@c9up/transit 0.1.0

package/dist/drivers/LdapDirectory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LdapDirectory.js","sourceRoot":"","sources":["../../src/drivers/LdapDirectory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACN,cAAc,EAEd,SAAS,GAET,MAAM,YAAY,CAAC;AA8BpB,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;AAC3D,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAE1D,MAAM,OAAO,aAAa;IAChB,OAAO,CAAa;IAE7B,YAAY,MAAkB;QAC7B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,QAAgB;QACpD,oEAAoE;QACpE,uEAAuE;QACvE,qBAAqB;QACrB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAClB,8FAA8F,CAC9F,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,KAAK,CAAC,QAAgB;QAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,UAAU,CAAC,IAAI,CACpB,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAC/B,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,KAAK,GAAe;gBACzB,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;aAC/C,CAAC;YACF,MAAM,MAAM,GAAe,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC7C,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBACvC,CAAC,CAAC,KAAK,CAAC;YAET,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;gBACvC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBACzB,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI;oBACtC,GAAG,WAAW;oBACd,GAAG,UAAU;oBACb,GAAG,UAAU;iBACb;gBACD,0DAA0D;gBAC1D,sDAAsD;gBACtD,SAAS,EAAE,CAAC;aACZ,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,gEAAgE;gBAChE,mDAAmD;gBACnD,MAAM,IAAI,SAAS,CAClB,qDAAqD,EACrD,EAAE,CACF,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,SAAS,CAClB,IAAI,QAAQ,aAAa,OAAO,CAAC,MAAM,wCAAwC,CAC/E,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC,CAAC,CAAc,CAAC;QAChC,CAAC;gBAAS,CAAC;YACV,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,QAAgB;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;gBAAS,CAAC;YACV,kEAAkE;YAClE,sBAAsB;YACtB,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,KAAK;QACJ,OAAO,IAAI,cAAc,CAAC;YACzB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YACrB,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;YACzC,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;YACnD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;SACjC,CAAC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,KAAgB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE1D,OAAO;YACN,oEAAoE;YACpE,sCAAsC;YACtC,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,EAAE,IAAI,IAAI,QAAQ,IAAI,KAAK,CAAC,EAAE;YAClC,QAAQ;YACR,qEAAqE;YACrE,kBAAkB;YAClB,sBAAsB,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;YACxE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;SACnD,CAAC;IACH,CAAC;CACD;AAED,SAAS,IAAI,CACZ,KAAgB,EAChB,UAA8B,EAC9B,UAAoB;IAEpB,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC"}

package/dist/drivers/LinkedInDriver.d.ts

@@ -0,0 +1,29 @@
+/**
+ * LinkedIn OAuth2 driver — the member API.
+ *
+ * For an application whose LinkedIn app holds `r_liteprofile` /
+ * `r_emailaddress`. It needs two calls: the profile carries no address, and
+ * the address endpoint carries no profile.
+ *
+ * LinkedIn issues new applications OpenID Connect instead — that is
+ * `LinkedInOpenidConnectDriver`.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+import type { TransitUser } from "../types.js";
+export declare class LinkedInDriver extends Oauth2Driver {
+    protected readonly provider = "LinkedIn";
+    protected readonly authorizeUrl = "https://www.linkedin.com/oauth/v2/authorization";
+    protected readonly accessTokenUrl = "https://www.linkedin.com/oauth/v2/accessToken";
+    protected readonly userInfoUrl = "https://api.linkedin.com/v2/me";
+    protected readonly defaultScopes: readonly ["r_liteprofile", "r_emailaddress"];
+    protected userInfoParams(): Record<string, string>;
+    protected fetchUser(accessToken: string): Promise<TransitUser>;
+    /**
+     * The address lives behind its own endpoint, and only with the
+     * `r_emailaddress` scope — without it the response has no elements, which is
+     * reported here rather than surfacing as an empty address downstream.
+     */
+    fetchEmail(accessToken: string): Promise<string>;
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+//# sourceMappingURL=LinkedInDriver.d.ts.map

package/dist/drivers/LinkedInDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinkedInDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/LinkedInDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM/C,qBAAa,cAAe,SAAQ,YAAY;IAC/C,SAAS,CAAC,QAAQ,CAAC,QAAQ,cAAc;IACzC,SAAS,CAAC,QAAQ,CAAC,YAAY,qDACoB;IACnD,SAAS,CAAC,QAAQ,CAAC,cAAc,mDACgB;IACjD,SAAS,CAAC,QAAQ,CAAC,WAAW,oCAAoC;IAClE,SAAS,CAAC,QAAQ,CAAC,aAAa,+CAGrB;cAEQ,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;cAIlC,SAAS,CACjC,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAQvB;;;;OAIG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBtD,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAiB5D"}

package/dist/drivers/LinkedInDriver.js

@@ -0,0 +1,97 @@
+/**
+ * LinkedIn OAuth2 driver — the member API.
+ *
+ * For an application whose LinkedIn app holds `r_liteprofile` /
+ * `r_emailaddress`. It needs two calls: the profile carries no address, and
+ * the address endpoint carries no profile.
+ *
+ * LinkedIn issues new applications OpenID Connect instead — that is
+ * `LinkedInOpenidConnectDriver`.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+const EMAIL_URL = "https://api.linkedin.com/v2/emailAddress";
+const PROFILE_PROJECTION = "(id,localizedFirstName,localizedLastName,vanityName,profilePicture(displayImage~:playableStreams))";
+export class LinkedInDriver extends Oauth2Driver {
+    provider = "LinkedIn";
+    authorizeUrl = "https://www.linkedin.com/oauth/v2/authorization";
+    accessTokenUrl = "https://www.linkedin.com/oauth/v2/accessToken";
+    userInfoUrl = "https://api.linkedin.com/v2/me";
+    defaultScopes = [
+        "r_liteprofile",
+        "r_emailaddress",
+    ];
+    userInfoParams() {
+        return { projection: PROFILE_PROJECTION };
+    }
+    async fetchUser(accessToken) {
+        const raw = await this.get(this.userInfoUrl, accessToken, {
+            ...this.userInfoParams(),
+        });
+        const email = await this.fetchEmail(accessToken);
+        return { ...this.mapUser(raw), email };
+    }
+    /**
+     * The address lives behind its own endpoint, and only with the
+     * `r_emailaddress` scope — without it the response has no elements, which is
+     * reported here rather than surfacing as an empty address downstream.
+     */
+    async fetchEmail(accessToken) {
+        const body = await this.get(EMAIL_URL, accessToken, {
+            q: "members",
+            projection: "(elements*(primary,type,handle~))",
+        });
+        const elements = Array.isArray(body.elements) ? body.elements : [];
+        for (const element of elements) {
+            if (typeof element !== "object" || element === null)
+                continue;
+            if (Reflect.get(element, "type") !== "EMAIL")
+                continue;
+            const handle = Reflect.get(element, "handle~");
+            if (typeof handle !== "object" || handle === null)
+                continue;
+            const address = Reflect.get(handle, "emailAddress");
+            if (typeof address === "string" && address !== "")
+                return address;
+        }
+        throw new Error("LinkedIn returned no email address — the application needs the 'r_emailaddress' scope.");
+    }
+    mapUser(raw) {
+        const first = String(raw.localizedFirstName ?? "");
+        const last = String(raw.localizedLastName ?? "");
+        return {
+            id: String(raw.id ?? ""),
+            email: "",
+            name: [first, last].filter(Boolean).join(" "),
+            nickName: typeof raw.vanityName === "string" && raw.vanityName !== ""
+                ? raw.vanityName
+                : [first, last].filter(Boolean).join(" "),
+            avatarUrl: pictureUrl(raw),
+            // The member API vouches for nothing about the address.
+            emailVerificationState: "unsupported",
+            raw,
+        };
+    }
+}
+/**
+ * The picture arrives as a list of renditions, largest last. Nothing about
+ * the shape is guaranteed, so every step is checked.
+ */
+function pictureUrl(raw) {
+    const picture = raw.profilePicture;
+    if (typeof picture !== "object" || picture === null)
+        return undefined;
+    const display = Reflect.get(picture, "displayImage~");
+    if (typeof display !== "object" || display === null)
+        return undefined;
+    const elements = Reflect.get(display, "elements");
+    if (!Array.isArray(elements) || elements.length === 0)
+        return undefined;
+    const identifiers = Reflect.get(Object(elements[0]), "identifiers");
+    if (!Array.isArray(identifiers) || identifiers.length === 0)
+        return undefined;
+    const identifier = Reflect.get(Object(identifiers[0]), "identifier");
+    return typeof identifier === "string" && identifier !== ""
+        ? identifier
+        : undefined;
+}
+//# sourceMappingURL=LinkedInDriver.js.map

package/dist/drivers/LinkedInDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinkedInDriver.js","sourceRoot":"","sources":["../../src/drivers/LinkedInDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,SAAS,GAAG,0CAA0C,CAAC;AAC7D,MAAM,kBAAkB,GACvB,oGAAoG,CAAC;AAEtG,MAAM,OAAO,cAAe,SAAQ,YAAY;IAC5B,QAAQ,GAAG,UAAU,CAAC;IACtB,YAAY,GAC9B,iDAAiD,CAAC;IAChC,cAAc,GAChC,+CAA+C,CAAC;IAC9B,WAAW,GAAG,gCAAgC,CAAC;IAC/C,aAAa,GAAG;QAClC,eAAe;QACf,gBAAgB;KACP,CAAC;IAEQ,cAAc;QAChC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAC3C,CAAC;IAEkB,KAAK,CAAC,SAAS,CACjC,WAAmB;QAEnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE;YACzD,GAAG,IAAI,CAAC,cAAc,EAAE;SACxB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACjD,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE;YACnD,CAAC,EAAE,SAAS;YACZ,UAAU,EAAE,mCAAmC;SAC/C,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;gBAAE,SAAS;YAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,OAAO;gBAAE,SAAS;YACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,SAAS;YAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;gBAAE,OAAO,OAAO,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,KAAK,CACd,wFAAwF,CACxF,CAAC;IACH,CAAC;IAES,OAAO,CAAC,GAA4B;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACxB,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7C,QAAQ,EACP,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE;gBAC1D,CAAC,CAAC,GAAG,CAAC,UAAU;gBAChB,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC;YAC1B,wDAAwD;YACxD,sBAAsB,EAAE,aAAa;YACrC,GAAG;SACH,CAAC;IACH,CAAC;CACD;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAA4B;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACtD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE;QACzD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAC;AACd,CAAC"}

package/dist/drivers/LinkedInOpenidConnectDriver.d.ts

@@ -0,0 +1,17 @@
+/**
+ * LinkedIn OAuth2 driver — OpenID Connect.
+ *
+ * This is the flow LinkedIn issues new applications: one `userinfo` call,
+ * standard claims. The member API is `LinkedInDriver`.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+import type { TransitUser } from "../types.js";
+export declare class LinkedInOpenidConnectDriver extends Oauth2Driver {
+    protected readonly provider = "LinkedIn";
+    protected readonly authorizeUrl = "https://www.linkedin.com/oauth/v2/authorization";
+    protected readonly accessTokenUrl = "https://www.linkedin.com/oauth/v2/accessToken";
+    protected readonly userInfoUrl = "https://api.linkedin.com/v2/userinfo";
+    protected readonly defaultScopes: readonly ["openid", "profile", "email"];
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+//# sourceMappingURL=LinkedInOpenidConnectDriver.d.ts.map

package/dist/drivers/LinkedInOpenidConnectDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinkedInOpenidConnectDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/LinkedInOpenidConnectDriver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAO,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,qBAAa,2BAA4B,SAAQ,YAAY;IAC5D,SAAS,CAAC,QAAQ,CAAC,QAAQ,cAAc;IACzC,SAAS,CAAC,QAAQ,CAAC,YAAY,qDACoB;IACnD,SAAS,CAAC,QAAQ,CAAC,cAAc,mDACgB;IACjD,SAAS,CAAC,QAAQ,CAAC,WAAW,0CAA0C;IACxE,SAAS,CAAC,QAAQ,CAAC,aAAa,0CAA2C;IAE3E,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAa5D"}

package/dist/drivers/LinkedInOpenidConnectDriver.js

@@ -0,0 +1,27 @@
+/**
+ * LinkedIn OAuth2 driver — OpenID Connect.
+ *
+ * This is the flow LinkedIn issues new applications: one `userinfo` call,
+ * standard claims. The member API is `LinkedInDriver`.
+ */
+import { Oauth2Driver, str } from "../Oauth2Driver.js";
+export class LinkedInOpenidConnectDriver extends Oauth2Driver {
+    provider = "LinkedIn";
+    authorizeUrl = "https://www.linkedin.com/oauth/v2/authorization";
+    accessTokenUrl = "https://www.linkedin.com/oauth/v2/accessToken";
+    userInfoUrl = "https://api.linkedin.com/v2/userinfo";
+    defaultScopes = ["openid", "profile", "email"];
+    mapUser(raw) {
+        return {
+            // `sub` is the stable subject identifier; `id` does not exist here.
+            id: String(raw.sub ?? ""),
+            email: String(raw.email ?? ""),
+            name: String(raw.name ?? ""),
+            nickName: str(raw, "given_name"),
+            avatarUrl: str(raw, "picture"),
+            emailVerificationState: raw.email_verified === true ? "verified" : "unverified",
+            raw,
+        };
+    }
+}
+//# sourceMappingURL=LinkedInOpenidConnectDriver.js.map

package/dist/drivers/LinkedInOpenidConnectDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinkedInOpenidConnectDriver.js","sourceRoot":"","sources":["../../src/drivers/LinkedInOpenidConnectDriver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,OAAO,2BAA4B,SAAQ,YAAY;IACzC,QAAQ,GAAG,UAAU,CAAC;IACtB,YAAY,GAC9B,iDAAiD,CAAC;IAChC,cAAc,GAChC,+CAA+C,CAAC;IAC9B,WAAW,GAAG,sCAAsC,CAAC;IACrD,aAAa,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;IAEjE,OAAO,CAAC,GAA4B;QAC7C,OAAO;YACN,oEAAoE;YACpE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;YACzB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC;YAChC,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC;YAC9B,sBAAsB,EACrB,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;YACxD,GAAG;SACH,CAAC;IACH,CAAC;CACD"}

package/dist/drivers/OidcDriver.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Generic OpenID Connect.
+ *
+ * One driver for every provider that conforms: Keycloak, Auth0, Okta,
+ * Entra ID, Authentik, Zitadel, Ping, Google. It is given an issuer and reads
+ * the rest — endpoints, keys, supported algorithms — from what the provider
+ * publishes about itself.
+ *
+ * What separates this from a plain OAuth2 driver is that the answer is a
+ * SIGNED STATEMENT about who the user is, not just a token to go ask with.
+ * That statement is only worth anything once it has been verified, which is
+ * what `jwt.ts` does and what most of this class exists to feed.
+ */
+import { type RemoteOptions } from "../oidc.js";
+import type { OAuthToken, RedirectRequest, TransitDriver, TransitUser } from "../types.js";
+export interface OidcConfig {
+    /** The provider's issuer URL, exactly as it appears in its tokens. */
+    issuer: string;
+    clientId: string;
+    /**
+     * The client secret, or something that mints one. Apple has no static
+     * secret — it expects a short-lived JWT signed with a private key — so this
+     * is resolved at each token request rather than read once.
+     */
+    clientSecret: string | (() => string | Promise<string>);
+    callbackUrl: string;
+    /** Default `["openid", "profile", "email"]`. `openid` is added if omitted. */
+    scopes?: string[];
+    /** Extra parameters on the authorize URL — `prompt`, `login_hint`, `acr_values`. */
+    authorizeParams?: Record<string, string>;
+    /**
+     * Also call the userinfo endpoint, when the provider advertises one.
+     * Default `true`: the id_token often carries only the subject.
+     */
+    userinfo?: boolean;
+    /** Tolerance for clock drift against the provider, in seconds. Default 60. */
+    leewaySeconds?: number;
+    /** Cache tuning for the discovery document and the signing keys. */
+    cache?: RemoteOptions;
+}
+export declare class OidcDriver implements TransitDriver {
+    #private;
+    constructor(config: OidcConfig);
+    /**
+     * The endpoints are only known once the provider has been asked, so there
+     * is nothing to build offline.
+     */
+    redirectUrl(): string;
+    begin(state?: string): Promise<RedirectRequest>;
+    callback(code: string, state?: string, expectedState?: string, secret?: string): Promise<{
+        user: TransitUser;
+        token: OAuthToken;
+    }>;
+    /** Read a profile behind a token already held, through the userinfo endpoint. */
+    userFromToken(accessToken: string): Promise<TransitUser>;
+    /**
+     * Turn the claims into the shape every driver answers with. A provider that
+     * spells a standard claim its own way overrides this.
+     */
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+/** Standard OpenID Connect claims, in the shape every driver answers with. */
+export declare function mapOidcUser(raw: Record<string, unknown>): TransitUser;
+//# sourceMappingURL=OidcDriver.d.ts.map

package/dist/drivers/OidcDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/OidcDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAIN,KAAK,aAAa,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACX,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,MAAM,aAAa,CAAC;AAGrB,MAAM,WAAW,UAAU;IAC1B,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,KAAK,CAAC,EAAE,aAAa,CAAC;CACtB;AASD,qBAAa,UAAW,YAAW,aAAa;;gBAKnC,MAAM,EAAE,UAAU;IAM9B;;;OAGG;IACH,WAAW,IAAI,MAAM;IAMf,KAAK,CAAC,KAAK,GAAE,MAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IAmC7D,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAgCpD,iFAAiF;IAC3E,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAY9D;;;OAGG;IACH,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CA0J5D;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAkBrE"}

package/dist/drivers/OidcDriver.js

@@ -0,0 +1,259 @@
+/**
+ * Generic OpenID Connect.
+ *
+ * One driver for every provider that conforms: Keycloak, Auth0, Okta,
+ * Entra ID, Authentik, Zitadel, Ping, Google. It is given an issuer and reads
+ * the rest — endpoints, keys, supported algorithms — from what the provider
+ * publishes about itself.
+ *
+ * What separates this from a plain OAuth2 driver is that the answer is a
+ * SIGNED STATEMENT about who the user is, not just a token to go ask with.
+ * That statement is only worth anything once it has been verified, which is
+ * what `jwt.ts` does and what most of this class exists to feed.
+ */
+import { randomUUID } from "node:crypto";
+import { assertIdTokenClaims, decodeJws, isSupportedAlg, verifyJwsSignature, } from "../jwt.js";
+import { challengeFor, createCodeVerifier } from "../Oauth2Driver.js";
+import { JwksCache, OidcDiscovery, } from "../oidc.js";
+import { assertOAuthState } from "../types.js";
+/**
+ * `secret` carries two values here — the PKCE verifier and the nonce — and the
+ * caller only has to store it and hand it back. Joined by a dot, which the
+ * base64url alphabet does not contain, so neither half can forge a boundary.
+ */
+const SECRET_SEPARATOR = ".";
+export class OidcDriver {
+    #config;
+    #discovery;
+    #jwks;
+    constructor(config) {
+        this.#config = config;
+        this.#discovery = new OidcDiscovery(config.issuer, config.cache);
+        this.#jwks = new JwksCache(config.cache);
+    }
+    /**
+     * The endpoints are only known once the provider has been asked, so there
+     * is nothing to build offline.
+     */
+    redirectUrl() {
+        throw new Error("[transit] an OpenID Connect provider publishes its endpoints, so the redirect is fetched. Use begin() instead of redirect().");
+    }
+    async begin(state = randomUUID()) {
+        const metadata = await this.#discovery.metadata();
+        const verifier = createCodeVerifier();
+        const nonce = randomUUID();
+        const params = new URLSearchParams({
+            client_id: this.#config.clientId,
+            redirect_uri: this.#config.callbackUrl,
+            response_type: "code",
+            scope: this.#scopes().join(" "),
+            state,
+            nonce,
+            ...this.#config.authorizeParams,
+        });
+        // PKCE is not optional for a public client and costs nothing for a
+        // confidential one, so it is sent unless the provider says outright that
+        // it does not take S256.
+        const pkce = metadata.code_challenge_methods_supported?.includes("S256") !== false;
+        if (pkce) {
+            params.set("code_challenge", challengeFor(verifier));
+            params.set("code_challenge_method", "S256");
+        }
+        // Whether PKCE was used travels in `secret`. Sending a verifier for a
+        // challenge that was never sent is at best noise, and a strict provider
+        // refuses the exchange over it.
+        return {
+            url: `${metadata.authorization_endpoint}?${params}`,
+            state,
+            secret: `${pkce ? verifier : ""}${SECRET_SEPARATOR}${nonce}`,
+        };
+    }
+    async callback(code, state, expectedState, secret) {
+        assertOAuthState(state, expectedState);
+        const { verifier, nonce } = splitSecret(secret);
+        const metadata = await this.#discovery.metadata();
+        const tokens = await this.#exchange(metadata, code, verifier);
+        const idToken = tokens.id_token;
+        if (typeof idToken !== "string" || idToken === "") {
+            throw new Error("[transit] the provider returned no id_token — check that the 'openid' scope is granted");
+        }
+        const claims = await this.#verifyIdToken(metadata, idToken, nonce);
+        const accessToken = String(tokens.access_token ?? "");
+        const profile = await this.#profile(metadata, accessToken, claims);
+        return {
+            user: this.mapUser(profile),
+            token: {
+                accessToken,
+                ...(typeof tokens.refresh_token === "string"
+                    ? { refreshToken: tokens.refresh_token }
+                    : {}),
+                ...(typeof tokens.expires_in === "number"
+                    ? { expiresIn: tokens.expires_in }
+                    : {}),
+            },
+        };
+    }
+    /** Read a profile behind a token already held, through the userinfo endpoint. */
+    async userFromToken(accessToken) {
+        const metadata = await this.#discovery.metadata();
+        if (!metadata.userinfo_endpoint) {
+            throw new Error(`[transit] '${this.#config.issuer}' publishes no userinfo endpoint, so a profile cannot be read from a token alone.`);
+        }
+        return this.mapUser(await this.#userinfo(metadata.userinfo_endpoint, accessToken));
+    }
+    /**
+     * Turn the claims into the shape every driver answers with. A provider that
+     * spells a standard claim its own way overrides this.
+     */
+    mapUser(raw) {
+        return mapOidcUser(raw);
+    }
+    /** The secret for one token request. */
+    async #clientSecret() {
+        const secret = this.#config.clientSecret;
+        return typeof secret === "function" ? await secret() : secret;
+    }
+    #scopes() {
+        const scopes = [...(this.#config.scopes ?? ["openid", "profile", "email"])];
+        // Without `openid` the provider runs a plain OAuth2 flow and returns no
+        // id_token, which fails later with a much less obvious message.
+        if (!scopes.includes("openid"))
+            scopes.unshift("openid");
+        return scopes;
+    }
+    async #exchange(metadata, code, verifier) {
+        const body = new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: this.#config.callbackUrl,
+            client_id: this.#config.clientId,
+            client_secret: await this.#clientSecret(),
+            // Only when a challenge was actually sent.
+            ...(verifier === "" ? {} : { code_verifier: verifier }),
+        });
+        const response = await fetch(metadata.token_endpoint, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body,
+        });
+        if (!response.ok) {
+            throw new Error(`[transit] OpenID Connect token exchange failed (HTTP ${response.status})`);
+        }
+        return (await response.json());
+    }
+    /**
+     * The signature first, then every claim. The algorithm comes from what the
+     * provider declared it signs with, intersected with what can be verified —
+     * never from the token's own header.
+     */
+    async #verifyIdToken(metadata, idToken, nonce) {
+        const parts = decodeJws(idToken);
+        const alg = this.#algorithmFor(metadata, parts.header.alg);
+        const kid = typeof parts.header.kid === "string" ? parts.header.kid : undefined;
+        const key = await this.#jwks.key(metadata.jwks_uri, kid);
+        if (!verifyJwsSignature(parts, key, alg)) {
+            throw new Error("[transit] id_token signature does not verify");
+        }
+        return assertIdTokenClaims(parts.payload, {
+            issuer: metadata.issuer,
+            audience: this.#config.clientId,
+            nonce,
+            leewaySeconds: this.#config.leewaySeconds,
+        });
+    }
+    /**
+     * Which algorithm to verify with.
+     *
+     * The header's value is used only to CHOOSE among what the provider says it
+     * signs with; it can never introduce one that was not declared, and it can
+     * never select a family this refuses.
+     */
+    #algorithmFor(metadata, headerAlg) {
+        // Every conforming provider supports RS256 and publishes the list; the
+        // narrow reading when it does not is that RS256 is all there is.
+        const declared = metadata.id_token_signing_alg_values_supported ?? [
+            "RS256",
+        ];
+        const allowed = declared.filter(isSupportedAlg);
+        if (allowed.length === 0) {
+            throw new Error(`[transit] '${this.#config.issuer}' signs id_tokens only with algorithms Transit refuses (${declared.join(", ")}). Asymmetric signatures are required.`);
+        }
+        if (!isSupportedAlg(headerAlg)) {
+            throw new Error(`[transit] id_token announces '${String(headerAlg)}', which Transit does not verify — only asymmetric signatures are accepted`);
+        }
+        if (!allowed.includes(headerAlg)) {
+            throw new Error(`[transit] id_token announces '${headerAlg}', which '${this.#config.issuer}' did not declare it signs with`);
+        }
+        // The header only ever SELECTS from the set computed above. It cannot
+        // introduce an algorithm, which is what keeps `none` and the
+        // shared-secret families away from the verifier entirely.
+        return headerAlg;
+    }
+    /**
+     * The claims, plus userinfo when there is one. The subject must be the same
+     * in both: a userinfo response describing another user is a substituted
+     * token, not a richer profile.
+     */
+    async #profile(metadata, accessToken, claims) {
+        if (this.#config.userinfo === false ||
+            !metadata.userinfo_endpoint ||
+            accessToken === "") {
+            return claims;
+        }
+        const info = await this.#userinfo(metadata.userinfo_endpoint, accessToken);
+        if (info.sub !== claims.sub) {
+            throw new Error("[transit] the userinfo response describes a different subject than the id_token");
+        }
+        return { ...claims, ...info };
+    }
+    async #userinfo(endpoint, accessToken) {
+        const response = await fetch(endpoint, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/json",
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`[transit] OpenID Connect userinfo request failed (HTTP ${response.status})`);
+        }
+        return (await response.json());
+    }
+}
+/** Standard OpenID Connect claims, in the shape every driver answers with. */
+export function mapOidcUser(raw) {
+    const given = str(raw, "given_name");
+    const family = str(raw, "family_name");
+    const email = str(raw, "email");
+    return {
+        id: String(raw.sub ?? ""),
+        email: email ?? "",
+        name: str(raw, "name") ?? [given, family].filter(Boolean).join(" "),
+        nickName: str(raw, "preferred_username") ?? given,
+        avatarUrl: str(raw, "picture"),
+        emailVerificationState: email === undefined
+            ? "unsupported"
+            : raw.email_verified === true
+                ? "verified"
+                : "unverified",
+        raw,
+    };
+}
+function str(raw, key) {
+    const value = raw[key];
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+/** Split the value `begin()` asked the caller to keep. */
+function splitSecret(secret) {
+    const index = secret?.indexOf(SECRET_SEPARATOR) ?? -1;
+    // An empty verifier is legitimate — it says PKCE was not used. A missing
+    // separator, or a missing nonce, is a value that did not come from begin().
+    const nonce = secret === undefined ? "" : secret.slice(index + 1);
+    if (secret === undefined || index === -1 || nonce === "") {
+        throw new Error("[transit] OpenID Connect needs the value begin() returned as `secret` — store it with the state and pass it back here.");
+    }
+    return { verifier: secret.slice(0, index), nonce };
+}
+//# sourceMappingURL=OidcDriver.js.map

package/dist/drivers/OidcDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcDriver.js","sourceRoot":"","sources":["../../src/drivers/OidcDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,mBAAmB,EACnB,SAAS,EAET,cAAc,EAEd,kBAAkB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EACN,SAAS,EACT,aAAa,GAGb,MAAM,YAAY,CAAC;AAOpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA4B/C;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,OAAO,UAAU;IACb,OAAO,CAAa;IACpB,UAAU,CAAgB;IAC1B,KAAK,CAAY;IAE1B,YAAY,MAAkB;QAC7B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,MAAM,IAAI,KAAK,CACd,8HAA8H,CAC9H,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,UAAU,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACtC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,KAAK;YACL,KAAK;YACL,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe;SAC/B,CAAC,CAAC;QAEH,mEAAmE;QACnE,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,IAAI,GACT,QAAQ,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC;QACvE,IAAI,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,gCAAgC;QAChC,OAAO;YACN,GAAG,EAAE,GAAG,QAAQ,CAAC,sBAAsB,IAAI,MAAM,EAAE;YACnD,KAAK;YACL,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,gBAAgB,GAAG,KAAK,EAAE;SAC5D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB,EACtB,MAAe;QAEf,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,wFAAwF,CACxF,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAEnE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAEnE,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAC3B,KAAK,EAAE;gBACN,WAAW;gBACX,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;oBAC3C,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE;oBACxC,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;oBACxC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACN;SACD,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,aAAa,CAAC,WAAmB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACd,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM,mFAAmF,CACpH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAClB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAC7D,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,OAAO,CAAC,GAA4B;QAC7C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,aAAa;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACzC,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,CAAC;IAED,OAAO;QACN,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5E,wEAAwE;QACxE,gEAAgE;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CACd,QAAsB,EACtB,IAAY,EACZ,QAAgB;QAEhB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAChC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACtC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE;YACzC,2CAA2C;YAC3C,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACnD;YACD,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,wDAAwD,QAAQ,CAAC,MAAM,GAAG,CAC1E,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CACnB,QAAsB,EACtB,OAAe,EACf,KAAa;QAEb,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,GAAG,GACR,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAErE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE;YACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACzC,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAsB,EAAE,SAAkB;QACvD,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,qCAAqC,IAAI;YAClE,OAAO;SACP,CAAC;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACd,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM,2DAA2D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CACvJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACd,iCAAiC,MAAM,CAAC,SAAS,CAAC,4EAA4E,CAC9H,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACd,iCAAiC,SAAS,aAAa,IAAI,CAAC,OAAO,CAAC,MAAM,iCAAiC,CAC3G,CAAC;QACH,CAAC;QACD,sEAAsE;QACtE,6DAA6D;QAC7D,0DAA0D;QAC1D,OAAO,SAAS,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,QAAsB,EACtB,WAAmB,EACnB,MAAqB;QAErB,IACC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK;YAC/B,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,WAAW,KAAK,EAAE,EACjB,CAAC;YACF,OAAO,MAA4C,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACd,iFAAiF,CACjF,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAAI,MAA6C,EAAE,GAAG,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,SAAS,CACd,QAAgB,EAChB,WAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACtC,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC1B;SACD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,0DAA0D,QAAQ,CAAC,MAAM,GAAG,CAC5E,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,CAAC;CACD;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,GAA4B;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO;QACN,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;QAClB,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACnE,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,KAAK;QACjD,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC;QAC9B,sBAAsB,EACrB,KAAK,KAAK,SAAS;YAClB,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI;gBAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,YAAY;QACjB,GAAG;KACH,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,GAA4B,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,0DAA0D;AAC1D,SAAS,WAAW,CAAC,MAA0B;IAI9C,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACd,wHAAwH,CACxH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC"}

package/dist/drivers/SamlDriver.d.ts

@@ -0,0 +1,66 @@
+/**
+ * SAML 2.0 Web Browser SSO.
+ *
+ * The pieces are the four layers below this one; what this adds is the walk
+ * between them, and the two bindings a browser sign-in uses: the request
+ * leaves deflated in a query string, and the response comes back base64 in a
+ * form POST.
+ *
+ * The order here is the security. The signature is checked FIRST, and
+ * everything read afterwards comes out of the element it covers — the status
+ * being the one exception, and a deliberate one.
+ */
+import { type AssertionReplayStore } from "../replay.js";
+import type { OAuthToken, RedirectRequest, TransitDriver, TransitUser } from "../types.js";
+export interface SamlConfig {
+    /** This application's entity id, as the provider knows it. */
+    entityId: string;
+    /** Where the provider posts its response — this application's ACS URL. */
+    callbackUrl: string;
+    /** The provider's entity id, exactly as its metadata declares it. */
+    issuer: string;
+    /** The provider's sign-on endpoint, for the redirect binding. */
+    signOnUrl: string;
+    /**
+     * The provider's signing certificates, from its metadata. Several are
+     * accepted so a rotation can be prepared before it happens.
+     */
+    certificates: string[];
+    /** The name identifier format to ask for. */
+    nameIdFormat?: string;
+    /** Tolerance for clock drift against the provider. Default 60 seconds. */
+    clockSkewSeconds?: number;
+    /**
+     * Where used assertions are remembered.
+     *
+     * Defaults to this process's memory, which accepts the same assertion once
+     * per replica — pass `replayStores.redis(…)` as soon as there are two.
+     */
+    replayStore?: AssertionReplayStore | (() => AssertionReplayStore);
+    /** The attribute names this provider uses, when they are not the usual ones. */
+    claims?: {
+        email?: string;
+        name?: string;
+        nickName?: string;
+    };
+}
+export declare class SamlDriver implements TransitDriver {
+    #private;
+    constructor(config: SamlConfig);
+    /**
+     * A SAML request carries its own id, and that id is what the response has
+     * to answer. There is nothing to build without minting one.
+     */
+    redirectUrl(): string;
+    begin(state?: string): Promise<RedirectRequest>;
+    /**
+     * `code` is the base64 `SAMLResponse` from the form post, `state` the
+     * `RelayState` that came back, `expectedState` the one sent, and `secret`
+     * the request id `begin()` minted.
+     */
+    callback(code: string, state?: string, expectedState?: string, secret?: string): Promise<{
+        user: TransitUser;
+        token: OAuthToken;
+    }>;
+}
+//# sourceMappingURL=SamlDriver.d.ts.map

package/dist/drivers/SamlDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SamlDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/SamlDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACN,KAAK,oBAAoB,EAEzB,MAAM,cAAc,CAAC;AAQtB,OAAO,KAAK,EACX,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,MAAM,aAAa,CAAC;AAkCrB,MAAM,WAAW,UAAU;IAC1B,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,CAAC,MAAM,oBAAoB,CAAC,CAAC;IAClE,gFAAgF;IAChF,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAsBD,qBAAa,UAAW,YAAW,aAAa;;gBAInC,MAAM,EAAE,UAAU;IAkB9B;;;OAGG;IACH,WAAW,IAAI,MAAM;IAMf,KAAK,CAAC,KAAK,GAAE,MAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IAwBnE;;;;OAIG;IACG,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CA+GpD"}