', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}` });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA8LA,oDAiFC;AA/QD,uCAAgD;AA8LhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { type AtlasRequestSettings, type RequestFn, type UnknownFieldsEvent } from './request';
|
|
2
2
|
import type { ListPage } from './types';
|
|
3
3
|
import type { BackchannelDeliveriesQuery, BackchannelLogoutDeliveryPage, BackchannelLogoutTest } from './oauth-clients';
|
|
4
|
-
import type { OriginMove, OriginMoveRequest, PreflightFinding } from './instance';
|
|
4
|
+
import type { AllowedOriginInput, OriginMove, OriginMoveRequest, PreflightFinding } from './instance';
|
|
5
5
|
import type { ConfigChangelogEntry, ListConfigChangelogParams } from './activity';
|
|
6
6
|
import type { AtlasDesign, AtlasDesignPatch, DeletedDesignAsset, DesignAsset, DesignAssetData, DesignPreview, ResolvedAtlasDesign, UploadDesignAssetOptions } from './design';
|
|
7
7
|
/** `GET /v1/platform/atlas_id_apps/{id}/preflight`. */
|
|
@@ -40,7 +40,20 @@ export interface PlatformApp {
|
|
|
40
40
|
name: string;
|
|
41
41
|
environment: 'production' | 'development';
|
|
42
42
|
publishable_key: string;
|
|
43
|
+
/** The Frontend API host: the default per-app host, or the custom domain once it is active. */
|
|
44
|
+
frontend_api_host: string | null;
|
|
45
|
+
/**
|
|
46
|
+
* The `iss` this app's session tokens carry. It changes when a custom domain
|
|
47
|
+
* goes active, so read it (and the two URLs below) rather than hard-coding it.
|
|
48
|
+
*/
|
|
49
|
+
issuer: string;
|
|
50
|
+
/** The OpenID discovery document whose `issuer` equals {@link issuer}. */
|
|
51
|
+
discovery_url: string;
|
|
52
|
+
/** The JWKS holding this app's signing keys. */
|
|
53
|
+
jwks_uri: string;
|
|
43
54
|
allowed_origins: string[];
|
|
55
|
+
/** The declared integration per allowed origin. Write `allowed_origins` entries as `{ origin, integration }` to set one. */
|
|
56
|
+
allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
|
|
44
57
|
/** Housekeeping labels (up to 20, each up to 40 chars). */
|
|
45
58
|
tags: string[];
|
|
46
59
|
/** Hidden from the default listing. A visibility flag only: the app still serves auth. */
|
|
@@ -68,14 +81,16 @@ export interface CreatedPlatformApp extends PlatformAppWithSecret {
|
|
|
68
81
|
export interface CreatePlatformAppBody {
|
|
69
82
|
name?: string;
|
|
70
83
|
environment?: 'production' | 'development';
|
|
71
|
-
|
|
84
|
+
/** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
|
|
85
|
+
allowed_origins?: AllowedOriginInput[];
|
|
72
86
|
/** Default true: also provision a test-mode sibling instance. */
|
|
73
87
|
create_development_sibling?: boolean;
|
|
74
88
|
tags?: string[];
|
|
75
89
|
}
|
|
76
90
|
export interface UpdatePlatformAppBody {
|
|
77
91
|
name?: string;
|
|
78
|
-
|
|
92
|
+
/** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
|
|
93
|
+
allowed_origins?: AllowedOriginInput[];
|
|
79
94
|
tags?: string[];
|
|
80
95
|
}
|
|
81
96
|
export interface ListPlatformAppsParams {
|
|
@@ -88,7 +103,8 @@ export interface ListPlatformAppsParams {
|
|
|
88
103
|
}
|
|
89
104
|
export interface CreatePlatformInstanceBody {
|
|
90
105
|
environment?: 'production' | 'development';
|
|
91
|
-
|
|
106
|
+
/** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
|
|
107
|
+
allowed_origins?: AllowedOriginInput[];
|
|
92
108
|
}
|
|
93
109
|
export interface PlatformAppSecretRotation {
|
|
94
110
|
object: 'app_secret';
|
|
@@ -144,7 +160,8 @@ export interface AccountlessApp {
|
|
|
144
160
|
export interface CreateAccountlessAppBody {
|
|
145
161
|
name?: string;
|
|
146
162
|
environment?: 'production' | 'development';
|
|
147
|
-
|
|
163
|
+
/** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
|
|
164
|
+
allowed_origins?: AllowedOriginInput[];
|
|
148
165
|
}
|
|
149
166
|
/** Page text on the Sign in with Atlas page. Plain text; null or empty uses the default. */
|
|
150
167
|
export interface AtlasIdAppCopy {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;AAupBA,8DAWC;AAlqBD,uCAMmB;AAoXnB,mFAAmF;AAEnF,SAAS,kBAAkB,CAAC,OAAkB;IAC5C,OAAO;QACL,IAAI,EAAE;YACJ,+EAA+E;YAC/E,IAAI,CAAC,SAAiC,EAAE;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,iEAAiE;YACjE,MAAM,CAAC,OAA8B,EAAE,EAAE,cAAuB;gBAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA2B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,6EAA6E;YAC7E,UAAU,CAAC,GAAa;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+DAA+D;YAC/D,OAAO,CAAC,EAAU;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,CAAC;YACD;;;eAGG;YACH,YAAY,CACV,EAAU,EACV,OAAqC,EAAE,EACvC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAClD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,mDAAmD;YACnD,UAAU,CAAC,EAAU;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS,EAAE;gBACT,IAAI,CAAC,KAAa;oBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,kFAAkF;gBAClF,MAAM,CACJ,KAAa,EACb,OAAmC,EAAE,EACrC,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;wBACjD,IAAI;wBACJ,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD,0EAA0E;gBAC1E,YAAY,CACV,KAAa,EACb,UAAkB,EAClB,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;wBAClF,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;aACF;YACD,yEAAyE;YACzE,QAAQ,CAAC,EAAU,EAAE,cAAuB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,sDAAsD;YACtD,cAAc,CACZ,aAAqB,EACrB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,mCAAmC;oBACzC,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;oBACvC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,KAAK,CAAC,UAAkB,EAAE,cAAuB;gBAC/C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;oBACjC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,eAAe,EAAE;YACf,8FAA8F;YAC9F,MAAM,CAAC,OAAiC,EAAE,EAAE,cAAuB;gBACjE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,oEAAoE;QACpE,WAAW,EAAE;YACX,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,sFAAsF;YACtF,MAAM,CAAC,IAA0B,EAAE,cAAuB;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,0DAA0D;YAC1D,MAAM,CAAC,EAAU,EAAE,IAA0B;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+CAA+C;YAC/C,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,6EAA6E;YAC7E,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;iBAC5D,CAAC,CAAC;YACL,CAAC;YACD,gEAAgE;YAChE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;gBAEtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;oBACpE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,kFAAkF;YAClF,qBAAqB,CAAC,EAAU;gBAC9B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;eAGG;YACH,SAAS,CAAC,EAAU,EAAE,KAAa;gBACjC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;oBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,oGAAoG;YACpG,WAAW,CAAC,EAAU,EAAE,OAAe;gBACrC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,sFAAsF;YACtF,UAAU,CAAC,EAAU,EAAE,IAAuB;gBAC5C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;oBACzD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,mBAAmB,CAAC,EAAU;gBAC5B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB;iBACpE,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,aAAa,CAAC,MAAmB;gBAC/B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,2CAA2C;oBACjD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,gBAAgB,EAAE;YAChB,yBAAyB;YACzB,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4EAA4E;YAC5E,GAAG,CAAC,IAA6B;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,6CAA6C;YAC7C,MAAM,CAAC,IAA+B;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,mDAAmD;YACnD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,uEAAuE;QACvE,eAAe,EAAE;YACf,IAAI,CAAC,SAAoC,EAAE;gBAMzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;SACF;QACD,yFAAyF;QACzF,YAAY,EAAE;YACZ,MAAM,CAAC,IAAqB,EAAE,UAAoC,EAAE;gBAClE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,+DAA+D;YAC/D,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,yBAAyB,CAAC,MAAiC;IACzE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC9B,WAAW,CAAC,SAA+B;YACzC,OAAO,yBAAyB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/client/users.d.ts
CHANGED
|
@@ -27,7 +27,22 @@ export interface EmailAddress {
|
|
|
27
27
|
object: 'email_address';
|
|
28
28
|
id: string;
|
|
29
29
|
email_address: string;
|
|
30
|
+
/**
|
|
31
|
+
* True only when the address was proven (an emailed code or link, a provider
|
|
32
|
+
* that vouches for it, or your backend). An address that signed up while
|
|
33
|
+
* `requireEmailVerification` was false is `false`.
|
|
34
|
+
*/
|
|
30
35
|
verified: boolean;
|
|
36
|
+
/**
|
|
37
|
+
* `status` mirrors `verified`. `strategy` says how it was verified
|
|
38
|
+
* (`email_code`, `email_link`, `oauth`, `admin`, `import`, `scim`, `lti`), or
|
|
39
|
+
* `skipped` for an address held for sign-in but never proven; `null` when not
|
|
40
|
+
* verified. (Absent from servers older than this field.)
|
|
41
|
+
*/
|
|
42
|
+
verification?: {
|
|
43
|
+
status: 'verified' | 'unverified';
|
|
44
|
+
strategy?: string | null;
|
|
45
|
+
};
|
|
31
46
|
primary: boolean;
|
|
32
47
|
created_at: number;
|
|
33
48
|
}
|
package/dist/client/users.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/client/users.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/client/users.ts"],"names":[],"mappings":";;AA8FA,sCA2aC;AAzgBD,uCAAgD;AA8FhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,SAA0B,EAAE;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,wEAAwE;QACxE,eAAe,CAAC,EAAU,EAAE,IAA6B;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,EAAU,EAAE,OAAyC,EAAE;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,eAAe,CACb,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,cAAc,CACZ,EAAU,EACV,UAAuC,EAAE;YAEzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,EAAU,EAAE,IAA+B;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,WAAW,CAAC,EAAU,EAAE,OAAe;YACrC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;aACpE,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,EAAU,EAAE,OAAe;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU;aACrE,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,EAAU,EAAE,QAAgB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,YAAY,CACV,EAAU,EACV,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD;;;;;;;;WAQG;QACH,sBAAsB,CACpB,EAAU,EACV,IAA8E,EAC9E,cAAuB;YASvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,4BAA4B;gBACtD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CACZ,EAAU,EACV,UAAkB;YAElB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,+EAA+E;QAC/E,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QACD;;;;WAIG;QACH,eAAe,CACb,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,WAAW,CACT,OAAe;YAEf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAAuB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6GAA6G;QAC7G,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,SAAuB,EAAE;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,2BAA2B,CACzB,EAAU,EACV,SAAuB,EAAE;YAEzB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;gBACrD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,EAAU,EAAE,IAAyB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,sEAAsE;QACtE,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,sFAAsF;QACtF,aAAa,CACX,EAAU,EACV,SAAiB;YAEjB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CAAC,EAAU,EAAE,IAAwB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;;WAIG;QACH,wBAAwB,CACtB,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,kBAAkB,CAChB,EAAU,EACV,IAAwB,EACxB,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe;gBACzC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,aAAa,CAAC,EAAU;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,sGAAsG;QACtG,QAAQ,EAAE;YACR,wGAAwG;YACxG,QAAQ,CACN,EAAU,EACV,OAAmC,EAAE,EACrC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,uFAAuF;YACvF,MAAM,CAAC,EAAU,EAAE,cAAuB;gBACxC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;oBAC5C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qGAAqG;YACrG,QAAQ,CACN,EAAU,EACV,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB;oBAC9C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,uEAAuE;QACvE,UAAU,EAAE;YACV,gFAAgF;YAChF,MAAM,CACJ,EAAU,EACV,IAA6B,EAC7B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;oBACvC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YAChF,CAAC;SACF;QACD,yEAAyE;QACzE,QAAQ,EAAE;YACR,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,wHAAwH;YACxH,MAAM,CACJ,EAAU,EACV,IAA2B,EAC3B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,sFAAsF;QACtF,gBAAgB,EAAE;YAChB;;;;eAIG;YACH,MAAM,CAAC,EAAU,EAAE,IAAmC;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,2EAA2E;YAC3E,GAAG,CAAC,EAAU,EAAE,UAAkB;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;QACD,yDAAyD;QACzD,uBAAuB,EAAE;YACvB,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;iBACtD,CAAC,CAAC;YACL,CAAC;YACD,iGAAiG;YACjG,MAAM,CACJ,EAAU,EACV,IAA2C;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;oBACrD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;QACD,wEAAwE;QACxE,YAAY,EAAE;YACZ,yBAAyB;YACzB,GAAG,CAAC,EAAU,EAAE,IAA8B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CAAC,EAAU,EAAE,OAAe;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;iBAClE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,EAAU,EACV,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;SACF;QACD,8BAA8B;QAC9B,WAAW,EAAE;YACX;;;eAGG;YACH,QAAQ,CAAC,EAAU,EAAE,IAA8B;gBACjD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -4,12 +4,14 @@ export * from './verify';
|
|
|
4
4
|
export * from './handshake';
|
|
5
5
|
export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
|
|
6
6
|
export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
|
|
7
|
+
export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidcCallback, oidcClearCookie, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches, } from './oidc';
|
|
8
|
+
export type { AtlasOidc, AtlasOidcErrorCode, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
|
|
7
9
|
export * from './webhooks';
|
|
8
10
|
export { createAtlasClient } from './client';
|
|
9
11
|
export type { AtlasClient } from './client';
|
|
10
12
|
export * from './client';
|
|
11
|
-
export { createTestIssuer } from './testing';
|
|
12
|
-
export type { TestIssuer, CreateTestIssuerOptions } from './testing';
|
|
13
|
+
export { createTestIssuer, TEST_TOKEN_TAMPERS } from './testing';
|
|
14
|
+
export type { TestIssuer, CreateTestIssuerOptions, MintIdTokenOptions, TestAuthorizeOptions, TestAuthorizeResult, TestTokenTamper, } from './testing';
|
|
13
15
|
export { verifyPCActn } from './pca/verify';
|
|
14
16
|
export type { PcaVerdict, PcaContext, VerifyPCActnOptions } from './pca/verify';
|
|
15
17
|
export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';
|
package/dist/index.js
CHANGED
|
@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
|
14
14
|
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
15
|
};
|
|
16
16
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
-
exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.createTestIssuer = exports.createAtlasClient = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
|
|
17
|
+
exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
|
|
18
18
|
// §7.3 token verification — the original surface, unchanged.
|
|
19
19
|
__exportStar(require("./jwks-cache"), exports);
|
|
20
20
|
// OIDC discovery of the JWKS URL when only `issuer` is configured.
|
|
@@ -33,6 +33,19 @@ Object.defineProperty(exports, "LOGOUT_TOKEN_MAX_AGE_SECONDS", { enumerable: tru
|
|
|
33
33
|
Object.defineProperty(exports, "LogoutTokenVerifier", { enumerable: true, get: function () { return logout_token_1.LogoutTokenVerifier; } });
|
|
34
34
|
Object.defineProperty(exports, "memoryLogoutReplayStore", { enumerable: true, get: function () { return logout_token_1.memoryLogoutReplayStore; } });
|
|
35
35
|
Object.defineProperty(exports, "verifyLogoutToken", { enumerable: true, get: function () { return logout_token_1.verifyLogoutToken; } });
|
|
36
|
+
// Server-side OIDC relying party for the hosted-redirect integration:
|
|
37
|
+
// state + nonce + PKCE flow cookie, code exchange, RS256-pinned ID-token checks.
|
|
38
|
+
var oidc_1 = require("./oidc");
|
|
39
|
+
Object.defineProperty(exports, "AtlasOidcError", { enumerable: true, get: function () { return oidc_1.AtlasOidcError; } });
|
|
40
|
+
Object.defineProperty(exports, "OIDC_FLOW_COOKIE", { enumerable: true, get: function () { return oidc_1.OIDC_FLOW_COOKIE; } });
|
|
41
|
+
Object.defineProperty(exports, "OIDC_FLOW_MAX_AGE_SECONDS", { enumerable: true, get: function () { return oidc_1.OIDC_FLOW_MAX_AGE_SECONDS; } });
|
|
42
|
+
Object.defineProperty(exports, "oidc", { enumerable: true, get: function () { return oidc_1.oidc; } });
|
|
43
|
+
Object.defineProperty(exports, "oidcCallback", { enumerable: true, get: function () { return oidc_1.oidcCallback; } });
|
|
44
|
+
Object.defineProperty(exports, "oidcClearCookie", { enumerable: true, get: function () { return oidc_1.oidcClearCookie; } });
|
|
45
|
+
Object.defineProperty(exports, "oidcLogoutUrl", { enumerable: true, get: function () { return oidc_1.oidcLogoutUrl; } });
|
|
46
|
+
Object.defineProperty(exports, "oidcStart", { enumerable: true, get: function () { return oidc_1.oidcStart; } });
|
|
47
|
+
Object.defineProperty(exports, "oidcVerifyIdToken", { enumerable: true, get: function () { return oidc_1.oidcVerifyIdToken; } });
|
|
48
|
+
Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: function () { return oidc_1.resetOidcCaches; } });
|
|
36
49
|
// §12.2 inbound webhook verification for consumers.
|
|
37
50
|
__exportStar(require("./webhooks"), exports);
|
|
38
51
|
// The typed management client for the secret-key Backend API.
|
|
@@ -44,6 +57,7 @@ __exportStar(require("./client"), exports);
|
|
|
44
57
|
// Its own module, so it never sits on the hot verification path.
|
|
45
58
|
var testing_1 = require("./testing");
|
|
46
59
|
Object.defineProperty(exports, "createTestIssuer", { enumerable: true, get: function () { return testing_1.createTestIssuer; } });
|
|
60
|
+
Object.defineProperty(exports, "TEST_TOKEN_TAMPERS", { enumerable: true, get: function () { return testing_1.TEST_TOKEN_TAMPERS; } });
|
|
47
61
|
// Proof-Carrying Authority (agentic auth): offline verifier + framework-agnostic guard,
|
|
48
62
|
// beside the session-token verifier above.
|
|
49
63
|
var verify_1 = require("./pca/verify");
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAU7C,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}
|
package/dist/oidc.d.ts
ADDED
|
@@ -0,0 +1,225 @@
|
|
|
1
|
+
import { type JWTPayload } from 'jose';
|
|
2
|
+
/**
|
|
3
|
+
* Server-side OpenID Connect relying party for the hosted-redirect integration.
|
|
4
|
+
*
|
|
5
|
+
* The three calls an app needs, in order:
|
|
6
|
+
*
|
|
7
|
+
* const { url, cookie } = await oidc.start({ issuer, clientId, redirectUri, secret });
|
|
8
|
+
* // → Set-Cookie: cookie, 302 to url
|
|
9
|
+
* const identity = await oidc.callback({ issuer, clientId, clientSecret, redirectUri, query, cookie, secret });
|
|
10
|
+
* // → Set-Cookie: identity.clearCookie, start your own session for identity.namespacedSub
|
|
11
|
+
* const logout = await oidc.logoutUrl({ issuer, clientId, postLogoutRedirectUri, idTokenHint });
|
|
12
|
+
*
|
|
13
|
+
* What it does so the integrator does not have to:
|
|
14
|
+
* - state, nonce and a PKCE (S256) pair per sign-in, carried to the callback in
|
|
15
|
+
* ONE short-lived httpOnly flow cookie scoped to the callback path. With a
|
|
16
|
+
* `secret` the cookie is sealed (AES-256-GCM, key derived with HKDF), so it
|
|
17
|
+
* can be neither read nor forged; the verifier never reaches page JavaScript
|
|
18
|
+
* either way.
|
|
19
|
+
* - discovery (cached per issuer for an hour; a failure is remembered for a
|
|
20
|
+
* minute so a burst of callbacks cannot become an outbound request flood),
|
|
21
|
+
* the code exchange with the client's authentication method, and the JWKS
|
|
22
|
+
* (the package's rate-limited kid-miss cache).
|
|
23
|
+
* - ID-token verification with the algorithm PINNED to RS256 (so `alg: none`
|
|
24
|
+
* and HS* confusion are refused), `iss` exact, `aud` containing the client id
|
|
25
|
+
* (and `azp` equal to it when there are several audiences or an `azp` at all),
|
|
26
|
+
* `nonce` equal to the cookie's, `exp`/`iat` with a small tolerance, and
|
|
27
|
+
* `at_hash` when the token carries one.
|
|
28
|
+
*
|
|
29
|
+
* Every failure is an {@link AtlasOidcError} with a stable `code`. Only Web
|
|
30
|
+
* standard globals are used (fetch, crypto.subtle, TextEncoder, atob/btoa), so
|
|
31
|
+
* this runs unchanged on Node 18+, Bun, Deno and edge runtimes.
|
|
32
|
+
*/
|
|
33
|
+
/**
|
|
34
|
+
* Stable failure codes. `access_denied` also stands for the OAuth `error` the
|
|
35
|
+
* authorization server redirected back with; that exact value is in
|
|
36
|
+
* {@link AtlasOidcError.oauthError}.
|
|
37
|
+
*/
|
|
38
|
+
export type AtlasOidcErrorCode = 'state_mismatch' | 'issuer_mismatch' | 'invalid_request' | 'invalid_token' | 'token_exchange_failed' | 'access_denied' | 'discovery_failed';
|
|
39
|
+
export declare class AtlasOidcError extends Error {
|
|
40
|
+
readonly code: AtlasOidcErrorCode;
|
|
41
|
+
/** The OAuth `error` value from the authorization or token endpoint, when there was one. */
|
|
42
|
+
readonly oauthError?: string;
|
|
43
|
+
/** The OAuth `error_description`, when there was one. */
|
|
44
|
+
readonly description?: string;
|
|
45
|
+
/** HTTP status of the token endpoint's answer, for `token_exchange_failed`. */
|
|
46
|
+
readonly status?: number;
|
|
47
|
+
/**
|
|
48
|
+
* A `Set-Cookie` value that removes the flow cookie. Send it with your error
|
|
49
|
+
* response too, so a failed sign-in leaves nothing behind. Set on every error
|
|
50
|
+
* thrown by {@link oidcCallback}.
|
|
51
|
+
*/
|
|
52
|
+
clearCookie?: string;
|
|
53
|
+
readonly cause?: unknown;
|
|
54
|
+
constructor(code: AtlasOidcErrorCode, message: string, extra?: {
|
|
55
|
+
cause?: unknown;
|
|
56
|
+
oauthError?: string;
|
|
57
|
+
description?: string;
|
|
58
|
+
status?: number;
|
|
59
|
+
});
|
|
60
|
+
}
|
|
61
|
+
interface OidcBaseOptions {
|
|
62
|
+
/** Your instance's issuer: `https://` + its frontend API host. */
|
|
63
|
+
issuer: string;
|
|
64
|
+
/** The OAuth client id (`client_id`). */
|
|
65
|
+
clientId: string;
|
|
66
|
+
/**
|
|
67
|
+
* Override the discovery document URL. Defaults to
|
|
68
|
+
* `${issuer}/.well-known/openid-configuration`.
|
|
69
|
+
*/
|
|
70
|
+
discoveryUrl?: string;
|
|
71
|
+
fetchImpl?: typeof fetch;
|
|
72
|
+
/** A clock in epoch milliseconds, for deterministic tests. */
|
|
73
|
+
now?: () => number;
|
|
74
|
+
}
|
|
75
|
+
/** The default flow cookie name. */
|
|
76
|
+
export declare const OIDC_FLOW_COOKIE = "atlas_oidc";
|
|
77
|
+
/** How long a started sign-in stays valid, in seconds. */
|
|
78
|
+
export declare const OIDC_FLOW_MAX_AGE_SECONDS = 600;
|
|
79
|
+
export interface OidcStartOptions extends OidcBaseOptions {
|
|
80
|
+
/** The callback URL, registered on the client exactly. */
|
|
81
|
+
redirectUri: string;
|
|
82
|
+
/** Space-delimited scopes. Default `openid profile email`; `openid` is added if missing. */
|
|
83
|
+
scope?: string;
|
|
84
|
+
/** OIDC `prompt` (`login`, `none`, `consent`, `select_account`, `create`). */
|
|
85
|
+
prompt?: string;
|
|
86
|
+
/** OIDC `login_hint`: prefill the sign-in page with this email or identifier. */
|
|
87
|
+
loginHint?: string;
|
|
88
|
+
/** Sent as `audience_hint`. */
|
|
89
|
+
audienceHint?: string;
|
|
90
|
+
/**
|
|
91
|
+
* Any other authorize parameters. They cannot override the ones this helper
|
|
92
|
+
* owns (`response_type`, `client_id`, `redirect_uri`, `state`, `nonce`,
|
|
93
|
+
* `code_challenge`, `code_challenge_method`).
|
|
94
|
+
*/
|
|
95
|
+
extraParams?: Record<string, string | undefined>;
|
|
96
|
+
/** The flow cookie name. Default `atlas_oidc`. Pass the same name to `callback`. */
|
|
97
|
+
cookieName?: string;
|
|
98
|
+
/**
|
|
99
|
+
* A server-side secret (at least 32 characters) that seals the flow cookie.
|
|
100
|
+
* Strongly recommended: without it the cookie is still httpOnly but only
|
|
101
|
+
* encoded, not encrypted or signed. Pass the same value to `callback`.
|
|
102
|
+
*/
|
|
103
|
+
secret?: string;
|
|
104
|
+
}
|
|
105
|
+
export interface OidcStartResult {
|
|
106
|
+
/** Redirect the browser here. */
|
|
107
|
+
url: string;
|
|
108
|
+
/** A `Set-Cookie` header value for the flow cookie. Send it with the redirect. */
|
|
109
|
+
cookie: string;
|
|
110
|
+
state: string;
|
|
111
|
+
nonce: string;
|
|
112
|
+
}
|
|
113
|
+
/**
|
|
114
|
+
* Begin a sign-in: build the authorize URL and the flow cookie. Send `cookie`
|
|
115
|
+
* as `Set-Cookie` and redirect to `url`.
|
|
116
|
+
*/
|
|
117
|
+
export declare function oidcStart(options: OidcStartOptions): Promise<OidcStartResult>;
|
|
118
|
+
export type OidcClientAuth = 'client_secret_basic' | 'client_secret_post' | 'none';
|
|
119
|
+
export interface OidcCallbackOptions extends OidcBaseOptions {
|
|
120
|
+
/** The same callback URL `start` used. */
|
|
121
|
+
redirectUri: string;
|
|
122
|
+
/** The client secret. Omit for a public client (`clientAuth: 'none'`). */
|
|
123
|
+
clientSecret?: string;
|
|
124
|
+
/**
|
|
125
|
+
* How to authenticate at the token endpoint. Default `client_secret_basic`
|
|
126
|
+
* when `clientSecret` is set, otherwise `none`.
|
|
127
|
+
*/
|
|
128
|
+
clientAuth?: OidcClientAuth;
|
|
129
|
+
/**
|
|
130
|
+
* The callback's query: a `URLSearchParams`, the request URL (or just its
|
|
131
|
+
* query string), or a framework's parsed query object.
|
|
132
|
+
*/
|
|
133
|
+
query: URLSearchParams | string | Record<string, string | string[] | undefined>;
|
|
134
|
+
/** The request's `Cookie` header, or just the flow cookie's value. */
|
|
135
|
+
cookie: string | null | undefined;
|
|
136
|
+
/** The flow cookie name `start` used. Default `atlas_oidc`. */
|
|
137
|
+
cookieName?: string;
|
|
138
|
+
/** The secret `start` used. */
|
|
139
|
+
secret?: string;
|
|
140
|
+
/** Allowed clock skew for `exp`/`iat`, in seconds. Default 60. */
|
|
141
|
+
clockToleranceSec?: number;
|
|
142
|
+
}
|
|
143
|
+
export interface OidcIdentity {
|
|
144
|
+
/** The Atlas user id (`sub`). Unique within one issuer. */
|
|
145
|
+
sub: string;
|
|
146
|
+
/**
|
|
147
|
+
* `${issuer}#${sub}`: unique across issuers. Key your users on this when you
|
|
148
|
+
* accept more than one instance (development and production, or several
|
|
149
|
+
* tenants), so two instances' users can never collide.
|
|
150
|
+
*/
|
|
151
|
+
namespacedSub: string;
|
|
152
|
+
email: string | null;
|
|
153
|
+
/** `true` only when the ID token says `email_verified: true`. */
|
|
154
|
+
emailVerified: boolean;
|
|
155
|
+
name: string | null;
|
|
156
|
+
/** The raw, verified ID token. Keep it for `logoutUrl({ idTokenHint })`. */
|
|
157
|
+
idToken: string;
|
|
158
|
+
accessToken: string;
|
|
159
|
+
/** Present when the client may use refresh tokens and the grant included one. */
|
|
160
|
+
refreshToken?: string;
|
|
161
|
+
/** When the access token expires, in epoch milliseconds. */
|
|
162
|
+
expiresAt: number;
|
|
163
|
+
/** Every verified ID-token claim. */
|
|
164
|
+
claims: JWTPayload & Record<string, unknown>;
|
|
165
|
+
/** A `Set-Cookie` value that removes the flow cookie. Send it with your response. */
|
|
166
|
+
clearCookie: string;
|
|
167
|
+
}
|
|
168
|
+
/**
|
|
169
|
+
* Finish a sign-in: check `state`, exchange the code (with PKCE and client
|
|
170
|
+
* authentication), verify the ID token, and return who signed in.
|
|
171
|
+
*/
|
|
172
|
+
export declare function oidcCallback(options: OidcCallbackOptions): Promise<OidcIdentity>;
|
|
173
|
+
/** Options for {@link verifyIdToken}. */
|
|
174
|
+
export interface VerifyIdTokenOptions {
|
|
175
|
+
issuer: string;
|
|
176
|
+
clientId: string;
|
|
177
|
+
/** The nonce sent on the authorize request. Required: an ID token without the right nonce is refused. */
|
|
178
|
+
nonce: string;
|
|
179
|
+
/** When given and the token has `at_hash`, the access token must match it. */
|
|
180
|
+
accessToken?: string;
|
|
181
|
+
clockToleranceSec?: number;
|
|
182
|
+
discoveryUrl?: string;
|
|
183
|
+
fetchImpl?: typeof fetch;
|
|
184
|
+
now?: () => number;
|
|
185
|
+
}
|
|
186
|
+
/**
|
|
187
|
+
* Verify an ID token on its own (for an app that does its own code exchange).
|
|
188
|
+
* Same checks as {@link oidcCallback}. Throws {@link AtlasOidcError}.
|
|
189
|
+
*/
|
|
190
|
+
export declare function oidcVerifyIdToken(idToken: string, options: VerifyIdTokenOptions): Promise<JWTPayload & Record<string, unknown>>;
|
|
191
|
+
export interface OidcLogoutUrlOptions extends OidcBaseOptions {
|
|
192
|
+
/** Where Atlas sends the user afterwards. Must be registered on the client exactly. */
|
|
193
|
+
postLogoutRedirectUri?: string;
|
|
194
|
+
/** The ID token from sign-in. Lets Atlas skip asking which session to end. */
|
|
195
|
+
idTokenHint?: string;
|
|
196
|
+
/** Echoed back on the post-logout redirect. */
|
|
197
|
+
state?: string;
|
|
198
|
+
}
|
|
199
|
+
/**
|
|
200
|
+
* The RP-initiated logout URL (`end_session_endpoint` from discovery). End your
|
|
201
|
+
* own session first, then redirect here so the Atlas session ends too.
|
|
202
|
+
*/
|
|
203
|
+
export declare function oidcLogoutUrl(options: OidcLogoutUrlOptions): Promise<string>;
|
|
204
|
+
/** A `Set-Cookie` value that removes the flow cookie for this callback path. */
|
|
205
|
+
export declare function oidcClearCookie(options: {
|
|
206
|
+
redirectUri: string;
|
|
207
|
+
cookieName?: string;
|
|
208
|
+
}): string;
|
|
209
|
+
/**
|
|
210
|
+
* The relying-party helpers as one namespace: `oidc.start`, `oidc.callback`,
|
|
211
|
+
* `oidc.logoutUrl`, `oidc.verifyIdToken`, `oidc.clearCookie`. Import the
|
|
212
|
+
* standalone `oidcStart` / `oidcCallback` / … for the smallest bundle.
|
|
213
|
+
*/
|
|
214
|
+
export declare const oidc: {
|
|
215
|
+
readonly start: typeof oidcStart;
|
|
216
|
+
readonly callback: typeof oidcCallback;
|
|
217
|
+
readonly logoutUrl: typeof oidcLogoutUrl;
|
|
218
|
+
readonly verifyIdToken: typeof oidcVerifyIdToken;
|
|
219
|
+
readonly clearCookie: typeof oidcClearCookie;
|
|
220
|
+
};
|
|
221
|
+
/** The type of {@link oidc}. */
|
|
222
|
+
export type AtlasOidc = typeof oidc;
|
|
223
|
+
/** Clear the discovery and key caches (tests, or after an issuer change). */
|
|
224
|
+
export declare function resetOidcCaches(): void;
|
|
225
|
+
export {};
|