@contember/engine-tenant-api 2.1.0-alpha.3 → 2.1.0-alpha.35

package/dist/development/src/model/service/idp/IDPResponseError.js

@@ -1,9 +0,0 @@
-class IDPResponseError extends Error {
-  constructor(message) {
-    super(message);
-  }
-}
-export {
-  IDPResponseError
-};
-//# sourceMappingURL=IDPResponseError.js.map

package/dist/development/src/model/service/idp/IDPResponseError.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"IDPResponseError.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPResponseError.ts"],"sourcesContent":["export class IDPResponseError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":"AAAO,MAAM,yBAAyB,MAAM;AAAA,EAC3C,YAAY,SAAiB;AAC5B,UAAM,OAAO;AAAA,EAAA;AAEf;"}

package/dist/development/src/model/service/idp/IDPValidationError.cjs

@@ -1,9 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-class IDPValidationError extends Error {
-  constructor(message) {
-    super(message);
-  }
-}
-exports.IDPValidationError = IDPValidationError;
-//# sourceMappingURL=IDPValidationError.cjs.map

package/dist/development/src/model/service/idp/IDPValidationError.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"IDPValidationError.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPValidationError.ts"],"sourcesContent":["export class IDPValidationError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":";;AAAO,MAAM,2BAA2B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC5B,UAAM,OAAO;AAAA,EAAA;AAEf;;"}

package/dist/development/src/model/service/idp/IDPValidationError.js

@@ -1,9 +0,0 @@
-class IDPValidationError extends Error {
-  constructor(message) {
-    super(message);
-  }
-}
-export {
-  IDPValidationError
-};
-//# sourceMappingURL=IDPValidationError.js.map

package/dist/development/src/model/service/idp/IDPValidationError.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"IDPValidationError.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPValidationError.ts"],"sourcesContent":["export class IDPValidationError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":"AAAO,MAAM,2BAA2B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC5B,UAAM,OAAO;AAAA,EAAA;AAEf;"}

package/dist/development/src/model/service/idp/IdentityProviderNotFoundError.cjs

@@ -1,9 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-class IdentityProviderNotFoundError extends Error {
-  constructor(message) {
-    super(message);
-  }
-}
-exports.IdentityProviderNotFoundError = IdentityProviderNotFoundError;
-//# sourceMappingURL=IdentityProviderNotFoundError.cjs.map

package/dist/development/src/model/service/idp/IdentityProviderNotFoundError.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"IdentityProviderNotFoundError.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdentityProviderNotFoundError.ts"],"sourcesContent":["export class IdentityProviderNotFoundError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":";;AAAO,MAAM,sCAAsC,MAAM;AAAA,EACxD,YAAY,SAAiB;AAC5B,UAAM,OAAO;AAAA,EAAA;AAEf;;"}

package/dist/development/src/model/service/idp/IdentityProviderNotFoundError.js

@@ -1,9 +0,0 @@
-class IdentityProviderNotFoundError extends Error {
-  constructor(message) {
-    super(message);
-  }
-}
-export {
-  IdentityProviderNotFoundError
-};
-//# sourceMappingURL=IdentityProviderNotFoundError.js.map

package/dist/development/src/model/service/idp/IdentityProviderNotFoundError.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"IdentityProviderNotFoundError.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdentityProviderNotFoundError.ts"],"sourcesContent":["export class IdentityProviderNotFoundError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":"AAAO,MAAM,sCAAsC,MAAM;AAAA,EACxD,YAAY,SAAiB;AAC5B,UAAM,OAAO;AAAA,EAAA;AAEf;"}

package/dist/development/src/model/service/idp/InvalidIDPConfigurationError.cjs

@@ -1,9 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-class InvalidIDPConfigurationError extends Error {
-  constructor(message) {
-    super(message);
-  }
-}
-exports.InvalidIDPConfigurationError = InvalidIDPConfigurationError;
-//# sourceMappingURL=InvalidIDPConfigurationError.cjs.map

package/dist/development/src/model/service/idp/InvalidIDPConfigurationError.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"InvalidIDPConfigurationError.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/InvalidIDPConfigurationError.ts"],"sourcesContent":["export class InvalidIDPConfigurationError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":";;AAAO,MAAM,qCAAqC,MAAM;AAAA,EACvD,YAAY,SAAiB;AAC5B,UAAM,OAAO;AAAA,EAAA;AAEf;;"}

package/dist/development/src/model/service/idp/InvalidIDPConfigurationError.js

@@ -1,9 +0,0 @@
-class InvalidIDPConfigurationError extends Error {
-  constructor(message) {
-    super(message);
-  }
-}
-export {
-  InvalidIDPConfigurationError
-};
-//# sourceMappingURL=InvalidIDPConfigurationError.js.map

package/dist/development/src/model/service/idp/InvalidIDPConfigurationError.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"InvalidIDPConfigurationError.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/InvalidIDPConfigurationError.ts"],"sourcesContent":["export class InvalidIDPConfigurationError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":"AAAO,MAAM,qCAAqC,MAAM;AAAA,EACvD,YAAY,SAAiB;AAC5B,UAAM,OAAO;AAAA,EAAA;AAEf;"}

package/dist/development/src/model/service/idp/providers/AppleProvider.cjs

@@ -1,81 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const Typesafe = require("@contember/typesafe");
-const OIDCTypes = require("./OIDCTypes.cjs");
-const helpers = require("./helpers.cjs");
-const IDPValidationError = require("../IDPValidationError.cjs");
-const InvalidIDPConfigurationError = require("../InvalidIDPConfigurationError.cjs");
-const OIDCHelpers = require("./OIDCHelpers.cjs");
-const openidClient = require("openid-client");
-const jose = require("jose");
-function _interopNamespaceDefault(e) {
-  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
-  if (e) {
-    for (const k in e) {
-      if (k !== "default") {
-        const d = Object.getOwnPropertyDescriptor(e, k);
-        Object.defineProperty(n, k, d.get ? d : {
-          enumerable: true,
-          get: () => e[k]
-        });
-      }
-    }
-  }
-  n.default = e;
-  return Object.freeze(n);
-}
-const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-const AppleConfiguration = Typesafe__namespace.intersection(
-  Typesafe__namespace.object({
-    keyId: Typesafe__namespace.string,
-    teamId: Typesafe__namespace.string,
-    clientId: Typesafe__namespace.string,
-    privateKey: Typesafe__namespace.string
-  }),
-  OIDCTypes.OIDCConfigurationOptions
-);
-const APPLE_OIDC_CONFIGURATION_ENDPOINT = "https://appleid.apple.com/.well-known/openid-configuration";
-class AppleProvider {
-  constructor() {
-    __publicField(this, "issuer");
-    __publicField(this, "validateConfiguration", helpers.catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError.InvalidIDPConfigurationError));
-  }
-  async initAuth(configuration, data) {
-    const initData = helpers.catchTypesafe(OIDCTypes.OIDCInitData, IDPValidationError.IDPValidationError)(data);
-    const client = await this.createOIDCClient(configuration);
-    return await OIDCHelpers.initOIDCAuth(client, {
-      scope: configuration.scope ?? configuration.claims,
-      ...initData
-    });
-  }
-  async processResponse(configuration, data) {
-    const responseData = helpers.catchTypesafe(OIDCTypes.OIDCResponseData, IDPValidationError.IDPValidationError)(data);
-    const client = await this.createOIDCClient(configuration);
-    return await OIDCHelpers.handleOIDCResponse(client, responseData);
-  }
-  getPublicConfiguration({ privateKey, ...config }) {
-    return config;
-  }
-  async createOIDCClient(configuration) {
-    this.issuer ?? (this.issuer = await openidClient.Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT));
-    const privateKey = await jose.importPKCS8(configuration.privateKey, "ES256");
-    const jwt = await new jose.SignJWT({}).setProtectedHeader({ alg: "ES256", typ: "JWT", kid: configuration.keyId }).setIssuedAt().setIssuer(configuration.teamId).setAudience("https://appleid.apple.com").setSubject(configuration.clientId).setExpirationTime("10m").sign(privateKey);
-    return new this.issuer.Client(
-      {
-        client_id: configuration.clientId,
-        client_secret: jwt,
-        response_types: [configuration.responseType || "code"]
-      },
-      void 0,
-      {
-        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
-      }
-    );
-  }
-}
-exports.AppleConfiguration = AppleConfiguration;
-exports.AppleProvider = AppleProvider;
-//# sourceMappingURL=AppleProvider.cjs.map

package/dist/development/src/model/service/idp/providers/AppleProvider.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"AppleProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'\nimport { catchTypesafe } from './helpers'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["Typesafe","OIDCConfigurationOptions","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer","importPKCS8","SignJWT"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,qBAAqBA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,IAChB,QAAQA,oBAAS;AAAA,IACjB,UAAUA,oBAAS;AAAA,IACnB,YAAYA,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDC,UAAAA;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACE,kBAAA,MAAA,QAAA;AAEgB,kBAAA,MAAA,yBAAAC,QAAA,cAAc,oBAAoBC,6BAA4B,4BAAA,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAWD,QAAA,cAAcE,UAAc,cAAAC,mBAAkB,kBAAA,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMC,yBAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EAAA;AAAA,EAGF,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAeJ,QAAA,cAAcK,UAAkB,kBAAAF,mBAAkB,kBAAA,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMG,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,EAAA;AAAA,EAGrD,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAC3F,WAAA;AAAA,EAAA;AAAA,EAGR,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAMC,oBAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAMC,KAAAA,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAIC,KAAA,QAAQ,CAAE,CAAA,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAM,CAAC,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEV,WAAA,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAG,CAAA;AAAA,MAAA;AAAA,IAEpF;AAAA,EAAA;AAEF;;;"}

package/dist/development/src/model/service/idp/providers/AppleProvider.js

@@ -1,64 +0,0 @@
-import * as Typesafe from "@contember/typesafe";
-import { OIDCConfigurationOptions, OIDCInitData, OIDCResponseData } from "./OIDCTypes.js";
-import { catchTypesafe } from "./helpers.js";
-import { IDPValidationError } from "../IDPValidationError.js";
-import { InvalidIDPConfigurationError } from "../InvalidIDPConfigurationError.js";
-import { initOIDCAuth, handleOIDCResponse } from "./OIDCHelpers.js";
-import { Issuer } from "openid-client";
-import { importPKCS8, SignJWT } from "jose";
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-const AppleConfiguration = Typesafe.intersection(
-  Typesafe.object({
-    keyId: Typesafe.string,
-    teamId: Typesafe.string,
-    clientId: Typesafe.string,
-    privateKey: Typesafe.string
-  }),
-  OIDCConfigurationOptions
-);
-const APPLE_OIDC_CONFIGURATION_ENDPOINT = "https://appleid.apple.com/.well-known/openid-configuration";
-class AppleProvider {
-  constructor() {
-    __publicField(this, "issuer");
-    __publicField(this, "validateConfiguration", catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError));
-  }
-  async initAuth(configuration, data) {
-    const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data);
-    const client = await this.createOIDCClient(configuration);
-    return await initOIDCAuth(client, {
-      scope: configuration.scope ?? configuration.claims,
-      ...initData
-    });
-  }
-  async processResponse(configuration, data) {
-    const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data);
-    const client = await this.createOIDCClient(configuration);
-    return await handleOIDCResponse(client, responseData);
-  }
-  getPublicConfiguration({ privateKey, ...config }) {
-    return config;
-  }
-  async createOIDCClient(configuration) {
-    this.issuer ?? (this.issuer = await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT));
-    const privateKey = await importPKCS8(configuration.privateKey, "ES256");
-    const jwt = await new SignJWT({}).setProtectedHeader({ alg: "ES256", typ: "JWT", kid: configuration.keyId }).setIssuedAt().setIssuer(configuration.teamId).setAudience("https://appleid.apple.com").setSubject(configuration.clientId).setExpirationTime("10m").sign(privateKey);
-    return new this.issuer.Client(
-      {
-        client_id: configuration.clientId,
-        client_secret: jwt,
-        response_types: [configuration.responseType || "code"]
-      },
-      void 0,
-      {
-        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
-      }
-    );
-  }
-}
-export {
-  AppleConfiguration,
-  AppleProvider
-};
-//# sourceMappingURL=AppleProvider.js.map

package/dist/development/src/model/service/idp/providers/AppleProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"AppleProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'\nimport { catchTypesafe } from './helpers'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AAUO,MAAM,qBAAqB,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,QAAQ,SAAS;AAAA,IACjB,UAAU,SAAS;AAAA,IACnB,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACE,kBAAA,MAAA,QAAA;AAEgB,kBAAA,MAAA,yBAAA,cAAc,oBAAoB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EAAA;AAAA,EAGF,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EAAA;AAAA,EAGrD,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAC3F,WAAA;AAAA,EAAA;AAAA,EAGR,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAM,OAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAM,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAI,QAAQ,CAAE,CAAA,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAM,CAAC,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEV,WAAA,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAG,CAAA;AAAA,MAAA;AAAA,IAEpF;AAAA,EAAA;AAEF;"}

package/dist/development/src/model/service/idp/providers/FacebookProvider.cjs

@@ -1,142 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const Typesafe = require("@contember/typesafe");
-const openidClient = require("openid-client");
-const IDPValidationError = require("../IDPValidationError.cjs");
-const InvalidIDPConfigurationError = require("../InvalidIDPConfigurationError.cjs");
-const helpers = require("./helpers.cjs");
-const OIDCTypes = require("./OIDCTypes.cjs");
-const OIDCHelpers = require("./OIDCHelpers.cjs");
-const crypto = require("node:crypto");
-const IDPResponseError = require("../IDPResponseError.cjs");
-function _interopNamespaceDefault(e) {
-  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
-  if (e) {
-    for (const k in e) {
-      if (k !== "default") {
-        const d = Object.getOwnPropertyDescriptor(e, k);
-        Object.defineProperty(n, k, d.get ? d : {
-          enumerable: true,
-          get: () => e[k]
-        });
-      }
-    }
-  }
-  n.default = e;
-  return Object.freeze(n);
-}
-const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-const FacebookConfiguration = OIDCTypes.BaseOIDCConfiguration;
-const FacebookResponseData = Typesafe__namespace.union(
-  OIDCTypes.OIDCResponseData,
-  Typesafe__namespace.object({
-    authResponse: Typesafe__namespace.object({
-      accessToken: Typesafe__namespace.string,
-      signedRequest: Typesafe__namespace.string
-    })
-  })
-);
-const FacebookResponsePayload = Typesafe__namespace.object({
-  user_id: Typesafe__namespace.string,
-  code: Typesafe__namespace.string
-});
-class FacebookProvider {
-  constructor() {
-    __publicField(this, "facebookIssuer", new openidClient.Issuer({
-      issuer: "https://www.facebook.com",
-      authorization_endpoint: "https://facebook.com/dialog/oauth/",
-      jwks_uri: "https://www.facebook.com/.well-known/oauth/openid/jwks/",
-      response_types_supported: [
-        "id_token",
-        "token id_token"
-      ],
-      subject_types_supported: [
-        "pairwise"
-      ],
-      id_token_signing_alg_values_supported: [
-        "RS256"
-      ],
-      claims_supported: [
-        "iss",
-        "aud",
-        "sub",
-        "iat",
-        "exp",
-        "jti",
-        "nonce",
-        "at_hash",
-        "name",
-        "given_name",
-        "middle_name",
-        "family_name",
-        "email",
-        "picture",
-        "user_friends",
-        "user_birthday",
-        "user_age_range",
-        "user_link",
-        "user_hometown",
-        "user_location",
-        "user_gender"
-      ],
-      token_endpoint: "https://graph.facebook.com/v11.0/oauth/access_token"
-    }));
-    __publicField(this, "validateConfiguration", helpers.catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError.InvalidIDPConfigurationError));
-  }
-  async initAuth(configuration, data) {
-    const initData = helpers.catchTypesafe(OIDCTypes.OIDCInitData, IDPValidationError.IDPValidationError)(data);
-    const client = await this.createOIDCClient(configuration);
-    return await OIDCHelpers.initOIDCAuth(client, {
-      scope: configuration.scope ?? configuration.claims,
-      ...initData
-    });
-  }
-  async processResponse(configuration, data) {
-    const responseData = helpers.catchTypesafe(FacebookResponseData, IDPValidationError.IDPValidationError)(data);
-    if (!("authResponse" in responseData)) {
-      const client = await this.createOIDCClient(configuration);
-      return await OIDCHelpers.handleOIDCResponse(client, responseData);
-    } else {
-      const [sig, payload] = responseData.authResponse.signedRequest.split(".");
-      const data2 = helpers.catchTypesafe(FacebookResponsePayload, IDPValidationError.IDPValidationError)(JSON.parse(Buffer.from(payload, "base64").toString("utf8")));
-      const hmac = crypto.createHmac("sha256", configuration.clientSecret);
-      const signature = hmac.update(payload).digest();
-      const isSignatureValid = signature.compare(Buffer.from(sig, "base64")) === 0;
-      if (!isSignatureValid) {
-        throw new IDPValidationError.IDPValidationError("Invalid signature");
-      }
-      const url = `https://graph.facebook.com/${data2.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`;
-      const response = await fetch(url);
-      if (!response.ok) {
-        throw new IDPResponseError.IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`);
-      }
-      const apiData = await response.json();
-      return {
-        externalIdentifier: data2.user_id,
-        name: apiData.name,
-        email: apiData.email
-      };
-    }
-  }
-  getPublicConfiguration({ clientSecret, ...config }) {
-    return config;
-  }
-  async createOIDCClient(configuration) {
-    return new this.facebookIssuer.Client(
-      {
-        client_id: configuration.clientId,
-        client_secret: configuration.clientSecret,
-        response_types: [configuration.responseType || "code"]
-      },
-      void 0,
-      {
-        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
-      }
-    );
-  }
-}
-exports.FacebookProvider = FacebookProvider;
-//# sourceMappingURL=FacebookProvider.cjs.map

package/dist/development/src/model/service/idp/providers/FacebookProvider.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"FacebookProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\n\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["BaseOIDCConfiguration","Typesafe","OIDCResponseData","Issuer","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","handleOIDCResponse","data","createHmac","IDPResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,MAAM,wBAAwBA,UAAA;AAG9B,MAAM,uBAAuBC,oBAAS;AAAA,EACrCC,UAAA;AAAA,EACAD,oBAAS,OAAO;AAAA,IACf,cAAcA,oBAAS,OAAO;AAAA,MAC7B,aAAaA,oBAAS;AAAA,MACtB,eAAeA,oBAAS;AAAA,IACxB,CAAA;AAAA,EACD,CAAA;AACF;AACA,MAAM,0BAA0BA,oBAAS,OAAO;AAAA,EAC/C,SAASA,oBAAS;AAAA,EAClB,MAAMA,oBAAS;AAChB,CAAC;AAKM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGE,kBAAA,MAAA,kBAAiB,IAAIE,oBAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MACD;AAAA,MACA,yBAAyB;AAAA,QACxB;AAAA,MACD;AAAA,MACA,uCAAuC;AAAA,QACtC;AAAA,MACD;AAAA,MACA,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,MACA,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAEuB,kBAAA,MAAA,yBAAAC,QAAA,cAAc,uBAAuBC,6BAA4B,4BAAA,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAWD,QAAA,cAAcE,UAAc,cAAAC,mBAAkB,kBAAA,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMC,yBAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EAAA;AAAA,EAGF,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAeJ,QAAA,cAAc,sBAAsBG,mBAAkB,kBAAA,EAAE,IAAI;AAE7E,QAAA,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,aAAA,MAAME,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,IAAA,OAC9C;AACA,YAAA,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMC,QAAON,QAAAA,cAAc,yBAAyBG,mBAAAA,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAOI,OAAA,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAO;AACxC,YAAA,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AAChB,cAAA,IAAIJ,sCAAmB,mBAAmB;AAAA,MAAA;AAEjD,YAAM,MAAM,8BAA8BG,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AAC3H,YAAA,WAAW,MAAM,MAAM,GAAG;AAC5B,UAAA,CAAC,SAAS,IAAI;AACX,cAAA,IAAIE,iBAAiB,iBAAA,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAM,CAAA,EAAE;AAAA,MAAA;AAEhG,YAAA,UAAU,MAAM,SAAS,KAAK;AAE7B,aAAA;AAAA,QACN,oBAAoBF,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAChB;AAAA,IAAA;AAAA,EACD;AAAA,EAGD,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AACnG,WAAA;AAAA,EAAA;AAAA,EAGR,MAAc,iBAAiB,eAAuD;AAC9E,WAAA,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAG,CAAA;AAAA,MAAA;AAAA,IAEpF;AAAA,EAAA;AAEF;;"}

package/dist/development/src/model/service/idp/providers/FacebookProvider.js

@@ -1,125 +0,0 @@
-import * as Typesafe from "@contember/typesafe";
-import { Issuer } from "openid-client";
-import { IDPValidationError } from "../IDPValidationError.js";
-import { InvalidIDPConfigurationError } from "../InvalidIDPConfigurationError.js";
-import { catchTypesafe } from "./helpers.js";
-import { OIDCResponseData, OIDCInitData, BaseOIDCConfiguration } from "./OIDCTypes.js";
-import { initOIDCAuth, handleOIDCResponse } from "./OIDCHelpers.js";
-import { createHmac } from "node:crypto";
-import { IDPResponseError } from "../IDPResponseError.js";
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-const FacebookConfiguration = BaseOIDCConfiguration;
-const FacebookResponseData = Typesafe.union(
-  OIDCResponseData,
-  Typesafe.object({
-    authResponse: Typesafe.object({
-      accessToken: Typesafe.string,
-      signedRequest: Typesafe.string
-    })
-  })
-);
-const FacebookResponsePayload = Typesafe.object({
-  user_id: Typesafe.string,
-  code: Typesafe.string
-});
-class FacebookProvider {
-  constructor() {
-    __publicField(this, "facebookIssuer", new Issuer({
-      issuer: "https://www.facebook.com",
-      authorization_endpoint: "https://facebook.com/dialog/oauth/",
-      jwks_uri: "https://www.facebook.com/.well-known/oauth/openid/jwks/",
-      response_types_supported: [
-        "id_token",
-        "token id_token"
-      ],
-      subject_types_supported: [
-        "pairwise"
-      ],
-      id_token_signing_alg_values_supported: [
-        "RS256"
-      ],
-      claims_supported: [
-        "iss",
-        "aud",
-        "sub",
-        "iat",
-        "exp",
-        "jti",
-        "nonce",
-        "at_hash",
-        "name",
-        "given_name",
-        "middle_name",
-        "family_name",
-        "email",
-        "picture",
-        "user_friends",
-        "user_birthday",
-        "user_age_range",
-        "user_link",
-        "user_hometown",
-        "user_location",
-        "user_gender"
-      ],
-      token_endpoint: "https://graph.facebook.com/v11.0/oauth/access_token"
-    }));
-    __publicField(this, "validateConfiguration", catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError));
-  }
-  async initAuth(configuration, data) {
-    const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data);
-    const client = await this.createOIDCClient(configuration);
-    return await initOIDCAuth(client, {
-      scope: configuration.scope ?? configuration.claims,
-      ...initData
-    });
-  }
-  async processResponse(configuration, data) {
-    const responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data);
-    if (!("authResponse" in responseData)) {
-      const client = await this.createOIDCClient(configuration);
-      return await handleOIDCResponse(client, responseData);
-    } else {
-      const [sig, payload] = responseData.authResponse.signedRequest.split(".");
-      const data2 = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, "base64").toString("utf8")));
-      const hmac = createHmac("sha256", configuration.clientSecret);
-      const signature = hmac.update(payload).digest();
-      const isSignatureValid = signature.compare(Buffer.from(sig, "base64")) === 0;
-      if (!isSignatureValid) {
-        throw new IDPValidationError("Invalid signature");
-      }
-      const url = `https://graph.facebook.com/${data2.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`;
-      const response = await fetch(url);
-      if (!response.ok) {
-        throw new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`);
-      }
-      const apiData = await response.json();
-      return {
-        externalIdentifier: data2.user_id,
-        name: apiData.name,
-        email: apiData.email
-      };
-    }
-  }
-  getPublicConfiguration({ clientSecret, ...config }) {
-    return config;
-  }
-  async createOIDCClient(configuration) {
-    return new this.facebookIssuer.Client(
-      {
-        client_id: configuration.clientId,
-        client_secret: configuration.clientSecret,
-        response_types: [configuration.responseType || "code"]
-      },
-      void 0,
-      {
-        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
-      }
-    );
-  }
-}
-export {
-  FacebookProvider
-};
-//# sourceMappingURL=FacebookProvider.js.map

package/dist/development/src/model/service/idp/providers/FacebookProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"FacebookProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\n\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["data"],"mappings":";;;;;;;;;;;;AAaA,MAAM,wBAAwB;AAG9B,MAAM,uBAAuB,SAAS;AAAA,EACrC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,cAAc,SAAS,OAAO;AAAA,MAC7B,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,IACxB,CAAA;AAAA,EACD,CAAA;AACF;AACA,MAAM,0BAA0B,SAAS,OAAO;AAAA,EAC/C,SAAS,SAAS;AAAA,EAClB,MAAM,SAAS;AAChB,CAAC;AAKM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGE,kBAAA,MAAA,kBAAiB,IAAI,OAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MACD;AAAA,MACA,yBAAyB;AAAA,QACxB;AAAA,MACD;AAAA,MACA,uCAAuC;AAAA,QACtC;AAAA,MACD;AAAA,MACA,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,MACA,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAEuB,kBAAA,MAAA,yBAAA,cAAc,uBAAuB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EAAA;AAAA,EAGF,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAe,cAAc,sBAAsB,kBAAkB,EAAE,IAAI;AAE7E,QAAA,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,aAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,IAAA,OAC9C;AACA,YAAA,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMA,QAAO,cAAc,yBAAyB,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAO,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAO;AACxC,YAAA,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AAChB,cAAA,IAAI,mBAAmB,mBAAmB;AAAA,MAAA;AAEjD,YAAM,MAAM,8BAA8BA,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AAC3H,YAAA,WAAW,MAAM,MAAM,GAAG;AAC5B,UAAA,CAAC,SAAS,IAAI;AACX,cAAA,IAAI,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAM,CAAA,EAAE;AAAA,MAAA;AAEhG,YAAA,UAAU,MAAM,SAAS,KAAK;AAE7B,aAAA;AAAA,QACN,oBAAoBA,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAChB;AAAA,IAAA;AAAA,EACD;AAAA,EAGD,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AACnG,WAAA;AAAA,EAAA;AAAA,EAGR,MAAc,iBAAiB,eAAuD;AAC9E,WAAA,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAG,CAAA;AAAA,MAAA;AAAA,IAEpF;AAAA,EAAA;AAEF;"}

package/dist/development/src/model/service/idp/providers/OIDCHelpers.cjs

@@ -1,54 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const openidClient = require("openid-client");
-const IDPValidationError = require("../IDPValidationError.cjs");
-const IDPResponseError = require("../IDPResponseError.cjs");
-const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
-  const nonce = openidClient.generators.nonce();
-  const state = openidClient.generators.state();
-  const url = client.authorizationUrl({
-    redirect_uri: redirectUrl,
-    response_mode: responseMode,
-    scope: scope ?? "openid email",
-    nonce,
-    state
-  });
-  return {
-    authUrl: url,
-    sessionData: { nonce, state }
-  };
-};
-const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, fetchUserInfo, returnOIDCResult) => {
-  const params = "parameters" in otherData ? otherData.parameters : client.callbackParams(otherData.url);
-  if (params.state && !sessionData?.state) {
-    throw new IDPValidationError.IDPValidationError(`state is present in parameters, but missing in session data`);
-  }
-  try {
-    const result = await client.callback(redirectUrl, params, sessionData);
-    const claims = result.claims();
-    const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims;
-    const userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {};
-    const oidcResult = returnOIDCResult ? result : {};
-    return {
-      externalIdentifier: claims.sub,
-      ...oidcResult,
-      ...claimsWithoutHashes,
-      ...userInfo
-    };
-  } catch (e) {
-    if (e instanceof openidClient.errors.RPError) {
-      throw new IDPValidationError.IDPValidationError(e.message);
-    }
-    if (e instanceof openidClient.errors.OPError) {
-      const body = e.response?.body;
-      if (typeof body === "object" && typeof body?.error === "object" && typeof body.error?.message === "string") {
-        throw new IDPResponseError.IDPResponseError(body.error.message);
-      }
-      throw new IDPResponseError.IDPResponseError(e.message);
-    }
-    throw e;
-  }
-};
-exports.handleOIDCResponse = handleOIDCResponse;
-exports.initOIDCAuth = initOIDCAuth;
-//# sourceMappingURL=OIDCHelpers.cjs.map