@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","consentService","logger","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","client","redirectUriVerified","verify","identity","result","authorize","raw","sessionId","builtIn","record","clientId","id","realmId","owner","sub","subKind","type","scope","e","warn","error","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected consentService? : IConsentService;\n\n    protected logger? : Logger;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.consentService = ctx.consentService;\n        this.logger = ctx.logger;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const {\n            data,\n            client,\n            redirectUriVerified,\n        } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        const result = await this.authorize(data, identity.raw, {\n            sessionId: useRequestSessionId(event),\n            client,\n            redirectUriVerified,\n        });\n\n        // Persisted per-scope consent (plan 055): recorded only after a\n        // successful approval — an access-policy denial throws inside\n        // authorize() above, so a denied identity never writes a row.\n        // built_in clients keep zero rows (locked); insert-missing makes\n        // re-recording idempotent (union/keep).\n        if (this.consentService && client && !client.builtIn) {\n            try {\n                await this.consentService.record({\n                    clientId: client.id,\n                    realmId: client.realmId,\n                    owner: {\n                        sub: identity.raw.data.id,\n                        subKind: identity.raw.type,\n                    },\n                    scope: data.scope ?? null,\n                });\n            } catch (e) {\n                // never fail an issued code over a consent-write failure\n                this.logger?.warn('Recording the OAuth2 consent grant failed.', {\n                    clientId: client.id,\n                    error: e,\n                });\n            }\n        }\n\n        return result;\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKE,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAElB,KAAKF,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMU,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EACFG,MACAC,QACAC,wBACA,MAAM,KAAKX,oBAAoBY,OAAOL,oBAAAA;EAE1C,MAAMM,WAAWhB,yBAAyBS,KAAAA;EAE1C,MAAMQ,SAAS,MAAM,KAAKC,UAAUN,MAAMI,SAASG,KAAK;GACpDC,WAAWnB,oBAAoBQ,KAAAA;GAC/BI;GACAC;EACJ,CAAA;EAOA,IAAI,KAAKT,kBAAkBQ,UAAU,CAACA,OAAOQ,SACzC,IAAI;GACA,MAAM,KAAKhB,eAAeiB,OAAO;IAC7BC,UAAUV,OAAOW;IACjBC,SAASZ,OAAOY;IAChBC,OAAO;KACHC,KAAKX,SAASG,IAAIP,KAAKY;KACvBI,SAASZ,SAASG,IAAIU;IAC1B;IACAC,OAAOlB,KAAKkB,SAAS;GACzB,CAAA;EACJ,SAASC,GAAG;GAER,KAAKzB,QAAQ0B,KAAK,8CAA8C;IAC5DT,UAAUV,OAAOW;IACjBS,OAAOF;GACX,CAAA;EACJ;EAGJ,OAAOd;CACX;;;;;IAOA,MAAMN,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMb,kBAAkBU,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAC7D,OAAO,KAAKL,iBAAiB8B,IAAItB,IAAAA;CACrC;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","consentService","logger","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","client","redirectUriVerified","verify","identity","result","authorize","raw","sessionId","builtIn","record","clientId","id","realmId","owner","sub","subKind","type","scope","e","warn","error","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected consentService? : IConsentService;\n\n    protected logger? : Logger;\n\n    constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n        super(ctx);\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.consentService = ctx.consentService;\n        this.logger = ctx.logger;\n\n        this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n    }\n\n    async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n        const codeRequestValidated = await this.validateWithRequest(event);\n\n        const {\n            data,\n            client,\n            redirectUriVerified,\n        } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        const identity = useRequestIdentityOrFail(event);\n\n        const result = await this.authorize(data, identity.raw, {\n            sessionId: useRequestSessionId(event),\n            client,\n            redirectUriVerified,\n        });\n\n        // Persisted per-scope consent (plan 055): recorded only after a\n        // successful approval — an access-policy denial throws inside\n        // authorize() above, so a denied identity never writes a row.\n        // built_in clients keep zero rows (locked); insert-missing makes\n        // re-recording idempotent (union/keep).\n        if (client && this.consentService && !client.builtIn) {\n            try {\n                await this.consentService.record({\n                    clientId: client.id,\n                    realmId: client.realmId,\n                    owner: {\n                        sub: identity.raw.data.id,\n                        subKind: identity.raw.type,\n                    },\n                    scope: data.scope ?? null,\n                });\n            } catch (e) {\n                // never fail an issued code over a consent-write failure\n                this.logger?.warn('Recording the OAuth2 consent grant failed.', {\n                    clientId: client.id,\n                    error: e,\n                });\n            }\n        }\n\n        return result;\n    }\n\n    /**\n     * Validate authorization request.\n     *\n     * @throws OAuth2Error\n     */\n    async validateWithRequest(\n        event: IAppEvent,\n    ) : Promise<OAuth2AuthorizationCodeRequest> {\n        const data = await readFromLocations(event, ['body', 'query']);\n        return this.requestValidator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKE,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAElB,KAAKF,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMU,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EACFG,MACAC,QACAC,wBACA,MAAM,KAAKX,oBAAoBY,OAAOL,oBAAAA;EAE1C,MAAMM,WAAWhB,yBAAyBS,KAAAA;EAE1C,MAAMQ,SAAS,MAAM,KAAKC,UAAUN,MAAMI,SAASG,KAAK;GACpDC,WAAWnB,oBAAoBQ,KAAAA;GAC/BI;GACAC;EACJ,CAAA;EAOA,IAAID,UAAU,KAAKR,kBAAkB,CAACQ,OAAOQ,SACzC,IAAI;GACA,MAAM,KAAKhB,eAAeiB,OAAO;IAC7BC,UAAUV,OAAOW;IACjBC,SAASZ,OAAOY;IAChBC,OAAO;KACHC,KAAKX,SAASG,IAAIP,KAAKY;KACvBI,SAASZ,SAASG,IAAIU;IAC1B;IACAC,OAAOlB,KAAKkB,SAAS;GACzB,CAAA;EACJ,SAASC,GAAG;GAER,KAAKzB,QAAQ0B,KAAK,8CAA8C;IAC5DT,UAAUV,OAAOW;IACjBS,OAAOF;GACX,CAAA;EACJ;EAGJ,OAAOd;CACX;;;;;IAOA,MAAMN,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMb,kBAAkBU,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAC7D,OAAO,KAAKL,iBAAiB8B,IAAItB,IAAAA;CACrC;AACJ"}

package/dist/adapters/http/constants.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The path segments the served consoles live under. Each is spelled ONCE:
+ * the controller mount, the login cookie scope, the callback URL, the asset
+ * mount and the shell's rebased vite base all derive from it, so a move
+ * cannot drift the login flow away from the page. The vite `base` in each
+ * console workspace is a hand-synced literal (a vite config cannot import a
+ * server constant); the page specs catch a bundle built against another.
+ */
+export declare const ADMIN_CONSOLE_SEGMENT = "console/admin";
+export declare const ACCOUNT_CONSOLE_SEGMENT = "console/account";
+/**
+ * The auth console's namespace, under which ONLY its assets are mounted
+ * (`<segment>/assets`, the same shape as the two static consoles). Its
+ * PAGES stay on their protocol routes (`/authorize`, `/logout`, the
+ * workflow paths), so `/console/auth` itself serves nothing.
+ */
+export declare const AUTH_CONSOLE_SEGMENT = "console/auth";
+//# sourceMappingURL=constants.d.ts.map

package/dist/adapters/http/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/adapters/http/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,iBAAiB,CAAC"}

package/dist/adapters/http/constants.mjs

@@ -0,0 +1,23 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/constants.ts
+/**
+* The path segments the served consoles live under. Each is spelled ONCE:
+* the controller mount, the login cookie scope, the callback URL, the asset
+* mount and the shell's rebased vite base all derive from it, so a move
+* cannot drift the login flow away from the page. The vite `base` in each
+* console workspace is a hand-synced literal (a vite config cannot import a
+* server constant); the page specs catch a bundle built against another.
+*/ const ADMIN_CONSOLE_SEGMENT = "console/admin";
+const ACCOUNT_CONSOLE_SEGMENT = "console/account";
+/**
+* The auth console's namespace, under which ONLY its assets are mounted
+* (`<segment>/assets`, the same shape as the two static consoles). Its
+* PAGES stay on their protocol routes (`/authorize`, `/logout`, the
+* workflow paths), so `/console/auth` itself serves nothing.
+*/ const AUTH_CONSOLE_SEGMENT = "console/auth";
+//#endregion
+export { ACCOUNT_CONSOLE_SEGMENT, ADMIN_CONSOLE_SEGMENT, AUTH_CONSOLE_SEGMENT };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/adapters/http/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["ADMIN_CONSOLE_SEGMENT","ACCOUNT_CONSOLE_SEGMENT","AUTH_CONSOLE_SEGMENT"],"sources":["../../../src/adapters/http/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * The path segments the served consoles live under. Each is spelled ONCE:\n * the controller mount, the login cookie scope, the callback URL, the asset\n * mount and the shell's rebased vite base all derive from it, so a move\n * cannot drift the login flow away from the page. The vite `base` in each\n * console workspace is a hand-synced literal (a vite config cannot import a\n * server constant); the page specs catch a bundle built against another.\n */\nexport const ADMIN_CONSOLE_SEGMENT = 'console/admin';\n\nexport const ACCOUNT_CONSOLE_SEGMENT = 'console/account';\n\n/**\n * The auth console's namespace, under which ONLY its assets are mounted\n * (`<segment>/assets`, the same shape as the two static consoles). Its\n * PAGES stay on their protocol routes (`/authorize`, `/logout`, the\n * workflow paths), so `/console/auth` itself serves nothing.\n */\nexport const AUTH_CONSOLE_SEGMENT = 'console/auth';\n"],"mappings":";;;;;;;;;;;GAeA,MAAaA,wBAAwB;AAErC,MAAaC,0BAA0B;;;;;;GAQvC,MAAaC,uBAAuB"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs

@@ -5,10 +5,10 @@ import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../cor
 import { identityProviderSchema } from "../../../../../core/entities/identity-provider/schema.mjs";
 import { decodeQuery } from "../../../../../core/query/module.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "../../../../../core/oauth2/authorization/code-request/validator.mjs";
-import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "../../../../../core/oauth2/federated-login/constants.mjs";
 import { describeError } from "../../../../../utils/error.mjs";
 import { resolveURL } from "../../../../../utils/url.mjs";
 import "../../../../../utils/index.mjs";
+import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "../../../../../core/oauth2/federated-login/constants.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "../../../../../core/identity/provider/authentication/factory.mjs";
 import "../../../../../core/index.mjs";
 import { useRequestPermissionEvaluator } from "../../../request/permission/helper.mjs";
@@ -184,7 +184,7 @@ var IdentityProviderController = class {
 		if (link) return this.completeLink(event, entity, data, link);
 		if (!data.codeRequest) throw OAuth2RequestError.malformed("The state carries no authorization code request.");
 		const browserNonce = useRequestCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE);
-		if (!data.browserNonce || typeof browserNonce !== "string" || browserNonce !== data.browserNonce) return sendRedirect(event, this.buildHostedAuthorizeURL(data.codeRequest).href);
+		if (typeof browserNonce !== "string" || !data.browserNonce || browserNonce !== data.browserNonce) return sendRedirect(event, this.buildHostedAuthorizeURL(data.codeRequest).href);
 		const { code, error } = useRequestQuery(event);
 		if (typeof error === "string" && error.length > 0) {
 			this.logger?.info(`The identity provider ${entity.id} answered the authorization with ${JSON.stringify(error.slice(0, 64))}.`);
@@ -294,7 +294,7 @@ var IdentityProviderController = class {
 	* running the login path. No auth code and no session is minted; the
 	* browser lands back on the account console with a marker param.
 	*/ async completeLink(event, provider, state, link) {
-		const url = new URL(resolveURL(this.options.baseURL, "account/connected-accounts"));
+		const url = new URL(resolveURL(this.options.accountConsoleUrl, "connected-accounts"));
 		const { code } = useRequestQuery(event);
 		try {
 			if (link.providerId !== provider.id || !provider.enabled) throw new BadRequestError("The identity provider is not available for account linking.");

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","createNanoID","getURLBasePath","isObject","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","EventName","EventRefType","EventScope","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","describeError","resolveURL","useRequestQuery","setResponseCookie","unsetResponseCookie","useRequestCookie","readRequestBody","OAuth2RequestError","IDENTITY_PROVIDER_LOGIN_NOT_PENDING","URL","OAUTH2_FEDERATED_LOGIN_COOKIE","OAUTH2_FEDERATED_LOGIN_TTL","OAuth2AuthorizationCodeRequestValidator","RECORD_QUERY_PARAMETERS","createIdentityProviderOAuth2Authenticator","decodeQuery","describeQuerySchema","identityProviderSchema","applyRouteRealmIDToBody","buildActorContext","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestEventContext","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","accountManager","linkStore","codeRequestVerifier","codeRequestValidator","stateManager","loginService","eventService","logger","ctx","getProviders","event","data","meta","findMany","schema","actor","getProvider","id","paramId","entity","findOneByIdOrName","evaluateOneOf","name","IDENTITY_PROVIDER_READ","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","ATTRIBUTES","REALM_MATCH","realmId","editProvider","user","write","updateOnly","put","dropProvider","permissionEvaluator","preEvaluate","findOneBy","evaluate","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","enabled","query","codeRequest","malformed","codeRequestDecoded","JSON","parse","codeRequestValidated","run","verify","client","authenticator","buildProviderAuthenticator","browserNonce","setFederatedLoginCookie","state","saveAuthorizationState","buildRedirectURL","linkRequest","identity","type","USER","link","userId","providerId","url","authorizeIn","Error","protocol","verifyAuthorizationState","completeLink","buildHostedAuthorizeURL","href","code","error","length","info","stringify","slice","result","complete","provider","request","ipAddress","userAgent","kind","searchParams","set","pendingLoginId","completeLogin","assertSameOrigin","message","reason","path","buildFederatedLoginCookiePath","completeHandoff","group","body","where","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","checkUniqueness","undefined","keepAll","merge","saveWithEA","create","baseURL","resolveIdentity","handle","save","providerUserId","providerUserName","pickIdentityCandidate","providerUserEmail","e","confirmLink","_data","consume","account","attributeCandidates","email","requestContext","record","scope","IDENTITY","IDENTITY_PROVIDER_LINKED","refType","IDENTITY_PROVIDER_ACCOUNT","refId","userRealmId","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","providerName","key","candidates","candidate","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","clientId","value","httpOnly","sameSite","secure","maxAge","origin","ip","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    ValidatorGroup,\n    base64URLDecode,\n    createNanoID,\n    getURLBasePath,\n    isObject,\n    isUUID,\n} from '@authup/kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n    getRequestHeader,\n    getRequestIP,\n    sendRedirect,\n} from 'routup';\nimport type {\n    IdentityProvider,\n    IdentityProviderAccount,\n    OAuth2AuthorizationCodeRequest,\n    OAuth2IdentityProvider,\n    OpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityProviderAttributesValidator,\n    IdentityProviderValidator,\n    IdentityType,\n    PermissionName,\n    isOAuth2IdentityProvider,\n    isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport { describeError, resolveURL } from '../../../../../utils/index.ts';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { setResponseCookie, unsetResponseCookie, useRequestCookie } from '@routup/basic/cookie';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n    EntityCollectionResponse,\n    EntityRecordResponse,\n    IdentityProviderCreatePayload,\n    IdentityProviderLinkConfirmPayload,\n    IdentityProviderLinkRequestResponse,\n    IdentityProviderSavePayload,\n    IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { IDENTITY_PROVIDER_LOGIN_NOT_PENDING } from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n    IEventService,\n    IIdentityProviderAccountLinkStore,\n    IIdentityProviderAccountManager,\n    IIdentityProviderRepository,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationStateManager,\n    IOAuth2FederatedLoginService,\n    IdentityProviderIdentity,\n    OAuth2AuthorizationState,\n    OAuth2AuthorizationStateLink,\n} from '../../../../../core/index.ts';\nimport {\n    OAUTH2_FEDERATED_LOGIN_COOKIE,\n    OAUTH2_FEDERATED_LOGIN_TTL,\n    OAuth2AuthorizationCodeRequestValidator,\n    RECORD_QUERY_PARAMETERS,\n    createIdentityProviderOAuth2Authenticator,\n    decodeQuery,\n    describeQuerySchema,\n    identityProviderSchema,\n} from '../../../../../core/index.ts';\nimport {\n    applyRouteRealmIDToBody,\n    buildActorContext,\n    getBodyRealmID,\n    getRequestParamID,\n    getRequestRealmID,\n    useRequestEventContext,\n    useRequestIdentityOrFail,\n    useRequestParamID,\n    useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n    protected options: IdentityProviderControllerOptions;\n\n    protected repository: IIdentityProviderRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected linkStore: IIdentityProviderAccountLinkStore;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected stateManager : IOAuth2AuthorizationStateManager;\n\n    protected loginService : IOAuth2FederatedLoginService;\n\n    protected eventService? : IEventService;\n\n    protected logger? : Logger;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: IdentityProviderControllerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.accountManager = ctx.accountManager;\n        this.linkStore = ctx.linkStore;\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n        this.stateManager = ctx.stateManager;\n        this.loginService = ctx.loginService;\n        this.eventService = ctx.eventService;\n        this.logger = ctx.logger;\n    }\n\n    // ---------------------------------------------------------\n\n    // Deliberately anonymous and ungated: the hosted login page lists a\n    // realm's providers before anyone signs in. Safe only because findMany\n    // does not extend with extra attributes, so the response is the schema's\n    // fields.default projection. The record read below carries them and is\n    // gated for exactly that reason.\n    @DGet('', [])\n    async getProviders(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<IdentityProvider>> {\n        const {\n            data,\n            meta,\n        } = await this.repository.findMany(\n            await decodeQuery(useRequestQuery(event), {\n                schema: identityProviderSchema,\n                actor: buildActorContext(event),\n            }),\n        );\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(identityProviderSchema),\n            },\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<IdentityProvider>> {\n        const paramId = useRequestParamID(event, { isUUID: false });\n\n        const entity = await this.repository.findOneByIdOrName(\n            paramId,\n            getRequestRealmID(event),\n        );\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await useRequestPermissionEvaluator(event).evaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n        });\n\n        return { data: entity, meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) } };\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async editProvider(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProvider>> {\n        return this.write(event, { updateOnly: true });\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProvider>> {\n        return this.write(event);\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async dropProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProvider>> {\n        const paramId = useRequestParamID(event);\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n        const entity = await this.repository.findOneBy({ id: paramId });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.remove(entity);\n\n        entity.id = entityId;\n\n        event.response.status = 202;\n\n        return { data: entity, meta: {} };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async addProvider(\n        @DBody() user: IdentityProviderCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProvider>> {\n        return this.write(event);\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('/:id/authorize-out', [])\n    async authorizeOut(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n        }\n\n        // Refused here as well as at the callback, so a disabled provider\n        // costs no provider round trip.\n        if (!entity.enabled) {\n            throw new BadRequestError('The identity provider is not enabled.');\n        }\n\n        // A federated login completes an RP's authorization request: the\n        // callback mints a code bound to that request and delivers it to the\n        // request's redirect_uri. Without one there is nowhere to deliver a\n        // code (the callback used to mint an unbound one and hand it to the\n        // server root, issue #3457), so the login must not start.\n        const query = useRequestQuery(event);\n        if (typeof query.codeRequest !== 'string') {\n            throw OAuth2RequestError.malformed('A federated login requires an authorization code request.');\n        }\n\n        let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n        try {\n            codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n        } catch {\n            throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n        }\n\n        const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n        const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        if (\n            data.client.realmId &&\n            entity.realmId &&\n            entity.realmId !== data.client.realmId\n        ) {\n            throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n        }\n\n        const authenticator = this.buildProviderAuthenticator(entity);\n\n        // Ties this login to THIS browser. The callback requires the cookie\n        // to match, so a crafted callback URL opened in someone else's\n        // browser cannot make authup establish a session there (login CSRF).\n        // The state's ip / user agent cannot carry that: both are chosen by\n        // whoever mints the state (#3439). Keycloak and Authentik bind the\n        // same hop to a cookie for the same reason.\n        const browserNonce = createNanoID();\n        this.setFederatedLoginCookie(event, browserNonce);\n\n        const state = await this.saveAuthorizationState(event, {\n            codeRequest: data.data,\n            browserNonce,\n        });\n\n        return sendRedirect(event, authenticator.buildRedirectURL({ state }));\n    }\n\n    @DPost('/:id/link-request', [ForceLoggedInMiddleware])\n    async linkRequest(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProviderLinkRequestResponse> {\n        const id = useRequestParamID(event);\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports account linking.');\n        }\n\n        if (!entity.enabled) {\n            throw new BadRequestError('The identity provider is not enabled.');\n        }\n\n        const identity = useRequestIdentityOrFail(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only a user can link an identity provider account.');\n        }\n\n        if (entity.realmId && entity.realmId !== identity.realmId) {\n            throw new BadRequestError('The identity provider does not belong to the user realm.');\n        }\n\n        const authenticator = this.buildProviderAuthenticator(entity);\n\n        const state = await this.saveAuthorizationState(event, { link: { userId: identity.id, providerId: entity.id } });\n\n        return { url: authenticator.buildRedirectURL({ state }) };\n    }\n\n    @DGet('/:id/authorize-in', [])\n    async authorizeIn(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n        }\n\n        const data = await this.verifyAuthorizationState(event);\n\n        const { link } = data;\n        if (link) {\n            return this.completeLink(event, entity, data, link);\n        }\n\n        // authorize-out no longer mints a login state without a code request;\n        // this refuses the ones minted before that (issue #3457).\n        if (!data.codeRequest) {\n            throw OAuth2RequestError.malformed('The state carries no authorization code request.');\n        }\n\n        // The browser that started this login is the only one that may\n        // finish it. Refused before the provider's single-use code is spent\n        // and before any session exists. A state minted before this shipped\n        // carries no nonce and is refused the same way; the hosted page\n        // re-renders the request and the next attempt carries one.\n        const browserNonce = useRequestCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE);\n        if (\n            !data.browserNonce ||\n            typeof browserNonce !== 'string' ||\n            browserNonce !== data.browserNonce\n        ) {\n            return sendRedirect(event, this.buildHostedAuthorizeURL(data.codeRequest).href);\n        }\n\n        const { code, error } = useRequestQuery(event);\n\n        // RFC 6749 section 4.1.2.1: a provider answers a refused or failed\n        // authorization (the person cancelled at the provider, the provider\n        // is down) with `error` and no code. A top-level browser navigation\n        // like every other refusal here, so it lands on the hosted login\n        // again. Nothing of the provider's answer is echoed: whoever controls\n        // the provider's redirect shapes those values.\n        if (typeof error === 'string' && error.length > 0) {\n            // JSON-quoted: a raw query value must not be able to forge a log line\n            this.logger?.info(`The identity provider ${entity.id} answered the authorization with ${JSON.stringify(error.slice(0, 64))}.`);\n\n            return sendRedirect(event, this.buildHostedAuthorizeURL(data.codeRequest).href);\n        }\n\n        if (typeof code !== 'string' || code.length === 0) {\n            throw new BadRequestError('The authorization code is missing.');\n        }\n\n        const result = await this.loginService.complete({\n            provider: entity,\n            codeRequest: data.codeRequest,\n            code,\n            request: {\n                ipAddress: getRequestIP(event),\n                userAgent: getRequestHeader(event, 'user-agent'),\n            },\n        });\n\n        // A refusal is a decision the person at the browser has to be told\n        // about, and this is a top-level navigation, so it lands on the\n        // hosted login rather than in a JSON body (issue #3458). A marker is\n        // only attached when the refusal carries one; without it the page\n        // re-runs the same verifier over the same request and states the\n        // reason itself, so nothing is echoed.\n        const url = this.buildHostedAuthorizeURL(result.codeRequest);\n\n        if (result.kind === 'refused') {\n            if (result.error) {\n                url.searchParams.set('error', result.error);\n            }\n\n            return sendRedirect(event, url.href);\n        }\n\n        // The application's code is NOT minted here. The browser goes back to\n        // the hosted authorize page, which completes the login and runs the\n        // ladder an interactive login runs (prompt freshness, consent) before\n        // any code exists (plan 094). So a custom-scheme redirect_uri needs no\n        // interstitial on this leg either: it is navigated at the end of the\n        // ladder, exactly as it is for an interactive login.\n        //\n        // The pending login rides a cookie rather than the URL, which is what\n        // Keycloak and Authentik both do: only the browser that started the\n        // login carries it, no other origin can set it, and nothing redeemable\n        // reaches history, a log or a referrer. `SameSite=Lax` keeps it off\n        // cross-site requests, so a page on another origin cannot drive the\n        // completion. `provider` stays in the URL as a routing hint, and is no\n        // secret.\n        this.setFederatedLoginCookie(event, result.pendingLoginId);\n\n        url.searchParams.set('provider', entity.id);\n\n        return sendRedirect(event, url.href);\n    }\n\n    @DPost('/:id/login-complete', [])\n    async completeLogin(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const id = useRequestParamID(event);\n\n        this.assertSameOrigin(event);\n\n        const pendingLoginId = useRequestCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE);\n        if (typeof pendingLoginId !== 'string' || pendingLoginId.length === 0) {\n            // Marked, because this refusal alone means the completion never\n            // began: the caller was not in a federated login at all. The\n            // hosted page reads it to skip the session teardown it performs\n            // for a redemption that genuinely failed.\n            throw new BadRequestError({\n                message: 'The login request is unknown or expired.',\n                data: { reason: IDENTITY_PROVIDER_LOGIN_NOT_PENDING },\n            });\n        }\n\n        // Cleared whichever way the completion goes: it is single use, and a\n        // cookie outliving its pending login only produces a confusing\n        // refusal on some later page load.\n        unsetResponseCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE, { path: this.buildFederatedLoginCookiePath() });\n\n        return this.loginService.completeHandoff({\n            pendingLoginId,\n            providerId: id,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    private async write(event: IAppEvent, options: {\n        updateOnly?: boolean\n    } = {}): Promise<EntityRecordResponse<IdentityProvider>> {\n        let group: string;\n        const id = getRequestParamID(event, { isUUID: false });\n        const body = await readRequestBody(event);\n        applyRouteRealmIDToBody(event, body);\n        const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n        let entity: IdentityProvider | null | undefined;\n        if (id) {\n            const where: Record<string, any> = {};\n            if (isUUID(id)) {\n                where.id = id;\n            } else {\n                where.name = id;\n            }\n\n            if (realmId) {\n                where.realmId = realmId;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        if (entity) {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validator = new IdentityProviderValidator();\n        const data = await validator.run(body, { group });\n\n        const attributesValidator = new IdentityProviderAttributesValidator();\n        const attributes = await attributesValidator.run(body);\n\n        await this.repository.validateJoinColumns(data);\n\n        if (entity) {\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...data,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? entity.realmId ?? null,\n                }),\n            });\n        } else {\n            if (!data.realmId) {\n                const identity = useRequestIdentityOrFail(event);\n                data.realmId = identity.realmId;\n            }\n\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_CREATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? null }),\n            });\n        }\n\n        await this.repository.checkUniqueness(data, entity || undefined);\n\n        if (entity) {\n            // A partial update must not delete attributes it never mentioned.\n            // The payload is partial by contract, so automation written before\n            // `requiredAmr` / `requiredAcr` existed would otherwise turn the\n            // upstream assurance gate off by saying nothing about it. A caller\n            // clears an attribute by sending it as `null`, which is what the\n            // console submits for a blank field.\n            //\n            // A protocol switch is the exception and still replaces: the old\n            // protocol's rows (an LDAP bind password) are dead configuration\n            // no code reads any more, and keeping them leaves a secret behind.\n            const keepAll = entity.protocol === data.protocol;\n\n            entity = this.repository.merge(entity, data);\n            await this.repository.saveWithEA(entity, attributes, { keepAll });\n\n            event.response.status = 202;\n\n            return { data: entity, meta: {} };\n        }\n\n        entity = this.repository.create(data);\n        await this.repository.saveWithEA(entity, attributes);\n\n        event.response.status = 201;\n\n        return { data: entity, meta: {} };\n    }\n\n    // ---------------------------------------------------------\n\n    /**\n     * Callback half of the account-linking round-trip (plan 091): the\n     * external identity is bound to the state-referenced user instead of\n     * running the login path. No auth code and no session is minted; the\n     * browser lands back on the account console with a marker param.\n     */\n    private async completeLink(\n        event: IAppEvent,\n        provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n        state: OAuth2AuthorizationState,\n        link: OAuth2AuthorizationStateLink,\n    ) {\n        // Fixed, server-derived return target (the account console page).\n        // No client-supplied redirect exists on this path.\n        const url = new URL(resolveURL(this.options.baseURL, 'account/connected-accounts'));\n\n        const { code } = useRequestQuery(event);\n\n        try {\n            // The state is bound to the provider it was minted for, and the\n            // provider must still be enabled at completion — a state cannot\n            // be replayed against a different provider's callback, nor\n            // complete a link after its provider was disabled.\n            if (link.providerId !== provider.id || !provider.enabled) {\n                throw new BadRequestError('The identity provider is not available for account linking.');\n            }\n\n            if (typeof code !== 'string' || code.length === 0) {\n                throw new BadRequestError('The authorization code is missing.');\n            }\n\n            const authenticator = this.buildProviderAuthenticator(provider);\n\n            const identity = await authenticator.resolveIdentity({ code });\n\n            // A provider answering without a subject has nothing to bind. The\n            // callback used to reach `link()`, which rejected it; the stash\n            // would otherwise carry an empty providerUserId to the confirm.\n            if (!identity.id) {\n                throw new BadRequestError('The identity provider returned no subject.');\n            }\n\n            // Nothing is written here. This request is unauthenticated — the\n            // browser round-trip cannot carry a bearer — so the only thing\n            // distinguishing the browser that started the link from any other\n            // would be the state's ip / user-agent binding, and both values\n            // are chosen by whoever minted the state. An attacker minting a\n            // state carrying their OWN userId and getting a victim to follow\n            // it would otherwise bind the VICTIM's external identity to the\n            // attacker's account (issue #3439).\n            //\n            // The resolved identity is stashed under a one-time handle\n            // instead, and the account console confirms it with its bearer.\n            // The stash keeps the requesting userId so the confirm can\n            // require it to equal the AUTHENTICATED user: the handle is a\n            // URL parameter, so it reaches browser history and proxy logs,\n            // and on its own it must authorize nothing.\n            const handle = await this.linkStore.save({\n                providerId: provider.id,\n                userId: link.userId,\n                providerUserId: identity.id,\n                providerUserName: this.pickIdentityCandidate(identity, 'name'),\n                providerUserEmail: this.pickIdentityCandidate(identity, 'email'),\n            });\n\n            url.searchParams.set('linkHandle', handle);\n            url.searchParams.set('provider', provider.id);\n        } catch (e) {\n            // The failure is swallowed into a redirect marker, so the log is\n            // the only surface it can reach. Without this an unreachable or\n            // rejecting provider is indistinguishable from a stale state.\n            this.logger?.error(describeError(e, 'The identity-provider account link failed.'));\n\n            url.searchParams.set('linkError', 'link_failed');\n        }\n\n        return sendRedirect(event, url.href);\n    }\n\n    /**\n     * The bearer-authenticated half of the link (issue #3439): the account\n     * row is written here, for the AUTHENTICATED user, never in the callback.\n     */\n    @DPost('/:id/link-confirm', [ForceLoggedInMiddleware])\n    async confirmLink(\n        @DPath('id') _id: string,\n        @DBody() _data: IdentityProviderLinkConfirmPayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProviderAccount>> {\n        const id = useRequestParamID(event);\n        const provider = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(provider) && !isOpenIDIdentityProvider(provider)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports account linking.');\n        }\n\n        if (!provider.enabled) {\n            throw new BadRequestError('The identity provider is not enabled.');\n        }\n\n        const identity = useRequestIdentityOrFail(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only a user can link an identity provider account.');\n        }\n\n        const body = await readRequestBody(event);\n        const handle = isObject(body) ? body.handle : undefined;\n        if (typeof handle !== 'string' || handle.length === 0) {\n            throw new BadRequestError('The account link handle is missing.');\n        }\n\n        const link = await this.linkStore.consume(handle);\n        if (!link) {\n            throw new BadRequestError('The account link request is unknown or expired.');\n        }\n\n        // The two checks that make the handle inert on its own: it may only\n        // be redeemed by the user it was minted for, and only against the\n        // provider it was minted for.\n        if (link.userId !== identity.id || link.providerId !== provider.id) {\n            throw new BadRequestError('The account link request does not belong to the authenticated user.');\n        }\n\n        const account = await this.accountManager.link(\n            {\n                id: link.providerUserId,\n                // deliberately rebuilt from the stashed scalars: the resolved\n                // identity carries the provider secret and the raw external\n                // token payload, neither of which belongs in a cache\n                attributeCandidates: {\n                    name: [link.providerUserName],\n                    email: [link.providerUserEmail],\n                },\n                data: {},\n                provider,\n            },\n            identity.id,\n        );\n\n        // the confirm runs under a bearer, so unlike the callback it CAN be\n        // attributed to a session and a route (the unlink emit's shape)\n        const requestContext = useRequestEventContext();\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.IDENTITY_PROVIDER_LINKED,\n            refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,\n            refId: account.id,\n            realmId: account.userRealmId ?? provider.realmId ?? null,\n            actorType: IdentityType.USER,\n            actorId: account.userId,\n            actorName: identity.data.name ?? null,\n            sessionId: requestContext?.sessionId ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? getRequestIP(event) ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? getRequestHeader(event, 'user-agent') ?? null,\n            data: { providerId: provider.id, providerName: provider.name },\n        });\n\n        return { data: account, meta: {} };\n    }\n\n    private pickIdentityCandidate(\n        identity: IdentityProviderIdentity,\n        key: 'name' | 'email',\n    ) : string | null {\n        const candidates = identity.attributeCandidates?.[key] || [];\n        for (const candidate of candidates) {\n            if (typeof candidate === 'string' && candidate.length > 0) {\n                return candidate;\n            }\n        }\n\n        return null;\n    }\n\n    // ---------------------------------------------------------\n\n    private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n        const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n        const codeRequestKeys = Object.keys(codeRequest);\n        for (const codeRequestKey_ of codeRequestKeys) {\n            const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n            const codeRequestValue = codeRequest[codeRequestKey];\n            // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n            // treats as prompt=login) — only skip absent ones.\n            if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n                url.searchParams.set(codeRequestKey, String(codeRequestValue));\n            }\n        }\n\n        return url;\n    }\n\n    // ---------------------------------------------------------\n\n    private async resolve(id: string) {\n        const entity = await this.repository.findOneById(id);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private buildProviderAuthenticator(\n        provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n        options: { clientId?: string } = {},\n    ) {\n        return createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider,\n            logger: this.logger,\n            options: {\n                baseURL: this.options.baseURL,\n                clientId: options.clientId,\n            },\n        });\n    }\n\n    /**\n     * Scoped to the routes that read it, so the cookie never rides an\n     * ordinary API request, and to publicUrl's base path, since a sub-path\n     * deployment mounts every route under it.\n     */\n    private buildFederatedLoginCookiePath() : string {\n        return `${getURLBasePath(this.options.baseURL)}/identity-providers`;\n    }\n\n    private setFederatedLoginCookie(event: IAppEvent, value: string) : void {\n        setResponseCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE, value, {\n            httpOnly: true,\n            sameSite: 'lax',\n            // The scheme is read from the parsed URL rather than the raw\n            // string: `publicUrl` is validated but never canonicalized, so a\n            // configured `HTTPS://...` would leave a prefix test false and\n            // drop the flag from the one cookie the login is bound to.\n            secure: new URL(this.options.baseURL).protocol === 'https:',\n            path: this.buildFederatedLoginCookiePath(),\n            maxAge: OAUTH2_FEDERATED_LOGIN_TTL / 1000,\n        });\n    }\n\n    /**\n     * The completion answers with a token pair and authenticates on a cookie\n     * alone, so it must be reachable only from the hosted page's own origin.\n     *\n     * CORS cannot carry that here: the default reflects every origin WITH\n     * credentials, and `SameSite` is scoped to the registrable domain rather\n     * than the origin, so a sibling subdomain's script is same-site and would\n     * both send the cookie and be allowed to read the response. A browser\n     * sends `Origin` on every POST, so requiring it to be publicUrl's own is\n     * what closes that. A request without the header is not a browser and\n     * carries no cookie of ours to begin with.\n     */\n    private assertSameOrigin(event: IAppEvent) : void {\n        const origin = getRequestHeader(event, 'origin');\n        if (typeof origin !== 'string' || origin.length === 0) {\n            return;\n        }\n\n        if (origin !== new URL(this.options.baseURL).origin) {\n            throw new BadRequestError('The login request is unknown or expired.');\n        }\n    }\n\n    private async saveAuthorizationState(\n        event: IAppEvent,\n        data: Pick<OAuth2AuthorizationState, 'codeRequest' | 'link' | 'browserNonce'> = {},\n    ) : Promise<string> {\n        return this.stateManager.save({\n            ...data,\n            ip: getRequestIP(event) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n        const query = useRequestQuery(event);\n        if (typeof query.state !== 'string') {\n            throw OAuth2RequestError.stateInvalid();\n        }\n\n        return this.stateManager.verify(query.state, {\n            ip: getRequestIP(event) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4GA,IAAa2D,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKV,UAAUU,IAAIV;EACnB,KAAKC,aAAaS,IAAIT;EACtB,KAAKC,iBAAiBQ,IAAIR;EAC1B,KAAKC,YAAYO,IAAIP;EACrB,KAAKC,sBAAsBM,IAAIN;EAC/B,KAAKC,uBAAuB,IAAItB,wCAAAA;EAChC,KAAKuB,eAAeI,IAAIJ;EACxB,KAAKC,eAAeG,IAAIH;EACxB,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,SAASC,IAAID;CACtB;CASA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKb,WAAWc,SACtB,MAAM7B,YAAYb,gBAAgBuC,KAAAA,GAAQ;GACtCI,QAAQ5B;GACR6B,OAAO3B,kBAAkBsB,KAAAA;EAC7B,CAAA,CAAA;EAGJ,OAAO;GACHC;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQ7B,oBAAoBC,sBAAAA;GAChC;EACJ;CACJ;CAEA,MACM8B,YACF,IACA,OAC+C;EAC/C,MAAME,UAAUxB,kBAAkBgB,OAAO,EAAEjE,QAAQ,MAAM,CAAA;EAEzD,MAAM0E,SAAS,MAAM,KAAKpB,WAAWqB,kBACjCF,SACA3B,kBAAkBmB,KAAAA,CAAAA;EAGtB,IAAI,CAACS,QACD,MAAM,IAAInD,oBAAAA;EAGd,MAAM2B,8BAA8Be,KAAAA,CAAAA,CAAOW,cAAc;GACrDC,MAAM;IACF1D,eAAe2D;IACf3D,eAAe4D;IACf5D,eAAe6D;GAClB;GACDd,MAAMxE,iBAAiB;KAAGD,kBAAkBwF,aAAaP;KAASjF,kBAAkByF,cAAcR,OAAOS,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,OAAO;GAAEjB,MAAMQ;GAAQP,MAAM,EAAEE,QAAQ7B,oBAAoBC,wBAAwBJ,uBAAAA,EAAyB;EAAE;CAClH;CAEA,MACM+C,aACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKE,MAAMrB,OAAO,EAAEsB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKF,MAAMrB,KAAAA;CACtB;CAEA,MACMwB,aACF,IACA,OACgD;EAChD,MAAMhB,UAAUxB,kBAAkBgB,KAAAA;EAElC,MAAMyB,sBAAsBxC,8BAA8Be,KAAAA;EAC1D,MAAMyB,oBAAoBC,YAAY,EAAEd,MAAM1D,eAAe6D,yBAAyB,CAAA;EAEtF,MAAMN,SAAS,MAAM,KAAKpB,WAAWsC,UAAU,EAAEpB,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAInD,oBAAAA;EAGd,MAAMmE,oBAAoBG,SAAS;GAC/BhB,MAAM1D,eAAe6D;GACrBd,MAAMxE,iBAAiB;KAAGD,kBAAkBwF,aAAaP;KAASjF,kBAAkByF,cAAcR,OAAOS,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,MAAM,EAAEX,IAAIsB,aAAapB;EAEzB,MAAM,KAAKpB,WAAWyC,OAAOrB,MAAAA;EAE7BA,OAAOF,KAAKsB;EAEZ7B,MAAM+B,SAASC,SAAS;EAExB,OAAO;GAAE/B,MAAMQ;GAAQP,MAAM,CAAC;EAAE;CACpC;CAEA,MACM+B,YACF,MACA,OACgD;EAChD,OAAO,KAAKZ,MAAMrB,KAAAA;CACtB;CAIA,MACMkC,aACF,KACA,OACF;EACE,MAAM3B,KAAKvB,kBAAkBgB,KAAAA;EAC7B,MAAMS,SAAS,MAAM,KAAK2B,QAAQ7B,EAAAA;EAElC,IAAI,CAACpD,yBAAyBsD,MAAAA,KAAW,CAACrD,yBAAyBqD,MAAAA,GAC/D,MAAM,IAAIpD,gBAAgB,oFAAA;EAK9B,IAAI,CAACoD,OAAO4B,SACR,MAAM,IAAIhF,gBAAgB,uCAAA;EAQ9B,MAAMiF,QAAQ7E,gBAAgBuC,KAAAA;EAC9B,IAAI,OAAOsC,MAAMC,gBAAgB,UAC7B,MAAMzE,mBAAmB0E,UAAU,2DAAA;EAGvC,IAAIC;EAEJ,IAAI;GACAA,qBAAqBC,KAAKC,MAAMhH,gBAAgB2G,MAAMC,WAAW,CAAA;EACrE,QAAQ;GACJ,MAAMzE,mBAAmB0E,UAAU,sDAAA;EACvC;EAEA,MAAMI,uBAAuB,MAAM,KAAKnD,qBAAqBoD,IAAIJ,kBAAAA;EACjE,MAAMxC,OAAO,MAAM,KAAKT,oBAAoBsD,OAAOF,oBAAAA;EAEnD,IACI3C,KAAK8C,OAAO7B,WACZT,OAAOS,WACPT,OAAOS,YAAYjB,KAAK8C,OAAO7B,SAE/B,MAAMpD,mBAAmB0E,UAAU,6CAAA;EAGvC,MAAMQ,gBAAgB,KAAKC,2BAA2BxC,MAAAA;EAQtD,MAAMyC,eAAetH,aAAAA;EACrB,KAAKuH,wBAAwBnD,OAAOkD,YAAAA;EAEpC,MAAME,QAAQ,MAAM,KAAKC,uBAAuBrD,OAAO;GACnDuC,aAAatC,KAAKA;GAClBiD;EACJ,CAAA;EAEA,OAAOvG,aAAaqD,OAAOgD,cAAcM,iBAAiB,EAAEF,MAAM,CAAA,CAAA;CACtE;CAEA,MACMG,YACF,KACA,OAC6C;EAC7C,MAAMhD,KAAKvB,kBAAkBgB,KAAAA;EAC7B,MAAMS,SAAS,MAAM,KAAK2B,QAAQ7B,EAAAA;EAElC,IAAI,CAACpD,yBAAyBsD,MAAAA,KAAW,CAACrD,yBAAyBqD,MAAAA,GAC/D,MAAM,IAAIpD,gBAAgB,iFAAA;EAG9B,IAAI,CAACoD,OAAO4B,SACR,MAAM,IAAIhF,gBAAgB,uCAAA;EAG9B,MAAMmG,WAAWzE,yBAAyBiB,KAAAA;EAC1C,IAAIwD,SAASC,SAASxG,aAAayG,MAC/B,MAAM,IAAIrG,gBAAgB,oDAAA;EAG9B,IAAIoD,OAAOS,WAAWT,OAAOS,YAAYsC,SAAStC,SAC9C,MAAM,IAAI7D,gBAAgB,0DAAA;EAG9B,MAAM2F,gBAAgB,KAAKC,2BAA2BxC,MAAAA;EAEtD,MAAM2C,QAAQ,MAAM,KAAKC,uBAAuBrD,OAAO,EAAE2D,MAAM;GAAEC,QAAQJ,SAASjD;GAAIsD,YAAYpD,OAAOF;EAAG,EAAE,CAAA;EAE9G,OAAO,EAAEuD,KAAKd,cAAcM,iBAAiB,EAAEF,MAAM,CAAA,EAAG;CAC5D;CAEA,MACMW,YACF,KACA,OACF;EACE,MAAMxD,KAAKvB,kBAAkBgB,KAAAA;EAE7B,MAAMS,SAAS,MAAM,KAAK2B,QAAQ7B,EAAAA;EAElC,IAAI,CAACpD,yBAAyBsD,MAAAA,KAAW,CAACrD,yBAAyBqD,MAAAA,GAC/D,MAAM,IAAIuD,MAAM,yBAAyBvD,OAAOwD,SAAS,eAAe;EAG5E,MAAMhE,OAAO,MAAM,KAAKiE,yBAAyBlE,KAAAA;EAEjD,MAAM,EAAE2D,SAAS1D;EACjB,IAAI0D,MACA,OAAO,KAAKQ,aAAanE,OAAOS,QAAQR,MAAM0D,IAAAA;EAKlD,IAAI,CAAC1D,KAAKsC,aACN,MAAMzE,mBAAmB0E,UAAU,kDAAA;EAQvC,MAAMU,eAAetF,iBAAiBoC,OAAO/B,6BAAAA;EAC7C,IACI,CAACgC,KAAKiD,gBACN,OAAOA,iBAAiB,YACxBA,iBAAiBjD,KAAKiD,cAEtB,OAAOvG,aAAaqD,OAAO,KAAKoE,wBAAwBnE,KAAKsC,WAAW,CAAA,CAAE8B,IAAI;EAGlF,MAAM,EAAEC,MAAMC,UAAU9G,gBAAgBuC,KAAAA;EAQxC,IAAI,OAAOuE,UAAU,YAAYA,MAAMC,SAAS,GAAG;GAE/C,KAAK3E,QAAQ4E,KAAK,yBAAyBhE,OAAOF,GAAG,mCAAmCmC,KAAKgC,UAAUH,MAAMI,MAAM,GAAG,EAAA,CAAA,EAAK,EAAE;GAE7H,OAAOhI,aAAaqD,OAAO,KAAKoE,wBAAwBnE,KAAKsC,WAAW,CAAA,CAAE8B,IAAI;EAClF;EAEA,IAAI,OAAOC,SAAS,YAAYA,KAAKE,WAAW,GAC5C,MAAM,IAAInH,gBAAgB,oCAAA;EAG9B,MAAMuH,SAAS,MAAM,KAAKjF,aAAakF,SAAS;GAC5CC,UAAUrE;GACV8B,aAAatC,KAAKsC;GAClB+B;GACAS,SAAS;IACLC,WAAWtI,aAAasD,KAAAA;IACxBiF,WAAWxI,iBAAiBuD,OAAO,YAAA;GACvC;EACJ,CAAA;EAQA,MAAM8D,MAAM,KAAKM,wBAAwBQ,OAAOrC,WAAW;EAE3D,IAAIqC,OAAOM,SAAS,WAAW;GAC3B,IAAIN,OAAOL,OACPT,IAAIqB,aAAaC,IAAI,SAASR,OAAOL,KAAK;GAG9C,OAAO5H,aAAaqD,OAAO8D,IAAIO,IAAI;EACvC;EAgBA,KAAKlB,wBAAwBnD,OAAO4E,OAAOS,cAAc;EAEzDvB,IAAIqB,aAAaC,IAAI,YAAY3E,OAAOF,EAAE;EAE1C,OAAO5D,aAAaqD,OAAO8D,IAAIO,IAAI;CACvC;CAEA,MACMiB,cACF,KACA,OACkC;EAClC,MAAM/E,KAAKvB,kBAAkBgB,KAAAA;EAE7B,KAAKuF,iBAAiBvF,KAAAA;EAEtB,MAAMqF,iBAAiBzH,iBAAiBoC,OAAO/B,6BAAAA;EAC/C,IAAI,OAAOoH,mBAAmB,YAAYA,eAAeb,WAAW,GAKhE,MAAM,IAAInH,gBAAgB;GACtBmI,SAAS;GACTvF,MAAM,EAAEwF,QAAQ1H,oCAAoC;EACxD,CAAA;EAMJJ,oBAAoBqC,OAAO/B,+BAA+B,EAAEyH,MAAM,KAAKC,8BAA6B,EAAG,CAAA;EAEvG,OAAO,KAAKhG,aAAaiG,gBAAgB;GACrCP;GACAxB,YAAYtD;EAChB,CAAA;CACJ;CAIA,MAAcc,MAAMrB,OAAkBZ,UAElC,CAAC,GAAoD;EACrD,IAAIyG;EACJ,MAAMtF,KAAK3B,kBAAkBoB,OAAO,EAAEjE,QAAQ,MAAM,CAAA;EACpD,MAAM+J,OAAO,MAAMjI,gBAAgBmC,KAAAA;EACnCvB,wBAAwBuB,OAAO8F,IAAAA;EAC/B,MAAM5E,UAAUrC,kBAAkBmB,KAAAA,KAAUrB,eAAemH,IAAAA;EAE3D,IAAIrF;EACJ,IAAIF,IAAI;GACJ,MAAMwF,QAA6B,CAAC;GACpC,IAAIhK,OAAOwE,EAAAA,GACPwF,MAAMxF,KAAKA;QAEXwF,MAAMnF,OAAOL;GAGjB,IAAIW,SACA6E,MAAM7E,UAAUA;GAGpBT,SAAS,MAAM,KAAKpB,WAAWsC,UAAUoE,KAAAA;GAGzC,IAAI,CAACtF,WAAWrB,QAAQkC,cAAcyE,MAAMxF,KACxC,MAAM,IAAIjD,oBAAAA;EAElB,OAAO,IAAI8B,QAAQkC,YACf,MAAM,IAAIhE,oBAAAA;EAGd,MAAMmE,sBAAsBxC,8BAA8Be,KAAAA;EAC1D,IAAIS,QAAQ;GACR,MAAMgB,oBAAoBC,YAAY,EAAEd,MAAM1D,eAAe4D,yBAAyB,CAAA;GAEtF+E,QAAQnK,eAAesK;EAC3B,OAAO;GACH,MAAMvE,oBAAoBC,YAAY,EAAEd,MAAM1D,eAAe+I,yBAAyB,CAAA;GAEtFJ,QAAQnK,eAAewK;EAC3B;EAGA,MAAMjG,OAAO,MAAMkG,IADGnJ,0BACHmJ,CAAAA,CAAUtD,IAAIiD,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMQ,aAAa,MAAMD,IADOrJ,oCACPqJ,CAAAA,CAAoBvD,IAAIiD,IAAAA;EAEjD,MAAM,KAAKzG,WAAWiH,oBAAoBrG,IAAAA;EAE1C,IAAIQ,QACA,MAAMgB,oBAAoBG,SAAS;GAC/BhB,MAAM1D,eAAe4D;GACrBb,MAAMxE,iBAAiB;KAClBD,kBAAkBwF,aAAa;KAC5B,GAAGP;KACH,GAAGR;IACP;KACCzE,kBAAkByF,cAAchB,KAAKiB,WAAWT,OAAOS,WAAW;GACvE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACjB,KAAKiB,SAENjB,KAAKiB,UADYnC,yBAAyBiB,KAC3BwD,CAAAA,CAAStC;GAG5B,MAAMO,oBAAoBG,SAAS;IAC/BhB,MAAM1D,eAAe+I;IACrBhG,MAAMxE,iBAAiB;MAAGD,kBAAkBwF,aAAaf;MAAOzE,kBAAkByF,cAAchB,KAAKiB,WAAW;IAAK,CAAA;GACzH,CAAA;EACJ;EAEA,MAAM,KAAK7B,WAAWkH,gBAAgBtG,MAAMQ,UAAU+F,KAAAA,CAAAA;EAEtD,IAAI/F,QAAQ;GAWR,MAAMgG,UAAUhG,OAAOwD,aAAahE,KAAKgE;GAEzCxD,SAAS,KAAKpB,WAAWqH,MAAMjG,QAAQR,IAAAA;GACvC,MAAM,KAAKZ,WAAWsH,WAAWlG,QAAQ4F,YAAY,EAAEI,QAAQ,CAAA;GAE/DzG,MAAM+B,SAASC,SAAS;GAExB,OAAO;IAAE/B,MAAMQ;IAAQP,MAAM,CAAC;GAAE;EACpC;EAEAO,SAAS,KAAKpB,WAAWuH,OAAO3G,IAAAA;EAChC,MAAM,KAAKZ,WAAWsH,WAAWlG,QAAQ4F,UAAAA;EAEzCrG,MAAM+B,SAASC,SAAS;EAExB,OAAO;GAAE/B,MAAMQ;GAAQP,MAAM,CAAC;EAAE;CACpC;;;;;;IAUA,MAAciE,aACVnE,OACA8E,UACA1B,OACAO,MACF;EAGE,MAAMG,MAAM,IAAI9F,IAAIR,WAAW,KAAK4B,QAAQyH,SAAS,4BAAA,CAAA;EAErD,MAAM,EAAEvC,SAAS7G,gBAAgBuC,KAAAA;EAEjC,IAAI;GAKA,IAAI2D,KAAKE,eAAeiB,SAASvE,MAAM,CAACuE,SAASzC,SAC7C,MAAM,IAAIhF,gBAAgB,6DAAA;GAG9B,IAAI,OAAOiH,SAAS,YAAYA,KAAKE,WAAW,GAC5C,MAAM,IAAInH,gBAAgB,oCAAA;GAK9B,MAAMmG,WAAW,MAFK,KAAKP,2BAA2B6B,QAE/B9B,CAAAA,CAAc8D,gBAAgB,EAAExC,KAAK,CAAA;GAK5D,IAAI,CAACd,SAASjD,IACV,MAAM,IAAIlD,gBAAgB,4CAAA;GAkB9B,MAAM0J,SAAS,MAAM,KAAKxH,UAAUyH,KAAK;IACrCnD,YAAYiB,SAASvE;IACrBqD,QAAQD,KAAKC;IACbqD,gBAAgBzD,SAASjD;IACzB2G,kBAAkB,KAAKC,sBAAsB3D,UAAU,MAAA;IACvD4D,mBAAmB,KAAKD,sBAAsB3D,UAAU,OAAA;GAC5D,CAAA;GAEAM,IAAIqB,aAAaC,IAAI,cAAc2B,MAAAA;GACnCjD,IAAIqB,aAAaC,IAAI,YAAYN,SAASvE,EAAE;EAChD,SAAS8G,GAAG;GAIR,KAAKxH,QAAQ0E,MAAMhH,cAAc8J,GAAG,4CAAA,CAAA;GAEpCvD,IAAIqB,aAAaC,IAAI,aAAa,aAAA;EACtC;EAEA,OAAOzI,aAAaqD,OAAO8D,IAAIO,IAAI;CACvC;;;;IAMA,MACMiD,YACF,KACA,OACA,OACuD;EACvD,MAAM/G,KAAKvB,kBAAkBgB,KAAAA;EAC7B,MAAM8E,WAAW,MAAM,KAAK1C,QAAQ7B,EAAAA;EAEpC,IAAI,CAACpD,yBAAyB2H,QAAAA,KAAa,CAAC1H,yBAAyB0H,QAAAA,GACjE,MAAM,IAAIzH,gBAAgB,iFAAA;EAG9B,IAAI,CAACyH,SAASzC,SACV,MAAM,IAAIhF,gBAAgB,uCAAA;EAG9B,MAAMmG,WAAWzE,yBAAyBiB,KAAAA;EAC1C,IAAIwD,SAASC,SAASxG,aAAayG,MAC/B,MAAM,IAAIrG,gBAAgB,oDAAA;EAG9B,MAAMyI,OAAO,MAAMjI,gBAAgBmC,KAAAA;EACnC,MAAM+G,SAASjL,SAASgK,IAAAA,IAAQA,KAAKiB,SAASP,KAAAA;EAC9C,IAAI,OAAOO,WAAW,YAAYA,OAAOvC,WAAW,GAChD,MAAM,IAAInH,gBAAgB,qCAAA;EAG9B,MAAMsG,OAAO,MAAM,KAAKpE,UAAUiI,QAAQT,MAAAA;EAC1C,IAAI,CAACpD,MACD,MAAM,IAAItG,gBAAgB,iDAAA;EAM9B,IAAIsG,KAAKC,WAAWJ,SAASjD,MAAMoD,KAAKE,eAAeiB,SAASvE,IAC5D,MAAM,IAAIlD,gBAAgB,qEAAA;EAG9B,MAAMoK,UAAU,MAAM,KAAKnI,eAAeqE,KACtC;GACIpD,IAAIoD,KAAKsD;GAITS,qBAAqB;IACjB9G,MAAM,CAAC+C,KAAKuD,gBAAiB;IAC7BS,OAAO,CAAChE,KAAKyD,iBAAkB;GACnC;GACAnH,MAAM,CAAC;GACP6E;EACJ,GACAtB,SAASjD,EAAE;EAKf,MAAMqH,iBAAiB9I,uBAAAA;EAEvB,MAAM,KAAKc,cAAciI,OAAO;GAC5BC,OAAOhL,WAAWiL;GAClBnH,MAAMhE,UAAUoL;GAChBC,SAASpL,aAAaqL;GACtBC,OAAOV,QAAQlH;GACfW,SAASuG,QAAQW,eAAetD,SAAS5D,WAAW;GACpDmH,WAAWpL,aAAayG;GACxB4E,SAASb,QAAQ7D;GACjB2E,WAAW/E,SAASvD,KAAKW,QAAQ;GACjC4H,WAAWZ,gBAAgBY,aAAa;GACxCC,aAAab,gBAAgBa,eAAe;GAC5CC,eAAed,gBAAgBc,iBAAiB;GAChDC,kBAAkBf,gBAAgBe,oBAAoBjM,aAAasD,KAAAA,KAAU;GAC7E4I,kBAAkBhB,gBAAgBgB,oBAAoBnM,iBAAiBuD,OAAO,YAAA,KAAiB;GAC/FC,MAAM;IAAE4D,YAAYiB,SAASvE;IAAIsI,cAAc/D,SAASlE;GAAK;EACjE,CAAA;EAEA,OAAO;GAAEX,MAAMwH;GAASvH,MAAM,CAAC;EAAE;CACrC;CAEQiH,sBACJ3D,UACAsF,KACc;EACd,MAAMC,aAAavF,SAASkE,sBAAsBoB,QAAQ,CAAA;EAC1D,KAAK,MAAME,aAAaD,YACpB,IAAI,OAAOC,cAAc,YAAYA,UAAUxE,SAAS,GACpD,OAAOwE;EAIf,OAAO;CACX;CAIQ5E,wBAAwB7B,aAAkD;EAC9E,MAAMuB,MAAM,IAAI9F,IAAIR,WAAW,KAAK4B,QAAQyH,SAAS,WAAA,CAAA;EAErD,MAAMoC,kBAAkBC,OAAOC,KAAK5G,WAAAA;EACpC,KAAK,MAAM6G,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmB/G,YAAY8G;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChExF,IAAIqB,aAAaC,IAAIiE,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAOxF;CACX;CAIA,MAAc1B,QAAQ7B,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAKpB,WAAWmK,YAAYjJ,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAInD,oBAAAA;EAGd,OAAOmD;CACX;CAIQwC,2BACJ6B,UACA1F,UAAiC,CAAC,GACpC;EACE,OAAOf,0CAA0C;GAC7CiB,gBAAgB,KAAKA;GACrBwF;GACAjF,QAAQ,KAAKA;GACbT,SAAS;IACLyH,SAAS,KAAKzH,QAAQyH;IACtB4C,UAAUrK,QAAQqK;GACtB;EACJ,CAAA;CACJ;;;;;IAOA,gCAAiD;EAC7C,OAAO,GAAG5N,eAAe,KAAKuD,QAAQyH,OAAO,EAAE;CACnD;CAEQ1D,wBAAwBnD,OAAkB0J,OAAsB;EACpEhM,kBAAkBsC,OAAO/B,+BAA+ByL,OAAO;GAC3DC,UAAU;GACVC,UAAU;GAKVC,QAAQ,IAAI7L,IAAI,KAAKoB,QAAQyH,OAAO,CAAA,CAAE5C,aAAa;GACnDyB,MAAM,KAAKC,8BAA6B;GACxCmE,QAAQ5L,6BAA6B;EACzC,CAAA;CACJ;;;;;;;;;;;;IAcA,iBAAyB8B,OAAyB;EAC9C,MAAM+J,SAAStN,iBAAiBuD,OAAO,QAAA;EACvC,IAAI,OAAO+J,WAAW,YAAYA,OAAOvF,WAAW,GAChD;EAGJ,IAAIuF,WAAW,IAAI/L,IAAI,KAAKoB,QAAQyH,OAAO,CAAA,CAAEkD,QACzC,MAAM,IAAI1M,gBAAgB,0CAAA;CAElC;CAEA,MAAcgG,uBACVrD,OACAC,OAAgF,CAAC,GACjE;EAChB,OAAO,KAAKP,aAAasH,KAAK;GAC1B,GAAG/G;GACH+J,IAAItN,aAAasD,KAAAA,KAAU;GAC3BiF,WAAWxI,iBAAiBuD,OAAO,YAAA,KAAiBwG,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBlE,OAAqD;EACxF,MAAMsC,QAAQ7E,gBAAgBuC,KAAAA;EAC9B,IAAI,OAAOsC,MAAMc,UAAU,UACvB,MAAMtF,mBAAmBmM,aAAY;EAGzC,OAAO,KAAKvK,aAAaoD,OAAOR,MAAMc,OAAO;GACzC4G,IAAItN,aAAasD,KAAAA,KAAU;GAC3BiF,WAAWxI,iBAAiBuD,OAAO,YAAA,KAAiBwG,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;CAttBmBtH,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CA4BCA,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAgCNA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;CA4EiBA,MAAAA,qBAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;CA0WAA,MAAAA,qBAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;CAvkBnB,YAAA,CAAA,uBAAuB,qCAAA,CAAA"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","createNanoID","getURLBasePath","isObject","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","EventName","EventRefType","EventScope","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","describeError","resolveURL","useRequestQuery","setResponseCookie","unsetResponseCookie","useRequestCookie","readRequestBody","OAuth2RequestError","IDENTITY_PROVIDER_LOGIN_NOT_PENDING","URL","OAUTH2_FEDERATED_LOGIN_COOKIE","OAUTH2_FEDERATED_LOGIN_TTL","OAuth2AuthorizationCodeRequestValidator","RECORD_QUERY_PARAMETERS","createIdentityProviderOAuth2Authenticator","decodeQuery","describeQuerySchema","identityProviderSchema","applyRouteRealmIDToBody","buildActorContext","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestEventContext","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","accountManager","linkStore","codeRequestVerifier","codeRequestValidator","stateManager","loginService","eventService","logger","ctx","getProviders","event","data","meta","findMany","schema","actor","getProvider","id","paramId","entity","findOneByIdOrName","evaluateOneOf","name","IDENTITY_PROVIDER_READ","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","ATTRIBUTES","REALM_MATCH","realmId","editProvider","user","write","updateOnly","put","dropProvider","permissionEvaluator","preEvaluate","findOneBy","evaluate","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","enabled","query","codeRequest","malformed","codeRequestDecoded","JSON","parse","codeRequestValidated","run","verify","client","authenticator","buildProviderAuthenticator","browserNonce","setFederatedLoginCookie","state","saveAuthorizationState","buildRedirectURL","linkRequest","identity","type","USER","link","userId","providerId","url","authorizeIn","Error","protocol","verifyAuthorizationState","completeLink","buildHostedAuthorizeURL","href","code","error","length","info","stringify","slice","result","complete","provider","request","ipAddress","userAgent","kind","searchParams","set","pendingLoginId","completeLogin","assertSameOrigin","message","reason","path","buildFederatedLoginCookiePath","completeHandoff","group","body","where","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","checkUniqueness","undefined","keepAll","merge","saveWithEA","create","accountConsoleUrl","resolveIdentity","handle","save","providerUserId","providerUserName","pickIdentityCandidate","providerUserEmail","e","confirmLink","_data","consume","account","attributeCandidates","email","requestContext","record","scope","IDENTITY","IDENTITY_PROVIDER_LINKED","refType","IDENTITY_PROVIDER_ACCOUNT","refId","userRealmId","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","providerName","key","candidates","candidate","baseURL","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","clientId","value","httpOnly","sameSite","secure","maxAge","origin","ip","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    ValidatorGroup,\n    base64URLDecode,\n    createNanoID,\n    getURLBasePath,\n    isObject,\n    isUUID,\n} from '@authup/kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n    getRequestHeader,\n    getRequestIP,\n    sendRedirect,\n} from 'routup';\nimport type {\n    IdentityProvider,\n    IdentityProviderAccount,\n    OAuth2AuthorizationCodeRequest,\n    OAuth2IdentityProvider,\n    OpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityProviderAttributesValidator,\n    IdentityProviderValidator,\n    IdentityType,\n    PermissionName,\n    isOAuth2IdentityProvider,\n    isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport { describeError, resolveURL } from '../../../../../utils/index.ts';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { setResponseCookie, unsetResponseCookie, useRequestCookie } from '@routup/basic/cookie';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n    EntityCollectionResponse,\n    EntityRecordResponse,\n    IdentityProviderCreatePayload,\n    IdentityProviderLinkConfirmPayload,\n    IdentityProviderLinkRequestResponse,\n    IdentityProviderSavePayload,\n    IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { IDENTITY_PROVIDER_LOGIN_NOT_PENDING } from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n    IEventService,\n    IIdentityProviderAccountLinkStore,\n    IIdentityProviderAccountManager,\n    IIdentityProviderRepository,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationStateManager,\n    IOAuth2FederatedLoginService,\n    IdentityProviderIdentity,\n    OAuth2AuthorizationState,\n    OAuth2AuthorizationStateLink,\n} from '../../../../../core/index.ts';\nimport {\n    OAUTH2_FEDERATED_LOGIN_COOKIE,\n    OAUTH2_FEDERATED_LOGIN_TTL,\n    OAuth2AuthorizationCodeRequestValidator,\n    RECORD_QUERY_PARAMETERS,\n    createIdentityProviderOAuth2Authenticator,\n    decodeQuery,\n    describeQuerySchema,\n    identityProviderSchema,\n} from '../../../../../core/index.ts';\nimport {\n    applyRouteRealmIDToBody,\n    buildActorContext,\n    getBodyRealmID,\n    getRequestParamID,\n    getRequestRealmID,\n    useRequestEventContext,\n    useRequestIdentityOrFail,\n    useRequestParamID,\n    useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n    protected options: IdentityProviderControllerOptions;\n\n    protected repository: IIdentityProviderRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected linkStore: IIdentityProviderAccountLinkStore;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected stateManager : IOAuth2AuthorizationStateManager;\n\n    protected loginService : IOAuth2FederatedLoginService;\n\n    protected eventService? : IEventService;\n\n    protected logger? : Logger;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: IdentityProviderControllerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.accountManager = ctx.accountManager;\n        this.linkStore = ctx.linkStore;\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n        this.stateManager = ctx.stateManager;\n        this.loginService = ctx.loginService;\n        this.eventService = ctx.eventService;\n        this.logger = ctx.logger;\n    }\n\n    // ---------------------------------------------------------\n\n    // Deliberately anonymous and ungated: the hosted login page lists a\n    // realm's providers before anyone signs in. Safe only because findMany\n    // does not extend with extra attributes, so the response is the schema's\n    // fields.default projection. The record read below carries them and is\n    // gated for exactly that reason.\n    @DGet('', [])\n    async getProviders(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<IdentityProvider>> {\n        const {\n            data,\n            meta,\n        } = await this.repository.findMany(\n            await decodeQuery(useRequestQuery(event), {\n                schema: identityProviderSchema,\n                actor: buildActorContext(event),\n            }),\n        );\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(identityProviderSchema),\n            },\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<IdentityProvider>> {\n        const paramId = useRequestParamID(event, { isUUID: false });\n\n        const entity = await this.repository.findOneByIdOrName(\n            paramId,\n            getRequestRealmID(event),\n        );\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await useRequestPermissionEvaluator(event).evaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n        });\n\n        return { data: entity, meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) } };\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async editProvider(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProvider>> {\n        return this.write(event, { updateOnly: true });\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProvider>> {\n        return this.write(event);\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async dropProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProvider>> {\n        const paramId = useRequestParamID(event);\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n        const entity = await this.repository.findOneBy({ id: paramId });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.remove(entity);\n\n        entity.id = entityId;\n\n        event.response.status = 202;\n\n        return { data: entity, meta: {} };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async addProvider(\n        @DBody() user: IdentityProviderCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProvider>> {\n        return this.write(event);\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('/:id/authorize-out', [])\n    async authorizeOut(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n        }\n\n        // Refused here as well as at the callback, so a disabled provider\n        // costs no provider round trip.\n        if (!entity.enabled) {\n            throw new BadRequestError('The identity provider is not enabled.');\n        }\n\n        // A federated login completes an RP's authorization request: the\n        // callback mints a code bound to that request and delivers it to the\n        // request's redirect_uri. Without one there is nowhere to deliver a\n        // code (the callback used to mint an unbound one and hand it to the\n        // server root, issue #3457), so the login must not start.\n        const query = useRequestQuery(event);\n        if (typeof query.codeRequest !== 'string') {\n            throw OAuth2RequestError.malformed('A federated login requires an authorization code request.');\n        }\n\n        let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n        try {\n            codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n        } catch {\n            throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n        }\n\n        const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n        const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n        if (\n            data.client.realmId &&\n            entity.realmId &&\n            entity.realmId !== data.client.realmId\n        ) {\n            throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n        }\n\n        const authenticator = this.buildProviderAuthenticator(entity);\n\n        // Ties this login to THIS browser. The callback requires the cookie\n        // to match, so a crafted callback URL opened in someone else's\n        // browser cannot make authup establish a session there (login CSRF).\n        // The state's ip / user agent cannot carry that: both are chosen by\n        // whoever mints the state (#3439). Keycloak and Authentik bind the\n        // same hop to a cookie for the same reason.\n        const browserNonce = createNanoID();\n        this.setFederatedLoginCookie(event, browserNonce);\n\n        const state = await this.saveAuthorizationState(event, {\n            codeRequest: data.data,\n            browserNonce,\n        });\n\n        return sendRedirect(event, authenticator.buildRedirectURL({ state }));\n    }\n\n    @DPost('/:id/link-request', [ForceLoggedInMiddleware])\n    async linkRequest(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProviderLinkRequestResponse> {\n        const id = useRequestParamID(event);\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports account linking.');\n        }\n\n        if (!entity.enabled) {\n            throw new BadRequestError('The identity provider is not enabled.');\n        }\n\n        const identity = useRequestIdentityOrFail(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only a user can link an identity provider account.');\n        }\n\n        if (entity.realmId && entity.realmId !== identity.realmId) {\n            throw new BadRequestError('The identity provider does not belong to the user realm.');\n        }\n\n        const authenticator = this.buildProviderAuthenticator(entity);\n\n        const state = await this.saveAuthorizationState(event, { link: { userId: identity.id, providerId: entity.id } });\n\n        return { url: authenticator.buildRedirectURL({ state }) };\n    }\n\n    @DGet('/:id/authorize-in', [])\n    async authorizeIn(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n        }\n\n        const data = await this.verifyAuthorizationState(event);\n\n        const { link } = data;\n        if (link) {\n            return this.completeLink(event, entity, data, link);\n        }\n\n        // authorize-out no longer mints a login state without a code request;\n        // this refuses the ones minted before that (issue #3457).\n        if (!data.codeRequest) {\n            throw OAuth2RequestError.malformed('The state carries no authorization code request.');\n        }\n\n        // The browser that started this login is the only one that may\n        // finish it. Refused before the provider's single-use code is spent\n        // and before any session exists. A state minted before this shipped\n        // carries no nonce and is refused the same way; the hosted page\n        // re-renders the request and the next attempt carries one.\n        const browserNonce = useRequestCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE);\n        if (\n            typeof browserNonce !== 'string' ||\n            !data.browserNonce ||\n            browserNonce !== data.browserNonce\n        ) {\n            return sendRedirect(event, this.buildHostedAuthorizeURL(data.codeRequest).href);\n        }\n\n        const { code, error } = useRequestQuery(event);\n\n        // RFC 6749 section 4.1.2.1: a provider answers a refused or failed\n        // authorization (the person cancelled at the provider, the provider\n        // is down) with `error` and no code. A top-level browser navigation\n        // like every other refusal here, so it lands on the hosted login\n        // again. Nothing of the provider's answer is echoed: whoever controls\n        // the provider's redirect shapes those values.\n        if (typeof error === 'string' && error.length > 0) {\n            // JSON-quoted: a raw query value must not be able to forge a log line\n            this.logger?.info(`The identity provider ${entity.id} answered the authorization with ${JSON.stringify(error.slice(0, 64))}.`);\n\n            return sendRedirect(event, this.buildHostedAuthorizeURL(data.codeRequest).href);\n        }\n\n        if (typeof code !== 'string' || code.length === 0) {\n            throw new BadRequestError('The authorization code is missing.');\n        }\n\n        const result = await this.loginService.complete({\n            provider: entity,\n            codeRequest: data.codeRequest,\n            code,\n            request: {\n                ipAddress: getRequestIP(event),\n                userAgent: getRequestHeader(event, 'user-agent'),\n            },\n        });\n\n        // A refusal is a decision the person at the browser has to be told\n        // about, and this is a top-level navigation, so it lands on the\n        // hosted login rather than in a JSON body (issue #3458). A marker is\n        // only attached when the refusal carries one; without it the page\n        // re-runs the same verifier over the same request and states the\n        // reason itself, so nothing is echoed.\n        const url = this.buildHostedAuthorizeURL(result.codeRequest);\n\n        if (result.kind === 'refused') {\n            if (result.error) {\n                url.searchParams.set('error', result.error);\n            }\n\n            return sendRedirect(event, url.href);\n        }\n\n        // The application's code is NOT minted here. The browser goes back to\n        // the hosted authorize page, which completes the login and runs the\n        // ladder an interactive login runs (prompt freshness, consent) before\n        // any code exists (plan 094). So a custom-scheme redirect_uri needs no\n        // interstitial on this leg either: it is navigated at the end of the\n        // ladder, exactly as it is for an interactive login.\n        //\n        // The pending login rides a cookie rather than the URL, which is what\n        // Keycloak and Authentik both do: only the browser that started the\n        // login carries it, no other origin can set it, and nothing redeemable\n        // reaches history, a log or a referrer. `SameSite=Lax` keeps it off\n        // cross-site requests, so a page on another origin cannot drive the\n        // completion. `provider` stays in the URL as a routing hint, and is no\n        // secret.\n        this.setFederatedLoginCookie(event, result.pendingLoginId);\n\n        url.searchParams.set('provider', entity.id);\n\n        return sendRedirect(event, url.href);\n    }\n\n    @DPost('/:id/login-complete', [])\n    async completeLogin(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<OAuth2TokenGrantResponse> {\n        const id = useRequestParamID(event);\n\n        this.assertSameOrigin(event);\n\n        const pendingLoginId = useRequestCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE);\n        if (typeof pendingLoginId !== 'string' || pendingLoginId.length === 0) {\n            // Marked, because this refusal alone means the completion never\n            // began: the caller was not in a federated login at all. The\n            // hosted page reads it to skip the session teardown it performs\n            // for a redemption that genuinely failed.\n            throw new BadRequestError({\n                message: 'The login request is unknown or expired.',\n                data: { reason: IDENTITY_PROVIDER_LOGIN_NOT_PENDING },\n            });\n        }\n\n        // Cleared whichever way the completion goes: it is single use, and a\n        // cookie outliving its pending login only produces a confusing\n        // refusal on some later page load.\n        unsetResponseCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE, { path: this.buildFederatedLoginCookiePath() });\n\n        return this.loginService.completeHandoff({\n            pendingLoginId,\n            providerId: id,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    private async write(event: IAppEvent, options: {\n        updateOnly?: boolean\n    } = {}): Promise<EntityRecordResponse<IdentityProvider>> {\n        let group: string;\n        const id = getRequestParamID(event, { isUUID: false });\n        const body = await readRequestBody(event);\n        applyRouteRealmIDToBody(event, body);\n        const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n        let entity: IdentityProvider | null | undefined;\n        if (id) {\n            const where: Record<string, any> = {};\n            if (isUUID(id)) {\n                where.id = id;\n            } else {\n                where.name = id;\n            }\n\n            if (realmId) {\n                where.realmId = realmId;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        if (entity) {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validator = new IdentityProviderValidator();\n        const data = await validator.run(body, { group });\n\n        const attributesValidator = new IdentityProviderAttributesValidator();\n        const attributes = await attributesValidator.run(body);\n\n        await this.repository.validateJoinColumns(data);\n\n        if (entity) {\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...data,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? entity.realmId ?? null,\n                }),\n            });\n        } else {\n            if (!data.realmId) {\n                const identity = useRequestIdentityOrFail(event);\n                data.realmId = identity.realmId;\n            }\n\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_CREATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? null }),\n            });\n        }\n\n        await this.repository.checkUniqueness(data, entity || undefined);\n\n        if (entity) {\n            // A partial update must not delete attributes it never mentioned.\n            // The payload is partial by contract, so automation written before\n            // `requiredAmr` / `requiredAcr` existed would otherwise turn the\n            // upstream assurance gate off by saying nothing about it. A caller\n            // clears an attribute by sending it as `null`, which is what the\n            // console submits for a blank field.\n            //\n            // A protocol switch is the exception and still replaces: the old\n            // protocol's rows (an LDAP bind password) are dead configuration\n            // no code reads any more, and keeping them leaves a secret behind.\n            const keepAll = entity.protocol === data.protocol;\n\n            entity = this.repository.merge(entity, data);\n            await this.repository.saveWithEA(entity, attributes, { keepAll });\n\n            event.response.status = 202;\n\n            return { data: entity, meta: {} };\n        }\n\n        entity = this.repository.create(data);\n        await this.repository.saveWithEA(entity, attributes);\n\n        event.response.status = 201;\n\n        return { data: entity, meta: {} };\n    }\n\n    // ---------------------------------------------------------\n\n    /**\n     * Callback half of the account-linking round-trip (plan 091): the\n     * external identity is bound to the state-referenced user instead of\n     * running the login path. No auth code and no session is minted; the\n     * browser lands back on the account console with a marker param.\n     */\n    private async completeLink(\n        event: IAppEvent,\n        provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n        state: OAuth2AuthorizationState,\n        link: OAuth2AuthorizationStateLink,\n    ) {\n        // Fixed, server-derived return target (the account console page).\n        // No client-supplied redirect exists on this path.\n        const url = new URL(resolveURL(this.options.accountConsoleUrl, 'connected-accounts'));\n\n        const { code } = useRequestQuery(event);\n\n        try {\n            // The state is bound to the provider it was minted for, and the\n            // provider must still be enabled at completion — a state cannot\n            // be replayed against a different provider's callback, nor\n            // complete a link after its provider was disabled.\n            if (link.providerId !== provider.id || !provider.enabled) {\n                throw new BadRequestError('The identity provider is not available for account linking.');\n            }\n\n            if (typeof code !== 'string' || code.length === 0) {\n                throw new BadRequestError('The authorization code is missing.');\n            }\n\n            const authenticator = this.buildProviderAuthenticator(provider);\n\n            const identity = await authenticator.resolveIdentity({ code });\n\n            // A provider answering without a subject has nothing to bind. The\n            // callback used to reach `link()`, which rejected it; the stash\n            // would otherwise carry an empty providerUserId to the confirm.\n            if (!identity.id) {\n                throw new BadRequestError('The identity provider returned no subject.');\n            }\n\n            // Nothing is written here. This request is unauthenticated — the\n            // browser round-trip cannot carry a bearer — so the only thing\n            // distinguishing the browser that started the link from any other\n            // would be the state's ip / user-agent binding, and both values\n            // are chosen by whoever minted the state. An attacker minting a\n            // state carrying their OWN userId and getting a victim to follow\n            // it would otherwise bind the VICTIM's external identity to the\n            // attacker's account (issue #3439).\n            //\n            // The resolved identity is stashed under a one-time handle\n            // instead, and the account console confirms it with its bearer.\n            // The stash keeps the requesting userId so the confirm can\n            // require it to equal the AUTHENTICATED user: the handle is a\n            // URL parameter, so it reaches browser history and proxy logs,\n            // and on its own it must authorize nothing.\n            const handle = await this.linkStore.save({\n                providerId: provider.id,\n                userId: link.userId,\n                providerUserId: identity.id,\n                providerUserName: this.pickIdentityCandidate(identity, 'name'),\n                providerUserEmail: this.pickIdentityCandidate(identity, 'email'),\n            });\n\n            url.searchParams.set('linkHandle', handle);\n            url.searchParams.set('provider', provider.id);\n        } catch (e) {\n            // The failure is swallowed into a redirect marker, so the log is\n            // the only surface it can reach. Without this an unreachable or\n            // rejecting provider is indistinguishable from a stale state.\n            this.logger?.error(describeError(e, 'The identity-provider account link failed.'));\n\n            url.searchParams.set('linkError', 'link_failed');\n        }\n\n        return sendRedirect(event, url.href);\n    }\n\n    /**\n     * The bearer-authenticated half of the link (issue #3439): the account\n     * row is written here, for the AUTHENTICATED user, never in the callback.\n     */\n    @DPost('/:id/link-confirm', [ForceLoggedInMiddleware])\n    async confirmLink(\n        @DPath('id') _id: string,\n        @DBody() _data: IdentityProviderLinkConfirmPayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<IdentityProviderAccount>> {\n        const id = useRequestParamID(event);\n        const provider = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(provider) && !isOpenIDIdentityProvider(provider)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports account linking.');\n        }\n\n        if (!provider.enabled) {\n            throw new BadRequestError('The identity provider is not enabled.');\n        }\n\n        const identity = useRequestIdentityOrFail(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only a user can link an identity provider account.');\n        }\n\n        const body = await readRequestBody(event);\n        const handle = isObject(body) ? body.handle : undefined;\n        if (typeof handle !== 'string' || handle.length === 0) {\n            throw new BadRequestError('The account link handle is missing.');\n        }\n\n        const link = await this.linkStore.consume(handle);\n        if (!link) {\n            throw new BadRequestError('The account link request is unknown or expired.');\n        }\n\n        // The two checks that make the handle inert on its own: it may only\n        // be redeemed by the user it was minted for, and only against the\n        // provider it was minted for.\n        if (link.userId !== identity.id || link.providerId !== provider.id) {\n            throw new BadRequestError('The account link request does not belong to the authenticated user.');\n        }\n\n        const account = await this.accountManager.link(\n            {\n                id: link.providerUserId,\n                // deliberately rebuilt from the stashed scalars: the resolved\n                // identity carries the provider secret and the raw external\n                // token payload, neither of which belongs in a cache\n                attributeCandidates: {\n                    name: [link.providerUserName],\n                    email: [link.providerUserEmail],\n                },\n                data: {},\n                provider,\n            },\n            identity.id,\n        );\n\n        // the confirm runs under a bearer, so unlike the callback it CAN be\n        // attributed to a session and a route (the unlink emit's shape)\n        const requestContext = useRequestEventContext();\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.IDENTITY_PROVIDER_LINKED,\n            refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,\n            refId: account.id,\n            realmId: account.userRealmId ?? provider.realmId ?? null,\n            actorType: IdentityType.USER,\n            actorId: account.userId,\n            actorName: identity.data.name ?? null,\n            sessionId: requestContext?.sessionId ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? getRequestIP(event) ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? getRequestHeader(event, 'user-agent') ?? null,\n            data: { providerId: provider.id, providerName: provider.name },\n        });\n\n        return { data: account, meta: {} };\n    }\n\n    private pickIdentityCandidate(\n        identity: IdentityProviderIdentity,\n        key: 'name' | 'email',\n    ) : string | null {\n        const candidates = identity.attributeCandidates?.[key] || [];\n        for (const candidate of candidates) {\n            if (typeof candidate === 'string' && candidate.length > 0) {\n                return candidate;\n            }\n        }\n\n        return null;\n    }\n\n    // ---------------------------------------------------------\n\n    private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n        const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n        const codeRequestKeys = Object.keys(codeRequest);\n        for (const codeRequestKey_ of codeRequestKeys) {\n            const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n            const codeRequestValue = codeRequest[codeRequestKey];\n            // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n            // treats as prompt=login) — only skip absent ones.\n            if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n                url.searchParams.set(codeRequestKey, String(codeRequestValue));\n            }\n        }\n\n        return url;\n    }\n\n    // ---------------------------------------------------------\n\n    private async resolve(id: string) {\n        const entity = await this.repository.findOneById(id);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private buildProviderAuthenticator(\n        provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n        options: { clientId?: string } = {},\n    ) {\n        return createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider,\n            logger: this.logger,\n            options: {\n                baseURL: this.options.baseURL,\n                clientId: options.clientId,\n            },\n        });\n    }\n\n    /**\n     * Scoped to the routes that read it, so the cookie never rides an\n     * ordinary API request, and to publicUrl's base path, since a sub-path\n     * deployment mounts every route under it.\n     */\n    private buildFederatedLoginCookiePath() : string {\n        return `${getURLBasePath(this.options.baseURL)}/identity-providers`;\n    }\n\n    private setFederatedLoginCookie(event: IAppEvent, value: string) : void {\n        setResponseCookie(event, OAUTH2_FEDERATED_LOGIN_COOKIE, value, {\n            httpOnly: true,\n            sameSite: 'lax',\n            // The scheme is read from the parsed URL rather than the raw\n            // string: `publicUrl` is validated but never canonicalized, so a\n            // configured `HTTPS://...` would leave a prefix test false and\n            // drop the flag from the one cookie the login is bound to.\n            secure: new URL(this.options.baseURL).protocol === 'https:',\n            path: this.buildFederatedLoginCookiePath(),\n            maxAge: OAUTH2_FEDERATED_LOGIN_TTL / 1000,\n        });\n    }\n\n    /**\n     * The completion answers with a token pair and authenticates on a cookie\n     * alone, so it must be reachable only from the hosted page's own origin.\n     *\n     * CORS cannot carry that here: the default reflects every origin WITH\n     * credentials, and `SameSite` is scoped to the registrable domain rather\n     * than the origin, so a sibling subdomain's script is same-site and would\n     * both send the cookie and be allowed to read the response. A browser\n     * sends `Origin` on every POST, so requiring it to be publicUrl's own is\n     * what closes that. A request without the header is not a browser and\n     * carries no cookie of ours to begin with.\n     */\n    private assertSameOrigin(event: IAppEvent) : void {\n        const origin = getRequestHeader(event, 'origin');\n        if (typeof origin !== 'string' || origin.length === 0) {\n            return;\n        }\n\n        if (origin !== new URL(this.options.baseURL).origin) {\n            throw new BadRequestError('The login request is unknown or expired.');\n        }\n    }\n\n    private async saveAuthorizationState(\n        event: IAppEvent,\n        data: Pick<OAuth2AuthorizationState, 'codeRequest' | 'link' | 'browserNonce'> = {},\n    ) : Promise<string> {\n        return this.stateManager.save({\n            ...data,\n            ip: getRequestIP(event) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n        const query = useRequestQuery(event);\n        if (typeof query.state !== 'string') {\n            throw OAuth2RequestError.stateInvalid();\n        }\n\n        return this.stateManager.verify(query.state, {\n            ip: getRequestIP(event) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4GA,IAAa2D,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKV,UAAUU,IAAIV;EACnB,KAAKC,aAAaS,IAAIT;EACtB,KAAKC,iBAAiBQ,IAAIR;EAC1B,KAAKC,YAAYO,IAAIP;EACrB,KAAKC,sBAAsBM,IAAIN;EAC/B,KAAKC,uBAAuB,IAAItB,wCAAAA;EAChC,KAAKuB,eAAeI,IAAIJ;EACxB,KAAKC,eAAeG,IAAIH;EACxB,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,SAASC,IAAID;CACtB;CASA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKb,WAAWc,SACtB,MAAM7B,YAAYb,gBAAgBuC,KAAAA,GAAQ;GACtCI,QAAQ5B;GACR6B,OAAO3B,kBAAkBsB,KAAAA;EAC7B,CAAA,CAAA;EAGJ,OAAO;GACHC;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQ7B,oBAAoBC,sBAAAA;GAChC;EACJ;CACJ;CAEA,MACM8B,YACF,IACA,OAC+C;EAC/C,MAAME,UAAUxB,kBAAkBgB,OAAO,EAAEjE,QAAQ,MAAM,CAAA;EAEzD,MAAM0E,SAAS,MAAM,KAAKpB,WAAWqB,kBACjCF,SACA3B,kBAAkBmB,KAAAA,CAAAA;EAGtB,IAAI,CAACS,QACD,MAAM,IAAInD,oBAAAA;EAGd,MAAM2B,8BAA8Be,KAAAA,CAAAA,CAAOW,cAAc;GACrDC,MAAM;IACF1D,eAAe2D;IACf3D,eAAe4D;IACf5D,eAAe6D;GAClB;GACDd,MAAMxE,iBAAiB;KAAGD,kBAAkBwF,aAAaP;KAASjF,kBAAkByF,cAAcR,OAAOS,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,OAAO;GAAEjB,MAAMQ;GAAQP,MAAM,EAAEE,QAAQ7B,oBAAoBC,wBAAwBJ,uBAAAA,EAAyB;EAAE;CAClH;CAEA,MACM+C,aACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKE,MAAMrB,OAAO,EAAEsB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKF,MAAMrB,KAAAA;CACtB;CAEA,MACMwB,aACF,IACA,OACgD;EAChD,MAAMhB,UAAUxB,kBAAkBgB,KAAAA;EAElC,MAAMyB,sBAAsBxC,8BAA8Be,KAAAA;EAC1D,MAAMyB,oBAAoBC,YAAY,EAAEd,MAAM1D,eAAe6D,yBAAyB,CAAA;EAEtF,MAAMN,SAAS,MAAM,KAAKpB,WAAWsC,UAAU,EAAEpB,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAInD,oBAAAA;EAGd,MAAMmE,oBAAoBG,SAAS;GAC/BhB,MAAM1D,eAAe6D;GACrBd,MAAMxE,iBAAiB;KAAGD,kBAAkBwF,aAAaP;KAASjF,kBAAkByF,cAAcR,OAAOS,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,MAAM,EAAEX,IAAIsB,aAAapB;EAEzB,MAAM,KAAKpB,WAAWyC,OAAOrB,MAAAA;EAE7BA,OAAOF,KAAKsB;EAEZ7B,MAAM+B,SAASC,SAAS;EAExB,OAAO;GAAE/B,MAAMQ;GAAQP,MAAM,CAAC;EAAE;CACpC;CAEA,MACM+B,YACF,MACA,OACgD;EAChD,OAAO,KAAKZ,MAAMrB,KAAAA;CACtB;CAIA,MACMkC,aACF,KACA,OACF;EACE,MAAM3B,KAAKvB,kBAAkBgB,KAAAA;EAC7B,MAAMS,SAAS,MAAM,KAAK2B,QAAQ7B,EAAAA;EAElC,IAAI,CAACpD,yBAAyBsD,MAAAA,KAAW,CAACrD,yBAAyBqD,MAAAA,GAC/D,MAAM,IAAIpD,gBAAgB,oFAAA;EAK9B,IAAI,CAACoD,OAAO4B,SACR,MAAM,IAAIhF,gBAAgB,uCAAA;EAQ9B,MAAMiF,QAAQ7E,gBAAgBuC,KAAAA;EAC9B,IAAI,OAAOsC,MAAMC,gBAAgB,UAC7B,MAAMzE,mBAAmB0E,UAAU,2DAAA;EAGvC,IAAIC;EAEJ,IAAI;GACAA,qBAAqBC,KAAKC,MAAMhH,gBAAgB2G,MAAMC,WAAW,CAAA;EACrE,QAAQ;GACJ,MAAMzE,mBAAmB0E,UAAU,sDAAA;EACvC;EAEA,MAAMI,uBAAuB,MAAM,KAAKnD,qBAAqBoD,IAAIJ,kBAAAA;EACjE,MAAMxC,OAAO,MAAM,KAAKT,oBAAoBsD,OAAOF,oBAAAA;EAEnD,IACI3C,KAAK8C,OAAO7B,WACZT,OAAOS,WACPT,OAAOS,YAAYjB,KAAK8C,OAAO7B,SAE/B,MAAMpD,mBAAmB0E,UAAU,6CAAA;EAGvC,MAAMQ,gBAAgB,KAAKC,2BAA2BxC,MAAAA;EAQtD,MAAMyC,eAAetH,aAAAA;EACrB,KAAKuH,wBAAwBnD,OAAOkD,YAAAA;EAEpC,MAAME,QAAQ,MAAM,KAAKC,uBAAuBrD,OAAO;GACnDuC,aAAatC,KAAKA;GAClBiD;EACJ,CAAA;EAEA,OAAOvG,aAAaqD,OAAOgD,cAAcM,iBAAiB,EAAEF,MAAM,CAAA,CAAA;CACtE;CAEA,MACMG,YACF,KACA,OAC6C;EAC7C,MAAMhD,KAAKvB,kBAAkBgB,KAAAA;EAC7B,MAAMS,SAAS,MAAM,KAAK2B,QAAQ7B,EAAAA;EAElC,IAAI,CAACpD,yBAAyBsD,MAAAA,KAAW,CAACrD,yBAAyBqD,MAAAA,GAC/D,MAAM,IAAIpD,gBAAgB,iFAAA;EAG9B,IAAI,CAACoD,OAAO4B,SACR,MAAM,IAAIhF,gBAAgB,uCAAA;EAG9B,MAAMmG,WAAWzE,yBAAyBiB,KAAAA;EAC1C,IAAIwD,SAASC,SAASxG,aAAayG,MAC/B,MAAM,IAAIrG,gBAAgB,oDAAA;EAG9B,IAAIoD,OAAOS,WAAWT,OAAOS,YAAYsC,SAAStC,SAC9C,MAAM,IAAI7D,gBAAgB,0DAAA;EAG9B,MAAM2F,gBAAgB,KAAKC,2BAA2BxC,MAAAA;EAEtD,MAAM2C,QAAQ,MAAM,KAAKC,uBAAuBrD,OAAO,EAAE2D,MAAM;GAAEC,QAAQJ,SAASjD;GAAIsD,YAAYpD,OAAOF;EAAG,EAAE,CAAA;EAE9G,OAAO,EAAEuD,KAAKd,cAAcM,iBAAiB,EAAEF,MAAM,CAAA,EAAG;CAC5D;CAEA,MACMW,YACF,KACA,OACF;EACE,MAAMxD,KAAKvB,kBAAkBgB,KAAAA;EAE7B,MAAMS,SAAS,MAAM,KAAK2B,QAAQ7B,EAAAA;EAElC,IAAI,CAACpD,yBAAyBsD,MAAAA,KAAW,CAACrD,yBAAyBqD,MAAAA,GAC/D,MAAM,IAAIuD,MAAM,yBAAyBvD,OAAOwD,SAAS,eAAe;EAG5E,MAAMhE,OAAO,MAAM,KAAKiE,yBAAyBlE,KAAAA;EAEjD,MAAM,EAAE2D,SAAS1D;EACjB,IAAI0D,MACA,OAAO,KAAKQ,aAAanE,OAAOS,QAAQR,MAAM0D,IAAAA;EAKlD,IAAI,CAAC1D,KAAKsC,aACN,MAAMzE,mBAAmB0E,UAAU,kDAAA;EAQvC,MAAMU,eAAetF,iBAAiBoC,OAAO/B,6BAAAA;EAC7C,IACI,OAAOiF,iBAAiB,YACxB,CAACjD,KAAKiD,gBACNA,iBAAiBjD,KAAKiD,cAEtB,OAAOvG,aAAaqD,OAAO,KAAKoE,wBAAwBnE,KAAKsC,WAAW,CAAA,CAAE8B,IAAI;EAGlF,MAAM,EAAEC,MAAMC,UAAU9G,gBAAgBuC,KAAAA;EAQxC,IAAI,OAAOuE,UAAU,YAAYA,MAAMC,SAAS,GAAG;GAE/C,KAAK3E,QAAQ4E,KAAK,yBAAyBhE,OAAOF,GAAG,mCAAmCmC,KAAKgC,UAAUH,MAAMI,MAAM,GAAG,EAAA,CAAA,EAAK,EAAE;GAE7H,OAAOhI,aAAaqD,OAAO,KAAKoE,wBAAwBnE,KAAKsC,WAAW,CAAA,CAAE8B,IAAI;EAClF;EAEA,IAAI,OAAOC,SAAS,YAAYA,KAAKE,WAAW,GAC5C,MAAM,IAAInH,gBAAgB,oCAAA;EAG9B,MAAMuH,SAAS,MAAM,KAAKjF,aAAakF,SAAS;GAC5CC,UAAUrE;GACV8B,aAAatC,KAAKsC;GAClB+B;GACAS,SAAS;IACLC,WAAWtI,aAAasD,KAAAA;IACxBiF,WAAWxI,iBAAiBuD,OAAO,YAAA;GACvC;EACJ,CAAA;EAQA,MAAM8D,MAAM,KAAKM,wBAAwBQ,OAAOrC,WAAW;EAE3D,IAAIqC,OAAOM,SAAS,WAAW;GAC3B,IAAIN,OAAOL,OACPT,IAAIqB,aAAaC,IAAI,SAASR,OAAOL,KAAK;GAG9C,OAAO5H,aAAaqD,OAAO8D,IAAIO,IAAI;EACvC;EAgBA,KAAKlB,wBAAwBnD,OAAO4E,OAAOS,cAAc;EAEzDvB,IAAIqB,aAAaC,IAAI,YAAY3E,OAAOF,EAAE;EAE1C,OAAO5D,aAAaqD,OAAO8D,IAAIO,IAAI;CACvC;CAEA,MACMiB,cACF,KACA,OACkC;EAClC,MAAM/E,KAAKvB,kBAAkBgB,KAAAA;EAE7B,KAAKuF,iBAAiBvF,KAAAA;EAEtB,MAAMqF,iBAAiBzH,iBAAiBoC,OAAO/B,6BAAAA;EAC/C,IAAI,OAAOoH,mBAAmB,YAAYA,eAAeb,WAAW,GAKhE,MAAM,IAAInH,gBAAgB;GACtBmI,SAAS;GACTvF,MAAM,EAAEwF,QAAQ1H,oCAAoC;EACxD,CAAA;EAMJJ,oBAAoBqC,OAAO/B,+BAA+B,EAAEyH,MAAM,KAAKC,8BAA6B,EAAG,CAAA;EAEvG,OAAO,KAAKhG,aAAaiG,gBAAgB;GACrCP;GACAxB,YAAYtD;EAChB,CAAA;CACJ;CAIA,MAAcc,MAAMrB,OAAkBZ,UAElC,CAAC,GAAoD;EACrD,IAAIyG;EACJ,MAAMtF,KAAK3B,kBAAkBoB,OAAO,EAAEjE,QAAQ,MAAM,CAAA;EACpD,MAAM+J,OAAO,MAAMjI,gBAAgBmC,KAAAA;EACnCvB,wBAAwBuB,OAAO8F,IAAAA;EAC/B,MAAM5E,UAAUrC,kBAAkBmB,KAAAA,KAAUrB,eAAemH,IAAAA;EAE3D,IAAIrF;EACJ,IAAIF,IAAI;GACJ,MAAMwF,QAA6B,CAAC;GACpC,IAAIhK,OAAOwE,EAAAA,GACPwF,MAAMxF,KAAKA;QAEXwF,MAAMnF,OAAOL;GAGjB,IAAIW,SACA6E,MAAM7E,UAAUA;GAGpBT,SAAS,MAAM,KAAKpB,WAAWsC,UAAUoE,KAAAA;GAGzC,IAAI,CAACtF,WAAWrB,QAAQkC,cAAcyE,MAAMxF,KACxC,MAAM,IAAIjD,oBAAAA;EAElB,OAAO,IAAI8B,QAAQkC,YACf,MAAM,IAAIhE,oBAAAA;EAGd,MAAMmE,sBAAsBxC,8BAA8Be,KAAAA;EAC1D,IAAIS,QAAQ;GACR,MAAMgB,oBAAoBC,YAAY,EAAEd,MAAM1D,eAAe4D,yBAAyB,CAAA;GAEtF+E,QAAQnK,eAAesK;EAC3B,OAAO;GACH,MAAMvE,oBAAoBC,YAAY,EAAEd,MAAM1D,eAAe+I,yBAAyB,CAAA;GAEtFJ,QAAQnK,eAAewK;EAC3B;EAGA,MAAMjG,OAAO,MAAMkG,IADGnJ,0BACHmJ,CAAAA,CAAUtD,IAAIiD,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMQ,aAAa,MAAMD,IADOrJ,oCACPqJ,CAAAA,CAAoBvD,IAAIiD,IAAAA;EAEjD,MAAM,KAAKzG,WAAWiH,oBAAoBrG,IAAAA;EAE1C,IAAIQ,QACA,MAAMgB,oBAAoBG,SAAS;GAC/BhB,MAAM1D,eAAe4D;GACrBb,MAAMxE,iBAAiB;KAClBD,kBAAkBwF,aAAa;KAC5B,GAAGP;KACH,GAAGR;IACP;KACCzE,kBAAkByF,cAAchB,KAAKiB,WAAWT,OAAOS,WAAW;GACvE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACjB,KAAKiB,SAENjB,KAAKiB,UADYnC,yBAAyBiB,KAC3BwD,CAAAA,CAAStC;GAG5B,MAAMO,oBAAoBG,SAAS;IAC/BhB,MAAM1D,eAAe+I;IACrBhG,MAAMxE,iBAAiB;MAAGD,kBAAkBwF,aAAaf;MAAOzE,kBAAkByF,cAAchB,KAAKiB,WAAW;IAAK,CAAA;GACzH,CAAA;EACJ;EAEA,MAAM,KAAK7B,WAAWkH,gBAAgBtG,MAAMQ,UAAU+F,KAAAA,CAAAA;EAEtD,IAAI/F,QAAQ;GAWR,MAAMgG,UAAUhG,OAAOwD,aAAahE,KAAKgE;GAEzCxD,SAAS,KAAKpB,WAAWqH,MAAMjG,QAAQR,IAAAA;GACvC,MAAM,KAAKZ,WAAWsH,WAAWlG,QAAQ4F,YAAY,EAAEI,QAAQ,CAAA;GAE/DzG,MAAM+B,SAASC,SAAS;GAExB,OAAO;IAAE/B,MAAMQ;IAAQP,MAAM,CAAC;GAAE;EACpC;EAEAO,SAAS,KAAKpB,WAAWuH,OAAO3G,IAAAA;EAChC,MAAM,KAAKZ,WAAWsH,WAAWlG,QAAQ4F,UAAAA;EAEzCrG,MAAM+B,SAASC,SAAS;EAExB,OAAO;GAAE/B,MAAMQ;GAAQP,MAAM,CAAC;EAAE;CACpC;;;;;;IAUA,MAAciE,aACVnE,OACA8E,UACA1B,OACAO,MACF;EAGE,MAAMG,MAAM,IAAI9F,IAAIR,WAAW,KAAK4B,QAAQyH,mBAAmB,oBAAA,CAAA;EAE/D,MAAM,EAAEvC,SAAS7G,gBAAgBuC,KAAAA;EAEjC,IAAI;GAKA,IAAI2D,KAAKE,eAAeiB,SAASvE,MAAM,CAACuE,SAASzC,SAC7C,MAAM,IAAIhF,gBAAgB,6DAAA;GAG9B,IAAI,OAAOiH,SAAS,YAAYA,KAAKE,WAAW,GAC5C,MAAM,IAAInH,gBAAgB,oCAAA;GAK9B,MAAMmG,WAAW,MAFK,KAAKP,2BAA2B6B,QAE/B9B,CAAAA,CAAc8D,gBAAgB,EAAExC,KAAK,CAAA;GAK5D,IAAI,CAACd,SAASjD,IACV,MAAM,IAAIlD,gBAAgB,4CAAA;GAkB9B,MAAM0J,SAAS,MAAM,KAAKxH,UAAUyH,KAAK;IACrCnD,YAAYiB,SAASvE;IACrBqD,QAAQD,KAAKC;IACbqD,gBAAgBzD,SAASjD;IACzB2G,kBAAkB,KAAKC,sBAAsB3D,UAAU,MAAA;IACvD4D,mBAAmB,KAAKD,sBAAsB3D,UAAU,OAAA;GAC5D,CAAA;GAEAM,IAAIqB,aAAaC,IAAI,cAAc2B,MAAAA;GACnCjD,IAAIqB,aAAaC,IAAI,YAAYN,SAASvE,EAAE;EAChD,SAAS8G,GAAG;GAIR,KAAKxH,QAAQ0E,MAAMhH,cAAc8J,GAAG,4CAAA,CAAA;GAEpCvD,IAAIqB,aAAaC,IAAI,aAAa,aAAA;EACtC;EAEA,OAAOzI,aAAaqD,OAAO8D,IAAIO,IAAI;CACvC;;;;IAMA,MACMiD,YACF,KACA,OACA,OACuD;EACvD,MAAM/G,KAAKvB,kBAAkBgB,KAAAA;EAC7B,MAAM8E,WAAW,MAAM,KAAK1C,QAAQ7B,EAAAA;EAEpC,IAAI,CAACpD,yBAAyB2H,QAAAA,KAAa,CAAC1H,yBAAyB0H,QAAAA,GACjE,MAAM,IAAIzH,gBAAgB,iFAAA;EAG9B,IAAI,CAACyH,SAASzC,SACV,MAAM,IAAIhF,gBAAgB,uCAAA;EAG9B,MAAMmG,WAAWzE,yBAAyBiB,KAAAA;EAC1C,IAAIwD,SAASC,SAASxG,aAAayG,MAC/B,MAAM,IAAIrG,gBAAgB,oDAAA;EAG9B,MAAMyI,OAAO,MAAMjI,gBAAgBmC,KAAAA;EACnC,MAAM+G,SAASjL,SAASgK,IAAAA,IAAQA,KAAKiB,SAASP,KAAAA;EAC9C,IAAI,OAAOO,WAAW,YAAYA,OAAOvC,WAAW,GAChD,MAAM,IAAInH,gBAAgB,qCAAA;EAG9B,MAAMsG,OAAO,MAAM,KAAKpE,UAAUiI,QAAQT,MAAAA;EAC1C,IAAI,CAACpD,MACD,MAAM,IAAItG,gBAAgB,iDAAA;EAM9B,IAAIsG,KAAKC,WAAWJ,SAASjD,MAAMoD,KAAKE,eAAeiB,SAASvE,IAC5D,MAAM,IAAIlD,gBAAgB,qEAAA;EAG9B,MAAMoK,UAAU,MAAM,KAAKnI,eAAeqE,KACtC;GACIpD,IAAIoD,KAAKsD;GAITS,qBAAqB;IACjB9G,MAAM,CAAC+C,KAAKuD,gBAAiB;IAC7BS,OAAO,CAAChE,KAAKyD,iBAAkB;GACnC;GACAnH,MAAM,CAAC;GACP6E;EACJ,GACAtB,SAASjD,EAAE;EAKf,MAAMqH,iBAAiB9I,uBAAAA;EAEvB,MAAM,KAAKc,cAAciI,OAAO;GAC5BC,OAAOhL,WAAWiL;GAClBnH,MAAMhE,UAAUoL;GAChBC,SAASpL,aAAaqL;GACtBC,OAAOV,QAAQlH;GACfW,SAASuG,QAAQW,eAAetD,SAAS5D,WAAW;GACpDmH,WAAWpL,aAAayG;GACxB4E,SAASb,QAAQ7D;GACjB2E,WAAW/E,SAASvD,KAAKW,QAAQ;GACjC4H,WAAWZ,gBAAgBY,aAAa;GACxCC,aAAab,gBAAgBa,eAAe;GAC5CC,eAAed,gBAAgBc,iBAAiB;GAChDC,kBAAkBf,gBAAgBe,oBAAoBjM,aAAasD,KAAAA,KAAU;GAC7E4I,kBAAkBhB,gBAAgBgB,oBAAoBnM,iBAAiBuD,OAAO,YAAA,KAAiB;GAC/FC,MAAM;IAAE4D,YAAYiB,SAASvE;IAAIsI,cAAc/D,SAASlE;GAAK;EACjE,CAAA;EAEA,OAAO;GAAEX,MAAMwH;GAASvH,MAAM,CAAC;EAAE;CACrC;CAEQiH,sBACJ3D,UACAsF,KACc;EACd,MAAMC,aAAavF,SAASkE,sBAAsBoB,QAAQ,CAAA;EAC1D,KAAK,MAAME,aAAaD,YACpB,IAAI,OAAOC,cAAc,YAAYA,UAAUxE,SAAS,GACpD,OAAOwE;EAIf,OAAO;CACX;CAIQ5E,wBAAwB7B,aAAkD;EAC9E,MAAMuB,MAAM,IAAI9F,IAAIR,WAAW,KAAK4B,QAAQ6J,SAAS,WAAA,CAAA;EAErD,MAAMC,kBAAkBC,OAAOC,KAAK7G,WAAAA;EACpC,KAAK,MAAM8G,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmBhH,YAAY+G;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChEzF,IAAIqB,aAAaC,IAAIkE,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAOzF;CACX;CAIA,MAAc1B,QAAQ7B,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAKpB,WAAWoK,YAAYlJ,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAInD,oBAAAA;EAGd,OAAOmD;CACX;CAIQwC,2BACJ6B,UACA1F,UAAiC,CAAC,GACpC;EACE,OAAOf,0CAA0C;GAC7CiB,gBAAgB,KAAKA;GACrBwF;GACAjF,QAAQ,KAAKA;GACbT,SAAS;IACL6J,SAAS,KAAK7J,QAAQ6J;IACtBS,UAAUtK,QAAQsK;GACtB;EACJ,CAAA;CACJ;;;;;IAOA,gCAAiD;EAC7C,OAAO,GAAG7N,eAAe,KAAKuD,QAAQ6J,OAAO,EAAE;CACnD;CAEQ9F,wBAAwBnD,OAAkB2J,OAAsB;EACpEjM,kBAAkBsC,OAAO/B,+BAA+B0L,OAAO;GAC3DC,UAAU;GACVC,UAAU;GAKVC,QAAQ,IAAI9L,IAAI,KAAKoB,QAAQ6J,OAAO,CAAA,CAAEhF,aAAa;GACnDyB,MAAM,KAAKC,8BAA6B;GACxCoE,QAAQ7L,6BAA6B;EACzC,CAAA;CACJ;;;;;;;;;;;;IAcA,iBAAyB8B,OAAyB;EAC9C,MAAMgK,SAASvN,iBAAiBuD,OAAO,QAAA;EACvC,IAAI,OAAOgK,WAAW,YAAYA,OAAOxF,WAAW,GAChD;EAGJ,IAAIwF,WAAW,IAAIhM,IAAI,KAAKoB,QAAQ6J,OAAO,CAAA,CAAEe,QACzC,MAAM,IAAI3M,gBAAgB,0CAAA;CAElC;CAEA,MAAcgG,uBACVrD,OACAC,OAAgF,CAAC,GACjE;EAChB,OAAO,KAAKP,aAAasH,KAAK;GAC1B,GAAG/G;GACHgK,IAAIvN,aAAasD,KAAAA,KAAU;GAC3BiF,WAAWxI,iBAAiBuD,OAAO,YAAA,KAAiBwG,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBlE,OAAqD;EACxF,MAAMsC,QAAQ7E,gBAAgBuC,KAAAA;EAC9B,IAAI,OAAOsC,MAAMc,UAAU,UACvB,MAAMtF,mBAAmBoM,aAAY;EAGzC,OAAO,KAAKxK,aAAaoD,OAAOR,MAAMc,OAAO;GACzC6G,IAAIvN,aAAasD,KAAAA,KAAU;GAC3BiF,WAAWxI,iBAAiBuD,OAAO,YAAA,KAAiBwG,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;CAttBmBtH,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CA4BCA,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAgCNA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;CA4EiBA,MAAAA,qBAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;CA0WAA,MAAAA,qBAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;CAvkBnB,YAAA,CAAA,uBAAuB,qCAAA,CAAA"}

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts

@@ -2,6 +2,12 @@ import type { Logger } from '@authup/server-kit';
 import type { IEventService, IIdentityProviderAccountLinkStore, IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2FederatedLoginService } from '../../../../../core/index.ts';
 export type IdentityProviderControllerOptions = {
     baseURL: string;
+    /**
+     * Where the account console is served. The link callback returns the
+     * browser there, so a console published at a path of its own must not be
+     * addressed at the default segment.
+     */
+    accountConsoleUrl: string;
 };
 export type IdentityProviderControllerContext = {
     options: IdentityProviderControllerOptions;

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,aAAa,EACb,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,uCAAuC,EACvC,gCAAgC,EAChC,4BAA4B,EAC/B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IAExC,cAAc,EAAE,+BAA+B,CAAC;IAChD,SAAS,EAAE,iCAAiC,CAAC;IAC7C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,4BAA4B,CAAC;IAE3C,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,aAAa,EACb,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,uCAAuC,EACvC,gCAAgC,EAChC,4BAA4B,EAC/B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IAExC,cAAc,EAAE,+BAA+B,CAAC;IAChD,SAAS,EAAE,iCAAiC,CAAC;IAC7C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,4BAA4B,CAAC;IAE3C,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/entities/realm/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAMlE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAMvE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,sBAAsB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;CACxC,CAAC;AAEF,qBAEa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAE1C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;IAEjC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEnC,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAgBrC,GAAG,CACI,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAUlC,GAAG,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAOlE,sBAAsB,CACX,EAAE,EAAE,MAAM,GACxB,OAAO,CAAC,sBAAsB,CAAC;IA0F5B,QAAQ,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAMxE,OAAO,CACI,EAAE,EAAE,MAAM,EACP,KAAK,EAAE,MAAM,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IAMtB,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAclC,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACnB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAgBlC,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;CAQ3C"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAMlE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAMvE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,sBAAsB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;CACxC,CAAC;AAEF,qBAEa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAE1C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;IAEjC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEnC,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAgBrC,GAAG,CACI,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAUlC,GAAG,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAOlE,sBAAsB,CACX,EAAE,EAAE,MAAM,GACxB,OAAO,CAAC,sBAAsB,CAAC;IAgG5B,QAAQ,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAMxE,OAAO,CACI,EAAE,EAAE,MAAM,EACP,KAAK,EAAE,MAAM,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IAMtB,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAclC,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACnB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAgBlC,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;CAQ3C"}

package/dist/adapters/http/controllers/entities/realm/module.mjs

@@ -72,6 +72,8 @@ var RealmController = class {
 			issuer: resolveURL(baseURL, `realms/${entity.name}`).replace(/\/+$/, ""),
 			authorization_endpoint: resolveURL(baseURL, "authorize"),
 			end_session_endpoint: resolveURL(baseURL, "logout"),
+			backchannel_logout_supported: true,
+			backchannel_logout_session_supported: true,
 			jwks_uri: resolveURL(baseURL, `realms/${entity.name}/jwks`),
 			response_types_supported: [OAuth2AuthorizationResponseType.CODE],
 			prompt_values_supported: [

package/dist/adapters/http/controllers/entities/realm/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","useRequestQuery","RECORD_QUERY_PARAMETERS","describeQuerySchema","realmSchema","getJwkRouteHandler","getJwksRouteHandler","ForceLoggedInMiddleware","buildActorContext","resolveURL","RealmController","options","service","keyRepository","ctx","getMany","event","data","meta","schema","add","actor","entity","create","response","status","get","id","getOne","getOpenIdConfiguration","baseURL","mtlsBaseURL","clientCertificatesEnabled","issuer","name","replace","authorization_endpoint","end_session_endpoint","jwks_uri","response_types_supported","CODE","prompt_values_supported","NONE","LOGIN","CONSENT","SELECT_ACCOUNT","acr_values_supported","PASSWORD","MFA","subject_types_supported","id_token_signing_alg_values_supported","token_endpoint","token_endpoint_auth_methods_supported","tls_client_certificate_bound_access_tokens","mtls_endpoint_aliases","introspection_endpoint","revocation_endpoint","userinfo_endpoint","service_documentation","getCerts","getCert","keyId","edit","update","put","created","save","undefined","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { OAuth2JsonWebKey, OpenIDProviderMetadata } from '@authup/specs';\nimport { OAuth2AuthenticationContextClass, OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { Repository } from 'typeorm';\nimport type {\n    EntityCollectionResponse,\n    EntityRecordResponse,\n    RealmCreatePayload,\n    RealmSavePayload,\n    RealmUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { IRealmService } from '../../../../../core/index.ts';\nimport {\n    RECORD_QUERY_PARAMETERS,\n    describeQuerySchema,\n    realmSchema,\n} from '../../../../../core/index.ts';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { getJwkRouteHandler, getJwksRouteHandler } from '../../workflows/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\nimport { resolveURL } from '../../../../../utils/index.ts';\n\nexport type RealmControllerOptions = {\n    baseURL: string,\n    mtlsBaseURL?: string | null,\n    clientCertificatesEnabled?: boolean,\n};\n\nexport type RealmControllerContext = {\n    options: RealmControllerOptions,\n    service: IRealmService,\n    keyRepository: Repository<KeyEntity>,\n};\n\n@DTags('realm')\n@DController('/realms')\nexport class RealmController {\n    protected options: RealmControllerOptions;\n\n    protected service: IRealmService;\n\n    protected keyRepository: Repository<KeyEntity>;\n\n    constructor(ctx: RealmControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n        this.keyRepository = ctx.keyRepository;\n    }\n\n    @DGet('', [])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Realm>> {\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event));\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(realmSchema),\n            },\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: RealmCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<Realm>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return { data: entity, meta: {} };\n    }\n\n    @DGet('/:id', [])\n    async get(@DPath('id') id: string): Promise<EntityRecordResponse<Realm>> {\n        const entity = await this.service.getOne(id);\n\n        return { data: entity, meta: { schema: describeQuerySchema(realmSchema, RECORD_QUERY_PARAMETERS) } };\n    }\n\n    @DGet('/:id/.well-known/openid-configuration', [])\n    async getOpenIdConfiguration(\n        @DPath('id') id: string,\n    ): Promise<OpenIDProviderMetadata> {\n        const entity = await this.service.getOne(id);\n\n        const { baseURL } = this.options;\n        const { mtlsBaseURL, clientCertificatesEnabled = false } = this.options;\n\n        return {\n            issuer: resolveURL(baseURL, `realms/${entity.name}`).replace(/\\/+$/, ''),\n\n            authorization_endpoint: resolveURL(baseURL, 'authorize'),\n\n            end_session_endpoint: resolveURL(baseURL, 'logout'),\n\n            jwks_uri: resolveURL(baseURL, `realms/${entity.name}/jwks`),\n\n            // OAuth 2.1 posture: the authorization endpoint issues codes\n            // only — implicit/hybrid response types were dropped (plan 042).\n            response_types_supported: [\n                OAuth2AuthorizationResponseType.CODE,\n            ],\n\n            // `none` (silent authentication) is handled by the hosted SSR\n            // authorize page (the kit `Authorize.vue`): it either completes a\n            // built_in client's auto-consent silently or redirects the OIDC\n            // error (login_required / consent_required / interaction_required)\n            // to a verified redirect_uri — zero UI. The server GET cannot do\n            // this server-side (auth is header-only; a top-level navigation\n            // carries no bearer), so the SSR page owns it (plan 042 item 10).\n            prompt_values_supported: [\n                OAuth2AuthorizationPrompt.NONE,\n                OAuth2AuthorizationPrompt.LOGIN,\n                OAuth2AuthorizationPrompt.CONSENT,\n                OAuth2AuthorizationPrompt.SELECT_ACCOUNT,\n            ],\n\n            // two coarse levels only (urn-style — OIDC reserves the bare\n            // \"0\"); `urn:authup:mfa` in `acr_values` acts as a step-up\n            // trigger (plan 050).\n            acr_values_supported: [\n                OAuth2AuthenticationContextClass.PASSWORD,\n                OAuth2AuthenticationContextClass.MFA,\n            ],\n\n            subject_types_supported: [\n                'public',\n            ],\n\n            id_token_signing_alg_values_supported: [\n                'HS256',\n                'HS384',\n                'HS512',\n                'RS256',\n                'RS384',\n                'RS512',\n                'none',\n            ],\n\n            token_endpoint: resolveURL(baseURL, 'token'),\n\n            token_endpoint_auth_methods_supported: [\n                'none',\n                'client_secret_basic',\n                'client_secret_post',\n                ...(clientCertificatesEnabled ? ['tls_client_auth'] : []),\n            ],\n\n            ...(clientCertificatesEnabled ? { tls_client_certificate_bound_access_tokens: true } : {}),\n\n            ...(mtlsBaseURL ? {\n                mtls_endpoint_aliases: {\n                    token_endpoint: resolveURL(mtlsBaseURL, 'token'),\n                    introspection_endpoint: resolveURL(mtlsBaseURL, 'token/introspect'),\n                    revocation_endpoint: resolveURL(mtlsBaseURL, 'token/revoke'),\n                    userinfo_endpoint: resolveURL(mtlsBaseURL, 'userinfo'),\n                },\n            } : {}),\n\n            introspection_endpoint: resolveURL(baseURL, 'token/introspect'),\n\n            revocation_endpoint: resolveURL(baseURL, 'token/revoke'),\n\n            // -----------------------------------------------------------\n\n            service_documentation: 'https://authup.org/',\n\n            userinfo_endpoint: resolveURL(baseURL, 'userinfo'),\n        };\n    }\n\n    @DGet('/:id/jwks', [])\n    async getCerts(@DPath('id') id: string): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const entity = await this.service.getOne(id);\n        return getJwksRouteHandler(this.keyRepository, entity.id);\n    }\n\n    @DGet('/:id/jwks/:keyId', [])\n    async getCert(\n        @DPath('id') id: string,\n        @DPath('keyId') keyId: string,\n    ): Promise<OAuth2JsonWebKey> {\n        const entity = await this.service.getOne(id);\n        return getJwkRouteHandler(this.keyRepository, keyId, entity.id);\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async edit(\n        @DPath('id') id: string,\n        @DBody() data: RealmUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<Realm>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.update(\n            id,\n            data,\n            actor,\n        );\n\n        event.response.status = 202;\n\n        return { data: entity, meta: {} };\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() data: RealmSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<Realm>> {\n        const actor = buildActorContext(event);\n        const {\n            entity,\n            created,\n        } = await this.service.save(\n            id || undefined,\n            data,\n            actor,\n        );\n\n        event.response.status = created ? 201 : 202;\n        return { data: entity, meta: {} };\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<Realm>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return { data: entity, meta: {} };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,IAAaqB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,UAAUE,IAAIF;EACnB,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MACME,QACF,OACwC;EACxC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQG,QAAQd,gBAAgBe,KAAAA,CAAAA;EAE/C,OAAO;GACHC;GACAC,MAAM;IACF,GAAGA;IACHC,QAAQhB,oBAAoBC,WAAAA;GAChC;EACJ;CACJ;CAEA,MACMgB,IACF,MACA,OACqC;EACrC,MAAMC,QAAQb,kBAAkBQ,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKV,QAAQW,OAAON,MAAMI,KAAAA;EAE/CL,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAER,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;CAEA,MACMQ,IAAI,IAA+D;EAGrE,OAAO;GAAET,MAAMK,MAFM,KAAKV,QAAQgB,OAAOD,EAAAA;GAElBT,MAAM,EAAEC,QAAQhB,oBAAoBC,aAAaF,uBAAAA,EAAyB;EAAE;CACvG;CAEA,MACM2B,uBACF,IAC+B;EAC/B,MAAMP,SAAS,MAAM,KAAKV,QAAQgB,OAAOD,EAAAA;EAEzC,MAAM,EAAEG,YAAY,KAAKnB;EACzB,MAAM,EAAEoB,aAAaC,4BAA4B,UAAU,KAAKrB;EAEhE,OAAO;GACHsB,QAAQxB,WAAWqB,SAAS,UAAUR,OAAOY,MAAM,CAAA,CAAEC,QAAQ,QAAQ,EAAA;GAErEC,wBAAwB3B,WAAWqB,SAAS,WAAA;GAE5CO,sBAAsB5B,WAAWqB,SAAS,QAAA;GAE1CQ,UAAU7B,WAAWqB,SAAS,UAAUR,OAAOY,KAAK,MAAM;GAI1DK,0BAA0B,CACtBvC,gCAAgCwC,IACnC;GASDC,yBAAyB;IACrB1C,0BAA0B2C;IAC1B3C,0BAA0B4C;IAC1B5C,0BAA0B6C;IAC1B7C,0BAA0B8C;GAC7B;GAKDC,sBAAsB,CAClBhD,iCAAiCiD,UACjCjD,iCAAiCkD,GACpC;GAEDC,yBAAyB,CACrB,QACH;GAEDC,uCAAuC;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;GACH;GAEDC,gBAAgB1C,WAAWqB,SAAS,OAAA;GAEpCsB,uCAAuC;IACnC;IACA;IACA;IACIpB,GAAAA,4BAA4B,CAAC,iBAAkB,IAAG,CAAA;GACzD;GAED,GAAIA,4BAA4B,EAAEqB,4CAA4C,KAAK,IAAI,CAAC;GAExF,GAAItB,cAAc,EACduB,uBAAuB;IACnBH,gBAAgB1C,WAAWsB,aAAa,OAAA;IACxCwB,wBAAwB9C,WAAWsB,aAAa,kBAAA;IAChDyB,qBAAqB/C,WAAWsB,aAAa,cAAA;IAC7C0B,mBAAmBhD,WAAWsB,aAAa,UAAA;GAC/C,EACJ,IAAI,CAAC;GAELwB,wBAAwB9C,WAAWqB,SAAS,kBAAA;GAE5C0B,qBAAqB/C,WAAWqB,SAAS,cAAA;GAIzC4B,uBAAuB;GAEvBD,mBAAmBhD,WAAWqB,SAAS,UAAA;EAC3C;CACJ;CAEA,MACM6B,SAAS,IAAgE;EAC3E,MAAMrC,SAAS,MAAM,KAAKV,QAAQgB,OAAOD,EAAAA;EACzC,OAAOrB,oBAAoB,KAAKO,eAAeS,OAAOK,EAAE;CAC5D;CAEA,MACMiC,QACF,IACA,OACyB;EACzB,MAAMtC,SAAS,MAAM,KAAKV,QAAQgB,OAAOD,EAAAA;EACzC,OAAOtB,mBAAmB,KAAKQ,eAAegD,OAAOvC,OAAOK,EAAE;CAClE;CAEA,MACMmC,KACF,IACA,MACA,OACqC;EACrC,MAAMzC,QAAQb,kBAAkBQ,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKV,QAAQmD,OAC9BpC,IACAV,MACAI,KAAAA;EAGJL,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAER,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;CAEA,MACM8C,IACF,IACA,MACA,OACqC;EACrC,MAAM3C,QAAQb,kBAAkBQ,KAAAA;EAChC,MAAM,EACFM,QACA2C,YACA,MAAM,KAAKrD,QAAQsD,KACnBvC,MAAMwC,KAAAA,GACNlD,MACAI,KAAAA;EAGJL,MAAMQ,SAASC,SAASwC,UAAU,MAAM;EACxC,OAAO;GAAEhD,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;CAEA,MACMkD,KACF,IACA,OACqC;EACrC,MAAM/C,QAAQb,kBAAkBQ,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKV,QAAQyD,OAAO1C,IAAIN,KAAAA;EAE7CL,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAER,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;AACJ;;;;;;;;;CAjLgBX,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+HIA,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CAkBDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CAoBGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","OAuth2AuthenticationContextClass","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","useRequestQuery","RECORD_QUERY_PARAMETERS","describeQuerySchema","realmSchema","getJwkRouteHandler","getJwksRouteHandler","ForceLoggedInMiddleware","buildActorContext","resolveURL","RealmController","options","service","keyRepository","ctx","getMany","event","data","meta","schema","add","actor","entity","create","response","status","get","id","getOne","getOpenIdConfiguration","baseURL","mtlsBaseURL","clientCertificatesEnabled","issuer","name","replace","authorization_endpoint","end_session_endpoint","backchannel_logout_supported","backchannel_logout_session_supported","jwks_uri","response_types_supported","CODE","prompt_values_supported","NONE","LOGIN","CONSENT","SELECT_ACCOUNT","acr_values_supported","PASSWORD","MFA","subject_types_supported","id_token_signing_alg_values_supported","token_endpoint","token_endpoint_auth_methods_supported","tls_client_certificate_bound_access_tokens","mtls_endpoint_aliases","introspection_endpoint","revocation_endpoint","userinfo_endpoint","service_documentation","getCerts","getCert","keyId","edit","update","put","created","save","undefined","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { OAuth2JsonWebKey, OpenIDProviderMetadata } from '@authup/specs';\nimport { OAuth2AuthenticationContextClass, OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { Repository } from 'typeorm';\nimport type {\n    EntityCollectionResponse,\n    EntityRecordResponse,\n    RealmCreatePayload,\n    RealmSavePayload,\n    RealmUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { IRealmService } from '../../../../../core/index.ts';\nimport {\n    RECORD_QUERY_PARAMETERS,\n    describeQuerySchema,\n    realmSchema,\n} from '../../../../../core/index.ts';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { getJwkRouteHandler, getJwksRouteHandler } from '../../workflows/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\nimport { resolveURL } from '../../../../../utils/index.ts';\n\nexport type RealmControllerOptions = {\n    baseURL: string,\n    mtlsBaseURL?: string | null,\n    clientCertificatesEnabled?: boolean,\n};\n\nexport type RealmControllerContext = {\n    options: RealmControllerOptions,\n    service: IRealmService,\n    keyRepository: Repository<KeyEntity>,\n};\n\n@DTags('realm')\n@DController('/realms')\nexport class RealmController {\n    protected options: RealmControllerOptions;\n\n    protected service: IRealmService;\n\n    protected keyRepository: Repository<KeyEntity>;\n\n    constructor(ctx: RealmControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n        this.keyRepository = ctx.keyRepository;\n    }\n\n    @DGet('', [])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Realm>> {\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event));\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(realmSchema),\n            },\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: RealmCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<Realm>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return { data: entity, meta: {} };\n    }\n\n    @DGet('/:id', [])\n    async get(@DPath('id') id: string): Promise<EntityRecordResponse<Realm>> {\n        const entity = await this.service.getOne(id);\n\n        return { data: entity, meta: { schema: describeQuerySchema(realmSchema, RECORD_QUERY_PARAMETERS) } };\n    }\n\n    @DGet('/:id/.well-known/openid-configuration', [])\n    async getOpenIdConfiguration(\n        @DPath('id') id: string,\n    ): Promise<OpenIDProviderMetadata> {\n        const entity = await this.service.getOne(id);\n\n        const { baseURL } = this.options;\n        const { mtlsBaseURL, clientCertificatesEnabled = false } = this.options;\n\n        return {\n            issuer: resolveURL(baseURL, `realms/${entity.name}`).replace(/\\/+$/, ''),\n\n            authorization_endpoint: resolveURL(baseURL, 'authorize'),\n\n            end_session_endpoint: resolveURL(baseURL, 'logout'),\n\n            // OIDC Back-Channel Logout 1.0: every session end pushes a\n            // logout token carrying `sid` to the clients that registered a\n            // back-channel logout URI (plan 064).\n            backchannel_logout_supported: true,\n            backchannel_logout_session_supported: true,\n\n            jwks_uri: resolveURL(baseURL, `realms/${entity.name}/jwks`),\n\n            // OAuth 2.1 posture: the authorization endpoint issues codes\n            // only — implicit/hybrid response types were dropped (plan 042).\n            response_types_supported: [\n                OAuth2AuthorizationResponseType.CODE,\n            ],\n\n            // `none` (silent authentication) is handled by the hosted SSR\n            // authorize page (the kit `Authorize.vue`): it either completes a\n            // built_in client's auto-consent silently or redirects the OIDC\n            // error (login_required / consent_required / interaction_required)\n            // to a verified redirect_uri — zero UI. The server GET cannot do\n            // this server-side (auth is header-only; a top-level navigation\n            // carries no bearer), so the SSR page owns it (plan 042 item 10).\n            prompt_values_supported: [\n                OAuth2AuthorizationPrompt.NONE,\n                OAuth2AuthorizationPrompt.LOGIN,\n                OAuth2AuthorizationPrompt.CONSENT,\n                OAuth2AuthorizationPrompt.SELECT_ACCOUNT,\n            ],\n\n            // two coarse levels only (urn-style — OIDC reserves the bare\n            // \"0\"); `urn:authup:mfa` in `acr_values` acts as a step-up\n            // trigger (plan 050).\n            acr_values_supported: [\n                OAuth2AuthenticationContextClass.PASSWORD,\n                OAuth2AuthenticationContextClass.MFA,\n            ],\n\n            subject_types_supported: [\n                'public',\n            ],\n\n            id_token_signing_alg_values_supported: [\n                'HS256',\n                'HS384',\n                'HS512',\n                'RS256',\n                'RS384',\n                'RS512',\n                'none',\n            ],\n\n            token_endpoint: resolveURL(baseURL, 'token'),\n\n            token_endpoint_auth_methods_supported: [\n                'none',\n                'client_secret_basic',\n                'client_secret_post',\n                ...(clientCertificatesEnabled ? ['tls_client_auth'] : []),\n            ],\n\n            ...(clientCertificatesEnabled ? { tls_client_certificate_bound_access_tokens: true } : {}),\n\n            ...(mtlsBaseURL ? {\n                mtls_endpoint_aliases: {\n                    token_endpoint: resolveURL(mtlsBaseURL, 'token'),\n                    introspection_endpoint: resolveURL(mtlsBaseURL, 'token/introspect'),\n                    revocation_endpoint: resolveURL(mtlsBaseURL, 'token/revoke'),\n                    userinfo_endpoint: resolveURL(mtlsBaseURL, 'userinfo'),\n                },\n            } : {}),\n\n            introspection_endpoint: resolveURL(baseURL, 'token/introspect'),\n\n            revocation_endpoint: resolveURL(baseURL, 'token/revoke'),\n\n            // -----------------------------------------------------------\n\n            service_documentation: 'https://authup.org/',\n\n            userinfo_endpoint: resolveURL(baseURL, 'userinfo'),\n        };\n    }\n\n    @DGet('/:id/jwks', [])\n    async getCerts(@DPath('id') id: string): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const entity = await this.service.getOne(id);\n        return getJwksRouteHandler(this.keyRepository, entity.id);\n    }\n\n    @DGet('/:id/jwks/:keyId', [])\n    async getCert(\n        @DPath('id') id: string,\n        @DPath('keyId') keyId: string,\n    ): Promise<OAuth2JsonWebKey> {\n        const entity = await this.service.getOne(id);\n        return getJwkRouteHandler(this.keyRepository, keyId, entity.id);\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async edit(\n        @DPath('id') id: string,\n        @DBody() data: RealmUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<Realm>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.update(\n            id,\n            data,\n            actor,\n        );\n\n        event.response.status = 202;\n\n        return { data: entity, meta: {} };\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() data: RealmSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<Realm>> {\n        const actor = buildActorContext(event);\n        const {\n            entity,\n            created,\n        } = await this.service.save(\n            id || undefined,\n            data,\n            actor,\n        );\n\n        event.response.status = created ? 201 : 202;\n        return { data: entity, meta: {} };\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<EntityRecordResponse<Realm>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return { data: entity, meta: {} };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,IAAaqB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,UAAUE,IAAIF;EACnB,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MACME,QACF,OACwC;EACxC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQG,QAAQd,gBAAgBe,KAAAA,CAAAA;EAE/C,OAAO;GACHC;GACAC,MAAM;IACF,GAAGA;IACHC,QAAQhB,oBAAoBC,WAAAA;GAChC;EACJ;CACJ;CAEA,MACMgB,IACF,MACA,OACqC;EACrC,MAAMC,QAAQb,kBAAkBQ,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKV,QAAQW,OAAON,MAAMI,KAAAA;EAE/CL,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAER,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;CAEA,MACMQ,IAAI,IAA+D;EAGrE,OAAO;GAAET,MAAMK,MAFM,KAAKV,QAAQgB,OAAOD,EAAAA;GAElBT,MAAM,EAAEC,QAAQhB,oBAAoBC,aAAaF,uBAAAA,EAAyB;EAAE;CACvG;CAEA,MACM2B,uBACF,IAC+B;EAC/B,MAAMP,SAAS,MAAM,KAAKV,QAAQgB,OAAOD,EAAAA;EAEzC,MAAM,EAAEG,YAAY,KAAKnB;EACzB,MAAM,EAAEoB,aAAaC,4BAA4B,UAAU,KAAKrB;EAEhE,OAAO;GACHsB,QAAQxB,WAAWqB,SAAS,UAAUR,OAAOY,MAAM,CAAA,CAAEC,QAAQ,QAAQ,EAAA;GAErEC,wBAAwB3B,WAAWqB,SAAS,WAAA;GAE5CO,sBAAsB5B,WAAWqB,SAAS,QAAA;GAK1CQ,8BAA8B;GAC9BC,sCAAsC;GAEtCC,UAAU/B,WAAWqB,SAAS,UAAUR,OAAOY,KAAK,MAAM;GAI1DO,0BAA0B,CACtBzC,gCAAgC0C,IACnC;GASDC,yBAAyB;IACrB5C,0BAA0B6C;IAC1B7C,0BAA0B8C;IAC1B9C,0BAA0B+C;IAC1B/C,0BAA0BgD;GAC7B;GAKDC,sBAAsB,CAClBlD,iCAAiCmD,UACjCnD,iCAAiCoD,GACpC;GAEDC,yBAAyB,CACrB,QACH;GAEDC,uCAAuC;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;GACH;GAEDC,gBAAgB5C,WAAWqB,SAAS,OAAA;GAEpCwB,uCAAuC;IACnC;IACA;IACA;IACItB,GAAAA,4BAA4B,CAAC,iBAAkB,IAAG,CAAA;GACzD;GAED,GAAIA,4BAA4B,EAAEuB,4CAA4C,KAAK,IAAI,CAAC;GAExF,GAAIxB,cAAc,EACdyB,uBAAuB;IACnBH,gBAAgB5C,WAAWsB,aAAa,OAAA;IACxC0B,wBAAwBhD,WAAWsB,aAAa,kBAAA;IAChD2B,qBAAqBjD,WAAWsB,aAAa,cAAA;IAC7C4B,mBAAmBlD,WAAWsB,aAAa,UAAA;GAC/C,EACJ,IAAI,CAAC;GAEL0B,wBAAwBhD,WAAWqB,SAAS,kBAAA;GAE5C4B,qBAAqBjD,WAAWqB,SAAS,cAAA;GAIzC8B,uBAAuB;GAEvBD,mBAAmBlD,WAAWqB,SAAS,UAAA;EAC3C;CACJ;CAEA,MACM+B,SAAS,IAAgE;EAC3E,MAAMvC,SAAS,MAAM,KAAKV,QAAQgB,OAAOD,EAAAA;EACzC,OAAOrB,oBAAoB,KAAKO,eAAeS,OAAOK,EAAE;CAC5D;CAEA,MACMmC,QACF,IACA,OACyB;EACzB,MAAMxC,SAAS,MAAM,KAAKV,QAAQgB,OAAOD,EAAAA;EACzC,OAAOtB,mBAAmB,KAAKQ,eAAekD,OAAOzC,OAAOK,EAAE;CAClE;CAEA,MACMqC,KACF,IACA,MACA,OACqC;EACrC,MAAM3C,QAAQb,kBAAkBQ,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKV,QAAQqD,OAC9BtC,IACAV,MACAI,KAAAA;EAGJL,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAER,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;CAEA,MACMgD,IACF,IACA,MACA,OACqC;EACrC,MAAM7C,QAAQb,kBAAkBQ,KAAAA;EAChC,MAAM,EACFM,QACA6C,YACA,MAAM,KAAKvD,QAAQwD,KACnBzC,MAAM0C,KAAAA,GACNpD,MACAI,KAAAA;EAGJL,MAAMQ,SAASC,SAAS0C,UAAU,MAAM;EACxC,OAAO;GAAElD,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;CAEA,MACMoD,KACF,IACA,OACqC;EACrC,MAAMjD,QAAQb,kBAAkBQ,KAAAA;EAChC,MAAMM,SAAS,MAAM,KAAKV,QAAQ2D,OAAO5C,IAAIN,KAAAA;EAE7CL,MAAMQ,SAASC,SAAS;EAExB,OAAO;GAAER,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;AACJ;;;;;;;;;CAvLgBX,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqIIA,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CAkBDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CAoBGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA"}

package/dist/adapters/http/controllers/entities/session/module.d.ts

@@ -1,13 +1,45 @@
 import type { Session } from '@authup/core-kit';
 import type { IAppEvent } from 'routup';
 import type { EntityCollectionResponse, EntityRecordResponse, SessionDeleteManyResponse } from '@authup/core-http-kit';
-import type { ISessionService } from '../../../../../core/index.ts';
+import type { IIdentityPermissionProvider, IIdentityResolver, ISessionRepository, ISessionService } from '../../../../../core/index.ts';
+import type { OAuth2TokenIntrospectionResponse } from '@authup/specs';
 export type SessionControllerContext = {
+    /**
+     * Only the cookie-session additions below use these (plan 088). The entity
+     * routes delegate wholly to `service`, as every entity controller does.
+     */
+    baseURL?: string;
+    identityResolver?: IIdentityResolver;
+    identityPermissionProvider?: IIdentityPermissionProvider;
+    sessionRepository?: ISessionRepository;
     service: ISessionService;
 };
 export declare class SessionController {
     protected service: ISessionService;
+    protected baseURL?: string;
+    protected identityResolver?: IIdentityResolver;
+    protected identityPermissionProvider?: IIdentityPermissionProvider;
+    protected sessionRepository?: ISessionRepository;
     constructor(ctx: SessionControllerContext);
+    /**
+     * The caller's own session as a CONTEXT rather than a row: the identity
+     * claims and permission projection a console hydrates its store from, which
+     * is what `POST /token/introspect` answers minus everything token-shaped.
+     *
+     * A sibling of `@me` rather than a replacement for it: `GET /sessions/@me`
+     * returns the `auth_sessions` ROW, and a console needs the subject's claims
+     * and permissions, which are not on it. Named `introspect` because it is
+     * literally the introspection projection, keyed off the request's own
+     * credential instead of a token in the body.
+     *
+     * No client scope on the permission read, deliberately.
+     * `reduceBindingsByIdentityClient` keeps only permissions whose own
+     * `clientId` matches the one passed, so naming a console's client would
+     * drop every global permission — nearly all of them. The bearer path passes
+     * the token's `client_id` because a token IS issued to one client; a
+     * session is not.
+     */
+    getOwnIntrospection(event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse>;
     getMany(event: IAppEvent): Promise<EntityCollectionResponse<Session>>;
     getOne(id: string, event: IAppEvent): Promise<EntityRecordResponse<Session>>;
     dropMany(event: IAppEvent): Promise<SessionDeleteManyResponse>;

package/dist/adapters/http/controllers/entities/session/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/session/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAEvH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AASpE,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,qBAEa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEvB,GAAG,EAAE,wBAAwB;IAKnC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAiBvC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAYnC,QAAQ,CACE,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAgB/B,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;CAS5C"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/session/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAEvH,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,eAAe,CAAC;AAMtE,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,0BAA0B,CAAC,EAAE,2BAA2B,CAAC;IACzD,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;IACvC,OAAO,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,qBAEa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE3B,SAAS,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,CAAC,EAAE,2BAA2B,CAAC;IAEnE,SAAS,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;gBAErC,GAAG,EAAE,wBAAwB;IAQzC;;;;;;;;;;;;;;;;;OAiBG;IAEG,mBAAmB,CACT,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gCAAgC,CAAC;IAoDtC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAiBvC,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAYnC,QAAQ,CACE,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAgB/B,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;CAyB5C"}