@authup/server-core 1.0.0-beta.36 → 1.0.0-beta.38

package/dist/core/identity/permission/types.d.ts

@@ -1,5 +1,10 @@
-import type { Policy, Role } from '@authup/core-kit';
+import type { Policy } from '@authup/core-kit';
 import type { IdentityPolicyData, PermissionPolicyBinding } from '@authup/access';
+import type { IClientRepository } from '../../entities/client/types.ts';
+import type { IRobotRepository } from '../../entities/robot/types.ts';
+import type { IRoleRepository } from '../../entities/role/types.ts';
+import type { IUserRepository } from '../../entities/user/types.ts';
+import type { IIdentityRoleProvider } from '../role/types.ts';
 export type ResolveJunctionPolicyOptions = {
     name: string;
     realmId?: string | null;
@@ -10,18 +15,11 @@ export interface IIdentityPermissionProvider {
     isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData): Promise<boolean>;
     resolveJunctionPolicy(identity: IdentityPolicyData, options: ResolveJunctionPolicyOptions): Promise<Policy | undefined>;
 }
-export interface IIdentityBindingRepository {
-    getBoundPermissions(entity: string): Promise<PermissionPolicyBinding[]>;
-    getBoundRoles(entity: string): Promise<Role[]>;
-}
-export interface IRoleBindingRepository {
-    getBoundPermissions(entity: string | Role): Promise<PermissionPolicyBinding[]>;
-    getBoundPermissionsForMany(entities: (string | Role)[]): Promise<PermissionPolicyBinding[]>;
-}
 export type IdentityPermissionProviderContext = {
-    clientRepository: IIdentityBindingRepository;
-    userRepository: IIdentityBindingRepository;
-    robotRepository: IIdentityBindingRepository;
-    roleRepository: IRoleBindingRepository;
+    clientRepository: IClientRepository;
+    userRepository: IUserRepository;
+    robotRepository: IRobotRepository;
+    roleRepository: IRoleRepository;
+    roleProvider: IIdentityRoleProvider;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/identity/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACzE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC3H;AAED,MAAM,WAAW,0BAA0B;IACvC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACxE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,sBAAsB;IACnC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC/E,0BAA0B,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CAC/F;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,cAAc,EAAE,0BAA0B,CAAC;IAC3C,eAAe,EAAE,0BAA0B,CAAC;IAC5C,cAAc,EAAE,sBAAsB,CAAC;CAC1C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACzE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC3H;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,EAAE,gBAAgB,CAAC;IAClC,cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,EAAE,qBAAqB,CAAC;CACvC,CAAC"}

package/dist/core/identity/permission/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/account/index.mjs

@@ -0,0 +1,2 @@
+import { IdentityProviderAccountManager } from "./module.mjs";
+export { IdentityProviderAccountManager };

package/dist/core/identity/provider/account/module.mjs

@@ -0,0 +1,141 @@
+import { IdentityProviderIdentityOperation } from "../constants.mjs";
+import { IdentityProviderMapperOperation } from "../mapper/constants.mjs";
+import "../mapper/index.mjs";
+import { UserValidator, ValidatorGroup, buildUserFakeEmail, isUserFakeEmail } from "@authup/core-kit";
+import { createNanoID, extendObject } from "@authup/kit";
+import { isValidupError, stringifyPath } from "validup";
+//#region src/core/identity/provider/account/module.ts
+var IdentityProviderAccountManager = class {
+	attributesMapper;
+	permissionMapper;
+	roleMapper;
+	repository;
+	userRepository;
+	userValidator;
+	constructor(ctx) {
+		this.attributesMapper = ctx.attributeMapper;
+		this.permissionMapper = ctx.permissionMapper;
+		this.roleMapper = ctx.roleMapper;
+		this.repository = ctx.repository;
+		this.userRepository = ctx.userRepository;
+		this.userValidator = new UserValidator();
+	}
+	async save(identity) {
+		let account = await this.repository.findOneByProviderIdentity(identity);
+		if (account) {
+			identity.operation = IdentityProviderIdentityOperation.UPDATE;
+			account.user = await this.saveUser(identity, account.user);
+			await this.repository.save(account);
+			await this.saveRoles(identity, account.user);
+			await this.savePermissions(identity, account.user);
+			return account;
+		}
+		identity.operation = IdentityProviderIdentityOperation.CREATE;
+		const user = await this.saveUser(identity);
+		account = await this.repository.save({
+			provider_id: identity.provider.id,
+			provider_user_id: identity.id,
+			provider_user_name: user.name,
+			provider_realm_id: identity.provider.realm_id,
+			user,
+			user_id: user.id,
+			user_realm_id: user.realm_id
+		});
+		await this.saveRoles(identity, account.user);
+		await this.savePermissions(identity, account.user);
+		return account;
+	}
+	async saveUser(identity, user) {
+		const attributes = await this.attributesMapper.execute(identity);
+		const entity = {};
+		for (const attribute of attributes) if (attribute.key && attribute.operation === IdentityProviderMapperOperation.CREATE) entity[attribute.key] = attribute.value;
+		if (!user) {
+			entity.realm_id = identity.provider.realm_id;
+			entity.active = true;
+			entity.name_locked = true;
+			entity.client_id = identity.clientId || null;
+		}
+		const attributesSelf = await this.validateAttributes(entity, identity, 10);
+		if (!attributesSelf) throw new Error("Identity provider attributes could not be validated.");
+		const attributesSelfKeys = Object.keys(attributesSelf);
+		const attributesExtra = {};
+		const entityKeys = Object.keys(entity);
+		for (const entityKey of entityKeys) {
+			if (attributesSelfKeys.indexOf(entityKey) !== -1) continue;
+			attributesExtra[entityKey] = entity[entityKey];
+		}
+		let output;
+		if (user) output = extendObject(user, attributesSelf);
+		else output = attributesSelf;
+		let attempts = Math.max((identity.attributeCandidates?.name?.length || 0) + 1, 10);
+		while (attempts > 0) try {
+			return await this.userRepository.saveOneWithEA(output, attributesExtra);
+		} catch {
+			const names = identity.attributeCandidates?.name || [];
+			if (names.length > 0) while (names.length > 0) {
+				output.name = `${names.shift()}`;
+				try {
+					await this.userValidator.run(output, { group: identity.operation === IdentityProviderIdentityOperation.CREATE ? ValidatorGroup.CREATE : ValidatorGroup.UPDATE });
+					break;
+				} catch {}
+			}
+			else output.name = createNanoID("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_", 10);
+			if (isUserFakeEmail(output.email)) output.email = buildUserFakeEmail(output.name);
+			attempts -= 1;
+		}
+		throw new Error("The user account could not be created due a conflict error.");
+	}
+	async validateAttributes(entity, identity, attempts) {
+		attempts--;
+		if (attempts <= 0) return null;
+		try {
+			return await this.userValidator.run(entity, { group: identity.operation === IdentityProviderIdentityOperation.CREATE ? ValidatorGroup.CREATE : ValidatorGroup.UPDATE });
+		} catch (e) {
+			if (!isValidupError(e)) return null;
+			let retry = false;
+			for (let i = 0; i < e.issues.length; i++) {
+				const child = e.issues[i];
+				const pathNormalized = stringifyPath(child.path);
+				if (Array.isArray(entity[pathNormalized]) && entity[pathNormalized].length > 0) {
+					const [first, ...rest] = entity[pathNormalized];
+					entity[pathNormalized] = first;
+					if (rest.length > 0) {
+						if (!identity.attributeCandidates) identity.attributeCandidates = {};
+						if (!identity.attributeCandidates[pathNormalized]) identity.attributeCandidates[pathNormalized] = [];
+						identity.attributeCandidates[pathNormalized].push(...rest);
+					}
+					retry = true;
+					break;
+				}
+				if (identity.attributeCandidates && identity.attributeCandidates[pathNormalized] && identity.attributeCandidates[pathNormalized].length > 0) {
+					entity[pathNormalized] = identity.attributeCandidates[pathNormalized].shift();
+					retry = true;
+					break;
+				}
+				if (entity.name && pathNormalized === "email") {
+					entity[pathNormalized] = buildUserFakeEmail(entity.name);
+					retry = true;
+					break;
+				}
+				if (entity[pathNormalized]) {
+					entity[pathNormalized] = null;
+					break;
+				}
+			}
+			if (retry) return this.validateAttributes(entity, identity, attempts);
+			return null;
+		}
+	}
+	async savePermissions(identity, user) {
+		const entities = await this.permissionMapper.execute(identity);
+		await this.userRepository.savePermissions(user, entities);
+	}
+	async saveRoles(identity, user) {
+		const entities = await this.roleMapper.execute(identity);
+		await this.userRepository.saveRoles(user, entities);
+	}
+};
+//#endregion
+export { IdentityProviderAccountManager };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/account/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["UserValidator","ValidatorGroup","buildUserFakeEmail","isUserFakeEmail","createNanoID","extendObject","isValidupError","stringifyPath","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountManager","attributesMapper","permissionMapper","roleMapper","repository","userRepository","userValidator","ctx","attributeMapper","save","identity","account","findOneByProviderIdentity","operation","UPDATE","user","saveUser","saveRoles","savePermissions","CREATE","provider_id","provider","id","provider_user_id","provider_user_name","name","provider_realm_id","realm_id","user_id","user_realm_id","attributes","execute","entity","attribute","key","value","active","name_locked","client_id","clientId","attributesSelf","validateAttributes","Error","attributesSelfKeys","Object","keys","attributesExtra","entityKeys","entityKey","index","indexOf","output","attempts","Math","max","attributeCandidates","length","saveOneWithEA","names","shift","run","group","email","e","retry","i","issues","child","pathNormalized","path","Array","isArray","first","rest","push","entities"],"sources":["../../../../../src/core/identity/provider/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount, User } from '@authup/core-kit';\nimport {\n    UserValidator, \n    ValidatorGroup,\n    buildUserFakeEmail, \n    isUserFakeEmail,\n} from '@authup/core-kit';\nimport { createNanoID, extendObject } from '@authup/kit';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { IUserIdentityRepository } from '../../entities/index.ts';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IIdentityProviderMapper } from '../mapper/index.ts';\nimport { IdentityProviderMapperOperation } from '../mapper/index.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';\n\nexport class IdentityProviderAccountManager implements IIdentityProviderAccountManager {\n    protected attributesMapper : IIdentityProviderMapper;\n\n    protected permissionMapper : IIdentityProviderMapper;\n\n    protected roleMapper : IIdentityProviderMapper;\n\n    protected repository : IIdentityProviderAccountRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected userValidator : UserValidator;\n\n    constructor(ctx: IdentityProviderAccountManagerContext) {\n        this.attributesMapper = ctx.attributeMapper;\n        this.permissionMapper = ctx.permissionMapper;\n        this.roleMapper = ctx.roleMapper;\n        this.repository = ctx.repository;\n        this.userRepository = ctx.userRepository;\n\n        this.userValidator = new UserValidator();\n    }\n\n    async save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount> {\n        let account = await this.repository.findOneByProviderIdentity(identity);\n        if (account) {\n            identity.operation = IdentityProviderIdentityOperation.UPDATE;\n\n            account.user = await this.saveUser(identity, account.user);\n\n            await this.repository.save(account);\n\n            await this.saveRoles(identity, account.user);\n            await this.savePermissions(identity, account.user);\n\n            return account;\n        }\n\n        identity.operation = IdentityProviderIdentityOperation.CREATE;\n\n        const user = await this.saveUser(identity);\n\n        account = await this.repository.save({\n            provider_id: identity.provider.id,\n            provider_user_id: identity.id,\n            provider_user_name: user.name, // todo: parse identity.name\n            provider_realm_id: identity.provider.realm_id,\n            user,\n            user_id: user.id,\n            user_realm_id: user.realm_id,\n        });\n\n        await this.saveRoles(identity, account.user);\n        await this.savePermissions(identity, account.user);\n\n        return account;\n    }\n\n    async saveUser(\n        identity: IdentityProviderIdentity,\n        user?: User,\n    ): Promise<User> {\n        const attributes = await this.attributesMapper.execute(\n            identity,\n        );\n\n        const entity : Record<string, any> = {};\n        for (const attribute of attributes) {\n            if (\n                attribute.key &&\n                attribute.operation === IdentityProviderMapperOperation.CREATE\n            ) {\n                // attribute value might be object, array, ...\n                entity[attribute.key] = attribute.value;\n            }\n        }\n\n        if (!user) {\n            entity.realm_id = identity.provider.realm_id;\n            entity.active = true;\n            entity.name_locked = true;\n            entity.client_id = identity.clientId || null;\n        }\n\n        const attributesSelf = await this.validateAttributes(entity, identity, 10);\n        if (!attributesSelf) {\n            // todo: better error name\n            throw new Error('Identity provider attributes could not be validated.');\n        }\n        const attributesSelfKeys = Object.keys(attributesSelf);\n\n        const attributesExtra : Record<string, any> = {};\n\n        const entityKeys = Object.keys(entity);\n        for (const entityKey of entityKeys) {\n            const index = attributesSelfKeys.indexOf(entityKey);\n            if (index !== -1) {\n                continue;\n            }\n\n            attributesExtra[entityKey] = entity[entityKey];\n        }\n\n        let output : User;\n        if (user) {\n            output = extendObject(user, attributesSelf);\n        } else {\n            output = attributesSelf;\n        }\n\n        let attempts = Math.max((identity.attributeCandidates?.name?.length || 0) + 1, 10);\n        while (attempts > 0) {\n            try {\n                // todo: we also need to remove existing ones via idp login flow ( but not other attributes!)\n                return await this.userRepository.saveOneWithEA(output, attributesExtra);\n            } catch {\n                const names = identity.attributeCandidates?.name || [];\n                if (names.length > 0) {\n                    while (names.length > 0) {\n                        output.name = `${names.shift()}`;\n\n                        try {\n                            await this.userValidator.run(output, {\n                                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                                    ValidatorGroup.CREATE :\n                                    ValidatorGroup.UPDATE,\n                            });\n                            break;\n                        } catch {\n                            // todo: do nothing.\n                        }\n                    }\n                } else {\n                    output.name = createNanoID('0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_', 10);\n                }\n\n                if (isUserFakeEmail(output.email)) {\n                    output.email = buildUserFakeEmail(output.name);\n                }\n\n                attempts -= 1;\n            }\n        }\n\n        throw new Error('The user account could not be created due a conflict error.');\n    }\n\n    async validateAttributes(\n        entity: Record<string, any>,\n        identity: IdentityProviderIdentity,\n        attempts: number,\n    ) : Promise<User | null> {\n        attempts--;\n        if (attempts <= 0) {\n            return null;\n        }\n\n        try {\n            return await this.userValidator.run(entity, {\n                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                    ValidatorGroup.CREATE :\n                    ValidatorGroup.UPDATE,\n            });\n        } catch (e: any) {\n            if (!isValidupError(e)) {\n                return null;\n            }\n\n            let retry = false;\n            for (let i = 0; i < e.issues.length; i++) {\n                const child = e.issues[i];\n\n                const pathNormalized = stringifyPath(child.path);\n\n                if (\n                    Array.isArray(entity[pathNormalized]) &&\n                    entity[pathNormalized].length > 0\n                ) {\n                    const [first, ...rest] = entity[pathNormalized];\n                    entity[pathNormalized] = first;\n\n                    if (rest.length > 0) {\n                        if (!identity.attributeCandidates) {\n                            identity.attributeCandidates = {};\n                        }\n\n                        if (!identity.attributeCandidates[pathNormalized]) {\n                            identity.attributeCandidates[pathNormalized] = [];\n                        }\n\n                        identity.attributeCandidates[pathNormalized]!.push(...rest);\n                    }\n\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    identity.attributeCandidates &&\n                    identity.attributeCandidates[pathNormalized] &&\n                    identity.attributeCandidates[pathNormalized]!.length > 0\n                ) {\n                    entity[pathNormalized] = identity.attributeCandidates[pathNormalized]!.shift();\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    entity.name &&\n                    pathNormalized === 'email'\n                ) {\n                    entity[pathNormalized] = buildUserFakeEmail(entity.name);\n                    retry = true;\n                    break;\n                }\n\n                if (entity[pathNormalized]) {\n                    entity[pathNormalized] = null;\n                    break;\n                }\n            }\n\n            if (retry) {\n                return this.validateAttributes(entity, identity, attempts);\n            }\n\n            return null;\n        }\n    }\n\n    async savePermissions(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.permissionMapper.execute(identity);\n\n        await this.userRepository.savePermissions(user, entities);\n    }\n\n    async saveRoles(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.roleMapper.execute(identity);\n\n        await this.userRepository.saveRoles(user, entities);\n    }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaU,iCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;AACpD,OAAKN,mBAAmBM,IAAIC;AAC5B,OAAKN,mBAAmBK,IAAIL;AAC5B,OAAKC,aAAaI,IAAIJ;AACtB,OAAKC,aAAaG,IAAIH;AACtB,OAAKC,iBAAiBE,IAAIF;AAE1B,OAAKC,gBAAgB,IAAIhB,eAAAA;;CAG7B,MAAMmB,KAAKC,UAAsE;EAC7E,IAAIC,UAAU,MAAM,KAAKP,WAAWQ,0BAA0BF,SAAAA;AAC9D,MAAIC,SAAS;AACTD,YAASG,YAAYf,kCAAkCgB;AAEvDH,WAAQI,OAAO,MAAM,KAAKC,SAASN,UAAUC,QAAQI,KAAI;AAEzD,SAAM,KAAKX,WAAWK,KAAKE,QAAAA;AAE3B,SAAM,KAAKM,UAAUP,UAAUC,QAAQI,KAAI;AAC3C,SAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,KAAI;AAEjD,UAAOJ;;AAGXD,WAASG,YAAYf,kCAAkCqB;EAEvD,MAAMJ,OAAO,MAAM,KAAKC,SAASN,SAAAA;AAEjCC,YAAU,MAAM,KAAKP,WAAWK,KAAK;GACjCW,aAAaV,SAASW,SAASC;GAC/BC,kBAAkBb,SAASY;GAC3BE,oBAAoBT,KAAKU;GACzBC,mBAAmBhB,SAASW,SAASM;GACrCZ;GACAa,SAASb,KAAKO;GACdO,eAAed,KAAKY;GACxB,CAAA;AAEA,QAAM,KAAKV,UAAUP,UAAUC,QAAQI,KAAI;AAC3C,QAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,KAAI;AAEjD,SAAOJ;;CAGX,MAAMK,SACFN,UACAK,MACa;EACb,MAAMe,aAAa,MAAM,KAAK7B,iBAAiB8B,QAC3CrB,SAAAA;EAGJ,MAAMsB,SAA+B,EAAC;AACtC,OAAK,MAAMC,aAAaH,WACpB,KACIG,UAAUC,OACVD,UAAUpB,cAAcd,gCAAgCoB,OAGxDa,QAAOC,UAAUC,OAAOD,UAAUE;AAI1C,MAAI,CAACpB,MAAM;AACPiB,UAAOL,WAAWjB,SAASW,SAASM;AACpCK,UAAOI,SAAS;AAChBJ,UAAOK,cAAc;AACrBL,UAAOM,YAAY5B,SAAS6B,YAAY;;EAG5C,MAAMC,iBAAiB,MAAM,KAAKC,mBAAmBT,QAAQtB,UAAU,GAAA;AACvE,MAAI,CAAC8B,eAED,OAAM,IAAIE,MAAM,uDAAA;EAEpB,MAAMC,qBAAqBC,OAAOC,KAAKL,eAAAA;EAEvC,MAAMM,kBAAwC,EAAC;EAE/C,MAAMC,aAAaH,OAAOC,KAAKb,OAAAA;AAC/B,OAAK,MAAMgB,aAAaD,YAAY;AAEhC,OADcJ,mBAAmBO,QAAQF,UACrCC,KAAU,GACV;AAGJH,mBAAgBE,aAAahB,OAAOgB;;EAGxC,IAAIG;AACJ,MAAIpC,KACAoC,UAASxD,aAAaoB,MAAMyB,eAAAA;MAE5BW,UAASX;EAGb,IAAIY,WAAWC,KAAKC,KAAK5C,SAAS6C,qBAAqB9B,MAAM+B,UAAU,KAAK,GAAG,GAAA;AAC/E,SAAOJ,WAAW,EACd,KAAI;AAEA,UAAO,MAAM,KAAK/C,eAAeoD,cAAcN,QAAQL,gBAAAA;UACnD;GACJ,MAAMY,QAAQhD,SAAS6C,qBAAqB9B,QAAQ,EAAE;AACtD,OAAIiC,MAAMF,SAAS,EACf,QAAOE,MAAMF,SAAS,GAAG;AACrBL,WAAO1B,OAAO,GAAGiC,MAAMC,OAAK;AAE5B,QAAI;AACA,WAAM,KAAKrD,cAAcsD,IAAIT,QAAQ,EACjCU,OAAOnD,SAASG,cAAcf,kCAAkCqB,SAC5D5B,eAAe4B,SACf5B,eAAeuB,QACvB,CAAA;AACA;YACI;;OAKZqC,QAAO1B,OAAO/B,aAAa,oEAAoE,GAAA;AAGnG,OAAID,gBAAgB0D,OAAOW,MAAK,CAC5BX,QAAOW,QAAQtE,mBAAmB2D,OAAO1B,KAAI;AAGjD2B,eAAY;;AAIpB,QAAM,IAAIV,MAAM,8DAAA;;CAGpB,MAAMD,mBACFT,QACAtB,UACA0C,UACqB;AACrBA;AACA,MAAIA,YAAY,EACZ,QAAO;AAGX,MAAI;AACA,UAAO,MAAM,KAAK9C,cAAcsD,IAAI5B,QAAQ,EACxC6B,OAAOnD,SAASG,cAAcf,kCAAkCqB,SAC5D5B,eAAe4B,SACf5B,eAAeuB,QACvB,CAAA;WACKiD,GAAQ;AACb,OAAI,CAACnE,eAAemE,EAAAA,CAChB,QAAO;GAGX,IAAIC,QAAQ;AACZ,QAAK,IAAIC,IAAI,GAAGA,IAAIF,EAAEG,OAAOV,QAAQS,KAAK;IACtC,MAAME,QAAQJ,EAAEG,OAAOD;IAEvB,MAAMG,iBAAiBvE,cAAcsE,MAAME,KAAI;AAE/C,QACIC,MAAMC,QAAQvC,OAAOoC,gBAAe,IACpCpC,OAAOoC,gBAAgBZ,SAAS,GAClC;KACE,MAAM,CAACgB,OAAO,GAAGC,QAAQzC,OAAOoC;AAChCpC,YAAOoC,kBAAkBI;AAEzB,SAAIC,KAAKjB,SAAS,GAAG;AACjB,UAAI,CAAC9C,SAAS6C,oBACV7C,UAAS6C,sBAAsB,EAAC;AAGpC,UAAI,CAAC7C,SAAS6C,oBAAoBa,gBAC9B1D,UAAS6C,oBAAoBa,kBAAkB,EAAE;AAGrD1D,eAAS6C,oBAAoBa,gBAAiBM,KAAI,GAAID,KAAAA;;AAG1DT,aAAQ;AACR;;AAGJ,QACItD,SAAS6C,uBACT7C,SAAS6C,oBAAoBa,mBAC7B1D,SAAS6C,oBAAoBa,gBAAiBZ,SAAS,GACzD;AACExB,YAAOoC,kBAAkB1D,SAAS6C,oBAAoBa,gBAAiBT,OAAK;AAC5EK,aAAQ;AACR;;AAGJ,QACIhC,OAAOP,QACP2C,mBAAmB,SACrB;AACEpC,YAAOoC,kBAAkB5E,mBAAmBwC,OAAOP,KAAI;AACvDuC,aAAQ;AACR;;AAGJ,QAAIhC,OAAOoC,iBAAiB;AACxBpC,YAAOoC,kBAAkB;AACzB;;;AAIR,OAAIJ,MACA,QAAO,KAAKvB,mBAAmBT,QAAQtB,UAAU0C,SAAAA;AAGrD,UAAO;;;CAIf,MAAMlC,gBACFR,UACAK,MACF;EACE,MAAM4D,WAAW,MAAM,KAAKzE,iBAAiB6B,QAAQrB,SAAAA;AAErD,QAAM,KAAKL,eAAea,gBAAgBH,MAAM4D,SAAAA;;CAGpD,MAAM1D,UACFP,UACAK,MACF;EACE,MAAM4D,WAAW,MAAM,KAAKxE,WAAW4B,QAAQrB,SAAAA;AAE/C,QAAM,KAAKL,eAAeY,UAAUF,MAAM4D,SAAAA"}

package/dist/core/identity/provider/account/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/identity/provider/authentication/constants.mjs

@@ -0,0 +1,7 @@
+import { TypedToken } from "eldin";
+//#region src/core/identity/provider/authentication/constants.ts
+const IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN = new TypedToken("IdentityProviderLdapCollectionAuthenticator");
+//#endregion
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/identity/provider/authentication/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["TypedToken","IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN"],"sources":["../../../../../src/core/identity/provider/authentication/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { IdentityProviderLdapCollectionAuthenticator } from './protocols/ldap/index.ts';\n\nexport const IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN = new TypedToken<IdentityProviderLdapCollectionAuthenticator>('IdentityProviderLdapCollectionAuthenticator');\n"],"mappings":";;AAUA,MAAaC,wDAAwD,IAAID,WAAwD,8CAAA"}

package/dist/core/identity/provider/authentication/factory.mjs

@@ -0,0 +1,24 @@
+import { IdentityProviderOAuth2Authenticator } from "./protocols/oauth2/module.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./protocols/open-id/module.mjs";
+import "./protocols/index.mjs";
+import { IdentityProviderFacebookAuthenticator } from "./presets/facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./presets/github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./presets/google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./presets/instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./presets/paypal.mjs";
+import "./presets/index.mjs";
+import { IdentityProviderPreset, IdentityProviderProtocol } from "@authup/core-kit";
+//#region src/core/identity/provider/authentication/factory.ts
+function createIdentityProviderOAuth2Authenticator(ctx) {
+	if (ctx.provider.preset === IdentityProviderPreset.FACEBOOK) return new IdentityProviderFacebookAuthenticator(ctx);
+	if (ctx.provider.preset === IdentityProviderPreset.GITHUB) return new IdentityProviderGithubAuthenticator(ctx);
+	if (ctx.provider.preset === IdentityProviderPreset.GOOGLE) return new IdentityProviderGoogleAuthenticator(ctx);
+	if (ctx.provider.preset === IdentityProviderPreset.INSTAGRAM) return new IdentityProviderInstagramAuthenticator(ctx);
+	if (ctx.provider.preset === IdentityProviderPreset.PAYPAL) return new IdentityProviderPaypalAuthenticator(ctx);
+	if (ctx.provider.protocol === IdentityProviderProtocol.OIDC) return new IdentityProviderOpenIDAuthenticator(ctx);
+	return new IdentityProviderOAuth2Authenticator(ctx);
+}
+//#endregion
+export { createIdentityProviderOAuth2Authenticator };
+
+//# sourceMappingURL=factory.mjs.map

package/dist/core/identity/provider/authentication/factory.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.mjs","names":["IdentityProviderPreset","IdentityProviderProtocol","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","IdentityProviderFacebookAuthenticator","IdentityProviderGithubAuthenticator","IdentityProviderGoogleAuthenticator","IdentityProviderInstagramAuthenticator","IdentityProviderPaypalAuthenticator","createIdentityProviderOAuth2Authenticator","ctx","provider","preset","FACEBOOK","GITHUB","GOOGLE","INSTAGRAM","PAYPAL","protocol","OIDC"],"sources":["../../../../../src/core/identity/provider/authentication/factory.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { IdentityProviderPreset, IdentityProviderProtocol } from '@authup/core-kit';\nimport type { IOAuth2Authenticator, IdentityProviderOAuth2AuthenticatorContext } from './protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator } from './protocols/index.ts';\nimport {\n    IdentityProviderFacebookAuthenticator,\n    IdentityProviderGithubAuthenticator,\n    IdentityProviderGoogleAuthenticator,\n    IdentityProviderInstagramAuthenticator,\n    IdentityProviderPaypalAuthenticator,\n} from './presets/index.ts';\n\nexport function createIdentityProviderOAuth2Authenticator(ctx: IdentityProviderOAuth2AuthenticatorContext) : IOAuth2Authenticator<User> {\n    if (ctx.provider.preset === IdentityProviderPreset.FACEBOOK) {\n        return new IdentityProviderFacebookAuthenticator(ctx);\n    }\n\n    if (ctx.provider.preset === IdentityProviderPreset.GITHUB) {\n        return new IdentityProviderGithubAuthenticator(ctx);\n    }\n\n    if (ctx.provider.preset === IdentityProviderPreset.GOOGLE) {\n        return new IdentityProviderGoogleAuthenticator(ctx);\n    }\n\n    if (ctx.provider.preset === IdentityProviderPreset.INSTAGRAM) {\n        return new IdentityProviderInstagramAuthenticator(ctx);\n    }\n\n    if (ctx.provider.preset === IdentityProviderPreset.PAYPAL) {\n        return new IdentityProviderPaypalAuthenticator(ctx);\n    }\n\n    if (ctx.provider.protocol === IdentityProviderProtocol.OIDC) {\n        return new IdentityProviderOpenIDAuthenticator(ctx);\n    }\n\n    return new IdentityProviderOAuth2Authenticator(ctx);\n}\n"],"mappings":";;;;;;;;;;;AAmBA,SAAgBS,0CAA0CC,KAA+C;AACrG,KAAIA,IAAIC,SAASC,WAAWZ,uBAAuBa,SAC/C,QAAO,IAAIT,sCAAsCM,IAAAA;AAGrD,KAAIA,IAAIC,SAASC,WAAWZ,uBAAuBc,OAC/C,QAAO,IAAIT,oCAAoCK,IAAAA;AAGnD,KAAIA,IAAIC,SAASC,WAAWZ,uBAAuBe,OAC/C,QAAO,IAAIT,oCAAoCI,IAAAA;AAGnD,KAAIA,IAAIC,SAASC,WAAWZ,uBAAuBgB,UAC/C,QAAO,IAAIT,uCAAuCG,IAAAA;AAGtD,KAAIA,IAAIC,SAASC,WAAWZ,uBAAuBiB,OAC/C,QAAO,IAAIT,oCAAoCE,IAAAA;AAGnD,KAAIA,IAAIC,SAASO,aAAajB,yBAAyBkB,KACnD,QAAO,IAAIhB,oCAAoCO,IAAAA;AAGnD,QAAO,IAAIR,oCAAoCQ,IAAAA"}

package/dist/core/identity/provider/authentication/index.mjs

@@ -0,0 +1,14 @@
+import { IdentityProviderLdapAuthenticator } from "./protocols/ldap/module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./protocols/ldap/collection.mjs";
+import { IdentityProviderOAuth2Authenticator } from "./protocols/oauth2/module.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./protocols/open-id/module.mjs";
+import "./protocols/index.mjs";
+import { IdentityProviderFacebookAuthenticator } from "./presets/facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./presets/github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./presets/google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./presets/instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./presets/paypal.mjs";
+import "./presets/index.mjs";
+import { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN } from "./constants.mjs";
+import { createIdentityProviderOAuth2Authenticator } from "./factory.mjs";
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/provider/authentication/presets/facebook.mjs

@@ -0,0 +1,35 @@
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/facebook.ts
+var IdentityProviderFacebookAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "email";
+		ctx.provider.authorize_url = "https://graph.facebook.com/oauth/authorize";
+		ctx.provider.token_url = "https://graph.facebook.com/oauth/access_token";
+		ctx.provider.user_info_url = "https://graph.facebook.com/me?fields=id,name,email,first_name,last_name";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const userInfo = await this.client.userInfo.get({
+			type: "Bearer",
+			token: input.access_token
+		});
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: userInfo.id,
+			attributeCandidates: {
+				name: [userInfo.username, userInfo.id],
+				email: [userInfo.email],
+				first_name: [userInfo.first_name],
+				last_name: [userInfo.last_name]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderFacebookAuthenticator };
+
+//# sourceMappingURL=facebook.mjs.map

package/dist/core/identity/provider/authentication/presets/facebook.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderFacebookAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","email","first_name","last_name","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/facebook.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderFacebookAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'email';\n        ctx.provider.authorize_url = 'https://graph.facebook.com/oauth/authorize';\n        ctx.provider.token_url = 'https://graph.facebook.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.facebook.com/me?fields=id,name,email,first_name,last_name';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n                first_name: [\n                    userInfo.first_name,\n                ],\n                last_name: [\n                    userInfo.last_name,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,wCAAb,cAA2DD,oCAAAA;CACvD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;GACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,aAAY;AAEtD,SAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,GACZ;IACDI,OAAO,CACHX,SAASW,MACZ;IACDC,YAAY,CACRZ,SAASY,WACZ;IACDC,WAAW,CACPb,SAASa,UACZ;IACL;GACAC,MAAMR;GACNb,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/presets/github.mjs

@@ -0,0 +1,37 @@
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/github.ts
+var IdentityProviderGithubAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "user:email";
+		ctx.provider.authorize_url = "https://github.com/login/oauth/authorize";
+		ctx.provider.token_url = "https://github.com/login/oauth/access_token";
+		ctx.provider.user_info_url = "https://api.github.com/user";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const userInfo = await this.client.userInfo.get({
+			type: "Bearer",
+			token: input.access_token
+		});
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: userInfo.id,
+			attributeCandidates: {
+				name: [
+					userInfo.login,
+					userInfo.name,
+					userInfo.id
+				],
+				email: [userInfo.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderGithubAuthenticator };
+
+//# sourceMappingURL=github.mjs.map

package/dist/core/identity/provider/authentication/presets/github.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderGithubAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","login","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/github.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGithubAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'user:email';\n        ctx.provider.authorize_url = 'https://github.com/login/oauth/authorize';\n        ctx.provider.token_url = 'https://github.com/login/oauth/access_token';\n        ctx.provider.user_info_url = 'https://api.github.com/user';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.login,\n                    userInfo.name,\n                    userInfo.id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;GACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,aAAY;AAEtD,SAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM;KACFT,SAASU;KACTV,SAASS;KACTT,SAASO;KACZ;IACDI,OAAO,CACHX,SAASW,MACZ;IACL;GACAC,MAAMN;GACNb,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/presets/google.mjs

@@ -0,0 +1,36 @@
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/google.ts
+var IdentityProviderGoogleAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "openid profile email";
+		ctx.provider.authorize_url = "https://accounts.google.com/o/oauth2/v2/auth";
+		ctx.provider.token_url = "https://oauth2.googleapis.com/token";
+		ctx.provider.user_info_url = "https://openidconnect.googleapis.com/v1/userinfo";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const payload = extractTokenPayload(input.access_token);
+		const attributeCandidates = {};
+		/**
+		* @see https://developers.google.com/identity/openid-connect/openid-connect?hl=de#server-flow
+		*/ if (input.id_token) {
+			const idTokenPayload = extractTokenPayload(input.id_token);
+			attributeCandidates.name = [idTokenPayload.name];
+			attributeCandidates.email = [idTokenPayload.email];
+			attributeCandidates.first_name = [idTokenPayload.given_name];
+			attributeCandidates.last_name = [idTokenPayload.family_name];
+		}
+		return {
+			id: payload.sub,
+			attributeCandidates,
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderGoogleAuthenticator };
+
+//# sourceMappingURL=google.mjs.map

package/dist/core/identity/provider/authentication/presets/google.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderGoogleAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","payload","access_token","attributeCandidates","id_token","idTokenPayload","name","email","first_name","given_name","last_name","family_name","id","sub","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/google.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGoogleAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'openid profile email';\n        ctx.provider.authorize_url = 'https://accounts.google.com/o/oauth2/v2/auth';\n        ctx.provider.token_url = 'https://oauth2.googleapis.com/token';\n        ctx.provider.user_info_url = 'https://openidconnect.googleapis.com/v1/userinfo';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        const attributeCandidates : Record<keyof User, unknown[]> = {};\n\n        /**\n         * @see https://developers.google.com/identity/openid-connect/openid-connect?hl=de#server-flow\n         */\n        if (input.id_token) {\n            const idTokenPayload = extractTokenPayload(input.id_token) as OpenIDTokenPayload;\n\n            attributeCandidates.name = [\n                idTokenPayload.name,\n            ];\n\n            attributeCandidates.email = [\n                idTokenPayload.email,\n            ];\n\n            attributeCandidates.first_name = [\n                idTokenPayload.given_name,\n            ];\n            attributeCandidates.last_name = [\n                idTokenPayload.family_name,\n            ];\n        }\n\n        return {\n            id: payload.sub!,\n            attributeCandidates,\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAeA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUX,oBAAoBU,MAAME,aAAY;EAEtD,MAAMC,sBAAsD,EAAC;;;IAK7D,KAAIH,MAAMI,UAAU;GAChB,MAAMC,iBAAiBf,oBAAoBU,MAAMI,SAAQ;AAEzDD,uBAAoBG,OAAO,CACvBD,eAAeC,KAClB;AAEDH,uBAAoBI,QAAQ,CACxBF,eAAeE,MAClB;AAEDJ,uBAAoBK,aAAa,CAC7BH,eAAeI,WAClB;AACDN,uBAAoBO,YAAY,CAC5BL,eAAeM,YAClB;;AAGL,SAAO;GACHC,IAAIX,QAAQY;GACZV;GACAW,MAAMb;GACNP,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/presets/index.mjs

@@ -0,0 +1,6 @@
+import { IdentityProviderFacebookAuthenticator } from "./facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./paypal.mjs";
+export { IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderPaypalAuthenticator };

package/dist/core/identity/provider/authentication/presets/instagram.mjs

@@ -0,0 +1,30 @@
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/instagram.ts
+var IdentityProviderInstagramAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "user_profile";
+		ctx.provider.authorize_url = "https://api.instagram.com/oauth/authorize";
+		ctx.provider.token_url = "https://api.instagram.com/oauth/access_token";
+		ctx.provider.user_info_url = "https://graph.instagram.com/me?fields=id,username";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const userInfo = await this.client.userInfo.get({
+			type: "Bearer",
+			token: input.access_token
+		});
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: userInfo.id,
+			attributeCandidates: { name: [userInfo.username, userInfo.id] },
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderInstagramAuthenticator };
+
+//# sourceMappingURL=instagram.mjs.map

package/dist/core/identity/provider/authentication/presets/instagram.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"instagram.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderInstagramAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderInstagramAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'user_profile';\n        ctx.provider.authorize_url = 'https://api.instagram.com/oauth/authorize';\n        ctx.provider.token_url = 'https://api.instagram.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.instagram.com/me?fields=id,username';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,yCAAb,cAA4DD,oCAAAA;CACxD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;GACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,aAAY;AAEtD,SAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB,EACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,GACZ,EACL;GACAI,MAAML;GACNb,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/presets/paypal.mjs

@@ -0,0 +1,33 @@
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/paypal.ts
+var IdentityProviderPaypalAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "openid profile email";
+		ctx.provider.authorize_url = "https://www.paypal.com/signin/authorize";
+		ctx.provider.token_url = "https://api.paypal.com/v1/identity/openidconnect/tokenservice";
+		ctx.provider.user_info_url = "https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const userInfo = await this.client.userInfo.get({
+			type: "Bearer",
+			token: input.access_token
+		});
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: userInfo.user_id,
+			attributeCandidates: {
+				name: [userInfo.name, userInfo.user_id],
+				email: [userInfo.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderPaypalAuthenticator };
+
+//# sourceMappingURL=paypal.mjs.map

package/dist/core/identity/provider/authentication/presets/paypal.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderPaypalAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","user_id","attributeCandidates","name","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderPaypalAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'openid profile email';\n        ctx.provider.authorize_url = 'https://www.paypal.com/signin/authorize';\n        ctx.provider.token_url = 'https://api.paypal.com/v1/identity/openidconnect/tokenservice';\n        ctx.provider.user_info_url = 'https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.user_id,\n            attributeCandidates: {\n                name: [\n                    userInfo.name,\n                    userInfo.user_id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;GACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,aAAY;AAEtD,SAAO;GACHE,IAAIP,SAASQ;GACbC,qBAAqB;IACjBC,MAAM,CACFV,SAASU,MACTV,SAASQ,QACZ;IACDG,OAAO,CACHX,SAASW,MACZ;IACL;GACAC,MAAMN;GACNb,UAAU,KAAKA;GACnB"}

package/dist/core/identity/provider/authentication/protocols/index.mjs

@@ -0,0 +1,8 @@
+import { IdentityProviderLdapAuthenticator } from "./ldap/module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./ldap/collection.mjs";
+import "./ldap/index.mjs";
+import { IdentityProviderOAuth2Authenticator } from "./oauth2/module.mjs";
+import "./oauth2/index.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./open-id/module.mjs";
+import "./open-id/index.mjs";
+export { IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator };

package/dist/core/identity/provider/authentication/protocols/ldap/collection.mjs

@@ -0,0 +1,36 @@
+import { BaseCredentialsAuthenticator } from "../../../../../authentication/base.mjs";
+import "../../../../../authentication/index.mjs";
+import { IdentityProviderLdapAuthenticator } from "./module.mjs";
+import { IdentityProviderProtocol, UserError, isLdapIdentityProvider } from "@authup/core-kit";
+//#region src/core/identity/provider/authentication/protocols/ldap/collection.ts
+var IdentityProviderLdapCollectionAuthenticator = class extends BaseCredentialsAuthenticator {
+	repository;
+	accountManager;
+	clientFactory;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.accountManager = ctx.accountManager;
+		this.clientFactory = ctx.clientFactory;
+	}
+	async authenticate(name, password, realmId) {
+		let error;
+		const entities = await this.repository.findByProtocol(IdentityProviderProtocol.LDAP, realmId);
+		for (const provider of entities) {
+			if (!isLdapIdentityProvider(provider)) continue;
+			const response = await new IdentityProviderLdapAuthenticator({
+				provider,
+				accountManager: this.accountManager,
+				clientFactory: this.clientFactory
+			}).safeAuthenticate(name, password);
+			if (response.success === true) return response.data;
+			error = response.error;
+		}
+		if (error) throw error;
+		throw UserError.credentialsInvalid();
+	}
+};
+//#endregion
+export { IdentityProviderLdapCollectionAuthenticator };
+
+//# sourceMappingURL=collection.mjs.map

package/dist/core/identity/provider/authentication/protocols/ldap/collection.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection.mjs","names":["IdentityProviderProtocol","UserError","isLdapIdentityProvider","IdentityProviderLdapAuthenticator","BaseCredentialsAuthenticator","IdentityProviderLdapCollectionAuthenticator","repository","accountManager","clientFactory","ctx","authenticate","name","password","realmId","error","entities","findByProtocol","LDAP","provider","authenticator","response","safeAuthenticate","success","data","credentialsInvalid"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/collection.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { IdentityProviderProtocol, UserError, isLdapIdentityProvider } from '@authup/core-kit';\nimport type { IIdentityProviderRepository } from '../../../../../entities/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport { IdentityProviderLdapAuthenticator } from './module.ts';\nimport type { ILdapClientFactory } from '../../../../../ldap/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { IdentityProviderLdapCollectionAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapCollectionAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected repository: IIdentityProviderRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected clientFactory: ILdapClientFactory;\n\n    constructor(ctx: IdentityProviderLdapCollectionAuthenticatorContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.accountManager = ctx.accountManager;\n        this.clientFactory = ctx.clientFactory;\n    }\n\n    async authenticate(name: string, password: string, realmId?: string): Promise<User> {\n        let error : Error | undefined;\n        const entities = await this.repository.findByProtocol(IdentityProviderProtocol.LDAP, realmId);\n\n        for (const provider of entities) {\n            if (!isLdapIdentityProvider(provider)) {\n                continue;\n            }\n\n            const authenticator = new IdentityProviderLdapAuthenticator({\n                provider,\n                accountManager: this.accountManager,\n                clientFactory: this.clientFactory,\n            });\n\n            const response = await authenticator.safeAuthenticate(name, password);\n            if (response.success === true) {\n                return response.data;\n            }\n\n            error = response.error;\n        }\n\n        if (error) {\n            throw error;\n        }\n\n        throw UserError.credentialsInvalid();\n    }\n}\n"],"mappings":";;;;;AAgBA,IAAaK,8CAAb,cAAiED,6BAAAA;CACnDE;CAEAC;CAEAC;CAEV,YAAYC,KAAyD;AACjE,SAAK;AAEL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,gBAAgBC,IAAID;;CAG7B,MAAME,aAAaC,MAAcC,UAAkBC,SAAiC;EAChF,IAAIC;EACJ,MAAMC,WAAW,MAAM,KAAKT,WAAWU,eAAehB,yBAAyBiB,MAAMJ,QAAAA;AAErF,OAAK,MAAMK,YAAYH,UAAU;AAC7B,OAAI,CAACb,uBAAuBgB,SAAAA,CACxB;GASJ,MAAME,WAAW,MAAMD,IANGhB,kCAAkC;IACxDe;IACAX,gBAAgB,KAAKA;IACrBC,eAAe,KAAKA;IACxB,CAEuBW,CAAcE,iBAAiBV,MAAMC,SAAAA;AAC5D,OAAIQ,SAASE,YAAY,KACrB,QAAOF,SAASG;AAGpBT,WAAQM,SAASN;;AAGrB,MAAIA,MACA,OAAMA;AAGV,QAAMb,UAAUuB,oBAAkB"}

package/dist/core/identity/provider/authentication/protocols/ldap/index.mjs

@@ -0,0 +1,3 @@
+import { IdentityProviderLdapAuthenticator } from "./module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./collection.mjs";
+export { IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator };