npm - @authup/server-core - Versions diffs - 1.0.0-beta.57 → 1.0.0-beta.59 - Mend

@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (416) hide show

package/dist/adapters/database/logger/module.mjs CHANGED Viewed

@@ -29,10 +29,8 @@ import { AdvancedConsoleLogger } from "typeorm";
 				else this.logger.warn(`[DB]: ${message.message}`);
 				break;
 			case "error":
-			case "query-error":
-				if (message.prefix) this.logger.error(`[DB]: ${message.prefix} ${message.message}`);
-				else this.logger.error(`[DB]: ${message.message}`);
-				break;
+			case "query-error": if (message.prefix) this.logger.error(`[DB]: ${message.prefix} ${message.message}`);
+			else this.logger.error(`[DB]: ${message.message}`);
 		}
 	}
 };

package/dist/adapters/database/logger/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["AdvancedConsoleLogger","DatabaseLogger","logger","writeLog","level","logMessage","messages","prepareLogMessages","message","type","debug","info","prefix","warn","error"],"sources":["../../../../src/adapters/database/logger/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Logger } from '@authup/server-kit';\nimport type { LogLevel, LogMessage } from 'typeorm';\nimport { AdvancedConsoleLogger } from 'typeorm';\n\n/\n @see https://github.com/typeorm/typeorm/blob/master/src/logger/AdvancedConsoleLogger.ts\n */\n\nexport class DatabaseLogger extends AdvancedConsoleLogger {\n protected logger : Logger;\n\n constructor(logger : Logger) {\n super();\n\n this.logger = logger;\n }\n\n protected writeLog(\n level: LogLevel,\n logMessage: LogMessage \| LogMessage[],\n ) {\n const messages = this.prepareLogMessages(logMessage);\n\n for (const message of messages) {\n switch (message.type ?? level) {\n case 'log':\n case 'schema-build':\n case 'migration':\n this.logger.debug(`[DB]: ${message.message}`);\n break;\n\n case 'info':\n case 'query':\n this.logger.info(`[DB]: ${message.message}`);\n break;\n\n case 'warn':\n case 'query-slow':\n if (message.prefix) {\n this.logger.warn(`[DB]: ${message.prefix} ${message.message}`);\n } else {\n this.logger.warn(`[DB]: ${message.message}`);\n }\n break;\n\n case 'error':\n case 'query-error':\n if (message.prefix) {\n this.logger.error(`[DB]: ${message.prefix} ${message.message}`);\n } else {\n this.logger.error(`[DB]: ${message.message}`);\n }\n break;\n }\n }\n }\n}\n"],"mappings":";;;;;;;GAeA,IAAaC,iBAAb,cAAoCD,sBAAAA;CACtBE;CAEV,YAAYA,QAAiB;EACzB,MAAK;EAEL,KAAKA,SAASA;CAClB;CAEUC,SACNC,OACAC,YACF;EACE,MAAMC,WAAW,KAAKC,mBAAmBF,UAAAA;EAEzC,KAAK,MAAMG,WAAWF,UAClB,QAAQE,QAAQC,QAAQL,OAAxB;GACI,KAAK;GACL,KAAK;GACL,KAAK;IACD,KAAKF,OAAOQ,MAAM,SAASF,QAAQA,SAAS;IAC5C;GAEJ,KAAK;GACL,KAAK;IACD,KAAKN,OAAOS,KAAK,SAASH,QAAQA,SAAS;IAC3C;GAEJ,KAAK;GACL,KAAK;IACD,IAAIA,QAAQI,QACR,KAAKV,OAAOW,KAAK,SAASL,QAAQI,OAAO,GAAGJ,QAAQA,SAAS;SAE7D,KAAKN,OAAOW,KAAK,SAASL,QAAQA,SAAS;IAE/C;GAEJ,KAAK;GACL,KAAK~~;IACD~~,IAAIA,QAAQI,QACR,KAAKV,OAAOY,MAAM,SAASN,QAAQI,OAAO,GAAGJ,QAAQA,SAAS;~~SAE9D~~,KAAKN,OAAOY,MAAM,SAASN,QAAQA,SAAS;~~IAEhD~~;~~EACR;~~CAER;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["AdvancedConsoleLogger","DatabaseLogger","logger","writeLog","level","logMessage","messages","prepareLogMessages","message","type","debug","info","prefix","warn","error"],"sources":["../../../../src/adapters/database/logger/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Logger } from '@authup/server-kit';\nimport type { LogLevel, LogMessage } from 'typeorm';\nimport { AdvancedConsoleLogger } from 'typeorm';\n\n/\n @see https://github.com/typeorm/typeorm/blob/master/src/logger/AdvancedConsoleLogger.ts\n */\n\nexport class DatabaseLogger extends AdvancedConsoleLogger {\n protected logger : Logger;\n\n constructor(logger : Logger) {\n super();\n\n this.logger = logger;\n }\n\n protected writeLog(\n level: LogLevel,\n logMessage: LogMessage \| LogMessage[],\n ) {\n const messages = this.prepareLogMessages(logMessage);\n\n for (const message of messages) {\n switch (message.type ?? level) {\n case 'log':\n case 'schema-build':\n case 'migration':\n this.logger.debug(`[DB]: ${message.message}`);\n break;\n\n case 'info':\n case 'query':\n this.logger.info(`[DB]: ${message.message}`);\n break;\n\n case 'warn':\n case 'query-slow':\n if (message.prefix) {\n this.logger.warn(`[DB]: ${message.prefix} ${message.message}`);\n } else {\n this.logger.warn(`[DB]: ${message.message}`);\n }\n break;\n\n case 'error':\n case 'query-error':\n if (message.prefix) {\n this.logger.error(`[DB]: ${message.prefix} ${message.message}`);\n } else {\n this.logger.error(`[DB]: ${message.message}`);\n }\n break;\n }\n }\n }\n}\n"],"mappings":";;;;;;;GAeA,IAAaC,iBAAb,cAAoCD,sBAAAA;CACtBE;CAEV,YAAYA,QAAiB;EACzB,MAAK;EAEL,KAAKA,SAASA;CAClB;CAEUC,SACNC,OACAC,YACF;EACE,MAAMC,WAAW,KAAKC,mBAAmBF,UAAAA;EAEzC,KAAK,MAAMG,WAAWF,UAClB,QAAQE,QAAQC,QAAQL,OAAxB;GACI,KAAK;GACL,KAAK;GACL,KAAK;IACD,KAAKF,OAAOQ,MAAM,SAASF,QAAQA,SAAS;IAC5C;GAEJ,KAAK;GACL,KAAK;IACD,KAAKN,OAAOS,KAAK,SAASH,QAAQA,SAAS;IAC3C;GAEJ,KAAK;GACL,KAAK;IACD,IAAIA,QAAQI,QACR,KAAKV,OAAOW,KAAK,SAASL,QAAQI,OAAO,GAAGJ,QAAQA,SAAS;SAE7D,KAAKN,OAAOW,KAAK,SAASL,QAAQA,SAAS;IAE/C;GAEJ,KAAK;GACL,KAAK,eACD,IAAIA,QAAQI,QACR,KAAKV,OAAOY,MAAM,SAASN,QAAQI,OAAO,GAAGJ,QAAQA,SAAS;QAE9D,KAAKN,OAAOY,MAAM,SAASN,QAAQA,SAAS;EAGxD;CAER;AACJ"}

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;AAiBzF,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAO1C,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAIpD,GAAG,EAAE,iCAAiC;IAgB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAuChD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YAyGlB,KAAK;~~IA6FnB~~,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;AAiBzF,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAO1C,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAIpD,GAAG,EAAE,iCAAiC;IAgB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAuChD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YAyGlB,KAAK;IA+FnB,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs CHANGED Viewed

@@ -238,7 +238,7 @@ var IdentityProviderController = class {
 			else where.name = id;
 			if (realmId) where.realmId = realmId;
 			entity = await this.repository.findOneBy(where);
-			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+			if (!entity && (options.updateOnly || where.id)) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
 		const permissionEvaluator = useRequestPermissionEvaluator(event);
 		if (entity) {

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","SessionAuthMethod","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2ErrorCode","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","RECORD_QUERY_PARAMETERS","createIdentityProviderOAuth2Authenticator","decodeQuery","describeQuerySchema","identityProviderSchema","toIdentityPolicyData","applyRouteRealmIDToBody","buildActorContext","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","clientRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","accessPolicyEvaluator","ctx","getProviders","event","data","meta","findMany","schema","actor","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realmId","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","realm_id","code","clientId","client_id","authenticate","realm","accessPolicyId","allowed","subject","type","USER","url","buildHostedAuthorizeURL","searchParams","set","ACCESS_DENIED","href","authorizationCode","issue","response_type","redirect_uri","scope","authMethod","EXTERNAL","group","body","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","save","ip","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n SessionAuthMethod,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2ErrorCode, OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n EntityRecordResponse,\n IdentityProviderCreatePayload,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IOAuth2ClientRepository,\n IRealmRepository,\n OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n RECORD_QUERY_PARAMETERS,\n createIdentityProviderOAuth2Authenticator,\n decodeQuery,\n describeQuerySchema,\n identityProviderSchema,\n toIdentityPolicyData,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n buildActorContext,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.clientRepository = ctx.clientRepository;\n this.accountManager = ctx.accountManager;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data,\n meta,\n } = await this.repository.findMany(\n await decodeQuery(useRequestQuery(event), {\n schema: identityProviderSchema,\n actor: buildActorContext(event),\n }),\n );\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta: {\n ...meta,\n schema: describeQuerySchema(identityProviderSchema),\n },\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return { data: entity, meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) } };\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: { baseURL: this.options.baseURL },\n });\n\n const parameters : AuthorizeParameters = {};\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realmId &&\n entity.realmId &&\n entity.realmId !== data.client.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n if (\n entity.realmId &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: {\n baseURL: this.options.baseURL,\n clientId: data.codeRequest?.client_id,\n },\n });\n\n const user = await authenticator.authenticate(code);\n\n const realm = await this.realmRepository.resolve(entity.realmId, true);\n\n // Application access policy (plan 052), federated leg: the callback\n // never redirects to the RP directly — a denial bounces back to the\n // hosted authorize page with error=access_denied, so no\n // redirectUriVerified threading through the state blob is needed.\n // A policy id with no wired evaluator denies (fail closed); a\n // since-deleted client is skipped (the /token backstop still covers it).\n if (data.codeRequest?.client_id) {\n const client = await this.clientRepository.findOneByIdOrName(\n data.codeRequest.client_id,\n data.codeRequest.realm_id,\n );\n\n if (client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData({\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n });\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n\n return sendRedirect(event, url.href);\n }\n }\n }\n\n const authorizationCode = await this.codeIssuer.issue(\n {\n response_type: 'code',\n client_id: data.codeRequest?.client_id,\n redirect_uri: data.codeRequest?.redirect_uri,\n scope: data.codeRequest?.scope,\n },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n { authMethod: SessionAuthMethod.EXTERNAL },\n );\n\n if (data.codeRequest) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<EntityRecordResponse<IdentityProvider>> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realmId = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? entity.realmId ?? null,\n }),\n });\n } else {\n if (!data.realmId) {\n const identity = useRequestIdentityOrFail(event);\n data.realmId = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return { data: entity, meta: {} };\n }\n\n // ---------------------------------------------------------\n\n private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n const codeRequestKeys = Object.keys(codeRequest);\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n const codeRequestValue = codeRequest[codeRequestKey];\n // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n // treats as prompt=login) — only skip absent ones.\n if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n url.searchParams.set(codeRequestKey, String(codeRequestValue));\n }\n }\n\n return url;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async saveAuthorizationState(\n event: IAppEvent,\n codeRequest?: OAuth2AuthorizationCodeRequest,\n ) : Promise<string> {\n return this.stateManager.save({\n codeRequest,\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsFA,IAAagD,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKV,UAAUU,IAAIV;EACnB,KAAKC,aAAaS,IAAIT;EACtB,KAAKC,kBAAkBQ,IAAIR;EAC3B,KAAKC,mBAAmBO,IAAIP;EAC5B,KAAKC,iBAAiBM,IAAIN;EAC1B,KAAKI,aAAaE,IAAIF;EACtB,KAAKH,sBAAsBK,IAAIL;EAC/B,KAAKC,uBAAuB,IAAIvB,wCAAAA;EAChC,KAAKwB,eAAeG,IAAIH;EACxB,KAAKE,wBAAwBC,IAAID;CACrC;CAIA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKb,WAAWc,SACtB,MAAM7B,YAAYR,gBAAgBkC,KAAAA,GAAQ;GACtCI,QAAQ5B;GACR6B,OAAO1B,kBAAkBqB,KAAAA;EAC7B,CAAA,CAAA;EAGJ,IAAI;GACA,MAAMM,sBAAsBrB,8BAA8Be,KAAAA;GAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAekD,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAAST,MAChB,IAAI;IACA,MAAMK,oBAAoBK,SAAS;KAC/BH,MAAMjD,eAAekD;KACrBR,MAAM7D,iBAAiB;OAAGD,kBAAkByE,aAAaF;OAAQvE,kBAAkB0E,cAAcH,MAAMI,WAAW;KAAK,CAAA;IAC3H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHb;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQ7B,oBAAoBC,sBAAAA;GAChC;EACJ;CACJ;CAEA,MACMuC,YACF,IACA,OAC+C;EAC/C,MAAME,UAAUjC,kBAAkBgB,OAAO,EAAEzD,QAAQ,MAAM,CAAA;EAEzD,MAAM2E,SAAS,MAAM,KAAK7B,WAAW8B,kBACjCF,SACAnC,kBAAkBkB,KAAAA,CAAAA;EAGtB,IAAI,CAACkB,QACD,MAAM,IAAItD,oBAAAA;EAGd,IAAI;GAEA,MAD4BqB,8BAA8Be,KACpDM,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMjD,eAAekD;IACrBR,MAAM7D,iBAAiB;MAAGD,kBAAkByE,aAAaM;MAAS/E,kBAAkB0E,cAAcK,OAAOJ,WAAW;IAAK,CAAA;GAC7H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAO;GAAEb,MAAMiB;GAAQhB,MAAM,EAAEE,QAAQ7B,oBAAoBC,wBAAwBJ,uBAAAA,EAAyB;EAAE;CAClH;CAEA,MACMgD,aACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKE,MAAMtB,OAAO,EAAEuB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKF,MAAMtB,KAAAA;CACtB;CAEA,MACMyB,aACF,IACA,OACgD;EAChD,MAAMR,UAAUjC,kBAAkBgB,KAAAA;EAElC,MAAMM,sBAAsBrB,8BAA8Be,KAAAA;EAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAemE,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAK7B,WAAWsC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAItD,oBAAAA;EAGd,MAAM0C,oBAAoBK,SAAS;GAC/BH,MAAMjD,eAAemE;GACrBzB,MAAM7D,iBAAiB;KAAGD,kBAAkByE,aAAaM;KAAS/E,kBAAkB0E,cAAcK,OAAOJ,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAK7B,WAAWwC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ5B,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAEA,MACM8B,YACF,MACA,OACgD;EAChD,OAAO,KAAKV,MAAMtB,KAAAA;CACtB;CAIA,MACMiC,aACF,KACA,OACF;EACE,MAAMjB,KAAKhC,kBAAkBgB,KAAAA;EAC7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAACvD,yBAAyByD,MAAAA,KAAW,CAACxD,yBAAyBwD,MAAAA,GAC/D,MAAM,IAAIvD,gBAAgB,oFAAA;EAG9B,MAAMyE,gBAAgB/D,0CAA0C;GAC5DmB,gBAAgB,KAAKA;GACrB6C,UAAUnB;GACV9B,SAAS,EAAEkD,SAAS,KAAKlD,QAAQkD,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQ3E,gBAAgBkC,KAAAA;EAC9B,IAAI,OAAOyC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAMtG,gBAAgBmG,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAMvE,mBAAmB4E,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKpD,qBAAqBqD,IAAIL,kBAAAA;GACjE,MAAMzC,OAAO,MAAM,KAAKR,oBAAoBuD,OAAOF,oBAAAA;GAEnD,IACI7C,KAAKgD,OAAOnC,WACZI,OAAOJ,WACPI,OAAOJ,YAAYb,KAAKgD,OAAOnC,SAE/B,MAAM7C,mBAAmB4E,UAAU,6CAAA;GAGvCL,cAAcvC,KAAKA;EACvB;EAEAsC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBnD,OAAOwC,WAAAA;EAE5D,OAAOrF,aAAa6C,OAAOoC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAKhC,kBAAkBgB,KAAAA;EAE7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAACvD,yBAAyByD,MAAAA,KAAW,CAACxD,yBAAyBwD,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMtD,OAAO,MAAM,KAAKuD,yBAAyBxD,KAAAA;EACjD,IACIkB,OAAOJ,WACPb,KAAKuC,eACLvC,KAAKuC,YAAYiB,YACjBxD,KAAKuC,YAAYiB,aAAavC,OAAOJ,SAErC,MAAM7C,mBAAmB4E,UAAU,6CAAA;EAGvC,MAAM,EAAEa,SAAS5F,gBAAgBkC,KAAAA;EAWjC,MAAMqB,OAAO,MATShD,0CAA0C;GAC5DmB,gBAAgB,KAAKA;GACrB6C,UAAUnB;GACV9B,SAAS;IACLkD,SAAS,KAAKlD,QAAQkD;IACtBqB,UAAU1D,KAAKuC,aAAaoB;GAChC;EACJ,CAEmBxB,CAAAA,CAAcyB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKxE,gBAAgB6C,QAAQjB,OAAOJ,SAAS,IAAA;EAQjE,IAAIb,KAAKuC,aAAaoB,WAAW;GAC7B,MAAMX,SAAS,MAAM,KAAK1D,iBAAiB4B,kBACvClB,KAAKuC,YAAYoB,WACjB3D,KAAKuC,YAAYiB,QAAQ;GAG7B,IAAIR,QAAQc,gBAAgB;IACxB,IAAIC,UAAU;IAEd,MAAMC,UAAUxF,qBAAqB;KACjCyF,MAAM5G,aAAa6G;KACnBlE,MAAM;MACF,GAAGoB;MACHyC;KACJ;IACJ,CAAA;IACA,IAAI,KAAKjE,yBAAyBoE,SAC9BD,UAAU,MAAM,KAAKnE,sBAAsBc,SACvCsC,OAAOc,gBACPE,OAAAA;IAIR,IAAI,CAACD,SAAS;KACV,MAAMI,MAAM,KAAKC,wBAAwBpE,KAAKuC,WAAW;KACzD4B,IAAIE,aAAaC,IAAI,SAASvG,gBAAgBwG,aAAa;KAE3D,OAAOrH,aAAa6C,OAAOoE,IAAIK,IAAI;IACvC;GACJ;EACJ;EAEA,MAAMC,oBAAoB,MAAM,KAAK9E,WAAW+E,MAC5C;GACIC,eAAe;GACfhB,WAAW3D,KAAKuC,aAAaoB;GAC7BiB,cAAc5E,KAAKuC,aAAaqC;GAChCC,OAAO7E,KAAKuC,aAAasC;EAC7B,GACA;GACIZ,MAAM5G,aAAa6G;GACnBlE,MAAM;IACF,GAAGoB;IACHyC;GACJ;EACJ,GACA,EAAEiB,YAAYvH,kBAAkBwH,SAAS,CAAA;EAG7C,IAAI/E,KAAKuC,aAAa;GAClB,MAAM4B,MAAM,KAAKC,wBAAwBpE,KAAKuC,WAAW;GACzD4B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkB1D,EAAE;GAEjD,OAAO7D,aAAa6C,OAAOoE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAIlG,IAAI,KAAKkB,QAAQkD,OAAO;EACxC8B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkB1D,EAAE;EAEjD,OAAO7D,aAAa6C,OAAOoE,IAAIK,IAAI;CACvC;CAIA,MAAcnD,MAAMtB,OAAkBZ,UAElC,CAAC,GAAoD;EACrD,IAAI6F;EACJ,MAAMjE,KAAKnC,kBAAkBmB,OAAO,EAAEzD,QAAQ,MAAM,CAAA;EACpD,MAAM2I,OAAO,MAAMnH,gBAAgBiC,KAAAA;EACnCtB,wBAAwBsB,OAAOkF,IAAAA;EAC/B,MAAMpE,UAAUhC,kBAAkBkB,KAAAA,KAAUpB,eAAesG,IAAAA;EAE3D,IAAIhE;EACJ,IAAIF,IAAI;GACJ,MAAMmE,QAA6B,CAAC;GACpC,IAAI5I,OAAOyE,EAAAA,GACPmE,MAAMnE,KAAKA;QAEXmE,MAAM3E,OAAOQ;GAGjB,IAAIF,SACAqE,MAAMrE,UAAUA;GAGpBI,SAAS,MAAM,KAAK7B,WAAWsC,UAAUwD,KAAAA;GACzC,IAAI,CAACjE,UAAU9B,QAAQmC,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAIwB,QAAQmC,YACf,MAAM,IAAI3D,oBAAAA;EAGd,MAAM0C,sBAAsBrB,8BAA8Be,KAAAA;EAC1D,IAAIkB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAe6H,yBAAyB,CAAA;GAEtFH,QAAQ5I,eAAegJ;EAC3B,OAAO;GACH,MAAM/E,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAe+H,yBAAyB,CAAA;GAEtFL,QAAQ5I,eAAekJ;EAC3B;EAGA,MAAMtF,OAAO,MAAMuF,IADGnI,0BACHmI,CAAAA,CAAUzC,IAAImC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMS,aAAa,MAAMD,IADOrI,oCACPqI,CAAAA,CAAoB1C,IAAImC,IAAAA;EAEjD,MAAM,KAAK7F,WAAWsG,oBAAoB1F,IAAAA;EAE1C,IAAIiB,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMjD,eAAe6H;GACrBnF,MAAM7D,iBAAiB;KAClBD,kBAAkByE,aAAa;KAC5B,GAAGM;KACH,GAAGjB;IACP;KACC9D,kBAAkB0E,cAAcZ,KAAKa,WAAWI,OAAOJ,WAAW;GACvE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACb,KAAKa,SAENb,KAAKa,UADY/B,yBAAyBiB,KAC3B4F,CAAAA,CAAS9E;GAG5B,MAAMR,oBAAoBK,SAAS;IAC/BH,MAAMjD,eAAe+H;IACrBrF,MAAM7D,iBAAiB;MAAGD,kBAAkByE,aAAaX;MAAO9D,kBAAkB0E,cAAcZ,KAAKa,WAAW;IAAK,CAAA;GACzH,CAAA;EACJ;EAEA,MAAM,KAAKzB,WAAWwG,gBAAgB5F,MAAMiB,UAAU4E,KAAAA,CAAAA;EAEtD,IAAI5E,QAAQ;GACRA,SAAS,KAAK7B,WAAW0G,MAAM7E,QAAQjB,IAAAA;GACvC,MAAM,KAAKZ,WAAW2G,WAAW9E,QAAQwE,UAAAA;GAEzC1F,MAAM8B,SAASC,SAAS;GAExB,OAAO;IAAE9B,MAAMiB;IAAQhB,MAAM,CAAC;GAAE;EACpC;EAEAgB,SAAS,KAAK7B,WAAW4G,OAAOhG,IAAAA;EAChC,MAAM,KAAKZ,WAAW2G,WAAW9E,QAAQwE,UAAAA;EAEzC1F,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAIQmE,wBAAwB7B,aAAkD;EAC9E,MAAM4B,MAAM,IAAIlG,IAAIL,WAAW,KAAKuB,QAAQkD,SAAS,WAAA,CAAA;EAErD,MAAM4D,kBAAkBC,OAAOC,KAAK5D,WAAAA;EACpC,KAAK,MAAM6D,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmB/D,YAAY8D;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChEnC,IAAIE,aAAaC,IAAI+B,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAOnC;CACX;CAIA,MAAcjC,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAK7B,WAAWoH,YAAYzF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAItD,oBAAAA;EAGd,OAAOsD;CACX;CAIA,MAAciC,uBACVnD,OACAwC,aACgB;EAChB,OAAO,KAAK7C,aAAa+G,KAAK;GAC1BlE;GACAmE,IAAIzJ,aAAa8C,KAAAA,KAAU;GAC3B4G,WAAW3J,iBAAiB+C,OAAO,YAAA,KAAiB8F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBxD,OAAqD;EACxF,MAAMyC,QAAQ3E,gBAAgBkC,KAAAA;EAC9B,IAAI,OAAOyC,MAAMS,UAAU,UACvB,MAAMjF,mBAAmB4I,aAAY;EAGzC,OAAO,KAAKlH,aAAaqD,OAAOP,MAAMS,OAAO;GACzCyD,IAAIzJ,aAAa8C,KAAAA,KAAU;GAC3B4G,WAAW3J,iBAAiB+C,OAAO,YAAA,KAAiB8F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;CA5WoB5G,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAgCNA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;CA/JF,YAAA,CAAA,uBAAuB,qCAAA,CAAA"}
1	+ {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","SessionAuthMethod","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2ErrorCode","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","RECORD_QUERY_PARAMETERS","createIdentityProviderOAuth2Authenticator","decodeQuery","describeQuerySchema","identityProviderSchema","toIdentityPolicyData","applyRouteRealmIDToBody","buildActorContext","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","clientRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","accessPolicyEvaluator","ctx","getProviders","event","data","meta","findMany","schema","actor","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realmId","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","realm_id","code","clientId","client_id","authenticate","realm","accessPolicyId","allowed","subject","type","USER","url","buildHostedAuthorizeURL","searchParams","set","ACCESS_DENIED","href","authorizationCode","issue","response_type","redirect_uri","scope","authMethod","EXTERNAL","group","body","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","save","ip","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n SessionAuthMethod,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2ErrorCode, OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n EntityRecordResponse,\n IdentityProviderCreatePayload,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IOAuth2ClientRepository,\n IRealmRepository,\n OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n RECORD_QUERY_PARAMETERS,\n createIdentityProviderOAuth2Authenticator,\n decodeQuery,\n describeQuerySchema,\n identityProviderSchema,\n toIdentityPolicyData,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n buildActorContext,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.clientRepository = ctx.clientRepository;\n this.accountManager = ctx.accountManager;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data,\n meta,\n } = await this.repository.findMany(\n await decodeQuery(useRequestQuery(event), {\n schema: identityProviderSchema,\n actor: buildActorContext(event),\n }),\n );\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta: {\n ...meta,\n schema: describeQuerySchema(identityProviderSchema),\n },\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return { data: entity, meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) } };\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: { baseURL: this.options.baseURL },\n });\n\n const parameters : AuthorizeParameters = {};\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realmId &&\n entity.realmId &&\n entity.realmId !== data.client.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n if (\n entity.realmId &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: {\n baseURL: this.options.baseURL,\n clientId: data.codeRequest?.client_id,\n },\n });\n\n const user = await authenticator.authenticate(code);\n\n const realm = await this.realmRepository.resolve(entity.realmId, true);\n\n // Application access policy (plan 052), federated leg: the callback\n // never redirects to the RP directly — a denial bounces back to the\n // hosted authorize page with error=access_denied, so no\n // redirectUriVerified threading through the state blob is needed.\n // A policy id with no wired evaluator denies (fail closed); a\n // since-deleted client is skipped (the /token backstop still covers it).\n if (data.codeRequest?.client_id) {\n const client = await this.clientRepository.findOneByIdOrName(\n data.codeRequest.client_id,\n data.codeRequest.realm_id,\n );\n\n if (client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData({\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n });\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n\n return sendRedirect(event, url.href);\n }\n }\n }\n\n const authorizationCode = await this.codeIssuer.issue(\n {\n response_type: 'code',\n client_id: data.codeRequest?.client_id,\n redirect_uri: data.codeRequest?.redirect_uri,\n scope: data.codeRequest?.scope,\n },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n { authMethod: SessionAuthMethod.EXTERNAL },\n );\n\n if (data.codeRequest) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<EntityRecordResponse<IdentityProvider>> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realmId = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n // Only a NAME key may upsert-create. A UUID addresses one specific\n // row, so a miss is a 404 (creating would write a different id).\n if (!entity && (options.updateOnly \|\| where.id)) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? entity.realmId ?? null,\n }),\n });\n } else {\n if (!data.realmId) {\n const identity = useRequestIdentityOrFail(event);\n data.realmId = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return { data: entity, meta: {} };\n }\n\n // ---------------------------------------------------------\n\n private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n const codeRequestKeys = Object.keys(codeRequest);\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n const codeRequestValue = codeRequest[codeRequestKey];\n // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n // treats as prompt=login) — only skip absent ones.\n if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n url.searchParams.set(codeRequestKey, String(codeRequestValue));\n }\n }\n\n return url;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async saveAuthorizationState(\n event: IAppEvent,\n codeRequest?: OAuth2AuthorizationCodeRequest,\n ) : Promise<string> {\n return this.stateManager.save({\n codeRequest,\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsFA,IAAagD,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKV,UAAUU,IAAIV;EACnB,KAAKC,aAAaS,IAAIT;EACtB,KAAKC,kBAAkBQ,IAAIR;EAC3B,KAAKC,mBAAmBO,IAAIP;EAC5B,KAAKC,iBAAiBM,IAAIN;EAC1B,KAAKI,aAAaE,IAAIF;EACtB,KAAKH,sBAAsBK,IAAIL;EAC/B,KAAKC,uBAAuB,IAAIvB,wCAAAA;EAChC,KAAKwB,eAAeG,IAAIH;EACxB,KAAKE,wBAAwBC,IAAID;CACrC;CAIA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKb,WAAWc,SACtB,MAAM7B,YAAYR,gBAAgBkC,KAAAA,GAAQ;GACtCI,QAAQ5B;GACR6B,OAAO1B,kBAAkBqB,KAAAA;EAC7B,CAAA,CAAA;EAGJ,IAAI;GACA,MAAMM,sBAAsBrB,8BAA8Be,KAAAA;GAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAekD,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAAST,MAChB,IAAI;IACA,MAAMK,oBAAoBK,SAAS;KAC/BH,MAAMjD,eAAekD;KACrBR,MAAM7D,iBAAiB;OAAGD,kBAAkByE,aAAaF;OAAQvE,kBAAkB0E,cAAcH,MAAMI,WAAW;KAAK,CAAA;IAC3H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHb;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQ7B,oBAAoBC,sBAAAA;GAChC;EACJ;CACJ;CAEA,MACMuC,YACF,IACA,OAC+C;EAC/C,MAAME,UAAUjC,kBAAkBgB,OAAO,EAAEzD,QAAQ,MAAM,CAAA;EAEzD,MAAM2E,SAAS,MAAM,KAAK7B,WAAW8B,kBACjCF,SACAnC,kBAAkBkB,KAAAA,CAAAA;EAGtB,IAAI,CAACkB,QACD,MAAM,IAAItD,oBAAAA;EAGd,IAAI;GAEA,MAD4BqB,8BAA8Be,KACpDM,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMjD,eAAekD;IACrBR,MAAM7D,iBAAiB;MAAGD,kBAAkByE,aAAaM;MAAS/E,kBAAkB0E,cAAcK,OAAOJ,WAAW;IAAK,CAAA;GAC7H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAO;GAAEb,MAAMiB;GAAQhB,MAAM,EAAEE,QAAQ7B,oBAAoBC,wBAAwBJ,uBAAAA,EAAyB;EAAE;CAClH;CAEA,MACMgD,aACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKE,MAAMtB,OAAO,EAAEuB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKF,MAAMtB,KAAAA;CACtB;CAEA,MACMyB,aACF,IACA,OACgD;EAChD,MAAMR,UAAUjC,kBAAkBgB,KAAAA;EAElC,MAAMM,sBAAsBrB,8BAA8Be,KAAAA;EAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAemE,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAK7B,WAAWsC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAItD,oBAAAA;EAGd,MAAM0C,oBAAoBK,SAAS;GAC/BH,MAAMjD,eAAemE;GACrBzB,MAAM7D,iBAAiB;KAAGD,kBAAkByE,aAAaM;KAAS/E,kBAAkB0E,cAAcK,OAAOJ,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAK7B,WAAWwC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ5B,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAEA,MACM8B,YACF,MACA,OACgD;EAChD,OAAO,KAAKV,MAAMtB,KAAAA;CACtB;CAIA,MACMiC,aACF,KACA,OACF;EACE,MAAMjB,KAAKhC,kBAAkBgB,KAAAA;EAC7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAACvD,yBAAyByD,MAAAA,KAAW,CAACxD,yBAAyBwD,MAAAA,GAC/D,MAAM,IAAIvD,gBAAgB,oFAAA;EAG9B,MAAMyE,gBAAgB/D,0CAA0C;GAC5DmB,gBAAgB,KAAKA;GACrB6C,UAAUnB;GACV9B,SAAS,EAAEkD,SAAS,KAAKlD,QAAQkD,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQ3E,gBAAgBkC,KAAAA;EAC9B,IAAI,OAAOyC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAMtG,gBAAgBmG,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAMvE,mBAAmB4E,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKpD,qBAAqBqD,IAAIL,kBAAAA;GACjE,MAAMzC,OAAO,MAAM,KAAKR,oBAAoBuD,OAAOF,oBAAAA;GAEnD,IACI7C,KAAKgD,OAAOnC,WACZI,OAAOJ,WACPI,OAAOJ,YAAYb,KAAKgD,OAAOnC,SAE/B,MAAM7C,mBAAmB4E,UAAU,6CAAA;GAGvCL,cAAcvC,KAAKA;EACvB;EAEAsC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBnD,OAAOwC,WAAAA;EAE5D,OAAOrF,aAAa6C,OAAOoC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAKhC,kBAAkBgB,KAAAA;EAE7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAACvD,yBAAyByD,MAAAA,KAAW,CAACxD,yBAAyBwD,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMtD,OAAO,MAAM,KAAKuD,yBAAyBxD,KAAAA;EACjD,IACIkB,OAAOJ,WACPb,KAAKuC,eACLvC,KAAKuC,YAAYiB,YACjBxD,KAAKuC,YAAYiB,aAAavC,OAAOJ,SAErC,MAAM7C,mBAAmB4E,UAAU,6CAAA;EAGvC,MAAM,EAAEa,SAAS5F,gBAAgBkC,KAAAA;EAWjC,MAAMqB,OAAO,MATShD,0CAA0C;GAC5DmB,gBAAgB,KAAKA;GACrB6C,UAAUnB;GACV9B,SAAS;IACLkD,SAAS,KAAKlD,QAAQkD;IACtBqB,UAAU1D,KAAKuC,aAAaoB;GAChC;EACJ,CAEmBxB,CAAAA,CAAcyB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKxE,gBAAgB6C,QAAQjB,OAAOJ,SAAS,IAAA;EAQjE,IAAIb,KAAKuC,aAAaoB,WAAW;GAC7B,MAAMX,SAAS,MAAM,KAAK1D,iBAAiB4B,kBACvClB,KAAKuC,YAAYoB,WACjB3D,KAAKuC,YAAYiB,QAAQ;GAG7B,IAAIR,QAAQc,gBAAgB;IACxB,IAAIC,UAAU;IAEd,MAAMC,UAAUxF,qBAAqB;KACjCyF,MAAM5G,aAAa6G;KACnBlE,MAAM;MACF,GAAGoB;MACHyC;KACJ;IACJ,CAAA;IACA,IAAI,KAAKjE,yBAAyBoE,SAC9BD,UAAU,MAAM,KAAKnE,sBAAsBc,SACvCsC,OAAOc,gBACPE,OAAAA;IAIR,IAAI,CAACD,SAAS;KACV,MAAMI,MAAM,KAAKC,wBAAwBpE,KAAKuC,WAAW;KACzD4B,IAAIE,aAAaC,IAAI,SAASvG,gBAAgBwG,aAAa;KAE3D,OAAOrH,aAAa6C,OAAOoE,IAAIK,IAAI;IACvC;GACJ;EACJ;EAEA,MAAMC,oBAAoB,MAAM,KAAK9E,WAAW+E,MAC5C;GACIC,eAAe;GACfhB,WAAW3D,KAAKuC,aAAaoB;GAC7BiB,cAAc5E,KAAKuC,aAAaqC;GAChCC,OAAO7E,KAAKuC,aAAasC;EAC7B,GACA;GACIZ,MAAM5G,aAAa6G;GACnBlE,MAAM;IACF,GAAGoB;IACHyC;GACJ;EACJ,GACA,EAAEiB,YAAYvH,kBAAkBwH,SAAS,CAAA;EAG7C,IAAI/E,KAAKuC,aAAa;GAClB,MAAM4B,MAAM,KAAKC,wBAAwBpE,KAAKuC,WAAW;GACzD4B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkB1D,EAAE;GAEjD,OAAO7D,aAAa6C,OAAOoE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAIlG,IAAI,KAAKkB,QAAQkD,OAAO;EACxC8B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkB1D,EAAE;EAEjD,OAAO7D,aAAa6C,OAAOoE,IAAIK,IAAI;CACvC;CAIA,MAAcnD,MAAMtB,OAAkBZ,UAElC,CAAC,GAAoD;EACrD,IAAI6F;EACJ,MAAMjE,KAAKnC,kBAAkBmB,OAAO,EAAEzD,QAAQ,MAAM,CAAA;EACpD,MAAM2I,OAAO,MAAMnH,gBAAgBiC,KAAAA;EACnCtB,wBAAwBsB,OAAOkF,IAAAA;EAC/B,MAAMpE,UAAUhC,kBAAkBkB,KAAAA,KAAUpB,eAAesG,IAAAA;EAE3D,IAAIhE;EACJ,IAAIF,IAAI;GACJ,MAAMmE,QAA6B,CAAC;GACpC,IAAI5I,OAAOyE,EAAAA,GACPmE,MAAMnE,KAAKA;QAEXmE,MAAM3E,OAAOQ;GAGjB,IAAIF,SACAqE,MAAMrE,UAAUA;GAGpBI,SAAS,MAAM,KAAK7B,WAAWsC,UAAUwD,KAAAA;GAGzC,IAAI,CAACjE,WAAW9B,QAAQmC,cAAc4D,MAAMnE,KACxC,MAAM,IAAIpD,oBAAAA;EAElB,OAAO,IAAIwB,QAAQmC,YACf,MAAM,IAAI3D,oBAAAA;EAGd,MAAM0C,sBAAsBrB,8BAA8Be,KAAAA;EAC1D,IAAIkB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAe6H,yBAAyB,CAAA;GAEtFH,QAAQ5I,eAAegJ;EAC3B,OAAO;GACH,MAAM/E,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAe+H,yBAAyB,CAAA;GAEtFL,QAAQ5I,eAAekJ;EAC3B;EAGA,MAAMtF,OAAO,MAAMuF,IADGnI,0BACHmI,CAAAA,CAAUzC,IAAImC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMS,aAAa,MAAMD,IADOrI,oCACPqI,CAAAA,CAAoB1C,IAAImC,IAAAA;EAEjD,MAAM,KAAK7F,WAAWsG,oBAAoB1F,IAAAA;EAE1C,IAAIiB,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMjD,eAAe6H;GACrBnF,MAAM7D,iBAAiB;KAClBD,kBAAkByE,aAAa;KAC5B,GAAGM;KACH,GAAGjB;IACP;KACC9D,kBAAkB0E,cAAcZ,KAAKa,WAAWI,OAAOJ,WAAW;GACvE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACb,KAAKa,SAENb,KAAKa,UADY/B,yBAAyBiB,KAC3B4F,CAAAA,CAAS9E;GAG5B,MAAMR,oBAAoBK,SAAS;IAC/BH,MAAMjD,eAAe+H;IACrBrF,MAAM7D,iBAAiB;MAAGD,kBAAkByE,aAAaX;MAAO9D,kBAAkB0E,cAAcZ,KAAKa,WAAW;IAAK,CAAA;GACzH,CAAA;EACJ;EAEA,MAAM,KAAKzB,WAAWwG,gBAAgB5F,MAAMiB,UAAU4E,KAAAA,CAAAA;EAEtD,IAAI5E,QAAQ;GACRA,SAAS,KAAK7B,WAAW0G,MAAM7E,QAAQjB,IAAAA;GACvC,MAAM,KAAKZ,WAAW2G,WAAW9E,QAAQwE,UAAAA;GAEzC1F,MAAM8B,SAASC,SAAS;GAExB,OAAO;IAAE9B,MAAMiB;IAAQhB,MAAM,CAAC;GAAE;EACpC;EAEAgB,SAAS,KAAK7B,WAAW4G,OAAOhG,IAAAA;EAChC,MAAM,KAAKZ,WAAW2G,WAAW9E,QAAQwE,UAAAA;EAEzC1F,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAIQmE,wBAAwB7B,aAAkD;EAC9E,MAAM4B,MAAM,IAAIlG,IAAIL,WAAW,KAAKuB,QAAQkD,SAAS,WAAA,CAAA;EAErD,MAAM4D,kBAAkBC,OAAOC,KAAK5D,WAAAA;EACpC,KAAK,MAAM6D,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmB/D,YAAY8D;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChEnC,IAAIE,aAAaC,IAAI+B,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAOnC;CACX;CAIA,MAAcjC,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAK7B,WAAWoH,YAAYzF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAItD,oBAAAA;EAGd,OAAOsD;CACX;CAIA,MAAciC,uBACVnD,OACAwC,aACgB;EAChB,OAAO,KAAK7C,aAAa+G,KAAK;GAC1BlE;GACAmE,IAAIzJ,aAAa8C,KAAAA,KAAU;GAC3B4G,WAAW3J,iBAAiB+C,OAAO,YAAA,KAAiB8F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBxD,OAAqD;EACxF,MAAMyC,QAAQ3E,gBAAgBkC,KAAAA;EAC9B,IAAI,OAAOyC,MAAMS,UAAU,UACvB,MAAMjF,mBAAmB4I,aAAY;EAGzC,OAAO,KAAKlH,aAAaqD,OAAOP,MAAMS,OAAO;GACzCyD,IAAIzJ,aAAa8C,KAAAA,KAAU;GAC3B4G,WAAW3J,iBAAiB+C,OAAO,YAAA,KAAiB8F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;CA9WoB5G,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAgCNA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;CA/JF,YAAA,CAAA,uBAAuB,qCAAA,CAAA"}

package/dist/adapters/http/controllers/index.mjs CHANGED Viewed

@@ -15,6 +15,7 @@ import { IdentityProviderRoleMappingController } from "./entities/identity-provi
 import { KeyController } from "./entities/key/module.mjs";
 import { PermissionController } from "./entities/permission/module.mjs";
 import { PermissionPolicyController } from "./entities/permission-policy/module.mjs";
+import { AccountController } from "./workflows/account/module.mjs";
 import { ActivateController } from "./workflows/activate/module.mjs";
 import { AuthenticatorChallengeController } from "./workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./workflows/authorize/module.mjs";
@@ -50,4 +51,4 @@ import { UserPermissionRequestValidator } from "./entities/user-permission/utils
 import { UserRoleController } from "./entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./entities/user-role/utils/validation.mjs";
 import "./entities/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };
+export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/account/index.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export * from './module.ts';
2	+ //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/account/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/workflows/account/index.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AccountController } from "./module.mjs";
+export { AccountController };

package/dist/adapters/http/controllers/workflows/account/module.d.ts ADDED Viewed

@@ -0,0 +1,24 @@
+import type { StatusResponseFeatures } from '@authup/core-http-kit';
+import type { IAppEvent } from 'routup';
+export type AccountControllerOptions = {
+    baseURL: string;
+    features: StatusResponseFeatures;
+    trustedOrigins: string[];
+};
+export type AccountControllerContext = {
+    options: AccountControllerOptions;
+};
+/**
+ * Serves the account console SPA (`@authup/client-account-console`) shell —
+ * client-side routing owns the sub-paths, so every route returns the same
+ * shell with the runtime config (apiUrl, base path, feature flags) injected.
+ * The bundle's static assets ride the assets middleware (/account/assets).
+ */
+export declare class AccountController {
+    protected options: AccountControllerOptions;
+    constructor(ctx: AccountControllerContext);
+    serve(event: IAppEvent): Promise<string>;
+    servePage(event: IAppEvent): Promise<string>;
+    protected render(event: IAppEvent): Promise<string>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/account/module.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAMpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,qBACa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;gBAEhC,GAAG,EAAE,wBAAwB;IAKnC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAKpD,SAAS,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9D,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CAOtD"}

package/dist/adapters/http/controllers/workflows/account/module.mjs ADDED Viewed

@@ -0,0 +1,63 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { serveAccountConsolePage } from "../../../ui/account-console/module.mjs";
+import "../../../ui/index.mjs";
+import { DContext, DController, DGet } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/account/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var AccountController = class {
+	options;
+	constructor(ctx) {
+		this.options = ctx.options;
+	}
+	async serve(event) {
+		return this.render(event);
+	}
+	async servePage(event) {
+		return this.render(event);
+	}
+	render(event) {
+		return serveAccountConsolePage(event, {
+			baseURL: this.options.baseURL,
+			features: this.options.features,
+			trustedOrigins: this.options.trustedOrigins
+		});
+	}
+};
+_ts_decorate([
+	DGet("", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AccountController.prototype, "serve", null);
+_ts_decorate([
+	DGet("/:page", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AccountController.prototype, "servePage", null);
+AccountController = _ts_decorate([
+	DController("/account"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof AccountControllerContext === "undefined" ? Object : AccountControllerContext])
+], AccountController);
+//#endregion
+export { AccountController };
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/account/module.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.mjs","names":["DContext","DController","DGet","serveAccountConsolePage","AccountController","options","ctx","serve","event","render","servePage","baseURL","features","trustedOrigins"],"sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n DContext,\n DController,\n DGet,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { serveAccountConsolePage } from '../../../ui/index.ts';\n\nexport type AccountControllerOptions = {\n baseURL: string,\n features: StatusResponseFeatures,\n trustedOrigins: string[],\n};\n\nexport type AccountControllerContext = {\n options: AccountControllerOptions,\n};\n\n/**\n * Serves the account console SPA (`@authup/client-account-console`) shell —\n * client-side routing owns the sub-paths, so every route returns the same\n * shell with the runtime config (apiUrl, base path, feature flags) injected.\n * The bundle's static assets ride the assets middleware (/account/assets).\n */\n@DController('/account')\nexport class AccountController {\n protected options: AccountControllerOptions;\n\n constructor(ctx: AccountControllerContext) {\n this.options = ctx.options;\n }\n\n @DGet('', [])\n async serve(@DContext() event: IAppEvent): Promise<string> {\n return this.render(event);\n }\n\n @DGet('/:page', [])\n async servePage(@DContext() event: IAppEvent): Promise<string> {\n return this.render(event);\n }\n\n protected render(event: IAppEvent): Promise<string> {\n return serveAccountConsolePage(event, {\n baseURL: this.options.baseURL,\n features: this.options.features,\n trustedOrigins: this.options.trustedOrigins,\n });\n }\n}\n"],"mappings":";;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AA4BD,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+B;EACvC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,MAAM,OAA+C;EACvD,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAEA,MACME,UAAU,OAA+C;EAC3D,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEUC,OAAOD,OAAmC;EAChD,OAAOL,wBAAwBK,OAAO;GAClCG,SAAS,KAAKN,QAAQM;GACtBC,UAAU,KAAKP,QAAQO;GACvBC,gBAAgB,KAAKR,QAAQQ;EACjC,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/activate/module.mjs CHANGED Viewed

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { serveWorkflowPage } from "../../../ui/serve.mjs";
+import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
 import "../../../ui/index.mjs";
 import { ActivateRequestValidator } from "./validator.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";

package/dist/adapters/http/controllers/workflows/authorize/module.mjs CHANGED Viewed

@@ -6,10 +6,10 @@ import "../../../../../core/index.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
 import "../../../request/index.mjs";
 import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
+import { renderAuthConsolePage } from "../../../ui/auth-console/module.mjs";
 import { sanitizeError } from "../../../../../utils/error.mjs";
 import "../../../../../utils/index.mjs";
 import "../../../middleware/index.mjs";
-import { renderUIPage } from "../../../ui/render.mjs";
 import "../../../ui/index.mjs";
 import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
 import "../../../adapters/index.mjs";
@@ -115,7 +115,7 @@ var AuthorizeController = class {
 			}
 		}
 		const requestURL = new URL(event.request.url);
-		return renderUIPage(event, {
+		return renderAuthConsolePage(event, {
 			url: "/authorize",
 			payload: {
 				config: { baseURL: this.options.baseURL },

package/dist/adapters/http/controllers/workflows/authorize/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","forClient","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n Client,\n OAuth2AuthorizationCodeRequest,\n Realm,\n Scope,\n} from '@authup/core-kit';\nimport { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' \| 'name' \| 'displayName'>;\ntype ClientSummary = Pick<Client, 'id' \| 'name' \| 'displayName' \| 'builtIn' \| 'createdAt'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n // todo: maybe /realms/<realm>/[...]/authorize\n\n protected options: AuthorizeControllerOptions;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected authorizer: HTTPOAuth2Authorizer;\n\n // ---------------------------------------------------------\n\n constructor(ctx: AuthorizeControllerContext) {\n this.options = ctx.options;\n\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n this.authorizer = new HTTPOAuth2Authorizer({\n codeRequestVerifier: this.codeRequestVerifier,\n codeIssuer: ctx.codeIssuer,\n sessionManager: ctx.sessionManager,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n mfaChallengeProvider: ctx.mfaChallengeProvider,\n accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n consentService: ctx.consentService,\n logger: ctx.logger,\n });\n }\n\n // ---------------------------------------------------------\n\n @DPost('', [ForceUserLoggedInMiddleware])\n async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n try {\n const result = await this.authorizer.authorizeWithRequest(event);\n\n const url = new URL(result.redirectUri);\n if (result.state) {\n url.searchParams.set('state', result.state);\n }\n\n if (result.authorizationCode) {\n url.searchParams.set('code', result.authorizationCode);\n }\n\n return { url: url.href };\n } catch (e) {\n // Access-policy denial (plan 052): with a pattern-verified\n // redirect_uri the denial is answered as an error redirect\n // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n // any success. Unverified → rethrow → 400 body → interactive\n // denial card.\n if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n const url = new URL(e.redirectUri);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n if (e.state) {\n url.searchParams.set('state', e.state);\n }\n\n return { url: url.href };\n }\n\n throw e;\n }\n }\n\n @DGet('', [])\n async serve(@DContext() event: IAppEvent): Promise<string> {\n let codeRequest : OAuth2AuthorizationCodeRequest \| undefined;\n\n let client : ClientSummary \| undefined;\n let scopes : Scope[] \| undefined;\n\n // Target realm summary (the client's realm) — the UI names it in the\n // realm-mismatch notice. codeRequest.realm_id is only the id.\n let realm : RealmSummary \| undefined;\n\n // Whether the request redirect_uri matched a registered client pattern —\n // the UI must not offer an automatic \"return to application\" redirect to\n // an unverified (pattern-less-client) redirect_uri.\n let redirectUriVerified = false;\n\n let error : Error \| undefined;\n\n try {\n const merged = await readFromLocations(event, ['body', 'query']);\n const data = await this.codeRequestValidator.run(merged);\n\n const result = await this.codeRequestVerifier.verify(data);\n\n // Trim the client to a deliberate DTO before it reaches the\n // anonymous SSR hydration payload — never disclose redirect_uri\n // patterns (the trusted-origin set), grant_types, internal\n // base/root URLs, auth methods, or the secret storage flags to an\n // unauthenticated visitor. (ClientEntity.secret is additionally\n // select:false, so the secret is never loaded — but the DTO must not\n // rely on that alone: a future entity/query change could unset it.)\n client = {\n id: result.client.id,\n name: result.client.name,\n displayName: result.client.displayName,\n builtIn: result.client.builtIn,\n createdAt: result.client.createdAt,\n };\n scopes = result.scopes;\n redirectUriVerified = result.redirectUriVerified;\n\n if (result.client.realm) {\n realm = {\n id: result.client.realm.id,\n name: result.client.realm.name,\n displayName: result.client.realm.displayName,\n };\n }\n\n codeRequest = result.data;\n } catch (e) {\n const normalized = sanitizeError(e);\n error = {\n ...normalized,\n message: normalized.message,\n };\n }\n\n // A recognized `error` query param (the federated-IdP callback\n // redirects back here with error=access_denied on a policy denial)\n // is mapped onto the hydration payload's error — neutral message,\n // never attacker-controlled text.\n if (!error) {\n const query = useRequestQuery(event);\n if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());\n error = {\n ...normalized,\n message: normalized.message,\n };\n }\n }\n\n // Path + query of the original request — the SSR page uses it as\n // the same-origin `redirect` parameter on register / password links\n // so those pages can lead back into this authorize request.\n const requestURL = new URL(event.request.url);\n\n return renderUIPage(event, {\n url: '/authorize',\n payload: {\n config: { baseURL: this.options.baseURL },\n data: {\n codeRequest,\n error,\n client,\n scopes,\n realm,\n redirectUriVerified,\n features: this.options.features,\n requestPath: `${requestURL.pathname}${requestURL.search}`,\n },\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAae,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAI/B,IAAI6B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAI/B,IAAIsC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAAShC,gBAAgBoC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAQ,CAAA;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,aAAaxB,OAAOa,OAAOW;IAC3BC,SAASzB,OAAOa,OAAOY;IACvBC,WAAW1B,OAAOa,OAAOa;GAC7B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,aAAaxB,OAAOa,OAAOE,MAAMS;GACrC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAMA,IAAI,CAACX,OACa7C;OAAAA,gBAAgB2B,KAC1B8B,CAAAA,CAAMZ,UAAU3C,gBAAgBoC,eAAe;IAC/C,MAAMiB,aAAa9C,cAAcR,wBAAwByD,UAAS,CAAA;IAClEb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;;EAMJ,MAAMG,aAAa,IAAI5D,IAAI4B,MAAMiC,QAAQ9B,GAAG;EAE5C,OAAOxB,aAAaqB,OAAO;GACvBG,KAAK;GACL+B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKpD,QAAQoD,QAAQ;IACxChB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAoB,UAAU,KAAKrD,QAAQqD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;CAlIgB/D,MAAAA,IAAAA,CAAAA,2BAAAA,CAAAA"}
1	+ {"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderAuthConsolePage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","forClient","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n Client,\n OAuth2AuthorizationCodeRequest,\n Realm,\n Scope,\n} from '@authup/core-kit';\nimport { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderAuthConsolePage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' \| 'name' \| 'displayName'>;\ntype ClientSummary = Pick<Client, 'id' \| 'name' \| 'displayName' \| 'builtIn' \| 'createdAt'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n // todo: maybe /realms/<realm>/[...]/authorize\n\n protected options: AuthorizeControllerOptions;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected authorizer: HTTPOAuth2Authorizer;\n\n // ---------------------------------------------------------\n\n constructor(ctx: AuthorizeControllerContext) {\n this.options = ctx.options;\n\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n this.authorizer = new HTTPOAuth2Authorizer({\n codeRequestVerifier: this.codeRequestVerifier,\n codeIssuer: ctx.codeIssuer,\n sessionManager: ctx.sessionManager,\n eventService: ctx.eventService,\n metrics: ctx.metrics,\n promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n mfaChallengeProvider: ctx.mfaChallengeProvider,\n accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n consentService: ctx.consentService,\n logger: ctx.logger,\n });\n }\n\n // ---------------------------------------------------------\n\n @DPost('', [ForceUserLoggedInMiddleware])\n async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n try {\n const result = await this.authorizer.authorizeWithRequest(event);\n\n const url = new URL(result.redirectUri);\n if (result.state) {\n url.searchParams.set('state', result.state);\n }\n\n if (result.authorizationCode) {\n url.searchParams.set('code', result.authorizationCode);\n }\n\n return { url: url.href };\n } catch (e) {\n // Access-policy denial (plan 052): with a pattern-verified\n // redirect_uri the denial is answered as an error redirect\n // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n // any success. Unverified → rethrow → 400 body → interactive\n // denial card.\n if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n const url = new URL(e.redirectUri);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n if (e.state) {\n url.searchParams.set('state', e.state);\n }\n\n return { url: url.href };\n }\n\n throw e;\n }\n }\n\n @DGet('', [])\n async serve(@DContext() event: IAppEvent): Promise<string> {\n let codeRequest : OAuth2AuthorizationCodeRequest \| undefined;\n\n let client : ClientSummary \| undefined;\n let scopes : Scope[] \| undefined;\n\n // Target realm summary (the client's realm) — the UI names it in the\n // realm-mismatch notice. codeRequest.realm_id is only the id.\n let realm : RealmSummary \| undefined;\n\n // Whether the request redirect_uri matched a registered client pattern —\n // the UI must not offer an automatic \"return to application\" redirect to\n // an unverified (pattern-less-client) redirect_uri.\n let redirectUriVerified = false;\n\n let error : Error \| undefined;\n\n try {\n const merged = await readFromLocations(event, ['body', 'query']);\n const data = await this.codeRequestValidator.run(merged);\n\n const result = await this.codeRequestVerifier.verify(data);\n\n // Trim the client to a deliberate DTO before it reaches the\n // anonymous SSR hydration payload — never disclose redirect_uri\n // patterns (the trusted-origin set), grant_types, internal\n // base/root URLs, auth methods, or the secret storage flags to an\n // unauthenticated visitor. (ClientEntity.secret is additionally\n // select:false, so the secret is never loaded — but the DTO must not\n // rely on that alone: a future entity/query change could unset it.)\n client = {\n id: result.client.id,\n name: result.client.name,\n displayName: result.client.displayName,\n builtIn: result.client.builtIn,\n createdAt: result.client.createdAt,\n };\n scopes = result.scopes;\n redirectUriVerified = result.redirectUriVerified;\n\n if (result.client.realm) {\n realm = {\n id: result.client.realm.id,\n name: result.client.realm.name,\n displayName: result.client.realm.displayName,\n };\n }\n\n codeRequest = result.data;\n } catch (e) {\n const normalized = sanitizeError(e);\n error = {\n ...normalized,\n message: normalized.message,\n };\n }\n\n // A recognized `error` query param (the federated-IdP callback\n // redirects back here with error=access_denied on a policy denial)\n // is mapped onto the hydration payload's error — neutral message,\n // never attacker-controlled text.\n if (!error) {\n const query = useRequestQuery(event);\n if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());\n error = {\n ...normalized,\n message: normalized.message,\n };\n }\n }\n\n // Path + query of the original request — the SSR page uses it as\n // the same-origin `redirect` parameter on register / password links\n // so those pages can lead back into this authorize request.\n const requestURL = new URL(event.request.url);\n\n return renderAuthConsolePage(event, {\n url: '/authorize',\n payload: {\n config: { baseURL: this.options.baseURL },\n data: {\n codeRequest,\n error,\n client,\n scopes,\n realm,\n redirectUriVerified,\n features: this.options.features,\n requestPath: `${requestURL.pathname}${requestURL.search}`,\n },\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAae,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAI/B,IAAI6B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAI/B,IAAIsC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAAShC,gBAAgBoC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAQ,CAAA;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,aAAaxB,OAAOa,OAAOW;IAC3BC,SAASzB,OAAOa,OAAOY;IACvBC,WAAW1B,OAAOa,OAAOa;GAC7B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,aAAaxB,OAAOa,OAAOE,MAAMS;GACrC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAMA,IAAI,CAACX,OACa7C;OAAAA,gBAAgB2B,KAC1B8B,CAAAA,CAAMZ,UAAU3C,gBAAgBoC,eAAe;IAC/C,MAAMiB,aAAa9C,cAAcR,wBAAwByD,UAAS,CAAA;IAClEb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;;EAMJ,MAAMG,aAAa,IAAI5D,IAAI4B,MAAMiC,QAAQ9B,GAAG;EAE5C,OAAOxB,sBAAsBqB,OAAO;GAChCG,KAAK;GACL+B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKpD,QAAQoD,QAAQ;IACxChB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAoB,UAAU,KAAKrD,QAAQqD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;CAlIgB/D,MAAAA,IAAAA,CAAAA,2BAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+export * from './account/index.ts';
 export * from './activate/index.ts';
 export * from './authenticator-challenge/index.ts';
 export * from './authorize/index.ts';

package/dist/adapters/http/controllers/workflows/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.mjs CHANGED Viewed

@@ -1,6 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { AccountController } from "./account/module.mjs";
+import "./account/index.mjs";
 import { ActivateController } from "./activate/module.mjs";
 import "./activate/index.mjs";
 import { AuthenticatorChallengeController } from "./authenticator-challenge/module.mjs";
@@ -26,4 +28,4 @@ import { TokenController } from "./token/module.mjs";
 import "./token/index.mjs";
 import { UserInfoController } from "./userinfo/module.mjs";
 import "./userinfo/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController, getJwkRouteHandler, getJwksRouteHandler };
+export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/logout/module.mjs CHANGED Viewed

@@ -5,7 +5,7 @@ import { OAuth2EndSessionRequestValidator } from "../../../../../core/oauth2/end
 import "../../../../../core/index.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
 import "../../../request/index.mjs";
-import { renderUIPage } from "../../../ui/render.mjs";
+import { renderAuthConsolePage } from "../../../ui/auth-console/module.mjs";
 import "../../../ui/index.mjs";
 import { URL } from "node:url";
 import { sendRedirect } from "routup";
@@ -63,7 +63,7 @@ var LogoutController = class {
 		}
 		if (serverRevoked && redirect) return sendRedirect(event, redirect);
 		const requestURL = new URL(event.request.url);
-		return renderUIPage(event, {
+		return renderAuthConsolePage(event, {
 			url: "/logout",
 			payload: {
 				config: { baseURL: this.options.baseURL },

package/dist/adapters/http/controllers/workflows/logout/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","~~renderUIPage~~","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","id_token_hint","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { ~~renderUIPage~~ } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n protected options: LogoutControllerOptions;\n\n protected endSessionService: IOAuth2EndSessionService;\n\n protected validator: OAuth2EndSessionRequestValidator;\n\n constructor(ctx: LogoutControllerContext) {\n this.options = ctx.options;\n this.endSessionService = ctx.endSessionService;\n this.validator = new OAuth2EndSessionRequestValidator();\n }\n\n @DGet('', [])\n async serve(@DContext() event: IAppEvent): Promise<string \| Response> {\n return this.handle(event);\n }\n\n // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n @DPost('', [])\n async execute(@DContext() event: IAppEvent): Promise<string \| Response> {\n return this.handle(event);\n }\n\n protected async handle(event: IAppEvent): Promise<string \| Response> {\n const merged = await readFromLocations(event, ['body', 'query']);\n\n // Malformed input (oversized / duplicated params) must never dead-end\n // the human behind the browser on a JSON error, nor discard a valid\n // id_token_hint: a bad cosmetic* param (post_logout_redirect_uri /\n // state / client_id / realm hint) must NOT cancel the\n // security-critical revoke the hint authorizes. So on a full-request\n // validation failure, retry with the hint ALONE — the revoke needs\n // nothing else: its subject/session come from the verified hint's\n // claims, and client resolution degrades gracefully (the service\n // falls back to the hint's sole `aud`, scoped by the hint's own realm\n // claim — the dropped request params only affected the confirm page's\n // client name and the redirect, which is dropped anyway). Only a\n // malformed hint itself falls through to the parameter-less confirm\n // page.\n let data: OAuth2EndSessionRequest;\n try {\n data = await this.validator.run(merged);\n } catch {\n try {\n data = await this.validator.run({ id_token_hint: merged.id_token_hint });\n } catch {\n data = {};\n }\n }\n\n const result = await this.endSessionService.verify(data);\n\n // A signature-verified id_token_hint proves possession — revoke the\n // referenced session server-side immediately (only if it belongs to the\n // hint's subject). Without a hint we mutate nothing; the SSR page's\n // sign-out is a click-gated, bearer-authenticated action.\n let serverRevoked = false;\n if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n serverRevoked = await this.endSessionService.revoke(\n result.sessionId,\n result.sub,\n result.subKind,\n );\n }\n\n // Build the validated post-logout redirect (the open-redirect guard\n // lives in the service; `state` rides only alongside a validated uri).\n let redirect: string \| undefined;\n if (result.redirectUri) {\n const url = new URL(result.redirectUri);\n if (result.state) {\n url.searchParams.set('state', result.state);\n }\n\n redirect = url.href;\n }\n\n // Bounce straight back to the RP ONLY when the logout was actually\n // performed server-side (a verified hint revoked the session). A\n // hint-less or forged request MUST NOT silently redirect without ending\n // the session — otherwise the RP treats a no-op round-trip as a\n // successful logout while the authup session survives. Instead render\n // the click-gated confirm page, which performs the bearer-authenticated\n // sign-out and then redirects.\n if (serverRevoked && redirect) {\n return sendRedirect(event, redirect);\n }\n\n const requestURL = new URL(event.request.url);\n\n return ~~renderUIPage~~(event, {\n url: '/logout',\n payload: {\n config: { baseURL: this.options.baseURL },\n data: {\n client: result.clientName ? { name: result.clientName } : undefined,\n hintVerified: result.hintVerified,\n // never reflect an unverified hint's claims\n hintSub: result.hintVerified ? result.sub : undefined,\n hintSubKind: result.hintVerified ? result.subKind : undefined,\n serverRevoked,\n // the (already validated) uri to return to after a click-gated\n // sign-out; carries `state` when present\n redirect,\n requestPath: `${requestURL.pathname}${requestURL.search}`,\n },\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAe/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJ,IAAI;IACAC,OAAO,MAAM,KAAKP,UAAUQ,IAAI,EAAEC,eAAeH,OAAOG,cAAc,CAAA;GAC1E,QAAQ;IACJF,OAAO,CAAC;GACZ;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKX,kBAAkBY,OAAOJ,IAAAA;EAMnD,IAAIK,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKb,kBAAkBkB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI5B,IAAIkB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOzB,aAAaU,OAAOe,QAAAA;EAG/B,MAAMO,aAAa,IAAIjC,IAAIW,MAAMuB,QAAQN,GAAG;EAE5C,OAAOxB,~~aAAaO~~,OAAO;~~GACvBiB~~,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK/B,QAAQ+B,QAAQ;IACxCtB,MAAM;KACFuB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderAuthConsolePage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","id_token_hint","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n DContext,\n DController,\n DGet,\n DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderAuthConsolePage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n protected options: LogoutControllerOptions;\n\n protected endSessionService: IOAuth2EndSessionService;\n\n protected validator: OAuth2EndSessionRequestValidator;\n\n constructor(ctx: LogoutControllerContext) {\n this.options = ctx.options;\n this.endSessionService = ctx.endSessionService;\n this.validator = new OAuth2EndSessionRequestValidator();\n }\n\n @DGet('', [])\n async serve(@DContext() event: IAppEvent): Promise<string \| Response> {\n return this.handle(event);\n }\n\n // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n @DPost('', [])\n async execute(@DContext() event: IAppEvent): Promise<string \| Response> {\n return this.handle(event);\n }\n\n protected async handle(event: IAppEvent): Promise<string \| Response> {\n const merged = await readFromLocations(event, ['body', 'query']);\n\n // Malformed input (oversized / duplicated params) must never dead-end\n // the human behind the browser on a JSON error, nor discard a valid\n // id_token_hint: a bad cosmetic* param (post_logout_redirect_uri /\n // state / client_id / realm hint) must NOT cancel the\n // security-critical revoke the hint authorizes. So on a full-request\n // validation failure, retry with the hint ALONE — the revoke needs\n // nothing else: its subject/session come from the verified hint's\n // claims, and client resolution degrades gracefully (the service\n // falls back to the hint's sole `aud`, scoped by the hint's own realm\n // claim — the dropped request params only affected the confirm page's\n // client name and the redirect, which is dropped anyway). Only a\n // malformed hint itself falls through to the parameter-less confirm\n // page.\n let data: OAuth2EndSessionRequest;\n try {\n data = await this.validator.run(merged);\n } catch {\n try {\n data = await this.validator.run({ id_token_hint: merged.id_token_hint });\n } catch {\n data = {};\n }\n }\n\n const result = await this.endSessionService.verify(data);\n\n // A signature-verified id_token_hint proves possession — revoke the\n // referenced session server-side immediately (only if it belongs to the\n // hint's subject). Without a hint we mutate nothing; the SSR page's\n // sign-out is a click-gated, bearer-authenticated action.\n let serverRevoked = false;\n if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n serverRevoked = await this.endSessionService.revoke(\n result.sessionId,\n result.sub,\n result.subKind,\n );\n }\n\n // Build the validated post-logout redirect (the open-redirect guard\n // lives in the service; `state` rides only alongside a validated uri).\n let redirect: string \| undefined;\n if (result.redirectUri) {\n const url = new URL(result.redirectUri);\n if (result.state) {\n url.searchParams.set('state', result.state);\n }\n\n redirect = url.href;\n }\n\n // Bounce straight back to the RP ONLY when the logout was actually\n // performed server-side (a verified hint revoked the session). A\n // hint-less or forged request MUST NOT silently redirect without ending\n // the session — otherwise the RP treats a no-op round-trip as a\n // successful logout while the authup session survives. Instead render\n // the click-gated confirm page, which performs the bearer-authenticated\n // sign-out and then redirects.\n if (serverRevoked && redirect) {\n return sendRedirect(event, redirect);\n }\n\n const requestURL = new URL(event.request.url);\n\n return renderAuthConsolePage(event, {\n url: '/logout',\n payload: {\n config: { baseURL: this.options.baseURL },\n data: {\n client: result.clientName ? { name: result.clientName } : undefined,\n hintVerified: result.hintVerified,\n // never reflect an unverified hint's claims\n hintSub: result.hintVerified ? result.sub : undefined,\n hintSubKind: result.hintVerified ? result.subKind : undefined,\n serverRevoked,\n // the (already validated) uri to return to after a click-gated\n // sign-out; carries `state` when present\n redirect,\n requestPath: `${requestURL.pathname}${requestURL.search}`,\n },\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAe/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJ,IAAI;IACAC,OAAO,MAAM,KAAKP,UAAUQ,IAAI,EAAEC,eAAeH,OAAOG,cAAc,CAAA;GAC1E,QAAQ;IACJF,OAAO,CAAC;GACZ;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKX,kBAAkBY,OAAOJ,IAAAA;EAMnD,IAAIK,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKb,kBAAkBkB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI5B,IAAIkB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOzB,aAAaU,OAAOe,QAAAA;EAG/B,MAAMO,aAAa,IAAIjC,IAAIW,MAAMuB,QAAQN,GAAG;EAE5C,OAAOxB,sBAAsBO,OAAO;GAChCiB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK/B,QAAQ+B,QAAQ;IACxCtB,MAAM;KACFuB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/password-forgot/module.mjs CHANGED Viewed

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { useRequestLocale } from "../../../request/helpers/locale.mjs";
 import "../../../request/index.mjs";
-import { serveWorkflowPage } from "../../../ui/serve.mjs";
+import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
 import "../../../ui/index.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/password-forgot/module.ts

package/dist/adapters/http/controllers/workflows/password-reset/module.mjs CHANGED Viewed

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { serveWorkflowPage } from "../../../ui/serve.mjs";
+import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
 import "../../../ui/index.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/password-reset/module.ts

package/dist/adapters/http/controllers/workflows/register/module.mjs CHANGED Viewed

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { useRequestLocale } from "../../../request/helpers/locale.mjs";
 import "../../../request/index.mjs";
-import { serveWorkflowPage } from "../../../ui/serve.mjs";
+import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
 import "../../../ui/index.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/register/module.ts

package/dist/adapters/http/controllers/workflows/userinfo/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAIjE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF;;;;;GAKG;AACH,qBAEa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;gBAEpB,GAAG,EAAE,yBAAyB;IAKpC,GAAG,CACO,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;~~CAanB~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAIjE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF;;;;;GAKG;AACH,qBAEa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;gBAEpB,GAAG,EAAE,yBAAyB;IAKpC,GAAG,CACO,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;CAwBnB"}

package/dist/adapters/http/controllers/workflows/userinfo/module.mjs CHANGED Viewed

@@ -31,7 +31,11 @@ var UserInfoController = class {
 		const actor = buildActorContext(event);
 		let id = "@me";
 		if (actor.identity && actor.identity.type === "user") id = actor.identity.data.id;
-		return this.service.getOne(id, actor, useRequestQuery(event));
+		const query = useRequestQuery(event);
+		return this.service.getOne(id, actor, {
+			...query,
+			fields: query.fields || "+email"
+		});
 	}
 };
 _ts_decorate([