@authup/server-core 1.0.0-beta.61 → 1.0.0-beta.63

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts

@@ -1,21 +1,20 @@
 import type { IAppEvent } from 'routup';
 import type { IdentityProvider, IdentityProviderAccount } from '@authup/core-kit';
 import type { Logger } from '@authup/server-kit';
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { EntityCollectionResponse, EntityRecordResponse, IdentityProviderCreatePayload, IdentityProviderLinkConfirmPayload, IdentityProviderLinkRequestResponse, IdentityProviderSavePayload, IdentityProviderUpdatePayload } from '@authup/core-http-kit';
-import type { IEventService, IIdentityProviderAccountLinkStore, IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IRealmRepository } from '../../../../../core/index.ts';
+import type { IEventService, IIdentityProviderAccountLinkStore, IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2FederatedLoginService } from '../../../../../core/index.ts';
 import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';
 export declare class IdentityProviderController {
     protected options: IdentityProviderControllerOptions;
     protected repository: IIdentityProviderRepository;
-    protected realmRepository: IRealmRepository;
     protected accountManager: IIdentityProviderAccountManager;
     protected linkStore: IIdentityProviderAccountLinkStore;
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     protected codeRequestValidator: OAuth2AuthorizationCodeRequestValidator;
     protected stateManager: IOAuth2AuthorizationStateManager;
-    protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
-    protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    protected loginService: IOAuth2FederatedLoginService;
     protected eventService?: IEventService;
     protected logger?: Logger;
     constructor(ctx: IdentityProviderControllerContext);
@@ -28,6 +27,7 @@ export declare class IdentityProviderController {
     authorizeOut(_id: string, event: IAppEvent): Promise<Response>;
     linkRequest(_id: string, event: IAppEvent): Promise<IdentityProviderLinkRequestResponse>;
     authorizeIn(_id: string, event: IAppEvent): Promise<Response>;
+    completeLogin(_id: string, event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
     private write;
     /**
      * Callback half of the account-linking round-trip (plan 091): the
@@ -45,6 +45,26 @@ export declare class IdentityProviderController {
     private buildHostedAuthorizeURL;
     private resolve;
     private buildProviderAuthenticator;
+    /**
+     * Scoped to the routes that read it, so the cookie never rides an
+     * ordinary API request, and to publicUrl's base path, since a sub-path
+     * deployment mounts every route under it.
+     */
+    private buildFederatedLoginCookiePath;
+    private setFederatedLoginCookie;
+    /**
+     * The completion answers with a token pair and authenticates on a cookie
+     * alone, so it must be reachable only from the hosted page's own origin.
+     *
+     * CORS cannot carry that here: the default reflects every origin WITH
+     * credentials, and `SameSite` is scoped to the registrable domain rather
+     * than the origin, so a sibling subdomain's script is same-site and would
+     * both send the cookie and be allowed to read the response. A browser
+     * sends `Origin` on every POST, so requiring it to be publicUrl's own is
+     * what closes that. A request without the header is not a browser and
+     * carries no cookie of ours to begin with.
+     */
+    private assertSameOrigin;
     private saveAuthorizationState;
     private verifyAuthorizationState;
 }

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EACR,gBAAgB,EAChB,uBAAuB,EAI1B,MAAM,kBAAkB,CAAC;AAc1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAKjD,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,aAAa,EACb,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EAInB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAO1C,MAAM,8BAA8B,CAAC;AAatC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,SAAS,EAAE,iCAAiC,CAAC;IAEvD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAIf,GAAG,EAAE,iCAAiC;IAkB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAuChD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IA0C1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,mCAAmC,CAAC;IA6B1C,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YA4KlB,KAAK;IA+FnB;;;;;OAKG;YACW,YAAY;IAyE1B;;;OAGG;IAEG,WAAW,CACA,GAAG,EAAE,MAAM,EACf,KAAK,EAAE,kCAAkC,EACtC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;IA2E1D,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;IAYrB,OAAO,CAAC,0BAA0B;YAepB,sBAAsB;YAWtB,wBAAwB;CAWzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EACR,gBAAgB,EAChB,uBAAuB,EAI1B,MAAM,kBAAkB,CAAC;AAa1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAKjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EACR,aAAa,EACb,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,uCAAuC,EACvC,gCAAgC,EAChC,4BAA4B,EAI/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGH,uCAAuC,EAM1C,MAAM,8BAA8B,CAAC;AAatC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,SAAS,EAAE,iCAAiC,CAAC;IAEvD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,YAAY,EAAG,4BAA4B,CAAC;IAEtD,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAIf,GAAG,EAAE,iCAAiC;IAqB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAqBhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAyB5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgE1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,mCAAmC,CAAC;IA6B1C,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAwG1B,aAAa,CACF,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,wBAAwB,CAAC;YA8BvB,KAAK;IA2GnB;;;;;OAKG;YACW,YAAY;IAyE1B;;;OAGG;IAEG,WAAW,CACA,GAAG,EAAE,MAAM,EACf,KAAK,EAAE,kCAAkC,EACtC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;IA2E1D,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;IAYrB,OAAO,CAAC,0BAA0B;IAelC;;;;OAIG;IACH,OAAO,CAAC,6BAA6B;IAIrC,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,gBAAgB;YAWV,sBAAsB;YAWtB,wBAAwB;CAWzC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs

@@ -5,7 +5,10 @@ import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../cor
 import { identityProviderSchema } from "../../../../../core/entities/identity-provider/schema.mjs";
 import { decodeQuery } from "../../../../../core/query/module.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "../../../../../core/oauth2/authorization/code-request/validator.mjs";
-import { toIdentityPolicyData } from "../../../../../core/identity/permission/identity-policy-data.mjs";
+import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "../../../../../core/oauth2/federated-login/constants.mjs";
+import { describeError } from "../../../../../utils/error.mjs";
+import { resolveURL } from "../../../../../utils/url.mjs";
+import "../../../../../utils/index.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "../../../../../core/identity/provider/authentication/factory.mjs";
 import "../../../../../core/index.mjs";
 import { useRequestPermissionEvaluator } from "../../../request/permission/helper.mjs";
@@ -17,19 +20,18 @@ import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/hel
 import { useRequestEventContext } from "../../../request/event-context.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
-import { describeError } from "../../../../../utils/error.mjs";
-import { resolveURL } from "../../../../../utils/url.mjs";
-import "../../../../../utils/index.mjs";
 import "../../../middleware/index.mjs";
-import { ValidatorGroup, base64URLDecode, isObject, isUUID } from "@authup/kit";
-import { EventName, EventRefType, EventScope, IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, SessionAuthMethod, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
+import { ValidatorGroup, base64URLDecode, createNanoID, getURLBasePath, isObject, isUUID } from "@authup/kit";
+import { EventName, EventRefType, EventScope, IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityInactiveError, EntityNotFoundError } from "@authup/errors";
-import { OAuth2ErrorCode, OAuth2RequestError } from "@authup/specs";
+import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { OAuth2RequestError } from "@authup/specs";
 import { URL } from "node:url";
 import { getRequestHeader, getRequestIP, sendRedirect } from "routup";
+import { setResponseCookie, unsetResponseCookie, useRequestCookie } from "@routup/basic/cookie";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
+import { IDENTITY_PROVIDER_LOGIN_NOT_PENDING } from "@authup/core-http-kit";
 import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/identity-provider/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -49,27 +51,23 @@ function _ts_param(paramIndex, decorator) {
 var IdentityProviderController = class {
 	options;
 	repository;
-	realmRepository;
 	accountManager;
 	linkStore;
 	codeRequestVerifier;
 	codeRequestValidator;
 	stateManager;
-	codeIssuer;
-	accessPolicyEvaluator;
+	loginService;
 	eventService;
 	logger;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
-		this.realmRepository = ctx.realmRepository;
 		this.accountManager = ctx.accountManager;
 		this.linkStore = ctx.linkStore;
-		this.codeIssuer = ctx.codeIssuer;
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
 		this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();
 		this.stateManager = ctx.stateManager;
-		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
+		this.loginService = ctx.loginService;
 		this.eventService = ctx.eventService;
 		this.logger = ctx.logger;
 	}
@@ -78,19 +76,6 @@ var IdentityProviderController = class {
 			schema: identityProviderSchema,
 			actor: buildActorContext(event)
 		}));
-		try {
-			const permissionEvaluator = useRequestPermissionEvaluator(event);
-			await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });
-			for (const datum of data) try {
-				await permissionEvaluator.evaluate({
-					name: PermissionName.IDENTITY_PROVIDER_READ,
-					data: definePolicyData({
-						[BuiltInPolicyType.ATTRIBUTES]: datum,
-						[BuiltInPolicyType.REALM_MATCH]: datum.realmId ?? null
-					})
-				});
-			} catch {}
-		} catch {}
 		return {
 			data,
 			meta: {
@@ -103,15 +88,17 @@ var IdentityProviderController = class {
 		const paramId = useRequestParamID(event, { isUUID: false });
 		const entity = await this.repository.findOneByIdOrName(paramId, getRequestRealmID(event));
 		if (!entity) throw new EntityNotFoundError();
-		try {
-			await useRequestPermissionEvaluator(event).evaluate({
-				name: PermissionName.IDENTITY_PROVIDER_READ,
-				data: definePolicyData({
-					[BuiltInPolicyType.ATTRIBUTES]: entity,
-					[BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null
-				})
-			});
-		} catch {}
+		await useRequestPermissionEvaluator(event).evaluateOneOf({
+			name: [
+				PermissionName.IDENTITY_PROVIDER_READ,
+				PermissionName.IDENTITY_PROVIDER_UPDATE,
+				PermissionName.IDENTITY_PROVIDER_DELETE
+			],
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				[BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null
+			})
+		});
 		return {
 			data: entity,
 			meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) }
@@ -152,22 +139,25 @@ var IdentityProviderController = class {
 		const id = useRequestParamID(event);
 		const entity = await this.resolve(id);
 		if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) throw new BadRequestError("Only an identity-provider based on the oauth protocol supports authorize redirect.");
-		const authenticator = this.buildProviderAuthenticator(entity);
-		let codeRequest;
+		if (!entity.enabled) throw new BadRequestError("The identity provider is not enabled.");
 		const query = useRequestQuery(event);
-		if (typeof query.codeRequest === "string") {
-			let codeRequestDecoded;
-			try {
-				codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));
-			} catch {
-				throw OAuth2RequestError.malformed("The code request is malformed and can not be parsed.");
-			}
-			const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);
-			const data = await this.codeRequestVerifier.verify(codeRequestValidated);
-			if (data.client.realmId && entity.realmId && entity.realmId !== data.client.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
-			codeRequest = data.data;
+		if (typeof query.codeRequest !== "string") throw OAuth2RequestError.malformed("A federated login requires an authorization code request.");
+		let codeRequestDecoded;
+		try {
+			codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));
+		} catch {
+			throw OAuth2RequestError.malformed("The code request is malformed and can not be parsed.");
 		}
-		const state = await this.saveAuthorizationState(event, { codeRequest });
+		const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);
+		const data = await this.codeRequestVerifier.verify(codeRequestValidated);
+		if (data.client.realmId && entity.realmId && entity.realmId !== data.client.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
+		const authenticator = this.buildProviderAuthenticator(entity);
+		const browserNonce = createNanoID();
+		this.setFederatedLoginCookie(event, browserNonce);
+		const state = await this.saveAuthorizationState(event, {
+			codeRequest: data.data,
+			browserNonce
+		});
 		return sendRedirect(event, authenticator.buildRedirectURL({ state }));
 	}
 	async linkRequest(_id, event) {
@@ -192,67 +182,47 @@ var IdentityProviderController = class {
 		const data = await this.verifyAuthorizationState(event);
 		const { link } = data;
 		if (link) return this.completeLink(event, entity, data, link);
-		if (entity.realmId && data.codeRequest && data.codeRequest.realm_id && data.codeRequest.realm_id !== entity.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
-		const { code } = useRequestQuery(event);
-		if (typeof code !== "string" || code.length === 0) throw new BadRequestError("The authorization code is missing.");
-		const verified = data.codeRequest ? await this.codeRequestVerifier.verify(data.codeRequest) : void 0;
-		if (!entity.enabled) throw new BadRequestError("The identity provider is not enabled.");
-		const user = await this.buildProviderAuthenticator(entity, { clientId: verified?.data.client_id }).authenticate({ code });
-		if (!user.active) throw new EntityInactiveError({ entity: "user" });
-		const realm = await this.realmRepository.resolve(entity.realmId, true);
-		if (verified?.client.accessPolicyId) {
-			let allowed = false;
-			const subject = toIdentityPolicyData({
-				type: IdentityType.USER,
-				data: {
-					...user,
-					realm
-				}
-			});
-			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(verified.client.accessPolicyId, subject);
-			if (!allowed) {
-				const url = this.buildHostedAuthorizeURL(verified.data);
-				url.searchParams.set("error", OAuth2ErrorCode.ACCESS_DENIED);
-				return sendRedirect(event, url.href);
-			}
+		if (!data.codeRequest) throw OAuth2RequestError.malformed("The state carries no authorization code request.");
+		const browserNonce = useRequestCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE);
+		if (!data.browserNonce || typeof browserNonce !== "string" || browserNonce !== data.browserNonce) return sendRedirect(event, this.buildHostedAuthorizeURL(data.codeRequest).href);
+		const { code, error } = useRequestQuery(event);
+		if (typeof error === "string" && error.length > 0) {
+			this.logger?.info(`The identity provider ${entity.id} answered the authorization with ${JSON.stringify(error.slice(0, 64))}.`);
+			return sendRedirect(event, this.buildHostedAuthorizeURL(data.codeRequest).href);
 		}
-		const authorizationCode = await this.codeIssuer.issue(verified?.data ?? { response_type: "code" }, {
-			type: IdentityType.USER,
-			data: {
-				...user,
-				realm
-			}
-		}, { authMethod: SessionAuthMethod.EXTERNAL });
-		await this.eventService?.record({
-			scope: EventScope.OAUTH2,
-			name: EventName.AUTHORIZE,
-			refType: EventRefType.CLIENT,
-			refId: verified?.data.client_id ?? null,
-			clientId: verified?.data.client_id ?? null,
-			sessionId: null,
-			actorType: IdentityType.USER,
-			actorId: user.id,
-			actorName: user.name,
-			realmId: verified?.data.realm_id ?? realm.id,
-			requestIpAddress: getRequestIP(event) ?? null,
-			requestUserAgent: getRequestHeader(event, "user-agent") ?? null,
-			data: {
-				reason: "federated",
-				providerId: entity.id,
-				providerName: entity.name,
-				...verified?.data.scope ? { scope: verified.data.scope } : {}
+		if (typeof code !== "string" || code.length === 0) throw new BadRequestError("The authorization code is missing.");
+		const result = await this.loginService.complete({
+			provider: entity,
+			codeRequest: data.codeRequest,
+			code,
+			request: {
+				ipAddress: getRequestIP(event),
+				userAgent: getRequestHeader(event, "user-agent")
 			}
 		});
-		if (verified?.redirectUriVerified && verified.data.redirect_uri) {
-			const url = new URL(verified.data.redirect_uri);
-			url.searchParams.set("code", authorizationCode.id);
-			if (verified.data.state) url.searchParams.set("state", verified.data.state);
+		const url = this.buildHostedAuthorizeURL(result.codeRequest);
+		if (result.kind === "refused") {
+			if (result.error) url.searchParams.set("error", result.error);
 			return sendRedirect(event, url.href);
 		}
-		const url = new URL(this.options.baseURL);
-		url.searchParams.set("code", authorizationCode.id);
+		this.setFederatedLoginCookie(event, result.pendingLoginId);
+		url.searchParams.set("provider", entity.id);
 		return sendRedirect(event, url.href);
 	}
+	async completeLogin(_id, event) {
+		const id = useRequestParamID(event);
+		this.assertSameOrigin(event);
+		const pendingLoginId = useRequestCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE);
+		if (typeof pendingLoginId !== "string" || pendingLoginId.length === 0) throw new BadRequestError({
+			message: "The login request is unknown or expired.",
+			data: { reason: IDENTITY_PROVIDER_LOGIN_NOT_PENDING }
+		});
+		unsetResponseCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE, { path: this.buildFederatedLoginCookiePath() });
+		return this.loginService.completeHandoff({
+			pendingLoginId,
+			providerId: id
+		});
+	}
 	async write(event, options = {}) {
 		let group;
 		const id = getRequestParamID(event, { isUUID: false });
@@ -301,8 +271,9 @@ var IdentityProviderController = class {
 		}
 		await this.repository.checkUniqueness(data, entity || void 0);
 		if (entity) {
+			const keepAll = entity.protocol === data.protocol;
 			entity = this.repository.merge(entity, data);
-			await this.repository.saveWithEA(entity, attributes);
+			await this.repository.saveWithEA(entity, attributes, { keepAll });
 			event.response.status = 202;
 			return {
 				data: entity,
@@ -426,6 +397,38 @@ var IdentityProviderController = class {
 			}
 		});
 	}
+	/**
+	* Scoped to the routes that read it, so the cookie never rides an
+	* ordinary API request, and to publicUrl's base path, since a sub-path
+	* deployment mounts every route under it.
+	*/ buildFederatedLoginCookiePath() {
+		return `${getURLBasePath(this.options.baseURL)}/identity-providers`;
+	}
+	setFederatedLoginCookie(event, value) {
+		setResponseCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE, value, {
+			httpOnly: true,
+			sameSite: "lax",
+			secure: new URL(this.options.baseURL).protocol === "https:",
+			path: this.buildFederatedLoginCookiePath(),
+			maxAge: OAUTH2_FEDERATED_LOGIN_TTL / 1e3
+		});
+	}
+	/**
+	* The completion answers with a token pair and authenticates on a cookie
+	* alone, so it must be reachable only from the hosted page's own origin.
+	*
+	* CORS cannot carry that here: the default reflects every origin WITH
+	* credentials, and `SameSite` is scoped to the registrable domain rather
+	* than the origin, so a sibling subdomain's script is same-site and would
+	* both send the cookie and be allowed to read the response. A browser
+	* sends `Origin` on every POST, so requiring it to be publicUrl's own is
+	* what closes that. A request without the header is not a browser and
+	* carries no cookie of ours to begin with.
+	*/ assertSameOrigin(event) {
+		const origin = getRequestHeader(event, "origin");
+		if (typeof origin !== "string" || origin.length === 0) return;
+		if (origin !== new URL(this.options.baseURL).origin) throw new BadRequestError("The login request is unknown or expired.");
+	}
 	async saveAuthorizationState(event, data = {}) {
 		return this.stateManager.save({
 			...data,
@@ -450,7 +453,7 @@ _ts_decorate([
 	_ts_metadata("design:returntype", Promise)
 ], IdentityProviderController.prototype, "getProviders", null);
 _ts_decorate([
-	DGet("/:id", []),
+	DGet("/:id", [ForceLoggedInMiddleware]),
 	_ts_param(0, DPath("id")),
 	_ts_param(1, DContext()),
 	_ts_metadata("design:type", Function),
@@ -523,6 +526,14 @@ _ts_decorate([
 	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], IdentityProviderController.prototype, "authorizeIn", null);
+_ts_decorate([
+	DPost("/:id/login-complete", []),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderController.prototype, "completeLogin", null);
 _ts_decorate([
 	DPost("/:id/link-confirm", [ForceLoggedInMiddleware]),
 	_ts_param(0, DPath("id")),