@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/model/service/idp/providers/AppleProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppleProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'\nimport { catchTypesafe } from './helpers'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AAUO,MAAM,qBAAqB,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,QAAQ,SAAS;AAAA,IACjB,UAAU,SAAS;AAAA,IACnB,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwB,cAAc,oBAAoB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAM,OAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAM,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAI,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}
+{"version":3,"file":"AppleProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes.js'\nimport { catchTypesafe } from './helpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers.js'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AAUO,MAAM,qBAAqB,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,QAAQ,SAAS;AAAA,IACjB,UAAU,SAAS;AAAA,IACnB,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwB,cAAc,oBAAoB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAM,OAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAM,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAI,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}

package/dist/development/src/model/service/idp/providers/FacebookProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"FacebookProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["BaseOIDCConfiguration","Typesafe","OIDCResponseData","Issuer","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","handleOIDCResponse","data","createHmac","IDPResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,wBAAwBA,UAAAA;AAG9B,MAAM,uBAAuBC,oBAAS;AAAA,EACrCC,UAAAA;AAAAA,EACAD,oBAAS,OAAO;AAAA,IACf,cAAcA,oBAAS,OAAO;AAAA,MAC7B,aAAaA,oBAAS;AAAA,MACtB,eAAeA,oBAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0BA,oBAAS,OAAO;AAAA,EAC/C,SAASA,oBAAS;AAAA,EAClB,MAAMA,oBAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAIE,oBAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,uBAAuBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAeJ,QAAAA,cAAc,sBAAsBG,mBAAAA,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAME,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMC,QAAON,QAAAA,cAAc,yBAAyBG,mBAAAA,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAOI,OAAAA,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAIJ,mBAAAA,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BG,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAIE,iBAAAA,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBF,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"FacebookProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers.js'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError.js'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["BaseOIDCConfiguration","Typesafe","OIDCResponseData","Issuer","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","handleOIDCResponse","data","createHmac","IDPResponseError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,wBAAwBA,UAAAA;AAG9B,MAAM,uBAAuBC,oBAAS;AAAA,EACrCC,UAAAA;AAAAA,EACAD,oBAAS,OAAO;AAAA,IACf,cAAcA,oBAAS,OAAO;AAAA,MAC7B,aAAaA,oBAAS;AAAA,MACtB,eAAeA,oBAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0BA,oBAAS,OAAO;AAAA,EAC/C,SAASA,oBAAS;AAAA,EAClB,MAAMA,oBAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAIE,oBAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,uBAAuBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAeJ,QAAAA,cAAc,sBAAsBG,mBAAAA,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAME,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMC,QAAON,QAAAA,cAAc,yBAAyBG,mBAAAA,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAOI,OAAAA,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAIJ,mBAAAA,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BG,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAIE,iBAAAA,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBF,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;"}

package/dist/development/src/model/service/idp/providers/FacebookProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"FacebookProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["data"],"mappings":";;;;;;;;;;;;AAWA,MAAM,wBAAwB;AAG9B,MAAM,uBAAuB,SAAS;AAAA,EACrC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,cAAc,SAAS,OAAO;AAAA,MAC7B,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0B,SAAS,OAAO;AAAA,EAC/C,SAAS,SAAS;AAAA,EAClB,MAAM,SAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAI,OAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwB,cAAc,uBAAuB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAe,cAAc,sBAAsB,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMA,QAAO,cAAc,yBAAyB,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAO,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAI,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BA,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAI,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBA,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}
+{"version":3,"file":"FacebookProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/FacebookProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { BaseOIDCConfiguration, OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers.js'\nimport { createHmac } from 'node:crypto'\nimport { IDPResponseError } from '../IDPResponseError.js'\n\nconst FacebookConfiguration = BaseOIDCConfiguration\ntype FacebookConfiguration = ReturnType<typeof FacebookConfiguration>\n\nconst FacebookResponseData = Typesafe.union(\n\tOIDCResponseData,\n\tTypesafe.object({\n\t\tauthResponse: Typesafe.object({\n\t\t\taccessToken: Typesafe.string,\n\t\t\tsignedRequest: Typesafe.string,\n\t\t}),\n\t}),\n)\nconst FacebookResponsePayload = Typesafe.object({\n\tuser_id: Typesafe.string,\n\tcode: Typesafe.string,\n})\n\ntype FacebookResponseData = ReturnType<typeof FacebookResponseData>\n\nexport class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {\n\t// based on https://www.facebook.com/.well-known/openid-configuration/\n\t// facebook .well-known endpoint does have \"token_endpoint\" field\n\tprivate facebookIssuer = new Issuer({\n\t\tissuer: 'https://www.facebook.com',\n\t\tauthorization_endpoint: 'https://facebook.com/dialog/oauth/',\n\t\tjwks_uri: 'https://www.facebook.com/.well-known/oauth/openid/jwks/',\n\t\tresponse_types_supported: [\n\t\t\t'id_token',\n\t\t\t'token id_token',\n\t\t],\n\t\tsubject_types_supported: [\n\t\t\t'pairwise',\n\t\t],\n\t\tid_token_signing_alg_values_supported: [\n\t\t\t'RS256',\n\t\t],\n\t\tclaims_supported: [\n\t\t\t'iss',\n\t\t\t'aud',\n\t\t\t'sub',\n\t\t\t'iat',\n\t\t\t'exp',\n\t\t\t'jti',\n\t\t\t'nonce',\n\t\t\t'at_hash',\n\t\t\t'name',\n\t\t\t'given_name',\n\t\t\t'middle_name',\n\t\t\t'family_name',\n\t\t\t'email',\n\t\t\t'picture',\n\t\t\t'user_friends',\n\t\t\t'user_birthday',\n\t\t\t'user_age_range',\n\t\t\t'user_link',\n\t\t\t'user_hometown',\n\t\t\t'user_location',\n\t\t\t'user_gender',\n\t\t],\n\t\ttoken_endpoint: 'https://graph.facebook.com/v11.0/oauth/access_token',\n\t})\n\n\tvalidateConfiguration = catchTypesafe(FacebookConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(FacebookResponseData, IDPValidationError)(data)\n\n\t\tif (!('authResponse' in responseData)) {\n\t\t\tconst client = await this.createOIDCClient(configuration)\n\t\t\treturn await handleOIDCResponse(client, responseData)\n\t\t} else {\n\t\t\tconst [sig, payload] = responseData.authResponse.signedRequest.split('.')\n\t\t\tconst data = catchTypesafe(FacebookResponsePayload, IDPValidationError)(JSON.parse(Buffer.from(payload, 'base64').toString('utf8')))\n\t\t\tconst hmac = createHmac('sha256', configuration.clientSecret)\n\t\t\tconst signature = hmac.update(payload).digest()\n\t\t\tconst isSignatureValid = signature.compare(Buffer.from(sig, 'base64')) === 0\n\t\t\tif (!isSignatureValid) {\n\t\t\t\tthrow new IDPValidationError('Invalid signature')\n\t\t\t}\n\t\t\tconst url = `https://graph.facebook.com/${data.user_id}?fields=id,email,name&access_token=${responseData.authResponse.accessToken}`\n\t\t\tconst response = await fetch(url)\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new IDPResponseError(`Invalid Facebook response: [${response.status}] ${await response.text()}`)\n\t\t\t}\n\t\t\tconst apiData = await response.json()\n\n\t\t\treturn {\n\t\t\t\texternalIdentifier: data.user_id,\n\t\t\t\tname: apiData.name,\n\t\t\t\temail: apiData.email,\n\t\t\t}\n\t\t}\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: FacebookConfiguration): Partial<FacebookConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: FacebookConfiguration): Promise<Client> {\n\t\treturn new this.facebookIssuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["data"],"mappings":";;;;;;;;;;;;AAWA,MAAM,wBAAwB;AAG9B,MAAM,uBAAuB,SAAS;AAAA,EACrC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,cAAc,SAAS,OAAO;AAAA,MAC7B,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,IAAA,CACxB;AAAA,EAAA,CACD;AACF;AACA,MAAM,0BAA0B,SAAS,OAAO;AAAA,EAC/C,SAAS,SAAS;AAAA,EAClB,MAAM,SAAS;AAChB,CAAC;AAIM,MAAM,iBAA2E;AAAA,EAAjF,cAAA;AAGN,kBAAA,MAAQ,kBAAiB,IAAI,OAAO;AAAA,MACnC,QAAQ;AAAA,MACR,wBAAwB;AAAA,MACxB,UAAU;AAAA,MACV,0BAA0B;AAAA,QACzB;AAAA,QACA;AAAA,MAAA;AAAA,MAED,yBAAyB;AAAA,QACxB;AAAA,MAAA;AAAA,MAED,uCAAuC;AAAA,QACtC;AAAA,MAAA;AAAA,MAED,kBAAkB;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAED,gBAAgB;AAAA,IAAA,CAChB,CAAA;AAED,kBAAA,MAAA,yBAAwB,cAAc,uBAAuB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEzF,MAAa,SAAS,eAAsC,MAA2C;AACtG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAsC,MAAqC;AACvG,UAAM,eAAe,cAAc,sBAAsB,kBAAkB,EAAE,IAAI;AAEjF,QAAI,EAAE,kBAAkB,eAAe;AACtC,YAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,aAAO,MAAM,mBAAmB,QAAQ,YAAY;AAAA,IACrD,OAAO;AACN,YAAM,CAAC,KAAK,OAAO,IAAI,aAAa,aAAa,cAAc,MAAM,GAAG;AACxE,YAAMA,QAAO,cAAc,yBAAyB,kBAAkB,EAAE,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC,CAAC;AACnI,YAAM,OAAO,WAAW,UAAU,cAAc,YAAY;AAC5D,YAAM,YAAY,KAAK,OAAO,OAAO,EAAE,OAAA;AACvC,YAAM,mBAAmB,UAAU,QAAQ,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM;AAC3E,UAAI,CAAC,kBAAkB;AACtB,cAAM,IAAI,mBAAmB,mBAAmB;AAAA,MACjD;AACA,YAAM,MAAM,8BAA8BA,MAAK,OAAO,sCAAsC,aAAa,aAAa,WAAW;AACjI,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,IAAI,iBAAiB,+BAA+B,SAAS,MAAM,KAAK,MAAM,SAAS,KAAA,CAAM,EAAE;AAAA,MACtG;AACA,YAAM,UAAU,MAAM,SAAS,KAAA;AAE/B,aAAO;AAAA,QACN,oBAAoBA,MAAK;AAAA,QACzB,MAAM,QAAQ;AAAA,QACd,OAAO,QAAQ;AAAA,MAAA;AAAA,IAEjB;AAAA,EACD;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAiE;AAC1G,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAuD;AACrF,WAAO,IAAI,KAAK,eAAe;AAAA,MAC9B;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;"}

package/dist/development/src/model/service/idp/providers/OIDCHelpers.cjs

@@ -1,8 +1,22 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const openidClient = require("openid-client");
+const jose = require("jose");
 const IDPValidationError = require("../IDPValidationError.cjs");
 const IDPResponseError = require("../IDPResponseError.cjs");
+const tokenSetToSessionState = (tokenSet, sessionId, prevTokens) => {
+  const refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === "string" ? prevTokens.refresh_token : void 0);
+  const idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === "string" ? prevTokens.id_token : void 0);
+  return {
+    sessionId,
+    tokens: {
+      ...refreshToken ? { refresh_token: refreshToken } : {},
+      ...tokenSet.access_token ? { access_token: tokenSet.access_token } : {},
+      ...idToken ? { id_token: idToken } : {}
+    },
+    expiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1e3) : void 0
+  };
+};
 const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
   const nonce = openidClient.generators.nonce();
   const state = openidClient.generators.state();
@@ -18,7 +32,11 @@ const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
     sessionData: { nonce, state }
   };
 };
-const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, fetchUserInfo, returnOIDCResult) => {
+const getClaim = (source, path) => path.split(".").reduce(
+  (acc, key) => acc != null && typeof acc === "object" ? acc[key] : void 0,
+  source
+);
+const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, { fetchUserInfo, returnOIDCResult, captureSession, claimMapping } = {}) => {
   const params = "parameters" in otherData ? otherData.parameters : client.callbackParams(otherData.url);
   if (params.state && !sessionData?.state) {
     throw new IDPValidationError.IDPValidationError(`state is present in parameters, but missing in session data`);
@@ -29,11 +47,39 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
     const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims;
     const userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {};
     const oidcResult = returnOIDCResult ? result : {};
+    const idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === "string" ? claims.sid : void 0) : void 0;
+    let source = { ...claimsWithoutHashes, ...userInfo };
+    const attributesKey = claimMapping?.attributesKey;
+    if (attributesKey) {
+      const nested = source[attributesKey];
+      if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+        source = { ...nested, ...source };
+      }
+    }
+    const rawEmailVerified = source.email_verified;
+    const emailVerified = rawEmailVerified === true || rawEmailVerified === "true";
+    const mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? "sub");
+    let externalIdentifier;
+    if (mappedSubject === void 0 || mappedSubject === null) {
+      externalIdentifier = claims.sub;
+    } else if (typeof mappedSubject === "string" || typeof mappedSubject === "number") {
+      externalIdentifier = String(mappedSubject);
+    } else {
+      throw new IDPValidationError.IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`);
+    }
+    if (externalIdentifier === "") {
+      throw new IDPValidationError.IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`);
+    }
+    const email = getClaim(source, claimMapping?.email ?? "email");
+    const name = getClaim(source, claimMapping?.name ?? "name");
     return {
-      externalIdentifier: claims.sub,
       ...oidcResult,
-      ...claimsWithoutHashes,
-      ...userInfo
+      ...source,
+      externalIdentifier,
+      email: typeof email === "string" ? email : void 0,
+      name: typeof name === "string" ? name : void 0,
+      emailVerified,
+      ...idpSession ? { idpSession } : {}
     };
   } catch (e) {
     if (e instanceof openidClient.errors.RPError) {
@@ -49,6 +95,127 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
     throw e;
   }
 };
+const REVOKED_OIDC_ERRORS = /* @__PURE__ */ new Set(["invalid_grant", "invalid_token", "expired_token"]);
+const revalidateOIDC = async (client, method, session) => {
+  const tokens = session.tokens ?? {};
+  const refreshToken = typeof tokens.refresh_token === "string" ? tokens.refresh_token : void 0;
+  const accessToken = typeof tokens.access_token === "string" ? tokens.access_token : void 0;
+  try {
+    if (method === "refresh") {
+      if (!refreshToken) {
+        return { status: "revoked", reason: "no_refresh_token" };
+      }
+      const tokenSet = await client.refresh(refreshToken);
+      let claims;
+      try {
+        claims = tokenSet.id_token ? tokenSet.claims() : void 0;
+      } catch {
+        claims = void 0;
+      }
+      return {
+        status: "valid",
+        claims,
+        // carry the stored tokens forward: a non-rotating IdP omits the refresh token here
+        idpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens)
+      };
+    }
+    if (method === "userinfo") {
+      if (!accessToken) {
+        return { status: "revoked", reason: "no_access_token" };
+      }
+      const userInfo = await client.userinfo(accessToken);
+      return { status: "valid", claims: userInfo };
+    }
+    const token = accessToken ?? refreshToken;
+    if (!token) {
+      return { status: "revoked", reason: "no_token" };
+    }
+    const result = await client.introspect(token, accessToken ? "access_token" : "refresh_token");
+    if (!result.active) {
+      return { status: "revoked", reason: "inactive" };
+    }
+    return { status: "valid" };
+  } catch (e) {
+    if (e instanceof openidClient.errors.OPError) {
+      if (typeof e.error === "string" && REVOKED_OIDC_ERRORS.has(e.error)) {
+        return { status: "revoked", reason: e.error };
+      }
+      if (method === "userinfo" && e.response?.statusCode === 401) {
+        return { status: "revoked", reason: "userinfo_unauthorized" };
+      }
+    }
+    throw e;
+  }
+};
+const buildOIDCLogoutUrl = (client, { idToken, postLogoutRedirectUri }) => {
+  if (!client.issuer.metadata.end_session_endpoint) {
+    return null;
+  }
+  return client.endSessionUrl({
+    ...idToken ? { id_token_hint: idToken } : {},
+    ...postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}
+  });
+};
+const BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+const LOGOUT_TOKEN_MAX_AGE_SECONDS = 120;
+const LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5;
+const remoteJwksCache = /* @__PURE__ */ new Map();
+const getRemoteJwks = (jwksUri) => {
+  let jwks = remoteJwksCache.get(jwksUri);
+  if (!jwks) {
+    jwks = jose.createRemoteJWKSet(new URL(jwksUri));
+    remoteJwksCache.set(jwksUri, jwks);
+  }
+  return jwks;
+};
+const validateOIDCLogoutToken = async (client, issuer, logoutToken) => {
+  const jwksUri = issuer.metadata.jwks_uri;
+  if (!jwksUri) {
+    throw new IDPValidationError.IDPValidationError("IdP has no jwks_uri; cannot verify logout token");
+  }
+  const clientId = client.metadata.client_id;
+  if (typeof clientId !== "string" || clientId === "") {
+    throw new IDPValidationError.IDPValidationError("cannot verify logout token audience: client_id is missing");
+  }
+  const expectedAlg = typeof client.metadata.id_token_signed_response_alg === "string" ? client.metadata.id_token_signed_response_alg : "RS256";
+  const jwks = getRemoteJwks(jwksUri);
+  let payload;
+  try {
+    const verified = await jose.jwtVerify(logoutToken, jwks, {
+      issuer: issuer.metadata.issuer,
+      audience: clientId,
+      // pin to the provider's configured signing alg so a JWKS containing a symmetric/none key
+      // can never be selected (defence-in-depth on top of jose's own key-type check).
+      algorithms: [expectedAlg],
+      // §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;
+      // `requiredClaims` makes `exp` required (jose only checks `exp` when present).
+      maxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,
+      requiredClaims: ["exp"],
+      clockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS
+    });
+    payload = verified.payload;
+  } catch (e) {
+    throw new IDPValidationError.IDPValidationError(`Invalid logout token: ${e?.message ?? "verification failed"}`);
+  }
+  if ("nonce" in payload) {
+    throw new IDPValidationError.IDPValidationError("Logout token must not contain a nonce");
+  }
+  const events = payload.events;
+  const hasLogoutEvent = typeof events === "object" && events !== null && BACKCHANNEL_LOGOUT_EVENT in events;
+  if (!hasLogoutEvent) {
+    throw new IDPValidationError.IDPValidationError("Logout token is missing the back-channel-logout event");
+  }
+  const sid = typeof payload.sid === "string" ? payload.sid : void 0;
+  const sub = typeof payload.sub === "string" ? payload.sub : void 0;
+  if (!sid && !sub) {
+    throw new IDPValidationError.IDPValidationError("Logout token must contain a sid or sub claim");
+  }
+  return { sid, sub };
+};
+exports.buildOIDCLogoutUrl = buildOIDCLogoutUrl;
 exports.handleOIDCResponse = handleOIDCResponse;
 exports.initOIDCAuth = initOIDCAuth;
+exports.revalidateOIDC = revalidateOIDC;
+exports.tokenSetToSessionState = tokenSetToSessionState;
+exports.validateOIDCLogoutToken = validateOIDCLogoutToken;
 //# sourceMappingURL=OIDCHelpers.cjs.map

package/dist/development/src/model/service/idp/providers/OIDCHelpers.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\tfetchUserInfo?: boolean,\n\treturnOIDCResult?: boolean,\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\n\t\treturn {\n\t\t\texternalIdentifier: claims.sub,\n\t\t\t...oidcResult,\n\t\t\t...claimsWithoutHashes,\n\t\t\t...userInfo,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":["generators","IDPValidationError","errors","IDPResponseError"],"mappings":";;;;;AAMO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAEO,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,UAAA,GAC/B,eACA,qBAC0B;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAIC,mBAAAA,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAE/C,WAAO;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,GAAG;AAAA,MACH,GAAG;AAAA,MACH,GAAG;AAAA,IAAA;AAAA,EAEL,SAAS,GAAQ;AAChB,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,IAAID,mBAAAA,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAIA,iBAAAA,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;;;"}
+{"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators, Issuer, TokenSet } from 'openid-client'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\nimport { OIDCClaimMapping, OIDCResponseData } from './OIDCTypes.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { IDPResponseError } from '../IDPResponseError.js'\nimport {\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\n\n/**\n * Build the persisted session state from an OIDC token set. Stores the tokens needed for\n * later re-validation (refresh/access) and SLO (id_token); the whole `tokens` blob is\n * encrypted at rest by the command layer.\n *\n * `prevTokens` carries the previously stored tokens forward: a refresh-grant response MAY omit\n * the refresh token (RFC 6749 §6 — IdPs that don't rotate just don't re-send it), in which case\n * the client must keep using the old one. Without this fallback a non-rotating IdP would persist\n * a session with no refresh token and be revoked (`no_refresh_token`) on the very next tick.\n */\nexport const tokenSetToSessionState = (tokenSet: TokenSet, sessionId?: string, prevTokens?: Record<string, unknown>): IDPSessionState => {\n\tconst refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === 'string' ? prevTokens.refresh_token : undefined)\n\tconst idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === 'string' ? prevTokens.id_token : undefined)\n\treturn {\n\t\tsessionId,\n\t\ttokens: {\n\t\t\t...(refreshToken ? { refresh_token: refreshToken } : {}),\n\t\t\t...(tokenSet.access_token ? { access_token: tokenSet.access_token } : {}),\n\t\t\t...(idToken ? { id_token: idToken } : {}),\n\t\t},\n\t\texpiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1000) : undefined,\n\t}\n}\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport type HandleOIDCResponseOptions = {\n\tfetchUserInfo?: boolean\n\treturnOIDCResult?: boolean\n\tcaptureSession?: boolean\n\tclaimMapping?: OIDCClaimMapping\n}\n\n/** Read a claim by name, supporting dot-paths into nested objects (`a.b.c`). */\nconst getClaim = (source: Record<string, unknown>, path: string): unknown =>\n\tpath.split('.').reduce<unknown>(\n\t\t(acc, key) => (acc != null && typeof acc === 'object' ? (acc as Record<string, unknown>)[key] : undefined),\n\t\tsource,\n\t)\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\t{ fetchUserInfo, returnOIDCResult, captureSession, claimMapping }: HandleOIDCResponseOptions = {},\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\t\tconst idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === 'string' ? claims.sid : undefined) : undefined\n\n\t\t// Merge ID-token claims with userInfo (userInfo wins, per spec). Then optionally lift a\n\t\t// nested attributes object to the top level so providers that nest their claims (notably\n\t\t// Apereo CAS userinfo, which returns them under `attributes`) map without a code change.\n\t\t// The nested attributes are UNSIGNED, so they must not override a claim already present in\n\t\t// the (signature-verified) ID-token / userInfo merge — spread them UNDER `source`, not over\n\t\t// it, so a signed `sub` / `email_verified` keeps precedence over an attributes-level value.\n\t\tlet source: Record<string, unknown> = { ...claimsWithoutHashes, ...userInfo }\n\t\tconst attributesKey = claimMapping?.attributesKey\n\t\tif (attributesKey) {\n\t\t\tconst nested = source[attributesKey]\n\t\t\tif (nested && typeof nested === 'object' && !Array.isArray(nested)) {\n\t\t\t\tsource = { ...(nested as Record<string, unknown>), ...source }\n\t\t\t}\n\t\t}\n\n\t\t// The OIDC `email_verified` claim is a boolean per spec, but some providers send the\n\t\t// string \"true\". userInfo (and any unwrapped attributes) take precedence over the ID token.\n\t\tconst rawEmailVerified = source.email_verified\n\t\tconst emailVerified = rawEmailVerified === true || rawEmailVerified === 'true'\n\n\t\t// `externalIdentifier` is the federation key persisted in `person_identity_provider` and\n\t\t// matched on the next sign-in, so it must be a stable scalar. A `claimMapping` that pointed\n\t\t// it at an object/array would otherwise be coerced by `String(...)` to `'[object Object]'` /\n\t\t// a comma-join — collapsing every user of the provider onto one key (account takeover). Fail\n\t\t// closed instead. The default `sub` path is safe (openid-client guarantees `sub` is a string).\n\t\tconst mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? 'sub')\n\t\tlet externalIdentifier: string\n\t\tif (mappedSubject === undefined || mappedSubject === null) {\n\t\t\texternalIdentifier = claims.sub\n\t\t} else if (typeof mappedSubject === 'string' || typeof mappedSubject === 'number') {\n\t\t\texternalIdentifier = String(mappedSubject)\n\t\t} else {\n\t\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`)\n\t\t}\n\t\tif (externalIdentifier === '') {\n\t\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`)\n\t\t}\n\n\t\t// `email` / `name` are typed `string | undefined` on IDPResponse and feed the by-e-mail\n\t\t// account lookup (which crashes on a non-string). `...source` already placed the raw claim\n\t\t// of whatever type, so OVERWRITE (don't conditionally add) with the mapped value when it is\n\t\t// a string, otherwise `undefined` — a non-string claim must not leak through `...source`.\n\t\tconst email = getClaim(source, claimMapping?.email ?? 'email')\n\t\tconst name = getClaim(source, claimMapping?.name ?? 'name')\n\n\t\treturn {\n\t\t\t...oidcResult,\n\t\t\t...source,\n\t\t\texternalIdentifier,\n\t\t\temail: typeof email === 'string' ? email : undefined,\n\t\t\tname: typeof name === 'string' ? name : undefined,\n\t\t\temailVerified,\n\t\t\t...(idpSession ? { idpSession } : {}),\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n\n/** OIDC errors that definitively mean \"this session is no longer valid at the IdP\". */\nconst REVOKED_OIDC_ERRORS = new Set(['invalid_grant', 'invalid_token', 'expired_token'])\n\n/**\n * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive\n * IdP responses (invalid/expired grant or inactive introspection). Transient failures\n * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP\n * downtime must not log everyone out.\n */\nexport const revalidateOIDC = async (\n\tclient: Client,\n\tmethod: 'refresh' | 'userinfo' | 'introspection',\n\tsession: IDPSessionState,\n): Promise<RevalidationResult> => {\n\tconst tokens = session.tokens ?? {}\n\tconst refreshToken = typeof tokens.refresh_token === 'string' ? tokens.refresh_token : undefined\n\tconst accessToken = typeof tokens.access_token === 'string' ? tokens.access_token : undefined\n\ttry {\n\t\tif (method === 'refresh') {\n\t\t\tif (!refreshToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_refresh_token' }\n\t\t\t}\n\t\t\tconst tokenSet = await client.refresh(refreshToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\ttry {\n\t\t\t\tclaims = tokenSet.id_token ? tokenSet.claims() : undefined\n\t\t\t} catch {\n\t\t\t\tclaims = undefined\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: 'valid',\n\t\t\t\tclaims,\n\t\t\t\t// carry the stored tokens forward: a non-rotating IdP omits the refresh token here\n\t\t\t\tidpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens),\n\t\t\t}\n\t\t}\n\t\tif (method === 'userinfo') {\n\t\t\tif (!accessToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_access_token' }\n\t\t\t}\n\t\t\tconst userInfo = await client.userinfo(accessToken)\n\t\t\treturn { status: 'valid', claims: userInfo }\n\t\t}\n\t\t// introspection\n\t\tconst token = accessToken ?? refreshToken\n\t\tif (!token) {\n\t\t\treturn { status: 'revoked', reason: 'no_token' }\n\t\t}\n\t\tconst result = await client.introspect(token, accessToken ? 'access_token' : 'refresh_token')\n\t\tif (!result.active) {\n\t\t\treturn { status: 'revoked', reason: 'inactive' }\n\t\t}\n\t\treturn { status: 'valid' }\n\t} catch (e: any) {\n\t\tif (e instanceof errors.OPError) {\n\t\t\tif (typeof e.error === 'string' && REVOKED_OIDC_ERRORS.has(e.error)) {\n\t\t\t\treturn { status: 'revoked', reason: e.error }\n\t\t\t}\n\t\t\t// The userinfo endpoint signals a rejected access token with a bare HTTP 401 — per\n\t\t\t// RFC 6750 the `WWW-Authenticate` error code is optional, so openid-client may not\n\t\t\t// surface a parseable `error` here. A 401 is still definitive: the token is no\n\t\t\t// longer accepted → revoked. (Introspection is NOT treated this way: it returns 200\n\t\t\t// `{active:false}` for revoked tokens, so a 401/400 there means client-auth/config\n\t\t\t// failure — transient, must not log users out.)\n\t\t\tif (method === 'userinfo' && e.response?.statusCode === 401) {\n\t\t\t\treturn { status: 'revoked', reason: 'userinfo_unauthorized' }\n\t\t\t}\n\t\t}\n\t\t// transient (network / IdP unavailable) — propagate, do not revoke\n\t\tthrow e\n\t}\n}\n\n/**\n * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null\n * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only\n * logout (legacy-IdP graceful fallback). The `id_token_hint` lets the IdP identify and confirm the\n * session to terminate; `post_logout_redirect_uri` is where the IdP returns the browser afterwards.\n */\nexport const buildOIDCLogoutUrl = (client: Client, { idToken, postLogoutRedirectUri }: LogoutUrlRequest): string | null => {\n\tif (!client.issuer.metadata.end_session_endpoint) {\n\t\treturn null\n\t}\n\treturn client.endSessionUrl({\n\t\t...(idToken ? { id_token_hint: idToken } : {}),\n\t\t...(postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}),\n\t})\n}\n\n/**\n * The OIDC Back-Channel Logout 1.0 event member that MUST be present in a logout token's `events`\n * claim. Its presence (and the absence of a `nonce`) is what distinguishes a logout token from an\n * ID token — both are signed by the same IdP, so without this check an ID token could be replayed\n * to forcibly log a user out.\n */\nconst BACKCHANNEL_LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout'\n\n/**\n * Max accepted age of a back-channel logout token, derived from its `iat`. OIDC Back-Channel Logout\n * tokens are single-use and short-lived; bounding the age (together with requiring `exp`) limits the\n * window in which a captured token could be replayed to force a logout.\n */\nconst LOGOUT_TOKEN_MAX_AGE_SECONDS = 120\nconst LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5\n\n/**\n * Remote JWKS sets keyed by `jwks_uri`. `createRemoteJWKSet` returns a function with its own internal\n * key cache + fetch cooldown, so it MUST be reused across requests — re-creating it per call (as the\n * unauthenticated back-channel endpoint would otherwise do) defeats the cache and turns every request\n * into a potential outbound JWKS fetch. Keyed by URL, so two providers sharing an IdP share the set.\n */\nconst remoteJwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>()\n\nconst getRemoteJwks = (jwksUri: string): ReturnType<typeof createRemoteJWKSet> => {\n\tlet jwks = remoteJwksCache.get(jwksUri)\n\tif (!jwks) {\n\t\tjwks = createRemoteJWKSet(new URL(jwksUri))\n\t\tremoteJwksCache.set(jwksUri, jwks)\n\t}\n\treturn jwks\n}\n\n/**\n * Validate an OIDC back-channel logout token (OIDC Back-Channel Logout 1.0 §2.4–2.6) and extract\n * the targeted `sid` / `sub`. The token is a JWT signed by the IdP; we verify the signature against\n * the issuer's JWKS and enforce the issuer + audience (client_id) the same way ID tokens are\n * verified, pinning the signing algorithm to the provider's configured one, then assert the\n * back-channel-specific claims:\n *   - `iat` is present and recent and `exp` is present (§2.4 requires both) — bounds the replay window;\n *   - `events` contains the back-channel-logout member (it really is a logout token);\n *   - it carries a `sid` and/or `sub` (otherwise there is nothing to act on);\n *   - it does NOT carry a `nonce` (a `nonce` means it is an ID token being replayed).\n * Throws {@link IDPValidationError} on any failure so the caller can answer 400.\n */\nexport const validateOIDCLogoutToken = async (client: Client, issuer: Issuer<Client>, logoutToken: string): Promise<LogoutTokenClaims> => {\n\tconst jwksUri = issuer.metadata.jwks_uri\n\tif (!jwksUri) {\n\t\tthrow new IDPValidationError('IdP has no jwks_uri; cannot verify logout token')\n\t}\n\tconst clientId = client.metadata.client_id\n\tif (typeof clientId !== 'string' || clientId === '') {\n\t\t// The `aud` check is a core anti-token-substitution defence on this unauthenticated endpoint.\n\t\t// jose treats `audience: undefined` as \"skip the aud check entirely\", so a missing client_id\n\t\t// must fail closed (reject the token) rather than fall through and accept any audience.\n\t\tthrow new IDPValidationError('cannot verify logout token audience: client_id is missing')\n\t}\n\tconst expectedAlg = typeof client.metadata.id_token_signed_response_alg === 'string'\n\t\t? client.metadata.id_token_signed_response_alg\n\t\t: 'RS256'\n\tconst jwks = getRemoteJwks(jwksUri)\n\tlet payload: Record<string, unknown>\n\ttry {\n\t\tconst verified = await jwtVerify(logoutToken, jwks, {\n\t\t\tissuer: issuer.metadata.issuer,\n\t\t\taudience: clientId,\n\t\t\t// pin to the provider's configured signing alg so a JWKS containing a symmetric/none key\n\t\t\t// can never be selected (defence-in-depth on top of jose's own key-type check).\n\t\t\talgorithms: [expectedAlg],\n\t\t\t// §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;\n\t\t\t// `requiredClaims` makes `exp` required (jose only checks `exp` when present).\n\t\t\tmaxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,\n\t\t\trequiredClaims: ['exp'],\n\t\t\tclockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS,\n\t\t})\n\t\tpayload = verified.payload as Record<string, unknown>\n\t} catch (e: any) {\n\t\tthrow new IDPValidationError(`Invalid logout token: ${e?.message ?? 'verification failed'}`)\n\t}\n\n\t// A logout token MUST NOT contain a nonce; its presence means an ID token is being replayed.\n\tif ('nonce' in payload) {\n\t\tthrow new IDPValidationError('Logout token must not contain a nonce')\n\t}\n\n\tconst events = payload.events\n\tconst hasLogoutEvent = typeof events === 'object' && events !== null && BACKCHANNEL_LOGOUT_EVENT in (events as Record<string, unknown>)\n\tif (!hasLogoutEvent) {\n\t\tthrow new IDPValidationError('Logout token is missing the back-channel-logout event')\n\t}\n\n\tconst sid = typeof payload.sid === 'string' ? payload.sid : undefined\n\tconst sub = typeof payload.sub === 'string' ? payload.sub : undefined\n\tif (!sid && !sub) {\n\t\tthrow new IDPValidationError('Logout token must contain a sid or sub claim')\n\t}\n\n\treturn { sid, sub }\n}\n"],"names":["generators","IDPValidationError","errors","IDPResponseError","createRemoteJWKSet","jwtVerify"],"mappings":";;;;;;AAwBO,MAAM,yBAAyB,CAAC,UAAoB,WAAoB,eAA0D;AACxI,QAAM,eAAe,SAAS,kBAAkB,OAAO,YAAY,kBAAkB,WAAW,WAAW,gBAAgB;AAC3H,QAAM,UAAU,SAAS,aAAa,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW;AACvG,SAAO;AAAA,IACN;AAAA,IACA,QAAQ;AAAA,MACP,GAAI,eAAe,EAAE,eAAe,aAAA,IAAiB,CAAA;AAAA,MACrD,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAA,IAAiB,CAAA;AAAA,MACtE,GAAI,UAAU,EAAE,UAAU,YAAY,CAAA;AAAA,IAAC;AAAA,IAExC,WAAW,SAAS,aAAa,IAAI,KAAK,SAAS,aAAa,GAAI,IAAI;AAAA,EAAA;AAE1E;AAEO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAUA,MAAM,WAAW,CAAC,QAAiC,SAClD,KAAK,MAAM,GAAG,EAAE;AAAA,EACf,CAAC,KAAK,QAAS,OAAO,QAAQ,OAAO,QAAQ,WAAY,IAAgC,GAAG,IAAI;AAAA,EAChG;AACD;AAEM,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,aAC/B,EAAE,eAAe,kBAAkB,gBAAgB,aAAA,IAA4C,CAAA,MACrE;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAIC,mBAAAA,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAC/C,UAAM,aAAa,iBAAiB,uBAAuB,QAAQ,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,MAAS,IAAI;AAQ9H,QAAI,SAAkC,EAAE,GAAG,qBAAqB,GAAG,SAAA;AACnE,UAAM,gBAAgB,cAAc;AACpC,QAAI,eAAe;AAClB,YAAM,SAAS,OAAO,aAAa;AACnC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AACnE,iBAAS,EAAE,GAAI,QAAoC,GAAG,OAAA;AAAA,MACvD;AAAA,IACD;AAIA,UAAM,mBAAmB,OAAO;AAChC,UAAM,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAOxE,UAAM,gBAAgB,SAAS,QAAQ,cAAc,sBAAsB,KAAK;AAChF,QAAI;AACJ,QAAI,kBAAkB,UAAa,kBAAkB,MAAM;AAC1D,2BAAqB,OAAO;AAAA,IAC7B,WAAW,OAAO,kBAAkB,YAAY,OAAO,kBAAkB,UAAU;AAClF,2BAAqB,OAAO,aAAa;AAAA,IAC1C,OAAO;AACN,YAAM,IAAIA,mBAAAA,mBAAmB,2DAA2D;AAAA,IACzF;AACA,QAAI,uBAAuB,IAAI;AAC9B,YAAM,IAAIA,mBAAAA,mBAAmB,gEAAgE;AAAA,IAC9F;AAMA,UAAM,QAAQ,SAAS,QAAQ,cAAc,SAAS,OAAO;AAC7D,UAAM,OAAO,SAAS,QAAQ,cAAc,QAAQ,MAAM;AAE1D,WAAO;AAAA,MACN,GAAG;AAAA,MACH,GAAG;AAAA,MACH;AAAA,MACA,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,MAC3C,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,MACxC;AAAA,MACA,GAAI,aAAa,EAAE,eAAe,CAAA;AAAA,IAAC;AAAA,EAErC,SAAS,GAAQ;AAChB,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,IAAID,mBAAAA,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAIA,iBAAAA,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;AAGA,MAAM,sBAAsB,oBAAI,IAAI,CAAC,iBAAiB,iBAAiB,eAAe,CAAC;AAQhF,MAAM,iBAAiB,OAC7B,QACA,QACA,YACiC;AACjC,QAAM,SAAS,QAAQ,UAAU,CAAA;AACjC,QAAM,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB;AACvF,QAAM,cAAc,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACpF,MAAI;AACH,QAAI,WAAW,WAAW;AACzB,UAAI,CAAC,cAAc;AAClB,eAAO,EAAE,QAAQ,WAAW,QAAQ,mBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,QAAQ,YAAY;AAClD,UAAI;AACJ,UAAI;AACH,iBAAS,SAAS,WAAW,SAAS,OAAA,IAAW;AAAA,MAClD,QAAQ;AACP,iBAAS;AAAA,MACV;AACA,aAAO;AAAA,QACN,QAAQ;AAAA,QACR;AAAA;AAAA,QAEA,YAAY,uBAAuB,UAAU,QAAQ,WAAW,MAAM;AAAA,MAAA;AAAA,IAExE;AACA,QAAI,WAAW,YAAY;AAC1B,UAAI,CAAC,aAAa;AACjB,eAAO,EAAE,QAAQ,WAAW,QAAQ,kBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,SAAS,WAAW;AAClD,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAA;AAAA,IACnC;AAEA,UAAM,QAAQ,eAAe;AAC7B,QAAI,CAAC,OAAO;AACX,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,OAAO,WAAW,OAAO,cAAc,iBAAiB,eAAe;AAC5F,QAAI,CAAC,OAAO,QAAQ;AACnB,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,WAAO,EAAE,QAAQ,QAAA;AAAA,EAClB,SAAS,GAAQ;AAChB,QAAI,aAAaD,aAAAA,OAAO,SAAS;AAChC,UAAI,OAAO,EAAE,UAAU,YAAY,oBAAoB,IAAI,EAAE,KAAK,GAAG;AACpE,eAAO,EAAE,QAAQ,WAAW,QAAQ,EAAE,MAAA;AAAA,MACvC;AAOA,UAAI,WAAW,cAAc,EAAE,UAAU,eAAe,KAAK;AAC5D,eAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAA;AAAA,MACrC;AAAA,IACD;AAEA,UAAM;AAAA,EACP;AACD;AAQO,MAAM,qBAAqB,CAAC,QAAgB,EAAE,SAAS,4BAA6D;AAC1H,MAAI,CAAC,OAAO,OAAO,SAAS,sBAAsB;AACjD,WAAO;AAAA,EACR;AACA,SAAO,OAAO,cAAc;AAAA,IAC3B,GAAI,UAAU,EAAE,eAAe,QAAA,IAAY,CAAA;AAAA,IAC3C,GAAI,wBAAwB,EAAE,0BAA0B,0BAA0B,CAAA;AAAA,EAAC,CACnF;AACF;AAQA,MAAM,2BAA2B;AAOjC,MAAM,+BAA+B;AACrC,MAAM,uCAAuC;AAQ7C,MAAM,sCAAsB,IAAA;AAE5B,MAAM,gBAAgB,CAAC,YAA2D;AACjF,MAAI,OAAO,gBAAgB,IAAI,OAAO;AACtC,MAAI,CAAC,MAAM;AACV,WAAOE,KAAAA,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAC1C,oBAAgB,IAAI,SAAS,IAAI;AAAA,EAClC;AACA,SAAO;AACR;AAcO,MAAM,0BAA0B,OAAO,QAAgB,QAAwB,gBAAoD;AACzI,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,CAAC,SAAS;AACb,UAAM,IAAIH,mBAAAA,mBAAmB,iDAAiD;AAAA,EAC/E;AACA,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAIpD,UAAM,IAAIA,mBAAAA,mBAAmB,2DAA2D;AAAA,EACzF;AACA,QAAM,cAAc,OAAO,OAAO,SAAS,iCAAiC,WACzE,OAAO,SAAS,+BAChB;AACH,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI;AACJ,MAAI;AACH,UAAM,WAAW,MAAMI,eAAU,aAAa,MAAM;AAAA,MACnD,QAAQ,OAAO,SAAS;AAAA,MACxB,UAAU;AAAA;AAAA;AAAA,MAGV,YAAY,CAAC,WAAW;AAAA;AAAA;AAAA,MAGxB,aAAa;AAAA,MACb,gBAAgB,CAAC,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAAA,CAChB;AACD,cAAU,SAAS;AAAA,EACpB,SAAS,GAAQ;AAChB,UAAM,IAAIJ,mBAAAA,mBAAmB,yBAAyB,GAAG,WAAW,qBAAqB,EAAE;AAAA,EAC5F;AAGA,MAAI,WAAW,SAAS;AACvB,UAAM,IAAIA,mBAAAA,mBAAmB,uCAAuC;AAAA,EACrE;AAEA,QAAM,SAAS,QAAQ;AACvB,QAAM,iBAAiB,OAAO,WAAW,YAAY,WAAW,QAAQ,4BAA6B;AACrG,MAAI,CAAC,gBAAgB;AACpB,UAAM,IAAIA,mBAAAA,mBAAmB,uDAAuD;AAAA,EACrF;AAEA,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,MAAI,CAAC,OAAO,CAAC,KAAK;AACjB,UAAM,IAAIA,mBAAAA,mBAAmB,8CAA8C;AAAA,EAC5E;AAEA,SAAO,EAAE,KAAK,IAAA;AACf;;;;;;;"}

package/dist/development/src/model/service/idp/providers/OIDCHelpers.js

@@ -1,6 +1,20 @@
 import { generators, errors } from "openid-client";
+import { jwtVerify, createRemoteJWKSet } from "jose";
 import { IDPValidationError } from "../IDPValidationError.js";
 import { IDPResponseError } from "../IDPResponseError.js";
+const tokenSetToSessionState = (tokenSet, sessionId, prevTokens) => {
+  const refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === "string" ? prevTokens.refresh_token : void 0);
+  const idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === "string" ? prevTokens.id_token : void 0);
+  return {
+    sessionId,
+    tokens: {
+      ...refreshToken ? { refresh_token: refreshToken } : {},
+      ...tokenSet.access_token ? { access_token: tokenSet.access_token } : {},
+      ...idToken ? { id_token: idToken } : {}
+    },
+    expiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1e3) : void 0
+  };
+};
 const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
   const nonce = generators.nonce();
   const state = generators.state();
@@ -16,7 +30,11 @@ const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
     sessionData: { nonce, state }
   };
 };
-const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, fetchUserInfo, returnOIDCResult) => {
+const getClaim = (source, path) => path.split(".").reduce(
+  (acc, key) => acc != null && typeof acc === "object" ? acc[key] : void 0,
+  source
+);
+const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, { fetchUserInfo, returnOIDCResult, captureSession, claimMapping } = {}) => {
   const params = "parameters" in otherData ? otherData.parameters : client.callbackParams(otherData.url);
   if (params.state && !sessionData?.state) {
     throw new IDPValidationError(`state is present in parameters, but missing in session data`);
@@ -27,11 +45,39 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
     const { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims;
     const userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {};
     const oidcResult = returnOIDCResult ? result : {};
+    const idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === "string" ? claims.sid : void 0) : void 0;
+    let source = { ...claimsWithoutHashes, ...userInfo };
+    const attributesKey = claimMapping?.attributesKey;
+    if (attributesKey) {
+      const nested = source[attributesKey];
+      if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+        source = { ...nested, ...source };
+      }
+    }
+    const rawEmailVerified = source.email_verified;
+    const emailVerified = rawEmailVerified === true || rawEmailVerified === "true";
+    const mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? "sub");
+    let externalIdentifier;
+    if (mappedSubject === void 0 || mappedSubject === null) {
+      externalIdentifier = claims.sub;
+    } else if (typeof mappedSubject === "string" || typeof mappedSubject === "number") {
+      externalIdentifier = String(mappedSubject);
+    } else {
+      throw new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`);
+    }
+    if (externalIdentifier === "") {
+      throw new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`);
+    }
+    const email = getClaim(source, claimMapping?.email ?? "email");
+    const name = getClaim(source, claimMapping?.name ?? "name");
     return {
-      externalIdentifier: claims.sub,
       ...oidcResult,
-      ...claimsWithoutHashes,
-      ...userInfo
+      ...source,
+      externalIdentifier,
+      email: typeof email === "string" ? email : void 0,
+      name: typeof name === "string" ? name : void 0,
+      emailVerified,
+      ...idpSession ? { idpSession } : {}
     };
   } catch (e) {
     if (e instanceof errors.RPError) {
@@ -47,8 +93,129 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
     throw e;
   }
 };
+const REVOKED_OIDC_ERRORS = /* @__PURE__ */ new Set(["invalid_grant", "invalid_token", "expired_token"]);
+const revalidateOIDC = async (client, method, session) => {
+  const tokens = session.tokens ?? {};
+  const refreshToken = typeof tokens.refresh_token === "string" ? tokens.refresh_token : void 0;
+  const accessToken = typeof tokens.access_token === "string" ? tokens.access_token : void 0;
+  try {
+    if (method === "refresh") {
+      if (!refreshToken) {
+        return { status: "revoked", reason: "no_refresh_token" };
+      }
+      const tokenSet = await client.refresh(refreshToken);
+      let claims;
+      try {
+        claims = tokenSet.id_token ? tokenSet.claims() : void 0;
+      } catch {
+        claims = void 0;
+      }
+      return {
+        status: "valid",
+        claims,
+        // carry the stored tokens forward: a non-rotating IdP omits the refresh token here
+        idpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens)
+      };
+    }
+    if (method === "userinfo") {
+      if (!accessToken) {
+        return { status: "revoked", reason: "no_access_token" };
+      }
+      const userInfo = await client.userinfo(accessToken);
+      return { status: "valid", claims: userInfo };
+    }
+    const token = accessToken ?? refreshToken;
+    if (!token) {
+      return { status: "revoked", reason: "no_token" };
+    }
+    const result = await client.introspect(token, accessToken ? "access_token" : "refresh_token");
+    if (!result.active) {
+      return { status: "revoked", reason: "inactive" };
+    }
+    return { status: "valid" };
+  } catch (e) {
+    if (e instanceof errors.OPError) {
+      if (typeof e.error === "string" && REVOKED_OIDC_ERRORS.has(e.error)) {
+        return { status: "revoked", reason: e.error };
+      }
+      if (method === "userinfo" && e.response?.statusCode === 401) {
+        return { status: "revoked", reason: "userinfo_unauthorized" };
+      }
+    }
+    throw e;
+  }
+};
+const buildOIDCLogoutUrl = (client, { idToken, postLogoutRedirectUri }) => {
+  if (!client.issuer.metadata.end_session_endpoint) {
+    return null;
+  }
+  return client.endSessionUrl({
+    ...idToken ? { id_token_hint: idToken } : {},
+    ...postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}
+  });
+};
+const BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+const LOGOUT_TOKEN_MAX_AGE_SECONDS = 120;
+const LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5;
+const remoteJwksCache = /* @__PURE__ */ new Map();
+const getRemoteJwks = (jwksUri) => {
+  let jwks = remoteJwksCache.get(jwksUri);
+  if (!jwks) {
+    jwks = createRemoteJWKSet(new URL(jwksUri));
+    remoteJwksCache.set(jwksUri, jwks);
+  }
+  return jwks;
+};
+const validateOIDCLogoutToken = async (client, issuer, logoutToken) => {
+  const jwksUri = issuer.metadata.jwks_uri;
+  if (!jwksUri) {
+    throw new IDPValidationError("IdP has no jwks_uri; cannot verify logout token");
+  }
+  const clientId = client.metadata.client_id;
+  if (typeof clientId !== "string" || clientId === "") {
+    throw new IDPValidationError("cannot verify logout token audience: client_id is missing");
+  }
+  const expectedAlg = typeof client.metadata.id_token_signed_response_alg === "string" ? client.metadata.id_token_signed_response_alg : "RS256";
+  const jwks = getRemoteJwks(jwksUri);
+  let payload;
+  try {
+    const verified = await jwtVerify(logoutToken, jwks, {
+      issuer: issuer.metadata.issuer,
+      audience: clientId,
+      // pin to the provider's configured signing alg so a JWKS containing a symmetric/none key
+      // can never be selected (defence-in-depth on top of jose's own key-type check).
+      algorithms: [expectedAlg],
+      // §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;
+      // `requiredClaims` makes `exp` required (jose only checks `exp` when present).
+      maxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,
+      requiredClaims: ["exp"],
+      clockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS
+    });
+    payload = verified.payload;
+  } catch (e) {
+    throw new IDPValidationError(`Invalid logout token: ${e?.message ?? "verification failed"}`);
+  }
+  if ("nonce" in payload) {
+    throw new IDPValidationError("Logout token must not contain a nonce");
+  }
+  const events = payload.events;
+  const hasLogoutEvent = typeof events === "object" && events !== null && BACKCHANNEL_LOGOUT_EVENT in events;
+  if (!hasLogoutEvent) {
+    throw new IDPValidationError("Logout token is missing the back-channel-logout event");
+  }
+  const sid = typeof payload.sid === "string" ? payload.sid : void 0;
+  const sub = typeof payload.sub === "string" ? payload.sub : void 0;
+  if (!sid && !sub) {
+    throw new IDPValidationError("Logout token must contain a sid or sub claim");
+  }
+  return { sid, sub };
+};
 export {
+  buildOIDCLogoutUrl,
   handleOIDCResponse,
-  initOIDCAuth
+  initOIDCAuth,
+  revalidateOIDC,
+  tokenSetToSessionState,
+  validateOIDCLogoutToken
 };
 //# sourceMappingURL=OIDCHelpers.js.map