@atproto/oauth-provider 0.16.5 → 0.17.0

package/dist/oauth-errors.js

@@ -1,44 +1,26 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthError = void 0;
 // Root Error class
-var oauth_error_js_1 = require("./errors/oauth-error.js");
-Object.defineProperty(exports, "OAuthError", { enumerable: true, get: function () { return oauth_error_js_1.OAuthError; } });
-__exportStar(require("./errors/access-denied-error.js"), exports);
-__exportStar(require("./errors/account-selection-required-error.js"), exports);
-__exportStar(require("./errors/authorization-error.js"), exports);
-__exportStar(require("./errors/consent-required-error.js"), exports);
-__exportStar(require("./errors/handle-unavailable-error.js"), exports);
-__exportStar(require("./errors/invalid-authorization-details-error.js"), exports);
-__exportStar(require("./errors/invalid-client-error.js"), exports);
-__exportStar(require("./errors/invalid-client-id-error.js"), exports);
-__exportStar(require("./errors/invalid-client-metadata-error.js"), exports);
-__exportStar(require("./errors/invalid-credentials-error.js"), exports);
-__exportStar(require("./errors/invalid-dpop-key-binding-error.js"), exports);
-__exportStar(require("./errors/invalid-dpop-proof-error.js"), exports);
-__exportStar(require("./errors/invalid-grant-error.js"), exports);
-__exportStar(require("./errors/invalid-invite-code-error.js"), exports);
-__exportStar(require("./errors/invalid-redirect-uri-error.js"), exports);
-__exportStar(require("./errors/invalid-request-error.js"), exports);
-__exportStar(require("./errors/invalid-scope-error.js"), exports);
-__exportStar(require("./errors/invalid-token-error.js"), exports);
-__exportStar(require("./errors/login-required-error.js"), exports);
-__exportStar(require("./errors/second-authentication-factor-required-error.js"), exports);
-__exportStar(require("./errors/unauthorized-client-error.js"), exports);
-__exportStar(require("./errors/use-dpop-nonce-error.js"), exports);
-__exportStar(require("./errors/www-authenticate-error.js"), exports);
+export { OAuthError } from './errors/oauth-error.js';
+export * from './errors/access-denied-error.js';
+export * from './errors/account-selection-required-error.js';
+export * from './errors/authorization-error.js';
+export * from './errors/consent-required-error.js';
+export * from './errors/handle-unavailable-error.js';
+export * from './errors/invalid-authorization-details-error.js';
+export * from './errors/invalid-client-error.js';
+export * from './errors/invalid-client-id-error.js';
+export * from './errors/invalid-client-metadata-error.js';
+export * from './errors/invalid-credentials-error.js';
+export * from './errors/invalid-dpop-key-binding-error.js';
+export * from './errors/invalid-dpop-proof-error.js';
+export * from './errors/invalid-grant-error.js';
+export * from './errors/invalid-invite-code-error.js';
+export * from './errors/invalid-redirect-uri-error.js';
+export * from './errors/invalid-request-error.js';
+export * from './errors/invalid-scope-error.js';
+export * from './errors/invalid-token-error.js';
+export * from './errors/login-required-error.js';
+export * from './errors/second-authentication-factor-required-error.js';
+export * from './errors/unauthorized-client-error.js';
+export * from './errors/use-dpop-nonce-error.js';
+export * from './errors/www-authenticate-error.js';
 //# sourceMappingURL=oauth-errors.js.map

package/dist/oauth-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-errors.js","sourceRoot":"","sources":["../src/oauth-errors.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,mBAAmB;AACnB,0DAAoD;AAA3C,4GAAA,UAAU,OAAA;AAEnB,kEAA+C;AAC/C,+EAA4D;AAC5D,kEAA+C;AAC/C,qEAAkD;AAClD,uEAAoD;AACpD,kFAA+D;AAC/D,mEAAgD;AAChD,sEAAmD;AACnD,4EAAyD;AACzD,wEAAqD;AACrD,6EAA0D;AAC1D,uEAAoD;AACpD,kEAA+C;AAC/C,wEAAqD;AACrD,yEAAsD;AACtD,oEAAiD;AACjD,kEAA+C;AAC/C,kEAA+C;AAC/C,mEAAgD;AAChD,0FAAuE;AACvE,wEAAqD;AACrD,mEAAgD;AAChD,qEAAkD","sourcesContent":["// Root Error class\nexport { OAuthError } from './errors/oauth-error.js'\n\nexport * from './errors/access-denied-error.js'\nexport * from './errors/account-selection-required-error.js'\nexport * from './errors/authorization-error.js'\nexport * from './errors/consent-required-error.js'\nexport * from './errors/handle-unavailable-error.js'\nexport * from './errors/invalid-authorization-details-error.js'\nexport * from './errors/invalid-client-error.js'\nexport * from './errors/invalid-client-id-error.js'\nexport * from './errors/invalid-client-metadata-error.js'\nexport * from './errors/invalid-credentials-error.js'\nexport * from './errors/invalid-dpop-key-binding-error.js'\nexport * from './errors/invalid-dpop-proof-error.js'\nexport * from './errors/invalid-grant-error.js'\nexport * from './errors/invalid-invite-code-error.js'\nexport * from './errors/invalid-redirect-uri-error.js'\nexport * from './errors/invalid-request-error.js'\nexport * from './errors/invalid-scope-error.js'\nexport * from './errors/invalid-token-error.js'\nexport * from './errors/login-required-error.js'\nexport * from './errors/second-authentication-factor-required-error.js'\nexport * from './errors/unauthorized-client-error.js'\nexport * from './errors/use-dpop-nonce-error.js'\nexport * from './errors/www-authenticate-error.js'\n"]}
+{"version":3,"file":"oauth-errors.js","sourceRoot":"","sources":["../src/oauth-errors.ts"],"names":[],"mappings":"AAAA,mBAAmB;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEpD,cAAc,iCAAiC,CAAA;AAC/C,cAAc,8CAA8C,CAAA;AAC5D,cAAc,iCAAiC,CAAA;AAC/C,cAAc,oCAAoC,CAAA;AAClD,cAAc,sCAAsC,CAAA;AACpD,cAAc,iDAAiD,CAAA;AAC/D,cAAc,kCAAkC,CAAA;AAChD,cAAc,qCAAqC,CAAA;AACnD,cAAc,2CAA2C,CAAA;AACzD,cAAc,uCAAuC,CAAA;AACrD,cAAc,4CAA4C,CAAA;AAC1D,cAAc,sCAAsC,CAAA;AACpD,cAAc,iCAAiC,CAAA;AAC/C,cAAc,uCAAuC,CAAA;AACrD,cAAc,wCAAwC,CAAA;AACtD,cAAc,mCAAmC,CAAA;AACjD,cAAc,iCAAiC,CAAA;AAC/C,cAAc,iCAAiC,CAAA;AAC/C,cAAc,kCAAkC,CAAA;AAChD,cAAc,yDAAyD,CAAA;AACvE,cAAc,uCAAuC,CAAA;AACrD,cAAc,kCAAkC,CAAA;AAChD,cAAc,oCAAoC,CAAA","sourcesContent":["// Root Error class\nexport { OAuthError } from './errors/oauth-error.js'\n\nexport * from './errors/access-denied-error.js'\nexport * from './errors/account-selection-required-error.js'\nexport * from './errors/authorization-error.js'\nexport * from './errors/consent-required-error.js'\nexport * from './errors/handle-unavailable-error.js'\nexport * from './errors/invalid-authorization-details-error.js'\nexport * from './errors/invalid-client-error.js'\nexport * from './errors/invalid-client-id-error.js'\nexport * from './errors/invalid-client-metadata-error.js'\nexport * from './errors/invalid-credentials-error.js'\nexport * from './errors/invalid-dpop-key-binding-error.js'\nexport * from './errors/invalid-dpop-proof-error.js'\nexport * from './errors/invalid-grant-error.js'\nexport * from './errors/invalid-invite-code-error.js'\nexport * from './errors/invalid-redirect-uri-error.js'\nexport * from './errors/invalid-request-error.js'\nexport * from './errors/invalid-scope-error.js'\nexport * from './errors/invalid-token-error.js'\nexport * from './errors/login-required-error.js'\nexport * from './errors/second-authentication-factor-required-error.js'\nexport * from './errors/unauthorized-client-error.js'\nexport * from './errors/use-dpop-nonce-error.js'\nexport * from './errors/www-authenticate-error.js'\n"]}

package/dist/oauth-hooks.js

@@ -1,16 +1,9 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthError = exports.InvalidRequestError = exports.InvalidCredentialsError = exports.Client = exports.AuthorizationError = exports.AccessDeniedError = void 0;
-const client_js_1 = require("./client/client.js");
-Object.defineProperty(exports, "Client", { enumerable: true, get: function () { return client_js_1.Client; } });
-const access_denied_error_js_1 = require("./errors/access-denied-error.js");
-Object.defineProperty(exports, "AccessDeniedError", { enumerable: true, get: function () { return access_denied_error_js_1.AccessDeniedError; } });
-const authorization_error_js_1 = require("./errors/authorization-error.js");
-Object.defineProperty(exports, "AuthorizationError", { enumerable: true, get: function () { return authorization_error_js_1.AuthorizationError; } });
-const invalid_credentials_error_js_1 = require("./errors/invalid-credentials-error.js");
-Object.defineProperty(exports, "InvalidCredentialsError", { enumerable: true, get: function () { return invalid_credentials_error_js_1.InvalidCredentialsError; } });
-const invalid_request_error_js_1 = require("./errors/invalid-request-error.js");
-Object.defineProperty(exports, "InvalidRequestError", { enumerable: true, get: function () { return invalid_request_error_js_1.InvalidRequestError; } });
-const oauth_error_js_1 = require("./errors/oauth-error.js");
-Object.defineProperty(exports, "OAuthError", { enumerable: true, get: function () { return oauth_error_js_1.OAuthError; } });
+import { Client } from './client/client.js';
+import { AccessDeniedError } from './errors/access-denied-error.js';
+import { AuthorizationError } from './errors/authorization-error.js';
+import { InvalidCredentialsError } from './errors/invalid-credentials-error.js';
+import { InvalidRequestError } from './errors/invalid-request-error.js';
+import { OAuthError } from './errors/oauth-error.js';
+// Make sure all types needed to implement the OAuthHooks are exported
+export { AccessDeniedError, AuthorizationError, Client, InvalidCredentialsError, InvalidRequestError, OAuthError, };
 //# sourceMappingURL=oauth-hooks.js.map

package/dist/oauth-hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":";;;AAoBA,kDAA2C;AA2BzC,uFA3BO,kBAAM,OA2BP;AAxBR,4EAAmE;AAmBjE,kGAnBO,0CAAiB,OAmBP;AAlBnB,4EAAoE;AAqBlE,mGArBO,2CAAkB,OAqBP;AApBpB,wFAA+E;AA+B7E,wGA/BO,sDAAuB,OA+BP;AA9BzB,gFAAuE;AA+BrE,oGA/BO,8CAAmB,OA+BP;AA9BrB,4DAAoD;AAoClD,2FApCO,2BAAU,OAoCP","sourcesContent":["import { Jwks } from '@atproto/jwk'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport {\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n} from '@atproto/oauth-types'\nimport {\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n} from './account/account-store.js'\nimport { SignInData } from './account/sign-in-data.js'\nimport { SignUpInput } from './account/sign-up-input.js'\nimport { ClientAuth } from './client/client-auth.js'\nimport { ClientId } from './client/client-id.js'\nimport { ClientInfo } from './client/client-info.js'\nimport { Client } from './client/client.js'\nimport { DeviceId } from './device/device-id.js'\nimport { DpopProof } from './dpop/dpop-proof.js'\nimport { AccessDeniedError } from './errors/access-denied-error.js'\nimport { AuthorizationError } from './errors/authorization-error.js'\nimport { InvalidCredentialsError } from './errors/invalid-credentials-error.js'\nimport { InvalidRequestError } from './errors/invalid-request-error.js'\nimport { OAuthError } from './errors/oauth-error.js'\nimport {\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n} from './lib/hcaptcha.js'\nimport { RequestMetadata } from './lib/http/request.js'\nimport { Awaitable, OmitKey } from './lib/util/type.js'\nimport { Sub } from './oidc/sub.js'\nimport { RequestId } from './request/request-id.js'\nimport { AccessTokenPayload } from './signer/access-token-payload.js'\nimport { TokenClaims } from './token/token-claims.js'\n\n// Make sure all types needed to implement the OAuthHooks are exported\nexport {\n  AccessDeniedError,\n  type AccessTokenPayload,\n  type Account,\n  AuthorizationError,\n  type Awaitable,\n  Client,\n  type ClientAuth,\n  type ClientId,\n  type ClientInfo,\n  type DeviceId,\n  type DpopProof,\n  type HcaptchaClientTokens,\n  type HcaptchaConfig,\n  type HcaptchaVerifyResult,\n  InvalidCredentialsError,\n  InvalidRequestError,\n  type Jwks,\n  type OAuthAccessToken,\n  type OAuthAuthorizationDetails,\n  type OAuthAuthorizationRequestParameters,\n  type OAuthClientMetadata,\n  OAuthError,\n  type OAuthTokenResponse,\n  type OAuthTokenType,\n  type RequestMetadata,\n  type ResetPasswordConfirmInput,\n  type ResetPasswordRequestInput,\n  type SignInData,\n  type SignUpData,\n  type SignUpInput,\n  type Sub,\n  type TokenClaims,\n}\n\nexport type OAuthHooks = {\n  /**\n   * Use this to alter, override or validate the client metadata & jwks returned\n   * by the client store.\n   *\n   * @throws {InvalidClientMetadataError} if the metadata is invalid\n   * @see {@link InvalidClientMetadataError}\n   */\n  getClientInfo?: (\n    clientId: ClientId,\n    data: { metadata: OAuthClientMetadata; jwks?: Jwks },\n  ) => Awaitable<undefined | Partial<ClientInfo>>\n\n  /**\n   * This hook is called when a user attempts to sign up, after every validation\n   * has passed (including hcaptcha).\n   */\n  onSignUpAttempt?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after the hcaptcha\n   * `/siteverify` request has been made (and before the result is validated).\n   */\n  onHcaptchaResult?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    tokens: HcaptchaClientTokens\n    result: HcaptchaVerifyResult\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store.\n   */\n  onResetPasswordRequest?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store.\n   */\n  onResetPasswordRequested?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms a password reset, before the\n   * password is actually reset on the account store.\n   */\n  onResetPasswordConfirm?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms a password reset, and the\n   * password was successfully reset on the account store.\n   */\n  onResetPasswordConfirmed?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs up.\n   *\n   * @throws {AccessDeniedError} to deny the sign-up\n   */\n  onSignedUp?: (data: {\n    data: SignUpData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request (i.e. the user is logging in to approve a\n   * client); it is omitted for first-party sign-ins that happen outside any\n   * authorization flow.\n   */\n  onSignInAttempt?: (data: {\n    data: SignInData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs in.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * @throws {InvalidRequestError} when the sing-in should be denied\n   */\n  onSignedIn?: (data: {\n    data: SignInData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a sign-in attempt is rejected by the account\n   * store due to invalid credentials (e.g. unknown identifier, wrong\n   * password). It is *not* called for unexpected server errors, nor for flows\n   * that require an additional authentication factor.\n   *\n   * `sub` is populated when the store throws an\n   * {@link InvalidCredentialsError} that carries the matched subject\n   * identifier (i.e. identifier known, credentials wrong). It is `null` when\n   * the identifier was unknown or when the store threw a plain\n   * {@link InvalidRequestError} without distinguishing the two cases.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * Errors thrown from this hook are caught and ignored so that they do not\n   * mask the original authentication failure.\n   */\n  onSignInFailed?: (data: {\n    data: SignInData\n    error: InvalidRequestError\n    sub: Sub | null\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * Allows validating an authorization request (typically the requested scopes)\n   * before it is created. Note that the validity against the client metadata is\n   * already enforced by the OAuth provider.\n   *\n   * @throws {AuthorizationError}\n   */\n  onAuthorizationRequest?: (data: {\n    client: Client\n    clientAuth: null | ClientAuth\n    parameters: Readonly<OAuthAuthorizationRequestParameters>\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a client is authorized.\n   *\n   * @throws {AuthorizationError} to deny the authorization request and redirect\n   * the user to the client with an OAuth error (other errors will result in an\n   * internal server error being displayed to the user)\n   *\n   * @note We use `deviceMetadata` instead of `clientMetadata` to make it clear\n   * that this metadata is from the user device, which might be different from\n   * the client metadata (because the OAuth client could live in a backend).\n   */\n  onAuthorized?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    requestId: RequestId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called whenever a token is about to be created. You can use\n   * it to modify the token claims or perform additional validation.\n   *\n   * This hook should never throw an error.\n   */\n  onCreateToken?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    claims: TokenClaims\n  }) => Awaitable<void | OmitKey<AccessTokenPayload, 'iss'>>\n\n  /**\n   * This hook is called whenever a token was just decoded, and basic validation\n   * was performed (signature, expiration, not-before).\n   *\n   * It can be used to modify the payload (e.g., to add custom claims), or to\n   * perform additional validation.\n   *\n   * This hook is called when authenticating requests through the\n   * `authenticateRequest()` method in `OAuthVerifier` and `OAuthProvider`.\n   *\n   * Any error thrown here will be propagated.\n   */\n  onDecodeToken?: (data: {\n    tokenType: OAuthTokenType\n    token: OAuthAccessToken\n    payload: AccessTokenPayload\n    dpopProof: null | DpopProof\n  }) => Promise<AccessTokenPayload | void>\n\n  /**\n   * This hook is called when an authorized client exchanges an authorization\n   * code for an access token.\n   *\n   * @throws {OAuthError} to cancel the token creation and revoke the session\n   */\n  onTokenCreated?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when an authorized client refreshes an access token.\n   *\n   * @throws {OAuthError} to cancel the token refresh and revoke the session\n   */\n  onTokenRefreshed?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n}\n"]}
+{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAG3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAapD,sEAAsE;AACtE,OAAO,EACL,iBAAiB,EAGjB,kBAAkB,EAElB,MAAM,EASN,uBAAuB,EACvB,mBAAmB,EAMnB,UAAU,GAWX,CAAA","sourcesContent":["import { Jwks } from '@atproto/jwk'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport {\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n} from '@atproto/oauth-types'\nimport {\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n} from './account/account-store.js'\nimport { SignInData } from './account/sign-in-data.js'\nimport { SignUpInput } from './account/sign-up-input.js'\nimport { ClientAuth } from './client/client-auth.js'\nimport { ClientId } from './client/client-id.js'\nimport { ClientInfo } from './client/client-info.js'\nimport { Client } from './client/client.js'\nimport { DeviceId } from './device/device-id.js'\nimport { DpopProof } from './dpop/dpop-proof.js'\nimport { AccessDeniedError } from './errors/access-denied-error.js'\nimport { AuthorizationError } from './errors/authorization-error.js'\nimport { InvalidCredentialsError } from './errors/invalid-credentials-error.js'\nimport { InvalidRequestError } from './errors/invalid-request-error.js'\nimport { OAuthError } from './errors/oauth-error.js'\nimport {\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n} from './lib/hcaptcha.js'\nimport { RequestMetadata } from './lib/http/request.js'\nimport { Awaitable, OmitKey } from './lib/util/type.js'\nimport { Sub } from './oidc/sub.js'\nimport { RequestId } from './request/request-id.js'\nimport { AccessTokenPayload } from './signer/access-token-payload.js'\nimport { TokenClaims } from './token/token-claims.js'\n\n// Make sure all types needed to implement the OAuthHooks are exported\nexport {\n  AccessDeniedError,\n  type AccessTokenPayload,\n  type Account,\n  AuthorizationError,\n  type Awaitable,\n  Client,\n  type ClientAuth,\n  type ClientId,\n  type ClientInfo,\n  type DeviceId,\n  type DpopProof,\n  type HcaptchaClientTokens,\n  type HcaptchaConfig,\n  type HcaptchaVerifyResult,\n  InvalidCredentialsError,\n  InvalidRequestError,\n  type Jwks,\n  type OAuthAccessToken,\n  type OAuthAuthorizationDetails,\n  type OAuthAuthorizationRequestParameters,\n  type OAuthClientMetadata,\n  OAuthError,\n  type OAuthTokenResponse,\n  type OAuthTokenType,\n  type RequestMetadata,\n  type ResetPasswordConfirmInput,\n  type ResetPasswordRequestInput,\n  type SignInData,\n  type SignUpData,\n  type SignUpInput,\n  type Sub,\n  type TokenClaims,\n}\n\nexport type OAuthHooks = {\n  /**\n   * Use this to alter, override or validate the client metadata & jwks returned\n   * by the client store.\n   *\n   * @throws {InvalidClientMetadataError} if the metadata is invalid\n   * @see {@link InvalidClientMetadataError}\n   */\n  getClientInfo?: (\n    clientId: ClientId,\n    data: { metadata: OAuthClientMetadata; jwks?: Jwks },\n  ) => Awaitable<undefined | Partial<ClientInfo>>\n\n  /**\n   * This hook is called when a user attempts to sign up, after every validation\n   * has passed (including hcaptcha).\n   */\n  onSignUpAttempt?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after the hcaptcha\n   * `/siteverify` request has been made (and before the result is validated).\n   */\n  onHcaptchaResult?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    tokens: HcaptchaClientTokens\n    result: HcaptchaVerifyResult\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store.\n   */\n  onResetPasswordRequest?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store.\n   */\n  onResetPasswordRequested?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms a password reset, before the\n   * password is actually reset on the account store.\n   */\n  onResetPasswordConfirm?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms a password reset, and the\n   * password was successfully reset on the account store.\n   */\n  onResetPasswordConfirmed?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs up.\n   *\n   * @throws {AccessDeniedError} to deny the sign-up\n   */\n  onSignedUp?: (data: {\n    data: SignUpData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request (i.e. the user is logging in to approve a\n   * client); it is omitted for first-party sign-ins that happen outside any\n   * authorization flow.\n   */\n  onSignInAttempt?: (data: {\n    data: SignInData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs in.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * @throws {InvalidRequestError} when the sing-in should be denied\n   */\n  onSignedIn?: (data: {\n    data: SignInData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a sign-in attempt is rejected by the account\n   * store due to invalid credentials (e.g. unknown identifier, wrong\n   * password). It is *not* called for unexpected server errors, nor for flows\n   * that require an additional authentication factor.\n   *\n   * `sub` is populated when the store throws an\n   * {@link InvalidCredentialsError} that carries the matched subject\n   * identifier (i.e. identifier known, credentials wrong). It is `null` when\n   * the identifier was unknown or when the store threw a plain\n   * {@link InvalidRequestError} without distinguishing the two cases.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * Errors thrown from this hook are caught and ignored so that they do not\n   * mask the original authentication failure.\n   */\n  onSignInFailed?: (data: {\n    data: SignInData\n    error: InvalidRequestError\n    sub: Sub | null\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * Allows validating an authorization request (typically the requested scopes)\n   * before it is created. Note that the validity against the client metadata is\n   * already enforced by the OAuth provider.\n   *\n   * @throws {AuthorizationError}\n   */\n  onAuthorizationRequest?: (data: {\n    client: Client\n    clientAuth: null | ClientAuth\n    parameters: Readonly<OAuthAuthorizationRequestParameters>\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a client is authorized.\n   *\n   * @throws {AuthorizationError} to deny the authorization request and redirect\n   * the user to the client with an OAuth error (other errors will result in an\n   * internal server error being displayed to the user)\n   *\n   * @note We use `deviceMetadata` instead of `clientMetadata` to make it clear\n   * that this metadata is from the user device, which might be different from\n   * the client metadata (because the OAuth client could live in a backend).\n   */\n  onAuthorized?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    requestId: RequestId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called whenever a token is about to be created. You can use\n   * it to modify the token claims or perform additional validation.\n   *\n   * This hook should never throw an error.\n   */\n  onCreateToken?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    claims: TokenClaims\n  }) => Awaitable<void | OmitKey<AccessTokenPayload, 'iss'>>\n\n  /**\n   * This hook is called whenever a token was just decoded, and basic validation\n   * was performed (signature, expiration, not-before).\n   *\n   * It can be used to modify the payload (e.g., to add custom claims), or to\n   * perform additional validation.\n   *\n   * This hook is called when authenticating requests through the\n   * `authenticateRequest()` method in `OAuthVerifier` and `OAuthProvider`.\n   *\n   * Any error thrown here will be propagated.\n   */\n  onDecodeToken?: (data: {\n    tokenType: OAuthTokenType\n    token: OAuthAccessToken\n    payload: AccessTokenPayload\n    dpopProof: null | DpopProof\n  }) => Promise<AccessTokenPayload | void>\n\n  /**\n   * This hook is called when an authorized client exchanges an authorization\n   * code for an access token.\n   *\n   * @throws {OAuthError} to cancel the token creation and revoke the session\n   */\n  onTokenCreated?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when an authorized client refreshes an access token.\n   *\n   * @throws {OAuthError} to cancel the token refresh and revoke the session\n   */\n  onTokenRefreshed?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n}\n"]}

package/dist/oauth-middleware.js

@@ -1,17 +1,14 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.oauthMiddleware = oauthMiddleware;
-const middleware_js_1 = require("./lib/http/middleware.js");
-const assets_js_1 = require("./router/assets/assets.js");
-const create_account_page_middleware_js_1 = require("./router/create-account-page-middleware.js");
-const create_api_middleware_js_1 = require("./router/create-api-middleware.js");
-const create_authorization_page_middleware_js_1 = require("./router/create-authorization-page-middleware.js");
-const create_oauth_middleware_js_1 = require("./router/create-oauth-middleware.js");
+import { asHandler, combineMiddlewares } from './lib/http/middleware.js';
+import { assetsMiddleware } from './router/assets/assets.js';
+import { createAccountPageMiddleware } from './router/create-account-page-middleware.js';
+import { createApiMiddleware } from './router/create-api-middleware.js';
+import { createAuthorizationPageMiddleware } from './router/create-authorization-page-middleware.js';
+import { createOAuthMiddleware } from './router/create-oauth-middleware.js';
 /**
  * @returns An http request handler that can be used with node's http server
  * or as a middleware with express / connect.
  */
-function oauthMiddleware(server, { ...options } = {}) {
+export function oauthMiddleware(server, { ...options } = {}) {
     const { onError } = options;
     // options is shallow cloned so it's fine to mutate it
     options.onError =
@@ -21,12 +18,12 @@ function oauthMiddleware(server, { ...options } = {}) {
                 return onError?.(req, res, err, msg);
             }
             : onError;
-    return (0, middleware_js_1.asHandler)((0, middleware_js_1.combineMiddlewares)([
-        assets_js_1.assetsMiddleware,
-        (0, create_oauth_middleware_js_1.createOAuthMiddleware)(server, options),
-        (0, create_api_middleware_js_1.createApiMiddleware)(server, options),
-        (0, create_authorization_page_middleware_js_1.createAuthorizationPageMiddleware)(server, options),
-        (0, create_account_page_middleware_js_1.createAccountPageMiddleware)(server, options),
+    return asHandler(combineMiddlewares([
+        assetsMiddleware,
+        createOAuthMiddleware(server, options),
+        createApiMiddleware(server, options),
+        createAuthorizationPageMiddleware(server, options),
+        createAccountPageMiddleware(server, options),
     ]));
 }
 //# sourceMappingURL=oauth-middleware.js.map

package/dist/oauth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-middleware.js","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":";;AAyBA,0CA2BC;AAnDD,4DAAwE;AAGxE,yDAA4D;AAC5D,kGAAwF;AACxF,gFAAuE;AACvE,8GAAoG;AACpG,oFAA2E;AAa3E;;;GAGG;AACH,SAAgB,eAAe,CAI7B,MAAqB,EACrB,EAAE,GAAG,OAAO,KAAkC,EAAE;IAEhD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,sDAAsD;IACtD,OAAO,CAAC,OAAO;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;YACvC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;gBACnD,OAAO,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,CAAC;YACH,CAAC,CAAC,OAAO,CAAA;IAEb,OAAO,IAAA,yBAAS,EACd,IAAA,kCAAkB,EAAC;QACjB,4BAAgB;QAChB,IAAA,kDAAqB,EAAC,MAAM,EAAE,OAAO,CAAC;QACtC,IAAA,8CAAmB,EAAC,MAAM,EAAE,OAAO,CAAC;QACpC,IAAA,2EAAiC,EAAC,MAAM,EAAE,OAAO,CAAC;QAClD,IAAA,+DAA2B,EAAC,MAAM,EAAE,OAAO,CAAC;KAC7C,CAAC,CACH,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { asHandler, combineMiddlewares } from './lib/http/middleware.js'\nimport { Handler } from './lib/http/types.js'\nimport { OAuthProvider } from './oauth-provider.js'\nimport { assetsMiddleware } from './router/assets/assets.js'\nimport { createAccountPageMiddleware } from './router/create-account-page-middleware.js'\nimport { createApiMiddleware } from './router/create-api-middleware.js'\nimport { createAuthorizationPageMiddleware } from './router/create-authorization-page-middleware.js'\nimport { createOAuthMiddleware } from './router/create-oauth-middleware.js'\nimport { ErrorHandler } from './router/error-handler.js'\nimport { MiddlewareOptions } from './router/middleware-options.js'\n\n// Export all the types exposed\nexport type {\n  ErrorHandler,\n  Handler,\n  IncomingMessage,\n  MiddlewareOptions,\n  ServerResponse,\n}\n\n/**\n * @returns An http request handler that can be used with node's http server\n * or as a middleware with express / connect.\n */\nexport function oauthMiddleware<\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { ...options }: MiddlewareOptions<Req, Res> = {},\n): Handler<void, Req, Res> {\n  const { onError } = options\n\n  // options is shallow cloned so it's fine to mutate it\n  options.onError =\n    process.env['NODE_ENV'] === 'development'\n      ? (req, res, err, msg) => {\n          console.error(`OAuthProvider error (${msg}):`, err)\n          return onError?.(req, res, err, msg)\n        }\n      : onError\n\n  return asHandler(\n    combineMiddlewares([\n      assetsMiddleware,\n      createOAuthMiddleware(server, options),\n      createApiMiddleware(server, options),\n      createAuthorizationPageMiddleware(server, options),\n      createAccountPageMiddleware(server, options),\n    ]),\n  )\n}\n"]}
+{"version":3,"file":"oauth-middleware.js","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAGxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAA;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAA;AAa3E;;;GAGG;AACH,MAAM,UAAU,eAAe,CAI7B,MAAqB,EACrB,EAAE,GAAG,OAAO,KAAkC,EAAE;IAEhD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,sDAAsD;IACtD,OAAO,CAAC,OAAO;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;YACvC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;gBACnD,OAAO,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,CAAC;YACH,CAAC,CAAC,OAAO,CAAA;IAEb,OAAO,SAAS,CACd,kBAAkB,CAAC;QACjB,gBAAgB;QAChB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC;QACtC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC;QACpC,iCAAiC,CAAC,MAAM,EAAE,OAAO,CAAC;QAClD,2BAA2B,CAAC,MAAM,EAAE,OAAO,CAAC;KAC7C,CAAC,CACH,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { asHandler, combineMiddlewares } from './lib/http/middleware.js'\nimport { Handler } from './lib/http/types.js'\nimport { OAuthProvider } from './oauth-provider.js'\nimport { assetsMiddleware } from './router/assets/assets.js'\nimport { createAccountPageMiddleware } from './router/create-account-page-middleware.js'\nimport { createApiMiddleware } from './router/create-api-middleware.js'\nimport { createAuthorizationPageMiddleware } from './router/create-authorization-page-middleware.js'\nimport { createOAuthMiddleware } from './router/create-oauth-middleware.js'\nimport { ErrorHandler } from './router/error-handler.js'\nimport { MiddlewareOptions } from './router/middleware-options.js'\n\n// Export all the types exposed\nexport type {\n  ErrorHandler,\n  Handler,\n  IncomingMessage,\n  MiddlewareOptions,\n  ServerResponse,\n}\n\n/**\n * @returns An http request handler that can be used with node's http server\n * or as a middleware with express / connect.\n */\nexport function oauthMiddleware<\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { ...options }: MiddlewareOptions<Req, Res> = {},\n): Handler<void, Req, Res> {\n  const { onError } = options\n\n  // options is shallow cloned so it's fine to mutate it\n  options.onError =\n    process.env['NODE_ENV'] === 'development'\n      ? (req, res, err, msg) => {\n          console.error(`OAuthProvider error (${msg}):`, err)\n          return onError?.(req, res, err, msg)\n        }\n      : onError\n\n  return asHandler(\n    combineMiddlewares([\n      assetsMiddleware,\n      createOAuthMiddleware(server, options),\n      createApiMiddleware(server, options),\n      createAuthorizationPageMiddleware(server, options),\n      createAccountPageMiddleware(server, options),\n    ]),\n  )\n}\n"]}