@authup/server-core 1.0.0-beta.35 → 1.0.0-beta.37

package/dist/core/identity/provider/authentication/presets/github.mjs

@@ -0,0 +1,37 @@
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/github.ts
+var IdentityProviderGithubAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "user:email";
+		ctx.provider.authorize_url = "https://github.com/login/oauth/authorize";
+		ctx.provider.token_url = "https://github.com/login/oauth/access_token";
+		ctx.provider.user_info_url = "https://api.github.com/user";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const userInfo = await this.client.userInfo.get({
+			type: "Bearer",
+			token: input.access_token
+		});
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: userInfo.id,
+			attributeCandidates: {
+				name: [
+					userInfo.login,
+					userInfo.name,
+					userInfo.id
+				],
+				email: [userInfo.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderGithubAuthenticator };
+
+//# sourceMappingURL=github.mjs.map

package/dist/core/identity/provider/authentication/presets/github.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderGithubAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","login","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/github.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGithubAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'user:email';\n        ctx.provider.authorize_url = 'https://github.com/login/oauth/authorize';\n        ctx.provider.token_url = 'https://github.com/login/oauth/access_token';\n        ctx.provider.user_info_url = 'https://api.github.com/user';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.login,\n                    userInfo.name,\n                    userInfo.id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;GACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,aAAY;AAEtD,SAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM;KACFT,SAASU;KACTV,SAASS;KACTT,SAASO;KACZ;IACDI,OAAO,CACHX,SAASW,MACZ;IACL;GACAC,MAAMN;GACNb,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/presets/google.mjs

@@ -0,0 +1,36 @@
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/google.ts
+var IdentityProviderGoogleAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "openid profile email";
+		ctx.provider.authorize_url = "https://accounts.google.com/o/oauth2/v2/auth";
+		ctx.provider.token_url = "https://oauth2.googleapis.com/token";
+		ctx.provider.user_info_url = "https://openidconnect.googleapis.com/v1/userinfo";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const payload = extractTokenPayload(input.access_token);
+		const attributeCandidates = {};
+		/**
+		* @see https://developers.google.com/identity/openid-connect/openid-connect?hl=de#server-flow
+		*/ if (input.id_token) {
+			const idTokenPayload = extractTokenPayload(input.id_token);
+			attributeCandidates.name = [idTokenPayload.name];
+			attributeCandidates.email = [idTokenPayload.email];
+			attributeCandidates.first_name = [idTokenPayload.given_name];
+			attributeCandidates.last_name = [idTokenPayload.family_name];
+		}
+		return {
+			id: payload.sub,
+			attributeCandidates,
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderGoogleAuthenticator };
+
+//# sourceMappingURL=google.mjs.map

package/dist/core/identity/provider/authentication/presets/google.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderGoogleAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","payload","access_token","attributeCandidates","id_token","idTokenPayload","name","email","first_name","given_name","last_name","family_name","id","sub","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/google.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGoogleAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'openid profile email';\n        ctx.provider.authorize_url = 'https://accounts.google.com/o/oauth2/v2/auth';\n        ctx.provider.token_url = 'https://oauth2.googleapis.com/token';\n        ctx.provider.user_info_url = 'https://openidconnect.googleapis.com/v1/userinfo';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        const attributeCandidates : Record<keyof User, unknown[]> = {};\n\n        /**\n         * @see https://developers.google.com/identity/openid-connect/openid-connect?hl=de#server-flow\n         */\n        if (input.id_token) {\n            const idTokenPayload = extractTokenPayload(input.id_token) as OpenIDTokenPayload;\n\n            attributeCandidates.name = [\n                idTokenPayload.name,\n            ];\n\n            attributeCandidates.email = [\n                idTokenPayload.email,\n            ];\n\n            attributeCandidates.first_name = [\n                idTokenPayload.given_name,\n            ];\n            attributeCandidates.last_name = [\n                idTokenPayload.family_name,\n            ];\n        }\n\n        return {\n            id: payload.sub!,\n            attributeCandidates,\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAeA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUX,oBAAoBU,MAAME,aAAY;EAEtD,MAAMC,sBAAsD,EAAC;;;IAK7D,KAAIH,MAAMI,UAAU;GAChB,MAAMC,iBAAiBf,oBAAoBU,MAAMI,SAAQ;AAEzDD,uBAAoBG,OAAO,CACvBD,eAAeC,KAClB;AAEDH,uBAAoBI,QAAQ,CACxBF,eAAeE,MAClB;AAEDJ,uBAAoBK,aAAa,CAC7BH,eAAeI,WAClB;AACDN,uBAAoBO,YAAY,CAC5BL,eAAeM,YAClB;;AAGL,SAAO;GACHC,IAAIX,QAAQY;GACZV;GACAW,MAAMb;GACNP,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/presets/index.mjs

@@ -0,0 +1,6 @@
+import { IdentityProviderFacebookAuthenticator } from "./facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./paypal.mjs";
+export { IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderPaypalAuthenticator };

package/dist/core/identity/provider/authentication/presets/instagram.mjs

@@ -0,0 +1,30 @@
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/instagram.ts
+var IdentityProviderInstagramAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "user_profile";
+		ctx.provider.authorize_url = "https://api.instagram.com/oauth/authorize";
+		ctx.provider.token_url = "https://api.instagram.com/oauth/access_token";
+		ctx.provider.user_info_url = "https://graph.instagram.com/me?fields=id,username";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const userInfo = await this.client.userInfo.get({
+			type: "Bearer",
+			token: input.access_token
+		});
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: userInfo.id,
+			attributeCandidates: { name: [userInfo.username, userInfo.id] },
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderInstagramAuthenticator };
+
+//# sourceMappingURL=instagram.mjs.map

package/dist/core/identity/provider/authentication/presets/instagram.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"instagram.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderInstagramAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderInstagramAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'user_profile';\n        ctx.provider.authorize_url = 'https://api.instagram.com/oauth/authorize';\n        ctx.provider.token_url = 'https://api.instagram.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.instagram.com/me?fields=id,username';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,yCAAb,cAA4DD,oCAAAA;CACxD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;GACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,aAAY;AAEtD,SAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB,EACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,GACZ,EACL;GACAI,MAAML;GACNb,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/presets/paypal.mjs

@@ -0,0 +1,33 @@
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/paypal.ts
+var IdentityProviderPaypalAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "openid profile email";
+		ctx.provider.authorize_url = "https://www.paypal.com/signin/authorize";
+		ctx.provider.token_url = "https://api.paypal.com/v1/identity/openidconnect/tokenservice";
+		ctx.provider.user_info_url = "https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const userInfo = await this.client.userInfo.get({
+			type: "Bearer",
+			token: input.access_token
+		});
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: userInfo.user_id,
+			attributeCandidates: {
+				name: [userInfo.name, userInfo.user_id],
+				email: [userInfo.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderPaypalAuthenticator };
+
+//# sourceMappingURL=paypal.mjs.map

package/dist/core/identity/provider/authentication/presets/paypal.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderPaypalAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","user_id","attributeCandidates","name","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderPaypalAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'openid profile email';\n        ctx.provider.authorize_url = 'https://www.paypal.com/signin/authorize';\n        ctx.provider.token_url = 'https://api.paypal.com/v1/identity/openidconnect/tokenservice';\n        ctx.provider.user_info_url = 'https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.user_id,\n            attributeCandidates: {\n                name: [\n                    userInfo.name,\n                    userInfo.user_id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;GACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,aAAY;AAEtD,SAAO;GACHE,IAAIP,SAASQ;GACbC,qBAAqB;IACjBC,MAAM,CACFV,SAASU,MACTV,SAASQ,QACZ;IACDG,OAAO,CACHX,SAASW,MACZ;IACL;GACAC,MAAMN;GACNb,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/protocols/index.mjs

@@ -0,0 +1,8 @@
+import { IdentityProviderLdapAuthenticator } from "./ldap/module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./ldap/collection.mjs";
+import "./ldap/index.mjs";
+import { IdentityProviderOAuth2Authenticator } from "./oauth2/module.mjs";
+import "./oauth2/index.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./open-id/module.mjs";
+import "./open-id/index.mjs";
+export { IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator };

package/dist/core/identity/provider/authentication/protocols/ldap/collection.mjs

@@ -0,0 +1,36 @@
+import { BaseCredentialsAuthenticator } from "../../../../../authentication/base.mjs";
+import "../../../../../authentication/index.mjs";
+import { IdentityProviderLdapAuthenticator } from "./module.mjs";
+import { IdentityProviderProtocol, UserError, isLdapIdentityProvider } from "@authup/core-kit";
+//#region src/core/identity/provider/authentication/protocols/ldap/collection.ts
+var IdentityProviderLdapCollectionAuthenticator = class extends BaseCredentialsAuthenticator {
+	repository;
+	accountManager;
+	clientFactory;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.accountManager = ctx.accountManager;
+		this.clientFactory = ctx.clientFactory;
+	}
+	async authenticate(name, password, realmId) {
+		let error;
+		const entities = await this.repository.findByProtocol(IdentityProviderProtocol.LDAP, realmId);
+		for (const provider of entities) {
+			if (!isLdapIdentityProvider(provider)) continue;
+			const response = await new IdentityProviderLdapAuthenticator({
+				provider,
+				accountManager: this.accountManager,
+				clientFactory: this.clientFactory
+			}).safeAuthenticate(name, password);
+			if (response.success === true) return response.data;
+			error = response.error;
+		}
+		if (error) throw error;
+		throw UserError.credentialsInvalid();
+	}
+};
+//#endregion
+export { IdentityProviderLdapCollectionAuthenticator };
+
+//# sourceMappingURL=collection.mjs.map

package/dist/core/identity/provider/authentication/protocols/ldap/collection.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection.mjs","names":["IdentityProviderProtocol","UserError","isLdapIdentityProvider","IdentityProviderLdapAuthenticator","BaseCredentialsAuthenticator","IdentityProviderLdapCollectionAuthenticator","repository","accountManager","clientFactory","ctx","authenticate","name","password","realmId","error","entities","findByProtocol","LDAP","provider","authenticator","response","safeAuthenticate","success","data","credentialsInvalid"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/collection.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { IdentityProviderProtocol, UserError, isLdapIdentityProvider } from '@authup/core-kit';\nimport type { IIdentityProviderRepository } from '../../../../../entities/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport { IdentityProviderLdapAuthenticator } from './module.ts';\nimport type { ILdapClientFactory } from '../../../../../ldap/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { IdentityProviderLdapCollectionAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapCollectionAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected repository: IIdentityProviderRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected clientFactory: ILdapClientFactory;\n\n    constructor(ctx: IdentityProviderLdapCollectionAuthenticatorContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.accountManager = ctx.accountManager;\n        this.clientFactory = ctx.clientFactory;\n    }\n\n    async authenticate(name: string, password: string, realmId?: string): Promise<User> {\n        let error : Error | undefined;\n        const entities = await this.repository.findByProtocol(IdentityProviderProtocol.LDAP, realmId);\n\n        for (const provider of entities) {\n            if (!isLdapIdentityProvider(provider)) {\n                continue;\n            }\n\n            const authenticator = new IdentityProviderLdapAuthenticator({\n                provider,\n                accountManager: this.accountManager,\n                clientFactory: this.clientFactory,\n            });\n\n            const response = await authenticator.safeAuthenticate(name, password);\n            if (response.success === true) {\n                return response.data;\n            }\n\n            error = response.error;\n        }\n\n        if (error) {\n            throw error;\n        }\n\n        throw UserError.credentialsInvalid();\n    }\n}\n"],"mappings":";;;;;AAgBA,IAAaK,8CAAb,cAAiED,6BAAAA;CACnDE;CAEAC;CAEAC;CAEV,YAAYC,KAAyD;AACjE,SAAK;AAEL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,gBAAgBC,IAAID;;CAG7B,MAAME,aAAaC,MAAcC,UAAkBC,SAAiC;EAChF,IAAIC;EACJ,MAAMC,WAAW,MAAM,KAAKT,WAAWU,eAAehB,yBAAyBiB,MAAMJ,QAAAA;AAErF,OAAK,MAAMK,YAAYH,UAAU;AAC7B,OAAI,CAACb,uBAAuBgB,SAAAA,CACxB;GASJ,MAAME,WAAW,MAAMD,IANGhB,kCAAkC;IACxDe;IACAX,gBAAgB,KAAKA;IACrBC,eAAe,KAAKA;IACxB,CAEuBW,CAAcE,iBAAiBV,MAAMC,SAAAA;AAC5D,OAAIQ,SAASE,YAAY,KACrB,QAAOF,SAASG;AAGpBT,WAAQM,SAASN;;AAGrB,MAAIA,MACA,OAAMA;AAGV,QAAMb,UAAUuB,oBAAkB"}

package/dist/core/identity/provider/authentication/protocols/ldap/index.mjs

@@ -0,0 +1,3 @@
+import { IdentityProviderLdapAuthenticator } from "./module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./collection.mjs";
+export { IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator };

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs

@@ -0,0 +1,154 @@
+import { BaseCredentialsAuthenticator } from "../../../../../authentication/base.mjs";
+import "../../../../../authentication/index.mjs";
+import { UserError } from "@authup/core-kit";
+import { template } from "@authup/kit";
+import ldap from "ldapjs";
+//#region src/core/identity/provider/authentication/protocols/ldap/module.ts
+var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticator {
+	provider;
+	accountManager;
+	client;
+	constructor(ctx) {
+		super();
+		this.accountManager = ctx.accountManager;
+		this.provider = ctx.provider;
+		this.client = ctx.clientFactory.create({
+			url: ctx.provider.url,
+			tls: ctx.provider.tls,
+			startTLS: ctx.provider.start_tls,
+			baseDn: ctx.provider.base_dn,
+			user: ctx.provider.user,
+			password: ctx.provider.password,
+			userNameAttribute: ctx.provider.user_name_attribute
+		});
+	}
+	async authenticate(name, password) {
+		let bind = await this.safeBind();
+		if (!bind.success) {
+			await this.safeUnbind();
+			throw UserError.credentialsInvalid();
+		}
+		const entity = await this.findOneByName(name);
+		if (!entity) throw UserError.credentialsInvalid();
+		const identity = {
+			id: entity.dn,
+			attributeCandidates: {
+				name: [entity[this.provider.user_name_attribute || "cn"], this.extractCnFromDn(entity.dn)],
+				email: [entity[this.provider.user_mail_attribute || "mail"]]
+			},
+			data: entity,
+			provider: this.provider
+		};
+		try {
+			identity.roles = await this.findUserGroups(entity);
+		} catch {}
+		bind = await this.safeBind(identity.id, password);
+		await this.safeUnbind();
+		if (!bind.success) throw UserError.credentialsInvalid();
+		return (await this.accountManager.save(identity)).user;
+	}
+	async bind(user, password) {
+		if (!user) return this.client.bind();
+		if (!this.client.isDn(user)) user = `${this.provider.user_name_attribute || "cn"}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;
+		return this.client.bind(user, password);
+	}
+	async safeBind(user, password) {
+		try {
+			await this.bind(user, password);
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: e
+			};
+		}
+	}
+	async unbind() {
+		return this.client.unbind();
+	}
+	async safeUnbind() {
+		try {
+			await this.unbind();
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: e
+			};
+		}
+	}
+	async findOneByName(input) {
+		let filter;
+		if (this.provider.user_filter) filter = template(this.provider.user_filter, {
+			input,
+			name_attribute: this.provider.user_name_attribute || "cn",
+			mail_attribute: this.provider.user_mail_attribute || "mail",
+			display_name_attribute: this.provider.user_display_name_attribute || "cn"
+		});
+		else if (this.provider.user_name_attribute) filter = new ldap.EqualityFilter({
+			attribute: this.provider.user_name_attribute,
+			value: input
+		});
+		else filter = new ldap.OrFilter({ filters: [new ldap.EqualityFilter({
+			attribute: "cn",
+			value: input
+		}), new ldap.EqualityFilter({
+			attribute: "sAMAccountName",
+			value: input
+		})] });
+		const entities = await this.client.search({
+			filter,
+			scope: "sub"
+		}, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));
+		if (entities.length === 0) return null;
+		return entities[0];
+	}
+	extractCnFromDn(dn) {
+		const match = /^cn=([^,]+)/i.exec(dn);
+		return match ? match[1].trim() : void 0;
+	}
+	async findUserGroups(user) {
+		const nameAttribute = this.provider.group_name_attribute || "cn";
+		const memberAttribute = this.provider.group_member_attribute || "member";
+		let filter;
+		if (this.provider.group_filter) filter = template(this.provider.group_filter, {
+			...user,
+			name_attribute: nameAttribute,
+			member_attribute: memberAttribute
+		});
+		else filter = new ldap.AndFilter({ filters: [new ldap.EqualityFilter({
+			attribute: "objectClass",
+			value: this.provider.group_class || "group"
+		}), new ldap.EqualityFilter({
+			attribute: memberAttribute,
+			value: user[this.provider.group_member_user_attribute || "dn"]
+		})] });
+		const entities = await this.client.search({
+			filter,
+			scope: "sub"
+		}, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));
+		if (entities.length === 0) return [];
+		const attributeKey = this.provider.group_name_attribute || "cn";
+		const names = [];
+		for (const entity of entities) {
+			const attribute = entity[attributeKey];
+			if (typeof attribute === "undefined") continue;
+			if (typeof attribute === "string") {
+				names.push(attribute);
+				continue;
+			}
+			if (Array.isArray(attribute)) names.push(...attribute.filter((el) => typeof el === "string"));
+		}
+		return names;
+	}
+};
+//#endregion
+export { IdentityProviderLdapAuthenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["UserError","template","ldap","BaseCredentialsAuthenticator","IdentityProviderLdapAuthenticator","provider","accountManager","client","ctx","clientFactory","create","url","tls","startTLS","start_tls","baseDn","base_dn","user","password","userNameAttribute","user_name_attribute","authenticate","name","bind","safeBind","success","safeUnbind","credentialsInvalid","entity","findOneByName","identity","id","dn","attributeCandidates","extractCnFromDn","email","user_mail_attribute","data","roles","findUserGroups","account","save","isDn","nameAttribute","resolveDn","user_base_dn","e","error","unbind","input","filter","user_filter","name_attribute","mail_attribute","display_name_attribute","user_display_name_attribute","EqualityFilter","attribute","value","OrFilter","filters","entities","search","scope","length","match","exec","trim","undefined","group_name_attribute","memberAttribute","group_member_attribute","group_filter","member_attribute","AndFilter","group_class","group_member_user_attribute","group_base_dn","attributeKey","names","push","Array","isArray","el"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LdapIdentityProvider, User } from '@authup/core-kit';\nimport { UserError } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { template } from '@authup/kit';\nimport ldap from 'ldapjs';\nimport type { Filter } from 'ldapjs';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { ILdapClient } from '../../../../../ldap/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type { IdentityProviderLdapAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected provider : LdapIdentityProvider;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected client: ILdapClient;\n\n    constructor(ctx: IdentityProviderLdapAuthenticatorContext) {\n        super();\n\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n        this.client = ctx.clientFactory.create({\n            url: ctx.provider.url,\n            tls: ctx.provider.tls,\n            startTLS: ctx.provider.start_tls,\n            baseDn: ctx.provider.base_dn,\n            user: ctx.provider.user,\n            password: ctx.provider.password,\n            userNameAttribute: ctx.provider.user_name_attribute,\n        });\n    }\n\n    async authenticate(name: string, password: string) : Promise<User> {\n        let bind = await this.safeBind();\n        if (!bind.success) {\n            await this.safeUnbind();\n\n            throw UserError.credentialsInvalid();\n        }\n\n        const entity = await this.findOneByName(name);\n        if (!entity) {\n            throw UserError.credentialsInvalid();\n        }\n\n        const identity : IdentityProviderIdentity = {\n            id: entity.dn,\n            attributeCandidates: {\n                name: [\n                    entity[this.provider.user_name_attribute || 'cn'],\n                    this.extractCnFromDn(entity.dn),\n                ],\n                email: [\n                    entity[this.provider.user_mail_attribute || 'mail'],\n                ],\n            },\n            data: entity,\n            provider: this.provider,\n        };\n\n        try {\n            identity.roles = await this.findUserGroups(entity);\n        } catch {\n            // todo: log event\n        }\n\n        bind = await this.safeBind(identity.id, password);\n        await this.safeUnbind();\n\n        if (!bind.success) {\n            throw UserError.credentialsInvalid();\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    protected async bind(user?: string, password?: string) : Promise<void> {\n        if (!user) {\n            return this.client.bind();\n        }\n\n        if (!this.client.isDn(user)) {\n            const nameAttribute = this.provider.user_name_attribute || 'cn';\n            user = `${nameAttribute}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;\n        }\n\n        return this.client.bind(user, password);\n    }\n\n    protected async safeBind(user?: string, password?: string) : Promise<Result<null>> {\n        try {\n            await this.bind(user, password);\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async unbind() : Promise<void> {\n        return this.client.unbind();\n    }\n\n    protected async safeUnbind() : Promise<Result<null>> {\n        try {\n            await this.unbind();\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async findOneByName(input: string) : Promise<Record<string, any> | null> {\n        let filter : Filter | string;\n\n        if (this.provider.user_filter) {\n            filter = template(this.provider.user_filter, {\n                input,\n                name_attribute: this.provider.user_name_attribute || 'cn',\n                mail_attribute: this.provider.user_mail_attribute || 'mail',\n                display_name_attribute: this.provider.user_display_name_attribute || 'cn',\n            });\n        } else if (this.provider.user_name_attribute) {\n            filter = new ldap.EqualityFilter({\n                attribute: this.provider.user_name_attribute,\n                value: input,\n            });\n        } else {\n            filter = new ldap.OrFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'cn',\n                        value: input,\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: 'sAMAccountName',\n                        value: input,\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return null;\n        }\n\n        return entities[0];\n    }\n\n    protected extractCnFromDn(dn: string) : string | undefined {\n        const match = /^cn=([^,]+)/i.exec(dn);\n        return match ? match[1].trim() : undefined;\n    }\n\n    public async findUserGroups(user: Record<string, any>) : Promise<string[]> {\n        const nameAttribute = this.provider.group_name_attribute || 'cn';\n        const memberAttribute = this.provider.group_member_attribute || 'member';\n\n        let filter : Filter | string;\n        if (this.provider.group_filter) {\n            filter = template(this.provider.group_filter, {\n                ...user,\n                name_attribute: nameAttribute,\n                member_attribute: memberAttribute,\n            });\n        } else {\n            filter = new ldap.AndFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'objectClass',\n                        value: this.provider.group_class || 'group',\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: memberAttribute,\n                        value: user[this.provider.group_member_user_attribute || 'dn'],\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return [];\n        }\n\n        const attributeKey = this.provider.group_name_attribute || 'cn';\n        const names : string[] = [];\n        for (const entity of entities) {\n            const attribute = entity[attributeKey];\n            if (typeof attribute === 'undefined') {\n                continue;\n            }\n\n            if (typeof attribute === 'string') {\n                names.push(attribute);\n                continue;\n            }\n\n            if (Array.isArray(attribute)) {\n                names.push(...attribute.filter((el) => typeof el === 'string'));\n            }\n        }\n\n        return names;\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaI,oCAAb,cAAuDD,6BAAAA;CACzCE;CAEAC;CAEAC;CAEV,YAAYC,KAA+C;AACvD,SAAK;AAEL,OAAKF,iBAAiBE,IAAIF;AAC1B,OAAKD,WAAWG,IAAIH;AACpB,OAAKE,SAASC,IAAIC,cAAcC,OAAO;GACnCC,KAAKH,IAAIH,SAASM;GAClBC,KAAKJ,IAAIH,SAASO;GAClBC,UAAUL,IAAIH,SAASS;GACvBC,QAAQP,IAAIH,SAASW;GACrBC,MAAMT,IAAIH,SAASY;GACnBC,UAAUV,IAAIH,SAASa;GACvBC,mBAAmBX,IAAIH,SAASe;GACpC,CAAA;;CAGJ,MAAMC,aAAaC,MAAcJ,UAAkC;EAC/D,IAAIK,OAAO,MAAM,KAAKC,UAAQ;AAC9B,MAAI,CAACD,KAAKE,SAAS;AACf,SAAM,KAAKC,YAAU;AAErB,SAAM1B,UAAU2B,oBAAkB;;EAGtC,MAAMC,SAAS,MAAM,KAAKC,cAAcP,KAAAA;AACxC,MAAI,CAACM,OACD,OAAM5B,UAAU2B,oBAAkB;EAGtC,MAAMG,WAAsC;GACxCC,IAAIH,OAAOI;GACXC,qBAAqB;IACjBX,MAAM,CACFM,OAAO,KAAKvB,SAASe,uBAAuB,OAC5C,KAAKc,gBAAgBN,OAAOI,GAAE,CACjC;IACDG,OAAO,CACHP,OAAO,KAAKvB,SAAS+B,uBAAuB,QAC/C;IACL;GACAC,MAAMT;GACNvB,UAAU,KAAKA;GACnB;AAEA,MAAI;AACAyB,YAASQ,QAAQ,MAAM,KAAKC,eAAeX,OAAAA;UACvC;AAIRL,SAAO,MAAM,KAAKC,SAASM,SAASC,IAAIb,SAAAA;AACxC,QAAM,KAAKQ,YAAU;AAErB,MAAI,CAACH,KAAKE,QACN,OAAMzB,UAAU2B,oBAAkB;AAKtC,UAAOa,MAFe,KAAKlC,eAAemC,KAAKX,SAAAA,EAEhCb;;CAGnB,MAAgBM,KAAKN,MAAeC,UAAmC;AACnE,MAAI,CAACD,KACD,QAAO,KAAKV,OAAOgB,MAAI;AAG3B,MAAI,CAAC,KAAKhB,OAAOmC,KAAKzB,KAAAA,CAElBA,QAAO,GADe,KAAKZ,SAASe,uBAAuB,KACnC,GAAGH,KAAK,GAAG,KAAKV,OAAOqC,UAAU,KAAKvC,SAASwC,cAAc,KAAKxC,SAASW,QAAO;AAG9G,SAAO,KAAKT,OAAOgB,KAAKN,MAAMC,SAAAA;;CAGlC,MAAgBM,SAASP,MAAeC,UAA2C;AAC/E,MAAI;AACA,SAAM,KAAKK,KAAKN,MAAMC,SAAAA;AAEtB,UAAO;IACHO,SAAS;IACTY,MAAM;IACV;WACKS,GAAG;AACR,UAAO;IACHrB,SAAS;IACTsB,OAAOD;IACX;;;CAIR,MAAgBE,SAAyB;AACrC,SAAO,KAAKzC,OAAOyC,QAAM;;CAG7B,MAAgBtB,aAAqC;AACjD,MAAI;AACA,SAAM,KAAKsB,QAAM;AAEjB,UAAO;IACHvB,SAAS;IACTY,MAAM;IACV;WACKS,GAAG;AACR,UAAO;IACHrB,SAAS;IACTsB,OAAOD;IACX;;;CAIR,MAAgBjB,cAAcoB,OAAqD;EAC/E,IAAIC;AAEJ,MAAI,KAAK7C,SAAS8C,YACdD,UAASjD,SAAS,KAAKI,SAAS8C,aAAa;GACzCF;GACAG,gBAAgB,KAAK/C,SAASe,uBAAuB;GACrDiC,gBAAgB,KAAKhD,SAAS+B,uBAAuB;GACrDkB,wBAAwB,KAAKjD,SAASkD,+BAA+B;GACzE,CAAA;WACO,KAAKlD,SAASe,oBACrB8B,UAAS,IAAIhD,KAAKsD,eAAe;GAC7BC,WAAW,KAAKpD,SAASe;GACzBsC,OAAOT;GACX,CAAA;MAEAC,UAAS,IAAIhD,KAAKyD,SAAS,EACvBC,SAAS,CACL,IAAI1D,KAAKsD,eAAe;GACpBC,WAAW;GACXC,OAAOT;GACX,CAAA,EACA,IAAI/C,KAAKsD,eAAe;GACpBC,WAAW;GACXC,OAAOT;GACX,CAAA,CACH,EACL,CAAA;EAGJ,MAAMY,WAAW,MAAM,KAAKtD,OAAOuD,OAAO;GACtCZ;GACAa,OAAO;GACX,EAAG,KAAKxD,OAAOqC,UAAU,KAAKvC,SAASwC,cAAc,KAAKxC,SAASW,QAAO,CAAA;AAE1E,MAAI6C,SAASG,WAAW,EACpB,QAAO;AAGX,SAAOH,SAAS;;CAGV3B,gBAAgBF,IAAiC;EACvD,MAAMiC,QAAQ,eAAeC,KAAKlC,GAAAA;AAClC,SAAOiC,QAAQA,MAAM,GAAGE,MAAI,GAAKC,KAAAA;;CAGrC,MAAa7B,eAAetB,MAA+C;EACvE,MAAM0B,gBAAgB,KAAKtC,SAASgE,wBAAwB;EAC5D,MAAMC,kBAAkB,KAAKjE,SAASkE,0BAA0B;EAEhE,IAAIrB;AACJ,MAAI,KAAK7C,SAASmE,aACdtB,UAASjD,SAAS,KAAKI,SAASmE,cAAc;GAC1C,GAAGvD;GACHmC,gBAAgBT;GAChB8B,kBAAkBH;GACtB,CAAA;MAEApB,UAAS,IAAIhD,KAAKwE,UAAU,EACxBd,SAAS,CACL,IAAI1D,KAAKsD,eAAe;GACpBC,WAAW;GACXC,OAAO,KAAKrD,SAASsE,eAAe;GACxC,CAAA,EACA,IAAIzE,KAAKsD,eAAe;GACpBC,WAAWa;GACXZ,OAAOzC,KAAK,KAAKZ,SAASuE,+BAA+B;GAC7D,CAAA,CACH,EACL,CAAA;EAGJ,MAAMf,WAAW,MAAM,KAAKtD,OAAOuD,OAAO;GACtCZ;GACAa,OAAO;GACX,EAAG,KAAKxD,OAAOqC,UAAU,KAAKvC,SAASwE,eAAe,KAAKxE,SAASW,QAAO,CAAA;AAE3E,MAAI6C,SAASG,WAAW,EACpB,QAAO,EAAE;EAGb,MAAMc,eAAe,KAAKzE,SAASgE,wBAAwB;EAC3D,MAAMU,QAAmB,EAAE;AAC3B,OAAK,MAAMnD,UAAUiC,UAAU;GAC3B,MAAMJ,YAAY7B,OAAOkD;AACzB,OAAI,OAAOrB,cAAc,YACrB;AAGJ,OAAI,OAAOA,cAAc,UAAU;AAC/BsB,UAAMC,KAAKvB,UAAAA;AACX;;AAGJ,OAAIwB,MAAMC,QAAQzB,UAAAA,CACdsB,OAAMC,KAAI,GAAIvB,UAAUP,QAAQiC,OAAO,OAAOA,OAAO,SAAA,CAAA;;AAI7D,SAAOJ"}

package/dist/core/identity/provider/authentication/protocols/ldap/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/authentication/protocols/oauth2/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityProviderOAuth2Authenticator } from "./module.mjs";
+export { IdentityProviderOAuth2Authenticator };

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs

@@ -0,0 +1,62 @@
+import { buildIdentityProviderAuthorizeCallbackPath } from "@authup/core-kit";
+import { extractTokenPayload } from "@authup/server-kit";
+import { OAuth2Client } from "@hapic/oauth2";
+//#region src/core/identity/provider/authentication/protocols/oauth2/module.ts
+var IdentityProviderOAuth2Authenticator = class {
+	client;
+	options;
+	accountManager;
+	provider;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.accountManager = ctx.accountManager;
+		this.provider = ctx.provider;
+		this.client = new OAuth2Client({ options: {
+			clientId: ctx.provider.client_id,
+			clientSecret: ctx.provider.client_secret,
+			redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,
+			scope: ctx.provider.scope,
+			authorizationEndpoint: ctx.provider.authorize_url,
+			tokenEndpoint: ctx.provider.token_url,
+			userinfoEndpoint: ctx.provider.user_info_url || void 0
+		} });
+	}
+	buildRedirectURL(parameters = {}) {
+		return this.client.authorize.buildURL(parameters);
+	}
+	async authenticate(params) {
+		const token = await this.client.token.createWithAuthorizationCode(params);
+		const identity = await this.buildIdentityWithTokenGrantResponse(token);
+		if (this.options.clientId) identity.clientId = this.options.clientId;
+		return (await this.accountManager.save(identity)).user;
+	}
+	async safeAuthenticate(params) {
+		try {
+			return {
+				success: true,
+				data: await this.authenticate(params)
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: e
+			};
+		}
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: payload.sub,
+			attributeCandidates: {
+				name: [payload.sub],
+				email: [payload.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderOAuth2Authenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","undefined","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        return this.client.authorize.buildURL(parameters);\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAsBA,IAAaG,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;AACzD,OAAKH,UAAUG,IAAIH;AACnB,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,WAAWC,IAAID;AAEpB,OAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUd,2CAA2CQ,IAAID,SAASQ,GAAE;GAChGC,OAAOR,IAAID,SAASS;GACpBC,uBAAuBT,IAAID,SAASW;GACpCC,eAAeX,IAAID,SAASa;GAC5BC,kBAAkBb,IAAID,SAASe,iBAAiBC,KAAAA;GACpD,EACJ,CAAA;;CAKJC,iBAAiBC,aAA2C,EAAE,EAAW;AACrE,SAAO,KAAKrB,OAAOsB,UAAUC,SAASF,WAAAA;;CAK1C,MAAMG,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,OAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,MAAAA;AAChE,MAAI,KAAKzB,QAAQI,SACbuB,UAASvB,WAAW,KAAKJ,QAAQI;AAKrC,UAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,SAAAA,EAEhCI;;CAGnB,MAAMC,iBAAiBR,QAAoE;AACvF,MAAI;AAEA,UAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,OAAAA;IAIrC;WACKW,GAAG;AACR,UAAO;IACHD,SAAS;IACTE,OAAOD;IACX;;;CAMR,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,aAAY;AAEtD,SAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,IACX;IACDG,OAAO,CACHL,QAAQK,MACX;IACL;GACAV,MAAMK;GACNpC,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/protocols/oauth2/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/authentication/protocols/open-id/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityProviderOpenIDAuthenticator } from "./module.mjs";
+export { IdentityProviderOpenIDAuthenticator };

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs

@@ -0,0 +1,26 @@
+import { IdentityProviderOAuth2Authenticator } from "../oauth2/module.mjs";
+import "../oauth2/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/protocols/open-id/module.ts
+var IdentityProviderOpenIDAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	async buildIdentityWithTokenGrantResponse(input) {
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: payload.sub,
+			attributeCandidates: {
+				name: [
+					payload.preferred_username,
+					payload.nickname,
+					payload.sub
+				],
+				email: [payload.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderOpenIDAuthenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","buildIdentityWithTokenGrantResponse","input","payload","access_token","id","sub","attributeCandidates","name","preferred_username","nickname","email","data","provider"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';\n\nexport class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.preferred_username,\n                    payload.nickname,\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAYA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,MAAgBE,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUL,oBAAoBI,MAAME,aAAY;AAEtD,SAAO;GACHC,IAAIF,QAAQG;GACZC,qBAAqB;IACjBC,MAAM;KACFL,QAAQM;KACRN,QAAQO;KACRP,QAAQG;KACX;IACDK,OAAO,CACHR,QAAQQ,MACX;IACL;GACAC,MAAMT;GACNU,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/constants.mjs

@@ -0,0 +1,10 @@
+//#region src/core/identity/provider/constants.ts
+var IdentityProviderIdentityOperation = /* @__PURE__ */ function(IdentityProviderIdentityOperation) {
+	IdentityProviderIdentityOperation["CREATE"] = "create";
+	IdentityProviderIdentityOperation["UPDATE"] = "update";
+	return IdentityProviderIdentityOperation;
+}({});
+//#endregion
+export { IdentityProviderIdentityOperation };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/identity/provider/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["IdentityProviderIdentityOperation"],"sources":["../../../../src/core/identity/provider/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum IdentityProviderIdentityOperation {\n    CREATE = 'create',\n    UPDATE = 'update',\n}\n"],"mappings":";AAOA,IAAO,oCAAKA,yBAAAA,mCAAAA;;;QAAAA"}

package/dist/core/identity/provider/index.mjs

@@ -0,0 +1,21 @@
+import { IdentityProviderMapperOperation } from "./mapper/constants.mjs";
+import { IdentityProviderAccountBaseMapper } from "./mapper/base.mjs";
+import { IdentityProviderAttributeMapper } from "./mapper/attributes/module.mjs";
+import { IdentityProviderRoleMapper } from "./mapper/role/module.mjs";
+import { IdentityProviderPermissionMapper } from "./mapper/permission/module.mjs";
+import "./mapper/index.mjs";
+import { IdentityProviderAccountManager } from "./account/module.mjs";
+import "./account/index.mjs";
+import { IdentityProviderLdapAuthenticator } from "./authentication/protocols/ldap/module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./authentication/protocols/ldap/collection.mjs";
+import { IdentityProviderOAuth2Authenticator } from "./authentication/protocols/oauth2/module.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./authentication/protocols/open-id/module.mjs";
+import { IdentityProviderFacebookAuthenticator } from "./authentication/presets/facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./authentication/presets/github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./authentication/presets/google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./authentication/presets/instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./authentication/presets/paypal.mjs";
+import { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN } from "./authentication/constants.mjs";
+import { createIdentityProviderOAuth2Authenticator } from "./authentication/factory.mjs";
+import "./authentication/index.mjs";
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/provider/mapper/attributes/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityProviderAttributeMapper } from "./module.mjs";
+export { IdentityProviderAttributeMapper };