npm - @authup/server-core - Versions diffs - 1.0.0-beta.59 → 1.0.0-beta.61 - Mend

@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.61

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (434) hide show

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","SessionAuthMethod","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2ErrorCode","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","RECORD_QUERY_PARAMETERS","createIdentityProviderOAuth2Authenticator","decodeQuery","describeQuerySchema","identityProviderSchema","toIdentityPolicyData","applyRouteRealmIDToBody","buildActorContext","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","clientRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","accessPolicyEvaluator","ctx","getProviders","event","data","meta","findMany","schema","actor","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realmId","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","realm_id","code","clientId","client_id","authenticate","realm","accessPolicyId","allowed","subject","type","USER","url","buildHostedAuthorizeURL","searchParams","set","ACCESS_DENIED","href","authorizationCode","issue","response_type","redirect_uri","scope","authMethod","EXTERNAL","group","body","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","save","ip","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n SessionAuthMethod,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2ErrorCode, OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n EntityRecordResponse,\n IdentityProviderCreatePayload,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IOAuth2ClientRepository,\n IRealmRepository,\n OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n RECORD_QUERY_PARAMETERS,\n createIdentityProviderOAuth2Authenticator,\n decodeQuery,\n describeQuerySchema,\n identityProviderSchema,\n toIdentityPolicyData,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n buildActorContext,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.clientRepository = ctx.clientRepository;\n this.accountManager = ctx.accountManager;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data,\n meta,\n } = await this.repository.findMany(\n await decodeQuery(useRequestQuery(event), {\n schema: identityProviderSchema,\n actor: buildActorContext(event),\n }),\n );\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta: {\n ...meta,\n schema: describeQuerySchema(identityProviderSchema),\n },\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return { data: entity, meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) } };\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: { baseURL: this.options.baseURL },\n });\n\n const parameters : AuthorizeParameters = {};\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realmId &&\n entity.realmId &&\n entity.realmId !== data.client.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n if (\n entity.realmId &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: {\n baseURL: this.options.baseURL,\n clientId: data.codeRequest?.client_id,\n },\n });\n\n const user = await authenticator.authenticate(code);\n\n const realm = await this.realmRepository.resolve(entity.realmId, true);\n\n // Application access policy (plan 052), federated leg: the callback\n // never redirects to the RP directly — a denial bounces back to the\n // hosted authorize page with error=access_denied, so no\n // redirectUriVerified threading through the state blob is needed.\n // A policy id with no wired evaluator denies (fail closed); a\n // since-deleted client is skipped (the /token backstop still covers it).\n if (data.codeRequest?.client_id) {\n const client = await this.clientRepository.findOneByIdOrName(\n data.codeRequest.client_id,\n data.codeRequest.realm_id,\n );\n\n if (client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData({\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n });\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n\n return sendRedirect(event, url.href);\n }\n }\n }\n\n const authorizationCode = await this.codeIssuer.issue(\n {\n response_type: 'code',\n client_id: data.codeRequest?.client_id,\n redirect_uri: data.codeRequest?.redirect_uri,\n scope: data.codeRequest?.scope,\n },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n { authMethod: SessionAuthMethod.EXTERNAL },\n );\n\n if (data.codeRequest) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<EntityRecordResponse<IdentityProvider>> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realmId = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n // Only a NAME key may upsert-create. A UUID addresses one specific\n // row, so a miss is a 404 (creating would write a different id).\n if (!entity && (options.updateOnly \|\| where.id)) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? entity.realmId ?? null,\n }),\n });\n } else {\n if (!data.realmId) {\n const identity = useRequestIdentityOrFail(event);\n data.realmId = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return { data: entity, meta: {} };\n }\n\n // ---------------------------------------------------------\n\n private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n const codeRequestKeys = Object.keys(codeRequest);\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n const codeRequestValue = codeRequest[codeRequestKey];\n // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n // treats as prompt=login) — only skip absent ones.\n if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n url.searchParams.set(codeRequestKey, String(codeRequestValue));\n }\n }\n\n return url;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async saveAuthorizationState(\n event: IAppEvent,\n codeRequest?: OAuth2AuthorizationCodeRequest,\n ) : Promise<string> {\n return this.stateManager.save({\n codeRequest,\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsFA,IAAagD,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKV,UAAUU,IAAIV;EACnB,KAAKC,aAAaS,IAAIT;EACtB,KAAKC,kBAAkBQ,IAAIR;EAC3B,KAAKC,mBAAmBO,IAAIP;EAC5B,KAAKC,iBAAiBM,IAAIN;EAC1B,KAAKI,aAAaE,IAAIF;EACtB,KAAKH,sBAAsBK,IAAIL;EAC/B,KAAKC,uBAAuB,IAAIvB,wCAAAA;EAChC,KAAKwB,eAAeG,IAAIH;EACxB,KAAKE,wBAAwBC,IAAID;CACrC;CAIA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKb,WAAWc,SACtB,MAAM7B,YAAYR,gBAAgBkC,KAAAA,GAAQ;GACtCI,QAAQ5B;GACR6B,OAAO1B,kBAAkBqB,KAAAA;EAC7B,CAAA,CAAA;EAGJ,IAAI;GACA,MAAMM,sBAAsBrB,8BAA8Be,KAAAA;GAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAekD,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAAST,MAChB,IAAI;IACA,MAAMK,oBAAoBK,SAAS;KAC/BH,MAAMjD,eAAekD;KACrBR,MAAM7D,iBAAiB;OAAGD,kBAAkByE,aAAaF;OAAQvE,kBAAkB0E,cAAcH,MAAMI,WAAW;KAAK,CAAA;IAC3H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHb;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQ7B,oBAAoBC,sBAAAA;GAChC;EACJ;CACJ;CAEA,MACMuC,YACF,IACA,OAC+C;EAC/C,MAAME,UAAUjC,kBAAkBgB,OAAO,EAAEzD,QAAQ,MAAM,CAAA;EAEzD,MAAM2E,SAAS,MAAM,KAAK7B,WAAW8B,kBACjCF,SACAnC,kBAAkBkB,KAAAA,CAAAA;EAGtB,IAAI,CAACkB,QACD,MAAM,IAAItD,oBAAAA;EAGd,IAAI;GAEA,MAD4BqB,8BAA8Be,KACpDM,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMjD,eAAekD;IACrBR,MAAM7D,iBAAiB;MAAGD,kBAAkByE,aAAaM;MAAS/E,kBAAkB0E,cAAcK,OAAOJ,WAAW;IAAK,CAAA;GAC7H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAO;GAAEb,MAAMiB;GAAQhB,MAAM,EAAEE,QAAQ7B,oBAAoBC,wBAAwBJ,uBAAAA,EAAyB;EAAE;CAClH;CAEA,MACMgD,aACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKE,MAAMtB,OAAO,EAAEuB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKF,MAAMtB,KAAAA;CACtB;CAEA,MACMyB,aACF,IACA,OACgD;EAChD,MAAMR,UAAUjC,kBAAkBgB,KAAAA;EAElC,MAAMM,sBAAsBrB,8BAA8Be,KAAAA;EAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAemE,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAK7B,WAAWsC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAItD,oBAAAA;EAGd,MAAM0C,oBAAoBK,SAAS;GAC/BH,MAAMjD,eAAemE;GACrBzB,MAAM7D,iBAAiB;KAAGD,kBAAkByE,aAAaM;KAAS/E,kBAAkB0E,cAAcK,OAAOJ,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAK7B,WAAWwC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ5B,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAEA,MACM8B,YACF,MACA,OACgD;EAChD,OAAO,KAAKV,MAAMtB,KAAAA;CACtB;CAIA,MACMiC,aACF,KACA,OACF;EACE,MAAMjB,KAAKhC,kBAAkBgB,KAAAA;EAC7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAACvD,yBAAyByD,MAAAA,KAAW,CAACxD,yBAAyBwD,MAAAA,GAC/D,MAAM,IAAIvD,gBAAgB,oFAAA;EAG9B,MAAMyE,gBAAgB/D,0CAA0C;GAC5DmB,gBAAgB,KAAKA;GACrB6C,UAAUnB;GACV9B,SAAS,EAAEkD,SAAS,KAAKlD,QAAQkD,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQ3E,gBAAgBkC,KAAAA;EAC9B,IAAI,OAAOyC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAMtG,gBAAgBmG,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAMvE,mBAAmB4E,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKpD,qBAAqBqD,IAAIL,kBAAAA;GACjE,MAAMzC,OAAO,MAAM,KAAKR,oBAAoBuD,OAAOF,oBAAAA;GAEnD,IACI7C,KAAKgD,OAAOnC,WACZI,OAAOJ,WACPI,OAAOJ,YAAYb,KAAKgD,OAAOnC,SAE/B,MAAM7C,mBAAmB4E,UAAU,6CAAA;GAGvCL,cAAcvC,KAAKA;EACvB;EAEAsC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBnD,OAAOwC,WAAAA;EAE5D,OAAOrF,aAAa6C,OAAOoC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAKhC,kBAAkBgB,KAAAA;EAE7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAACvD,yBAAyByD,MAAAA,KAAW,CAACxD,yBAAyBwD,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMtD,OAAO,MAAM,KAAKuD,yBAAyBxD,KAAAA;EACjD,IACIkB,OAAOJ,WACPb,KAAKuC,eACLvC,KAAKuC,YAAYiB,YACjBxD,KAAKuC,YAAYiB,aAAavC,OAAOJ,SAErC,MAAM7C,mBAAmB4E,UAAU,6CAAA;EAGvC,MAAM,EAAEa,SAAS5F,gBAAgBkC,KAAAA;EAWjC,MAAMqB,OAAO,MATShD,0CAA0C;GAC5DmB,gBAAgB,KAAKA;GACrB6C,UAAUnB;GACV9B,SAAS;IACLkD,SAAS,KAAKlD,QAAQkD;IACtBqB,UAAU1D,KAAKuC,aAAaoB;GAChC;EACJ,CAEmBxB,CAAAA,CAAcyB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKxE,gBAAgB6C,QAAQjB,OAAOJ,SAAS,IAAA;EAQjE,IAAIb,KAAKuC,aAAaoB,WAAW;GAC7B,MAAMX,SAAS,MAAM,KAAK1D,iBAAiB4B,kBACvClB,KAAKuC,YAAYoB,WACjB3D,KAAKuC,YAAYiB,QAAQ;GAG7B,IAAIR,QAAQc,gBAAgB;IACxB,IAAIC,UAAU;IAEd,MAAMC,UAAUxF,qBAAqB;KACjCyF,MAAM5G,aAAa6G;KACnBlE,MAAM;MACF,GAAGoB;MACHyC;KACJ;IACJ,CAAA;IACA,IAAI,KAAKjE,yBAAyBoE,SAC9BD,UAAU,MAAM,KAAKnE,sBAAsBc,SACvCsC,OAAOc,gBACPE,OAAAA;IAIR,IAAI,CAACD,SAAS;KACV,MAAMI,MAAM,KAAKC,wBAAwBpE,KAAKuC,WAAW;KACzD4B,IAAIE,aAAaC,IAAI,SAASvG,gBAAgBwG,aAAa;KAE3D,OAAOrH,aAAa6C,OAAOoE,IAAIK,IAAI;IACvC;GACJ;EACJ;EAEA,MAAMC,oBAAoB,MAAM,KAAK9E,WAAW+E,MAC5C;GACIC,eAAe;GACfhB,WAAW3D,KAAKuC,aAAaoB;GAC7BiB,cAAc5E,KAAKuC,aAAaqC;GAChCC,OAAO7E,KAAKuC,aAAasC;EAC7B,GACA;GACIZ,MAAM5G,aAAa6G;GACnBlE,MAAM;IACF,GAAGoB;IACHyC;GACJ;EACJ,GACA,EAAEiB,YAAYvH,kBAAkBwH,SAAS,CAAA;EAG7C,IAAI/E,KAAKuC,aAAa;GAClB,MAAM4B,MAAM,KAAKC,wBAAwBpE,KAAKuC,WAAW;GACzD4B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkB1D,EAAE;GAEjD,OAAO7D,aAAa6C,OAAOoE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAIlG,IAAI,KAAKkB,QAAQkD,OAAO;EACxC8B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkB1D,EAAE;EAEjD,OAAO7D,aAAa6C,OAAOoE,IAAIK,IAAI;CACvC;CAIA,MAAcnD,MAAMtB,OAAkBZ,UAElC,CAAC,GAAoD;EACrD,IAAI6F;EACJ,MAAMjE,KAAKnC,kBAAkBmB,OAAO,EAAEzD,QAAQ,MAAM,CAAA;EACpD,MAAM2I,OAAO,MAAMnH,gBAAgBiC,KAAAA;EACnCtB,wBAAwBsB,OAAOkF,IAAAA;EAC/B,MAAMpE,UAAUhC,kBAAkBkB,KAAAA,KAAUpB,eAAesG,IAAAA;EAE3D,IAAIhE;EACJ,IAAIF,IAAI;GACJ,MAAMmE,QAA6B,CAAC;GACpC,IAAI5I,OAAOyE,EAAAA,GACPmE,MAAMnE,KAAKA;QAEXmE,MAAM3E,OAAOQ;GAGjB,IAAIF,SACAqE,MAAMrE,UAAUA;GAGpBI,SAAS,MAAM,KAAK7B,WAAWsC,UAAUwD,KAAAA;GAGzC,IAAI,CAACjE,WAAW9B,QAAQmC,cAAc4D,MAAMnE,KACxC,MAAM,IAAIpD,oBAAAA;EAElB,OAAO,IAAIwB,QAAQmC,YACf,MAAM,IAAI3D,oBAAAA;EAGd,MAAM0C,sBAAsBrB,8BAA8Be,KAAAA;EAC1D,IAAIkB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAe6H,yBAAyB,CAAA;GAEtFH,QAAQ5I,eAAegJ;EAC3B,OAAO;GACH,MAAM/E,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAe+H,yBAAyB,CAAA;GAEtFL,QAAQ5I,eAAekJ;EAC3B;EAGA,MAAMtF,OAAO,MAAMuF,IADGnI,0BACHmI,CAAAA,CAAUzC,IAAImC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMS,aAAa,MAAMD,IADOrI,oCACPqI,CAAAA,CAAoB1C,IAAImC,IAAAA;EAEjD,MAAM,KAAK7F,WAAWsG,oBAAoB1F,IAAAA;EAE1C,IAAIiB,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMjD,eAAe6H;GACrBnF,MAAM7D,iBAAiB;KAClBD,kBAAkByE,aAAa;KAC5B,GAAGM;KACH,GAAGjB;IACP;KACC9D,kBAAkB0E,cAAcZ,KAAKa,WAAWI,OAAOJ,WAAW;GACvE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACb,KAAKa,SAENb,KAAKa,UADY/B,yBAAyBiB,KAC3B4F,CAAAA,CAAS9E;GAG5B,MAAMR,oBAAoBK,SAAS;IAC/BH,MAAMjD,eAAe+H;IACrBrF,MAAM7D,iBAAiB;MAAGD,kBAAkByE,aAAaX;MAAO9D,kBAAkB0E,cAAcZ,KAAKa,WAAW;IAAK,CAAA;GACzH,CAAA;EACJ;EAEA,MAAM,KAAKzB,WAAWwG,gBAAgB5F,MAAMiB,UAAU4E,KAAAA,CAAAA;EAEtD,IAAI5E,QAAQ;GACRA,SAAS,KAAK7B,WAAW0G,MAAM7E,QAAQjB,IAAAA;GACvC,MAAM,KAAKZ,WAAW2G,WAAW9E,QAAQwE,UAAAA;GAEzC1F,MAAM8B,SAASC,SAAS;GAExB,OAAO;IAAE9B,MAAMiB;IAAQhB,MAAM,CAAC;GAAE;EACpC;EAEAgB,SAAS,KAAK7B,WAAW4G,OAAOhG,IAAAA;EAChC,MAAM,KAAKZ,WAAW2G,WAAW9E,QAAQwE,UAAAA;EAEzC1F,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAIQmE,wBAAwB7B,aAAkD;EAC9E,MAAM4B,MAAM,IAAIlG,IAAIL,WAAW,KAAKuB,QAAQkD,SAAS,WAAA,CAAA;EAErD,MAAM4D,kBAAkBC,OAAOC,KAAK5D,WAAAA;EACpC,KAAK,MAAM6D,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmB/D,YAAY8D;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChEnC,IAAIE,aAAaC,IAAI+B,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAOnC;CACX;CAIA,MAAcjC,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAK7B,WAAWoH,YAAYzF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAItD,oBAAAA;EAGd,OAAOsD;CACX;CAIA,MAAciC,uBACVnD,OACAwC,aACgB;EAChB,OAAO,KAAK7C,aAAa+G,KAAK;GAC1BlE;GACAmE,IAAIzJ,aAAa8C,KAAAA,KAAU;GAC3B4G,WAAW3J,iBAAiB+C,OAAO,YAAA,KAAiB8F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBxD,OAAqD;EACxF,MAAMyC,QAAQ3E,gBAAgBkC,KAAAA;EAC9B,IAAI,OAAOyC,MAAMS,UAAU,UACvB,MAAMjF,mBAAmB4I,aAAY;EAGzC,OAAO,KAAKlH,aAAaqD,OAAOP,MAAMS,OAAO;GACzCyD,IAAIzJ,aAAa8C,KAAAA,KAAU;GAC3B4G,WAAW3J,iBAAiB+C,OAAO,YAAA,KAAiB8F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;CA9WoB5G,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAgCNA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;CA/JF,YAAA,CAAA,uBAAuB,qCAAA,CAAA"}
1	+ {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isObject","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","EventName","EventRefType","EventScope","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","SessionAuthMethod","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityInactiveError","EntityNotFoundError","describeError","resolveURL","useRequestQuery","readRequestBody","OAuth2ErrorCode","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","RECORD_QUERY_PARAMETERS","createIdentityProviderOAuth2Authenticator","decodeQuery","describeQuerySchema","identityProviderSchema","toIdentityPolicyData","applyRouteRealmIDToBody","buildActorContext","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestEventContext","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","accountManager","linkStore","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","accessPolicyEvaluator","eventService","logger","ctx","getProviders","event","data","meta","findMany","schema","actor","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realmId","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","buildProviderAuthenticator","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","linkRequest","enabled","identity","type","USER","link","userId","providerId","url","authorizeIn","Error","protocol","verifyAuthorizationState","completeLink","realm_id","code","length","verified","undefined","clientId","client_id","authenticate","active","realm","accessPolicyId","allowed","subject","buildHostedAuthorizeURL","searchParams","set","ACCESS_DENIED","href","authorizationCode","issue","response_type","authMethod","EXTERNAL","record","scope","OAUTH2","AUTHORIZE","refType","CLIENT","refId","sessionId","actorType","actorId","actorName","requestIpAddress","requestUserAgent","reason","providerName","redirectUriVerified","redirect_uri","baseURL","group","body","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","checkUniqueness","merge","saveWithEA","create","provider","resolveIdentity","handle","save","providerUserId","providerUserName","pickIdentityCandidate","providerUserEmail","e","error","confirmLink","_data","consume","account","attributeCandidates","email","requestContext","IDENTITY","IDENTITY_PROVIDER_LINKED","IDENTITY_PROVIDER_ACCOUNT","userRealmId","requestPath","requestMethod","key","candidates","candidate","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","ip","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { \n ValidatorGroup, \n base64URLDecode, \n isObject, \n isUUID, \n} from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type {\n IdentityProvider,\n IdentityProviderAccount,\n OAuth2AuthorizationCodeRequest,\n OAuth2IdentityProvider,\n OpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport {\n EventName,\n EventRefType,\n EventScope,\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n SessionAuthMethod,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityInactiveError, EntityNotFoundError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport { describeError, resolveURL } from '../../../../../utils/index.ts';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2ErrorCode, OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n EntityRecordResponse,\n IdentityProviderCreatePayload,\n IdentityProviderLinkConfirmPayload,\n IdentityProviderLinkRequestResponse,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IEventService,\n IIdentityProviderAccountLinkStore,\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IRealmRepository,\n IdentityProviderIdentity,\n OAuth2AuthorizationState,\n OAuth2AuthorizationStateLink,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n RECORD_QUERY_PARAMETERS,\n createIdentityProviderOAuth2Authenticator,\n decodeQuery,\n describeQuerySchema,\n identityProviderSchema,\n toIdentityPolicyData,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n buildActorContext,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestEventContext,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected linkStore: IIdentityProviderAccountLinkStore;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n protected eventService? : IEventService;\n\n protected logger? : Logger;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.accountManager = ctx.accountManager;\n this.linkStore = ctx.linkStore;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.eventService = ctx.eventService;\n this.logger = ctx.logger;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data,\n meta,\n } = await this.repository.findMany(\n await decodeQuery(useRequestQuery(event), {\n schema: identityProviderSchema,\n actor: buildActorContext(event),\n }),\n );\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta: {\n ...meta,\n schema: describeQuerySchema(identityProviderSchema),\n },\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return { data: entity, meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) } };\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = this.buildProviderAuthenticator(entity);\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realmId &&\n entity.realmId &&\n entity.realmId !== data.client.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n const state = await this.saveAuthorizationState(event, { codeRequest });\n\n return sendRedirect(event, authenticator.buildRedirectURL({ state }));\n }\n\n @DPost('/:id/link-request', [ForceLoggedInMiddleware])\n async linkRequest(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProviderLinkRequestResponse> {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports account linking.');\n }\n\n if (!entity.enabled) {\n throw new BadRequestError('The identity provider is not enabled.');\n }\n\n const identity = useRequestIdentityOrFail(event);\n if (identity.type !== IdentityType.USER) {\n throw new BadRequestError('Only a user can link an identity provider account.');\n }\n\n if (entity.realmId && entity.realmId !== identity.realmId) {\n throw new BadRequestError('The identity provider does not belong to the user realm.');\n }\n\n const authenticator = this.buildProviderAuthenticator(entity);\n\n const state = await this.saveAuthorizationState(event, { link: { userId: identity.id, providerId: entity.id } });\n\n return { url: authenticator.buildRedirectURL({ state }) };\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n\n const { link } = data;\n if (link) {\n return this.completeLink(event, entity, data, link);\n }\n\n if (\n entity.realmId &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n if (typeof code !== 'string' \|\| code.length === 0) {\n throw new BadRequestError('The authorization code is missing.');\n }\n\n // Re-verify the code request that authorize-out stored on the state,\n // BEFORE the provider's single-use code is spent. It re-resolves the\n // client (active, grant allowlist, scopes) and re-matches the\n // redirect_uri against the client's registered patterns, so a client\n // deactivated (or a pattern removed) while the user was away at the\n // provider cannot still receive a code, and a refused completion\n // provisions no user. Same fail-closed-at-completion rule the link path\n // applies to the provider.\n //\n // The redirect below rests on the MATCH, which the verifier enforces by\n // throwing `redirectUriMismatch`; `redirectUriVerified` is the flag\n // that survives to report it. Nothing else on this path knows whether\n // the uri was ever matched.\n const verified = data.codeRequest ?\n await this.codeRequestVerifier.verify(data.codeRequest) :\n undefined;\n\n // The provider must still be enabled, the rule the link path already\n // applies. Disabling a provider has to stop logins in flight too,\n // otherwise it only stops new ones.\n if (!entity.enabled) {\n throw new BadRequestError('The identity provider is not enabled.');\n }\n\n const authenticator = this.buildProviderAuthenticator(entity, { clientId: verified?.data.client_id });\n\n const user = await authenticator.authenticate({ code });\n\n // The local login path refuses an inactive user (EntityInactiveError),\n // and a federated login must not be the way around that. Only reachable\n // for an already-linked user: a first login provisions an active one.\n if (!user.active) {\n throw new EntityInactiveError({ entity: 'user' });\n }\n\n const realm = await this.realmRepository.resolve(entity.realmId, true);\n\n // Application access policy (plan 052), federated leg. The denial\n // bounces back to the hosted authorize page, which renders it as a\n // denial card, rather than becoming an error redirect to the RP: the\n // person is standing in front of the browser and the card is the only\n // surface that can tell them why. A policy id with no wired evaluator\n // denies (fail closed).\n if (verified?.client.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData({\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n });\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n verified.client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n const url = this.buildHostedAuthorizeURL(verified.data);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n\n return sendRedirect(event, url.href);\n }\n }\n\n // The WHOLE verified request reaches the issuer, never a hand-picked\n // subset: it carries code_challenge / code_challenge_method and nonce\n // (plus acr_values, which no redemption path reads yet). A code that\n // lost its PKCE challenge cannot be redeemed by a public client at all\n // (`PKCE is required for public clients`), which is every console\n // client.\n const authorizationCode = await this.codeIssuer.issue(\n verified?.data ?? { response_type: 'code' },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n { authMethod: SessionAuthMethod.EXTERNAL },\n );\n\n // The interactive path records this in OAuth2Authorization.authorize();\n // this leg issues its code directly, so without an emit here a\n // federated authorization leaves no trace in auth_events while every\n // other one does. `reason: federated` is what tells the two apart:\n // there was no consent step to report. No session exists yet (the\n // /token exchange creates it), hence a null sessionId. Metrics stay\n // uninstrumented on this leg, as they already are.\n await this.eventService?.record({\n scope: EventScope.OAUTH2,\n name: EventName.AUTHORIZE,\n refType: EventRefType.CLIENT,\n refId: verified?.data.client_id ?? null,\n clientId: verified?.data.client_id ?? null,\n sessionId: null,\n actorType: IdentityType.USER,\n actorId: user.id,\n actorName: user.name,\n realmId: verified?.data.realm_id ?? realm.id,\n requestIpAddress: getRequestIP(event) ?? null,\n requestUserAgent: getRequestHeader(event, 'user-agent') ?? null,\n data: {\n reason: 'federated',\n providerId: entity.id,\n providerName: entity.name,\n ...(verified?.data.scope ? { scope: verified.data.scope } : {}),\n },\n });\n\n // RFC 6749 §4.1.2: the code goes back to the client that asked for it.\n // It is bound to that client_id and that redirect_uri, so the RP is the\n // only party able to redeem it. Handing it to any other page strands\n // the login there (issue #3446).\n if (verified?.redirectUriVerified && verified.data.redirect_uri) {\n const url = new URL(verified.data.redirect_uri);\n url.searchParams.set('code', authorizationCode.id);\n if (verified.data.state) {\n url.searchParams.set('state', verified.data.state);\n }\n\n return sendRedirect(event, url.href);\n }\n\n // Only reachable when the state carried no code request at all: a\n // stored one always has a redirect_uri, because that mount is required\n // in OAuth2AuthorizationCodeRequestValidator (unlike `state`), so a\n // verified request is always a verified redirect target.\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<EntityRecordResponse<IdentityProvider>> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realmId = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n // Only a NAME key may upsert-create. A UUID addresses one specific\n // row, so a miss is a 404 (creating would write a different id).\n if (!entity && (options.updateOnly \|\| where.id)) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? entity.realmId ?? null,\n }),\n });\n } else {\n if (!data.realmId) {\n const identity = useRequestIdentityOrFail(event);\n data.realmId = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return { data: entity, meta: {} };\n }\n\n // ---------------------------------------------------------\n\n /\n Callback half of the account-linking round-trip (plan 091): the\n * external identity is bound to the state-referenced user instead of\n * running the login path. No auth code and no session is minted; the\n * browser lands back on the account console with a marker param.\n /\n private async completeLink(\n event: IAppEvent,\n provider: OAuth2IdentityProvider \| OpenIDIdentityProvider,\n state: OAuth2AuthorizationState,\n link: OAuth2AuthorizationStateLink,\n ) {\n // Fixed, server-derived return target (the account console page).\n // No client-supplied redirect exists on this path.\n const url = new URL(resolveURL(this.options.baseURL, 'account/connected-accounts'));\n\n const { code } = useRequestQuery(event);\n\n try {\n // The state is bound to the provider it was minted for, and the\n // provider must still be enabled at completion — a state cannot\n // be replayed against a different provider's callback, nor\n // complete a link after its provider was disabled.\n if (link.providerId !== provider.id \|\| !provider.enabled) {\n throw new BadRequestError('The identity provider is not available for account linking.');\n }\n\n if (typeof code !== 'string' \|\| code.length === 0) {\n throw new BadRequestError('The authorization code is missing.');\n }\n\n const authenticator = this.buildProviderAuthenticator(provider);\n\n const identity = await authenticator.resolveIdentity({ code });\n\n // A provider answering without a subject has nothing to bind. The\n // callback used to reach `link()`, which rejected it; the stash\n // would otherwise carry an empty providerUserId to the confirm.\n if (!identity.id) {\n throw new BadRequestError('The identity provider returned no subject.');\n }\n\n // Nothing is written here. This request is unauthenticated — the\n // browser round-trip cannot carry a bearer — so the only thing\n // distinguishing the browser that started the link from any other\n // would be the state's ip / user-agent binding, and both values\n // are chosen by whoever minted the state. An attacker minting a\n // state carrying their OWN userId and getting a victim to follow\n // it would otherwise bind the VICTIM's external identity to the\n // attacker's account (issue #3439).\n //\n // The resolved identity is stashed under a one-time handle\n // instead, and the account console confirms it with its bearer.\n // The stash keeps the requesting userId so the confirm can\n // require it to equal the AUTHENTICATED user: the handle is a\n // URL parameter, so it reaches browser history and proxy logs,\n // and on its own it must authorize nothing.\n const handle = await this.linkStore.save({\n providerId: provider.id,\n userId: link.userId,\n providerUserId: identity.id,\n providerUserName: this.pickIdentityCandidate(identity, 'name'),\n providerUserEmail: this.pickIdentityCandidate(identity, 'email'),\n });\n\n url.searchParams.set('linkHandle', handle);\n url.searchParams.set('provider', provider.id);\n } catch (e) {\n // The failure is swallowed into a redirect marker, so the log is\n // the only surface it can reach. Without this an unreachable or\n // rejecting provider is indistinguishable from a stale state.\n this.logger?.error(describeError(e, 'The identity-provider account link failed.'));\n\n url.searchParams.set('linkError', 'link_failed');\n }\n\n return sendRedirect(event, url.href);\n }\n\n /\n The bearer-authenticated half of the link (issue #3439): the account\n * row is written here, for the AUTHENTICATED user, never in the callback.\n */\n @DPost('/:id/link-confirm', [ForceLoggedInMiddleware])\n async confirmLink(\n @DPath('id') _id: string,\n @DBody() _data: IdentityProviderLinkConfirmPayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProviderAccount>> {\n const id = useRequestParamID(event);\n const provider = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(provider) && !isOpenIDIdentityProvider(provider)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports account linking.');\n }\n\n if (!provider.enabled) {\n throw new BadRequestError('The identity provider is not enabled.');\n }\n\n const identity = useRequestIdentityOrFail(event);\n if (identity.type !== IdentityType.USER) {\n throw new BadRequestError('Only a user can link an identity provider account.');\n }\n\n const body = await readRequestBody(event);\n const handle = isObject(body) ? body.handle : undefined;\n if (typeof handle !== 'string' \|\| handle.length === 0) {\n throw new BadRequestError('The account link handle is missing.');\n }\n\n const link = await this.linkStore.consume(handle);\n if (!link) {\n throw new BadRequestError('The account link request is unknown or expired.');\n }\n\n // The two checks that make the handle inert on its own: it may only\n // be redeemed by the user it was minted for, and only against the\n // provider it was minted for.\n if (link.userId !== identity.id \|\| link.providerId !== provider.id) {\n throw new BadRequestError('The account link request does not belong to the authenticated user.');\n }\n\n const account = await this.accountManager.link(\n {\n id: link.providerUserId,\n // deliberately rebuilt from the stashed scalars: the resolved\n // identity carries the provider secret and the raw external\n // token payload, neither of which belongs in a cache\n attributeCandidates: {\n name: [link.providerUserName],\n email: [link.providerUserEmail],\n },\n data: {},\n provider,\n },\n identity.id,\n );\n\n // the confirm runs under a bearer, so unlike the callback it CAN be\n // attributed to a session and a route (the unlink emit's shape)\n const requestContext = useRequestEventContext();\n\n await this.eventService?.record({\n scope: EventScope.IDENTITY,\n name: EventName.IDENTITY_PROVIDER_LINKED,\n refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,\n refId: account.id,\n realmId: account.userRealmId ?? provider.realmId ?? null,\n actorType: IdentityType.USER,\n actorId: account.userId,\n actorName: identity.data.name ?? null,\n sessionId: requestContext?.sessionId ?? null,\n requestPath: requestContext?.requestPath ?? null,\n requestMethod: requestContext?.requestMethod ?? null,\n requestIpAddress: requestContext?.requestIpAddress ?? getRequestIP(event) ?? null,\n requestUserAgent: requestContext?.requestUserAgent ?? getRequestHeader(event, 'user-agent') ?? null,\n data: { providerId: provider.id, providerName: provider.name },\n });\n\n return { data: account, meta: {} };\n }\n\n private pickIdentityCandidate(\n identity: IdentityProviderIdentity,\n key: 'name' \| 'email',\n ) : string \| null {\n const candidates = identity.attributeCandidates?.[key] \|\| [];\n for (const candidate of candidates) {\n if (typeof candidate === 'string' && candidate.length > 0) {\n return candidate;\n }\n }\n\n return null;\n }\n\n // ---------------------------------------------------------\n\n private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n const codeRequestKeys = Object.keys(codeRequest);\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n const codeRequestValue = codeRequest[codeRequestKey];\n // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n // treats as prompt=login) — only skip absent ones.\n if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n url.searchParams.set(codeRequestKey, String(codeRequestValue));\n }\n }\n\n return url;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private buildProviderAuthenticator(\n provider: OAuth2IdentityProvider \| OpenIDIdentityProvider,\n options: { clientId?: string } = {},\n ) {\n return createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider,\n logger: this.logger,\n options: {\n baseURL: this.options.baseURL,\n clientId: options.clientId,\n },\n });\n }\n\n private async saveAuthorizationState(\n event: IAppEvent,\n data: Pick<OAuth2AuthorizationState, 'codeRequest' \| 'link'> = {},\n ) : Promise<string> {\n return this.stateManager.save({\n ...data,\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyGA,IAAauD,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKZ,UAAUY,IAAIZ;EACnB,KAAKC,aAAaW,IAAIX;EACtB,KAAKC,kBAAkBU,IAAIV;EAC3B,KAAKC,iBAAiBS,IAAIT;EAC1B,KAAKC,YAAYQ,IAAIR;EACrB,KAAKI,aAAaI,IAAIJ;EACtB,KAAKH,sBAAsBO,IAAIP;EAC/B,KAAKC,uBAAuB,IAAIxB,wCAAAA;EAChC,KAAKyB,eAAeK,IAAIL;EACxB,KAAKE,wBAAwBG,IAAIH;EACjC,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,SAASC,IAAID;CACtB;CAIA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKf,WAAWgB,SACtB,MAAMhC,YAAYR,gBAAgBqC,KAAAA,GAAQ;GACtCI,QAAQ/B;GACRgC,OAAO7B,kBAAkBwB,KAAAA;EAC7B,CAAA,CAAA;EAGJ,IAAI;GACA,MAAMM,sBAAsBvB,8BAA8BiB,KAAAA;GAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMtD,eAAeuD,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAAST,MAChB,IAAI;IACA,MAAMK,oBAAoBK,SAAS;KAC/BH,MAAMtD,eAAeuD;KACrBR,MAAMtE,iBAAiB;OAAGD,kBAAkBkF,aAAaF;OAAQhF,kBAAkBmF,cAAcH,MAAMI,WAAW;KAAK,CAAA;IAC3H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHb;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQhC,oBAAoBC,sBAAAA;GAChC;EACJ;CACJ;CAEA,MACM0C,YACF,IACA,OAC+C;EAC/C,MAAME,UAAUnC,kBAAkBkB,OAAO,EAAEjE,QAAQ,MAAM,CAAA;EAEzD,MAAMmF,SAAS,MAAM,KAAK/B,WAAWgC,kBACjCF,SACAtC,kBAAkBqB,KAAAA,CAAAA;EAGtB,IAAI,CAACkB,QACD,MAAM,IAAI1D,oBAAAA;EAGd,IAAI;GAEA,MAD4BuB,8BAA8BiB,KACpDM,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMtD,eAAeuD;IACrBR,MAAMtE,iBAAiB;MAAGD,kBAAkBkF,aAAaM;MAASxF,kBAAkBmF,cAAcK,OAAOJ,WAAW;IAAK,CAAA;GAC7H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAO;GAAEb,MAAMiB;GAAQhB,MAAM,EAAEE,QAAQhC,oBAAoBC,wBAAwBJ,uBAAAA,EAAyB;EAAE;CAClH;CAEA,MACMmD,aACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKE,MAAMtB,OAAO,EAAEuB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKF,MAAMtB,KAAAA;CACtB;CAEA,MACMyB,aACF,IACA,OACgD;EAChD,MAAMR,UAAUnC,kBAAkBkB,KAAAA;EAElC,MAAMM,sBAAsBvB,8BAA8BiB,KAAAA;EAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMtD,eAAewE,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAK/B,WAAWwC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI1D,oBAAAA;EAGd,MAAM8C,oBAAoBK,SAAS;GAC/BH,MAAMtD,eAAewE;GACrBzB,MAAMtE,iBAAiB;KAAGD,kBAAkBkF,aAAaM;KAASxF,kBAAkBmF,cAAcK,OAAOJ,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAK/B,WAAW0C,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ5B,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAEA,MACM8B,YACF,MACA,OACgD;EAChD,OAAO,KAAKV,MAAMtB,KAAAA;CACtB;CAIA,MACMiC,aACF,KACA,OACF;EACE,MAAMjB,KAAKlC,kBAAkBkB,KAAAA;EAC7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5D,yBAAyB8D,MAAAA,KAAW,CAAC7D,yBAAyB6D,MAAAA,GAC/D,MAAM,IAAI5D,gBAAgB,oFAAA;EAG9B,MAAM8E,gBAAgB,KAAKC,2BAA2BnB,MAAAA;EAEtD,IAAIoB;EACJ,MAAMC,QAAQ5E,gBAAgBqC,KAAAA;EAC9B,IAAI,OAAOuC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAM7G,gBAAgB0G,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAMxE,mBAAmB6E,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKpD,qBAAqBqD,IAAIL,kBAAAA;GACjE,MAAMvC,OAAO,MAAM,KAAKV,oBAAoBuD,OAAOF,oBAAAA;GAEnD,IACI3C,KAAK8C,OAAOjC,WACZI,OAAOJ,WACPI,OAAOJ,YAAYb,KAAK8C,OAAOjC,SAE/B,MAAMhD,mBAAmB6E,UAAU,6CAAA;GAGvCL,cAAcrC,KAAKA;EACvB;EAEA,MAAM+C,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAO,EAAEsC,YAAY,CAAA;EAErE,OAAO3F,aAAaqD,OAAOoC,cAAcc,iBAAiB,EAAEF,MAAM,CAAA,CAAA;CACtE;CAEA,MACMG,YACF,KACA,OAC6C;EAC7C,MAAMnC,KAAKlC,kBAAkBkB,KAAAA;EAC7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5D,yBAAyB8D,MAAAA,KAAW,CAAC7D,yBAAyB6D,MAAAA,GAC/D,MAAM,IAAI5D,gBAAgB,iFAAA;EAG9B,IAAI,CAAC4D,OAAOkC,SACR,MAAM,IAAI9F,gBAAgB,uCAAA;EAG9B,MAAM+F,WAAWxE,yBAAyBmB,KAAAA;EAC1C,IAAIqD,SAASC,SAASrG,aAAasG,MAC/B,MAAM,IAAIjG,gBAAgB,oDAAA;EAG9B,IAAI4D,OAAOJ,WAAWI,OAAOJ,YAAYuC,SAASvC,SAC9C,MAAM,IAAIxD,gBAAgB,0DAAA;EAG9B,MAAM8E,gBAAgB,KAAKC,2BAA2BnB,MAAAA;EAEtD,MAAM8B,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAO,EAAEwD,MAAM;GAAEC,QAAQJ,SAASrC;GAAI0C,YAAYxC,OAAOF;EAAG,EAAE,CAAA;EAE9G,OAAO,EAAE2C,KAAKvB,cAAcc,iBAAiB,EAAEF,MAAM,CAAA,EAAG;CAC5D;CAEA,MACMY,YACF,KACA,OACF;EACE,MAAM5C,KAAKlC,kBAAkBkB,KAAAA;EAE7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5D,yBAAyB8D,MAAAA,KAAW,CAAC7D,yBAAyB6D,MAAAA,GAC/D,MAAM,IAAI2C,MAAM,yBAAyB3C,OAAO4C,SAAS,eAAe;EAG5E,MAAM7D,OAAO,MAAM,KAAK8D,yBAAyB/D,KAAAA;EAEjD,MAAM,EAAEwD,SAASvD;EACjB,IAAIuD,MACA,OAAO,KAAKQ,aAAahE,OAAOkB,QAAQjB,MAAMuD,IAAAA;EAGlD,IACItC,OAAOJ,WACPb,KAAKqC,eACLrC,KAAKqC,YAAY2B,YACjBhE,KAAKqC,YAAY2B,aAAa/C,OAAOJ,SAErC,MAAMhD,mBAAmB6E,UAAU,6CAAA;EAGvC,MAAM,EAAEuB,SAASvG,gBAAgBqC,KAAAA;EAEjC,IAAI,OAAOkE,SAAS,YAAYA,KAAKC,WAAW,GAC5C,MAAM,IAAI7G,gBAAgB,oCAAA;EAgB9B,MAAM8G,WAAWnE,KAAKqC,cAClB,MAAM,KAAK/C,oBAAoBuD,OAAO7C,KAAKqC,WAAW,IACtD+B,KAAAA;EAKJ,IAAI,CAACnD,OAAOkC,SACR,MAAM,IAAI9F,gBAAgB,uCAAA;EAK9B,MAAM+D,OAAO,MAFS,KAAKgB,2BAA2BnB,QAAQ,EAAEoD,UAAUF,UAAUnE,KAAKsE,UAAU,CAEhFnC,CAAAA,CAAcoC,aAAa,EAAEN,KAAK,CAAA;EAKrD,IAAI,CAAC7C,KAAKoD,QACN,MAAM,IAAIlH,oBAAoB,EAAE2D,QAAQ,OAAO,CAAA;EAGnD,MAAMwD,QAAQ,MAAM,KAAKtF,gBAAgB+C,QAAQjB,OAAOJ,SAAS,IAAA;EAQjE,IAAIsD,UAAUrB,OAAO4B,gBAAgB;GACjC,IAAIC,UAAU;GAEd,MAAMC,UAAUvG,qBAAqB;IACjCgF,MAAMrG,aAAasG;IACnBtD,MAAM;KACF,GAAGoB;KACHqD;IACJ;GACJ,CAAA;GACA,IAAI,KAAK/E,yBAAyBkF,SAC9BD,UAAU,MAAM,KAAKjF,sBAAsBgB,SACvCyD,SAASrB,OAAO4B,gBAChBE,OAAAA;GAIR,IAAI,CAACD,SAAS;IACV,MAAMjB,MAAM,KAAKmB,wBAAwBV,SAASnE,IAAI;IACtD0D,IAAIoB,aAAaC,IAAI,SAASnH,gBAAgBoH,aAAa;IAE3D,OAAOtI,aAAaqD,OAAO2D,IAAIuB,IAAI;GACvC;EACJ;EAQA,MAAMC,oBAAoB,MAAM,KAAKzF,WAAW0F,MAC5ChB,UAAUnE,QAAQ,EAAEoF,eAAe,OAAO,GAC1C;GACI/B,MAAMrG,aAAasG;GACnBtD,MAAM;IACF,GAAGoB;IACHqD;GACJ;EACJ,GACA,EAAEY,YAAYnI,kBAAkBoI,SAAS,CAAA;EAU7C,MAAM,KAAK3F,cAAc4F,OAAO;GAC5BC,OAAO3I,WAAW4I;GAClBlF,MAAM5D,UAAU+I;GAChBC,SAAS/I,aAAagJ;GACtBC,OAAO1B,UAAUnE,KAAKsE,aAAa;GACnCD,UAAUF,UAAUnE,KAAKsE,aAAa;GACtCwB,WAAW;GACXC,WAAW/I,aAAasG;GACxB0C,SAAS5E,KAAKL;GACdkF,WAAW7E,KAAKb;GAChBM,SAASsD,UAAUnE,KAAKgE,YAAYS,MAAM1D;GAC1CmF,kBAAkBzJ,aAAasD,KAAAA,KAAU;GACzCoG,kBAAkB3J,iBAAiBuD,OAAO,YAAA,KAAiB;GAC3DC,MAAM;IACFoG,QAAQ;IACR3C,YAAYxC,OAAOF;IACnBsF,cAAcpF,OAAOV;IACrB,GAAI4D,UAAUnE,KAAKwF,QAAQ,EAAEA,OAAOrB,SAASnE,KAAKwF,MAAM,IAAI,CAAC;GACjE;EACJ,CAAA;EAMA,IAAIrB,UAAUmC,uBAAuBnC,SAASnE,KAAKuG,cAAc;GAC7D,MAAM7C,MAAM,IAAI5F,IAAIqG,SAASnE,KAAKuG,YAAY;GAC9C7C,IAAIoB,aAAaC,IAAI,QAAQG,kBAAkBnE,EAAE;GACjD,IAAIoD,SAASnE,KAAK+C,OACdW,IAAIoB,aAAaC,IAAI,SAASZ,SAASnE,KAAK+C,KAAK;GAGrD,OAAOrG,aAAaqD,OAAO2D,IAAIuB,IAAI;EACvC;EAMA,MAAMvB,MAAM,IAAI5F,IAAI,KAAKmB,QAAQuH,OAAO;EACxC9C,IAAIoB,aAAaC,IAAI,QAAQG,kBAAkBnE,EAAE;EAEjD,OAAOrE,aAAaqD,OAAO2D,IAAIuB,IAAI;CACvC;CAIA,MAAc5D,MAAMtB,OAAkBd,UAElC,CAAC,GAAoD;EACrD,IAAIwH;EACJ,MAAM1F,KAAKtC,kBAAkBsB,OAAO,EAAEjE,QAAQ,MAAM,CAAA;EACpD,MAAM4K,OAAO,MAAM/I,gBAAgBoC,KAAAA;EACnCzB,wBAAwByB,OAAO2G,IAAAA;EAC/B,MAAM7F,UAAUnC,kBAAkBqB,KAAAA,KAAUvB,eAAekI,IAAAA;EAE3D,IAAIzF;EACJ,IAAIF,IAAI;GACJ,MAAM4F,QAA6B,CAAC;GACpC,IAAI7K,OAAOiF,EAAAA,GACP4F,MAAM5F,KAAKA;QAEX4F,MAAMpG,OAAOQ;GAGjB,IAAIF,SACA8F,MAAM9F,UAAUA;GAGpBI,SAAS,MAAM,KAAK/B,WAAWwC,UAAUiF,KAAAA;GAGzC,IAAI,CAAC1F,WAAWhC,QAAQqC,cAAcqF,MAAM5F,KACxC,MAAM,IAAIxD,oBAAAA;EAElB,OAAO,IAAI0B,QAAQqC,YACf,MAAM,IAAI/D,oBAAAA;EAGd,MAAM8C,sBAAsBvB,8BAA8BiB,KAAAA;EAC1D,IAAIkB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMtD,eAAe2J,yBAAyB,CAAA;GAEtFH,QAAQ9K,eAAekL;EAC3B,OAAO;GACH,MAAMxG,oBAAoBC,YAAY,EAAEC,MAAMtD,eAAe6J,yBAAyB,CAAA;GAEtFL,QAAQ9K,eAAeoL;EAC3B;EAGA,MAAM/G,OAAO,MAAMgH,IADGjK,0BACHiK,CAAAA,CAAUpE,IAAI8D,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMS,aAAa,MAAMD,IADOnK,oCACPmK,CAAAA,CAAoBrE,IAAI8D,IAAAA;EAEjD,MAAM,KAAKxH,WAAWiI,oBAAoBnH,IAAAA;EAE1C,IAAIiB,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMtD,eAAe2J;GACrB5G,MAAMtE,iBAAiB;KAClBD,kBAAkBkF,aAAa;KAC5B,GAAGM;KACH,GAAGjB;IACP;KACCvE,kBAAkBmF,cAAcZ,KAAKa,WAAWI,OAAOJ,WAAW;GACvE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACb,KAAKa,SAENb,KAAKa,UADYjC,yBAAyBmB,KAC3BqD,CAAAA,CAASvC;GAG5B,MAAMR,oBAAoBK,SAAS;IAC/BH,MAAMtD,eAAe6J;IACrB9G,MAAMtE,iBAAiB;MAAGD,kBAAkBkF,aAAaX;MAAOvE,kBAAkBmF,cAAcZ,KAAKa,WAAW;IAAK,CAAA;GACzH,CAAA;EACJ;EAEA,MAAM,KAAK3B,WAAWkI,gBAAgBpH,MAAMiB,UAAUmD,KAAAA,CAAAA;EAEtD,IAAInD,QAAQ;GACRA,SAAS,KAAK/B,WAAWmI,MAAMpG,QAAQjB,IAAAA;GACvC,MAAM,KAAKd,WAAWoI,WAAWrG,QAAQiG,UAAAA;GAEzCnH,MAAM8B,SAASC,SAAS;GAExB,OAAO;IAAE9B,MAAMiB;IAAQhB,MAAM,CAAC;GAAE;EACpC;EAEAgB,SAAS,KAAK/B,WAAWqI,OAAOvH,IAAAA;EAChC,MAAM,KAAKd,WAAWoI,WAAWrG,QAAQiG,UAAAA;EAEzCnH,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;;;;;;IAUA,MAAc8D,aACVhE,OACAyH,UACAzE,OACAQ,MACF;EAGE,MAAMG,MAAM,IAAI5F,IAAIL,WAAW,KAAKwB,QAAQuH,SAAS,4BAAA,CAAA;EAErD,MAAM,EAAEvC,SAASvG,gBAAgBqC,KAAAA;EAEjC,IAAI;GAKA,IAAIwD,KAAKE,eAAe+D,SAASzG,MAAM,CAACyG,SAASrE,SAC7C,MAAM,IAAI9F,gBAAgB,6DAAA;GAG9B,IAAI,OAAO4G,SAAS,YAAYA,KAAKC,WAAW,GAC5C,MAAM,IAAI7G,gBAAgB,oCAAA;GAK9B,MAAM+F,WAAW,MAFK,KAAKhB,2BAA2BoF,QAE/BrF,CAAAA,CAAcsF,gBAAgB,EAAExD,KAAK,CAAA;GAK5D,IAAI,CAACb,SAASrC,IACV,MAAM,IAAI1D,gBAAgB,4CAAA;GAkB9B,MAAMqK,SAAS,MAAM,KAAKrI,UAAUsI,KAAK;IACrClE,YAAY+D,SAASzG;IACrByC,QAAQD,KAAKC;IACboE,gBAAgBxE,SAASrC;IACzB8G,kBAAkB,KAAKC,sBAAsB1E,UAAU,MAAA;IACvD2E,mBAAmB,KAAKD,sBAAsB1E,UAAU,OAAA;GAC5D,CAAA;GAEAM,IAAIoB,aAAaC,IAAI,cAAc2C,MAAAA;GACnChE,IAAIoB,aAAaC,IAAI,YAAYyC,SAASzG,EAAE;EAChD,SAASiH,GAAG;GAIR,KAAKpI,QAAQqI,MAAMzK,cAAcwK,GAAG,4CAAA,CAAA;GAEpCtE,IAAIoB,aAAaC,IAAI,aAAa,aAAA;EACtC;EAEA,OAAOrI,aAAaqD,OAAO2D,IAAIuB,IAAI;CACvC;;;;IAMA,MACMiD,YACF,KACA,OACA,OACuD;EACvD,MAAMnH,KAAKlC,kBAAkBkB,KAAAA;EAC7B,MAAMyH,WAAW,MAAM,KAAKtF,QAAQnB,EAAAA;EAEpC,IAAI,CAAC5D,yBAAyBqK,QAAAA,KAAa,CAACpK,yBAAyBoK,QAAAA,GACjE,MAAM,IAAInK,gBAAgB,iFAAA;EAG9B,IAAI,CAACmK,SAASrE,SACV,MAAM,IAAI9F,gBAAgB,uCAAA;EAG9B,MAAM+F,WAAWxE,yBAAyBmB,KAAAA;EAC1C,IAAIqD,SAASC,SAASrG,aAAasG,MAC/B,MAAM,IAAIjG,gBAAgB,oDAAA;EAG9B,MAAMqJ,OAAO,MAAM/I,gBAAgBoC,KAAAA;EACnC,MAAM2H,SAAS7L,SAAS6K,IAAAA,IAAQA,KAAKgB,SAAStD,KAAAA;EAC9C,IAAI,OAAOsD,WAAW,YAAYA,OAAOxD,WAAW,GAChD,MAAM,IAAI7G,gBAAgB,qCAAA;EAG9B,MAAMkG,OAAO,MAAM,KAAKlE,UAAU+I,QAAQV,MAAAA;EAC1C,IAAI,CAACnE,MACD,MAAM,IAAIlG,gBAAgB,iDAAA;EAM9B,IAAIkG,KAAKC,WAAWJ,SAASrC,MAAMwC,KAAKE,eAAe+D,SAASzG,IAC5D,MAAM,IAAI1D,gBAAgB,qEAAA;EAG9B,MAAMgL,UAAU,MAAM,KAAKjJ,eAAemE,KACtC;GACIxC,IAAIwC,KAAKqE;GAITU,qBAAqB;IACjB/H,MAAM,CAACgD,KAAKsE,gBAAiB;IAC7BU,OAAO,CAAChF,KAAKwE,iBAAkB;GACnC;GACA/H,MAAM,CAAC;GACPwH;EACJ,GACApE,SAASrC,EAAE;EAKf,MAAMyH,iBAAiB7J,uBAAAA;EAEvB,MAAM,KAAKgB,cAAc4F,OAAO;GAC5BC,OAAO3I,WAAW4L;GAClBlI,MAAM5D,UAAU+L;GAChB/C,SAAS/I,aAAa+L;GACtB9C,OAAOwC,QAAQtH;GACfF,SAASwH,QAAQO,eAAepB,SAAS3G,WAAW;GACpDkF,WAAW/I,aAAasG;GACxB0C,SAASqC,QAAQ7E;GACjByC,WAAW7C,SAASpD,KAAKO,QAAQ;GACjCuF,WAAW0C,gBAAgB1C,aAAa;GACxC+C,aAAaL,gBAAgBK,eAAe;GAC5CC,eAAeN,gBAAgBM,iBAAiB;GAChD5C,kBAAkBsC,gBAAgBtC,oBAAoBzJ,aAAasD,KAAAA,KAAU;GAC7EoG,kBAAkBqC,gBAAgBrC,oBAAoB3J,iBAAiBuD,OAAO,YAAA,KAAiB;GAC/FC,MAAM;IAAEyD,YAAY+D,SAASzG;IAAIsF,cAAcmB,SAASjH;GAAK;EACjE,CAAA;EAEA,OAAO;GAAEP,MAAMqI;GAASpI,MAAM,CAAC;EAAE;CACrC;CAEQ6H,sBACJ1E,UACA2F,KACc;EACd,MAAMC,aAAa5F,SAASkF,sBAAsBS,QAAQ,CAAA;EAC1D,KAAK,MAAME,aAAaD,YACpB,IAAI,OAAOC,cAAc,YAAYA,UAAU/E,SAAS,GACpD,OAAO+E;EAIf,OAAO;CACX;CAIQpE,wBAAwBxC,aAAkD;EAC9E,MAAMqB,MAAM,IAAI5F,IAAIL,WAAW,KAAKwB,QAAQuH,SAAS,WAAA,CAAA;EAErD,MAAM0C,kBAAkBC,OAAOC,KAAK/G,WAAAA;EACpC,KAAK,MAAMgH,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmBlH,YAAYiH;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChE7F,IAAIoB,aAAaC,IAAIuE,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAO7F;CACX;CAIA,MAAcxB,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAK/B,WAAWuK,YAAY1I,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI1D,oBAAAA;EAGd,OAAO0D;CACX;CAIQmB,2BACJoF,UACAvI,UAAiC,CAAC,GACpC;EACE,OAAOhB,0CAA0C;GAC7CmB,gBAAgB,KAAKA;GACrBoI;GACA5H,QAAQ,KAAKA;GACbX,SAAS;IACLuH,SAAS,KAAKvH,QAAQuH;IACtBnC,UAAUpF,QAAQoF;GACtB;EACJ,CAAA;CACJ;CAEA,MAAcrB,uBACVjD,OACAC,OAA+D,CAAC,GAChD;EAChB,OAAO,KAAKR,aAAamI,KAAK;GAC1B,GAAG3H;GACH0J,IAAIjN,aAAasD,KAAAA,KAAU;GAC3B4J,WAAWnN,iBAAiBuD,OAAO,YAAA,KAAiBqE,KAAAA;EACxD,CAAA;CACJ;CAEA,MAAcN,yBAAyB/D,OAAqD;EACxF,MAAMuC,QAAQ5E,gBAAgBqC,KAAAA;EAC9B,IAAI,OAAOuC,MAAMS,UAAU,UACvB,MAAMlF,mBAAmB+L,aAAY;EAGzC,OAAO,KAAKpK,aAAaqD,OAAOP,MAAMS,OAAO;GACzC2G,IAAIjN,aAAasD,KAAAA,KAAU;GAC3B4J,WAAWnN,iBAAiBuD,OAAO,YAAA,KAAiBqE,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;CA7oBoBrF,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAgCNA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;CAsDiBA,MAAAA,qBAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;CAiYAA,MAAAA,qBAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;CA5lBnB,YAAA,CAAA,uBAAuB,qCAAA,CAAA"}

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
-import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IEventService, IIdentityProviderAccountLinkStore, IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IRealmRepository } from '../../../../../core/index.ts';
 export type IdentityProviderControllerOptions = {
     baseURL: string;
 };
@@ -6,11 +7,13 @@ export type IdentityProviderControllerContext = {
     options: IdentityProviderControllerOptions;
     repository: IIdentityProviderRepository;
     realmRepository: IRealmRepository;
-    clientRepository: IOAuth2ClientRepository;
     accountManager: IIdentityProviderAccountManager;
+    linkStore: IIdentityProviderAccountLinkStore;
     codeIssuer: IOAuth2AuthorizationCodeIssuer;
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     stateManager: IOAuth2AuthorizationStateManager;
     accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    eventService?: IEventService;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,~~uBAAuB,EACvB,~~gBAAgB,EACnB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IACxC,eAAe,EAAE,gBAAgB,CAAC;~~IAClC~~,~~gBAAgB,EAAE,uBAAuB,CAAC;IAE1C,~~cAAc,EAAE,+BAA+B,CAAC;IAChD,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;IAE/C,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;~~CACxD~~,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,aAAa,EACb,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EACnB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IACxC,eAAe,EAAE,gBAAgB,CAAC;IAElC,cAAc,EAAE,+BAA+B,CAAC;IAChD,SAAS,EAAE,iCAAiC,CAAC;IAC7C,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;IAE/C,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/entities/identity-provider-account/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider-account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/identity-provider-account/index.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderAccountController } from "./module.mjs";
+export { IdentityProviderAccountController };

package/dist/adapters/http/controllers/entities/identity-provider-account/module.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse, EntityRecordResponse } from '@authup/core-http-kit';
+import type { IIdentityProviderAccountService } from '../../../../../core/index.ts';
+export type IdentityProviderAccountControllerContext = {
+    service: IIdentityProviderAccountService;
+};
+export declare class IdentityProviderAccountController {
+    protected service: IIdentityProviderAccountService;
+    constructor(ctx: IdentityProviderAccountControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<IdentityProviderAccount>>;
+    getOne(id: string, event: IAppEvent): Promise<EntityRecordResponse<IdentityProviderAccount>>;
+    drop(id: string, event: IAppEvent): Promise<EntityRecordResponse<IdentityProviderAccount>>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/identity-provider-account/module.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider-account/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AASpF,MAAM,MAAM,wCAAwC,GAAG;IACnD,OAAO,EAAE,+BAA+B,CAAC;CAC5C,CAAC;AAEF,qBAEa,iCAAiC;IAC1C,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;gBAEvC,GAAG,EAAE,wCAAwC;IAKnD,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAiBvD,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;IASnD,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;CAQ5D"}

package/dist/adapters/http/controllers/entities/identity-provider-account/module.mjs ADDED Viewed

@@ -0,0 +1,94 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../core/query/describe.mjs";
+import { identityProviderAccountSchema } from "../../../../../core/entities/identity-provider-account/schema.mjs";
+import "../../../../../core/index.mjs";
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DDelete, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/identity-provider-account/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var IdentityProviderAccountController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });
+		return {
+			data,
+			meta: {
+				...meta,
+				schema: describeQuerySchema(identityProviderAccountSchema)
+			}
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return {
+			data: await this.service.getOne(id, actor, { realmId: getRequestRealmID(event) }),
+			meta: { schema: describeQuerySchema(identityProviderAccountSchema, RECORD_QUERY_PARAMETERS) }
+		};
+	}
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });
+		event.response.status = 202;
+		return {
+			data: entity,
+			meta: {}
+		};
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderAccountController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderAccountController.prototype, "getOne", null);
+_ts_decorate([
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderAccountController.prototype, "drop", null);
+IdentityProviderAccountController = _ts_decorate([
+	DTags("identity"),
+	DController(["/identity-provider-accounts", "/realms/:realmId/identity-provider-accounts"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IdentityProviderAccountControllerContext === "undefined" ? Object : IdentityProviderAccountControllerContext])
+], IdentityProviderAccountController);
+//#endregion
+export { IdentityProviderAccountController };
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/identity-provider-account/module.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","RECORD_QUERY_PARAMETERS","describeQuerySchema","identityProviderAccountSchema","ForceLoggedInMiddleware","buildActorContext","getRequestRealmID","IdentityProviderAccountController","service","ctx","getMany","event","actor","data","meta","realmId","schema","getOne","id","entity","drop","delete","response","status"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider-account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DTags,\n} from '@routup/decorators';\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n EntityCollectionResponse,\n EntityRecordResponse,\n} from '@authup/core-http-kit';\nimport type { IIdentityProviderAccountService } from '../../../../../core/index.ts';\nimport {\n RECORD_QUERY_PARAMETERS,\n describeQuerySchema,\n identityProviderAccountSchema,\n} from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, getRequestRealmID } from '../../../request/index.ts';\n\nexport type IdentityProviderAccountControllerContext = {\n service: IIdentityProviderAccountService,\n};\n\n@DTags('identity')\n@DController(['/identity-provider-accounts', '/realms/:realmId/identity-provider-accounts'])\nexport class IdentityProviderAccountController {\n protected service: IIdentityProviderAccountService;\n\n constructor(ctx: IdentityProviderAccountControllerContext) {\n this.service = ctx.service;\n }\n\n @DGet('', [ForceLoggedInMiddleware])\n async getMany(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProviderAccount>> {\n const actor = buildActorContext(event);\n const {\n data,\n meta,\n } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });\n\n return {\n data,\n meta: {\n ...meta,\n schema: describeQuerySchema(identityProviderAccountSchema),\n },\n };\n }\n\n @DGet('/:id', [ForceLoggedInMiddleware])\n async getOne(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<IdentityProviderAccount>> {\n const actor = buildActorContext(event);\n\n const entity = await this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });\n\n return { data: entity, meta: { schema: describeQuerySchema(identityProviderAccountSchema, RECORD_QUERY_PARAMETERS) } };\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async drop(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<IdentityProviderAccount>> {\n const actor = buildActorContext(event);\n\n const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });\n\n event.response.status = 202;\n return { data: entity, meta: {} };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAaa,oCAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+C;EACvD,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC0D;EAC1D,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQV,gBAAgBW,KAAAA,GAAQC,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAElG,OAAO;GACHE;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQd,oBAAoBC,6BAAAA;GAChC;EACJ;CACJ;CAEA,MACMc,OACF,IACA,OACsD;EACtD,MAAML,QAAQP,kBAAkBM,KAAAA;EAIhC,OAAO;GAAEE,MAAMM,MAFM,KAAKX,QAAQS,OAAOC,IAAIN,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;GAEjEG,MAAM,EAAEE,QAAQd,oBAAoBC,+BAA+BF,uBAAAA,EAAyB;EAAE;CACzH;CAEA,MACMmB,KACF,IACA,OACsD;EACtD,MAAMR,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAMQ,SAAS,MAAM,KAAKX,QAAQa,OAAOH,IAAIN,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAExFA,MAAMW,SAASC,SAAS;EACxB,OAAO;GAAEV,MAAMM;GAAQL,MAAM,CAAC;EAAE;CACpC;AACJ;;CA3CeV,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAmBIA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAYGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;CAvCR,YAAA,CAAA,+BAA+B,6CAAA,CAAA"}

package/dist/adapters/http/controllers/entities/index.d.ts CHANGED Viewed

@@ -5,6 +5,7 @@ export * from './client-scope/index.ts';
 export * from './consent/index.ts';
 export * from './event/index.ts';
 export * from './identity-provider/index.ts';
+export * from './identity-provider-account/index.ts';
 export * from './identity-provide-role/index.ts';
 export * from './key/index.ts';
 export * from './permission/index.ts';
@@ -16,6 +17,7 @@ export * from './role-permission/index.ts';
 export * from './policy/index.ts';
 export * from './scope/index.ts';
 export * from './session/index.ts';
+export * from './session-token/index.ts';
 export * from './trust-anchor/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';

package/dist/adapters/http/controllers/entities/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,kCAAkC,CAAC;AACjD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}

package/dist/adapters/http/controllers/entities/index.mjs CHANGED Viewed

@@ -18,6 +18,8 @@ import { EventController } from "./event/module.mjs";
 import "./event/index.mjs";
 import { IdentityProviderController } from "./identity-provider/module.mjs";
 import "./identity-provider/index.mjs";
+import { IdentityProviderAccountController } from "./identity-provider-account/module.mjs";
+import "./identity-provider-account/index.mjs";
 import { IdentityProviderRoleMappingController } from "./identity-provide-role/module.mjs";
 import "./identity-provide-role/index.mjs";
 import { KeyController } from "./key/module.mjs";
@@ -44,6 +46,8 @@ import { ScopeController } from "./scope/module.mjs";
 import "./scope/index.mjs";
 import { SessionController } from "./session/module.mjs";
 import "./session/index.mjs";
+import { SessionTokenController } from "./session-token/module.mjs";
+import "./session-token/index.mjs";
 import { TrustAnchorController } from "./trust-anchor/module.mjs";
 import "./trust-anchor/index.mjs";
 import { UserController } from "./user/module.mjs";
@@ -59,4 +63,4 @@ import "./user-permission/index.mjs";
 import { UserRoleController } from "./user-role/module.mjs";
 import { UserRoleRequestValidator } from "./user-role/utils/validation.mjs";
 import "./user-role/index.mjs";
-export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };
+export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };

package/dist/adapters/http/controllers/entities/session-token/index.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export * from './module.ts';
2	+ //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/session-token/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/session-token/index.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionTokenController } from "./module.mjs";
+export { SessionTokenController };

package/dist/adapters/http/controllers/entities/session-token/module.d.ts ADDED Viewed

@@ -0,0 +1,23 @@
+import type { SessionToken } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse, EntityRecordResponse } from '@authup/core-http-kit';
+import type { ISessionTokenService, SessionTokenDeleteManyResult } from '../../../../../core/index.ts';
+export type SessionTokenControllerContext = {
+    service: ISessionTokenService;
+};
+export declare class SessionTokenController {
+    protected service: ISessionTokenService;
+    constructor(ctx: SessionTokenControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<SessionToken>>;
+    getOne(id: string, event: IAppEvent): Promise<EntityRecordResponse<SessionToken>>;
+    /**
+     * Revoke every token matching the query. Requires a target filter, so it
+     * cannot degenerate into an unscoped mass revoke.
+     *
+     * Scoped to one client this is "sign out of this application": the session
+     * itself survives, so the other applications riding it stay signed in.
+     */
+    dropMany(event: IAppEvent): Promise<SessionTokenDeleteManyResult>;
+    drop(id: string, event: IAppEvent): Promise<EntityRecordResponse<SessionToken>>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/session-token/module.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/session-token/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,KAAK,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AASvG,MAAM,MAAM,6BAA6B,GAAG;IACxC,OAAO,EAAE,oBAAoB,CAAC;CACjC,CAAC;AAEF,qBAEa,sBAAsB;IAC/B,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE5B,GAAG,EAAE,6BAA6B;IAKxC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAc5C,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAU9C;;;;;;OAMG;IAEG,QAAQ,CACE,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,4BAA4B,CAAC;IASlC,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;CAOjD"}

package/dist/adapters/http/controllers/entities/session-token/module.mjs ADDED Viewed

@@ -0,0 +1,112 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../core/query/describe.mjs";
+import { sessionTokenSchema } from "../../../../../core/entities/session-token/schema.mjs";
+import "../../../../../core/index.mjs";
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DDelete, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/session-token/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var SessionTokenController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor);
+		return {
+			data,
+			meta: {
+				...meta,
+				schema: describeQuerySchema(sessionTokenSchema)
+			}
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return {
+			data: await this.service.getOne(id, actor),
+			meta: { schema: describeQuerySchema(sessionTokenSchema, RECORD_QUERY_PARAMETERS) }
+		};
+	}
+	/**
+	* Revoke every token matching the query. Requires a target filter, so it
+	* cannot degenerate into an unscoped mass revoke.
+	*
+	* Scoped to one client this is "sign out of this application": the session
+	* itself survives, so the other applications riding it stay signed in.
+	*/ async dropMany(event) {
+		const actor = buildActorContext(event);
+		const result = await this.service.deleteMany(useRequestQuery(event), actor);
+		event.response.status = 202;
+		return result;
+	}
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const entity = await this.service.delete(id, actor);
+		event.response.status = 202;
+		return {
+			data: entity,
+			meta: {}
+		};
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionTokenController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionTokenController.prototype, "getOne", null);
+_ts_decorate([
+	DDelete("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionTokenController.prototype, "dropMany", null);
+_ts_decorate([
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionTokenController.prototype, "drop", null);
+SessionTokenController = _ts_decorate([
+	DTags("session-token"),
+	DController(["/session-tokens"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof SessionTokenControllerContext === "undefined" ? Object : SessionTokenControllerContext])
+], SessionTokenController);
+//#endregion
+export { SessionTokenController };
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/session-token/module.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","RECORD_QUERY_PARAMETERS","describeQuerySchema","sessionTokenSchema","ForceLoggedInMiddleware","buildActorContext","SessionTokenController","service","ctx","getMany","event","actor","data","meta","schema","getOne","id","entity","dropMany","result","deleteMany","response","status","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/session-token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DTags,\n} from '@routup/decorators';\nimport type { SessionToken } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse, EntityRecordResponse } from '@authup/core-http-kit';\nimport type { ISessionTokenService, SessionTokenDeleteManyResult } from '../../../../../core/index.ts';\nimport {\n RECORD_QUERY_PARAMETERS,\n describeQuerySchema,\n sessionTokenSchema,\n} from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\n\nexport type SessionTokenControllerContext = {\n service: ISessionTokenService,\n};\n\n@DTags('session-token')\n@DController(['/session-tokens'])\nexport class SessionTokenController {\n protected service: ISessionTokenService;\n\n constructor(ctx: SessionTokenControllerContext) {\n this.service = ctx.service;\n }\n\n @DGet('', [ForceLoggedInMiddleware])\n async getMany(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<SessionToken>> {\n const actor = buildActorContext(event);\n const { data, meta } = await this.service.getMany(useRequestQuery(event), actor);\n\n return {\n data,\n meta: {\n ...meta,\n schema: describeQuerySchema(sessionTokenSchema),\n },\n };\n }\n\n @DGet('/:id', [ForceLoggedInMiddleware])\n async getOne(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<SessionToken>> {\n const actor = buildActorContext(event);\n const entity = await this.service.getOne(id, actor);\n\n return {\n data: entity,\n meta: { schema: describeQuerySchema(sessionTokenSchema, RECORD_QUERY_PARAMETERS) },\n };\n }\n\n /**\n * Revoke every token matching the query. Requires a target filter, so it\n * cannot degenerate into an unscoped mass revoke.\n *\n * Scoped to one client this is \"sign out of this application\": the session\n * itself survives, so the other applications riding it stay signed in.\n */\n @DDelete('', [ForceLoggedInMiddleware])\n async dropMany(\n @DContext() event: IAppEvent,\n ): Promise<SessionTokenDeleteManyResult> {\n const actor = buildActorContext(event);\n const result = await this.service.deleteMany(useRequestQuery(event), actor);\n\n event.response.status = 202;\n return result;\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async drop(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<SessionToken>> {\n const actor = buildActorContext(event);\n const entity = await this.service.delete(id, actor);\n\n event.response.status = 202;\n return { data: entity, meta: {} };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,IAAaY,yBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAoC;EAC5C,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC+C;EAC/C,MAAME,QAAQN,kBAAkBK,KAAAA;EAChC,MAAM,EAAEE,MAAMC,SAAS,MAAM,KAAKN,QAAQE,QAAQT,gBAAgBU,KAAAA,GAAQC,KAAAA;EAE1E,OAAO;GACHC;GACAC,MAAM;IACF,GAAGA;IACHC,QAAQZ,oBAAoBC,kBAAAA;GAChC;EACJ;CACJ;CAEA,MACMY,OACF,IACA,OAC2C;EAC3C,MAAMJ,QAAQN,kBAAkBK,KAAAA;EAGhC,OAAO;GACHE,MAAMK,MAHW,KAAKV,QAAQQ,OAAOC,IAAIL,KAAAA;GAIzCE,MAAM,EAAEC,QAAQZ,oBAAoBC,oBAAoBF,uBAAAA,EAAyB;EACrF;CACJ;;;;;;;IASA,MACMiB,SACF,OACqC;EACrC,MAAMP,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMS,SAAS,MAAM,KAAKZ,QAAQa,WAAWpB,gBAAgBU,KAAAA,GAAQC,KAAAA;EAErED,MAAMW,SAASC,SAAS;EACxB,OAAOH;CACX;CAEA,MACMI,KACF,IACA,OAC2C;EAC3C,MAAMZ,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMO,SAAS,MAAM,KAAKV,QAAQiB,OAAOR,IAAIL,KAAAA;EAE7CD,MAAMW,SAASC,SAAS;EACxB,OAAO;GAAEV,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;AACJ;;CA3DeT,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAgBIA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAqBDA,QAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAWIA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;CAxDR,YAAA,CAAA,iBAAA,CAAA"}