@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.51

package/dist/core/identity/provider/authentication/presets/paypal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAuBpH"}

package/dist/core/identity/provider/authentication/presets/paypal.mjs

@@ -0,0 +1,36 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/paypal.ts
+var IdentityProviderPaypalAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "openid profile email";
+		ctx.provider.authorize_url = "https://www.paypal.com/signin/authorize";
+		ctx.provider.token_url = "https://api.paypal.com/v1/identity/openidconnect/tokenservice";
+		ctx.provider.user_info_url = "https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const userInfo = await this.client.userInfo.get({
+			type: "Bearer",
+			token: input.access_token
+		});
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: userInfo.user_id,
+			attributeCandidates: {
+				name: [userInfo.name, userInfo.user_id],
+				email: [userInfo.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderPaypalAuthenticator };
+
+//# sourceMappingURL=paypal.mjs.map

package/dist/core/identity/provider/authentication/presets/paypal.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderPaypalAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","user_id","attributeCandidates","name","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderPaypalAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'openid profile email';\n        ctx.provider.authorize_url = 'https://www.paypal.com/signin/authorize';\n        ctx.provider.token_url = 'https://api.paypal.com/v1/identity/openidconnect/tokenservice';\n        ctx.provider.user_info_url = 'https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.user_id,\n            attributeCandidates: {\n                name: [\n                    userInfo.name,\n                    userInfo.user_id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQ;EACrBF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASQ;GACbC,qBAAqB;IACjBC,MAAM,CACFV,SAASU,MACTV,SAASQ,OAAAA;IAEbG,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/protocols/index.d.ts

@@ -0,0 +1,4 @@
+export * from './ldap/index.ts';
+export * from './oauth2/index.ts';
+export * from './open-id/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/provider/authentication/protocols/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/protocols/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}

package/dist/core/identity/provider/authentication/protocols/index.mjs

@@ -0,0 +1,11 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderLdapAuthenticator } from "./ldap/module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./ldap/collection.mjs";
+import "./ldap/index.mjs";
+import { IdentityProviderOAuth2Authenticator } from "./oauth2/module.mjs";
+import "./oauth2/index.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./open-id/module.mjs";
+import "./open-id/index.mjs";
+export { IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator };

package/dist/core/identity/provider/authentication/protocols/ldap/collection.d.ts

@@ -0,0 +1,14 @@
+import type { User } from '@authup/core-kit';
+import type { IIdentityProviderRepository } from '../../../../../entities/index.ts';
+import type { IIdentityProviderAccountManager } from '../../../account/index.ts';
+import type { ILdapClientFactory } from '../../../../../ldap/index.ts';
+import { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';
+import type { IdentityProviderLdapCollectionAuthenticatorContext } from './types.ts';
+export declare class IdentityProviderLdapCollectionAuthenticator extends BaseCredentialsAuthenticator<User> {
+    protected repository: IIdentityProviderRepository;
+    protected accountManager: IIdentityProviderAccountManager;
+    protected clientFactory: ILdapClientFactory;
+    constructor(ctx: IdentityProviderLdapCollectionAuthenticatorContext);
+    authenticate(name: string, password: string, realmId?: string): Promise<User>;
+}
+//# sourceMappingURL=collection.d.ts.map

package/dist/core/identity/provider/authentication/protocols/ldap/collection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/collection.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAEjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,kDAAkD,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,2CAA4C,SAAQ,4BAA4B,CAAC,IAAI,CAAC;IAC/F,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,aAAa,EAAE,kBAAkB,CAAC;gBAEhC,GAAG,EAAE,kDAAkD;IAQ7D,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA6BtF"}

package/dist/core/identity/provider/authentication/protocols/ldap/collection.mjs

@@ -0,0 +1,40 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BaseCredentialsAuthenticator } from "../../../../../authentication/base.mjs";
+import "../../../../../authentication/index.mjs";
+import { IdentityProviderLdapAuthenticator } from "./module.mjs";
+import { IdentityProviderProtocol, isLdapIdentityProvider } from "@authup/core-kit";
+import { EntityCredentialsInvalidError } from "@authup/errors";
+//#region src/core/identity/provider/authentication/protocols/ldap/collection.ts
+var IdentityProviderLdapCollectionAuthenticator = class extends BaseCredentialsAuthenticator {
+	repository;
+	accountManager;
+	clientFactory;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.accountManager = ctx.accountManager;
+		this.clientFactory = ctx.clientFactory;
+	}
+	async authenticate(name, password, realmId) {
+		let error;
+		const entities = await this.repository.findByProtocol(IdentityProviderProtocol.LDAP, realmId);
+		for (const provider of entities) {
+			if (!isLdapIdentityProvider(provider)) continue;
+			const response = await new IdentityProviderLdapAuthenticator({
+				provider,
+				accountManager: this.accountManager,
+				clientFactory: this.clientFactory
+			}).safeAuthenticate(name, password);
+			if (response.success === true) return response.data;
+			error = response.error;
+		}
+		if (error) throw error;
+		throw new EntityCredentialsInvalidError({ entity: "user" });
+	}
+};
+//#endregion
+export { IdentityProviderLdapCollectionAuthenticator };
+
+//# sourceMappingURL=collection.mjs.map

package/dist/core/identity/provider/authentication/protocols/ldap/collection.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection.mjs","names":["IdentityProviderProtocol","isLdapIdentityProvider","EntityCredentialsInvalidError","IdentityProviderLdapAuthenticator","BaseCredentialsAuthenticator","IdentityProviderLdapCollectionAuthenticator","repository","accountManager","clientFactory","ctx","authenticate","name","password","realmId","error","entities","findByProtocol","LDAP","provider","authenticator","response","safeAuthenticate","success","data","entity"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/collection.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { IdentityProviderProtocol, isLdapIdentityProvider } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { IIdentityProviderRepository } from '../../../../../entities/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport { IdentityProviderLdapAuthenticator } from './module.ts';\nimport type { ILdapClientFactory } from '../../../../../ldap/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { IdentityProviderLdapCollectionAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapCollectionAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected repository: IIdentityProviderRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected clientFactory: ILdapClientFactory;\n\n    constructor(ctx: IdentityProviderLdapCollectionAuthenticatorContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.accountManager = ctx.accountManager;\n        this.clientFactory = ctx.clientFactory;\n    }\n\n    async authenticate(name: string, password: string, realmId?: string): Promise<User> {\n        let error : Error | undefined;\n        const entities = await this.repository.findByProtocol(IdentityProviderProtocol.LDAP, realmId);\n\n        for (const provider of entities) {\n            if (!isLdapIdentityProvider(provider)) {\n                continue;\n            }\n\n            const authenticator = new IdentityProviderLdapAuthenticator({\n                provider,\n                accountManager: this.accountManager,\n                clientFactory: this.clientFactory,\n            });\n\n            const response = await authenticator.safeAuthenticate(name, password);\n            if (response.success === true) {\n                return response.data;\n            }\n\n            error = response.error;\n        }\n\n        if (error) {\n            throw error;\n        }\n\n        throw new EntityCredentialsInvalidError({ entity: 'user' });\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaK,8CAAb,cAAiED,6BAAAA;CACnDE;CAEAC;CAEAC;CAEV,YAAYC,KAAyD;EACjE,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MAAME,aAAaC,MAAcC,UAAkBC,SAAiC;EAChF,IAAIC;EACJ,MAAMC,WAAW,MAAM,KAAKT,WAAWU,eAAehB,yBAAyBiB,MAAMJ,OAAAA;EAErF,KAAK,MAAMK,YAAYH,UAAU;GAC7B,IAAI,CAACd,uBAAuBiB,QAAAA,GACxB;GASJ,MAAME,WAAW,MAAMD,IANGhB,kCAAkC;IACxDe;IACAX,gBAAgB,KAAKA;IACrBC,eAAe,KAAKA;GACxB,CAEuBW,CAAAA,CAAcE,iBAAiBV,MAAMC,QAAAA;GAC5D,IAAIQ,SAASE,YAAY,MACrB,OAAOF,SAASG;GAGpBT,QAAQM,SAASN;EACrB;EAEA,IAAIA,OACA,MAAMA;EAGV,MAAM,IAAIZ,8BAA8B,EAAEsB,QAAQ,OAAO,CAAA;CAC7D;AACJ"}

package/dist/core/identity/provider/authentication/protocols/ldap/index.d.ts

@@ -0,0 +1,4 @@
+export * from './collection.ts';
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/provider/authentication/protocols/ldap/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/provider/authentication/protocols/ldap/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderLdapAuthenticator } from "./module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./collection.mjs";
+export { IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator };

package/dist/core/identity/provider/authentication/protocols/ldap/module.d.ts

@@ -0,0 +1,21 @@
+import type { LdapIdentityProvider, User } from '@authup/core-kit';
+import type { Result } from '@authup/kit';
+import { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';
+import type { ILdapClient } from '../../../../../ldap/index.ts';
+import type { IIdentityProviderAccountManager } from '../../../account/index.ts';
+import type { IdentityProviderLdapAuthenticatorContext } from './types.ts';
+export declare class IdentityProviderLdapAuthenticator extends BaseCredentialsAuthenticator<User> {
+    protected provider: LdapIdentityProvider;
+    protected accountManager: IIdentityProviderAccountManager;
+    protected client: ILdapClient;
+    constructor(ctx: IdentityProviderLdapAuthenticatorContext);
+    authenticate(name: string, password: string): Promise<User>;
+    protected bind(user?: string, password?: string): Promise<void>;
+    protected safeBind(user?: string, password?: string): Promise<Result<null>>;
+    protected unbind(): Promise<void>;
+    protected safeUnbind(): Promise<Result<null>>;
+    protected findOneByName(input: string): Promise<Record<string, any> | null>;
+    protected extractCnFromDn(dn: string): string | undefined;
+    findUserGroups(user: Record<string, any>): Promise<string[]>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/provider/authentication/protocols/ldap/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAEjF,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAE3E,qBAAa,iCAAkC,SAAQ,4BAA4B,CAAC,IAAI,CAAC;IACrF,SAAS,CAAC,QAAQ,EAAG,oBAAoB,CAAC;IAE1C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC;gBAElB,GAAG,EAAE,wCAAwC;IAgBnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;cA+ClD,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;cAatD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAgBlE,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;cAIxB,UAAU,IAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAgBpC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IA0ClF,SAAS,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;IAK7C,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAuD7E"}

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs

@@ -0,0 +1,160 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BaseCredentialsAuthenticator } from "../../../../../authentication/base.mjs";
+import "../../../../../authentication/index.mjs";
+import { template } from "@authup/kit";
+import { EntityCredentialsInvalidError } from "@authup/errors";
+import ldap from "ldapjs";
+//#region src/core/identity/provider/authentication/protocols/ldap/module.ts
+var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticator {
+	provider;
+	accountManager;
+	client;
+	constructor(ctx) {
+		super();
+		this.accountManager = ctx.accountManager;
+		this.provider = ctx.provider;
+		this.client = ctx.clientFactory.create({
+			url: ctx.provider.url,
+			tls: ctx.provider.tls,
+			startTLS: ctx.provider.start_tls,
+			baseDn: ctx.provider.base_dn,
+			user: ctx.provider.user,
+			password: ctx.provider.password,
+			userNameAttribute: ctx.provider.user_name_attribute
+		});
+	}
+	async authenticate(name, password) {
+		let bind = await this.safeBind();
+		if (!bind.success) {
+			await this.safeUnbind();
+			throw new EntityCredentialsInvalidError({ entity: "user" });
+		}
+		const entity = await this.findOneByName(name);
+		if (!entity) {
+			await this.safeUnbind();
+			throw new EntityCredentialsInvalidError({ entity: "user" });
+		}
+		const identity = {
+			id: entity.dn,
+			attributeCandidates: {
+				name: [entity[this.provider.user_name_attribute || "cn"], this.extractCnFromDn(entity.dn)],
+				email: [entity[this.provider.user_mail_attribute || "mail"]]
+			},
+			data: entity,
+			provider: this.provider
+		};
+		try {
+			identity.roles = await this.findUserGroups(entity);
+		} catch {}
+		bind = await this.safeBind(identity.id, password);
+		await this.safeUnbind();
+		if (!bind.success) throw new EntityCredentialsInvalidError({ entity: "user" });
+		return (await this.accountManager.save(identity)).user;
+	}
+	async bind(user, password) {
+		if (!user) return this.client.bind();
+		if (!this.client.isDn(user)) user = `${this.provider.user_name_attribute || "cn"}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;
+		return this.client.bind(user, password);
+	}
+	async safeBind(user, password) {
+		try {
+			await this.bind(user, password);
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: e
+			};
+		}
+	}
+	async unbind() {
+		return this.client.unbind();
+	}
+	async safeUnbind() {
+		try {
+			await this.unbind();
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: e
+			};
+		}
+	}
+	async findOneByName(input) {
+		let filter;
+		if (this.provider.user_filter) filter = template(this.provider.user_filter, {
+			input,
+			name_attribute: this.provider.user_name_attribute || "cn",
+			mail_attribute: this.provider.user_mail_attribute || "mail",
+			display_name_attribute: this.provider.user_display_name_attribute || "cn"
+		});
+		else if (this.provider.user_name_attribute) filter = new ldap.EqualityFilter({
+			attribute: this.provider.user_name_attribute,
+			value: input
+		});
+		else filter = new ldap.OrFilter({ filters: [new ldap.EqualityFilter({
+			attribute: "cn",
+			value: input
+		}), new ldap.EqualityFilter({
+			attribute: "sAMAccountName",
+			value: input
+		})] });
+		const entities = await this.client.search({
+			filter,
+			scope: "sub"
+		}, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));
+		if (entities.length === 0) return null;
+		return entities[0];
+	}
+	extractCnFromDn(dn) {
+		const match = /^cn=([^,]+)/i.exec(dn);
+		return match ? match[1].trim() : void 0;
+	}
+	async findUserGroups(user) {
+		const nameAttribute = this.provider.group_name_attribute || "cn";
+		const memberAttribute = this.provider.group_member_attribute || "member";
+		let filter;
+		if (this.provider.group_filter) filter = template(this.provider.group_filter, {
+			...user,
+			name_attribute: nameAttribute,
+			member_attribute: memberAttribute
+		});
+		else filter = new ldap.AndFilter({ filters: [new ldap.EqualityFilter({
+			attribute: "objectClass",
+			value: this.provider.group_class || "group"
+		}), new ldap.EqualityFilter({
+			attribute: memberAttribute,
+			value: user[this.provider.group_member_user_attribute || "dn"]
+		})] });
+		const entities = await this.client.search({
+			filter,
+			scope: "sub"
+		}, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));
+		if (entities.length === 0) return [];
+		const attributeKey = this.provider.group_name_attribute || "cn";
+		const names = [];
+		for (const entity of entities) {
+			const attribute = entity[attributeKey];
+			if (typeof attribute === "undefined") continue;
+			if (typeof attribute === "string") {
+				names.push(attribute);
+				continue;
+			}
+			if (Array.isArray(attribute)) names.push(...attribute.filter((el) => typeof el === "string"));
+		}
+		return names;
+	}
+};
+//#endregion
+export { IdentityProviderLdapAuthenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["EntityCredentialsInvalidError","template","ldap","BaseCredentialsAuthenticator","IdentityProviderLdapAuthenticator","provider","accountManager","client","ctx","clientFactory","create","url","tls","startTLS","start_tls","baseDn","base_dn","user","password","userNameAttribute","user_name_attribute","authenticate","name","bind","safeBind","success","safeUnbind","entity","findOneByName","identity","id","dn","attributeCandidates","extractCnFromDn","email","user_mail_attribute","data","roles","findUserGroups","account","save","isDn","nameAttribute","resolveDn","user_base_dn","e","error","unbind","input","filter","user_filter","name_attribute","mail_attribute","display_name_attribute","user_display_name_attribute","EqualityFilter","attribute","value","OrFilter","filters","entities","search","scope","length","match","exec","trim","undefined","group_name_attribute","memberAttribute","group_member_attribute","group_filter","member_attribute","AndFilter","group_class","group_member_user_attribute","group_base_dn","attributeKey","names","push","Array","isArray","el"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LdapIdentityProvider, User } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { template } from '@authup/kit';\nimport ldap from 'ldapjs';\nimport type { Filter } from 'ldapjs';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { ILdapClient } from '../../../../../ldap/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type { IdentityProviderLdapAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected provider : LdapIdentityProvider;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected client: ILdapClient;\n\n    constructor(ctx: IdentityProviderLdapAuthenticatorContext) {\n        super();\n\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n        this.client = ctx.clientFactory.create({\n            url: ctx.provider.url,\n            tls: ctx.provider.tls,\n            startTLS: ctx.provider.start_tls,\n            baseDn: ctx.provider.base_dn,\n            user: ctx.provider.user,\n            password: ctx.provider.password,\n            userNameAttribute: ctx.provider.user_name_attribute,\n        });\n    }\n\n    async authenticate(name: string, password: string) : Promise<User> {\n        let bind = await this.safeBind();\n        if (!bind.success) {\n            await this.safeUnbind();\n\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const entity = await this.findOneByName(name);\n        if (!entity) {\n            await this.safeUnbind();\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const identity : IdentityProviderIdentity = {\n            id: entity.dn,\n            attributeCandidates: {\n                name: [\n                    entity[this.provider.user_name_attribute || 'cn'],\n                    this.extractCnFromDn(entity.dn),\n                ],\n                email: [\n                    entity[this.provider.user_mail_attribute || 'mail'],\n                ],\n            },\n            data: entity,\n            provider: this.provider,\n        };\n\n        try {\n            identity.roles = await this.findUserGroups(entity);\n        } catch {\n            // todo: log event\n        }\n\n        bind = await this.safeBind(identity.id, password);\n        await this.safeUnbind();\n\n        if (!bind.success) {\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    protected async bind(user?: string, password?: string) : Promise<void> {\n        if (!user) {\n            return this.client.bind();\n        }\n\n        if (!this.client.isDn(user)) {\n            const nameAttribute = this.provider.user_name_attribute || 'cn';\n            user = `${nameAttribute}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;\n        }\n\n        return this.client.bind(user, password);\n    }\n\n    protected async safeBind(user?: string, password?: string) : Promise<Result<null>> {\n        try {\n            await this.bind(user, password);\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async unbind() : Promise<void> {\n        return this.client.unbind();\n    }\n\n    protected async safeUnbind() : Promise<Result<null>> {\n        try {\n            await this.unbind();\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async findOneByName(input: string) : Promise<Record<string, any> | null> {\n        let filter : Filter | string;\n\n        if (this.provider.user_filter) {\n            filter = template(this.provider.user_filter, {\n                input,\n                name_attribute: this.provider.user_name_attribute || 'cn',\n                mail_attribute: this.provider.user_mail_attribute || 'mail',\n                display_name_attribute: this.provider.user_display_name_attribute || 'cn',\n            });\n        } else if (this.provider.user_name_attribute) {\n            filter = new ldap.EqualityFilter({\n                attribute: this.provider.user_name_attribute,\n                value: input,\n            });\n        } else {\n            filter = new ldap.OrFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'cn',\n                        value: input,\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: 'sAMAccountName',\n                        value: input,\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return null;\n        }\n\n        return entities[0];\n    }\n\n    protected extractCnFromDn(dn: string) : string | undefined {\n        const match = /^cn=([^,]+)/i.exec(dn);\n        return match ? match[1].trim() : undefined;\n    }\n\n    public async findUserGroups(user: Record<string, any>) : Promise<string[]> {\n        const nameAttribute = this.provider.group_name_attribute || 'cn';\n        const memberAttribute = this.provider.group_member_attribute || 'member';\n\n        let filter : Filter | string;\n        if (this.provider.group_filter) {\n            filter = template(this.provider.group_filter, {\n                ...user,\n                name_attribute: nameAttribute,\n                member_attribute: memberAttribute,\n            });\n        } else {\n            filter = new ldap.AndFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'objectClass',\n                        value: this.provider.group_class || 'group',\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: memberAttribute,\n                        value: user[this.provider.group_member_user_attribute || 'dn'],\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return [];\n        }\n\n        const attributeKey = this.provider.group_name_attribute || 'cn';\n        const names : string[] = [];\n        for (const entity of entities) {\n            const attribute = entity[attributeKey];\n            if (typeof attribute === 'undefined') {\n                continue;\n            }\n\n            if (typeof attribute === 'string') {\n                names.push(attribute);\n                continue;\n            }\n\n            if (Array.isArray(attribute)) {\n                names.push(...attribute.filter((el) => typeof el === 'string'));\n            }\n        }\n\n        return names;\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,oCAAb,cAAuDD,6BAAAA;CACzCE;CAEAC;CAEAC;CAEV,YAAYC,KAA+C;EACvD,MAAK;EAEL,KAAKF,iBAAiBE,IAAIF;EAC1B,KAAKD,WAAWG,IAAIH;EACpB,KAAKE,SAASC,IAAIC,cAAcC,OAAO;GACnCC,KAAKH,IAAIH,SAASM;GAClBC,KAAKJ,IAAIH,SAASO;GAClBC,UAAUL,IAAIH,SAASS;GACvBC,QAAQP,IAAIH,SAASW;GACrBC,MAAMT,IAAIH,SAASY;GACnBC,UAAUV,IAAIH,SAASa;GACvBC,mBAAmBX,IAAIH,SAASe;EACpC,CAAA;CACJ;CAEA,MAAMC,aAAaC,MAAcJ,UAAkC;EAC/D,IAAIK,OAAO,MAAM,KAAKC,SAAQ;EAC9B,IAAI,CAACD,KAAKE,SAAS;GACf,MAAM,KAAKC,WAAU;GAErB,MAAM,IAAI1B,8BAA8B,EAAE2B,QAAQ,OAAO,CAAA;EAC7D;EAEA,MAAMA,SAAS,MAAM,KAAKC,cAAcN,IAAAA;EACxC,IAAI,CAACK,QAAQ;GACT,MAAM,KAAKD,WAAU;GACrB,MAAM,IAAI1B,8BAA8B,EAAE2B,QAAQ,OAAO,CAAA;EAC7D;EAEA,MAAME,WAAsC;GACxCC,IAAIH,OAAOI;GACXC,qBAAqB;IACjBV,MAAM,CACFK,OAAO,KAAKtB,SAASe,uBAAuB,OAC5C,KAAKa,gBAAgBN,OAAOI,EAAE,CAAA;IAElCG,OAAO,CACHP,OAAO,KAAKtB,SAAS8B,uBAAuB,OAAA;GAEpD;GACAC,MAAMT;GACNtB,UAAU,KAAKA;EACnB;EAEA,IAAI;GACAwB,SAASQ,QAAQ,MAAM,KAAKC,eAAeX,MAAAA;EAC/C,QAAQ,CAER;EAEAJ,OAAO,MAAM,KAAKC,SAASK,SAASC,IAAIZ,QAAAA;EACxC,MAAM,KAAKQ,WAAU;EAErB,IAAI,CAACH,KAAKE,SACN,MAAM,IAAIzB,8BAA8B,EAAE2B,QAAQ,OAAO,CAAA;EAK7D,QAAOY,MAFe,KAAKjC,eAAekC,KAAKX,QAAAA,EAAAA,CAEhCZ;CACnB;CAEA,MAAgBM,KAAKN,MAAeC,UAAmC;EACnE,IAAI,CAACD,MACD,OAAO,KAAKV,OAAOgB,KAAI;EAG3B,IAAI,CAAC,KAAKhB,OAAOkC,KAAKxB,IAAAA,GAElBA,OAAO,GADe,KAAKZ,SAASe,uBAAuB,KACnC,GAAGH,KAAK,GAAG,KAAKV,OAAOoC,UAAU,KAAKtC,SAASuC,cAAc,KAAKvC,SAASW,OAAO;EAG9G,OAAO,KAAKT,OAAOgB,KAAKN,MAAMC,QAAAA;CAClC;CAEA,MAAgBM,SAASP,MAAeC,UAA2C;EAC/E,IAAI;GACA,MAAM,KAAKK,KAAKN,MAAMC,QAAAA;GAEtB,OAAO;IACHO,SAAS;IACTW,MAAM;GACV;EACJ,SAASS,GAAG;GACR,OAAO;IACHpB,SAAS;IACTqB,OAAOD;GACX;EACJ;CACJ;CAEA,MAAgBE,SAAyB;EACrC,OAAO,KAAKxC,OAAOwC,OAAM;CAC7B;CAEA,MAAgBrB,aAAqC;EACjD,IAAI;GACA,MAAM,KAAKqB,OAAM;GAEjB,OAAO;IACHtB,SAAS;IACTW,MAAM;GACV;EACJ,SAASS,GAAG;GACR,OAAO;IACHpB,SAAS;IACTqB,OAAOD;GACX;EACJ;CACJ;CAEA,MAAgBjB,cAAcoB,OAAqD;EAC/E,IAAIC;EAEJ,IAAI,KAAK5C,SAAS6C,aACdD,SAAShD,SAAS,KAAKI,SAAS6C,aAAa;GACzCF;GACAG,gBAAgB,KAAK9C,SAASe,uBAAuB;GACrDgC,gBAAgB,KAAK/C,SAAS8B,uBAAuB;GACrDkB,wBAAwB,KAAKhD,SAASiD,+BAA+B;EACzE,CAAA;OACG,IAAI,KAAKjD,SAASe,qBACrB6B,SAAS,IAAI/C,KAAKqD,eAAe;GAC7BC,WAAW,KAAKnD,SAASe;GACzBqC,OAAOT;EACX,CAAA;OAEAC,SAAS,IAAI/C,KAAKwD,SAAS,EACvBC,SAAS,CACL,IAAIzD,KAAKqD,eAAe;GACpBC,WAAW;GACXC,OAAOT;EACX,CAAA,GACA,IAAI9C,KAAKqD,eAAe;GACpBC,WAAW;GACXC,OAAOT;EACX,CAAA,CAAA,EAER,CAAA;EAGJ,MAAMY,WAAW,MAAM,KAAKrD,OAAOsD,OAAO;GACtCZ;GACAa,OAAO;EACX,GAAG,KAAKvD,OAAOoC,UAAU,KAAKtC,SAASuC,cAAc,KAAKvC,SAASW,OAAO,CAAA;EAE1E,IAAI4C,SAASG,WAAW,GACpB,OAAO;EAGX,OAAOH,SAAS;CACpB;CAEU3B,gBAAgBF,IAAiC;EACvD,MAAMiC,QAAQ,eAAeC,KAAKlC,EAAAA;EAClC,OAAOiC,QAAQA,MAAM,EAAE,CAACE,KAAI,IAAKC,KAAAA;CACrC;CAEA,MAAa7B,eAAerB,MAA+C;EACvE,MAAMyB,gBAAgB,KAAKrC,SAAS+D,wBAAwB;EAC5D,MAAMC,kBAAkB,KAAKhE,SAASiE,0BAA0B;EAEhE,IAAIrB;EACJ,IAAI,KAAK5C,SAASkE,cACdtB,SAAShD,SAAS,KAAKI,SAASkE,cAAc;GAC1C,GAAGtD;GACHkC,gBAAgBT;GAChB8B,kBAAkBH;EACtB,CAAA;OAEApB,SAAS,IAAI/C,KAAKuE,UAAU,EACxBd,SAAS,CACL,IAAIzD,KAAKqD,eAAe;GACpBC,WAAW;GACXC,OAAO,KAAKpD,SAASqE,eAAe;EACxC,CAAA,GACA,IAAIxE,KAAKqD,eAAe;GACpBC,WAAWa;GACXZ,OAAOxC,KAAK,KAAKZ,SAASsE,+BAA+B;EAC7D,CAAA,CAAA,EAER,CAAA;EAGJ,MAAMf,WAAW,MAAM,KAAKrD,OAAOsD,OAAO;GACtCZ;GACAa,OAAO;EACX,GAAG,KAAKvD,OAAOoC,UAAU,KAAKtC,SAASuE,eAAe,KAAKvE,SAASW,OAAO,CAAA;EAE3E,IAAI4C,SAASG,WAAW,GACpB,OAAO,CAAA;EAGX,MAAMc,eAAe,KAAKxE,SAAS+D,wBAAwB;EAC3D,MAAMU,QAAmB,CAAA;EACzB,KAAK,MAAMnD,UAAUiC,UAAU;GAC3B,MAAMJ,YAAY7B,OAAOkD;GACzB,IAAI,OAAOrB,cAAc,aACrB;GAGJ,IAAI,OAAOA,cAAc,UAAU;IAC/BsB,MAAMC,KAAKvB,SAAAA;IACX;GACJ;GAEA,IAAIwB,MAAMC,QAAQzB,SAAAA,GACdsB,MAAMC,KAAI,GAAIvB,UAAUP,QAAQiC,OAAO,OAAOA,OAAO,QAAA,CAAA;EAE7D;EAEA,OAAOJ;CACX;AACJ"}

package/dist/core/identity/provider/authentication/protocols/ldap/types.d.ts

@@ -0,0 +1,16 @@
+import type { LdapIdentityProvider } from '@authup/core-kit';
+import type { IIdentityProviderRepository } from '../../../../../entities/index.ts';
+import type { ILdapClientFactory } from '../../../../../ldap/index.ts';
+import type { IIdentityProviderAccountManager } from '../../../account/index.ts';
+type IdentityProviderAuthenticatorBaseContext = {
+    clientFactory: ILdapClientFactory;
+    accountManager: IIdentityProviderAccountManager;
+};
+export type IdentityProviderLdapCollectionAuthenticatorContext = IdentityProviderAuthenticatorBaseContext & {
+    repository: IIdentityProviderRepository;
+};
+export type IdentityProviderLdapAuthenticatorContext = IdentityProviderAuthenticatorBaseContext & {
+    provider: LdapIdentityProvider;
+};
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/provider/authentication/protocols/ldap/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAEjF,KAAK,wCAAwC,GAAG;IAC5C,aAAa,EAAE,kBAAkB,CAAC;IAClC,cAAc,EAAE,+BAA+B,CAAA;CAClD,CAAC;AAEF,MAAM,MAAM,kDAAkD,GAAG,wCAAwC,GAAG;IACxG,UAAU,EAAE,2BAA2B,CAAA;CAC1C,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG,wCAAwC,GAAG;IAC9F,QAAQ,EAAE,oBAAoB,CAAA;CACjC,CAAC"}

package/dist/core/identity/provider/authentication/protocols/ldap/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/provider/authentication/protocols/oauth2/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/provider/authentication/protocols/oauth2/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/provider/authentication/protocols/oauth2/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderOAuth2Authenticator } from "./module.mjs";
+export { IdentityProviderOAuth2Authenticator };

package/dist/core/identity/provider/authentication/protocols/oauth2/module.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';
+import type { Result } from '@authup/kit';
+import type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';
+import { OAuth2Client } from '@hapic/oauth2';
+import type { IIdentityProviderAccountManager } from '../../../account/index.ts';
+import type { IdentityProviderIdentity } from '../../../types.ts';
+import type { IOAuth2Authenticator, IdentityProviderOAuth2AuthenticatorContext, IdentityProviderOAuth2AuthenticatorOptions, OAuth2AuthorizationCodeGrantPayload } from './types.ts';
+export declare class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {
+    protected client: OAuth2Client;
+    protected options: IdentityProviderOAuth2AuthenticatorOptions;
+    protected accountManager: IIdentityProviderAccountManager;
+    protected provider: OAuth2IdentityProvider | OpenIDIdentityProvider;
+    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext);
+    buildRedirectURL(parameters?: Partial<AuthorizeParameters>): string;
+    authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User>;
+    safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>>;
+    protected buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/provider/authentication/protocols/oauth2/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EACR,oBAAoB,EACpB,0CAA0C,EAC1C,0CAA0C,EAC1C,mCAAmC,EACtC,MAAM,YAAY,CAAC;AAEpB,qBAAa,mCAAoC,YAAW,oBAAoB,CAAC,IAAI,CAAC;IAClF,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAG,0CAA0C,CAAC;IAE/D,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,QAAQ,EAAG,sBAAsB,GAAG,sBAAsB,CAAC;gBAIzD,GAAG,EAAE,0CAA0C;IAoB3D,gBAAgB,CAAC,UAAU,GAAE,OAAO,CAAC,mBAAmB,CAAM,GAAI,MAAM;IAMlE,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAiB1E,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAiBrH"}

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs

@@ -0,0 +1,65 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildIdentityProviderAuthorizeCallbackPath } from "@authup/core-kit";
+import { extractTokenPayload } from "@authup/server-kit";
+import { OAuth2Client } from "@hapic/oauth2";
+//#region src/core/identity/provider/authentication/protocols/oauth2/module.ts
+var IdentityProviderOAuth2Authenticator = class {
+	client;
+	options;
+	accountManager;
+	provider;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.accountManager = ctx.accountManager;
+		this.provider = ctx.provider;
+		this.client = new OAuth2Client({ options: {
+			clientId: ctx.provider.client_id,
+			clientSecret: ctx.provider.client_secret,
+			redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,
+			scope: ctx.provider.scope,
+			authorizationEndpoint: ctx.provider.authorize_url,
+			tokenEndpoint: ctx.provider.token_url,
+			userinfoEndpoint: ctx.provider.user_info_url || void 0
+		} });
+	}
+	buildRedirectURL(parameters = {}) {
+		return this.client.authorize.buildURL(parameters);
+	}
+	async authenticate(params) {
+		const token = await this.client.token.createWithAuthorizationCode(params);
+		const identity = await this.buildIdentityWithTokenGrantResponse(token);
+		if (this.options.clientId) identity.clientId = this.options.clientId;
+		return (await this.accountManager.save(identity)).user;
+	}
+	async safeAuthenticate(params) {
+		try {
+			return {
+				success: true,
+				data: await this.authenticate(params)
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: e
+			};
+		}
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: payload.sub,
+			attributeCandidates: {
+				name: [payload.sub],
+				email: [payload.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderOAuth2Authenticator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","undefined","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        return this.client.authorize.buildURL(parameters);\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAsBA,IAAaG,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUd,2CAA2CQ,IAAID,SAASQ,EAAE;GAChGC,OAAOR,IAAID,SAASS;GACpBC,uBAAuBT,IAAID,SAASW;GACpCC,eAAeX,IAAID,SAASa;GAC5BC,kBAAkBb,IAAID,SAASe,iBAAiBC,KAAAA;EACpD,EACJ,CAAA;CACJ;CAIAC,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,OAAO,KAAKrB,OAAOsB,UAAUC,SAASF,UAAAA;CAC1C;CAIA,MAAMG,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKzB,QAAQI,UACbuB,SAASvB,WAAW,KAAKJ,QAAQI;EAKrC,QAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,QAAAA,EAAAA,CAEhCI;CACnB;CAEA,MAAMC,iBAAiBR,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,MAAAA;GAIrC;EACJ,SAASW,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,YAAY;EAEtD,OAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GAAAA;IAEZG,OAAO,CACHL,QAAQK,KAAAA;GAEhB;GACAV,MAAMK;GACNpC,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/protocols/oauth2/types.d.ts

@@ -0,0 +1,23 @@
+import type { OAuth2IdentityProvider, OpenIDIdentityProvider } from '@authup/core-kit';
+import type { ObjectLiteral, Result } from '@authup/kit';
+import type { AuthorizeParameters } from '@hapic/oauth2';
+import type { IIdentityProviderAccountManager } from '../../../account/index.ts';
+export type OAuth2AuthorizationCodeGrantPayload = {
+    code: string;
+    code_verifier?: string;
+};
+export interface IOAuth2Authenticator<T extends ObjectLiteral = ObjectLiteral> {
+    authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<T>;
+    safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<T>>;
+    buildRedirectURL(parameters?: Partial<AuthorizeParameters>): string;
+}
+export type IdentityProviderOAuth2AuthenticatorOptions = {
+    baseURL: string;
+    clientId?: string;
+};
+export type IdentityProviderOAuth2AuthenticatorContext = {
+    options: IdentityProviderOAuth2AuthenticatorOptions;
+    accountManager: IIdentityProviderAccountManager;
+    provider: OAuth2IdentityProvider | OpenIDIdentityProvider;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/provider/authentication/protocols/oauth2/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAEjF,MAAM,MAAM,mCAAmC,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,CAAC,EAAE,MAAM,CAAA;CACzB,CAAC;AAEF,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACzE,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAEvE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnF,gBAAgB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC;CACvE;AAED,MAAM,MAAM,0CAA0C,GAAG;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CACpB,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACrD,OAAO,EAAE,0CAA0C,CAAC;IACpD,cAAc,EAAE,+BAA+B,CAAA;IAC/C,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,CAAC;CAC7D,CAAC"}

package/dist/core/identity/provider/authentication/protocols/oauth2/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/provider/authentication/protocols/open-id/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/provider/authentication/protocols/open-id/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/core/identity/provider/authentication/protocols/open-id/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderOpenIDAuthenticator } from "./module.mjs";
+export { IdentityProviderOpenIDAuthenticator };

package/dist/core/identity/provider/authentication/protocols/open-id/module.d.ts

@@ -0,0 +1,7 @@
+import type { TokenGrantResponse } from '@hapic/oauth2';
+import type { IdentityProviderIdentity } from '../../../types.ts';
+import { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';
+export declare class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {
+    protected buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/provider/authentication/protocols/open-id/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AAEzE,qBAAa,mCAAoC,SAAQ,mCAAmC;cACxE,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAmBpH"}

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs

@@ -0,0 +1,29 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderOAuth2Authenticator } from "../oauth2/module.mjs";
+import "../oauth2/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/protocols/open-id/module.ts
+var IdentityProviderOpenIDAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	async buildIdentityWithTokenGrantResponse(input) {
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: payload.sub,
+			attributeCandidates: {
+				name: [
+					payload.preferred_username,
+					payload.nickname,
+					payload.sub
+				],
+				email: [payload.email]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderOpenIDAuthenticator };
+
+//# sourceMappingURL=module.mjs.map