npm - @authup/server-core - Versions diffs - 1.0.0-beta.51 → 1.0.0-beta.53 - Mend

@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1000) hide show

package/dist/adapters/http/controllers/entities/consent/module.mjs ADDED Viewed

@@ -0,0 +1,82 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DDelete, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/consent/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var ConsentController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });
+		return {
+			data,
+			meta
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });
+	}
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });
+		event.response.status = 202;
+		return entity;
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], ConsentController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], ConsentController.prototype, "getOne", null);
+_ts_decorate([
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], ConsentController.prototype, "drop", null);
+ConsentController = _ts_decorate([
+	DTags("consent"),
+	DController(["/consents", "/realms/:realmId/consents"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof ConsentControllerContext === "undefined" ? Object : ConsentControllerContext])
+], ConsentController);
+//#endregion
+export { ConsentController };
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/consent/module.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","getRequestRealmID","ConsentController","service","ctx","getMany","event","actor","data","meta","realmId","getOne","id","drop","entity","delete","response","status"],"sources":["../../../../../../src/adapters/http/controllers/entities/consent/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DTags,\n} from '@routup/decorators';\nimport type { Consent } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse } from '@authup/core-http-kit';\nimport type { IConsentService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, getRequestRealmID } from '../../../request/index.ts';\n\nexport type ConsentControllerContext = {\n service: IConsentService,\n};\n\n@DTags('consent')\n@DController(['/consents', '/realms/:realmId/consents'])\nexport class ConsentController {\n protected service: IConsentService;\n\n constructor(ctx: ConsentControllerContext) {\n this.service = ctx.service;\n }\n\n @DGet('', [ForceLoggedInMiddleware])\n async getMany(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<Consent>> {\n const actor = buildActorContext(event);\n const {\n data,\n meta,\n } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });\n\n return {\n data,\n meta,\n };\n }\n\n @DGet('/:id', [ForceLoggedInMiddleware])\n async getOne(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<Consent> {\n const actor = buildActorContext(event);\n\n return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async drop(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<Consent> {\n const actor = buildActorContext(event);\n\n const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });\n\n event.response.status = 202;\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAaU,oBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+B;EACvC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC0C;EAC1C,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQP,gBAAgBQ,KAAAA,GAAQC,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAElG,OAAO;GACHE;GACAC;EACJ;CACJ;CAEA,MACME,OACF,IACA,OACgB;EAChB,MAAMJ,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQQ,OAAOC,IAAIL,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;CAC9E;CAEA,MACMO,KACF,IACA,OACgB;EAChB,MAAMN,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAMQ,SAAS,MAAM,KAAKX,QAAQY,OAAOH,IAAIL,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAExFA,MAAMU,SAASC,SAAS;EACxB,OAAOH;CACX;AACJ;;WAtCef,uBAAAA,CAAAA;;;;;;;eAgBIA,uBAAAA,CAAAA;;;;;;;;kBAUGA,uBAAAA,CAAAA;;;;;;;;;cAlCR,aAAa,2BAAA,CAAA"}

package/dist/adapters/http/controllers/entities/event/index.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export * from './module.ts';
2	+ //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/event/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/event/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/event/index.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EventController } from "./module.mjs";
+export { EventController };

package/dist/adapters/http/controllers/entities/event/module.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+import type { Event } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse } from '@authup/core-http-kit';
+import type { IEventService } from '../../../../../core/index.ts';
+export type EventControllerContext = {
+    service: IEventService;
+};
+export declare class EventController {
+    protected service: IEventService;
+    constructor(ctx: EventControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<Event>>;
+    getOne(id: string, event: IAppEvent): Promise<Event>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/event/module.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/event/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAIlE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,aAAa,CAAC;CAC1B,CAAC;AAIF,qBAEa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;gBAErB,GAAG,EAAE,sBAAsB;IAKjC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAkBrC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,KAAK,CAAC;CAKpB"}

package/dist/adapters/http/controllers/entities/event/module.mjs ADDED Viewed

@@ -0,0 +1,68 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/event/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var EventController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });
+		return {
+			data,
+			meta
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], EventController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], EventController.prototype, "getOne", null);
+EventController = _ts_decorate([
+	DTags("event"),
+	DController(["/events", "/realms/:realmId/events"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof EventControllerContext === "undefined" ? Object : EventControllerContext])
+], EventController);
+//#endregion
+export { EventController };
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/event/module.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPath","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","getRequestRealmID","EventController","service","ctx","getMany","event","actor","data","meta","realmId","getOne","id"],"sources":["../../../../../../src/adapters/http/controllers/entities/event/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DContext,\n DController,\n DGet,\n DPath,\n DTags,\n} from '@routup/decorators';\nimport type { Event } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse } from '@authup/core-http-kit';\nimport type { IEventService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, getRequestRealmID } from '../../../request/index.ts';\n\nexport type EventControllerContext = {\n service: IEventService,\n};\n\n// Read-only surface — the log is append-only: writes happen internally via\n// IEventService.record(), pruning is the retention sweep's job.\n@DTags('event')\n@DController(['/events', '/realms/:realmId/events'])\nexport class EventController {\n protected service: IEventService;\n\n constructor(ctx: EventControllerContext) {\n this.service = ctx.service;\n }\n\n @DGet('', [ForceLoggedInMiddleware])\n async getMany(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<Event>> {\n const actor = buildActorContext(event);\n const {\n data,\n meta,\n } = await this.service.getMany(\n useRequestQuery(event),\n actor,\n { realmId: getRequestRealmID(event) },\n );\n\n return {\n data,\n meta,\n };\n }\n\n @DGet('/:id', [ForceLoggedInMiddleware])\n async getOne(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<Event> {\n const actor = buildActorContext(event);\n\n return this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAaS,kBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA6B;EACrC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OACwC;EACxC,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QACnBP,gBAAgBQ,KAAAA,GAChBC,OACA,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAGxC,OAAO;GACHE;GACAC;EACJ;CACJ;CAEA,MACME,OACF,IACA,OACc;EACd,MAAMJ,QAAQP,kBAAkBM,KAAAA;EAEhC,OAAO,KAAKH,QAAQQ,OAAOC,IAAIL,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;CAC9E;AACJ;;WA7BeP,uBAAAA,CAAAA;;;;;;;eAoBIA,uBAAAA,CAAAA;;;;;;;;;cA5BL,WAAW,yBAAA,CAAA"}

package/dist/adapters/http/controllers/entities/identity-provide-role/module.mjs CHANGED Viewed

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/identity-provide-role/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts CHANGED Viewed

@@ -1,18 +1,20 @@
 import type { IAppEvent } from 'routup';
 import type { IdentityProvider } from '@authup/core-kit';
 import type { EntityCollectionResponse, IdentityProviderCreatePayload, IdentityProviderSavePayload, IdentityProviderUpdatePayload } from '@authup/core-http-kit';
-import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IRealmRepository } from '../../../../../core/index.ts';
+import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
 import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';
 export declare class IdentityProviderController {
     protected options: IdentityProviderControllerOptions;
     protected repository: IIdentityProviderRepository;
     protected realmRepository: IRealmRepository;
+    protected clientRepository: IOAuth2ClientRepository;
     protected accountManager: IIdentityProviderAccountManager;
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     protected codeRequestValidator: OAuth2AuthorizationCodeRequestValidator;
     protected stateManager: IOAuth2AuthorizationStateManager;
     protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
     constructor(ctx: IdentityProviderControllerContext);
     getProviders(event: IAppEvent): Promise<EntityCollectionResponse<IdentityProvider>>;
     getProvider(id: string, event: IAppEvent): Promise<IdentityProvider>;
@@ -23,6 +25,7 @@ export declare class IdentityProviderController {
     authorizeOut(_id: string, event: IAppEvent): Promise<Response>;
     authorizeIn(_id: string, event: IAppEvent): Promise<Response>;
     private write;
+    private buildHostedAuthorizeURL;
     private resolve;
     private saveAuthorizationState;
     private verifyAuthorizationState;

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;~~AAgBzF~~,OAAO,KAAK,EACR,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,~~EAE1C~~,MAAM,8BAA8B,CAAC;AAWtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;~~gBAI1C~~,GAAG,EAAE,iCAAiC;~~IAc5C~~,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IA+BhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IA0BtB,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA6BvB,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAOvB,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;~~YA2ElB~~,KAAK;~~YA6FL~~,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;AAiBzF,OAAO,KAAK,EACR,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAG1C,MAAM,8BAA8B,CAAC;AAWtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAIpD,GAAG,EAAE,iCAAiC;IAgB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IA+BhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IA0BtB,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA6BvB,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAOvB,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YAyGlB,KAAK;IA6FnB,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs CHANGED Viewed

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2AuthorizationCodeRequestValidator } from "../../../../../core/oauth2/authorization/code-request/validator.mjs";
+import { toIdentityPolicyData } from "../../../../../core/identity/permission/identity-policy-data.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "../../../../../core/identity/provider/authentication/factory.mjs";
 import "../../../../../core/index.mjs";
 import { useRequestPermissionEvaluator } from "../../../request/permission/helper.mjs";
@@ -10,20 +11,20 @@ import { getBodyRealmID } from "../../../request/helpers/body-realm-id.mjs";
 import { getRequestParamID, useRequestParamID } from "../../../request/helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import { resolveURL } from "../../../../../utils/url.mjs";
 import "../../../../../utils/index.mjs";
-import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
 import { ValidatorGroup, base64URLDecode, isUUID } from "@authup/kit";
-import { IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
+import { IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, SessionAuthMethod, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
-import { OAuth2RequestError } from "@authup/specs";
+import { OAuth2ErrorCode, OAuth2RequestError } from "@authup/specs";
 import { URL } from "node:url";
 import { getRequestHeader, getRequestIP, sendRedirect } from "routup";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/identity-provider/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -43,20 +44,24 @@ var IdentityProviderController = class {
 	options;
 	repository;
 	realmRepository;
+	clientRepository;
 	accountManager;
 	codeRequestVerifier;
 	codeRequestValidator;
 	stateManager;
 	codeIssuer;
+	accessPolicyEvaluator;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
+		this.clientRepository = ctx.clientRepository;
 		this.accountManager = ctx.accountManager;
 		this.codeIssuer = ctx.codeIssuer;
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
 		this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();
 		this.stateManager = ctx.stateManager;
+		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
 	}
 	async getProviders(event) {
 		const { data, meta } = await this.repository.findMany(useRequestQuery(event));
@@ -164,6 +169,25 @@ var IdentityProviderController = class {
 			}
 		}).authenticate(code);
 		const realm = await this.realmRepository.resolve(entity.realm_id, true);
+		if (data.codeRequest?.client_id) {
+			const client = await this.clientRepository.findOneByIdOrName(data.codeRequest.client_id, data.codeRequest.realm_id);
+			if (client?.access_policy_id) {
+				let allowed = false;
+				const subject = toIdentityPolicyData({
+					type: IdentityType.USER,
+					data: {
+						...user,
+						realm
+					}
+				});
+				if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(client.access_policy_id, subject);
+				if (!allowed) {
+					const url = this.buildHostedAuthorizeURL(data.codeRequest);
+					url.searchParams.set("error", OAuth2ErrorCode.ACCESS_DENIED);
+					return sendRedirect(event, url.href);
+				}
+			}
+		}
 		const authorizationCode = await this.codeIssuer.issue({
 			response_type: "code",
 			client_id: data.codeRequest?.client_id,
@@ -175,14 +199,9 @@ var IdentityProviderController = class {
 				...user,
 				realm
 			}
-		});
+		}, { authMethod: SessionAuthMethod.EXTERNAL });
 		if (data.codeRequest) {
-			const codeRequestKeys = Object.keys(data.codeRequest);
-			const url = new URL(resolveURL(this.options.baseURL, "authorize"));
-			for (const codeRequestKey_ of codeRequestKeys) {
-				const codeRequestKey = codeRequestKey_;
-				if (data.codeRequest[codeRequestKey]) url.searchParams.set(codeRequestKey, data.codeRequest[codeRequestKey]);
-			}
+			const url = this.buildHostedAuthorizeURL(data.codeRequest);
 			url.searchParams.set("code", authorizationCode.id);
 			return sendRedirect(event, url.href);
 		}
@@ -248,6 +267,16 @@ var IdentityProviderController = class {
 		event.response.status = 201;
 		return entity;
 	}
+	buildHostedAuthorizeURL(codeRequest) {
+		const url = new URL(resolveURL(this.options.baseURL, "authorize"));
+		const codeRequestKeys = Object.keys(codeRequest);
+		for (const codeRequestKey_ of codeRequestKeys) {
+			const codeRequestKey = codeRequestKey_;
+			const codeRequestValue = codeRequest[codeRequestKey];
+			if (typeof codeRequestValue !== "undefined" && codeRequestValue !== null) url.searchParams.set(codeRequestKey, String(codeRequestValue));
+		}
+		return url;
+	}
 	async resolve(id) {
 		const entity = await this.repository.findOneById(id);
 		if (!entity) throw new EntityNotFoundError();

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","createIdentityProviderOAuth2Authenticator","applyRouteRealmIDToBody","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","ctx","getProviders","event","data","meta","findMany","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realm_id","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","code","clientId","client_id","authenticate","realm","authorizationCode","issue","response_type","redirect_uri","scope","type","USER","codeRequestKeys","Object","keys","url","codeRequestKey_","codeRequestKey","searchParams","set","href","group","body","realmId","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","findOneById","save","ip","trustProxy","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n IdentityProviderCreatePayload,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IRealmRepository,\n OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n createIdentityProviderOAuth2Authenticator,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.accountManager = ctx.accountManager;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data, \n meta, \n } = await this.repository.findMany(useRequestQuery(event));\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realm_id ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta,\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<IdentityProvider> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return entity;\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return entity;\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: { baseURL: this.options.baseURL },\n });\n\n const parameters : AuthorizeParameters = {};\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realm_id &&\n entity.realm_id &&\n entity.realm_id !== data.client.realm_id\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n if (\n entity.realm_id &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realm_id\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: {\n baseURL: this.options.baseURL,\n clientId: data.codeRequest?.client_id,\n },\n });\n\n const user = await authenticator.authenticate(code);\n\n const realm = await this.realmRepository.resolve(entity.realm_id, true);\n\n const authorizationCode = await this.codeIssuer.issue(\n {\n response_type: 'code',\n client_id: data.codeRequest?.client_id,\n redirect_uri: data.codeRequest?.redirect_uri,\n scope: data.codeRequest?.scope,\n },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n );\n\n if (data.codeRequest) {\n const codeRequestKeys = Object.keys(data.codeRequest);\n\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n if (data.codeRequest[codeRequestKey]) {\n url.searchParams.set(codeRequestKey, data.codeRequest[codeRequestKey]);\n }\n }\n\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<IdentityProvider> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realm_id = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? entity.realm_id ?? null,\n }),\n });\n } else {\n if (!data.realm_id) {\n const identity = useRequestIdentityOrFail(event);\n data.realm_id = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return entity;\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async saveAuthorizationState(\n event: IAppEvent,\n codeRequest?: OAuth2AuthorizationCodeRequest,\n ) : Promise<string> {\n return this.stateManager.save({\n codeRequest,\n ip: getRequestIP(event, { trustProxy: true }) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event, { trustProxy: true }) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,IAAawC,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKR,UAAUQ,IAAIR;EACnB,KAAKC,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKI,aAAaC,IAAID;EACtB,KAAKH,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuB,IAAIhB,wCAAAA;EAChC,KAAKiB,eAAeE,IAAIF;CAC5B;CAIA,MACMG,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKX,WAAWY,SAAS5B,gBAAgByB,KAAAA,CAAAA;EAEnD,IAAI;GACA,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;GAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAesC,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAASP,MAChB,IAAI;IACA,MAAMG,oBAAoBK,SAAS;KAC/BH,MAAMrC,eAAesC;KACrBN,MAAMnD,iBAAiB;OAAGD,kBAAkB6D,aAAaF;OAAQ3D,kBAAkB8D,cAAcH,MAAMI,YAAY;KAAK,CAAA;IAC5H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHX;GACAC;EACJ;CACJ;CAEA,MACMW,YACF,IACA,OACyB;EACzB,MAAME,UAAU7B,kBAAkBc,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EAEzD,MAAM+D,SAAS,MAAM,KAAKzB,WAAW0B,kBACjCF,SACA/B,kBAAkBgB,KAAAA,CAAAA;EAGtB,IAAI,CAACgB,QACD,MAAM,IAAI3C,oBAAAA;EAGd,IAAI;GAEA,MAD4Bc,8BAA8Ba,KACpDI,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMrC,eAAesC;IACrBN,MAAMnD,iBAAiB;MAAGD,kBAAkB6D,aAAaM;MAASnE,kBAAkB8D,cAAcK,OAAOJ,YAAY;IAAK,CAAA;GAC9H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAOI;CACX;CAEA,MACME,aACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKE,MAAMpB,OAAO,EAAEqB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKF,MAAMpB,KAAAA;CACtB;CAEA,MACMuB,aACF,IACA,OAC0B;EAC1B,MAAMR,UAAU7B,kBAAkBc,KAAAA;EAElC,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeuD,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAKzB,WAAWkC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI3C,oBAAAA;EAGd,MAAM+B,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAeuD;GACrBvB,MAAMnD,iBAAiB;KAAGD,kBAAkB6D,aAAaM;KAASnE,kBAAkB8D,cAAcK,OAAOJ,YAAY;GAAK,CAAA;EAC9H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAKzB,WAAWoC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ1B,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAEA,MACMc,YACF,MACA,OAC0B;EAC1B,OAAO,KAAKV,MAAMpB,KAAAA;CACtB;CAIA,MACM+B,aACF,KACA,OACF;EACE,MAAMjB,KAAK5B,kBAAkBc,KAAAA;EAC7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5C,yBAAyB8C,MAAAA,KAAW,CAAC7C,yBAAyB6C,MAAAA,GAC/D,MAAM,IAAI5C,gBAAgB,oFAAA;EAG9B,MAAM8D,gBAAgBtD,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrB0C,UAAUnB;GACV1B,SAAS,EAAE8C,SAAS,KAAK9C,QAAQ8C,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQhE,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOuC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAM1F,gBAAgBuF,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAM7D,mBAAmBkE,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKjD,qBAAqBkD,IAAIL,kBAAAA;GACjE,MAAMvC,OAAO,MAAM,KAAKP,oBAAoBoD,OAAOF,oBAAAA;GAEnD,IACI3C,KAAK8C,OAAOnC,YACZI,OAAOJ,YACPI,OAAOJ,aAAaX,KAAK8C,OAAOnC,UAEhC,MAAMnC,mBAAmBkE,UAAU,6CAAA;GAGvCL,cAAcrC,KAAKA;EACvB;EAEAoC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAOsC,WAAAA;EAE5D,OAAOzE,aAAamC,OAAOkC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAK5B,kBAAkBc,KAAAA;EAE7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5C,yBAAyB8C,MAAAA,KAAW,CAAC7C,yBAAyB6C,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMpD,OAAO,MAAM,KAAKqD,yBAAyBtD,KAAAA;EACjD,IACIgB,OAAOJ,YACPX,KAAKqC,eACLrC,KAAKqC,YAAY1B,YACjBX,KAAKqC,YAAY1B,aAAaI,OAAOJ,UAErC,MAAMnC,mBAAmBkE,UAAU,6CAAA;EAGvC,MAAM,EAAEY,SAAShF,gBAAgByB,KAAAA;EAWjC,MAAMmB,OAAO,MATSvC,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrB0C,UAAUnB;GACV1B,SAAS;IACL8C,SAAS,KAAK9C,QAAQ8C;IACtBoB,UAAUvD,KAAKqC,aAAamB;GAChC;EACJ,CAEmBvB,CAAAA,CAAcwB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKnE,gBAAgByC,QAAQjB,OAAOJ,UAAU,IAAA;EAElE,MAAMgD,oBAAoB,MAAM,KAAK/D,WAAWgE,MAC5C;GACIC,eAAe;GACfL,WAAWxD,KAAKqC,aAAamB;GAC7BM,cAAc9D,KAAKqC,aAAayB;GAChCC,OAAO/D,KAAKqC,aAAa0B;EAC7B,GACA;GACIC,MAAMjG,aAAakG;GACnBjE,MAAM;IACF,GAAGkB;IACHwC;GACJ;EACJ,CAAA;EAGJ,IAAI1D,KAAKqC,aAAa;GAClB,MAAM6B,kBAAkBC,OAAOC,KAAKpE,KAAKqC,WAAW;GAEpD,MAAMgC,MAAM,IAAI5F,IAAIJ,WAAW,KAAKgB,QAAQ8C,SAAS,WAAA,CAAA;GACrD,KAAK,MAAMmC,mBAAmBJ,iBAAiB;IAC3C,MAAMK,iBAAiBD;IACvB,IAAItE,KAAKqC,YAAYkC,iBACjBF,IAAIG,aAAaC,IAAIF,gBAAgBvE,KAAKqC,YAAYkC,eAAe;GAE7E;GAEAF,IAAIG,aAAaC,IAAI,QAAQd,kBAAkB9C,EAAE;GAEjD,OAAOjD,aAAamC,OAAOsE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAI5F,IAAI,KAAKY,QAAQ8C,OAAO;EACxCkC,IAAIG,aAAaC,IAAI,QAAQd,kBAAkB9C,EAAE;EAEjD,OAAOjD,aAAamC,OAAOsE,IAAIK,IAAI;CACvC;CAIA,MAAcvD,MAAMpB,OAAkBV,UAElC,CAAC,GAA8B;EAC/B,IAAIsF;EACJ,MAAM9D,KAAK/B,kBAAkBiB,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EACpD,MAAM4H,OAAO,MAAMrG,gBAAgBwB,KAAAA;EACnCnB,wBAAwBmB,OAAO6E,IAAAA;EAC/B,MAAMC,UAAU9F,kBAAkBgB,KAAAA,KAAUlB,eAAe+F,IAAAA;EAE3D,IAAI7D;EACJ,IAAIF,IAAI;GACJ,MAAMiE,QAA6B,CAAC;GACpC,IAAI9H,OAAO6D,EAAAA,GACPiE,MAAMjE,KAAKA;QAEXiE,MAAMzE,OAAOQ;GAGjB,IAAIgE,SACAC,MAAMnE,WAAWkE;GAGrB9D,SAAS,MAAM,KAAKzB,WAAWkC,UAAUsD,KAAAA;GACzC,IAAI,CAAC/D,UAAU1B,QAAQ+B,YACnB,MAAM,IAAIhD,oBAAAA;EAElB,OAAO,IAAIiB,QAAQ+B,YACf,MAAM,IAAIhD,oBAAAA;EAGd,MAAM+B,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,IAAIgB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAe+G,yBAAyB,CAAA;GAEtFJ,QAAQ7H,eAAekI;EAC3B,OAAO;GACH,MAAM7E,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeiH,yBAAyB,CAAA;GAEtFN,QAAQ7H,eAAeoI;EAC3B;EAGA,MAAMlF,OAAO,MAAMmF,IADGrH,0BACHqH,CAAAA,CAAUvC,IAAIgC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMU,aAAa,MAAMD,IADOvH,oCACPuH,CAAAA,CAAoBxC,IAAIgC,IAAAA;EAEjD,MAAM,KAAKtF,WAAWgG,oBAAoBtF,IAAAA;EAE1C,IAAIe,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAe+G;GACrB/E,MAAMnD,iBAAiB;KAClBD,kBAAkB6D,aAAa;KAC5B,GAAGM;KACH,GAAGf;IACP;KACCpD,kBAAkB8D,cAAcV,KAAKW,YAAYI,OAAOJ,YAAY;GACzE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACX,KAAKW,UAENX,KAAKW,WADY3B,yBAAyBe,KAC1BwF,CAAAA,CAASV;GAG7B,MAAM1E,oBAAoBK,SAAS;IAC/BH,MAAMrC,eAAeiH;IACrBjF,MAAMnD,iBAAiB;MAAGD,kBAAkB6D,aAAaT;MAAOpD,kBAAkB8D,cAAcV,KAAKW,YAAY;IAAK,CAAA;GAC1H,CAAA;EACJ;EAEA,MAAM,KAAKrB,WAAWkG,gBAAgBxF,MAAMe,UAAU0E,KAAAA,CAAAA;EAEtD,IAAI1E,QAAQ;GACRA,SAAS,KAAKzB,WAAWoG,MAAM3E,QAAQf,IAAAA;GACvC,MAAM,KAAKV,WAAWqG,WAAW5E,QAAQsE,UAAAA;GAEzCtF,MAAM4B,SAASC,SAAS;GAExB,OAAOb;EACX;EAEAA,SAAS,KAAKzB,WAAWsG,OAAO5F,IAAAA;EAChC,MAAM,KAAKV,WAAWqG,WAAW5E,QAAQsE,UAAAA;EAEzCtF,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAIA,MAAciB,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAKzB,WAAWuG,YAAYhF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI3C,oBAAAA;EAGd,OAAO2C;CACX;CAIA,MAAciC,uBACVjD,OACAsC,aACgB;EAChB,OAAO,KAAK1C,aAAamG,KAAK;GAC1BzD;GACA0D,IAAIpI,aAAaoC,OAAO,EAAEiG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWvI,iBAAiBqC,OAAO,YAAA,KAAiB0F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAAcpC,yBAAyBtD,OAAqD;EACxF,MAAMuC,QAAQhE,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOuC,MAAMS,UAAU,UACvB,MAAMvE,mBAAmB0H,aAAY;EAGzC,OAAO,KAAKvG,aAAakD,OAAOP,MAAMS,OAAO;GACzCgD,IAAIpI,aAAaoC,OAAO,EAAEiG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWvI,iBAAiBqC,OAAO,YAAA,KAAiB0F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;gBA3ToBtG,uBAAAA,CAAAA;;;;;;;;;;;;;eASDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBASGA,uBAAAA,CAAAA;;;;;;;;YAgCNA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAjJF,uBAAuB,qCAAA,CAAA"}
1	+ {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","SessionAuthMethod","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2ErrorCode","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","createIdentityProviderOAuth2Authenticator","toIdentityPolicyData","applyRouteRealmIDToBody","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","clientRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","accessPolicyEvaluator","ctx","getProviders","event","data","meta","findMany","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realm_id","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","code","clientId","client_id","authenticate","realm","access_policy_id","allowed","subject","type","USER","url","buildHostedAuthorizeURL","searchParams","set","ACCESS_DENIED","href","authorizationCode","issue","response_type","redirect_uri","scope","authMethod","EXTERNAL","group","body","realmId","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","save","ip","trustProxy","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n SessionAuthMethod,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2ErrorCode, OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n IdentityProviderCreatePayload,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IOAuth2ClientRepository,\n IRealmRepository,\n OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n createIdentityProviderOAuth2Authenticator,\n toIdentityPolicyData,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.clientRepository = ctx.clientRepository;\n this.accountManager = ctx.accountManager;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data,\n meta,\n } = await this.repository.findMany(useRequestQuery(event));\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realm_id ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta,\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<IdentityProvider> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return entity;\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return entity;\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProvider> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: { baseURL: this.options.baseURL },\n });\n\n const parameters : AuthorizeParameters = {};\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realm_id &&\n entity.realm_id &&\n entity.realm_id !== data.client.realm_id\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n if (\n entity.realm_id &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realm_id\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: {\n baseURL: this.options.baseURL,\n clientId: data.codeRequest?.client_id,\n },\n });\n\n const user = await authenticator.authenticate(code);\n\n const realm = await this.realmRepository.resolve(entity.realm_id, true);\n\n // Application access policy (plan 052), federated leg: the callback\n // never redirects to the RP directly — a denial bounces back to the\n // hosted authorize page with error=access_denied, so no\n // redirectUriVerified threading through the state blob is needed.\n // A policy id with no wired evaluator denies (fail closed); a\n // since-deleted client is skipped (the /token backstop still covers it).\n if (data.codeRequest?.client_id) {\n const client = await this.clientRepository.findOneByIdOrName(\n data.codeRequest.client_id,\n data.codeRequest.realm_id,\n );\n\n if (client?.access_policy_id) {\n let allowed = false;\n\n const subject = toIdentityPolicyData({\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n });\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n client.access_policy_id,\n subject,\n );\n }\n\n if (!allowed) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n\n return sendRedirect(event, url.href);\n }\n }\n }\n\n const authorizationCode = await this.codeIssuer.issue(\n {\n response_type: 'code',\n client_id: data.codeRequest?.client_id,\n redirect_uri: data.codeRequest?.redirect_uri,\n scope: data.codeRequest?.scope,\n },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n { authMethod: SessionAuthMethod.EXTERNAL },\n );\n\n if (data.codeRequest) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<IdentityProvider> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realm_id = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? entity.realm_id ?? null,\n }),\n });\n } else {\n if (!data.realm_id) {\n const identity = useRequestIdentityOrFail(event);\n data.realm_id = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return entity;\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n const codeRequestKeys = Object.keys(codeRequest);\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n const codeRequestValue = codeRequest[codeRequestKey];\n // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n // treats as prompt=login) — only skip absent ones.\n if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n url.searchParams.set(codeRequestKey, String(codeRequestValue));\n }\n }\n\n return url;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async saveAuthorizationState(\n event: IAppEvent,\n codeRequest?: OAuth2AuthorizationCodeRequest,\n ) : Promise<string> {\n return this.stateManager.save({\n codeRequest,\n ip: getRequestIP(event, { trustProxy: true }) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event, { trustProxy: true }) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,IAAa2C,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKV,UAAUU,IAAIV;EACnB,KAAKC,aAAaS,IAAIT;EACtB,KAAKC,kBAAkBQ,IAAIR;EAC3B,KAAKC,mBAAmBO,IAAIP;EAC5B,KAAKC,iBAAiBM,IAAIN;EAC1B,KAAKI,aAAaE,IAAIF;EACtB,KAAKH,sBAAsBK,IAAIL;EAC/B,KAAKC,uBAAuB,IAAIlB,wCAAAA;EAChC,KAAKmB,eAAeG,IAAIH;EACxB,KAAKE,wBAAwBC,IAAID;CACrC;CAIA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKb,WAAWc,SAAShC,gBAAgB6B,KAAAA,CAAAA;EAEnD,IAAI;GACA,MAAMI,sBAAsBnB,8BAA8Be,KAAAA;GAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAM1C,eAAe2C,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAASP,MAChB,IAAI;IACA,MAAMG,oBAAoBK,SAAS;KAC/BH,MAAM1C,eAAe2C;KACrBN,MAAMxD,iBAAiB;OAAGD,kBAAkBkE,aAAaF;OAAQhE,kBAAkBmE,cAAcH,MAAMI,YAAY;KAAK,CAAA;IAC5H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHX;GACAC;EACJ;CACJ;CAEA,MACMW,YACF,IACA,OACyB;EACzB,MAAME,UAAU/B,kBAAkBgB,OAAO,EAAEpD,QAAQ,MAAM,CAAA;EAEzD,MAAMoE,SAAS,MAAM,KAAK3B,WAAW4B,kBACjCF,SACAjC,kBAAkBkB,KAAAA,CAAAA;EAGtB,IAAI,CAACgB,QACD,MAAM,IAAI/C,oBAAAA;EAGd,IAAI;GAEA,MAD4BgB,8BAA8Be,KACpDI,CAAAA,CAAoBK,SAAS;IAC/BH,MAAM1C,eAAe2C;IACrBN,MAAMxD,iBAAiB;MAAGD,kBAAkBkE,aAAaM;MAASxE,kBAAkBmE,cAAcK,OAAOJ,YAAY;IAAK,CAAA;GAC9H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAOI;CACX;CAEA,MACME,aACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKE,MAAMpB,OAAO,EAAEqB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKF,MAAMpB,KAAAA;CACtB;CAEA,MACMuB,aACF,IACA,OAC0B;EAC1B,MAAMR,UAAU/B,kBAAkBgB,KAAAA;EAElC,MAAMI,sBAAsBnB,8BAA8Be,KAAAA;EAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAM1C,eAAe4D,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAK3B,WAAWoC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI/C,oBAAAA;EAGd,MAAMmC,oBAAoBK,SAAS;GAC/BH,MAAM1C,eAAe4D;GACrBvB,MAAMxD,iBAAiB;KAAGD,kBAAkBkE,aAAaM;KAASxE,kBAAkBmE,cAAcK,OAAOJ,YAAY;GAAK,CAAA;EAC9H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAK3B,WAAWsC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ1B,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAEA,MACMc,YACF,MACA,OAC0B;EAC1B,OAAO,KAAKV,MAAMpB,KAAAA;CACtB;CAIA,MACM+B,aACF,KACA,OACF;EACE,MAAMjB,KAAK9B,kBAAkBgB,KAAAA;EAC7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAChD,yBAAyBkD,MAAAA,KAAW,CAACjD,yBAAyBiD,MAAAA,GAC/D,MAAM,IAAIhD,gBAAgB,oFAAA;EAG9B,MAAMkE,gBAAgBzD,0CAA0C;GAC5De,gBAAgB,KAAKA;GACrB2C,UAAUnB;GACV5B,SAAS,EAAEgD,SAAS,KAAKhD,QAAQgD,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQpE,gBAAgB6B,KAAAA;EAC9B,IAAI,OAAOuC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAM/F,gBAAgB4F,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAMhE,mBAAmBqE,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKlD,qBAAqBmD,IAAIL,kBAAAA;GACjE,MAAMvC,OAAO,MAAM,KAAKR,oBAAoBqD,OAAOF,oBAAAA;GAEnD,IACI3C,KAAK8C,OAAOnC,YACZI,OAAOJ,YACPI,OAAOJ,aAAaX,KAAK8C,OAAOnC,UAEhC,MAAMtC,mBAAmBqE,UAAU,6CAAA;GAGvCL,cAAcrC,KAAKA;EACvB;EAEAoC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAOsC,WAAAA;EAE5D,OAAO9E,aAAawC,OAAOkC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAK9B,kBAAkBgB,KAAAA;EAE7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAChD,yBAAyBkD,MAAAA,KAAW,CAACjD,yBAAyBiD,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMpD,OAAO,MAAM,KAAKqD,yBAAyBtD,KAAAA;EACjD,IACIgB,OAAOJ,YACPX,KAAKqC,eACLrC,KAAKqC,YAAY1B,YACjBX,KAAKqC,YAAY1B,aAAaI,OAAOJ,UAErC,MAAMtC,mBAAmBqE,UAAU,6CAAA;EAGvC,MAAM,EAAEY,SAASpF,gBAAgB6B,KAAAA;EAWjC,MAAMmB,OAAO,MATS1C,0CAA0C;GAC5De,gBAAgB,KAAKA;GACrB2C,UAAUnB;GACV5B,SAAS;IACLgD,SAAS,KAAKhD,QAAQgD;IACtBoB,UAAUvD,KAAKqC,aAAamB;GAChC;EACJ,CAEmBvB,CAAAA,CAAcwB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKrE,gBAAgB2C,QAAQjB,OAAOJ,UAAU,IAAA;EAQlE,IAAIX,KAAKqC,aAAamB,WAAW;GAC7B,MAAMV,SAAS,MAAM,KAAKxD,iBAAiB0B,kBACvChB,KAAKqC,YAAYmB,WACjBxD,KAAKqC,YAAY1B,QAAQ;GAG7B,IAAImC,QAAQa,kBAAkB;IAC1B,IAAIC,UAAU;IAEd,MAAMC,UAAUpF,qBAAqB;KACjCqF,MAAMpG,aAAaqG;KACnB/D,MAAM;MACF,GAAGkB;MACHwC;KACJ;IACJ,CAAA;IACA,IAAI,KAAK9D,yBAAyBiE,SAC9BD,UAAU,MAAM,KAAKhE,sBAAsBY,SACvCsC,OAAOa,kBACPE,OAAAA;IAIR,IAAI,CAACD,SAAS;KACV,MAAMI,MAAM,KAAKC,wBAAwBjE,KAAKqC,WAAW;KACzD2B,IAAIE,aAAaC,IAAI,SAAS/F,gBAAgBgG,aAAa;KAE3D,OAAO7G,aAAawC,OAAOiE,IAAIK,IAAI;IACvC;GACJ;EACJ;EAEA,MAAMC,oBAAoB,MAAM,KAAK3E,WAAW4E,MAC5C;GACIC,eAAe;GACfhB,WAAWxD,KAAKqC,aAAamB;GAC7BiB,cAAczE,KAAKqC,aAAaoC;GAChCC,OAAO1E,KAAKqC,aAAaqC;EAC7B,GACA;GACIZ,MAAMpG,aAAaqG;GACnB/D,MAAM;IACF,GAAGkB;IACHwC;GACJ;EACJ,GACA,EAAEiB,YAAY/G,kBAAkBgH,SAAS,CAAA;EAG7C,IAAI5E,KAAKqC,aAAa;GAClB,MAAM2B,MAAM,KAAKC,wBAAwBjE,KAAKqC,WAAW;GACzD2B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkBzD,EAAE;GAEjD,OAAOtD,aAAawC,OAAOiE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAI1F,IAAI,KAAKa,QAAQgD,OAAO;EACxC6B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkBzD,EAAE;EAEjD,OAAOtD,aAAawC,OAAOiE,IAAIK,IAAI;CACvC;CAIA,MAAclD,MAAMpB,OAAkBZ,UAElC,CAAC,GAA8B;EAC/B,IAAI0F;EACJ,MAAMhE,KAAKjC,kBAAkBmB,OAAO,EAAEpD,QAAQ,MAAM,CAAA;EACpD,MAAMmI,OAAO,MAAM3G,gBAAgB4B,KAAAA;EACnCrB,wBAAwBqB,OAAO+E,IAAAA;EAC/B,MAAMC,UAAUlG,kBAAkBkB,KAAAA,KAAUpB,eAAemG,IAAAA;EAE3D,IAAI/D;EACJ,IAAIF,IAAI;GACJ,MAAMmE,QAA6B,CAAC;GACpC,IAAIrI,OAAOkE,EAAAA,GACPmE,MAAMnE,KAAKA;QAEXmE,MAAM3E,OAAOQ;GAGjB,IAAIkE,SACAC,MAAMrE,WAAWoE;GAGrBhE,SAAS,MAAM,KAAK3B,WAAWoC,UAAUwD,KAAAA;GACzC,IAAI,CAACjE,UAAU5B,QAAQiC,YACnB,MAAM,IAAIpD,oBAAAA;EAElB,OAAO,IAAImB,QAAQiC,YACf,MAAM,IAAIpD,oBAAAA;EAGd,MAAMmC,sBAAsBnB,8BAA8Be,KAAAA;EAC1D,IAAIgB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAM1C,eAAesH,yBAAyB,CAAA;GAEtFJ,QAAQpI,eAAeyI;EAC3B,OAAO;GACH,MAAM/E,oBAAoBC,YAAY,EAAEC,MAAM1C,eAAewH,yBAAyB,CAAA;GAEtFN,QAAQpI,eAAe2I;EAC3B;EAGA,MAAMpF,OAAO,MAAMqF,IADG5H,0BACH4H,CAAAA,CAAUzC,IAAIkC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMU,aAAa,MAAMD,IADO9H,oCACP8H,CAAAA,CAAoB1C,IAAIkC,IAAAA;EAEjD,MAAM,KAAK1F,WAAWoG,oBAAoBxF,IAAAA;EAE1C,IAAIe,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAM1C,eAAesH;GACrBjF,MAAMxD,iBAAiB;KAClBD,kBAAkBkE,aAAa;KAC5B,GAAGM;KACH,GAAGf;IACP;KACCzD,kBAAkBmE,cAAcV,KAAKW,YAAYI,OAAOJ,YAAY;GACzE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACX,KAAKW,UAENX,KAAKW,WADY7B,yBAAyBiB,KAC1B0F,CAAAA,CAASV;GAG7B,MAAM5E,oBAAoBK,SAAS;IAC/BH,MAAM1C,eAAewH;IACrBnF,MAAMxD,iBAAiB;MAAGD,kBAAkBkE,aAAaT;MAAOzD,kBAAkBmE,cAAcV,KAAKW,YAAY;IAAK,CAAA;GAC1H,CAAA;EACJ;EAEA,MAAM,KAAKvB,WAAWsG,gBAAgB1F,MAAMe,UAAU4E,KAAAA,CAAAA;EAEtD,IAAI5E,QAAQ;GACRA,SAAS,KAAK3B,WAAWwG,MAAM7E,QAAQf,IAAAA;GACvC,MAAM,KAAKZ,WAAWyG,WAAW9E,QAAQwE,UAAAA;GAEzCxF,MAAM4B,SAASC,SAAS;GAExB,OAAOb;EACX;EAEAA,SAAS,KAAK3B,WAAW0G,OAAO9F,IAAAA;EAChC,MAAM,KAAKZ,WAAWyG,WAAW9E,QAAQwE,UAAAA;EAEzCxF,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAIQkD,wBAAwB5B,aAAkD;EAC9E,MAAM2B,MAAM,IAAI1F,IAAIL,WAAW,KAAKkB,QAAQgD,SAAS,WAAA,CAAA;EAErD,MAAM4D,kBAAkBC,OAAOC,KAAK5D,WAAAA;EACpC,KAAK,MAAM6D,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmB/D,YAAY8D;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChEpC,IAAIE,aAAaC,IAAIgC,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAOpC;CACX;CAIA,MAAchC,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAK3B,WAAWkH,YAAYzF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI/C,oBAAAA;EAGd,OAAO+C;CACX;CAIA,MAAciC,uBACVjD,OACAsC,aACgB;EAChB,OAAO,KAAK3C,aAAa6G,KAAK;GAC1BlE;GACAmE,IAAIlJ,aAAayC,OAAO,EAAE0G,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWrJ,iBAAiB0C,OAAO,YAAA,KAAiB4F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBtD,OAAqD;EACxF,MAAMuC,QAAQpE,gBAAgB6B,KAAAA;EAC9B,IAAI,OAAOuC,MAAMS,UAAU,UACvB,MAAM1E,mBAAmBsI,aAAY;EAGzC,OAAO,KAAKjH,aAAamD,OAAOP,MAAMS,OAAO;GACzCyD,IAAIlJ,aAAayC,OAAO,EAAE0G,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWrJ,iBAAiB0C,OAAO,YAAA,KAAiB4F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;gBA5WoB1G,uBAAAA,CAAAA;;;;;;;;;;;;;eASDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBASGA,uBAAAA,CAAAA;;;;;;;;YAgCNA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAvJF,uBAAuB,qCAAA,CAAA"}

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IRealmRepository } from '../../../../../core/index.ts';
+import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
 export type IdentityProviderControllerOptions = {
     baseURL: string;
 };
@@ -6,9 +6,11 @@ export type IdentityProviderControllerContext = {
     options: IdentityProviderControllerOptions;
     repository: IIdentityProviderRepository;
     realmRepository: IRealmRepository;
+    clientRepository: IOAuth2ClientRepository;
     accountManager: IIdentityProviderAccountManager;
     codeIssuer: IOAuth2AuthorizationCodeIssuer;
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     stateManager: IOAuth2AuthorizationStateManager;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EACnB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IACxC,eAAe,EAAE,gBAAgB,CAAC;~~IAElC~~,cAAc,EAAE,+BAA+B,CAAC;IAChD,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;~~CAClD~~,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,EACnB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IACxC,eAAe,EAAE,gBAAgB,CAAC;IAClC,gBAAgB,EAAE,uBAAuB,CAAC;IAE1C,cAAc,EAAE,+BAA+B,CAAC;IAChD,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;IAE/C,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;CACxD,CAAC"}

package/dist/adapters/http/controllers/entities/index.d.ts CHANGED Viewed

@@ -2,8 +2,11 @@ export * from './client/index.ts';
 export * from './client-permission/index.ts';
 export * from './client-role/index.ts';
 export * from './client-scope/index.ts';
+export * from './consent/index.ts';
+export * from './event/index.ts';
 export * from './identity-provider/index.ts';
 export * from './identity-provide-role/index.ts';
+export * from './key/index.ts';
 export * from './permission/index.ts';
 export * from './permission-policy/index.ts';
 export * from './realm/index.ts';
@@ -15,8 +18,11 @@ export * from './role-attribute/index.ts';
 export * from './role-permission/index.ts';
 export * from './policy/index.ts';
 export * from './scope/index.ts';
+export * from './session/index.ts';
+export * from './trust-anchor/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';
+export * from './user-authenticator/index.ts';
 export * from './user-permission/index.ts';
 export * from './user-role/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}

package/dist/adapters/http/controllers/entities/index.mjs CHANGED Viewed

@@ -12,10 +12,16 @@ import "./client-role/index.mjs";
 import { ClientScopeController } from "./client-scope/module.mjs";
 import { ClientScopeRequestValidator } from "./client-scope/utils/validator.mjs";
 import "./client-scope/index.mjs";
+import { ConsentController } from "./consent/module.mjs";
+import "./consent/index.mjs";
+import { EventController } from "./event/module.mjs";
+import "./event/index.mjs";
 import { IdentityProviderController } from "./identity-provider/module.mjs";
 import "./identity-provider/index.mjs";
 import { IdentityProviderRoleMappingController } from "./identity-provide-role/module.mjs";
 import "./identity-provide-role/index.mjs";
+import { KeyController } from "./key/module.mjs";
+import "./key/index.mjs";
 import { PermissionController } from "./permission/module.mjs";
 import "./permission/index.mjs";
 import { PermissionPolicyController } from "./permission-policy/module.mjs";
@@ -44,15 +50,21 @@ import { PolicyValidator } from "./policy/utils/validation.mjs";
 import "./policy/index.mjs";
 import { ScopeController } from "./scope/module.mjs";
 import "./scope/index.mjs";
+import { SessionController } from "./session/module.mjs";
+import "./session/index.mjs";
+import { TrustAnchorController } from "./trust-anchor/module.mjs";
+import "./trust-anchor/index.mjs";
 import { UserController } from "./user/module.mjs";
 import "./user/index.mjs";
 import { UserAttributeController } from "./user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./user-attribute/utils/validation.mjs";
 import "./user-attribute/index.mjs";
+import { UserAuthenticatorController } from "./user-authenticator/module.mjs";
+import "./user-authenticator/index.mjs";
 import { UserPermissionController } from "./user-permission/module.mjs";
 import { UserPermissionRequestValidator } from "./user-permission/utils/validation.mjs";
 import "./user-permission/index.mjs";
 import { UserRoleController } from "./user-role/module.mjs";
 import { UserRoleRequestValidator } from "./user-role/utils/validation.mjs";
 import "./user-role/index.mjs";
-export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, IdentityProviderController, IdentityProviderRoleMappingController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };
+export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };