@atproto/oauth-provider 0.19.9 → 0.20.0

package/dist/router/create-authorization-page-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-authorization-page-middleware.js","sourceRoot":"","sources":["../../src/router/create-authorization-page-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oCAAoC,GACrC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAEL,MAAM,EAEN,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAA;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EACL,+BAA+B,EAC/B,YAAY,GACb,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAG7D,MAAM,UAAU,iCAAiC,CAK/C,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAA;IAErC,MAAM,eAAe,GAA2B;QAC9C,IAAI,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACzD,CAAA;IAED,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,aAAa,GAAG,oBAAoB,CACxC,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,mBAAmB,GAAG,0BAA0B,CACpD,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,SAAS,CAAC,CAAA;IAEnD,MAAM,CAAC,GAAG,CACR,kBAAkB,EAClB,gBAAgB,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACvC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;QAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAEnC,yEAAyE;QACzE,8CAA8C;QAC9C,0EAA0E;QAC1E,kCAAkC;QAClC,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;QAC1E,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAEjC,sEAAsE;QACtE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE3D,oDAAoD;QACpD,uEAAuE;QACvE,uEAAuE;QACvE,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E;QACE,qBAAqB;QACrB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC;YAChD,wGAAwG;YACxG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,WAAW,CAAC;YAChD,6CAA6C;YAC7C,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAC7C,CAAC;YACD,6EAA6E;YAC7E,4EAA4E;YAC5E,wEAAwE;YACxE,6EAA6E;YAC7E,sEAAsE;YACtE,+BAA+B;YAE/B,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChD,0BAA0B;gBAC1B,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE;oBACvC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAA;gBAEF,gEAAgE;gBAChE,OAAO,iBAAiB,CACtB,GAAG,EACH,KAAK,EACL,IAAI,CAAC,GAAG,CAAC,IAAI;gBACb,qEAAqE;gBACrE,yBAAyB;gBACzB,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,EAClD,eAAe,CAChB,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,+DAA+D;gBAC/D,gDAAgD;gBAChD,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;oBAClC,8DAA8D;oBAC9D,6BAA6B;oBAE7B,0DAA0D;oBAC1D,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE;wBACzC,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;wBACzB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,6DAA6D;oBAC7D,yBAAyB;oBAEzB,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,GAAG,EAAE,CAAC;wBACvD,6DAA6D;wBAE7D,gEAAgE;wBAChE,qBAAqB;wBACrB,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE;4BACvC,QAAQ,EAAE,KAAK;4BACf,QAAQ,EAAE,IAAI;yBACf,CAAC,CAAA;wBAEF,kEAAkE;wBAClE,gBAAgB;wBAChB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;wBAC1C,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;wBAClD,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;oBACvD,CAAC;yBAAM,CAAC;wBACN,gEAAgE;wBAChE,oCAAoC;wBAEpC,4DAA4D;wBAC5D,8DAA8D;wBAC9D,MAAM,OAAO,GAAG,yBAAyB,CAAA;wBAEzC,6DAA6D;wBAC7D,+DAA+D;wBAC/D,gDAAgD;wBAChD,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;4BAC3B,4CAA4C;4BAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE;gCACpD,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;6BAC/B,CAAC,CAAA;4BACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAC1C,UAAU,EACV,SAAS,EACT,KAAK,CAAC,SAAS,CAChB,CAAA;4BACD,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;4BAC9C,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBACxD,CAAC;6BAAM,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;4BAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CACjD,KAAK,CAAC,SAAS,CAChB,CAAA;4BACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;4BACxD,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBACnD,CAAC;6BAAM,CAAC;4BACN,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;wBAC9C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAEpD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,+BAA+B,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,gBAAgB,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACvC,6CAA6C;QAC7C,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAEjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE;YACrC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAA;QAEF,mDAAmD;QACnD,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;QAEhE,OAAO,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAA;IACvE,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,SAAS,gBAAgB,CACvB,OAAyD;QAEzD,OAAO,KAAK,WAAW,GAAG,EAAE,GAAG;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAA;gBAEvD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,OAAO,+BAA+B,CACpC,GAAG,EACH;4BACE,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,UAAU,EAAE,GAAG,CAAC,UAAU;4BAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;yBACvB,EACD,eAAe,CAChB,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;oBACrC,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;oBAC1B,GAAG,CAAC,GAAG,EAAE,CAAA;gBACX,CAAC;YACH,CAAC;QACH,CAAC,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAC1C,GAAQ;IAER,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,KAAK,EAAE;QACnE,IAAI,EAAE,CAAC,OAAO,CAAC;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,4BAA4B,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAA;QACxB,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport {\n  OAuthAuthorizationRequestQuery,\n  oauthAuthorizationRequestQuerySchema,\n} from '@atproto/oauth-types'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport {\n  Middleware,\n  Router,\n  RouterCtx,\n  getCookie,\n  setCookie,\n  validateFetchDest,\n  validateFetchMode,\n  validateFetchSite,\n  validateOrigin,\n  validateReferrer,\n} from '../lib/http/index.js'\nimport { SecurityHeadersOptions } from '../lib/http/security-headers.js'\nimport { formatError } from '../lib/util/error.js'\nimport type { Awaitable } from '../lib/util/type.js'\nimport { writeFormRedirect } from '../lib/write-form-redirect.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport { parseRequestUri, requestUriSchema } from '../request/request-uri.js'\nimport { sendAuthorizePageFactory } from './assets/send-authorization-page.js'\nimport { sendCookieErrorPageFactory } from './assets/send-cookie-error-page.js'\nimport { sendErrorPageFactory } from './assets/send-error-page.js'\nimport {\n  sendAuthorizationResultRedirect,\n  sendRedirect,\n} from './assets/send-redirect.js'\nimport { parseRedirectUrl } from './create-api-middleware.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\nexport function createAuthorizationPageMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const issuerUrl = new URL(server.issuer)\n  const issuerOrigin = issuerUrl.origin\n\n  const securityOptions: SecurityHeadersOptions = {\n    hsts: issuerUrl.protocol === 'http:' ? false : undefined,\n  }\n\n  const sendAuthorizePage = sendAuthorizePageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendErrorPage = sendErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendCookieErrorPage = sendCookieErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n\n  const router = new Router<Ctx, Req, Res>(issuerUrl)\n\n  router.get(\n    '/oauth/authorize',\n    withErrorHandler(async function (req, res) {\n      res.setHeader('Cache-Control', 'no-store')\n      res.setHeader('Pragma', 'no-cache')\n\n      // \"same-origin\" is required to support the redirect test logic below (as\n      // well as refreshing the authorization page).\n      // \"same-site\" supports hosting PDS and app on the same site but different\n      // origins (different subdomains).\n      validateFetchSite(req, ['same-origin', 'same-site', 'cross-site', 'none'])\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      // Do not perform any of the following logic if the request is invalid\n      const query = parseOAuthAuthorizationRequestQuery(this.url)\n\n      // @NOTE For some reason, even when loaded through a\n      // ASWebAuthenticationSession, iOS will sometimes fail to properly save\n      // cookies set during the rendering of the page. When this happens, the\n      // authorization page logic, which relies on cookies to maintain the session,\n      // will fail. To work around this, we perform an initial redirect to ourselves\n      // using a form GET submit, in an attempt to verify if the browser saves\n      // cookies on redirect or not. If it does, we proceed as normal. If it\n      // doesn't, we redirect the user back to the client with an error message.\n      if (\n        // Only for iOS users\n        req.headers['user-agent']?.includes('iPhone OS') &&\n        // Disabled if the user already passed the test, which means their browser preserves cookies on redirect\n        !(getCookie(req, 'cookie-test') === 'succeeded') &&\n        // Disabled if the user already has a session\n        !(await server.deviceManager.hasSession(req))\n      ) {\n        // @TODO Another possible solution would be to avoid relying on cookies if we\n        // detect that they are not being preserved. This would mean that preserving\n        // sessions (SSO) would not be possible for browsers that don't preserve\n        // cookies on redirect, but at least the authorization request could still be\n        // completed. This was not implemented yet due to the extra complexity\n        // involved in supporting this.\n\n        // 1) When the user first comes here, we will test if their browser\n        // preserves cookies by redirecting back to ourselves\n        if (!this.url.searchParams.has('redirect-test')) {\n          // 2) Set a testing cookie\n          setCookie(res, 'cookie-test', 'testing', {\n            sameSite: 'lax',\n            httpOnly: true,\n          })\n\n          // 3) And send an auto-submit form redirecting back to ourselves\n          return writeFormRedirect(\n            res,\n            'get',\n            this.url.href,\n            // 4) We add an extra query parameter to trigger the test logic after\n            // the redirect occurred.\n            [...this.url.searchParams, ['redirect-test', '1']],\n            securityOptions,\n          )\n        } else {\n          // 5) We just got redirected back to ourselves. Verify that the\n          // browser preserved cookies during the redirect\n          if (getCookie(req, 'cookie-test')) {\n            // 6) Success! The browser preserved cookies. Proceed with the\n            // normal authorization flow.\n\n            // 7) Set a long lasting cookie to skip the test next time\n            setCookie(res, 'cookie-test', 'succeeded', {\n              sameSite: 'lax',\n              maxAge: 31 * 24 * 60 * 60,\n              httpOnly: true,\n            })\n          } else {\n            // The browser did NOT preserve cookies. We have to abort the\n            // authorization request.\n\n            if (this.url.searchParams.get('redirect-test') === '1') {\n              // 8) Show an error page to the user explaining the situation\n\n              // Give the browser another chance to save cookies after the use\n              // pressed \"Continue\"\n              setCookie(res, 'cookie-test', 'testing', {\n                sameSite: 'lax',\n                httpOnly: true,\n              })\n\n              // Make sure next time we reach the other branch and redirect back\n              // to the client\n              const continueUrl = new URL(this.url.href)\n              continueUrl.searchParams.set('redirect-test', '2')\n              return sendCookieErrorPage(req, res, { continueUrl })\n            } else {\n              // 9) Once the use acknowledges the error, redirect them back to\n              // the client with an error message.\n\n              // Allow the client to understand what happened (the `error`\n              // response parameter value is constrained by the OAuth2 spec)\n              const message = 'ERR_COOKIES_UNSUPPORTED'\n\n              // @NOTE AuthorizationError thrown here will be caught by the\n              // error handler middleware defined below, and cause a redirect\n              // back to the client with the error parameters.\n              if ('request_uri' in query) {\n                // Load and delete the authorization request\n                const requestUri = parseRequestUri(query.request_uri, {\n                  path: ['query', 'request_uri'],\n                })\n                const data = await server.requestManager.get(\n                  requestUri,\n                  undefined,\n                  query.client_id,\n                )\n                await server.requestManager.delete(requestUri)\n                throw new AuthorizationError(data.parameters, message)\n              } else if ('request' in query) {\n                const client = await server.clientManager.getClient(\n                  query.client_id,\n                )\n                const parameters = await server.decodeJAR(client, query)\n                throw new AuthorizationError(parameters, message)\n              } else {\n                throw new AuthorizationError(query, message)\n              }\n            }\n          }\n        }\n      }\n\n      // Normal authorization flow\n      const device = await server.deviceManager.load(req, res)\n\n      const result = await server.authorize(query, device)\n\n      if ('redirect' in result) {\n        return sendAuthorizationResultRedirect(res, result, securityOptions)\n      } else {\n        return sendAuthorizePage(req, res, result)\n      }\n    }),\n  )\n\n  // This is a private endpoint that will be called by the user after the\n  // authorization request was either approved or denied. The logic performed\n  // here **could** be performed directly in the frontend. We decided to\n  // implement it here to avoid duplicating the logic.\n  router.get(\n    '/oauth/authorize/redirect',\n    withErrorHandler(async function (req, res) {\n      // Ensure we come from the authorization page\n      validateFetchSite(req, ['same-origin'])\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      const referrer = validateReferrer(req, {\n        origin: issuerOrigin,\n        pathname: '/oauth/authorize',\n      })\n\n      // Ensure we are coming from the authorization page\n      requestUriSchema.parse(referrer.searchParams.get('request_uri'))\n\n      return sendRedirect(res, parseRedirectUrl(this.url), securityOptions)\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  function withErrorHandler<T extends RouterCtx>(\n    handler: (this: T, req: Req, res: Res) => Awaitable<void>,\n  ): Middleware<T, Req, Res> {\n    return async function (req, res) {\n      try {\n        await handler.call(this, req, res)\n      } catch (err) {\n        onError?.(req, res, err, `Authorization Request Error`)\n\n        if (!res.headersSent) {\n          if (err instanceof AuthorizationError) {\n            return sendAuthorizationResultRedirect(\n              res,\n              {\n                issuer: server.issuer,\n                parameters: err.parameters,\n                redirect: err.toJSON(),\n              },\n              securityOptions,\n            )\n          } else {\n            return sendErrorPage(req, res, err)\n          }\n        } else if (!res.destroyed) {\n          res.end()\n        }\n      }\n    }\n  }\n}\n\nfunction parseOAuthAuthorizationRequestQuery(\n  url: URL,\n): OAuthAuthorizationRequestQuery {\n  const query = Object.fromEntries(url.searchParams)\n  const result = oauthAuthorizationRequestQuerySchema.safeParse(query, {\n    path: ['query'],\n  })\n\n  if (!result.success) {\n    const message = 'Invalid request parameters'\n    const err = result.error\n    throw new InvalidRequestError(formatError(err, message), err)\n  }\n\n  return result.data\n}\n"]}
+{"version":3,"file":"create-authorization-page-middleware.js","sourceRoot":"","sources":["../../src/router/create-authorization-page-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oCAAoC,GACrC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAEL,MAAM,EAEN,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAA;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EACL,+BAA+B,EAC/B,YAAY,GACb,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAG7D,MAAM,UAAU,iCAAiC,CAK/C,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAA;IAErC,MAAM,eAAe,GAA2B;QAC9C,IAAI,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACzD,CAAA;IAED,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,aAAa,GAAG,oBAAoB,CACxC,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,mBAAmB,GAAG,0BAA0B,CACpD,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,SAAS,CAAC,CAAA;IAEnD,MAAM,CAAC,GAAG,CACR,kBAAkB,EAClB,gBAAgB,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACvC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;QAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAEnC,yEAAyE;QACzE,8CAA8C;QAC9C,0EAA0E;QAC1E,kCAAkC;QAClC,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;QAC1E,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAEjC,sEAAsE;QACtE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE3D,oDAAoD;QACpD,uEAAuE;QACvE,uEAAuE;QACvE,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E;QACE,qBAAqB;QACrB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC;YAChD,wGAAwG;YACxG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,WAAW,CAAC;YAChD,6CAA6C;YAC7C,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAC7C,CAAC;YACD,6EAA6E;YAC7E,4EAA4E;YAC5E,wEAAwE;YACxE,6EAA6E;YAC7E,sEAAsE;YACtE,+BAA+B;YAE/B,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChD,0BAA0B;gBAC1B,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE;oBACvC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAA;gBAEF,gEAAgE;gBAChE,OAAO,iBAAiB,CACtB,GAAG,EACH,KAAK,EACL,IAAI,CAAC,GAAG,CAAC,IAAI;gBACb,qEAAqE;gBACrE,yBAAyB;gBACzB,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,EAClD,eAAe,CAChB,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,+DAA+D;gBAC/D,gDAAgD;gBAChD,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;oBAClC,8DAA8D;oBAC9D,6BAA6B;oBAE7B,0DAA0D;oBAC1D,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE;wBACzC,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;wBACzB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,6DAA6D;oBAC7D,yBAAyB;oBAEzB,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,GAAG,EAAE,CAAC;wBACvD,6DAA6D;wBAE7D,gEAAgE;wBAChE,qBAAqB;wBACrB,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE;4BACvC,QAAQ,EAAE,KAAK;4BACf,QAAQ,EAAE,IAAI;yBACf,CAAC,CAAA;wBAEF,kEAAkE;wBAClE,gBAAgB;wBAChB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;wBAC1C,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;wBAClD,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;oBACvD,CAAC;yBAAM,CAAC;wBACN,gEAAgE;wBAChE,oCAAoC;wBAEpC,4DAA4D;wBAC5D,8DAA8D;wBAC9D,MAAM,OAAO,GAAG,yBAAyB,CAAA;wBAEzC,6DAA6D;wBAC7D,+DAA+D;wBAC/D,gDAAgD;wBAChD,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;4BAC3B,4CAA4C;4BAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE;gCACpD,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;6BAC/B,CAAC,CAAA;4BACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAC1C,UAAU,EACV,SAAS,EACT,KAAK,CAAC,SAAS,CAChB,CAAA;4BACD,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;4BAC9C,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBACxD,CAAC;6BAAM,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;4BAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CACjD,KAAK,CAAC,SAAS,CAChB,CAAA;4BACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;4BACxD,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBACnD,CAAC;6BAAM,CAAC;4BACN,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;wBAC9C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAEpD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,+BAA+B,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,gBAAgB,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACvC,6CAA6C;QAC7C,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAEjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE;YACrC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAA;QAEF,mDAAmD;QACnD,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;QAEhE,OAAO,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAA;IACvE,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,SAAS,gBAAgB,CACvB,OAAyD;QAEzD,OAAO,KAAK,WAAW,GAAG,EAAE,GAAG;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAA;gBAEvD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,OAAO,+BAA+B,CACpC,GAAG,EACH;4BACE,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,UAAU,EAAE,GAAG,CAAC,UAAU;4BAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;yBACvB,EACD,eAAe,CAChB,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;oBACrC,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;oBAC1B,GAAG,CAAC,GAAG,EAAE,CAAA;gBACX,CAAC;YACH,CAAC;QACH,CAAC,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAC1C,GAAQ;IAER,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,KAAK,EAAE;QACnE,IAAI,EAAE,CAAC,OAAO,CAAC;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,4BAA4B,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAA;QACxB,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport {\n  type OAuthAuthorizationRequestQuery,\n  oauthAuthorizationRequestQuerySchema,\n} from '@atproto/oauth-types'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport {\n  type Middleware,\n  Router,\n  type RouterCtx,\n  getCookie,\n  setCookie,\n  validateFetchDest,\n  validateFetchMode,\n  validateFetchSite,\n  validateOrigin,\n  validateReferrer,\n} from '../lib/http/index.js'\nimport type { SecurityHeadersOptions } from '../lib/http/security-headers.js'\nimport { formatError } from '../lib/util/error.js'\nimport type { Awaitable } from '../lib/util/type.js'\nimport { writeFormRedirect } from '../lib/write-form-redirect.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport { parseRequestUri, requestUriSchema } from '../request/request-uri.js'\nimport { sendAuthorizePageFactory } from './assets/send-authorization-page.js'\nimport { sendCookieErrorPageFactory } from './assets/send-cookie-error-page.js'\nimport { sendErrorPageFactory } from './assets/send-error-page.js'\nimport {\n  sendAuthorizationResultRedirect,\n  sendRedirect,\n} from './assets/send-redirect.js'\nimport { parseRedirectUrl } from './create-api-middleware.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\nexport function createAuthorizationPageMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const issuerUrl = new URL(server.issuer)\n  const issuerOrigin = issuerUrl.origin\n\n  const securityOptions: SecurityHeadersOptions = {\n    hsts: issuerUrl.protocol === 'http:' ? false : undefined,\n  }\n\n  const sendAuthorizePage = sendAuthorizePageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendErrorPage = sendErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendCookieErrorPage = sendCookieErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n\n  const router = new Router<Ctx, Req, Res>(issuerUrl)\n\n  router.get(\n    '/oauth/authorize',\n    withErrorHandler(async function (req, res) {\n      res.setHeader('Cache-Control', 'no-store')\n      res.setHeader('Pragma', 'no-cache')\n\n      // \"same-origin\" is required to support the redirect test logic below (as\n      // well as refreshing the authorization page).\n      // \"same-site\" supports hosting PDS and app on the same site but different\n      // origins (different subdomains).\n      validateFetchSite(req, ['same-origin', 'same-site', 'cross-site', 'none'])\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      // Do not perform any of the following logic if the request is invalid\n      const query = parseOAuthAuthorizationRequestQuery(this.url)\n\n      // @NOTE For some reason, even when loaded through a\n      // ASWebAuthenticationSession, iOS will sometimes fail to properly save\n      // cookies set during the rendering of the page. When this happens, the\n      // authorization page logic, which relies on cookies to maintain the session,\n      // will fail. To work around this, we perform an initial redirect to ourselves\n      // using a form GET submit, in an attempt to verify if the browser saves\n      // cookies on redirect or not. If it does, we proceed as normal. If it\n      // doesn't, we redirect the user back to the client with an error message.\n      if (\n        // Only for iOS users\n        req.headers['user-agent']?.includes('iPhone OS') &&\n        // Disabled if the user already passed the test, which means their browser preserves cookies on redirect\n        !(getCookie(req, 'cookie-test') === 'succeeded') &&\n        // Disabled if the user already has a session\n        !(await server.deviceManager.hasSession(req))\n      ) {\n        // @TODO Another possible solution would be to avoid relying on cookies if we\n        // detect that they are not being preserved. This would mean that preserving\n        // sessions (SSO) would not be possible for browsers that don't preserve\n        // cookies on redirect, but at least the authorization request could still be\n        // completed. This was not implemented yet due to the extra complexity\n        // involved in supporting this.\n\n        // 1) When the user first comes here, we will test if their browser\n        // preserves cookies by redirecting back to ourselves\n        if (!this.url.searchParams.has('redirect-test')) {\n          // 2) Set a testing cookie\n          setCookie(res, 'cookie-test', 'testing', {\n            sameSite: 'lax',\n            httpOnly: true,\n          })\n\n          // 3) And send an auto-submit form redirecting back to ourselves\n          return writeFormRedirect(\n            res,\n            'get',\n            this.url.href,\n            // 4) We add an extra query parameter to trigger the test logic after\n            // the redirect occurred.\n            [...this.url.searchParams, ['redirect-test', '1']],\n            securityOptions,\n          )\n        } else {\n          // 5) We just got redirected back to ourselves. Verify that the\n          // browser preserved cookies during the redirect\n          if (getCookie(req, 'cookie-test')) {\n            // 6) Success! The browser preserved cookies. Proceed with the\n            // normal authorization flow.\n\n            // 7) Set a long lasting cookie to skip the test next time\n            setCookie(res, 'cookie-test', 'succeeded', {\n              sameSite: 'lax',\n              maxAge: 31 * 24 * 60 * 60,\n              httpOnly: true,\n            })\n          } else {\n            // The browser did NOT preserve cookies. We have to abort the\n            // authorization request.\n\n            if (this.url.searchParams.get('redirect-test') === '1') {\n              // 8) Show an error page to the user explaining the situation\n\n              // Give the browser another chance to save cookies after the use\n              // pressed \"Continue\"\n              setCookie(res, 'cookie-test', 'testing', {\n                sameSite: 'lax',\n                httpOnly: true,\n              })\n\n              // Make sure next time we reach the other branch and redirect back\n              // to the client\n              const continueUrl = new URL(this.url.href)\n              continueUrl.searchParams.set('redirect-test', '2')\n              return sendCookieErrorPage(req, res, { continueUrl })\n            } else {\n              // 9) Once the use acknowledges the error, redirect them back to\n              // the client with an error message.\n\n              // Allow the client to understand what happened (the `error`\n              // response parameter value is constrained by the OAuth2 spec)\n              const message = 'ERR_COOKIES_UNSUPPORTED'\n\n              // @NOTE AuthorizationError thrown here will be caught by the\n              // error handler middleware defined below, and cause a redirect\n              // back to the client with the error parameters.\n              if ('request_uri' in query) {\n                // Load and delete the authorization request\n                const requestUri = parseRequestUri(query.request_uri, {\n                  path: ['query', 'request_uri'],\n                })\n                const data = await server.requestManager.get(\n                  requestUri,\n                  undefined,\n                  query.client_id,\n                )\n                await server.requestManager.delete(requestUri)\n                throw new AuthorizationError(data.parameters, message)\n              } else if ('request' in query) {\n                const client = await server.clientManager.getClient(\n                  query.client_id,\n                )\n                const parameters = await server.decodeJAR(client, query)\n                throw new AuthorizationError(parameters, message)\n              } else {\n                throw new AuthorizationError(query, message)\n              }\n            }\n          }\n        }\n      }\n\n      // Normal authorization flow\n      const device = await server.deviceManager.load(req, res)\n\n      const result = await server.authorize(query, device)\n\n      if ('redirect' in result) {\n        return sendAuthorizationResultRedirect(res, result, securityOptions)\n      } else {\n        return sendAuthorizePage(req, res, result)\n      }\n    }),\n  )\n\n  // This is a private endpoint that will be called by the user after the\n  // authorization request was either approved or denied. The logic performed\n  // here **could** be performed directly in the frontend. We decided to\n  // implement it here to avoid duplicating the logic.\n  router.get(\n    '/oauth/authorize/redirect',\n    withErrorHandler(async function (req, res) {\n      // Ensure we come from the authorization page\n      validateFetchSite(req, ['same-origin'])\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      const referrer = validateReferrer(req, {\n        origin: issuerOrigin,\n        pathname: '/oauth/authorize',\n      })\n\n      // Ensure we are coming from the authorization page\n      requestUriSchema.parse(referrer.searchParams.get('request_uri'))\n\n      return sendRedirect(res, parseRedirectUrl(this.url), securityOptions)\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  function withErrorHandler<T extends RouterCtx>(\n    handler: (this: T, req: Req, res: Res) => Awaitable<void>,\n  ): Middleware<T, Req, Res> {\n    return async function (req, res) {\n      try {\n        await handler.call(this, req, res)\n      } catch (err) {\n        onError?.(req, res, err, `Authorization Request Error`)\n\n        if (!res.headersSent) {\n          if (err instanceof AuthorizationError) {\n            return sendAuthorizationResultRedirect(\n              res,\n              {\n                issuer: server.issuer,\n                parameters: err.parameters,\n                redirect: err.toJSON(),\n              },\n              securityOptions,\n            )\n          } else {\n            return sendErrorPage(req, res, err)\n          }\n        } else if (!res.destroyed) {\n          res.end()\n        }\n      }\n    }\n  }\n}\n\nfunction parseOAuthAuthorizationRequestQuery(\n  url: URL,\n): OAuthAuthorizationRequestQuery {\n  const query = Object.fromEntries(url.searchParams)\n  const result = oauthAuthorizationRequestQuerySchema.safeParse(query, {\n    path: ['query'],\n  })\n\n  if (!result.success) {\n    const message = 'Invalid request parameters'\n    const err = result.error\n    throw new InvalidRequestError(formatError(err, message), err)\n  }\n\n  return result.data\n}\n"]}

package/dist/router/create-oauth-middleware.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { Middleware } from '../lib/http/index.js';
+import { type Middleware } from '../lib/http/index.js';
 import type { OAuthProvider } from '../oauth-provider.js';
 import type { MiddlewareOptions } from './middleware-options.js';
 export declare function createOAuthMiddleware<Ctx extends object | void = void, Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse>(server: OAuthProvider, { onError }: MiddlewareOptions<Req, Res>): Middleware<Ctx, Req, Res>;

package/dist/router/create-oauth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-oauth-middleware.d.ts","sourceRoot":"","sources":["../../src/router/create-oauth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAYhE,OAAO,EACL,UAAU,EAOX,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAqChE,wBAAgB,qBAAqB,CACnC,GAAG,SAAS,MAAM,GAAG,IAAI,GAAG,IAAI,EAChC,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,OAAO,EAAE,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,GACvC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAgL3B"}
+{"version":3,"file":"create-oauth-middleware.d.ts","sourceRoot":"","sources":["../../src/router/create-oauth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAahE,OAAO,EACL,KAAK,UAAU,EAOhB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAqChE,wBAAgB,qBAAqB,CACnC,GAAG,SAAS,MAAM,GAAG,IAAI,GAAG,IAAI,EAChC,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,OAAO,EAAE,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,GACvC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAgL3B"}

package/dist/router/create-oauth-middleware.js

@@ -3,10 +3,10 @@ import { buildErrorPayload, buildErrorStatus } from '../errors/error-parser.js';
 import { InvalidClientError } from '../errors/invalid-client-error.js';
 import { InvalidGrantError } from '../errors/invalid-grant-error.js';
 import { InvalidRequestError } from '../errors/invalid-request-error.js';
+import { OAuthError } from '../errors/oauth-error.js';
 import { WWWAuthenticateError } from '../errors/www-authenticate-error.js';
 import { Router, cacheControlMiddleware, combineMiddlewares, jsonHandler, parseHttpRequest, staticJsonMiddleware, } from '../lib/http/index.js';
 import { formatError } from '../lib/util/error.js';
-import { OAuthError } from '../oauth-errors.js';
 // CORS preflight
 const corsHeaders = function (req, res, next) {
     res.setHeader('Access-Control-Max-Age', '86400'); // 1 day

package/dist/router/create-oauth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-oauth-middleware.js","sourceRoot":"","sources":["../../src/router/create-oauth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EAClC,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAEL,MAAM,EACN,sBAAsB,EACtB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAI/C,iBAAiB;AACjB,MAAM,WAAW,GAAe,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;IACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA,CAAC,QAAQ;IAEzD,wFAAwF;IACxF,EAAE;IACF,mEAAmE;IACnE,+DAA+D;IAC/D,4DAA4D;IAC5D,kEAAkE;IAClE,WAAW;IACX,EAAE;IACF,4DAA4D;IAC5D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;IAEjD,yFAAyF;IACzF,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,eAAe;IACf,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;IAElD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,mBAAmB,CAAC,CAAA;IAElE,IAAI,EAAE,CAAA;AACR,CAAC,CAAA;AAED,MAAM,aAAa,GAAe,kBAAkB,CAAC;IACnD,WAAW;IACX,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACX,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,qBAAqB,CAKnC,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAEhE,0BAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,yCAAyC,EAAE,aAAa,CAAC,CAAA;IACxE,MAAM,CAAC,GAAG,CACR,yCAAyC,EACzC,WAAW,EACX,sBAAsB,CAAC,GAAG,CAAC,EAC3B,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CACtC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAC5C,MAAM,CAAC,GAAG,CACR,aAAa,EACb,WAAW,EACX,sBAAsB,CAAC,GAAG,CAAC,EAC3B,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAClC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IAC3C,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,oEAAoE;QACpE,0DAA0D;QAE1D,MAAM,WAAW,GAAG,MAAM,4BAA4B;aACnD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAExE,MAAM,oBAAoB,GAAG,MAAM,kCAAkC;aAClE,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,mBAAmB,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAC1D,CAAA;QAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,OAAO,MAAM,CAAC,0BAA0B,CACtC,WAAW,EACX,oBAAoB,EACpB,SAAS,CACV,CAAA;IACH,CAAC,EAAE,GAAG,CAAC,CACR,CAAA;IACD,4DAA4D;IAC5D,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IAC7C,MAAM,CAAC,IAAI,CACT,cAAc,EACd,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAEzE,MAAM,iBAAiB,GAAG,MAAM,4BAA4B;aACzD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAEvE,MAAM,YAAY,GAAG,MAAM,uBAAuB;aAC/C,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;QAEpE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,OAAO,MAAM,CAAC,KAAK,CACjB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,SAAS,CACV,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;IAC9C,MAAM,CAAC,IAAI,CACT,eAAe,EACf,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,MAAM,WAAW,GAAG,MAAM,4BAA4B;aACnD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAEzE,MAAM,mBAAmB,GAAG,MAAM,8BAA8B;aAC7D,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;QAEtE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,gCAAgC;YAChC,EAAE;YACF,4DAA4D;YAE5D,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAA;QACpD,CAAC;QAED,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,SAAS,YAAY,CACnB,kBAA4D,EAC5D,MAAe;QAEf,OAAO,WAAW,CAAc,KAAK,WAAW,GAAG,EAAE,GAAG;YACtD,IAAI,CAAC;gBACH,0DAA0D;gBAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;gBAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;gBAEnC,4DAA4D;gBAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAA;gBACxC,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,GAAG,YAAY,CAAA;oBACzB,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;oBAC9B,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CACP,GAAG,EACH,GAAG,EACH,GAAG,EACH,GAAG,YAAY,UAAU;oBACvB,CAAC,CAAC,UAAU,GAAG,CAAC,KAAK,SAAS;oBAC9B,CAAC,CAAC,kBAAkB,CACvB,CAAA;gBAED,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;oBAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAA;oBAC/B,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC9C,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;gBACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;gBAEnC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY,EAAE,MAAc;IACrD,MAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,MAAc;IACtD,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,MAAc;IACvD,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC9D,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport {\n  oauthAuthorizationRequestParSchema,\n  oauthClientCredentialsSchema,\n  oauthTokenIdentificationSchema,\n  oauthTokenRequestSchema,\n} from '@atproto/oauth-types'\nimport { buildErrorPayload, buildErrorStatus } from '../errors/error-parser.js'\nimport { InvalidClientError } from '../errors/invalid-client-error.js'\nimport { InvalidGrantError } from '../errors/invalid-grant-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { WWWAuthenticateError } from '../errors/www-authenticate-error.js'\nimport {\n  Middleware,\n  Router,\n  cacheControlMiddleware,\n  combineMiddlewares,\n  jsonHandler,\n  parseHttpRequest,\n  staticJsonMiddleware,\n} from '../lib/http/index.js'\nimport { formatError } from '../lib/util/error.js'\nimport { OAuthError } from '../oauth-errors.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\n// CORS preflight\nconst corsHeaders: Middleware = function (req, res, next) {\n  res.setHeader('Access-Control-Max-Age', '86400') // 1 day\n\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin\n  //\n  // > For requests without credentials, the literal value \"*\" can be\n  // > specified as a wildcard; the value tells browsers to allow\n  // > requesting code from any origin to access the resource.\n  // > Attempting to use the wildcard with credentials results in an\n  // > error.\n  //\n  // A \"*\" is safer to use than reflecting the request origin.\n  res.setHeader('Access-Control-Allow-Origin', '*')\n\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods\n  // > The value \"*\" only counts as a special wildcard value for\n  // > requests without credentials (requests without HTTP cookies or\n  // > HTTP authentication information). In requests with credentials,\n  // > it is treated as the literal method name \"*\" without special\n  // > semantics.\n  res.setHeader('Access-Control-Allow-Methods', '*')\n\n  res.setHeader('Access-Control-Allow-Headers', 'Content-Type,DPoP')\n\n  next()\n}\n\nconst corsPreflight: Middleware = combineMiddlewares([\n  corsHeaders,\n  (req, res) => {\n    res.writeHead(200).end()\n  },\n])\n\nexport function createOAuthMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const router = new Router<Ctx, Req, Res>(new URL(server.issuer))\n\n  //- Public OAuth endpoints\n\n  router.options('/.well-known/oauth-authorization-server', corsPreflight)\n  router.get(\n    '/.well-known/oauth-authorization-server',\n    corsHeaders,\n    cacheControlMiddleware(300),\n    staticJsonMiddleware(server.metadata),\n  )\n\n  router.options('/oauth/jwks', corsPreflight)\n  router.get(\n    '/oauth/jwks',\n    corsHeaders,\n    cacheControlMiddleware(300),\n    staticJsonMiddleware(server.jwks),\n  )\n\n  router.options('/oauth/par', corsPreflight)\n  router.post(\n    '/oauth/par',\n    corsHeaders,\n    oauthHandler(async function (req) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      // https://datatracker.ietf.org/doc/html/rfc9126#name-error-response\n      // https://datatracker.ietf.org/doc/html/rfc6749#autoid-56\n\n      const credentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidClient(err, 'Client credentials missing'))\n\n      const authorizationRequest = await oauthAuthorizationRequestParSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) =>\n          throwInvalidRequest(err, 'Invalid authorization request'),\n        )\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      return server.pushedAuthorizationRequest(\n        credentials,\n        authorizationRequest,\n        dpopProof,\n      )\n    }, 201),\n  )\n  // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3\n  // > If the request did not use the POST method, the authorization server\n  // > responds with an HTTP 405 (Method Not Allowed) status code.\n  router.all('/oauth/par', (req, res) => {\n    res.writeHead(405).end()\n  })\n\n  router.options('/oauth/token', corsPreflight)\n  router.post(\n    '/oauth/token',\n    corsHeaders,\n    oauthHandler(async function (req) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      const clientMetadata = await server.deviceManager.getRequestMetadata(req)\n\n      const clientCredentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidGrant(err, 'Client credentials missing'))\n\n      const tokenRequest = await oauthTokenRequestSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidGrant(err, 'Invalid request payload'))\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      return server.token(\n        clientCredentials,\n        clientMetadata,\n        tokenRequest,\n        dpopProof,\n      )\n    }),\n  )\n\n  router.options('/oauth/revoke', corsPreflight)\n  router.post(\n    '/oauth/revoke',\n    corsHeaders,\n    oauthHandler(async function (req, res) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      const credentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidRequest(err, 'Client credentials missing'))\n\n      const tokenIdentification = await oauthTokenIdentificationSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidRequest(err, 'Invalid request payload'))\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      try {\n        await server.revoke(credentials, tokenIdentification, dpopProof)\n      } catch (err) {\n        // > Note: invalid tokens do not cause an error response since the\n        // > client cannot handle such an error in a reasonable way.  Moreover,\n        // > the purpose of the revocation request, invalidating the particular\n        // > token, is already achieved.\n        //\n        // https://datatracker.ietf.org/doc/html/rfc7009#section-2.2\n\n        onError?.(req, res, err, 'Failed to revoke token')\n      }\n\n      return {}\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  function oauthHandler<T>(\n    buildOAuthResponse: (this: T, req: Req, res: Res) => unknown,\n    status?: number,\n  ): Middleware<T, Req, Res> {\n    return jsonHandler<T, Req, Res>(async function (req, res) {\n      try {\n        // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1\n        res.setHeader('Cache-Control', 'no-store')\n        res.setHeader('Pragma', 'no-cache')\n\n        // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n        const dpopNonce = server.nextDpopNonce()\n        if (dpopNonce) {\n          const name = 'DPoP-Nonce'\n          res.setHeader(name, dpopNonce)\n          res.appendHeader('Access-Control-Expose-Headers', name)\n        }\n\n        const json = await buildOAuthResponse.call(this, req, res)\n        return { json, status }\n      } catch (err) {\n        onError?.(\n          req,\n          res,\n          err,\n          err instanceof OAuthError\n            ? `OAuth \"${err.error}\" error`\n            : 'Unexpected error',\n        )\n\n        if (!res.headersSent && err instanceof WWWAuthenticateError) {\n          const name = 'WWW-Authenticate'\n          res.setHeader(name, err.wwwAuthenticateHeader)\n          res.appendHeader('Access-Control-Expose-Headers', name)\n        }\n\n        const status = buildErrorStatus(err)\n        const json = buildErrorPayload(err)\n\n        return { json, status }\n      }\n    })\n  }\n}\n\nfunction throwInvalidGrant(err: unknown, prefix: string): never {\n  throw new InvalidGrantError(formatError(err, prefix), err)\n}\n\nfunction throwInvalidClient(err: unknown, prefix: string): never {\n  throw new InvalidClientError(formatError(err, prefix), err)\n}\n\nfunction throwInvalidRequest(err: unknown, prefix: string): never {\n  throw new InvalidRequestError(formatError(err, prefix), err)\n}\n"]}
+{"version":3,"file":"create-oauth-middleware.js","sourceRoot":"","sources":["../../src/router/create-oauth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EAClC,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAEL,MAAM,EACN,sBAAsB,EACtB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAIlD,iBAAiB;AACjB,MAAM,WAAW,GAAe,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;IACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA,CAAC,QAAQ;IAEzD,wFAAwF;IACxF,EAAE;IACF,mEAAmE;IACnE,+DAA+D;IAC/D,4DAA4D;IAC5D,kEAAkE;IAClE,WAAW;IACX,EAAE;IACF,4DAA4D;IAC5D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;IAEjD,yFAAyF;IACzF,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,eAAe;IACf,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;IAElD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,mBAAmB,CAAC,CAAA;IAElE,IAAI,EAAE,CAAA;AACR,CAAC,CAAA;AAED,MAAM,aAAa,GAAe,kBAAkB,CAAC;IACnD,WAAW;IACX,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACX,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,qBAAqB,CAKnC,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAEhE,0BAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,yCAAyC,EAAE,aAAa,CAAC,CAAA;IACxE,MAAM,CAAC,GAAG,CACR,yCAAyC,EACzC,WAAW,EACX,sBAAsB,CAAC,GAAG,CAAC,EAC3B,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CACtC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAC5C,MAAM,CAAC,GAAG,CACR,aAAa,EACb,WAAW,EACX,sBAAsB,CAAC,GAAG,CAAC,EAC3B,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAClC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IAC3C,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,oEAAoE;QACpE,0DAA0D;QAE1D,MAAM,WAAW,GAAG,MAAM,4BAA4B;aACnD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAExE,MAAM,oBAAoB,GAAG,MAAM,kCAAkC;aAClE,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,mBAAmB,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAC1D,CAAA;QAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,OAAO,MAAM,CAAC,0BAA0B,CACtC,WAAW,EACX,oBAAoB,EACpB,SAAS,CACV,CAAA;IACH,CAAC,EAAE,GAAG,CAAC,CACR,CAAA;IACD,4DAA4D;IAC5D,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IAC7C,MAAM,CAAC,IAAI,CACT,cAAc,EACd,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAEzE,MAAM,iBAAiB,GAAG,MAAM,4BAA4B;aACzD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAEvE,MAAM,YAAY,GAAG,MAAM,uBAAuB;aAC/C,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;QAEpE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,OAAO,MAAM,CAAC,KAAK,CACjB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,SAAS,CACV,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;IAC9C,MAAM,CAAC,IAAI,CACT,eAAe,EACf,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,MAAM,WAAW,GAAG,MAAM,4BAA4B;aACnD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAEzE,MAAM,mBAAmB,GAAG,MAAM,8BAA8B;aAC7D,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;QAEtE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,gCAAgC;YAChC,EAAE;YACF,4DAA4D;YAE5D,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAA;QACpD,CAAC;QAED,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,SAAS,YAAY,CACnB,kBAA4D,EAC5D,MAAe;QAEf,OAAO,WAAW,CAAc,KAAK,WAAW,GAAG,EAAE,GAAG;YACtD,IAAI,CAAC;gBACH,0DAA0D;gBAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;gBAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;gBAEnC,4DAA4D;gBAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAA;gBACxC,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,GAAG,YAAY,CAAA;oBACzB,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;oBAC9B,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CACP,GAAG,EACH,GAAG,EACH,GAAG,EACH,GAAG,YAAY,UAAU;oBACvB,CAAC,CAAC,UAAU,GAAG,CAAC,KAAK,SAAS;oBAC9B,CAAC,CAAC,kBAAkB,CACvB,CAAA;gBAED,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;oBAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAA;oBAC/B,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC9C,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;gBACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;gBAEnC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY,EAAE,MAAc;IACrD,MAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,MAAc;IACtD,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,MAAc;IACvD,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC9D,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport {\n  oauthAuthorizationRequestParSchema,\n  oauthClientCredentialsSchema,\n  oauthTokenIdentificationSchema,\n  oauthTokenRequestSchema,\n} from '@atproto/oauth-types'\nimport { buildErrorPayload, buildErrorStatus } from '../errors/error-parser.js'\nimport { InvalidClientError } from '../errors/invalid-client-error.js'\nimport { InvalidGrantError } from '../errors/invalid-grant-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { OAuthError } from '../errors/oauth-error.js'\nimport { WWWAuthenticateError } from '../errors/www-authenticate-error.js'\nimport {\n  type Middleware,\n  Router,\n  cacheControlMiddleware,\n  combineMiddlewares,\n  jsonHandler,\n  parseHttpRequest,\n  staticJsonMiddleware,\n} from '../lib/http/index.js'\nimport { formatError } from '../lib/util/error.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\n// CORS preflight\nconst corsHeaders: Middleware = function (req, res, next) {\n  res.setHeader('Access-Control-Max-Age', '86400') // 1 day\n\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin\n  //\n  // > For requests without credentials, the literal value \"*\" can be\n  // > specified as a wildcard; the value tells browsers to allow\n  // > requesting code from any origin to access the resource.\n  // > Attempting to use the wildcard with credentials results in an\n  // > error.\n  //\n  // A \"*\" is safer to use than reflecting the request origin.\n  res.setHeader('Access-Control-Allow-Origin', '*')\n\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods\n  // > The value \"*\" only counts as a special wildcard value for\n  // > requests without credentials (requests without HTTP cookies or\n  // > HTTP authentication information). In requests with credentials,\n  // > it is treated as the literal method name \"*\" without special\n  // > semantics.\n  res.setHeader('Access-Control-Allow-Methods', '*')\n\n  res.setHeader('Access-Control-Allow-Headers', 'Content-Type,DPoP')\n\n  next()\n}\n\nconst corsPreflight: Middleware = combineMiddlewares([\n  corsHeaders,\n  (req, res) => {\n    res.writeHead(200).end()\n  },\n])\n\nexport function createOAuthMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const router = new Router<Ctx, Req, Res>(new URL(server.issuer))\n\n  //- Public OAuth endpoints\n\n  router.options('/.well-known/oauth-authorization-server', corsPreflight)\n  router.get(\n    '/.well-known/oauth-authorization-server',\n    corsHeaders,\n    cacheControlMiddleware(300),\n    staticJsonMiddleware(server.metadata),\n  )\n\n  router.options('/oauth/jwks', corsPreflight)\n  router.get(\n    '/oauth/jwks',\n    corsHeaders,\n    cacheControlMiddleware(300),\n    staticJsonMiddleware(server.jwks),\n  )\n\n  router.options('/oauth/par', corsPreflight)\n  router.post(\n    '/oauth/par',\n    corsHeaders,\n    oauthHandler(async function (req) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      // https://datatracker.ietf.org/doc/html/rfc9126#name-error-response\n      // https://datatracker.ietf.org/doc/html/rfc6749#autoid-56\n\n      const credentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidClient(err, 'Client credentials missing'))\n\n      const authorizationRequest = await oauthAuthorizationRequestParSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) =>\n          throwInvalidRequest(err, 'Invalid authorization request'),\n        )\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      return server.pushedAuthorizationRequest(\n        credentials,\n        authorizationRequest,\n        dpopProof,\n      )\n    }, 201),\n  )\n  // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3\n  // > If the request did not use the POST method, the authorization server\n  // > responds with an HTTP 405 (Method Not Allowed) status code.\n  router.all('/oauth/par', (req, res) => {\n    res.writeHead(405).end()\n  })\n\n  router.options('/oauth/token', corsPreflight)\n  router.post(\n    '/oauth/token',\n    corsHeaders,\n    oauthHandler(async function (req) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      const clientMetadata = await server.deviceManager.getRequestMetadata(req)\n\n      const clientCredentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidGrant(err, 'Client credentials missing'))\n\n      const tokenRequest = await oauthTokenRequestSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidGrant(err, 'Invalid request payload'))\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      return server.token(\n        clientCredentials,\n        clientMetadata,\n        tokenRequest,\n        dpopProof,\n      )\n    }),\n  )\n\n  router.options('/oauth/revoke', corsPreflight)\n  router.post(\n    '/oauth/revoke',\n    corsHeaders,\n    oauthHandler(async function (req, res) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      const credentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidRequest(err, 'Client credentials missing'))\n\n      const tokenIdentification = await oauthTokenIdentificationSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidRequest(err, 'Invalid request payload'))\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      try {\n        await server.revoke(credentials, tokenIdentification, dpopProof)\n      } catch (err) {\n        // > Note: invalid tokens do not cause an error response since the\n        // > client cannot handle such an error in a reasonable way.  Moreover,\n        // > the purpose of the revocation request, invalidating the particular\n        // > token, is already achieved.\n        //\n        // https://datatracker.ietf.org/doc/html/rfc7009#section-2.2\n\n        onError?.(req, res, err, 'Failed to revoke token')\n      }\n\n      return {}\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  function oauthHandler<T>(\n    buildOAuthResponse: (this: T, req: Req, res: Res) => unknown,\n    status?: number,\n  ): Middleware<T, Req, Res> {\n    return jsonHandler<T, Req, Res>(async function (req, res) {\n      try {\n        // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1\n        res.setHeader('Cache-Control', 'no-store')\n        res.setHeader('Pragma', 'no-cache')\n\n        // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n        const dpopNonce = server.nextDpopNonce()\n        if (dpopNonce) {\n          const name = 'DPoP-Nonce'\n          res.setHeader(name, dpopNonce)\n          res.appendHeader('Access-Control-Expose-Headers', name)\n        }\n\n        const json = await buildOAuthResponse.call(this, req, res)\n        return { json, status }\n      } catch (err) {\n        onError?.(\n          req,\n          res,\n          err,\n          err instanceof OAuthError\n            ? `OAuth \"${err.error}\" error`\n            : 'Unexpected error',\n        )\n\n        if (!res.headersSent && err instanceof WWWAuthenticateError) {\n          const name = 'WWW-Authenticate'\n          res.setHeader(name, err.wwwAuthenticateHeader)\n          res.appendHeader('Access-Control-Expose-Headers', name)\n        }\n\n        const status = buildErrorStatus(err)\n        const json = buildErrorPayload(err)\n\n        return { json, status }\n      }\n    })\n  }\n}\n\nfunction throwInvalidGrant(err: unknown, prefix: string): never {\n  throw new InvalidGrantError(formatError(err, prefix), err)\n}\n\nfunction throwInvalidClient(err: unknown, prefix: string): never {\n  throw new InvalidClientError(formatError(err, prefix), err)\n}\n\nfunction throwInvalidRequest(err: unknown, prefix: string): never {\n  throw new InvalidRequestError(formatError(err, prefix), err)\n}\n"]}

package/dist/signer/api-token-payload.d.ts

@@ -1,4 +1,4 @@
-import { z } from 'zod';
+import type { z } from 'zod';
 export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape<{
     iss: z.ZodOptional<z.ZodString>;
     aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "atleastone">]>>;

package/dist/signer/api-token-payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-payload.d.ts","sourceRoot":"","sources":["../../src/signer/api-token-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCASlB,CAAA;AAEhB,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA"}
+{"version":3,"file":"api-token-payload.d.ts","sourceRoot":"","sources":["../../src/signer/api-token-payload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAM5B,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCASlB,CAAA;AAEhB,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA"}

package/dist/signer/api-token-payload.js

@@ -1,6 +1,6 @@
 import { didSchema } from '@atproto/did';
 import { jwtPayloadSchema } from '@atproto/jwk';
-import { deviceIdSchema } from '../oauth-store.js';
+import { deviceIdSchema } from '../device/device-id.js';
 import { requestUriSchema } from '../request/request-uri.js';
 export const apiTokenPayloadSchema = jwtPayloadSchema
     .extend({

package/dist/signer/api-token-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-payload.js","sourceRoot":"","sources":["../../src/signer/api-token-payload.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,SAAS;IAEd,QAAQ,EAAE,cAAc;IACxB,2EAA2E;IAC3E,0CAA0C;IAC1C,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { didSchema } from '@atproto/did'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { deviceIdSchema } from '../oauth-store.js'\nimport { requestUriSchema } from '../request/request-uri.js'\n\nexport const apiTokenPayloadSchema = jwtPayloadSchema\n  .extend({\n    sub: didSchema,\n\n    deviceId: deviceIdSchema,\n    // If the token is bound to a particular authorization request, it can only\n    // be used in the context of that request.\n    requestUri: requestUriSchema.optional(),\n  })\n  .passthrough()\n\nexport type ApiTokenPayload = z.infer<typeof apiTokenPayloadSchema>\n"]}
+{"version":3,"file":"api-token-payload.js","sourceRoot":"","sources":["../../src/signer/api-token-payload.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,SAAS;IAEd,QAAQ,EAAE,cAAc;IACxB,2EAA2E;IAC3E,0CAA0C;IAC1C,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import type { z } from 'zod'\nimport { didSchema } from '@atproto/did'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { deviceIdSchema } from '../device/device-id.js'\nimport { requestUriSchema } from '../request/request-uri.js'\n\nexport const apiTokenPayloadSchema = jwtPayloadSchema\n  .extend({\n    sub: didSchema,\n\n    deviceId: deviceIdSchema,\n    // If the token is bound to a particular authorization request, it can only\n    // be used in the context of that request.\n    requestUri: requestUriSchema.optional(),\n  })\n  .passthrough()\n\nexport type ApiTokenPayload = z.infer<typeof apiTokenPayloadSchema>\n"]}

package/dist/signer/signer.d.ts

@@ -1,7 +1,7 @@
-import { JwtHeader, JwtPayload, JwtPayloadGetter, JwtSignHeader, Key, Keyset, SignedJwt, VerifyOptions, VerifyResult } from '@atproto/jwk';
-import { OmitKey, RequiredKey } from '../lib/util/type.js';
-import { AccessTokenPayload } from './access-token-payload.js';
-import { ApiTokenPayload } from './api-token-payload.js';
+import { type JwtHeader, type JwtPayload, type JwtPayloadGetter, type JwtSignHeader, type Key, Keyset, type SignedJwt, type VerifyOptions, type VerifyResult } from '@atproto/jwk';
+import type { OmitKey, RequiredKey } from '../lib/util/type.js';
+import { type AccessTokenPayload } from './access-token-payload.js';
+import { type ApiTokenPayload } from './api-token-payload.js';
 export type SignPayload = JwtPayload & {
     iss?: never;
 };

package/dist/signer/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,GAAG,EACH,MAAM,EACN,SAAS,EACT,aAAa,EACb,YAAY,EACb,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EACL,kBAAkB,EAEnB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,eAAe,EAAyB,MAAM,wBAAwB,CAAA;AAE/E,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG;IAAE,GAAG,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtD,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,CAAA;AAEzE,qBAAa,MAAM;aAEC,MAAM,EAAE,MAAM;aACd,MAAM,EAAE,MAAM;IAFhC,YACkB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EAC5B;IAEE,MAAM,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EACnC,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GACzC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,CAAC,CAKzC;IAEY,IAAI,CACf,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,GACnD,OAAO,CAAC,SAAS,CAAC,CAOpB;IAEK,iBAAiB,CACrB,OAAO,EAAE,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAC1C,OAAO,CAAC,SAAS,CAAC,CASpB;IAEK,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EAC9C,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,GACjD,OAAO,CAAC;QACT,eAAe,EAAE,SAAS,CAAA;QAC1B,OAAO,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAA;KAC5C,CAAC,CASD;IAEK,oBAAoB,CACxB,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GACvD,OAAO,CAAC,SAAS,CAAC,CAYpB;IAEK,oBAAoB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EACjD,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC,GAC9D,OAAO,CAAC;QACT,eAAe,EAAE,SAAS,CAAA;QAC1B,OAAO,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;KACzC,CAAC,CAcD;CACF"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,GAAG,EACR,MAAM,EACN,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAA;AAErB,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAA;AAE/B,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG;IAAE,GAAG,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtD,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,CAAA;AAEzE,qBAAa,MAAM;aAEC,MAAM,EAAE,MAAM;aACd,MAAM,EAAE,MAAM;IAFhC,YACkB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EAC5B;IAEE,MAAM,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EACnC,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GACzC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,CAAC,CAKzC;IAEY,IAAI,CACf,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,GACnD,OAAO,CAAC,SAAS,CAAC,CAOpB;IAEK,iBAAiB,CACrB,OAAO,EAAE,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAC1C,OAAO,CAAC,SAAS,CAAC,CASpB;IAEK,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EAC9C,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,GACjD,OAAO,CAAC;QACT,eAAe,EAAE,SAAS,CAAA;QAC1B,OAAO,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAA;KAC5C,CAAC,CASD;IAEK,oBAAoB,CACxB,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GACvD,OAAO,CAAC,SAAS,CAAC,CAYpB;IAEK,oBAAoB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EACjD,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC,GAC9D,OAAO,CAAC;QACT,eAAe,EAAE,SAAS,CAAA;QAC1B,OAAO,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;KACzC,CAAC,CAcD;CACF"}

package/dist/signer/signer.js

@@ -1,8 +1,8 @@
 import { Keyset, } from '@atproto/jwk';
-import { EPHEMERAL_SESSION_MAX_AGE } from '../constants.js';
 import { dateToEpoch } from '../lib/util/date.js';
+import { EPHEMERAL_SESSION_MAX_AGE } from '../oauth-constants.js';
 import { accessTokenPayloadSchema, } from './access-token-payload.js';
-import { apiTokenPayloadSchema } from './api-token-payload.js';
+import { apiTokenPayloadSchema, } from './api-token-payload.js';
 export { Keyset };
 export class Signer {
     constructor(issuer, keyset) {

package/dist/signer/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,MAAM,GAIP,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAEL,wBAAwB,GACzB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAmB,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAI/E,OAAO,EAAE,MAAM,EAAE,CAAA;AAGjB,MAAM,OAAO,MAAM;IACjB,YACkB,MAAc,EACd,MAAc;sBADd,MAAM;sBACN,MAAM;IACrB,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAgB,EAChB,OAA0C;QAE1C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAI,KAAK,EAAE;YACrC,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,UAAyB,EACzB,OAAoD;QAEpD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU;gBAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;gBACrC,CAAC,CAAC,OAAO,CAAC;YACZ,GAAG,EAAE,IAAI,CAAC,MAAM;SACjB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAA2C;QAE3C,OAAO,IAAI,CAAC,IAAI,CACd;YACE,4DAA4D;YAC5D,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD,OAAO,CACR,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAgB,EAChB,OAAkD;QAKlD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;QACzE,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGrD;SACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAwD;QAExD,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD;YACE,GAAG,OAAO;YACV,GAAG,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YACxC,GAAG,EAAE,WAAW,EAAE;SACnB,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAgB,EAChB,OAA+D;QAK/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE;YACzC,GAAG,OAAO;YACV,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,yBAAyB,GAAG,GAAG;YACpE,QAAQ,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YAC7C,GAAG,EAAE,QAAQ;SACd,CAAC,CAAA;QACF,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGlD;SACF,CAAA;IACH,CAAC;CACF","sourcesContent":["import {\n  JwtHeader,\n  JwtPayload,\n  JwtPayloadGetter,\n  JwtSignHeader,\n  Key,\n  Keyset,\n  SignedJwt,\n  VerifyOptions,\n  VerifyResult,\n} from '@atproto/jwk'\nimport { EPHEMERAL_SESSION_MAX_AGE } from '../constants.js'\nimport { dateToEpoch } from '../lib/util/date.js'\nimport { OmitKey, RequiredKey } from '../lib/util/type.js'\nimport {\n  AccessTokenPayload,\n  accessTokenPayloadSchema,\n} from './access-token-payload.js'\nimport { ApiTokenPayload, apiTokenPayloadSchema } from './api-token-payload.js'\n\nexport type SignPayload = JwtPayload & { iss?: never }\n\nexport { Keyset }\nexport type { JwtPayloadGetter, JwtSignHeader, SignedJwt, VerifyOptions }\n\nexport class Signer {\n  constructor(\n    public readonly issuer: string,\n    public readonly keyset: Keyset,\n  ) {}\n\n  async verify<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer'>,\n  ): Promise<VerifyResult<C> & { key: Key }> {\n    return this.keyset.verifyJwt<C>(token, {\n      ...options,\n      issuer: [this.issuer],\n    })\n  }\n\n  public async sign(\n    signHeader: JwtSignHeader,\n    payload: SignPayload | JwtPayloadGetter<SignPayload>,\n  ): Promise<SignedJwt> {\n    return this.keyset.createJwt(signHeader, async (protectedHeader, key) => ({\n      ...(typeof payload === 'function'\n        ? await payload(protectedHeader, key)\n        : payload),\n      iss: this.issuer,\n    }))\n  }\n\n  async createAccessToken(\n    payload: OmitKey<AccessTokenPayload, 'iss'>,\n  ): Promise<SignedJwt> {\n    return this.sign(\n      {\n        // https://datatracker.ietf.org/doc/html/rfc9068#section-2.1\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      payload,\n    )\n  }\n\n  async verifyAccessToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'typ'>,\n  ): Promise<{\n    protectedHeader: JwtHeader\n    payload: RequiredKey<AccessTokenPayload, C>\n  }> {\n    const result = await this.verify<C>(token, { ...options, typ: 'at+jwt' })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: accessTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        AccessTokenPayload,\n        C\n      >,\n    }\n  }\n\n  async createEphemeralToken(\n    payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>,\n  ): Promise<SignedJwt> {\n    return this.sign(\n      {\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      {\n        ...payload,\n        aud: `oauth-provider-api@${this.issuer}`,\n        iat: dateToEpoch(),\n      },\n    )\n  }\n\n  async verifyEphemeralToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'audience' | 'typ'>,\n  ): Promise<{\n    protectedHeader: JwtHeader\n    payload: RequiredKey<ApiTokenPayload, C>\n  }> {\n    const result = await this.verify<C>(token, {\n      ...options,\n      maxTokenAge: options?.maxTokenAge ?? EPHEMERAL_SESSION_MAX_AGE / 1e3,\n      audience: `oauth-provider-api@${this.issuer}`,\n      typ: 'at+jwt',\n    })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: apiTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        ApiTokenPayload,\n        C\n      >,\n    }\n  }\n}\n"]}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,MAAM,GAIP,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAEL,wBAAwB,GACzB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAEL,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAI/B,OAAO,EAAE,MAAM,EAAE,CAAA;AAGjB,MAAM,OAAO,MAAM;IACjB,YACkB,MAAc,EACd,MAAc;sBADd,MAAM;sBACN,MAAM;IACrB,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAgB,EAChB,OAA0C;QAE1C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAI,KAAK,EAAE;YACrC,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,UAAyB,EACzB,OAAoD;QAEpD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU;gBAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;gBACrC,CAAC,CAAC,OAAO,CAAC;YACZ,GAAG,EAAE,IAAI,CAAC,MAAM;SACjB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAA2C;QAE3C,OAAO,IAAI,CAAC,IAAI,CACd;YACE,4DAA4D;YAC5D,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD,OAAO,CACR,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAgB,EAChB,OAAkD;QAKlD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;QACzE,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGrD;SACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAwD;QAExD,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD;YACE,GAAG,OAAO;YACV,GAAG,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YACxC,GAAG,EAAE,WAAW,EAAE;SACnB,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAgB,EAChB,OAA+D;QAK/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE;YACzC,GAAG,OAAO;YACV,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,yBAAyB,GAAG,GAAG;YACpE,QAAQ,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YAC7C,GAAG,EAAE,QAAQ;SACd,CAAC,CAAA;QACF,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGlD;SACF,CAAA;IACH,CAAC;CACF","sourcesContent":["import {\n  type JwtHeader,\n  type JwtPayload,\n  type JwtPayloadGetter,\n  type JwtSignHeader,\n  type Key,\n  Keyset,\n  type SignedJwt,\n  type VerifyOptions,\n  type VerifyResult,\n} from '@atproto/jwk'\nimport { dateToEpoch } from '../lib/util/date.js'\nimport type { OmitKey, RequiredKey } from '../lib/util/type.js'\nimport { EPHEMERAL_SESSION_MAX_AGE } from '../oauth-constants.js'\nimport {\n  type AccessTokenPayload,\n  accessTokenPayloadSchema,\n} from './access-token-payload.js'\nimport {\n  type ApiTokenPayload,\n  apiTokenPayloadSchema,\n} from './api-token-payload.js'\n\nexport type SignPayload = JwtPayload & { iss?: never }\n\nexport { Keyset }\nexport type { JwtPayloadGetter, JwtSignHeader, SignedJwt, VerifyOptions }\n\nexport class Signer {\n  constructor(\n    public readonly issuer: string,\n    public readonly keyset: Keyset,\n  ) {}\n\n  async verify<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer'>,\n  ): Promise<VerifyResult<C> & { key: Key }> {\n    return this.keyset.verifyJwt<C>(token, {\n      ...options,\n      issuer: [this.issuer],\n    })\n  }\n\n  public async sign(\n    signHeader: JwtSignHeader,\n    payload: SignPayload | JwtPayloadGetter<SignPayload>,\n  ): Promise<SignedJwt> {\n    return this.keyset.createJwt(signHeader, async (protectedHeader, key) => ({\n      ...(typeof payload === 'function'\n        ? await payload(protectedHeader, key)\n        : payload),\n      iss: this.issuer,\n    }))\n  }\n\n  async createAccessToken(\n    payload: OmitKey<AccessTokenPayload, 'iss'>,\n  ): Promise<SignedJwt> {\n    return this.sign(\n      {\n        // https://datatracker.ietf.org/doc/html/rfc9068#section-2.1\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      payload,\n    )\n  }\n\n  async verifyAccessToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'typ'>,\n  ): Promise<{\n    protectedHeader: JwtHeader\n    payload: RequiredKey<AccessTokenPayload, C>\n  }> {\n    const result = await this.verify<C>(token, { ...options, typ: 'at+jwt' })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: accessTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        AccessTokenPayload,\n        C\n      >,\n    }\n  }\n\n  async createEphemeralToken(\n    payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>,\n  ): Promise<SignedJwt> {\n    return this.sign(\n      {\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      {\n        ...payload,\n        aud: `oauth-provider-api@${this.issuer}`,\n        iat: dateToEpoch(),\n      },\n    )\n  }\n\n  async verifyEphemeralToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'audience' | 'typ'>,\n  ): Promise<{\n    protectedHeader: JwtHeader\n    payload: RequiredKey<ApiTokenPayload, C>\n  }> {\n    const result = await this.verify<C>(token, {\n      ...options,\n      maxTokenAge: options?.maxTokenAge ?? EPHEMERAL_SESSION_MAX_AGE / 1e3,\n      audience: `oauth-provider-api@${this.issuer}`,\n      typ: 'at+jwt',\n    })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: apiTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        ApiTokenPayload,\n        C\n      >,\n    }\n  }\n}\n"]}

package/dist/token/refresh-token.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { REFRESH_TOKEN_BYTES_LENGTH, REFRESH_TOKEN_PREFIX, } from '../constants.js';
 import { randomHexId } from '../lib/util/crypto.js';
+import { REFRESH_TOKEN_BYTES_LENGTH, REFRESH_TOKEN_PREFIX, } from '../oauth-constants.js';
 export const REFRESH_TOKEN_LENGTH = REFRESH_TOKEN_PREFIX.length + REFRESH_TOKEN_BYTES_LENGTH * 2; // hex encoding
 export const refreshTokenSchema = z
     .string()

package/dist/token/refresh-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.js","sourceRoot":"","sources":["../../src/token/refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAC/B,oBAAoB,CAAC,MAAM,GAAG,0BAA0B,GAAG,CAAC,CAAA,CAAC,eAAe;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,MAAM,CAAC,oBAAoB,CAAC;KAC5B,MAAM,CACL,CAAC,CAAC,EAAkD,EAAE,CACpD,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,EACpC;IACE,OAAO,EAAE,8BAA8B;CACxC,CACF,CAAA;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAa,EAAwB,EAAE,CACpE,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAG5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAA2B,EAAE;IACpE,OAAO,GAAG,oBAAoB,GAAG,MAAM,WAAW,CAChD,0BAA0B,CAC3B,EAAE,CAAA;AACL,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport {\n  REFRESH_TOKEN_BYTES_LENGTH,\n  REFRESH_TOKEN_PREFIX,\n} from '../constants.js'\nimport { randomHexId } from '../lib/util/crypto.js'\n\nexport const REFRESH_TOKEN_LENGTH =\n  REFRESH_TOKEN_PREFIX.length + REFRESH_TOKEN_BYTES_LENGTH * 2 // hex encoding\n\nexport const refreshTokenSchema = z\n  .string()\n  .length(REFRESH_TOKEN_LENGTH)\n  .refine(\n    (v): v is `${typeof REFRESH_TOKEN_PREFIX}${string}` =>\n      v.startsWith(REFRESH_TOKEN_PREFIX),\n    {\n      message: `Invalid refresh token format`,\n    },\n  )\n\nexport const isRefreshToken = (data: unknown): data is RefreshToken =>\n  refreshTokenSchema.safeParse(data).success\n\nexport type RefreshToken = z.infer<typeof refreshTokenSchema>\nexport const generateRefreshToken = async (): Promise<RefreshToken> => {\n  return `${REFRESH_TOKEN_PREFIX}${await randomHexId(\n    REFRESH_TOKEN_BYTES_LENGTH,\n  )}`\n}\n"]}
+{"version":3,"file":"refresh-token.js","sourceRoot":"","sources":["../../src/token/refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAA;AAE9B,MAAM,CAAC,MAAM,oBAAoB,GAC/B,oBAAoB,CAAC,MAAM,GAAG,0BAA0B,GAAG,CAAC,CAAA,CAAC,eAAe;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,MAAM,CAAC,oBAAoB,CAAC;KAC5B,MAAM,CACL,CAAC,CAAC,EAAkD,EAAE,CACpD,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,EACpC;IACE,OAAO,EAAE,8BAA8B;CACxC,CACF,CAAA;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAa,EAAwB,EAAE,CACpE,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAG5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAA2B,EAAE;IACpE,OAAO,GAAG,oBAAoB,GAAG,MAAM,WAAW,CAChD,0BAA0B,CAC3B,EAAE,CAAA;AACL,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { randomHexId } from '../lib/util/crypto.js'\nimport {\n  REFRESH_TOKEN_BYTES_LENGTH,\n  REFRESH_TOKEN_PREFIX,\n} from '../oauth-constants.js'\n\nexport const REFRESH_TOKEN_LENGTH =\n  REFRESH_TOKEN_PREFIX.length + REFRESH_TOKEN_BYTES_LENGTH * 2 // hex encoding\n\nexport const refreshTokenSchema = z\n  .string()\n  .length(REFRESH_TOKEN_LENGTH)\n  .refine(\n    (v): v is `${typeof REFRESH_TOKEN_PREFIX}${string}` =>\n      v.startsWith(REFRESH_TOKEN_PREFIX),\n    {\n      message: `Invalid refresh token format`,\n    },\n  )\n\nexport const isRefreshToken = (data: unknown): data is RefreshToken =>\n  refreshTokenSchema.safeParse(data).success\n\nexport type RefreshToken = z.infer<typeof refreshTokenSchema>\nexport const generateRefreshToken = async (): Promise<RefreshToken> => {\n  return `${REFRESH_TOKEN_PREFIX}${await randomHexId(\n    REFRESH_TOKEN_BYTES_LENGTH,\n  )}`\n}\n"]}

package/dist/token/token-claims.d.ts

@@ -1,7 +1,7 @@
-import { Did } from '@atproto/did';
-import { OAuthScope } from '@atproto/oauth-types';
-import { ClientId } from '../client/client-id.js';
-import { TokenId } from './token-id.js';
+import type { Did } from '@atproto/did';
+import type { OAuthScope } from '@atproto/oauth-types';
+import type { ClientId } from '../client/client-id.js';
+import type { TokenId } from './token-id.js';
 /**
  * The access token claims that will be set by the {@link TokenManager} and that
  * will be passed to the "onCreateToken" hook.

package/dist/token/token-claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-claims.d.ts","sourceRoot":"","sources":["../../src/token/token-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,OAAO,CAAA;IACZ,GAAG,EAAE,GAAG,CAAA;IACR,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IACnC,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA"}
+{"version":3,"file":"token-claims.d.ts","sourceRoot":"","sources":["../../src/token/token-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,OAAO,CAAA;IACZ,GAAG,EAAE,GAAG,CAAA;IACR,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IACnC,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA"}

package/dist/token/token-claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-claims.js","sourceRoot":"","sources":["../../src/token/token-claims.ts"],"names":[],"mappings":"","sourcesContent":["import { Did } from '@atproto/did'\nimport { OAuthScope } from '@atproto/oauth-types'\nimport { ClientId } from '../client/client-id.js'\nimport { TokenId } from './token-id.js'\n\n/**\n * The access token claims that will be set by the {@link TokenManager} and that\n * will be passed to the \"onCreateToken\" hook.\n *\n * @note \"iss\" is missing here because it cannot be altered and will always be\n * set to the Authorization Server's identifier.\n */\nexport type TokenClaims = {\n  jti: TokenId\n  sub: Did\n  iat: number\n  exp: number\n  aud: string | [string, ...string[]]\n  cnf?: { jkt: string }\n  scope?: OAuthScope\n  client_id: ClientId\n}\n"]}
+{"version":3,"file":"token-claims.js","sourceRoot":"","sources":["../../src/token/token-claims.ts"],"names":[],"mappings":"","sourcesContent":["import type { Did } from '@atproto/did'\nimport type { OAuthScope } from '@atproto/oauth-types'\nimport type { ClientId } from '../client/client-id.js'\nimport type { TokenId } from './token-id.js'\n\n/**\n * The access token claims that will be set by the {@link TokenManager} and that\n * will be passed to the \"onCreateToken\" hook.\n *\n * @note \"iss\" is missing here because it cannot be altered and will always be\n * set to the Authorization Server's identifier.\n */\nexport type TokenClaims = {\n  jti: TokenId\n  sub: Did\n  iat: number\n  exp: number\n  aud: string | [string, ...string[]]\n  cnf?: { jkt: string }\n  scope?: OAuthScope\n  client_id: ClientId\n}\n"]}

package/dist/token/token-data.d.ts

@@ -1,10 +1,10 @@
-import { Did } from '@atproto/did';
-import { OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters } from '@atproto/oauth-types';
-import { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js';
-import { ClientId } from '../client/client-id.js';
-import { DeviceId } from '../device/device-id.js';
-import { Code } from '../request/code.js';
-export type { ClientAuth, ClientId, Code, DeviceId, Did, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, };
+import type { Did } from '@atproto/did';
+import type { OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters } from '@atproto/oauth-types';
+import type { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js';
+import type { ClientId } from '../client/client-id.js';
+import type { DeviceId } from '../device/device-id.js';
+import type { Code } from '../request/code.js';
+export type { ClientAuth, ClientAuthLegacy, ClientId, Code, DeviceId, Did, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, };
 export type TokenData = {
     createdAt: Date;
     updatedAt: Date;

package/dist/token/token-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-data.d.ts","sourceRoot":"","sources":["../../src/token/token-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACpC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAEzC,YAAY,EACV,UAAU,EACV,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,GAAG,EACH,yBAAyB,EACzB,mCAAmC,GACpC,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,UAAU,GAAG,gBAAgB,CAAA;IACzC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,GAAG,EAAE,GAAG,CAAA;IACR,UAAU,EAAE,mCAAmC,CAAA;IAC/C,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IAEjB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB,CAAA"}
+{"version":3,"file":"token-data.d.ts","sourceRoot":"","sources":["../../src/token/token-data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,EACV,yBAAyB,EACzB,mCAAmC,EACpC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC5E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,GAAG,EACH,yBAAyB,EACzB,mCAAmC,GACpC,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,UAAU,GAAG,gBAAgB,CAAA;IACzC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,GAAG,EAAE,GAAG,CAAA;IACR,UAAU,EAAE,mCAAmC,CAAA;IAC/C,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IAEjB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB,CAAA"}

package/dist/token/token-data.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-data.js","sourceRoot":"","sources":["../../src/token/token-data.ts"],"names":[],"mappings":"","sourcesContent":["import { Did } from '@atproto/did'\nimport {\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n} from '@atproto/oauth-types'\nimport { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js'\nimport { ClientId } from '../client/client-id.js'\nimport { DeviceId } from '../device/device-id.js'\nimport { Code } from '../request/code.js'\n\nexport type {\n  ClientAuth,\n  ClientId,\n  Code,\n  DeviceId,\n  Did,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n}\n\nexport type TokenData = {\n  createdAt: Date\n  updatedAt: Date\n  expiresAt: Date\n  clientId: ClientId\n  clientAuth: ClientAuth | ClientAuthLegacy\n  deviceId: DeviceId | null\n  did: Did\n  parameters: OAuthAuthorizationRequestParameters\n  details?: null // Legacy field, not used\n  code: Code | null\n\n  /**\n   * This will contain the parameter scope, translated into permissions\n   *\n   * @note null because this didn't use to exist. New tokens should always\n   * include a scope.\n   */\n  scope: string | null\n}\n"]}
+{"version":3,"file":"token-data.js","sourceRoot":"","sources":["../../src/token/token-data.ts"],"names":[],"mappings":"","sourcesContent":["import type { Did } from '@atproto/did'\nimport type {\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n} from '@atproto/oauth-types'\nimport type { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js'\nimport type { ClientId } from '../client/client-id.js'\nimport type { DeviceId } from '../device/device-id.js'\nimport type { Code } from '../request/code.js'\n\nexport type {\n  ClientAuth,\n  ClientAuthLegacy,\n  ClientId,\n  Code,\n  DeviceId,\n  Did,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n}\n\nexport type TokenData = {\n  createdAt: Date\n  updatedAt: Date\n  expiresAt: Date\n  clientId: ClientId\n  clientAuth: ClientAuth | ClientAuthLegacy\n  deviceId: DeviceId | null\n  did: Did\n  parameters: OAuthAuthorizationRequestParameters\n  details?: null // Legacy field, not used\n  code: Code | null\n\n  /**\n   * This will contain the parameter scope, translated into permissions\n   *\n   * @note null because this didn't use to exist. New tokens should always\n   * include a scope.\n   */\n  scope: string | null\n}\n"]}

package/dist/token/token-id.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { TOKEN_ID_BYTES_LENGTH, TOKEN_ID_PREFIX } from '../constants.js';
 import { randomHexId } from '../lib/util/crypto.js';
+import { TOKEN_ID_BYTES_LENGTH, TOKEN_ID_PREFIX } from '../oauth-constants.js';
 export const TOKEN_ID_LENGTH = TOKEN_ID_PREFIX.length + TOKEN_ID_BYTES_LENGTH * 2; // hex encoding
 export const tokenIdSchema = z
     .string()

package/dist/token/token-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-id.js","sourceRoot":"","sources":["../../src/token/token-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,MAAM,CAAC,MAAM,eAAe,GAC1B,eAAe,CAAC,MAAM,GAAG,qBAAqB,GAAG,CAAC,CAAA,CAAC,eAAe;AAEpE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,MAAM,CAAC,eAAe,CAAC;KACvB,MAAM,CACL,CAAC,CAAC,EAA6C,EAAE,CAC/C,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAC/B;IACE,OAAO,EAAE,yBAAyB;CACnC,CACF,CAAA;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,IAAsB,EAAE;IAC1D,OAAO,GAAG,eAAe,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC,EAAE,CAAA;AACxE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAa,EAAmB,EAAE,CAC1D,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA","sourcesContent":["import { z } from 'zod'\nimport { TOKEN_ID_BYTES_LENGTH, TOKEN_ID_PREFIX } from '../constants.js'\nimport { randomHexId } from '../lib/util/crypto.js'\n\nexport const TOKEN_ID_LENGTH =\n  TOKEN_ID_PREFIX.length + TOKEN_ID_BYTES_LENGTH * 2 // hex encoding\n\nexport const tokenIdSchema = z\n  .string()\n  .length(TOKEN_ID_LENGTH)\n  .refine(\n    (v): v is `${typeof TOKEN_ID_PREFIX}${string}` =>\n      v.startsWith(TOKEN_ID_PREFIX),\n    {\n      message: `Invalid token ID format`,\n    },\n  )\n\nexport type TokenId = z.infer<typeof tokenIdSchema>\nexport const generateTokenId = async (): Promise<TokenId> => {\n  return `${TOKEN_ID_PREFIX}${await randomHexId(TOKEN_ID_BYTES_LENGTH)}`\n}\n\nexport const isTokenId = (data: unknown): data is TokenId =>\n  tokenIdSchema.safeParse(data).success\n"]}
+{"version":3,"file":"token-id.js","sourceRoot":"","sources":["../../src/token/token-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAE9E,MAAM,CAAC,MAAM,eAAe,GAC1B,eAAe,CAAC,MAAM,GAAG,qBAAqB,GAAG,CAAC,CAAA,CAAC,eAAe;AAEpE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,MAAM,CAAC,eAAe,CAAC;KACvB,MAAM,CACL,CAAC,CAAC,EAA6C,EAAE,CAC/C,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAC/B;IACE,OAAO,EAAE,yBAAyB;CACnC,CACF,CAAA;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,IAAsB,EAAE;IAC1D,OAAO,GAAG,eAAe,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC,EAAE,CAAA;AACxE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAa,EAAmB,EAAE,CAC1D,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA","sourcesContent":["import { z } from 'zod'\nimport { randomHexId } from '../lib/util/crypto.js'\nimport { TOKEN_ID_BYTES_LENGTH, TOKEN_ID_PREFIX } from '../oauth-constants.js'\n\nexport const TOKEN_ID_LENGTH =\n  TOKEN_ID_PREFIX.length + TOKEN_ID_BYTES_LENGTH * 2 // hex encoding\n\nexport const tokenIdSchema = z\n  .string()\n  .length(TOKEN_ID_LENGTH)\n  .refine(\n    (v): v is `${typeof TOKEN_ID_PREFIX}${string}` =>\n      v.startsWith(TOKEN_ID_PREFIX),\n    {\n      message: `Invalid token ID format`,\n    },\n  )\n\nexport type TokenId = z.infer<typeof tokenIdSchema>\nexport const generateTokenId = async (): Promise<TokenId> => {\n  return `${TOKEN_ID_PREFIX}${await randomHexId(TOKEN_ID_BYTES_LENGTH)}`\n}\n\nexport const isTokenId = (data: unknown): data is TokenId =>\n  tokenIdSchema.safeParse(data).success\n"]}

package/dist/token/token-manager.d.ts

@@ -1,21 +1,21 @@
 import type { Did } from '@atproto/did';
-import { SignedJwt } from '@atproto/jwk';
+import { type SignedJwt } from '@atproto/jwk';
 import type { Account } from '@atproto/oauth-provider-api';
-import { OAuthAccessToken, OAuthAuthorizationRequestParameters, OAuthScope, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
+import type { OAuthAccessToken, OAuthAuthorizationRequestParameters, OAuthScope, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
 import { AccessTokenMode } from '../access-token/access-token-mode.js';
-import { ClientAuth } from '../client/client-auth.js';
-import { Client } from '../client/client.js';
-import { DeviceId } from '../device/device-id.js';
-import { LexiconManager } from '../lexicon/lexicon-manager.js';
-import { RequestMetadata } from '../lib/http/request.js';
-import { OAuthHooks } from '../oauth-hooks.js';
-import { Code } from '../request/code.js';
-import { AccessTokenPayload } from '../signer/access-token-payload.js';
+import type { ClientAuth } from '../client/client-auth.js';
+import type { Client } from '../client/client.js';
+import type { DeviceId } from '../device/device-id.js';
+import type { LexiconManager } from '../lexicon/lexicon-manager.js';
+import type { RequestMetadata } from '../lib/http/request.js';
+import type { OAuthHooks } from '../oauth-hooks.js';
+import { type Code } from '../request/code.js';
+import type { AccessTokenPayload } from '../signer/access-token-payload.js';
 import { Signer } from '../signer/signer.js';
-import { RefreshToken } from './refresh-token.js';
-import { TokenClaims } from './token-claims.js';
-import { TokenId } from './token-id.js';
-import { TokenInfo, TokenStore } from './token-store.js';
+import { type RefreshToken } from './refresh-token.js';
+import type { TokenClaims } from './token-claims.js';
+import { type TokenId } from './token-id.js';
+import type { TokenInfo, TokenStore } from './token-store.js';
 export { AccessTokenMode, Signer };
 export type { OAuthHooks, TokenStore };
 export declare class TokenManager {

package/dist/token/token-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/token/token-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,SAAS,EAAe,MAAM,cAAc,CAAA;AAErD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EACL,gBAAgB,EAChB,mCAAmC,EACnC,UAAU,EACV,kBAAkB,EAClB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAIjD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAU,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EACL,YAAY,EAGb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAA8B,MAAM,eAAe,CAAA;AACnE,OAAO,EAAmB,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAEzE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAClC,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AAEtC,qBAAa,YAAY;IAErB,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IACpC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc;IACjD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACjC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IACpC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe;IACnD,SAAS,CAAC,QAAQ,CAAC,WAAW;IANhC,YACqB,KAAK,EAAE,UAAU,EACjB,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,eAAe,EAChC,WAAW,SAAgB,EAC5C;IAEJ,SAAS,CAAC,iBAAiB,CAAC,GAAG,OAAa,QAE3C;IAED,UAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,mCAAmC,EAC/C,QAAQ,EAAE,IAAI,EACd,SAAS,EAAE,IAAI,EACf,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;IAEK,WAAW,CACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,IAAI,GAAG,QAAQ,EACzB,UAAU,EAAE,mCAAmC,EAC/C,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,kBAAkB,CAAC,CA0E7B;IAED,UAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,mCAAmC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAMf;IAED,SAAS,CAAC,kBAAkB,CAC1B,SAAS,EAAE,cAAc,EACzB,WAAW,EAAE,gBAAgB,EAC7B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,SAAS,EAAE,IAAI,EACf,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,GACZ,kBAAkB,CAkBpB;IAEK,WAAW,CACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kBAAkB,CAAC,CA0D7B;IAED;;;OAGG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAY/D;IAEY,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAiB1E;IAED,UAAgB,kBAAkB,CAChC,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAE3B;IAEY,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAyBxE;IAEY,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAE7D;IAEY,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD;IAEK,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAE9D;IAED;;;;OAIG;IACG,eAAe,CACnB,SAAS,EAAE,cAAc,EACzB,YAAY,EAAE,kBAAkB,GAC/B,OAAO,CAAC,WAAW,CAAC,CAmCtB;IAEK,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAKtD;CACF"}
+{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/token/token-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,KAAK,SAAS,EAAe,MAAM,cAAc,CAAA;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,KAAK,EACV,gBAAgB,EAChB,mCAAmC,EACnC,UAAU,EACV,kBAAkB,EAClB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAItD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAG7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,KAAK,IAAI,EAAU,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,KAAK,OAAO,EAA8B,MAAM,eAAe,CAAA;AACxE,OAAO,KAAK,EAAmB,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAClC,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AAEtC,qBAAa,YAAY;IAErB,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IACpC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc;IACjD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACjC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IACpC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe;IACnD,SAAS,CAAC,QAAQ,CAAC,WAAW;IANhC,YACqB,KAAK,EAAE,UAAU,EACjB,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,eAAe,EAChC,WAAW,SAAgB,EAC5C;IAEJ,SAAS,CAAC,iBAAiB,CAAC,GAAG,OAAa,QAE3C;IAED,UAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,mCAAmC,EAC/C,QAAQ,EAAE,IAAI,EACd,SAAS,EAAE,IAAI,EACf,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;IAEK,WAAW,CACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,IAAI,GAAG,QAAQ,EACzB,UAAU,EAAE,mCAAmC,EAC/C,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,kBAAkB,CAAC,CA0E7B;IAED,UAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,mCAAmC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAMf;IAED,SAAS,CAAC,kBAAkB,CAC1B,SAAS,EAAE,cAAc,EACzB,WAAW,EAAE,gBAAgB,EAC7B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,SAAS,EAAE,IAAI,EACf,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,GACZ,kBAAkB,CAkBpB;IAEK,WAAW,CACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kBAAkB,CAAC,CA0D7B;IAED;;;OAGG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAY/D;IAEY,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAiB1E;IAED,UAAgB,kBAAkB,CAChC,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAE3B;IAEY,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAyBxE;IAEY,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAE7D;IAEY,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD;IAEK,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAE9D;IAED;;;;OAIG;IACG,eAAe,CACnB,SAAS,EAAE,cAAc,EACzB,YAAY,EAAE,kBAAkB,GAC/B,OAAO,CAAC,WAAW,CAAC,CAmCtB;IAEK,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAKtD;CACF"}

package/dist/token/token-manager.js

@@ -1,11 +1,11 @@
 import { isSignedJwt } from '@atproto/jwk';
 import { LexResolverError } from '@atproto/lex-resolver';
 import { AccessTokenMode } from '../access-token/access-token-mode.js';
-import { TOKEN_MAX_AGE } from '../constants.js';
 import { InvalidGrantError } from '../errors/invalid-grant-error.js';
 import { InvalidRequestError } from '../errors/invalid-request-error.js';
 import { InvalidTokenError } from '../errors/invalid-token-error.js';
 import { dateToEpoch, dateToRelativeSeconds } from '../lib/util/date.js';
+import { TOKEN_MAX_AGE } from '../oauth-constants.js';
 import { isCode } from '../request/code.js';
 import { Signer } from '../signer/signer.js';
 import { generateRefreshToken, isRefreshToken, } from './refresh-token.js';