@contember/engine-tenant-api 2.1.0-alpha.37 → 2.1.0-alpha.39

package/dist/development/src/model/service/idp/providers/FacebookProvider.cjs

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Typesafe = require("@contember/typesafe");
+const openidClient = require("openid-client");
+const IDPValidationError = require("../IDPValidationError.cjs");
+const InvalidIDPConfigurationError = require("../InvalidIDPConfigurationError.cjs");
+const helpers = require("./helpers.cjs");
+const OIDCTypes = require("./OIDCTypes.cjs");
+const OIDCHelpers = require("./OIDCHelpers.cjs");
+const crypto = require("node:crypto");
+const IDPResponseError = require("../IDPResponseError.cjs");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const FacebookConfiguration = OIDCTypes.BaseOIDCConfiguration;
+const FacebookResponseData = Typesafe__namespace.union(
+  OIDCTypes.OIDCResponseData,
+  Typesafe__namespace.object({
+    authResponse: Typesafe__namespace.object({
+      accessToken: Typesafe__namespace.string,
+      signedRequest: Typesafe__namespace.string
+    })
+  })
+);
+const FacebookResponsePayload = Typesafe__namespace.object({
+  user_id: Typesafe__namespace.string,
+  code: Typesafe__namespace.string
+});
+class FacebookProvider {
+  constructor() {
+    __publicField(this, "facebookIssuer", new openidClient.Issuer({
+      issuer: "https://www.facebook.com",
+      authorization_endpoint: "https://facebook.com/dialog/oauth/",
+      jwks_uri: "https://www.facebook.com/.well-known/oauth/openid/jwks/",
+      response_types_supported: [
+        "id_token",
+        "token id_token"
+      ],
+      subject_types_supported: [
+        "pairwise"
+      ],
+      id_token_signing_alg_values_supported: [
+        "RS256"
+      ],
+      claims_supported: [
+        "iss",
+        "aud",
+        "sub",
+        "iat",
+        "exp",
+        "jti",
+        "nonce",
+        "at_hash",
+        "name",
+        "given_name",
+        "middle_name",
+        "family_name",
+        "email",
+        "picture",
+        "user_friends",
+        "user_birthday",
+        "user_age_range",
+        "user_link",
+        "user_hometown",
+        "user_location",
+        "user_gender"
+      ],
+      token_endpoint: "https://graph.facebook.com/v11.0/oauth/access_token"
+    }));
+    __publicField(this, "validateConfiguration", helpers.catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError.InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = helpers.catchTypesafe(OIDCTypes.OIDCInitData, IDPValidationError.IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.initOIDCAuth(client, {
+      scope: configuration.scope ?? configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = helpers.catchTypesafe(FacebookResponseData, IDPValidationError.IDPValidationError)(data);
+    if (!("authResponse" in responseData)) {
+      const client = await this.createOIDCClient(configuration);
+      return await OIDCHelpers.handleOIDCResponse(client, responseData);
+    } else {
+      const [sig, payload] = responseData.authResponse.signedRequest.split(".");
+      const data2 = helpers.catchTypesafe(FacebookResponsePayload, IDPValidationError.IDPValidationError)(JSON.parse(Buffer.from(payload, "base64").toString("utf8")));
+      const hmac = crypto.createHmac("sha256", configuration.clientSecret);
+      const signature = hmac.update(payload).digest();
+      const isSignatureValid = signature.compare(Buffer.from(sig, "base64")) === 0;
+      if (!isSignatureValid) {
+        throw new IDPValidationError.IDPValidationError("Invalid signature");
+      }
+      const url = `https://graph.facebook.com/${data2.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`;
+      const response = await fetch(url);
+      if (!response.ok) {
+        throw new IDPResponseError.IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`);
+      }
+      const apiData = await response.json();
+      return {
+        externalIdentifier: data2.user_id,
+        name: apiData.name,
+        email: apiData.email
+      };
+    }
+  }
+  getPublicConfiguration({ clientSecret, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    return new this.facebookIssuer.Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        response_types: [configuration.responseType || "code"]
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+  }
+}
+exports.FacebookProvider = FacebookProvider;
+//# sourceMappingURL=FacebookProvider.cjs.map

package/dist/development/src/model/service/idp/providers/FacebookProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"FacebookProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["BaseOIDCConfiguration","Typesafe","OIDCResponseData","Issuer","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","handleOIDCResponse","data","createHmac","IDPResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,wBAAwBA,UAAAA;AAG9B,MAAM,uBAAuBC,oBAAS;AAAA,EACrCC,UAAAA;AAAAA,EACAD,oBAAS,OAAO;AAAA,IACf,cAAcA,oBAAS,OAAO;AAAA,MAC7B,aAAaA,oBAAS;AAAA,MACtB,eAAeA,oBAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0BA,oBAAS,OAAO;AAAA,EAC/C,SAASA,oBAAS;AAAA,EAClB,MAAMA,oBAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAIE,oBAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,uBAAuBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAeJ,QAAAA,cAAc,sBAAsBG,mBAAAA,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAME,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMC,QAAON,QAAAA,cAAc,yBAAyBG,mBAAAA,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAOI,OAAAA,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAIJ,mBAAAA,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BG,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAIE,iBAAAA,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBF,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;"}

package/dist/development/src/model/service/idp/providers/FacebookProvider.js

@@ -0,0 +1,125 @@
+import * as Typesafe from "@contember/typesafe";
+import { Issuer } from "openid-client";
+import { IDPValidationError } from "../IDPValidationError.js";
+import { InvalidIDPConfigurationError } from "../InvalidIDPConfigurationError.js";
+import { catchTypesafe } from "./helpers.js";
+import { OIDCResponseData, OIDCInitData, BaseOIDCConfiguration } from "./OIDCTypes.js";
+import { initOIDCAuth, handleOIDCResponse } from "./OIDCHelpers.js";
+import { createHmac } from "node:crypto";
+import { IDPResponseError } from "../IDPResponseError.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const FacebookConfiguration = BaseOIDCConfiguration;
+const FacebookResponseData = Typesafe.union(
+  OIDCResponseData,
+  Typesafe.object({
+    authResponse: Typesafe.object({
+      accessToken: Typesafe.string,
+      signedRequest: Typesafe.string
+    })
+  })
+);
+const FacebookResponsePayload = Typesafe.object({
+  user_id: Typesafe.string,
+  code: Typesafe.string
+});
+class FacebookProvider {
+  constructor() {
+    __publicField(this, "facebookIssuer", new Issuer({
+      issuer: "https://www.facebook.com",
+      authorization_endpoint: "https://facebook.com/dialog/oauth/",
+      jwks_uri: "https://www.facebook.com/.well-known/oauth/openid/jwks/",
+      response_types_supported: [
+        "id_token",
+        "token id_token"
+      ],
+      subject_types_supported: [
+        "pairwise"
+      ],
+      id_token_signing_alg_values_supported: [
+        "RS256"
+      ],
+      claims_supported: [
+        "iss",
+        "aud",
+        "sub",
+        "iat",
+        "exp",
+        "jti",
+        "nonce",
+        "at_hash",
+        "name",
+        "given_name",
+        "middle_name",
+        "family_name",
+        "email",
+        "picture",
+        "user_friends",
+        "user_birthday",
+        "user_age_range",
+        "user_link",
+        "user_hometown",
+        "user_location",
+        "user_gender"
+      ],
+      token_endpoint: "https://graph.facebook.com/v11.0/oauth/access_token"
+    }));
+    __publicField(this, "validateConfiguration", catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await initOIDCAuth(client, {
+      scope: configuration.scope ?? configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data);
+    if (!("authResponse" in responseData)) {
+      const client = await this.createOIDCClient(configuration);
+      return await handleOIDCResponse(client, responseData);
+    } else {
+      const [sig, payload] = responseData.authResponse.signedRequest.split(".");
+      const data2 = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, "base64").toString("utf8")));
+      const hmac = createHmac("sha256", configuration.clientSecret);
+      const signature = hmac.update(payload).digest();
+      const isSignatureValid = signature.compare(Buffer.from(sig, "base64")) === 0;
+      if (!isSignatureValid) {
+        throw new IDPValidationError("Invalid signature");
+      }
+      const url = `https://graph.facebook.com/${data2.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`;
+      const response = await fetch(url);
+      if (!response.ok) {
+        throw new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`);
+      }
+      const apiData = await response.json();
+      return {
+        externalIdentifier: data2.user_id,
+        name: apiData.name,
+        email: apiData.email
+      };
+    }
+  }
+  getPublicConfiguration({ clientSecret, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    return new this.facebookIssuer.Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        response_types: [configuration.responseType || "code"]
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+  }
+}
+export {
+  FacebookProvider
+};
+//# sourceMappingURL=FacebookProvider.js.map

package/dist/development/src/model/service/idp/providers/FacebookProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FacebookProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["data"],"mappings":";;;;;;;;;;;;AAWA,MAAM,wBAAwB;AAG9B,MAAM,uBAAuB,SAAS;AAAA,EACrC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,cAAc,SAAS,OAAO;AAAA,MAC7B,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0B,SAAS,OAAO;AAAA,EAC/C,SAAS,SAAS;AAAA,EAClB,MAAM,SAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAI,OAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwB,cAAc,uBAAuB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAe,cAAc,sBAAsB,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMA,QAAO,cAAc,yBAAyB,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAO,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAI,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BA,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAI,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBA,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}

package/dist/development/src/model/service/idp/providers/OIDCHelpers.cjs

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const openidClient = require("openid-client");
+const IDPValidationError = require("../IDPValidationError.cjs");
+const IDPResponseError = require("../IDPResponseError.cjs");
+const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
+  const nonce = openidClient.generators.nonce();
+  const state = openidClient.generators.state();
+  const url = client.authorizationUrl({
+    redirect_uri: redirectUrl,
+    response_mode: responseMode,
+    scope: scope ?? "openid email",
+    nonce,
+    state
+  });
+  return {
+    authUrl: url,
+    sessionData: { nonce, state }
+  };
+};
+const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, fetchUserInfo, returnOIDCResult) => {
+  const params = "parameters" in otherData ? otherData.parameters : client.callbackParams(otherData.url);
+  if (params.state && !sessionData?.state) {
+    throw new IDPValidationError.IDPValidationError(`state is present in parameters, but missing in session data`);
+  }
+  try {
+    const result = await client.callback(redirectUrl, params, sessionData);
+    const claims = result.claims();
+    const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims;
+    const userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {};
+    const oidcResult = returnOIDCResult ? result : {};
+    return {
+      externalIdentifier: claims.sub,
+      ...oidcResult,
+      ...claimsWithoutHashes,
+      ...userInfo
+    };
+  } catch (e) {
+    if (e instanceof openidClient.errors.RPError) {
+      throw new IDPValidationError.IDPValidationError(e.message);
+    }
+    if (e instanceof openidClient.errors.OPError) {
+      const body = e.response?.body;
+      if (typeof body === "object" && typeof body?.error === "object" && typeof body.error?.message === "string") {
+        throw new IDPResponseError.IDPResponseError(body.error.message);
+      }
+      throw new IDPResponseError.IDPResponseError(e.message);
+    }
+    throw e;
+  }
+};
+exports.handleOIDCResponse = handleOIDCResponse;
+exports.initOIDCAuth = initOIDCAuth;
+//# sourceMappingURL=OIDCHelpers.cjs.map

package/dist/development/src/model/service/idp/providers/OIDCHelpers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\tfetchUserInfo?: boolean,\n\treturnOIDCResult?: boolean,\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\n\t\treturn {\n\t\t\texternalIdentifier: claims.sub,\n\t\t\t...oidcResult,\n\t\t\t...claimsWithoutHashes,\n\t\t\t...userInfo,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":["generators","IDPValidationError","errors","IDPResponseError"],"mappings":";;;;;AAMO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAEO,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,UAAA,GAC/B,eACA,qBAC0B;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAIC,mBAAAA,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAE/C,WAAO;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,GAAG;AAAA,MACH,GAAG;AAAA,MACH,GAAG;AAAA,IAAA;AAAA,EAEL,SAAS,GAAQ;AAChB,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,IAAID,mBAAAA,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAIA,iBAAAA,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;;;"}

package/dist/development/src/model/service/idp/providers/OIDCHelpers.js

@@ -0,0 +1,54 @@
+import { generators, errors } from "openid-client";
+import { IDPValidationError } from "../IDPValidationError.js";
+import { IDPResponseError } from "../IDPResponseError.js";
+const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
+  const nonce = generators.nonce();
+  const state = generators.state();
+  const url = client.authorizationUrl({
+    redirect_uri: redirectUrl,
+    response_mode: responseMode,
+    scope: scope ?? "openid email",
+    nonce,
+    state
+  });
+  return {
+    authUrl: url,
+    sessionData: { nonce, state }
+  };
+};
+const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, fetchUserInfo, returnOIDCResult) => {
+  const params = "parameters" in otherData ? otherData.parameters : client.callbackParams(otherData.url);
+  if (params.state && !sessionData?.state) {
+    throw new IDPValidationError(`state is present in parameters, but missing in session data`);
+  }
+  try {
+    const result = await client.callback(redirectUrl, params, sessionData);
+    const claims = result.claims();
+    const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims;
+    const userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {};
+    const oidcResult = returnOIDCResult ? result : {};
+    return {
+      externalIdentifier: claims.sub,
+      ...oidcResult,
+      ...claimsWithoutHashes,
+      ...userInfo
+    };
+  } catch (e) {
+    if (e instanceof errors.RPError) {
+      throw new IDPValidationError(e.message);
+    }
+    if (e instanceof errors.OPError) {
+      const body = e.response?.body;
+      if (typeof body === "object" && typeof body?.error === "object" && typeof body.error?.message === "string") {
+        throw new IDPResponseError(body.error.message);
+      }
+      throw new IDPResponseError(e.message);
+    }
+    throw e;
+  }
+};
+export {
+  handleOIDCResponse,
+  initOIDCAuth
+};
+//# sourceMappingURL=OIDCHelpers.js.map

package/dist/development/src/model/service/idp/providers/OIDCHelpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCHelpers.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\tfetchUserInfo?: boolean,\n\treturnOIDCResult?: boolean,\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\n\t\treturn {\n\t\t\texternalIdentifier: claims.sub,\n\t\t\t...oidcResult,\n\t\t\t...claimsWithoutHashes,\n\t\t\t...userInfo,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":[],"mappings":";;;AAMO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAEO,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,UAAA,GAC/B,eACA,qBAC0B;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAI,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAE/C,WAAO;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,GAAG;AAAA,MACH,GAAG;AAAA,MACH,GAAG;AAAA,IAAA;AAAA,EAEL,SAAS,GAAQ;AAChB,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,IAAI,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAI,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAI,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;"}

package/dist/development/src/model/service/idp/providers/OIDCProvider.cjs

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const openidClient = require("openid-client");
+const InvalidIDPConfigurationError = require("../InvalidIDPConfigurationError.cjs");
+const helpers = require("./helpers.cjs");
+const OIDCTypes = require("./OIDCTypes.cjs");
+const OIDCHelpers = require("./OIDCHelpers.cjs");
+const IDPValidationError = require("../IDPValidationError.cjs");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const DEFAULT_OIDC_TIMEOUT = 5e3;
+class OIDCProvider {
+  constructor() {
+    __publicField(this, "issuerCache", {});
+    __publicField(this, "validateConfiguration", helpers.catchTypesafe(OIDCTypes.OIDCConfiguration, InvalidIDPConfigurationError.InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = helpers.catchTypesafe(OIDCTypes.OIDCInitData, IDPValidationError.IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.initOIDCAuth(client, {
+      scope: configuration.scope ?? configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = helpers.catchTypesafe(OIDCTypes.OIDCResponseData, IDPValidationError.IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.handleOIDCResponse(
+      client,
+      responseData,
+      configuration.fetchUserInfo,
+      configuration.returnOIDCResult
+    );
+  }
+  getPublicConfiguration({ clientSecret, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    var _a, _b;
+    (_a = this.issuerCache)[_b = configuration.url] ?? (_a[_b] = await openidClient.Issuer.discover(configuration.url));
+    const client = new this.issuerCache[configuration.url].Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        response_types: [configuration.responseType || "code"],
+        id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? "RS256"
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+    client[openidClient.custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT });
+    return client;
+  }
+}
+exports.OIDCProvider = OIDCProvider;
+//# sourceMappingURL=OIDCProvider.cjs.map

package/dist/development/src/model/service/idp/providers/OIDCProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\tconfiguration.fetchUserInfo,\n\t\t\tconfiguration.returnOIDCResult,\n\t\t)\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer","custom"],"mappings":";;;;;;;;;;;AAQA,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwBA,QAAAA,cAAcC,UAAAA,mBAAmBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA;AAAAA,MACZ;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc;AAAA,IAAA;AAAA,EAEhB;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAvCnF,QAAA,IAAA;AAwCE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MAAA;AAAA,MAEzE;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAOC,aAAAA,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/idp/providers/OIDCProvider.js

@@ -0,0 +1,59 @@
+import { Issuer, custom } from "openid-client";
+import { InvalidIDPConfigurationError } from "../InvalidIDPConfigurationError.js";
+import { catchTypesafe } from "./helpers.js";
+import { OIDCInitData, OIDCResponseData, OIDCConfiguration } from "./OIDCTypes.js";
+import { initOIDCAuth, handleOIDCResponse } from "./OIDCHelpers.js";
+import { IDPValidationError } from "../IDPValidationError.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const DEFAULT_OIDC_TIMEOUT = 5e3;
+class OIDCProvider {
+  constructor() {
+    __publicField(this, "issuerCache", {});
+    __publicField(this, "validateConfiguration", catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError));
+  }
+  async initAuth(configuration, data) {
+    const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await initOIDCAuth(client, {
+      scope: configuration.scope ?? configuration.claims,
+      ...initData
+    });
+  }
+  async processResponse(configuration, data) {
+    const responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data);
+    const client = await this.createOIDCClient(configuration);
+    return await handleOIDCResponse(
+      client,
+      responseData,
+      configuration.fetchUserInfo,
+      configuration.returnOIDCResult
+    );
+  }
+  getPublicConfiguration({ clientSecret, ...config }) {
+    return config;
+  }
+  async createOIDCClient(configuration) {
+    var _a, _b;
+    (_a = this.issuerCache)[_b = configuration.url] ?? (_a[_b] = await Issuer.discover(configuration.url));
+    const client = new this.issuerCache[configuration.url].Client(
+      {
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        response_types: [configuration.responseType || "code"],
+        id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? "RS256"
+      },
+      void 0,
+      {
+        additionalAuthorizedParties: [...configuration.additionalAuthorizedParties ?? []]
+      }
+    );
+    client[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT });
+    return client;
+  }
+}
+export {
+  OIDCProvider
+};
+//# sourceMappingURL=OIDCProvider.js.map

package/dist/development/src/model/service/idp/providers/OIDCProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\tconfiguration.fetchUserInfo,\n\t\t\tconfiguration.returnOIDCResult,\n\t\t)\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAQA,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwB,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM;AAAA,MACZ;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc;AAAA,IAAA;AAAA,EAEhB;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAvCnF,QAAA,IAAA;AAwCE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MAAA;AAAA,MAEzE;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAO,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/idp/providers/OIDCTypes.cjs

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Typesafe = require("@contember/typesafe");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+const OIDCConfigurationOptions = Typesafe__namespace.partial({
+  responseType: Typesafe__namespace.enumeration("code", "code id_token", "code id_token token", "code token", "id_token", "id_token token", "none"),
+  claims: Typesafe__namespace.string,
+  // deprecated, use scope instead
+  scope: Typesafe__namespace.string,
+  additionalAuthorizedParties: Typesafe__namespace.array(Typesafe__namespace.string),
+  idTokenSignedResponseAlg: Typesafe__namespace.string,
+  fetchUserInfo: Typesafe__namespace.boolean,
+  returnOIDCResult: Typesafe__namespace.boolean,
+  timeout: Typesafe__namespace.number
+});
+const BaseOIDCConfiguration = Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    url: Typesafe__namespace.string,
+    clientId: Typesafe__namespace.string,
+    clientSecret: Typesafe__namespace.string
+  }),
+  OIDCConfigurationOptions
+);
+const OIDCConfiguration = Typesafe__namespace.intersection(
+  BaseOIDCConfiguration,
+  Typesafe__namespace.object({
+    url: Typesafe__namespace.string
+  })
+);
+const OIDCResponseData = Typesafe__namespace.intersection(
+  Typesafe__namespace.union(
+    Typesafe__namespace.object({
+      url: Typesafe__namespace.string
+    }),
+    Typesafe__namespace.object({
+      parameters: Typesafe__namespace.record(Typesafe__namespace.string, Typesafe__namespace.string)
+    })
+  ),
+  Typesafe__namespace.partial({
+    redirectUrl: Typesafe__namespace.string,
+    sessionData: Typesafe__namespace.partial({
+      nonce: Typesafe__namespace.string,
+      state: Typesafe__namespace.string
+    })
+  })
+);
+const OIDCInitData = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    redirectUrl: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    responseMode: Typesafe__namespace.string
+  })
+));
+exports.BaseOIDCConfiguration = BaseOIDCConfiguration;
+exports.OIDCConfiguration = OIDCConfiguration;
+exports.OIDCConfigurationOptions = OIDCConfigurationOptions;
+exports.OIDCInitData = OIDCInitData;
+exports.OIDCResponseData = OIDCResponseData;
+//# sourceMappingURL=OIDCTypes.cjs.map