@authup/server-core 1.0.0-beta.36 → 1.0.0-beta.37

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs

@@ -0,0 +1,154 @@
+import { BaseCredentialsAuthenticator } from "../../../../../authentication/base.mjs";
+import "../../../../../authentication/index.mjs";
+import { UserError } from "@authup/core-kit";
+import { template } from "@authup/kit";
+import ldap from "ldapjs";
+//#region src/core/identity/provider/authentication/protocols/ldap/module.ts
+var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticator {
+	provider;
+	accountManager;
+	client;
+	constructor(ctx) {
+		super();
+		this.accountManager = ctx.accountManager;
+		this.provider = ctx.provider;
+		this.client = ctx.clientFactory.create({
+			url: ctx.provider.url,
+			tls: ctx.provider.tls,
+			startTLS: ctx.provider.start_tls,
+			baseDn: ctx.provider.base_dn,
+			user: ctx.provider.user,
+			password: ctx.provider.password,
+			userNameAttribute: ctx.provider.user_name_attribute
+		});
+	}
+	async authenticate(name, password) {
+		let bind = await this.safeBind();
+		if (!bind.success) {
+			await this.safeUnbind();
+			throw UserError.credentialsInvalid();
+		}
+		const entity = await this.findOneByName(name);
+		if (!entity) throw UserError.credentialsInvalid();
+		const identity = {
+			id: entity.dn,
+			attributeCandidates: {
+				name: [entity[this.provider.user_name_attribute || "cn"], this.extractCnFromDn(entity.dn)],
+				email: [entity[this.provider.user_mail_attribute || "mail"]]
+			},
+			data: entity,
+			provider: this.provider
+		};
+		try {
+			identity.roles = await this.findUserGroups(entity);
+		} catch {}
+		bind = await this.safeBind(identity.id, password);
+		await this.safeUnbind();
+		if (!bind.success) throw UserError.credentialsInvalid();
+		return (await this.accountManager.save(identity)).user;
+	}
+	async bind(user, password) {
+		if (!user) return this.client.bind();
+		if (!this.client.isDn(user)) user = `${this.provider.user_name_attribute || "cn"}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;
+		return this.client.bind(user, password);
+	}
+	async safeBind(user, password) {
+		try {
+			await this.bind(user, password);
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: e
+			};
+		}
+	}
+	async unbind() {
+		return this.client.unbind();
+	}
+	async safeUnbind() {
+		try {
+			await this.unbind();
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: e
+			};
+		}
+	}
+	async findOneByName(input) {
+		let filter;
+		if (this.provider.user_filter) filter = template(this.provider.user_filter, {
+			input,
+			name_attribute: this.provider.user_name_attribute || "cn",
+			mail_attribute: this.provider.user_mail_attribute || "mail",
+			display_name_attribute: this.provider.user_display_name_attribute || "cn"
+		});
+		else if (this.provider.user_name_attribute) filter = new ldap.EqualityFilter({
+			attribute: this.provider.user_name_attribute,
+			value: input
+		});
+		else filter = new ldap.OrFilter({ filters: [new ldap.EqualityFilter({
+			attribute: "cn",
+			value: input
+		}), new ldap.EqualityFilter({
+			attribute: "sAMAccountName",
+			value: input
+		})] });
+		const entities = await this.client.search({
+			filter,
+			scope: "sub"
+		}, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));
+		if (entities.length === 0) return null;
+		return entities[0];
+	}
+	extractCnFromDn(dn) {
+		const match = /^cn=([^,]+)/i.exec(dn);
+		return match ? match[1].trim() : void 0;
+	}
+	async findUserGroups(user) {
+		const nameAttribute = this.provider.group_name_attribute || "cn";
+		const memberAttribute = this.provider.group_member_attribute || "member";
+		let filter;
+		if (this.provider.group_filter) filter = template(this.provider.group_filter, {
+			...user,
+			name_attribute: nameAttribute,
+			member_attribute: memberAttribute
+		});
+		else filter = new ldap.AndFilter({ filters: [new ldap.EqualityFilter({
+			attribute: "objectClass",
+			value: this.provider.group_class || "group"
+		}), new ldap.EqualityFilter({
+			attribute: memberAttribute,
+			value: user[this.provider.group_member_user_attribute || "dn"]
+		})] });
+		const entities = await this.client.search({
+			filter,
+			scope: "sub"
+		}, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));
+		if (entities.length === 0) return [];
+		const attributeKey = this.provider.group_name_attribute || "cn";
+		const names = [];
+		for (const entity of entities) {
+			const attribute = entity[attributeKey];
+			if (typeof attribute === "undefined") continue;
+			if (typeof attribute === "string") {
+				names.push(attribute);
+				continue;
+			}
+			if (Array.isArray(attribute)) names.push(...attribute.filter((el) => typeof el === "string"));
+		}
+		return names;
+	}
+};
+//#endregion
+export { IdentityProviderLdapAuthenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["UserError","template","ldap","BaseCredentialsAuthenticator","IdentityProviderLdapAuthenticator","provider","accountManager","client","ctx","clientFactory","create","url","tls","startTLS","start_tls","baseDn","base_dn","user","password","userNameAttribute","user_name_attribute","authenticate","name","bind","safeBind","success","safeUnbind","credentialsInvalid","entity","findOneByName","identity","id","dn","attributeCandidates","extractCnFromDn","email","user_mail_attribute","data","roles","findUserGroups","account","save","isDn","nameAttribute","resolveDn","user_base_dn","e","error","unbind","input","filter","user_filter","name_attribute","mail_attribute","display_name_attribute","user_display_name_attribute","EqualityFilter","attribute","value","OrFilter","filters","entities","search","scope","length","match","exec","trim","undefined","group_name_attribute","memberAttribute","group_member_attribute","group_filter","member_attribute","AndFilter","group_class","group_member_user_attribute","group_base_dn","attributeKey","names","push","Array","isArray","el"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LdapIdentityProvider, User } from '@authup/core-kit';\nimport { UserError } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { template } from '@authup/kit';\nimport ldap from 'ldapjs';\nimport type { Filter } from 'ldapjs';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { ILdapClient } from '../../../../../ldap/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type { IdentityProviderLdapAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected provider : LdapIdentityProvider;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected client: ILdapClient;\n\n    constructor(ctx: IdentityProviderLdapAuthenticatorContext) {\n        super();\n\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n        this.client = ctx.clientFactory.create({\n            url: ctx.provider.url,\n            tls: ctx.provider.tls,\n            startTLS: ctx.provider.start_tls,\n            baseDn: ctx.provider.base_dn,\n            user: ctx.provider.user,\n            password: ctx.provider.password,\n            userNameAttribute: ctx.provider.user_name_attribute,\n        });\n    }\n\n    async authenticate(name: string, password: string) : Promise<User> {\n        let bind = await this.safeBind();\n        if (!bind.success) {\n            await this.safeUnbind();\n\n            throw UserError.credentialsInvalid();\n        }\n\n        const entity = await this.findOneByName(name);\n        if (!entity) {\n            throw UserError.credentialsInvalid();\n        }\n\n        const identity : IdentityProviderIdentity = {\n            id: entity.dn,\n            attributeCandidates: {\n                name: [\n                    entity[this.provider.user_name_attribute || 'cn'],\n                    this.extractCnFromDn(entity.dn),\n                ],\n                email: [\n                    entity[this.provider.user_mail_attribute || 'mail'],\n                ],\n            },\n            data: entity,\n            provider: this.provider,\n        };\n\n        try {\n            identity.roles = await this.findUserGroups(entity);\n        } catch {\n            // todo: log event\n        }\n\n        bind = await this.safeBind(identity.id, password);\n        await this.safeUnbind();\n\n        if (!bind.success) {\n            throw UserError.credentialsInvalid();\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    protected async bind(user?: string, password?: string) : Promise<void> {\n        if (!user) {\n            return this.client.bind();\n        }\n\n        if (!this.client.isDn(user)) {\n            const nameAttribute = this.provider.user_name_attribute || 'cn';\n            user = `${nameAttribute}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;\n        }\n\n        return this.client.bind(user, password);\n    }\n\n    protected async safeBind(user?: string, password?: string) : Promise<Result<null>> {\n        try {\n            await this.bind(user, password);\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async unbind() : Promise<void> {\n        return this.client.unbind();\n    }\n\n    protected async safeUnbind() : Promise<Result<null>> {\n        try {\n            await this.unbind();\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async findOneByName(input: string) : Promise<Record<string, any> | null> {\n        let filter : Filter | string;\n\n        if (this.provider.user_filter) {\n            filter = template(this.provider.user_filter, {\n                input,\n                name_attribute: this.provider.user_name_attribute || 'cn',\n                mail_attribute: this.provider.user_mail_attribute || 'mail',\n                display_name_attribute: this.provider.user_display_name_attribute || 'cn',\n            });\n        } else if (this.provider.user_name_attribute) {\n            filter = new ldap.EqualityFilter({\n                attribute: this.provider.user_name_attribute,\n                value: input,\n            });\n        } else {\n            filter = new ldap.OrFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'cn',\n                        value: input,\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: 'sAMAccountName',\n                        value: input,\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return null;\n        }\n\n        return entities[0];\n    }\n\n    protected extractCnFromDn(dn: string) : string | undefined {\n        const match = /^cn=([^,]+)/i.exec(dn);\n        return match ? match[1].trim() : undefined;\n    }\n\n    public async findUserGroups(user: Record<string, any>) : Promise<string[]> {\n        const nameAttribute = this.provider.group_name_attribute || 'cn';\n        const memberAttribute = this.provider.group_member_attribute || 'member';\n\n        let filter : Filter | string;\n        if (this.provider.group_filter) {\n            filter = template(this.provider.group_filter, {\n                ...user,\n                name_attribute: nameAttribute,\n                member_attribute: memberAttribute,\n            });\n        } else {\n            filter = new ldap.AndFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'objectClass',\n                        value: this.provider.group_class || 'group',\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: memberAttribute,\n                        value: user[this.provider.group_member_user_attribute || 'dn'],\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return [];\n        }\n\n        const attributeKey = this.provider.group_name_attribute || 'cn';\n        const names : string[] = [];\n        for (const entity of entities) {\n            const attribute = entity[attributeKey];\n            if (typeof attribute === 'undefined') {\n                continue;\n            }\n\n            if (typeof attribute === 'string') {\n                names.push(attribute);\n                continue;\n            }\n\n            if (Array.isArray(attribute)) {\n                names.push(...attribute.filter((el) => typeof el === 'string'));\n            }\n        }\n\n        return names;\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaI,oCAAb,cAAuDD,6BAAAA;CACzCE;CAEAC;CAEAC;CAEV,YAAYC,KAA+C;AACvD,SAAK;AAEL,OAAKF,iBAAiBE,IAAIF;AAC1B,OAAKD,WAAWG,IAAIH;AACpB,OAAKE,SAASC,IAAIC,cAAcC,OAAO;GACnCC,KAAKH,IAAIH,SAASM;GAClBC,KAAKJ,IAAIH,SAASO;GAClBC,UAAUL,IAAIH,SAASS;GACvBC,QAAQP,IAAIH,SAASW;GACrBC,MAAMT,IAAIH,SAASY;GACnBC,UAAUV,IAAIH,SAASa;GACvBC,mBAAmBX,IAAIH,SAASe;GACpC,CAAA;;CAGJ,MAAMC,aAAaC,MAAcJ,UAAkC;EAC/D,IAAIK,OAAO,MAAM,KAAKC,UAAQ;AAC9B,MAAI,CAACD,KAAKE,SAAS;AACf,SAAM,KAAKC,YAAU;AAErB,SAAM1B,UAAU2B,oBAAkB;;EAGtC,MAAMC,SAAS,MAAM,KAAKC,cAAcP,KAAAA;AACxC,MAAI,CAACM,OACD,OAAM5B,UAAU2B,oBAAkB;EAGtC,MAAMG,WAAsC;GACxCC,IAAIH,OAAOI;GACXC,qBAAqB;IACjBX,MAAM,CACFM,OAAO,KAAKvB,SAASe,uBAAuB,OAC5C,KAAKc,gBAAgBN,OAAOI,GAAE,CACjC;IACDG,OAAO,CACHP,OAAO,KAAKvB,SAAS+B,uBAAuB,QAC/C;IACL;GACAC,MAAMT;GACNvB,UAAU,KAAKA;GACnB;AAEA,MAAI;AACAyB,YAASQ,QAAQ,MAAM,KAAKC,eAAeX,OAAAA;UACvC;AAIRL,SAAO,MAAM,KAAKC,SAASM,SAASC,IAAIb,SAAAA;AACxC,QAAM,KAAKQ,YAAU;AAErB,MAAI,CAACH,KAAKE,QACN,OAAMzB,UAAU2B,oBAAkB;AAKtC,UAAOa,MAFe,KAAKlC,eAAemC,KAAKX,SAAAA,EAEhCb;;CAGnB,MAAgBM,KAAKN,MAAeC,UAAmC;AACnE,MAAI,CAACD,KACD,QAAO,KAAKV,OAAOgB,MAAI;AAG3B,MAAI,CAAC,KAAKhB,OAAOmC,KAAKzB,KAAAA,CAElBA,QAAO,GADe,KAAKZ,SAASe,uBAAuB,KACnC,GAAGH,KAAK,GAAG,KAAKV,OAAOqC,UAAU,KAAKvC,SAASwC,cAAc,KAAKxC,SAASW,QAAO;AAG9G,SAAO,KAAKT,OAAOgB,KAAKN,MAAMC,SAAAA;;CAGlC,MAAgBM,SAASP,MAAeC,UAA2C;AAC/E,MAAI;AACA,SAAM,KAAKK,KAAKN,MAAMC,SAAAA;AAEtB,UAAO;IACHO,SAAS;IACTY,MAAM;IACV;WACKS,GAAG;AACR,UAAO;IACHrB,SAAS;IACTsB,OAAOD;IACX;;;CAIR,MAAgBE,SAAyB;AACrC,SAAO,KAAKzC,OAAOyC,QAAM;;CAG7B,MAAgBtB,aAAqC;AACjD,MAAI;AACA,SAAM,KAAKsB,QAAM;AAEjB,UAAO;IACHvB,SAAS;IACTY,MAAM;IACV;WACKS,GAAG;AACR,UAAO;IACHrB,SAAS;IACTsB,OAAOD;IACX;;;CAIR,MAAgBjB,cAAcoB,OAAqD;EAC/E,IAAIC;AAEJ,MAAI,KAAK7C,SAAS8C,YACdD,UAASjD,SAAS,KAAKI,SAAS8C,aAAa;GACzCF;GACAG,gBAAgB,KAAK/C,SAASe,uBAAuB;GACrDiC,gBAAgB,KAAKhD,SAAS+B,uBAAuB;GACrDkB,wBAAwB,KAAKjD,SAASkD,+BAA+B;GACzE,CAAA;WACO,KAAKlD,SAASe,oBACrB8B,UAAS,IAAIhD,KAAKsD,eAAe;GAC7BC,WAAW,KAAKpD,SAASe;GACzBsC,OAAOT;GACX,CAAA;MAEAC,UAAS,IAAIhD,KAAKyD,SAAS,EACvBC,SAAS,CACL,IAAI1D,KAAKsD,eAAe;GACpBC,WAAW;GACXC,OAAOT;GACX,CAAA,EACA,IAAI/C,KAAKsD,eAAe;GACpBC,WAAW;GACXC,OAAOT;GACX,CAAA,CACH,EACL,CAAA;EAGJ,MAAMY,WAAW,MAAM,KAAKtD,OAAOuD,OAAO;GACtCZ;GACAa,OAAO;GACX,EAAG,KAAKxD,OAAOqC,UAAU,KAAKvC,SAASwC,cAAc,KAAKxC,SAASW,QAAO,CAAA;AAE1E,MAAI6C,SAASG,WAAW,EACpB,QAAO;AAGX,SAAOH,SAAS;;CAGV3B,gBAAgBF,IAAiC;EACvD,MAAMiC,QAAQ,eAAeC,KAAKlC,GAAAA;AAClC,SAAOiC,QAAQA,MAAM,GAAGE,MAAI,GAAKC,KAAAA;;CAGrC,MAAa7B,eAAetB,MAA+C;EACvE,MAAM0B,gBAAgB,KAAKtC,SAASgE,wBAAwB;EAC5D,MAAMC,kBAAkB,KAAKjE,SAASkE,0BAA0B;EAEhE,IAAIrB;AACJ,MAAI,KAAK7C,SAASmE,aACdtB,UAASjD,SAAS,KAAKI,SAASmE,cAAc;GAC1C,GAAGvD;GACHmC,gBAAgBT;GAChB8B,kBAAkBH;GACtB,CAAA;MAEApB,UAAS,IAAIhD,KAAKwE,UAAU,EACxBd,SAAS,CACL,IAAI1D,KAAKsD,eAAe;GACpBC,WAAW;GACXC,OAAO,KAAKrD,SAASsE,eAAe;GACxC,CAAA,EACA,IAAIzE,KAAKsD,eAAe;GACpBC,WAAWa;GACXZ,OAAOzC,KAAK,KAAKZ,SAASuE,+BAA+B;GAC7D,CAAA,CACH,EACL,CAAA;EAGJ,MAAMf,WAAW,MAAM,KAAKtD,OAAOuD,OAAO;GACtCZ;GACAa,OAAO;GACX,EAAG,KAAKxD,OAAOqC,UAAU,KAAKvC,SAASwE,eAAe,KAAKxE,SAASW,QAAO,CAAA;AAE3E,MAAI6C,SAASG,WAAW,EACpB,QAAO,EAAE;EAGb,MAAMc,eAAe,KAAKzE,SAASgE,wBAAwB;EAC3D,MAAMU,QAAmB,EAAE;AAC3B,OAAK,MAAMnD,UAAUiC,UAAU;GAC3B,MAAMJ,YAAY7B,OAAOkD;AACzB,OAAI,OAAOrB,cAAc,YACrB;AAGJ,OAAI,OAAOA,cAAc,UAAU;AAC/BsB,UAAMC,KAAKvB,UAAAA;AACX;;AAGJ,OAAIwB,MAAMC,QAAQzB,UAAAA,CACdsB,OAAMC,KAAI,GAAIvB,UAAUP,QAAQiC,OAAO,OAAOA,OAAO,SAAA,CAAA;;AAI7D,SAAOJ"}

package/dist/core/identity/provider/authentication/protocols/ldap/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/authentication/protocols/oauth2/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityProviderOAuth2Authenticator } from "./module.mjs";
+export { IdentityProviderOAuth2Authenticator };

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs

@@ -0,0 +1,62 @@
+import { buildIdentityProviderAuthorizeCallbackPath } from "@authup/core-kit";
+import { extractTokenPayload } from "@authup/server-kit";
+import { OAuth2Client } from "@hapic/oauth2";
+//#region src/core/identity/provider/authentication/protocols/oauth2/module.ts
+var IdentityProviderOAuth2Authenticator = class {
+	client;
+	options;
+	accountManager;
+	provider;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.accountManager = ctx.accountManager;
+		this.provider = ctx.provider;
+		this.client = new OAuth2Client({ options: {
+			clientId: ctx.provider.client_id,
+			clientSecret: ctx.provider.client_secret,
+			redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,
+			scope: ctx.provider.scope,
+			authorizationEndpoint: ctx.provider.authorize_url,
+			tokenEndpoint: ctx.provider.token_url,
+			userinfoEndpoint: ctx.provider.user_info_url || void 0
+		} });
+	}
+	buildRedirectURL(parameters = {}) {
+		return this.client.authorize.buildURL(parameters);
+	}
+	async authenticate(params) {
+		const token = await this.client.token.createWithAuthorizationCode(params);
+		const identity = await this.buildIdentityWithTokenGrantResponse(token);
+		if (this.options.clientId) identity.clientId = this.options.clientId;
+		return (await this.accountManager.save(identity)).user;
+	}
+	async safeAuthenticate(params) {
+		try {
+			return {
+				success: true,
+				data: await this.authenticate(params)
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: e
+			};
+		}
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: payload.sub,
+			attributeCandidates: {
+				name: [payload.sub],
+				email: [payload.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderOAuth2Authenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","undefined","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        return this.client.authorize.buildURL(parameters);\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAsBA,IAAaG,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;AACzD,OAAKH,UAAUG,IAAIH;AACnB,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,WAAWC,IAAID;AAEpB,OAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUd,2CAA2CQ,IAAID,SAASQ,GAAE;GAChGC,OAAOR,IAAID,SAASS;GACpBC,uBAAuBT,IAAID,SAASW;GACpCC,eAAeX,IAAID,SAASa;GAC5BC,kBAAkBb,IAAID,SAASe,iBAAiBC,KAAAA;GACpD,EACJ,CAAA;;CAKJC,iBAAiBC,aAA2C,EAAE,EAAW;AACrE,SAAO,KAAKrB,OAAOsB,UAAUC,SAASF,WAAAA;;CAK1C,MAAMG,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,OAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,MAAAA;AAChE,MAAI,KAAKzB,QAAQI,SACbuB,UAASvB,WAAW,KAAKJ,QAAQI;AAKrC,UAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,SAAAA,EAEhCI;;CAGnB,MAAMC,iBAAiBR,QAAoE;AACvF,MAAI;AAEA,UAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,OAAAA;IAIrC;WACKW,GAAG;AACR,UAAO;IACHD,SAAS;IACTE,OAAOD;IACX;;;CAMR,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,aAAY;AAEtD,SAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,IACX;IACDG,OAAO,CACHL,QAAQK,MACX;IACL;GACAV,MAAMK;GACNpC,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/protocols/oauth2/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/authentication/protocols/open-id/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityProviderOpenIDAuthenticator } from "./module.mjs";
+export { IdentityProviderOpenIDAuthenticator };

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs

@@ -0,0 +1,26 @@
+import { IdentityProviderOAuth2Authenticator } from "../oauth2/module.mjs";
+import "../oauth2/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/protocols/open-id/module.ts
+var IdentityProviderOpenIDAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	async buildIdentityWithTokenGrantResponse(input) {
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: payload.sub,
+			attributeCandidates: {
+				name: [
+					payload.preferred_username,
+					payload.nickname,
+					payload.sub
+				],
+				email: [payload.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderOpenIDAuthenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","buildIdentityWithTokenGrantResponse","input","payload","access_token","id","sub","attributeCandidates","name","preferred_username","nickname","email","data","provider"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';\n\nexport class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.preferred_username,\n                    payload.nickname,\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAYA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,MAAgBE,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUL,oBAAoBI,MAAME,aAAY;AAEtD,SAAO;GACHC,IAAIF,QAAQG;GACZC,qBAAqB;IACjBC,MAAM;KACFL,QAAQM;KACRN,QAAQO;KACRP,QAAQG;KACX;IACDK,OAAO,CACHR,QAAQQ,MACX;IACL;GACAC,MAAMT;GACNU,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/constants.mjs

@@ -0,0 +1,10 @@
+//#region src/core/identity/provider/constants.ts
+var IdentityProviderIdentityOperation = /* @__PURE__ */ function(IdentityProviderIdentityOperation) {
+	IdentityProviderIdentityOperation["CREATE"] = "create";
+	IdentityProviderIdentityOperation["UPDATE"] = "update";
+	return IdentityProviderIdentityOperation;
+}({});
+//#endregion
+export { IdentityProviderIdentityOperation };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/identity/provider/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["IdentityProviderIdentityOperation"],"sources":["../../../../src/core/identity/provider/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum IdentityProviderIdentityOperation {\n    CREATE = 'create',\n    UPDATE = 'update',\n}\n"],"mappings":";AAOA,IAAO,oCAAKA,yBAAAA,mCAAAA;;;QAAAA"}

package/dist/core/identity/provider/index.mjs

@@ -0,0 +1,21 @@
+import { IdentityProviderMapperOperation } from "./mapper/constants.mjs";
+import { IdentityProviderAccountBaseMapper } from "./mapper/base.mjs";
+import { IdentityProviderAttributeMapper } from "./mapper/attributes/module.mjs";
+import { IdentityProviderRoleMapper } from "./mapper/role/module.mjs";
+import { IdentityProviderPermissionMapper } from "./mapper/permission/module.mjs";
+import "./mapper/index.mjs";
+import { IdentityProviderAccountManager } from "./account/module.mjs";
+import "./account/index.mjs";
+import { IdentityProviderLdapAuthenticator } from "./authentication/protocols/ldap/module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./authentication/protocols/ldap/collection.mjs";
+import { IdentityProviderOAuth2Authenticator } from "./authentication/protocols/oauth2/module.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./authentication/protocols/open-id/module.mjs";
+import { IdentityProviderFacebookAuthenticator } from "./authentication/presets/facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./authentication/presets/github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./authentication/presets/google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./authentication/presets/instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./authentication/presets/paypal.mjs";
+import { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN } from "./authentication/constants.mjs";
+import { createIdentityProviderOAuth2Authenticator } from "./authentication/factory.mjs";
+import "./authentication/index.mjs";
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/provider/mapper/attributes/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityProviderAttributeMapper } from "./module.mjs";
+export { IdentityProviderAttributeMapper };

package/dist/core/identity/provider/mapper/attributes/module.mjs

@@ -0,0 +1,27 @@
+import { IdentityProviderAccountBaseMapper } from "../base.mjs";
+//#region src/core/identity/provider/mapper/attributes/module.ts
+var IdentityProviderAttributeMapper = class extends IdentityProviderAccountBaseMapper {
+	repository;
+	constructor(repository) {
+		super();
+		this.repository = repository;
+	}
+	async execute(identity) {
+		const entities = await this.repository.findByProviderId(identity.provider.id);
+		const items = [];
+		for (const entity of entities) {
+			const [operation, value] = this.resolve(identity, entity);
+			items.push({
+				key: entity.target_name,
+				value: entity.target_value ? entity.target_value : value,
+				realmId: entity.provider_realm_id,
+				operation
+			});
+		}
+		return items;
+	}
+};
+//#endregion
+export { IdentityProviderAttributeMapper };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/mapper/attributes/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderAttributeMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","value","resolve","push","key","target_name","target_value","realmId","provider_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/attributes/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderAttributeMappingRepository } from './types.ts';\n\nexport class IdentityProviderAttributeMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderAttributeMappingRepository;\n\n    constructor(repository: IIdentityProviderAttributeMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation, value] = this.resolve(identity, entity);\n\n            items.push({\n                key: entity.target_name,\n                value: entity.target_value ? entity.target_value : value,\n                realmId: entity.provider_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;AAWA,IAAaC,kCAAb,cAAqDD,kCAAAA;CACvCE;CAEV,YAAYA,YAAyD;AACjE,SAAK;AAEL,OAAKA,aAAaA;;CAGtB,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,GAAE;EAE5E,MAAMC,QAA0C,EAAE;AAClD,OAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,WAAWC,SAAS,KAAKC,QAAQT,UAAUM,OAAAA;AAElDD,SAAMK,KAAK;IACPC,KAAKL,OAAOM;IACZJ,OAAOF,OAAOO,eAAeP,OAAOO,eAAeL;IACnDM,SAASR,OAAOS;IAChBR;IACJ,CAAA;;AAGJ,SAAOF"}

package/dist/core/identity/provider/mapper/attributes/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/mapper/base.mjs

@@ -0,0 +1,26 @@
+import { IdentityProviderIdentityOperation } from "../constants.mjs";
+import { IdentityProviderMapperOperation } from "./constants.mjs";
+import { IdentityProviderMappingSyncMode } from "@authup/core-kit";
+import { getJWTClaimByPattern } from "@authup/specs";
+//#region src/core/identity/provider/mapper/base.ts
+var IdentityProviderAccountBaseMapper = class {
+	resolve(identity, mapping) {
+		let operation;
+		if (mapping.synchronization_mode === IdentityProviderMappingSyncMode.ONCE && identity.operation === IdentityProviderIdentityOperation.UPDATE) {
+			operation = IdentityProviderMapperOperation.NONE;
+			return [operation];
+		}
+		if (!mapping.name || !mapping.value) {
+			operation = IdentityProviderMapperOperation.CREATE;
+			return [operation];
+		}
+		const value = getJWTClaimByPattern(identity.data, mapping.name, mapping.value, mapping.value_is_regex);
+		if (value.length === 0) operation = IdentityProviderMapperOperation.DELETE;
+		else operation = IdentityProviderMapperOperation.CREATE;
+		return [operation, value];
+	}
+};
+//#endregion
+export { IdentityProviderAccountBaseMapper };
+
+//# sourceMappingURL=base.mjs.map

package/dist/core/identity/provider/mapper/base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.mjs","names":["IdentityProviderMappingSyncMode","getJWTClaimByPattern","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountBaseMapper","resolve","identity","mapping","operation","synchronization_mode","ONCE","UPDATE","NONE","name","value","CREATE","data","value_is_regex","length","DELETE"],"sources":["../../../../../src/core/identity/provider/mapper/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderBaseMapping } from '@authup/core-kit';\nimport { IdentityProviderMappingSyncMode } from '@authup/core-kit';\nimport { getJWTClaimByPattern } from '@authup/specs';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport { IdentityProviderMapperOperation } from './constants.ts';\nimport type { IIdentityProviderMapper, IdentityProviderMapperElement } from './types.ts';\n\nexport abstract class IdentityProviderAccountBaseMapper implements IIdentityProviderMapper {\n    protected resolve(\n        identity: IdentityProviderIdentity,\n        mapping: IdentityProviderBaseMapping,\n    ) : [IdentityProviderMapperOperation, unknown] | [IdentityProviderMapperOperation] {\n        let operation : IdentityProviderMapperOperation;\n        if (\n            mapping.synchronization_mode === IdentityProviderMappingSyncMode.ONCE &&\n            identity.operation === IdentityProviderIdentityOperation.UPDATE\n        ) {\n            operation = IdentityProviderMapperOperation.NONE;\n\n            return [operation];\n        }\n\n        if (!mapping.name || !mapping.value) {\n            operation = IdentityProviderMapperOperation.CREATE;\n\n            return [operation];\n        }\n\n        const value = getJWTClaimByPattern(\n            identity.data,\n            mapping.name,\n            mapping.value,\n            mapping.value_is_regex,\n        );\n\n        if (value.length === 0) {\n            operation = IdentityProviderMapperOperation.DELETE;\n        } else {\n            operation = IdentityProviderMapperOperation.CREATE;\n        }\n\n        return [operation, value];\n    }\n\n    abstract execute(\n        identity: IdentityProviderIdentity\n    ): Promise<IdentityProviderMapperElement[]>;\n}\n"],"mappings":";;;;;AAeA,IAAsBI,oCAAtB,MAAsBA;CACRC,QACNC,UACAC,SAC+E;EAC/E,IAAIC;AACJ,MACID,QAAQE,yBAAyBT,gCAAgCU,QACjEJ,SAASE,cAAcN,kCAAkCS,QAC3D;AACEH,eAAYL,gCAAgCS;AAE5C,UAAO,CAACJ,UAAU;;AAGtB,MAAI,CAACD,QAAQM,QAAQ,CAACN,QAAQO,OAAO;AACjCN,eAAYL,gCAAgCY;AAE5C,UAAO,CAACP,UAAU;;EAGtB,MAAMM,QAAQb,qBACVK,SAASU,MACTT,QAAQM,MACRN,QAAQO,OACRP,QAAQU,eAAc;AAG1B,MAAIH,MAAMI,WAAW,EACjBV,aAAYL,gCAAgCgB;MAE5CX,aAAYL,gCAAgCY;AAGhD,SAAO,CAACP,WAAWM,MAAM"}

package/dist/core/identity/provider/mapper/constants.mjs

@@ -0,0 +1,11 @@
+//#region src/core/identity/provider/mapper/constants.ts
+var IdentityProviderMapperOperation = /* @__PURE__ */ function(IdentityProviderMapperOperation) {
+	IdentityProviderMapperOperation["NONE"] = "none";
+	IdentityProviderMapperOperation["DELETE"] = "delete";
+	IdentityProviderMapperOperation["CREATE"] = "create";
+	return IdentityProviderMapperOperation;
+}({});
+//#endregion
+export { IdentityProviderMapperOperation };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/identity/provider/mapper/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["IdentityProviderMapperOperation"],"sources":["../../../../../src/core/identity/provider/mapper/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum IdentityProviderMapperOperation {\n    NONE = 'none',\n    DELETE = 'delete',\n    CREATE = 'create',\n}\n"],"mappings":";AAOA,IAAO,kCAAKA,yBAAAA,iCAAAA;;;;QAAAA"}

package/dist/core/identity/provider/mapper/index.mjs

@@ -0,0 +1,9 @@
+import { IdentityProviderMapperOperation } from "./constants.mjs";
+import { IdentityProviderAccountBaseMapper } from "./base.mjs";
+import { IdentityProviderAttributeMapper } from "./attributes/module.mjs";
+import "./attributes/index.mjs";
+import { IdentityProviderRoleMapper } from "./role/module.mjs";
+import "./role/index.mjs";
+import { IdentityProviderPermissionMapper } from "./permission/module.mjs";
+import "./permission/index.mjs";
+export { IdentityProviderAccountBaseMapper, IdentityProviderAttributeMapper, IdentityProviderMapperOperation, IdentityProviderPermissionMapper, IdentityProviderRoleMapper };

package/dist/core/identity/provider/mapper/permission/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityProviderPermissionMapper } from "./module.mjs";
+export { IdentityProviderPermissionMapper };

package/dist/core/identity/provider/mapper/permission/module.mjs

@@ -0,0 +1,26 @@
+import { IdentityProviderAccountBaseMapper } from "../base.mjs";
+//#region src/core/identity/provider/mapper/permission/module.ts
+var IdentityProviderPermissionMapper = class extends IdentityProviderAccountBaseMapper {
+	repository;
+	constructor(repository) {
+		super();
+		this.repository = repository;
+	}
+	async execute(identity) {
+		const entities = await this.repository.findByProviderId(identity.provider.id);
+		const items = [];
+		for (const entity of entities) {
+			const [operation] = this.resolve(identity, entity);
+			items.push({
+				value: entity.permission_id,
+				realmId: entity.permission_realm_id,
+				operation
+			});
+		}
+		return items;
+	}
+};
+//#endregion
+export { IdentityProviderPermissionMapper };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/mapper/permission/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderPermissionMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","permission_id","realmId","permission_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderPermissionMappingRepository } from './types.ts';\n\nexport class IdentityProviderPermissionMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderPermissionMappingRepository;\n\n    constructor(repository: IIdentityProviderPermissionMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.permission_id,\n                realmId: entity.permission_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;AAYA,IAAaC,mCAAb,cAAsDD,kCAAAA;CACxCE;CAEV,YAAYA,YAA0D;AAClE,SAAK;AAEL,OAAKA,aAAaA;;CAGtB,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,GAAE;EAE5E,MAAMC,QAA0C,EAAE;AAClD,OAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,OAAAA;AAE3CD,SAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;IACJ,CAAA;;AAGJ,SAAOF"}

package/dist/core/identity/provider/mapper/permission/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/mapper/role/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityProviderRoleMapper } from "./module.mjs";
+export { IdentityProviderRoleMapper };

package/dist/core/identity/provider/mapper/role/module.mjs

@@ -0,0 +1,26 @@
+import { IdentityProviderAccountBaseMapper } from "../base.mjs";
+//#region src/core/identity/provider/mapper/role/module.ts
+var IdentityProviderRoleMapper = class extends IdentityProviderAccountBaseMapper {
+	finder;
+	constructor(finder) {
+		super();
+		this.finder = finder;
+	}
+	async execute(identity) {
+		const entities = await this.finder.findByProviderId(identity.provider.id);
+		const items = [];
+		for (const entity of entities) {
+			const [operation] = this.resolve(identity, entity);
+			items.push({
+				value: entity.role_id,
+				realmId: entity.role_realm_id,
+				operation
+			});
+		}
+		return items;
+	}
+};
+//#endregion
+export { IdentityProviderRoleMapper };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/mapper/role/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderRoleMapper","finder","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","role_id","realmId","role_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderRoleMappingFinder } from './types.ts';\n\nexport class IdentityProviderRoleMapper extends IdentityProviderAccountBaseMapper {\n    protected finder: IIdentityProviderRoleMappingFinder;\n\n    constructor(finder: IIdentityProviderRoleMappingFinder) {\n        super();\n\n        this.finder = finder;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.finder.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.role_id,\n                realmId: entity.role_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;AAYA,IAAaC,6BAAb,cAAgDD,kCAAAA;CAClCE;CAEV,YAAYA,QAA4C;AACpD,SAAK;AAEL,OAAKA,SAASA;;CAGlB,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,OAAOI,iBAAiBF,SAASG,SAASC,GAAE;EAExE,MAAMC,QAA0C,EAAE;AAClD,OAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,OAAAA;AAE3CD,SAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;IACJ,CAAA;;AAGJ,SAAOF"}

package/dist/core/identity/provider/mapper/role/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/mapper/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/registration/index.mjs

@@ -0,0 +1,2 @@
+import { RegistrationService } from "./service.mjs";
+export { RegistrationService };

package/dist/core/identity/registration/service.mjs

@@ -0,0 +1,68 @@
+import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { UserValidator } from "@authup/core-kit";
+import { createNanoID } from "@authup/kit";
+import { BadRequestError, NotFoundError } from "@ebec/http";
+import { Container } from "validup";
+import { randomBytes } from "node:crypto";
+//#region src/core/identity/registration/service.ts
+var RegistrationService = class {
+	options;
+	mailClient;
+	repository;
+	realmRepository;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.mailClient = ctx.mailClient;
+		this.repository = ctx.repository;
+		this.realmRepository = ctx.realmRepository;
+	}
+	async register(data) {
+		if (!this.options.registrationEnabled) throw new BadRequestError("User registration is not enabled.");
+		const validator = new Container({});
+		validator.mount(new UserValidator({ pathsToInclude: [
+			"email",
+			"name",
+			"password",
+			"realm_id"
+		] }));
+		const validated = await validator.run(data, { group: "create" });
+		await this.repository.validateJoinColumns(validated);
+		if (this.options.emailVerificationEnabled) {
+			validated.active = false;
+			validated.activate_hash = randomBytes(32).toString("hex");
+		} else validated.active = true;
+		const entity = this.repository.create(validated);
+		const credentialsService = new UserCredentialsService();
+		entity.password = entity.password || createNanoID(64);
+		entity.password = await credentialsService.protect(entity.password);
+		entity.realm_id = (await this.realmRepository.resolve(entity.realm_id, true)).id;
+		await this.repository.save(entity);
+		if (this.options.emailVerificationEnabled) try {
+			await this.mailClient.send({
+				to: entity.email,
+				subject: "Registration - Activation code",
+				html: `
+                    <p>Please use the code below to activate your account and start using the site.</p>
+                    <p>${entity.activate_hash}</p>
+                    `
+			});
+		} catch {
+			await this.repository.remove(entity);
+			throw new BadRequestError("Registration failed. Could not send activation email.");
+		}
+		return { active: entity.active };
+	}
+	async activate(data) {
+		const entity = await this.repository.findOneBy({ activate_hash: data.token });
+		if (!entity) throw new NotFoundError();
+		const merged = this.repository.merge(entity, {
+			active: true,
+			activate_hash: null
+		});
+		await this.repository.save(merged);
+	}
+};
+//#endregion
+export { RegistrationService };
+
+//# sourceMappingURL=service.mjs.map