@authup/server-core 1.0.0-beta.60 → 1.0.0-beta.61

package/dist/index.mjs

@@ -210,6 +210,8 @@ import { IdentityInjectionKey } from "./app/modules/identity/constants.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./app/modules/identity/repositories/provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./app/modules/identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./app/modules/identity/repositories/provider/mapper/role.mjs";
+import { CacheIdentityPrefix } from "./app/modules/identity/repositories/constants.mjs";
+import { IdentityProviderAccountLinkStore } from "./app/modules/identity/repositories/provider/link.mjs";
 import { ClientIdentityRepository } from "./app/modules/identity/repositories/client.mjs";
 import { UserIdentityRepository } from "./app/modules/identity/repositories/user.mjs";
 import { LDAPInjectionKey } from "./app/modules/ldap/constants.mjs";
@@ -234,4 +236,4 @@ import { defineCLIMigrationCommand } from "./cli/commands/migration.mjs";
 import { defineCLIStartCommand } from "./cli/commands/start.mjs";
 import "./cli/commands/index.mjs";
 import "reflect-metadata";
-export { AccountController, ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountController, IdentityProviderAccountEntity, IdentityProviderAccountRepositoryAdapter, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenController, SessionTokenEntity, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserInfoController, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeRowLockable, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isForeignKeyConstraintDatabaseError, isUniqueConstraintDatabaseError, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };
+export { AccountController, ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheIdentityPrefix, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountController, IdentityProviderAccountEntity, IdentityProviderAccountLinkStore, IdentityProviderAccountRepositoryAdapter, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenController, SessionTokenEntity, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserInfoController, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeRowLockable, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isForeignKeyConstraintDatabaseError, isUniqueConstraintDatabaseError, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };

package/dist/swagger.json

@@ -3696,6 +3696,34 @@
                 ],
                 "type": "object"
             },
+            "EntityRecordResponseIdentityProviderAccount": {
+                "properties": {
+                    "meta": {
+                        "$ref": "#/components/schemas/EntityRecordMeta"
+                    },
+                    "data": {
+                        "$ref": "#/components/schemas/IdentityProviderAccount"
+                    }
+                },
+                "required": [
+                    "meta",
+                    "data"
+                ],
+                "type": "object",
+                "description": "The wire shape of every entity-record response: the record under\n`data`, response-scoped extras under `meta` (mirroring\n`EntityCollectionResponse`)."
+            },
+            "IdentityProviderLinkConfirmPayload": {
+                "properties": {
+                    "handle": {
+                        "type": "string"
+                    }
+                },
+                "required": [
+                    "handle"
+                ],
+                "type": "object",
+                "description": "Body of `POST /identity-providers/:id/link-confirm` (issue #3439): the\none-time handle the callback returned on the account console URL. The\naccount row is written for the AUTHENTICATED caller, so the handle names\na pending link rather than authorizing one on its own."
+            },
             "EntityCollectionResponseIdentityProviderAccount": {
                 "properties": {
                     "meta": {
@@ -3734,22 +3762,6 @@
                 ],
                 "type": "object"
             },
-            "EntityRecordResponseIdentityProviderAccount": {
-                "properties": {
-                    "meta": {
-                        "$ref": "#/components/schemas/EntityRecordMeta"
-                    },
-                    "data": {
-                        "$ref": "#/components/schemas/IdentityProviderAccount"
-                    }
-                },
-                "required": [
-                    "meta",
-                    "data"
-                ],
-                "type": "object",
-                "description": "The wire shape of every entity-record response: the record under\n`data`, response-scoped extras under `meta` (mirroring\n`EntityCollectionResponse`)."
-            },
             "IdentityProviderRoleMapping": {
                 "properties": {
                     "name": {
@@ -9712,6 +9724,94 @@
                 ]
             }
         },
+        "/identity-providers/{id}/link-confirm": {
+            "post": {
+                "operationId": "ConfirmLink",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/EntityRecordResponseIdentityProviderAccount"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "The bearer-authenticated half of the link (issue #3439): the account\nrow is written here, for the AUTHENTICATED user, never in the callback.",
+                "tags": [],
+                "parameters": [
+                    {
+                        "allowEmptyValue": false,
+                        "deprecated": false,
+                        "description": "",
+                        "in": "path",
+                        "name": "id",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "examples": {}
+                    }
+                ],
+                "requestBody": {
+                    "description": "",
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "$ref": "#/components/schemas/IdentityProviderLinkConfirmPayload"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/realms/{realmId}/identity-providers/{id}/link-confirm": {
+            "post": {
+                "operationId": "ConfirmLink_2",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/EntityRecordResponseIdentityProviderAccount"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "The bearer-authenticated half of the link (issue #3439): the account\nrow is written here, for the AUTHENTICATED user, never in the callback.",
+                "tags": [],
+                "parameters": [
+                    {
+                        "allowEmptyValue": false,
+                        "deprecated": false,
+                        "description": "",
+                        "in": "path",
+                        "name": "id",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "examples": {}
+                    }
+                ],
+                "requestBody": {
+                    "description": "",
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "$ref": "#/components/schemas/IdentityProviderLinkConfirmPayload"
+                            }
+                        }
+                    }
+                }
+            }
+        },
         "/identity-provider-accounts": {
             "get": {
                 "operationId": "GetMany_10",

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/server-core",
     "type": "module",
-    "version": "1.0.0-beta.60",
+    "version": "1.0.0-beta.61",
     "description": "This is a standalone application.",
     "license": "AGPL-3.0-only",
     "main": "dist/index.mjs",
@@ -67,16 +67,16 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/access": "^1.0.0-beta.60",
-        "@authup/client-account-console": "^1.0.0-beta.60",
-        "@authup/client-auth-console": "^1.0.0-beta.60",
-        "@authup/core-http-kit": "^1.0.0-beta.60",
-        "@authup/core-kit": "^1.0.0-beta.60",
-        "@authup/errors": "^1.0.0-beta.60",
-        "@authup/i18n": "^1.0.0-beta.60",
-        "@authup/kit": "^1.0.0-beta.60",
-        "@authup/server-kit": "^1.0.0-beta.60",
-        "@authup/specs": "^1.0.0-beta.60",
+        "@authup/access": "^1.0.0-beta.61",
+        "@authup/client-account-console": "^1.0.0-beta.61",
+        "@authup/client-auth-console": "^1.0.0-beta.61",
+        "@authup/core-http-kit": "^1.0.0-beta.61",
+        "@authup/core-kit": "^1.0.0-beta.61",
+        "@authup/errors": "^1.0.0-beta.61",
+        "@authup/i18n": "^1.0.0-beta.61",
+        "@authup/kit": "^1.0.0-beta.61",
+        "@authup/server-kit": "^1.0.0-beta.61",
+        "@authup/specs": "^1.0.0-beta.61",
         "@ebec/http": "^4.2.0",
         "@hapic/oauth2": "^4.0.1",
         "@peculiar/x509": "^2.0.0",
@@ -126,7 +126,7 @@
         "zod": "^4.4.3"
     },
     "devDependencies": {
-        "@authup/server-test-kit": "^1.0.0-beta.60",
+        "@authup/server-test-kit": "^1.0.0-beta.61",
         "@faker-js/faker": "^10.5.0",
         "@trapi/cli": "^2.0.4",
         "@types/ldapjs": "^3.0.6",