@atproto/oauth-provider 0.10.2 → 0.11.1

package/src/oauth-provider.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto'
 import type { Redis, RedisOptions } from 'ioredis'
 import { Jwks, Keyset } from '@atproto/jwk'
+import { LexiconResolver } from '@atproto/lexicon-resolver'
 import type { Account } from '@atproto/oauth-provider-api'
 import {
   CLIENT_ASSERTION_TYPE_JWT_BEARER,
@@ -71,11 +72,13 @@ import { InvalidDpopProofError } from './errors/invalid-dpop-proof-error.js'
 import { InvalidGrantError } from './errors/invalid-grant-error.js'
 import { InvalidRequestError } from './errors/invalid-request-error.js'
 import { LoginRequiredError } from './errors/login-required-error.js'
+import { LexiconManager } from './lexicon/lexicon-manager.js'
+import { LexiconStore, asLexiconStore } from './lexicon/lexicon-store.js'
 import { HcaptchaConfig } from './lib/hcaptcha.js'
 import { RequestMetadata } from './lib/http/request.js'
 import { dateToRelativeSeconds } from './lib/util/date.js'
 import { formatError } from './lib/util/error.js'
-import { LocalizedString, MultiLangString } from './lib/util/locale.js'
+import { MultiLangString } from './lib/util/locale.js'
 import { CustomMetadata, buildMetadata } from './metadata/build-metadata.js'
 import { OAuthHooks } from './oauth-hooks.js'
 import {
@@ -117,7 +120,7 @@ export type {
   CustomizationInput,
   ErrorHandler,
   HcaptchaConfig,
-  LocalizedString,
+  LexiconResolver,
   MultiLangString,
   OAuthAuthorizationServerMetadata,
 }
@@ -129,11 +132,6 @@ type OAuthProviderConfig = {
    */
   authenticationMaxAge?: number
 
-  /**
-   * Maximum age an ephemeral session (one where "remember me" was not
-   * checked) can be before requiring re-authentication.
-   */
-
   /**
    * Maximum age access & id tokens can be before requiring a refresh.
    */
@@ -169,6 +167,11 @@ type OAuthProviderConfig = {
    */
   safeFetch?: typeof globalThis.fetch
 
+  /**
+   * A custom ATProto lexicon resolver
+   */
+  lexiconResolver?: LexiconResolver
+
   /**
    * A redis instance to use for replay protection. If not provided, replay
    * protection will use memory storage.
@@ -186,6 +189,7 @@ type OAuthProviderConfig = {
     AccountStore &
       ClientStore &
       DeviceStore &
+      LexiconStore &
       ReplayStore &
       RequestStore &
       TokenStore
@@ -194,6 +198,7 @@ type OAuthProviderConfig = {
   accountStore?: AccountStore
   clientStore?: ClientStore
   deviceStore?: DeviceStore
+  lexiconStore?: LexiconStore
   replayStore?: ReplayStore
   requestStore?: RequestStore
   tokenStore?: TokenStore
@@ -243,6 +248,7 @@ export class OAuthProvider extends OAuthVerifier {
   public readonly accountManager: AccountManager
   public readonly deviceManager: DeviceManager
   public readonly clientManager: ClientManager
+  public readonly lexiconManager: LexiconManager
   public readonly requestManager: RequestManager
   public readonly tokenManager: TokenManager
 
@@ -254,16 +260,18 @@ export class OAuthProvider extends OAuthVerifier {
 
     metadata,
 
+    lexiconResolver,
     safeFetch = safeFetchWrap(),
     store, // compound store implementation
 
-    // Requires stores
+    // Required stores
     accountStore = asAccountStore(store),
     deviceStore = asDeviceStore(store),
+    lexiconStore = asLexiconStore(store),
     tokenStore = asTokenStore(store),
     requestStore = asRequestStore(store),
 
-    // These are optional
+    // Optional stores
     clientStore = ifClientStore(store),
     replayStore = ifReplayStore(store),
 
@@ -322,14 +330,17 @@ export class OAuthProvider extends OAuthVerifier {
       clientJwksCache,
       clientMetadataCache,
     )
+    this.lexiconManager = new LexiconManager(lexiconStore, lexiconResolver)
     this.requestManager = new RequestManager(
       requestStore,
+      this.lexiconManager,
       this.signer,
       this.metadata,
       this.hooks,
     )
     this.tokenManager = new TokenManager(
       tokenStore,
+      this.lexiconManager,
       this.signer,
       this.hooks,
       this.accessTokenMode,
@@ -667,6 +678,16 @@ export class OAuthProvider extends OAuthVerifier {
           loginRequired: session.loginRequired,
           consentRequired: session.consentRequired,
         })),
+        permissionSets: await this.lexiconManager
+          .getPermissionSetsFromScope(parameters.scope)
+          .catch((cause) => {
+            throw new AuthorizationError(
+              parameters,
+              'Unable to retrieve permission sets',
+              'invalid_scope',
+              cause,
+            )
+          }),
       }
     } catch (err) {
       try {

package/src/oauth-store.ts

@@ -6,6 +6,7 @@
 export * from './account/account-store.js'
 export * from './client/client-store.js'
 export * from './device/device-store.js'
+export * from './lexicon/lexicon-store.js'
 export * from './replay/replay-store.js'
 export * from './request/request-store.js'
 export * from './token/token-store.js'

package/src/request/request-manager.ts

@@ -1,6 +1,7 @@
 import { isAtprotoDid } from '@atproto/did'
+import { LexiconResolutionError } from '@atproto/lexicon-resolver'
 import type { Account } from '@atproto/oauth-provider-api'
-import { isValidAtprotoOauthScope } from '@atproto/oauth-scopes'
+import { isAtprotoOauthScope } from '@atproto/oauth-scopes'
 import {
   OAuthAuthorizationRequestParameters,
   OAuthAuthorizationServerMetadata,
@@ -23,6 +24,7 @@ import { InvalidAuthorizationDetailsError } from '../errors/invalid-authorizatio
 import { InvalidGrantError } from '../errors/invalid-grant-error.js'
 import { InvalidRequestError } from '../errors/invalid-request-error.js'
 import { InvalidScopeError } from '../errors/invalid-scope-error.js'
+import { LexiconManager } from '../lexicon/lexicon-manager.js'
 import { RequestMetadata } from '../lib/http/request.js'
 import { callAsync } from '../lib/util/function.js'
 import { OAuthHooks } from '../oauth-hooks.js'
@@ -43,6 +45,7 @@ import {
 export class RequestManager {
   constructor(
     protected readonly store: RequestStore,
+    protected readonly lexiconManager: LexiconManager,
     protected readonly signer: Signer,
     protected readonly metadata: OAuthAuthorizationServerMetadata,
     protected readonly hooks: OAuthHooks,
@@ -171,17 +174,16 @@ export class RequestManager {
     // > (Section 3.2.3) to inform the client of the actual scope granted.
 
     // Let's make sure the scopes are unique (to reduce the token & storage
-    // size) & are indeed supported.
+    // size).
+    const scopes = new Set(parameters.scope?.split(' '))
 
     // @NOTE An app requesting a not yet supported list of scopes will need to
     // re-authenticate the user once the scopes are supported. This is due to
     // the fact that the AS does not know how to properly display those scopes
     // to the user, so it cannot properly ask for consent.
-    const scopes = new Set(
-      parameters.scope?.split(' ')?.filter(isValidAtprotoOauthScope),
-    )
-
-    parameters = { ...parameters, scope: [...scopes].join(' ') || undefined }
+    const scope =
+      Array.from(scopes).filter(isAtprotoOauthScope).join(' ') || undefined
+    parameters = { ...parameters, scope }
 
     if (parameters.code_challenge) {
       switch (parameters.code_challenge_method) {
@@ -288,6 +290,23 @@ export class RequestManager {
       parameters = { ...parameters, login_hint: hint }
     }
 
+    // Make sure that every nsid in the scope resolves to a valid permission set
+    // lexicon
+    if (parameters.scope) {
+      await this.lexiconManager
+        .getPermissionSetsFromScope(parameters.scope)
+        .catch((cause) => {
+          throw new AuthorizationError(
+            parameters,
+            cause instanceof LexiconResolutionError
+              ? cause.message
+              : 'Unable to retrieve included permission sets',
+            'invalid_scope',
+            cause,
+          )
+        })
+    }
+
     return parameters
   }
 

package/src/result/authorization-result-authorize-page.ts

@@ -1,12 +1,14 @@
+import type { LexPermissionSet } from '@atproto/lexicon'
 import type { Session } from '@atproto/oauth-provider-api'
-import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
-import { Client } from '../client/client.js'
-import { RequestUri } from '../request/request-uri.js'
+import type { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
+import type { Client } from '../client/client.js'
+import type { RequestUri } from '../request/request-uri.js'
 
 export type AuthorizationResultAuthorizePage = {
   issuer: string
   client: Client
   parameters: OAuthAuthorizationRequestParameters
+  permissionSets: Map<string, LexPermissionSet>
 
   requestUri: RequestUri
   sessions: readonly Session[]

package/src/router/assets/send-authorization-page.ts

@@ -46,6 +46,7 @@ export function sendAuthorizePageFactory(customization: Customization) {
         scope: data.parameters.scope,
         uiLocales: data.parameters.ui_locales,
         loginHint: data.parameters.login_hint,
+        permissionSets: Object.fromEntries(data.permissionSets),
       },
       __sessions: data.sessions,
     })

package/src/token/token-data.ts

@@ -29,4 +29,12 @@ export type TokenData = {
   parameters: OAuthAuthorizationRequestParameters
   details?: null // Legacy field, not used
   code: Code | null
+
+  /**
+   * This will contain the parameter scope, translated into permissions
+   *
+   * @note null because this didn't use to exist. New tokens should always
+   * include a scope.
+   */
+  scope: string | null
 }

package/src/token/token-manager.ts

@@ -1,4 +1,5 @@
 import { SignedJwt, isSignedJwt } from '@atproto/jwk'
+import { LexiconResolutionError } from '@atproto/lexicon-resolver'
 import type { Account } from '@atproto/oauth-provider-api'
 import {
   OAuthAccessToken,
@@ -14,6 +15,7 @@ import { DeviceId } from '../device/device-id.js'
 import { InvalidGrantError } from '../errors/invalid-grant-error.js'
 import { InvalidRequestError } from '../errors/invalid-request-error.js'
 import { InvalidTokenError } from '../errors/invalid-token-error.js'
+import { LexiconManager } from '../lexicon/lexicon-manager.js'
 import { RequestMetadata } from '../lib/http/request.js'
 import { dateToEpoch, dateToRelativeSeconds } from '../lib/util/date.js'
 import { callAsync } from '../lib/util/function.js'
@@ -28,9 +30,8 @@ import {
   generateRefreshToken,
   isRefreshToken,
 } from './refresh-token.js'
-import { TokenData } from './token-data.js'
 import { TokenId, generateTokenId, isTokenId } from './token-id.js'
-import { TokenInfo, TokenStore } from './token-store.js'
+import { CreateTokenData, TokenInfo, TokenStore } from './token-store.js'
 import {
   VerifyTokenClaimsOptions,
   VerifyTokenClaimsResult,
@@ -43,6 +44,7 @@ export type { OAuthHooks, TokenStore, VerifyTokenClaimsResult }
 export class TokenManager {
   constructor(
     protected readonly store: TokenStore,
+    protected readonly lexiconManager: LexiconManager,
     protected readonly signer: Signer,
     protected readonly hooks: OAuthHooks,
     protected readonly accessTokenMode: AccessTokenMode,
@@ -58,21 +60,20 @@ export class TokenManager {
     account: Account,
     client: Client,
     parameters: OAuthAuthorizationRequestParameters,
-    options: {
-      now: Date
-      expiresAt: Date
-    },
+    createdAt: Date,
+    expiresAt: Date,
+    scope: string,
   ): Promise<OAuthAccessToken> {
     return this.signer.createAccessToken({
       jti: tokenId,
       sub: account.sub,
-      exp: dateToEpoch(options.expiresAt),
-      iat: dateToEpoch(options.now),
+      exp: dateToEpoch(expiresAt),
+      iat: dateToEpoch(createdAt),
       cnf: parameters.dpop_jkt ? { jkt: parameters.dpop_jkt } : undefined,
 
       ...(this.accessTokenMode === AccessTokenMode.stateless && {
         aud: account.aud,
-        scope: parameters.scope,
+        scope,
         // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3
         client_id: client.id,
       }),
@@ -98,36 +99,50 @@ export class TokenManager {
     const now = new Date()
     const expiresAt = this.createTokenExpiry(now)
 
-    const tokenData: TokenData = {
-      createdAt: now,
-      updatedAt: now,
-      expiresAt,
-      clientId: client.id,
-      clientAuth,
-      deviceId,
-      sub: account.sub,
-      parameters,
-      details: null,
-      code,
-    }
+    const scope = await this.lexiconManager
+      .buildTokenScope(parameters.scope!)
+      .catch((cause) => {
+        throw new InvalidRequestError(
+          cause instanceof LexiconResolutionError
+            ? cause.message
+            : 'Unable to retrieve included permission sets',
+          cause,
+        )
+      })
 
     const accessToken = await this.buildAccessToken(
       tokenId,
       account,
       client,
       parameters,
-      { now, expiresAt },
+      now,
+      expiresAt,
+      scope,
     )
 
-    const response = await this.buildTokenResponse(
-      client,
+    const response = this.buildTokenResponse(
+      inferTokenType(parameters),
       accessToken,
       refreshToken,
       expiresAt,
-      parameters,
       account.sub,
+      scope,
     )
 
+    const tokenData: CreateTokenData = {
+      createdAt: now,
+      updatedAt: now,
+      expiresAt,
+      clientId: client.id,
+      clientAuth,
+      deviceId,
+      sub: account.sub,
+      parameters,
+      details: null,
+      scope,
+      code,
+    }
+
     await this.store.createToken(tokenId, tokenData, refreshToken)
 
     try {
@@ -161,18 +176,18 @@ export class TokenManager {
   }
 
   protected buildTokenResponse(
-    client: Client,
+    tokenType: OAuthTokenType,
     accessToken: OAuthAccessToken,
     refreshToken: string | undefined,
     expiresAt: Date,
-    parameters: OAuthAuthorizationRequestParameters,
     sub: Sub,
+    scope: string,
   ): OAuthTokenResponse {
     return {
       access_token: accessToken,
-      token_type: parameters.dpop_jkt ? 'DPoP' : 'Bearer',
+      token_type: tokenType,
       refresh_token: refreshToken,
-      scope: parameters.scope,
+      scope,
 
       // @NOTE using a getter so that the value gets computed when the JSON
       // response is generated, allowing to value to be as accurate as possible.
@@ -204,6 +219,11 @@ export class TokenManager {
     const now = new Date()
     const expiresAt = this.createTokenExpiry(now)
 
+    // @NOTE since the permission sets are stored in a persistent store,
+    // it's fine to propagate a 500 (server_error) here as the values should
+    // be retrievable from the store.
+    const scope = await this.lexiconManager.buildTokenScope(parameters.scope!)
+
     await this.store.rotateToken(tokenInfo.id, nextTokenId, nextRefreshToken, {
       updatedAt: now,
       expiresAt,
@@ -214,6 +234,7 @@ export class TokenManager {
       // - Allow clients to become "confidential" if they were previously
       //   "public"
       clientAuth,
+      scope,
     })
 
     const accessToken = await this.buildAccessToken(
@@ -221,16 +242,18 @@ export class TokenManager {
       account,
       client,
       parameters,
-      { now, expiresAt },
+      now,
+      expiresAt,
+      scope,
     )
 
-    const response = await this.buildTokenResponse(
-      client,
+    const response = this.buildTokenResponse(
+      inferTokenType(parameters),
       accessToken,
       nextRefreshToken,
       expiresAt,
-      parameters,
       account.sub,
+      scope,
     )
 
     await callAsync(this.hooks.onTokenRefreshed, {
@@ -361,7 +384,9 @@ export class TokenManager {
       // These are not stored in the JWT access token in "light" access token
       // mode. See `buildAccessToken`.
       aud: account.aud,
-      scope: parameters.scope,
+      // Note we fallback to parameters.scope for sessions created before
+      // TokenData.scope was introduced.
+      scope: data.scope ?? parameters.scope,
       client_id: data.clientId,
     }
 
@@ -386,3 +411,12 @@ export class TokenManager {
 function isCurrentTokenExpired(tokenInfo: TokenInfo): boolean {
   return tokenInfo.data.expiresAt.getTime() < Date.now()
 }
+
+function inferTokenType(
+  parameters: OAuthAuthorizationRequestParameters,
+): OAuthTokenType {
+  if (parameters.dpop_jkt) {
+    return 'DPoP'
+  }
+  return 'Bearer'
+}

package/src/token/token-store.ts

@@ -19,15 +19,27 @@ export type TokenInfo = {
   currentRefreshToken: null | RefreshToken
 }
 
-export type NewTokenData = Pick<
-  TokenData,
-  'clientAuth' | 'expiresAt' | 'updatedAt'
->
+export type NewTokenData = {
+  clientAuth: TokenData['clientAuth']
+  expiresAt: TokenData['expiresAt']
+  updatedAt: TokenData['updatedAt']
+  scope: NonNullable<TokenData['scope']>
+}
+
+export type CreateTokenData = TokenData & {
+  scope: NonNullable<TokenData['scope']>
+}
 
+/**
+ * @param data historically, {@link TokenData.scope} was not present in
+ * {@link TokenData}, causing it to be "nullable" when returned from
+ * {@link TokenStore.readToken}. We use {@link CreateTokenData} here to allow
+ * the store implementation to expect its presence.
+ */
 export interface TokenStore {
   createToken(
     tokenId: TokenId,
-    data: TokenData,
+    data: CreateTokenData,
     refreshToken?: RefreshToken,
   ): Awaitable<void>
 

package/tsconfig.build.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/constants.ts","./src/index.ts","./src/oauth-client.ts","./src/oauth-dpop.ts","./src/oauth-errors.ts","./src/oauth-hooks.ts","./src/oauth-middleware.ts","./src/oauth-provider.ts","./src/oauth-store.ts","./src/oauth-verifier.ts","./src/access-token/access-token-mode.ts","./src/account/account-manager.ts","./src/account/account-store.ts","./src/account/sign-in-data.ts","./src/account/sign-up-input.ts","./src/client/client-auth.ts","./src/client/client-data.ts","./src/client/client-id.ts","./src/client/client-info.ts","./src/client/client-manager.ts","./src/client/client-store.ts","./src/client/client-utils.ts","./src/client/client.ts","./src/customization/branding.ts","./src/customization/build-customization-css.ts","./src/customization/build-customization-data.ts","./src/customization/colors.ts","./src/customization/customization.ts","./src/customization/links.ts","./src/device/device-data.ts","./src/device/device-id.ts","./src/device/device-manager.ts","./src/device/device-store.ts","./src/device/session-id.ts","./src/dpop/dpop-manager.ts","./src/dpop/dpop-nonce.ts","./src/dpop/dpop-proof.ts","./src/errors/access-denied-error.ts","./src/errors/account-selection-required-error.ts","./src/errors/authorization-error.ts","./src/errors/consent-required-error.ts","./src/errors/error-parser.ts","./src/errors/handle-unavailable-error.ts","./src/errors/invalid-authorization-details-error.ts","./src/errors/invalid-client-error.ts","./src/errors/invalid-client-id-error.ts","./src/errors/invalid-client-metadata-error.ts","./src/errors/invalid-dpop-key-binding-error.ts","./src/errors/invalid-dpop-proof-error.ts","./src/errors/invalid-grant-error.ts","./src/errors/invalid-invite-code-error.ts","./src/errors/invalid-redirect-uri-error.ts","./src/errors/invalid-request-error.ts","./src/errors/invalid-scope-error.ts","./src/errors/invalid-token-error.ts","./src/errors/login-required-error.ts","./src/errors/oauth-error.ts","./src/errors/second-authentication-factor-required-error.ts","./src/errors/unauthorized-client-error.ts","./src/errors/use-dpop-nonce-error.ts","./src/errors/www-authenticate-error.ts","./src/lib/hcaptcha.ts","./src/lib/redis.ts","./src/lib/send-web-page.ts","./src/lib/csp/index.ts","./src/lib/html/build-document.ts","./src/lib/html/escapers.ts","./src/lib/html/html.ts","./src/lib/html/hydration-data.ts","./src/lib/html/index.ts","./src/lib/html/tags.ts","./src/lib/html/util.ts","./src/lib/http/accept.ts","./src/lib/http/context.ts","./src/lib/http/headers.ts","./src/lib/http/index.ts","./src/lib/http/method.ts","./src/lib/http/middleware.ts","./src/lib/http/parser.ts","./src/lib/http/path.ts","./src/lib/http/request.ts","./src/lib/http/response.ts","./src/lib/http/route.ts","./src/lib/http/router.ts","./src/lib/http/security-headers.ts","./src/lib/http/stream.ts","./src/lib/http/types.ts","./src/lib/http/url.ts","./src/lib/util/authorization-header.ts","./src/lib/util/cast.ts","./src/lib/util/color.ts","./src/lib/util/crypto.ts","./src/lib/util/date.ts","./src/lib/util/error.ts","./src/lib/util/function.ts","./src/lib/util/locale.ts","./src/lib/util/redirect-uri.ts","./src/lib/util/time.ts","./src/lib/util/type.ts","./src/lib/util/ui8.ts","./src/lib/util/well-known.ts","./src/lib/util/zod-error.ts","./src/metadata/build-metadata.ts","./src/oidc/sub.ts","./src/replay/replay-manager.ts","./src/replay/replay-store-memory.ts","./src/replay/replay-store-redis.ts","./src/replay/replay-store.ts","./src/request/code.ts","./src/request/request-data.ts","./src/request/request-id.ts","./src/request/request-manager.ts","./src/request/request-store.ts","./src/request/request-uri.ts","./src/result/authorization-redirect-parameters.ts","./src/result/authorization-result-authorize-page.ts","./src/result/authorization-result-redirect.ts","./src/router/create-account-page-middleware.ts","./src/router/create-api-middleware.ts","./src/router/create-authorization-page-middleware.ts","./src/router/create-oauth-middleware.ts","./src/router/error-handler.ts","./src/router/middleware-options.ts","./src/router/send-redirect.ts","./src/router/assets/assets-manifest.ts","./src/router/assets/assets.ts","./src/router/assets/csrf.ts","./src/router/assets/send-account-page.ts","./src/router/assets/send-authorization-page.ts","./src/router/assets/send-error-page.ts","./src/signer/api-token-payload.ts","./src/signer/signed-token-payload.ts","./src/signer/signer.ts","./src/token/refresh-token.ts","./src/token/token-data.ts","./src/token/token-id.ts","./src/token/token-manager.ts","./src/token/token-store.ts","./src/token/verify-token-claims.ts","./src/types/authorization-response-error.ts","./src/types/color-hue.ts","./src/types/email-otp.ts","./src/types/email.ts","./src/types/handle.ts","./src/types/invite-code.ts","./src/types/par-response-error.ts","./src/types/password.ts","./src/types/rgb-color.ts"],"version":"5.8.3"}
+{"root":["./src/constants.ts","./src/index.ts","./src/oauth-client.ts","./src/oauth-dpop.ts","./src/oauth-errors.ts","./src/oauth-hooks.ts","./src/oauth-middleware.ts","./src/oauth-provider.ts","./src/oauth-store.ts","./src/oauth-verifier.ts","./src/access-token/access-token-mode.ts","./src/account/account-manager.ts","./src/account/account-store.ts","./src/account/sign-in-data.ts","./src/account/sign-up-input.ts","./src/client/client-auth.ts","./src/client/client-data.ts","./src/client/client-id.ts","./src/client/client-info.ts","./src/client/client-manager.ts","./src/client/client-store.ts","./src/client/client-utils.ts","./src/client/client.ts","./src/customization/branding.ts","./src/customization/build-customization-css.ts","./src/customization/build-customization-data.ts","./src/customization/colors.ts","./src/customization/customization.ts","./src/customization/links.ts","./src/device/device-data.ts","./src/device/device-id.ts","./src/device/device-manager.ts","./src/device/device-store.ts","./src/device/session-id.ts","./src/dpop/dpop-manager.ts","./src/dpop/dpop-nonce.ts","./src/dpop/dpop-proof.ts","./src/errors/access-denied-error.ts","./src/errors/account-selection-required-error.ts","./src/errors/authorization-error.ts","./src/errors/consent-required-error.ts","./src/errors/error-parser.ts","./src/errors/handle-unavailable-error.ts","./src/errors/invalid-authorization-details-error.ts","./src/errors/invalid-client-error.ts","./src/errors/invalid-client-id-error.ts","./src/errors/invalid-client-metadata-error.ts","./src/errors/invalid-dpop-key-binding-error.ts","./src/errors/invalid-dpop-proof-error.ts","./src/errors/invalid-grant-error.ts","./src/errors/invalid-invite-code-error.ts","./src/errors/invalid-redirect-uri-error.ts","./src/errors/invalid-request-error.ts","./src/errors/invalid-scope-error.ts","./src/errors/invalid-token-error.ts","./src/errors/login-required-error.ts","./src/errors/oauth-error.ts","./src/errors/second-authentication-factor-required-error.ts","./src/errors/unauthorized-client-error.ts","./src/errors/use-dpop-nonce-error.ts","./src/errors/www-authenticate-error.ts","./src/lexicon/lexicon-data.ts","./src/lexicon/lexicon-getter.ts","./src/lexicon/lexicon-manager.ts","./src/lexicon/lexicon-store.ts","./src/lib/hcaptcha.ts","./src/lib/nsid.ts","./src/lib/redis.ts","./src/lib/send-web-page.ts","./src/lib/csp/index.ts","./src/lib/html/build-document.ts","./src/lib/html/escapers.ts","./src/lib/html/html.ts","./src/lib/html/hydration-data.ts","./src/lib/html/index.ts","./src/lib/html/tags.ts","./src/lib/html/util.ts","./src/lib/http/accept.ts","./src/lib/http/context.ts","./src/lib/http/headers.ts","./src/lib/http/index.ts","./src/lib/http/method.ts","./src/lib/http/middleware.ts","./src/lib/http/parser.ts","./src/lib/http/path.ts","./src/lib/http/request.ts","./src/lib/http/response.ts","./src/lib/http/route.ts","./src/lib/http/router.ts","./src/lib/http/security-headers.ts","./src/lib/http/stream.ts","./src/lib/http/types.ts","./src/lib/http/url.ts","./src/lib/util/authorization-header.ts","./src/lib/util/cast.ts","./src/lib/util/color.ts","./src/lib/util/crypto.ts","./src/lib/util/date.ts","./src/lib/util/error.ts","./src/lib/util/function.ts","./src/lib/util/locale.ts","./src/lib/util/redirect-uri.ts","./src/lib/util/time.ts","./src/lib/util/type.ts","./src/lib/util/ui8.ts","./src/lib/util/well-known.ts","./src/lib/util/zod-error.ts","./src/metadata/build-metadata.ts","./src/oidc/sub.ts","./src/replay/replay-manager.ts","./src/replay/replay-store-memory.ts","./src/replay/replay-store-redis.ts","./src/replay/replay-store.ts","./src/request/code.ts","./src/request/request-data.ts","./src/request/request-id.ts","./src/request/request-manager.ts","./src/request/request-store.ts","./src/request/request-uri.ts","./src/result/authorization-redirect-parameters.ts","./src/result/authorization-result-authorize-page.ts","./src/result/authorization-result-redirect.ts","./src/router/create-account-page-middleware.ts","./src/router/create-api-middleware.ts","./src/router/create-authorization-page-middleware.ts","./src/router/create-oauth-middleware.ts","./src/router/error-handler.ts","./src/router/middleware-options.ts","./src/router/send-redirect.ts","./src/router/assets/assets-manifest.ts","./src/router/assets/assets.ts","./src/router/assets/csrf.ts","./src/router/assets/send-account-page.ts","./src/router/assets/send-authorization-page.ts","./src/router/assets/send-error-page.ts","./src/signer/api-token-payload.ts","./src/signer/signed-token-payload.ts","./src/signer/signer.ts","./src/token/refresh-token.ts","./src/token/token-data.ts","./src/token/token-id.ts","./src/token/token-manager.ts","./src/token/token-store.ts","./src/token/verify-token-claims.ts","./src/types/authorization-response-error.ts","./src/types/color-hue.ts","./src/types/email-otp.ts","./src/types/email.ts","./src/types/handle.ts","./src/types/invite-code.ts","./src/types/par-response-error.ts","./src/types/password.ts","./src/types/rgb-color.ts"],"version":"5.8.3"}