@contember/engine-tenant-api 1.4.0-rc.8 → 2.0.0-alpha.8

package/dist/production/src/model/service/idp/providers/AppleProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppleProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'\nimport { catchTypesafe } from './helpers'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tclaims: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPClaim> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AAUO,MAAM,qBAAqB,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,QAAQ,SAAS;AAAA,IACjB,UAAU,SAAS;AAAA,IACnB,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACE,kBAAA,MAAA,QAAA;AAEgB,kBAAA,MAAA,yBAAA,cAAc,oBAAoB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,QAAQ,cAAc;AAAA,MACtB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAkC;AACjG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAM,OAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAM,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAI,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAO,CAAA,EACzE,cACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEV,WAAA,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/production/src/model/service/idp/providers/FacebookProvider.cjs

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Typesafe = require("@contember/typesafe");
+const openidClient = require("openid-client");
+const IDPValidationError = require("../IDPValidationError.cjs");
+const InvalidIDPConfigurationError = require("../InvalidIDPConfigurationError.cjs");
+const helpers = require("./helpers.cjs");
+const OIDCTypes = require("./OIDCTypes.cjs");
+const OIDCHelpers = require("./OIDCHelpers.cjs");
+const crypto = require("node:crypto");
+const IDPResponseError = require("../IDPResponseError.cjs");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const FacebookConfiguration = OIDCTypes.BaseOIDCConfiguration;
+const FacebookResponseData = Typesafe__namespace.union(
+  OIDCTypes.OIDCResponseData,
+  Typesafe__namespace.object({
+    authResponse: Typesafe__namespace.object({
+      accessToken: Typesafe__namespace.string,
+      signedRequest: Typesafe__namespace.string
+    })
+  })
+);
+const FacebookResponsePayload = Typesafe__namespace.object({
+  user_id: Typesafe__namespace.string,
+  code: Typesafe__namespace.string
+});
+class FacebookProvider {
+  constructor() {
+    __publicField(this, "facebookIssuer", new openidClient.Issuer({
+      issuer: "https://www.facebook.com",
+      authorization_endpoint: "https://facebook.com/dialog/oauth/",
+      jwks_uri: "https://www.facebook.com/.well-known/oauth/openid/jwks/",
+      response_types_supported: [
+        "id_token",
+        "token id_token"
+      ],
+      subject_types_supported: [
+        "pairwise"
+      ],
+      id_token_signing_alg_values_supported: [
+        "RS256"
+      ],
+      claims_supported: [
+        "iss",
+        "aud",
+        "sub",
+        "iat",
+        "exp",
+        "jti",
+        "nonce",
+        "at_hash",
+        "name",
+        "given_name",
+        "middle_name",
+        "family_name",
+        "email",
+        "picture",
+        "user_friends",
+        "user_birthday",
+        "user_age_range",
+        "user_link",
+        "user_hometown",
+        "user_location",
+        "user_gender"
+      ],
+      token_endpoint: "https://graph.facebook.com/v11.0/oauth/access_token"
+    }));
+    __publicField(this, "validateConfiguration", helpers.catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError.InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = helpers.catchTypesafe(OIDCTypes.OIDCInitData, IDPValidationError.IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.initOIDCAuth(client, {
+      claims: configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = helpers.catchTypesafe(FacebookResponseData, IDPValidationError.IDPValidationError)(data);
+    if (!("authResponse" in responseData)) {
+      const client = await this.createOIDCClient(configuration);
+      return await OIDCHelpers.handleOIDCResponse(client, responseData);
+    } else {
+      const [sig, payload] = responseData.authResponse.signedRequest.split(".");
+      const data2 = helpers.catchTypesafe(FacebookResponsePayload, IDPValidationError.IDPValidationError)(JSON.parse(Buffer.from(payload, "base64").toString("utf8")));
+      const hmac = crypto.createHmac("sha256", configuration.clientSecret);
+      const signature = hmac.update(payload).digest();
+      const isSignatureValid = signature.compare(Buffer.from(sig, "base64")) === 0;
+      if (!isSignatureValid) {
+        throw new IDPValidationError.IDPValidationError("Invalid signature");
+      }
+      const url = `https://graph.facebook.com/${data2.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`;
+      const response = await fetch(url);
+      if (!response.ok) {
+        throw new IDPResponseError.IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`);
+      }
+      const apiData = await response.json();
+      return {
+        externalIdentifier: data2.user_id,
+        name: apiData.name,
+        email: apiData.email
+      };
+    }
+  }
+  getPublicConfiguration({ clientSecret, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    return new this.facebookIssuer.Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        response_types: [configuration.responseType || "code"]
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+  }
+}
+exports.FacebookProvider = FacebookProvider;
+//# sourceMappingURL=FacebookProvider.cjs.map

package/dist/production/src/model/service/idp/providers/FacebookProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"FacebookProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\n\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tclaims: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPClaim> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["BaseOIDCConfiguration","Typesafe","OIDCResponseData","Issuer","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","handleOIDCResponse","data","createHmac","IDPResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,MAAM,wBAAwBA,UAAAA;AAG9B,MAAM,uBAAuBC,oBAAS;AAAA,EACrCC,UAAA;AAAA,EACAD,oBAAS,OAAO;AAAA,IACf,cAAcA,oBAAS,OAAO;AAAA,MAC7B,aAAaA,oBAAS;AAAA,MACtB,eAAeA,oBAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0BA,oBAAS,OAAO;AAAA,EAC/C,SAASA,oBAAS;AAAA,EAClB,MAAMA,oBAAS;AAChB,CAAC;AAKM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGE,kBAAA,MAAA,kBAAiB,IAAIE,oBAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MACD;AAAA,MACA,yBAAyB;AAAA,QACxB;AAAA,MACD;AAAA,MACA,uCAAuC;AAAA,QACtC;AAAA,MACD;AAAA,MACA,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,MACA,gBAAgB;AAAA,IAChB,CAAA,CAAA;AAEuB,kBAAA,MAAA,yBAAAC,QAAA,cAAc,uBAAuBC,6BAA4B,4BAAA,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMC,yBAAa,QAAQ;AAAA,MACjC,QAAQ,cAAc;AAAA,MACtB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAkC;AACpG,UAAM,eAAeJ,QAAAA,cAAc,sBAAsBG,mBAAAA,kBAAkB,EAAE,IAAI;AAE7E,QAAA,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,aAAA,MAAME,YAAmB,mBAAA,QAAQ,YAAY;AAAA,IAAA,OAC9C;AACA,YAAA,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMC,QAAON,QAAAA,cAAc,yBAAyBG,mBAAAA,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAOI,OAAA,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAO;AACxC,YAAA,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AAChB,cAAA,IAAIJ,mBAAAA,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BG,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AAC3H,YAAA,WAAW,MAAM,MAAM,GAAG;AAC5B,UAAA,CAAC,SAAS,IAAI;AACX,cAAA,IAAIE,iBAAiB,iBAAA,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAM,CAAA,EAAE;AAAA,MACtG;AACM,YAAA,UAAU,MAAM,SAAS;AAExB,aAAA;AAAA,QACN,oBAAoBF,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AACnG,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AAC9E,WAAA,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;;"}

package/dist/production/src/model/service/idp/providers/FacebookProvider.js

@@ -0,0 +1,125 @@
+import * as Typesafe from "@contember/typesafe";
+import { Issuer } from "openid-client";
+import { IDPValidationError } from "../IDPValidationError.js";
+import { InvalidIDPConfigurationError } from "../InvalidIDPConfigurationError.js";
+import { catchTypesafe } from "./helpers.js";
+import { OIDCResponseData, OIDCInitData, BaseOIDCConfiguration } from "./OIDCTypes.js";
+import { initOIDCAuth, handleOIDCResponse } from "./OIDCHelpers.js";
+import { createHmac } from "node:crypto";
+import { IDPResponseError } from "../IDPResponseError.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const FacebookConfiguration = BaseOIDCConfiguration;
+const FacebookResponseData = Typesafe.union(
+  OIDCResponseData,
+  Typesafe.object({
+    authResponse: Typesafe.object({
+      accessToken: Typesafe.string,
+      signedRequest: Typesafe.string
+    })
+  })
+);
+const FacebookResponsePayload = Typesafe.object({
+  user_id: Typesafe.string,
+  code: Typesafe.string
+});
+class FacebookProvider {
+  constructor() {
+    __publicField(this, "facebookIssuer", new Issuer({
+      issuer: "https://www.facebook.com",
+      authorization_endpoint: "https://facebook.com/dialog/oauth/",
+      jwks_uri: "https://www.facebook.com/.well-known/oauth/openid/jwks/",
+      response_types_supported: [
+        "id_token",
+        "token id_token"
+      ],
+      subject_types_supported: [
+        "pairwise"
+      ],
+      id_token_signing_alg_values_supported: [
+        "RS256"
+      ],
+      claims_supported: [
+        "iss",
+        "aud",
+        "sub",
+        "iat",
+        "exp",
+        "jti",
+        "nonce",
+        "at_hash",
+        "name",
+        "given_name",
+        "middle_name",
+        "family_name",
+        "email",
+        "picture",
+        "user_friends",
+        "user_birthday",
+        "user_age_range",
+        "user_link",
+        "user_hometown",
+        "user_location",
+        "user_gender"
+      ],
+      token_endpoint: "https://graph.facebook.com/v11.0/oauth/access_token"
+    }));
+    __publicField(this, "validateConfiguration", catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await initOIDCAuth(client, {
+      claims: configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data);
+    if (!("authResponse" in responseData)) {
+      const client = await this.createOIDCClient(configuration);
+      return await handleOIDCResponse(client, responseData);
+    } else {
+      const [sig, payload] = responseData.authResponse.signedRequest.split(".");
+      const data2 = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, "base64").toString("utf8")));
+      const hmac = createHmac("sha256", configuration.clientSecret);
+      const signature = hmac.update(payload).digest();
+      const isSignatureValid = signature.compare(Buffer.from(sig, "base64")) === 0;
+      if (!isSignatureValid) {
+        throw new IDPValidationError("Invalid signature");
+      }
+      const url = `https://graph.facebook.com/${data2.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`;
+      const response = await fetch(url);
+      if (!response.ok) {
+        throw new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`);
+      }
+      const apiData = await response.json();
+      return {
+        externalIdentifier: data2.user_id,
+        name: apiData.name,
+        email: apiData.email
+      };
+    }
+  }
+  getPublicConfiguration({ clientSecret, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    return new this.facebookIssuer.Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        response_types: [configuration.responseType || "code"]
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+  }
+}
+export {
+  FacebookProvider
+};
+//# sourceMappingURL=FacebookProvider.js.map

package/dist/production/src/model/service/idp/providers/FacebookProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FacebookProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\n\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tclaims: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPClaim> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["data"],"mappings":";;;;;;;;;;;;AAaA,MAAM,wBAAwB;AAG9B,MAAM,uBAAuB,SAAS;AAAA,EACrC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,cAAc,SAAS,OAAO;AAAA,MAC7B,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0B,SAAS,OAAO;AAAA,EAC/C,SAAS,SAAS;AAAA,EAClB,MAAM,SAAS;AAChB,CAAC;AAKM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGE,kBAAA,MAAA,kBAAiB,IAAI,OAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MACD;AAAA,MACA,yBAAyB;AAAA,QACxB;AAAA,MACD;AAAA,MACA,uCAAuC;AAAA,QACtC;AAAA,MACD;AAAA,MACA,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,MACA,gBAAgB;AAAA,IAChB,CAAA,CAAA;AAEuB,kBAAA,MAAA,yBAAA,cAAc,uBAAuB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,QAAQ,cAAc;AAAA,MACtB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAkC;AACpG,UAAM,eAAe,cAAc,sBAAsB,kBAAkB,EAAE,IAAI;AAE7E,QAAA,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,aAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,IAAA,OAC9C;AACA,YAAA,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMA,QAAO,cAAc,yBAAyB,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAO,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAO;AACxC,YAAA,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AAChB,cAAA,IAAI,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BA,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AAC3H,YAAA,WAAW,MAAM,MAAM,GAAG;AAC5B,UAAA,CAAC,SAAS,IAAI;AACX,cAAA,IAAI,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAM,CAAA,EAAE;AAAA,MACtG;AACM,YAAA,UAAU,MAAM,SAAS;AAExB,aAAA;AAAA,QACN,oBAAoBA,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AACnG,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AAC9E,WAAA,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/production/src/model/service/idp/providers/OIDCHelpers.cjs

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const openidClient = require("openid-client");
+const IDPValidationError = require("../IDPValidationError.cjs");
+const IDPResponseError = require("../IDPResponseError.cjs");
+openidClient.custom.setHttpOptionsDefaults({
+  timeout: 5e3
+});
+const initOIDCAuth = async (client, { redirectUrl, claims, responseMode }) => {
+  const nonce = openidClient.generators.nonce();
+  const state = openidClient.generators.state();
+  const url = client.authorizationUrl({
+    redirect_uri: redirectUrl,
+    response_mode: responseMode,
+    scope: claims ?? "openid email",
+    nonce,
+    state
+  });
+  return {
+    authUrl: url,
+    sessionData: { nonce, state }
+  };
+};
+const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }) => {
+  const params = "parameters" in otherData ? otherData.parameters : client.callbackParams(otherData.url);
+  if (params.state && !sessionData?.state) {
+    throw new IDPValidationError.IDPValidationError(`state is present in parameters, but missing in session data`);
+  }
+  try {
+    const result = await client.callback(redirectUrl, params, sessionData);
+    const claims = result.claims();
+    return {
+      externalIdentifier: claims.sub,
+      email: claims.email,
+      name: claims.name
+    };
+  } catch (e) {
+    if (e instanceof openidClient.errors.RPError) {
+      throw new IDPValidationError.IDPValidationError(e.message);
+    }
+    if (e instanceof openidClient.errors.OPError) {
+      const body = e.response?.body;
+      if (typeof body === "object" && typeof body?.error === "object" && typeof body.error?.message === "string") {
+        throw new IDPResponseError.IDPResponseError(body.error.message);
+      }
+      throw new IDPResponseError.IDPResponseError(e.message);
+    }
+    throw e;
+  }
+};
+exports.handleOIDCResponse = handleOIDCResponse;
+exports.initOIDCAuth = initOIDCAuth;
+//# sourceMappingURL=OIDCHelpers.cjs.map

package/dist/production/src/model/service/idp/providers/OIDCHelpers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\n\ncustom.setHttpOptionsDefaults({\n\ttimeout: 5000,\n})\n\nexport const initOIDCAuth = async (client: Client, { redirectUrl, claims, responseMode }: { redirectUrl: string; claims?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: claims ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<IDPClaim> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\treturn {\n\t\t\texternalIdentifier: claims.sub,\n\t\t\temail: claims.email,\n\t\t\tname: claims.name,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":["custom","generators","IDPValidationError","errors","IDPResponseError"],"mappings":";;;;;AAMAA,aAAA,OAAO,uBAAuB;AAAA,EAC7B,SAAS;AACV,CAAC;AAEM,MAAM,eAAe,OAAO,QAAgB,EAAE,aAAa,QAAQ,mBAAgH;AACnL,QAAA,QAAQC,wBAAW;AACnB,QAAA,QAAQA,wBAAW;AACnB,QAAA,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,UAAU;AAAA,IACjB;AAAA,IACA;AAAA,EAAA,CACA;AAEM,SAAA;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAM;AAAA,EAAA;AAE9B;AAEa,MAAA,qBAAqB,OAAO,QAAgB,EAAE,aAAa,aAAa,GAAG,gBAAqD;AACtI,QAAA,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AAClC,UAAA,IAAIC,sCAAmB,6DAA6D;AAAA,EAC3F;AACI,MAAA;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AAC/D,UAAA,SAAS,OAAO;AACf,WAAA;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,OAAO,OAAO;AAAA,MACd,MAAM,OAAO;AAAA,IAAA;AAAA,WAEN,GAAQ;AACZ,QAAA,aAAaC,oBAAO,SAAS;AAC1B,YAAA,IAAID,mBAAmB,mBAAA,EAAE,OAAO;AAAA,IACvC;AACI,QAAA,aAAaC,oBAAO,SAAS;AAC1B,YAAA,OAAO,EAAE,UAAU;AACrB,UAAA,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACM,YAAA,IAAIA,iBAAiB,iBAAA,EAAE,OAAO;AAAA,IACrC;AACM,UAAA;AAAA,EACP;AACD;;;"}

package/dist/production/src/model/service/idp/providers/OIDCHelpers.js

@@ -0,0 +1,53 @@
+import { custom, generators, errors } from "openid-client";
+import { IDPValidationError } from "../IDPValidationError.js";
+import { IDPResponseError } from "../IDPResponseError.js";
+custom.setHttpOptionsDefaults({
+  timeout: 5e3
+});
+const initOIDCAuth = async (client, { redirectUrl, claims, responseMode }) => {
+  const nonce = generators.nonce();
+  const state = generators.state();
+  const url = client.authorizationUrl({
+    redirect_uri: redirectUrl,
+    response_mode: responseMode,
+    scope: claims ?? "openid email",
+    nonce,
+    state
+  });
+  return {
+    authUrl: url,
+    sessionData: { nonce, state }
+  };
+};
+const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }) => {
+  const params = "parameters" in otherData ? otherData.parameters : client.callbackParams(otherData.url);
+  if (params.state && !sessionData?.state) {
+    throw new IDPValidationError(`state is present in parameters, but missing in session data`);
+  }
+  try {
+    const result = await client.callback(redirectUrl, params, sessionData);
+    const claims = result.claims();
+    return {
+      externalIdentifier: claims.sub,
+      email: claims.email,
+      name: claims.name
+    };
+  } catch (e) {
+    if (e instanceof errors.RPError) {
+      throw new IDPValidationError(e.message);
+    }
+    if (e instanceof errors.OPError) {
+      const body = e.response?.body;
+      if (typeof body === "object" && typeof body?.error === "object" && typeof body.error?.message === "string") {
+        throw new IDPResponseError(body.error.message);
+      }
+      throw new IDPResponseError(e.message);
+    }
+    throw e;
+  }
+};
+export {
+  handleOIDCResponse,
+  initOIDCAuth
+};
+//# sourceMappingURL=OIDCHelpers.js.map

package/dist/production/src/model/service/idp/providers/OIDCHelpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCHelpers.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\n\ncustom.setHttpOptionsDefaults({\n\ttimeout: 5000,\n})\n\nexport const initOIDCAuth = async (client: Client, { redirectUrl, claims, responseMode }: { redirectUrl: string; claims?: string; responseMode?: string }): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: claims ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData): Promise<IDPClaim> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\treturn {\n\t\t\texternalIdentifier: claims.sub,\n\t\t\temail: claims.email,\n\t\t\tname: claims.name,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":[],"mappings":";;;AAMA,OAAO,uBAAuB;AAAA,EAC7B,SAAS;AACV,CAAC;AAEM,MAAM,eAAe,OAAO,QAAgB,EAAE,aAAa,QAAQ,mBAAgH;AACnL,QAAA,QAAQ,WAAW;AACnB,QAAA,QAAQ,WAAW;AACnB,QAAA,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,UAAU;AAAA,IACjB;AAAA,IACA;AAAA,EAAA,CACA;AAEM,SAAA;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAM;AAAA,EAAA;AAE9B;AAEa,MAAA,qBAAqB,OAAO,QAAgB,EAAE,aAAa,aAAa,GAAG,gBAAqD;AACtI,QAAA,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AAClC,UAAA,IAAI,mBAAmB,6DAA6D;AAAA,EAC3F;AACI,MAAA;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AAC/D,UAAA,SAAS,OAAO;AACf,WAAA;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,OAAO,OAAO;AAAA,MACd,MAAM,OAAO;AAAA,IAAA;AAAA,WAEN,GAAQ;AACZ,QAAA,aAAa,OAAO,SAAS;AAC1B,YAAA,IAAI,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACI,QAAA,aAAa,OAAO,SAAS;AAC1B,YAAA,OAAO,EAAE,UAAU;AACrB,UAAA,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAI,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACM,YAAA,IAAI,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACM,UAAA;AAAA,EACP;AACD;"}

package/dist/production/src/model/service/idp/providers/OIDCProvider.cjs

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const openidClient = require("openid-client");
+const InvalidIDPConfigurationError = require("../InvalidIDPConfigurationError.cjs");
+const helpers = require("./helpers.cjs");
+const OIDCTypes = require("./OIDCTypes.cjs");
+const OIDCHelpers = require("./OIDCHelpers.cjs");
+const IDPValidationError = require("../IDPValidationError.cjs");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class OIDCProvider {
+  constructor() {
+    __publicField(this, "issuerCache", {});
+    __publicField(this, "validateConfiguration", helpers.catchTypesafe(OIDCTypes.OIDCConfiguration, InvalidIDPConfigurationError.InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = helpers.catchTypesafe(OIDCTypes.OIDCInitData, IDPValidationError.IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.initOIDCAuth(client, {
+      claims: configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = helpers.catchTypesafe(OIDCTypes.OIDCResponseData, IDPValidationError.IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.handleOIDCResponse(client, responseData);
+  }
+  getPublicConfiguration({ clientSecret, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    var _a, _b;
+    (_a = this.issuerCache)[_b = configuration.url] ?? (_a[_b] = await openidClient.Issuer.discover(configuration.url));
+    return new this.issuerCache[configuration.url].Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        response_types: [configuration.responseType || "code"]
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+  }
+}
+exports.OIDCProvider = OIDCProvider;
+//# sourceMappingURL=OIDCProvider.cjs.map

package/dist/production/src/model/service/idp/providers/OIDCProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tclaims: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer"],"mappings":";;;;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAAA,QAAA,cAAcC,6BAAmBC,6BAA4B,4BAAA,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMC,yBAAa,QAAQ;AAAA,MACjC,QAAQ,cAAc;AAAA,MACtB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAkC;AAChG,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMG,YAAmB,mBAAA,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;;"}

package/dist/production/src/model/service/idp/providers/OIDCProvider.js

@@ -0,0 +1,50 @@
+import { Issuer } from "openid-client";
+import { InvalidIDPConfigurationError } from "../InvalidIDPConfigurationError.js";
+import { catchTypesafe } from "./helpers.js";
+import { OIDCInitData, OIDCResponseData, OIDCConfiguration } from "./OIDCTypes.js";
+import { initOIDCAuth, handleOIDCResponse } from "./OIDCHelpers.js";
+import { IDPValidationError } from "../IDPValidationError.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class OIDCProvider {
+  constructor() {
+    __publicField(this, "issuerCache", {});
+    __publicField(this, "validateConfiguration", catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await initOIDCAuth(client, {
+      claims: configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await handleOIDCResponse(client, responseData);
+  }
+  getPublicConfiguration({ clientSecret, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    var _a, _b;
+    (_a = this.issuerCache)[_b = configuration.url] ?? (_a[_b] = await Issuer.discover(configuration.url));
+    return new this.issuerCache[configuration.url].Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        response_types: [configuration.responseType || "code"]
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+  }
+}
+export {
+  OIDCProvider
+};
+//# sourceMappingURL=OIDCProvider.js.map

package/dist/production/src/model/service/idp/providers/OIDCProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tclaims: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAA,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,QAAQ,cAAc;AAAA,MACtB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAkC;AAChG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/production/src/model/service/idp/providers/OIDCTypes.cjs

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Typesafe = require("@contember/typesafe");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+const OIDCConfigurationOptions = Typesafe__namespace.partial({
+  responseType: Typesafe__namespace.enumeration("code", "code id_token", "code id_token token", "code token", "id_token", "id_token token", "none"),
+  claims: Typesafe__namespace.string,
+  additionalAuthorizedParties: Typesafe__namespace.array(Typesafe__namespace.string)
+});
+const BaseOIDCConfiguration = Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    url: Typesafe__namespace.string,
+    clientId: Typesafe__namespace.string,
+    clientSecret: Typesafe__namespace.string
+  }),
+  OIDCConfigurationOptions
+);
+const OIDCConfiguration = Typesafe__namespace.intersection(
+  BaseOIDCConfiguration,
+  Typesafe__namespace.object({
+    url: Typesafe__namespace.string
+  })
+);
+const OIDCResponseData = Typesafe__namespace.intersection(
+  Typesafe__namespace.union(
+    Typesafe__namespace.object({
+      url: Typesafe__namespace.string
+    }),
+    Typesafe__namespace.object({
+      parameters: Typesafe__namespace.record(Typesafe__namespace.string, Typesafe__namespace.string)
+    })
+  ),
+  Typesafe__namespace.partial({
+    redirectUrl: Typesafe__namespace.string,
+    sessionData: Typesafe__namespace.partial({
+      nonce: Typesafe__namespace.string,
+      state: Typesafe__namespace.string
+    })
+  })
+);
+const OIDCInitData = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    redirectUrl: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    responseMode: Typesafe__namespace.string
+  })
+));
+exports.BaseOIDCConfiguration = BaseOIDCConfiguration;
+exports.OIDCConfiguration = OIDCConfiguration;
+exports.OIDCConfigurationOptions = OIDCConfigurationOptions;
+exports.OIDCInitData = OIDCInitData;
+exports.OIDCResponseData = OIDCResponseData;
+//# sourceMappingURL=OIDCTypes.cjs.map

package/dist/production/src/model/service/idp/providers/OIDCTypes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCTypes.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQa,MAAA,2BAA2BA,oBAAS,QAAQ;AAAA,EACxD,cAAcA,oBAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQA,oBAAS;AAAA,EACjB,6BAA6BA,oBAAS,MAAMA,oBAAS,MAAM;AAC5D,CAAC;AACM,MAAM,wBAAwBA,oBAAS;AAAA,EAC7CA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,IACd,UAAUA,oBAAS;AAAA,IACnB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoBA,oBAAS;AAAA,EACzC;AAAA,EACAA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmBA,oBAAS;AAAA,EACxCA,oBAAS;AAAA,IACRA,oBAAS,OAAO;AAAA,MACf,KAAKA,oBAAS;AAAA,IAAA,CACd;AAAA,IACDA,oBAAS,OAAO;AAAA,MACf,YAAYA,oBAAS,OAAOA,oBAAS,QAAQA,oBAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EACF;AAAA,EACAA,oBAAS,QAAQ;AAAA,IAChB,aAAaA,oBAAS;AAAA,IACtB,aAAaA,oBAAS,QAAQ;AAAA,MAC7B,OAAOA,oBAAS;AAAA,MAChB,OAAOA,oBAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CAED;AACF;AAIa,MAAA,eAAeA,oBAAS,aAAaA,oBAAS;AAAA,EAC1DA,oBAAS,OAAO;AAAA,IACf,aAAaA,oBAAS;AAAA,EAAA,CACtB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AACF,CAAC;;;;;;"}